wrangler 4.147.0 → 4.148.0

package/wrangler-dist/cli.js

@@ -3593,12 +3593,23 @@ function findRedirectedWranglerConfig(cwd2, userConfigPath) {
     );
   }
   if (userConfigPath) {
-    if (path28__namespace.default.join(path28__namespace.default.dirname(userConfigPath), PATH_TO_DEPLOY_CONFIG) !== deployConfigPath) {
+    const expectedDeployConfigPath = path28__namespace.default.join(
+      path28__namespace.default.dirname(userConfigPath),
+      PATH_TO_DEPLOY_CONFIG
+    );
+    if (expectedDeployConfigPath !== deployConfigPath) {
       throw new UserError(
         esm_default`
 					Found both a user configuration file at "${path28__namespace.default.relative(".", userConfigPath)}"
 					and a deploy configuration file at "${path28__namespace.default.relative(".", deployConfigPath)}".
 					But these do not share the same base path so it is not clear which should be used.
+
+					A deploy configuration file is generated by a build tool to redirect Wrangler to the configuration it generated.
+					It is only applied when it sits alongside the user configuration file, which here would be "${path28__namespace.default.relative(".", expectedDeployConfigPath)}".
+
+					Please either delete "${path28__namespace.default.relative(".", deployConfigPath)}" if it is left over from a previous build,
+					or try running this command from the directory containing the configuration you want to use.
+					See https://developers.cloudflare.com/workers/wrangler/configuration/#generated-wrangler-configuration
 				`,
         { telemetryMessage: false }
       );
@@ -24213,6 +24224,13 @@ Please add a binding for each to "${fieldPath}.bindings":
         "string",
         ["single-page-application", "404-page", "none"]
       ) && isValid;
+      isValid = validateOptionalProperty(
+        diagnostics,
+        field,
+        "base_path",
+        value.base_path,
+        "string"
+      ) && isValid;
       if (value.run_worker_first !== void 0) {
         if (typeof value.run_worker_first === "boolean") {
           isValid = validateOptionalProperty(
@@ -24243,6 +24261,7 @@ Please add a binding for each to "${fieldPath}.bindings":
         "binding",
         "html_handling",
         "not_found_handling",
+        "base_path",
         "run_worker_first"
       ]) && isValid;
       return isValid;
@@ -27412,7 +27431,7 @@ var DEFAULT_COMPAT_DATE;
 var init_default_compat_date = __esm({
   "../workers-utils/src/default-compat-date.ts"() {
     init_import_meta_url();
-    DEFAULT_COMPAT_DATE = "2026-10-01";
+    DEFAULT_COMPAT_DATE = "2026-10-06";
   }
 });
 
@@ -58006,10 +58025,25 @@ function startTunnel(options) {
   const reminderIntervalMs = options.reminderIntervalMs ?? DEFAULT_TUNNEL_REMINDER_INTERVAL_MS;
   const defaultExpiryMs = options.expiryMs ?? DEFAULT_TUNNEL_EXPIRY_MS;
   const isNamedTunnel = options.token !== void 0;
+  if (isNamedTunnel && (options.allowedMail?.length ?? 0) > 0) {
+    throw new UserError(
+      "The `allowedMail` option is only supported for Quick Tunnels.",
+      { telemetryMessage: "tunnel allowed mail named tunnel conflict" }
+    );
+  }
   const timeFormatter = new Intl.DateTimeFormat(void 0, {
     timeStyle: "short"
   });
-  const cloudflaredArgs = isNamedTunnel ? ["tunnel", "--no-autoupdate", "run"] : ["tunnel", "--no-autoupdate", "--url", options.origin.href];
+  const cloudflaredArgs = isNamedTunnel ? ["tunnel", "--no-autoupdate", "run"] : [
+    "tunnel",
+    "--no-autoupdate",
+    "--url",
+    options.origin.href,
+    ...(options.allowedMail ?? []).flatMap((allowedMail) => [
+      "--allowed-mail",
+      allowedMail
+    ])
+  ];
   const cloudflaredPromise = spawnCloudflared(cloudflaredArgs, {
     stdio: "pipe",
     env: options.token ? { TUNNEL_TOKEN: options.token } : void 0,
@@ -63071,7 +63105,7 @@ var name, version2;
 var init_package = __esm({
   "package.json"() {
     name = "wrangler";
-    version2 = "4.147.0";
+    version2 = "4.148.0";
   }
 });
 
@@ -125271,7 +125305,7 @@ function getCachedTemporaryPreviewAccount(storage) {
   }
   return temporaryPreviewAccount;
 }
-async function requestPowSolution(logger7) {
+async function requestPowSolution(temporaryAccountLogger) {
   const response = await (0, import_undici3.fetch)(getTemporaryPreviewChallengeUrl(), {
     method: "POST",
     headers: { "Content-Type": "application/json" },
@@ -125309,11 +125343,11 @@ async function requestPowSolution(logger7) {
       }
     );
   }
-  logger7.log("Solving proof-of-work challenge\u2026");
+  temporaryAccountLogger.log("Solving proof-of-work challenge\u2026");
   return solveChallenge({ challengeToken, seed, k: k7, g: g7 });
 }
-async function createTemporaryPreviewAccount(logger7, request4) {
-  const pow = await requestPowSolution(logger7);
+async function createTemporaryPreviewAccount(temporaryAccountLogger, request4) {
+  const pow = await requestPowSolution(temporaryAccountLogger);
   const response = await (0, import_undici3.fetch)(getTemporaryPreviewUrl(), {
     method: "POST",
     headers: { "Content-Type": "application/json" },
@@ -125407,7 +125441,7 @@ async function getOrCreateTemporaryPreviewAccount(options) {
     });
   }
   const temporaryPreviewAccount = await createTemporaryPreviewAccount(
-    options.logger,
+    options.temporaryAccountLogger,
     options.request
   );
   options.storage.write(temporaryPreviewAccount);
@@ -126509,7 +126543,6 @@ function createOAuthFlow(ctx) {
     }
     const result = await getOrCreateTemporaryPreviewAccount({
       ...ctx.temporary,
-      logger: ctx.logger,
       ...temporaryRequest ? { request: temporaryRequest } : {}
     });
     activeTemporaryAccount = result.account;
@@ -127420,8 +127453,8 @@ function scrubEncryptedCredentials(options) {
   return { backendAvailable: false, encryptedFileExisted };
 }
 var import_undici3, hasWarnedAboutDeprecatedV1ApiToken, getCloudflareAPITokenFromEnv, getCloudflareGlobalAuthKeyFromEnv, getCloudflareGlobalAuthEmailFromEnv, ACCOUNT_ID_PATTERN, getAuthDomainFromEnv, getAuthUrlFromEnv, getTokenUrlFromEnv, getRevokeUrlFromEnv, readCloudflareAccountIdFromEnv, DEVICE_AUTH_PATH, getAccessClientIdFromEnv, getAccessClientSecretFromEnv, getCfAuthorizationTokenFromEnv, getCloudflareAuthUseKeyringFromEnv, headersCache, usesAccessCache, RECOMMENDED_CODE_VERIFIER_LENGTH, RECOMMENDED_STATE_LENGTH, PKCE_CHARSET, generateVerificationUrl, generateAuthUrl, POW_MAX_ITERATIONS, TEMPORARY_TERMS_URLS, TEMPORARY_TERMS_PROMPT, TEMPORARY_TERMS_NOTICE, TEMPORARY_TERMS_ERROR, EVENT_ACCOUNT_ERRORS, esm_default3, ErrorOAuth2, ErrorUnknown, ErrorAuthServerUnreachable, ErrorNoAuthCode, ErrorInvalidReturnedStateParam, ErrorInvalidJson, ErrorInvalidScope, ErrorInvalidRequest, ErrorInvalidToken, ErrorAuthenticationGrant, ErrorUnauthorizedClient, ErrorAccessDenied, ErrorUnsupportedResponseType, ErrorServerError, ErrorTemporarilyUnavailable, ErrorAccessTokenResponse, ErrorInvalidClient, ErrorInvalidGrant, ErrorUnsupportedGrantType, DEVICE_FLOW_MAX_DURATION_SECONDS, DEVICE_FLOW_MIN_POLL_INTERVAL_SECONDS, RESERVED_PROFILE_NAMES, BARE_KEY2, HAS_WELLFORMED2, FILE_FORMATS, USER_AUTH_CONFIG_PATH, FileCredentialStore, KEY_LENGTH_BYTES, IV_LENGTH_BYTES, TAG_LENGTH_BYTES, ALGORITHM_LABEL, CIPHER_NAME, EncryptedFileCredentialStore, PINNED_KEYRING_VERSION, npmRunner, cachedBindingPathByDir, entryFactoryOverride, runner, cachedProbeResult, LinuxSecretToolKeyProvider, SECURITY_EXIT_ITEM_NOT_FOUND, runner2, MacSecurityKeyProvider, NapiKeyringKeyProvider, testProviderFactory, sessionFlags;
-var init_chunk_FT2NMTJB = __esm({
-  "../workers-auth/dist/chunk-FT2NMTJB.mjs"() {
+var init_chunk_NDZDTP46 = __esm({
+  "../workers-auth/dist/chunk-NDZDTP46.mjs"() {
     init_import_meta_url();
     init_chunk_VAZEJK55();
     init_src();
@@ -128413,7 +128446,7 @@ var init_chunk_FT2NMTJB = __esm({
 var init_dist2 = __esm({
   "../workers-auth/dist/index.mjs"() {
     init_import_meta_url();
-    init_chunk_FT2NMTJB();
+    init_chunk_NDZDTP46();
     nodeModule.createRequire(import_meta_url || (typeof __filename === "string" ? __filename : "/"));
   }
 });
@@ -128674,10 +128707,10 @@ function createFileStorage(format9, getPath) {
   };
 }
 function createTemporaryTermsPrompt(deps) {
-  const { logger: logger7, prompt: prompt3 } = deps;
+  const { temporaryAccountLogger, prompt: prompt3 } = deps;
   return /* @__PURE__ */ __name2(/* @__PURE__ */ __name(async function ensureTemporaryTermsAccepted(question, notice) {
     if (isNonInteractiveOrCI()) {
-      logger7.log(notice);
+      temporaryAccountLogger.log(notice);
       return true;
     }
     const answer = await prompt3(question);
@@ -128700,9 +128733,9 @@ function notLoggedInErrorBodies(loginCommand2) {
     "token-refresh-unreachable": `Your auth token has expired and could not be refreshed because the Cloudflare auth server could not be reached. This is usually a network problem (connectivity, proxy, or IPv6), not an invalid login: your stored credentials were left unchanged. Check your connection and try again.`
   };
 }
-function logTemporaryPreviewAccount(logger7, temporaryPreviewAccount, cached2) {
+function logTemporaryPreviewAccount(temporaryAccountLogger, temporaryPreviewAccount, cached2) {
   const claimExpiresAt = new Date(temporaryPreviewAccount.claim.expiresAt);
-  logger7.log(
+  temporaryAccountLogger.log(
     dedent2`
 			Temporary account ready:
 				Account: ${temporaryPreviewAccount.account.name} (${cached2 ? "reused" : "created"})
@@ -128713,6 +128746,7 @@ function logTemporaryPreviewAccount(logger7, temporaryPreviewAccount, cached2) {
 }
 function createCloudflareAuth(descriptor, ctx) {
   const { logger: logger7 } = ctx;
+  const temporaryAccountLogger = ctx.temporaryAccountLogger ?? logger7;
   const cliName = descriptor.cliName;
   const NOT_LOGGED_IN_ERROR_BODIES = notLoggedInErrorBodies(
     descriptor.commands.login
@@ -128755,7 +128789,11 @@ Run \`${descriptor.commands.whoami}\` to check your current authentication statu
         descriptor.fileFormat,
         descriptor.getTemporaryAccountConfigPath
       ),
-      prompt: createTemporaryTermsPrompt({ logger: logger7, prompt: ctx.prompt })
+      prompt: createTemporaryTermsPrompt({
+        temporaryAccountLogger,
+        prompt: ctx.prompt
+      }),
+      temporaryAccountLogger
     }
   });
   function setProfile2(profile) {
@@ -129044,7 +129082,11 @@ ${accounts.map(
         );
       }
       const { account: temporaryPreviewAccount, cached: cached2 } = await oauthFlow.activateTemporaryAccount();
-      logTemporaryPreviewAccount(logger7, temporaryPreviewAccount, cached2);
+      logTemporaryPreviewAccount(
+        temporaryAccountLogger,
+        temporaryPreviewAccount,
+        cached2
+      );
       return temporaryPreviewAccount.account.id;
     }
     const result = await loginOrRefreshIfRequired2(config2);
@@ -129327,10 +129369,10 @@ function createAuthConfigFileHelpers(deps) {
   };
 }
 var millisecondsInMinute, minutesInYear, minutesInMonth, minutesInDay, constructFromSymbol, defaultOptions2, formatDistanceLocale, formatDistance, dateFormats, timeFormats, dateTimeFormats, formatLong, formatRelativeLocale, formatRelative, eraValues, quarterValues, monthValues, dayValues, dayPeriodValues, formattingDayPeriodValues, ordinalNumber, localize, matchOrdinalNumberPattern, parseOrdinalNumberPattern, matchEraPatterns, parseEraPatterns, matchQuarterPatterns, parseQuarterPatterns, matchMonthPatterns, parseMonthPatterns, matchDayPatterns, parseDayPatterns, matchDayPeriodPatterns, parseDayPeriodPatterns, match, enUS, MEMBERSHIPS_INACCESSIBLE_CODES, DIRECTORY_BINDINGS_FILE, ENCRYPTED_PROFILE_CONFIG_EXTENSION;
-var init_chunk_VVLCNASF = __esm({
-  "../workers-auth/dist/chunk-VVLCNASF.mjs"() {
+var init_chunk_PGZZHNWG = __esm({
+  "../workers-auth/dist/chunk-PGZZHNWG.mjs"() {
     init_import_meta_url();
-    init_chunk_FT2NMTJB();
+    init_chunk_NDZDTP46();
     init_chunk_VAZEJK55();
     init_src();
     nodeModule.createRequire(import_meta_url || (typeof __filename === "string" ? __filename : "/"));
@@ -129845,7 +129887,7 @@ var DefaultScopes, DefaultScopeKeys, WRANGLER_KEYRING_SERVICE_NAME, WRANGLER_CLI
 var init_wrangler = __esm({
   "../workers-auth/dist/wrangler/index.mjs"() {
     init_import_meta_url();
-    init_chunk_VVLCNASF();
+    init_chunk_PGZZHNWG();
     init_chunk_VAZEJK55();
     init_src();
     nodeModule.createRequire(import_meta_url || (typeof __filename === "string" ? __filename : "/"));
@@ -135195,6 +135237,12 @@ var init_user2 = __esm({
     init_logger2();
     auth = createWranglerAuth({
       logger: logger2,
+      // Temporary-account notices go to stderr so they never corrupt command
+      // output on stdout (JSON, piped values), and stay visible when `--json`
+      // commands lower the log level to "error".
+      temporaryAccountLogger: {
+        log: /* @__PURE__ */ __name((...args) => logger2.console("error", ...args), "log")
+      },
       userAgent: `wrangler/${version2}`,
       prompt: prompt2,
       select: select2,
@@ -136151,6 +136199,7 @@ function convertBindingsAndAssets(config2, result) {
     if (assetsBindingName !== void 0) assets.binding = assetsBindingName;
     if (config2.assets?.htmlHandling !== void 0) assets.html_handling = config2.assets.htmlHandling;
     if (config2.assets?.notFoundHandling !== void 0) assets.not_found_handling = config2.assets.notFoundHandling;
+    if (config2.assets?.basePath !== void 0) assets.base_path = config2.assets.basePath;
     if (config2.assets?.runWorkerFirst !== void 0) assets.run_worker_first = config2.assets.runWorkerFirst;
     result.assets = assets;
   }
@@ -136587,6 +136636,7 @@ var init_dist3 = __esm({
         "404-page",
         "none"
       ]).optional(),
+      basePath: string2().optional(),
       runWorkerFirst: union([array(string2()), boolean2()]).optional()
     });
     BrowserBindingSchema = strictObject({
@@ -150898,7 +150948,7 @@ var init_bundle_type = __esm({
 function isJavaScriptModuleRule(rule) {
   return rule.type === "ESModule" || rule.type === "CommonJS";
 }
-function parseRules(userRules = []) {
+function parseRules(userRules = [], logWarnings = true) {
   const rules = [...userRules, ...DEFAULT_MODULE_RULES];
   const completedRuleLocations = {};
   const redundantRules = {};
@@ -150927,7 +150977,7 @@ function parseRules(userRules = []) {
   }
   for (const completedRuleType in completedRuleLocations) {
     const r10 = redundantRules[completedRuleType];
-    if (r10) {
+    if (r10 && logWarnings) {
       const completedRuleIndex = completedRuleLocations[completedRuleType];
       let warning = `The ${completedRuleIndex >= userRules.length ? "default " : ""}module rule ${JSON.stringify(
         rules[completedRuleIndex]
@@ -162808,6 +162858,7 @@ function resolveAssetOptions({ assetsDir, main: main2 }, config2) {
   const assetConfig = {
     html_handling: config2.assets?.html_handling,
     not_found_handling: config2.assets?.not_found_handling,
+    base_path: config2.assets?.base_path,
     // The _redirects and _headers files are parsed in Miniflare in dev and parsing is not required for deploy
     compatibility_date: config2.compatibility_date,
     compatibility_flags: config2.compatibility_flags
@@ -163546,6 +163597,7 @@ function createWorkerUploadForm(worker, bindings, options) {
   const assetConfig = {
     html_handling: assets?.assetConfig?.html_handling,
     not_found_handling: assets?.assetConfig?.not_found_handling,
+    base_path: assets?.assetConfig?.base_path,
     run_worker_first: assets?.run_worker_first,
     _redirects: assets?._redirects,
     _headers: assets?._headers
@@ -175338,13 +175390,92 @@ var init_match_tag = __esm({
     __name(verifyWorkerMatchesCITag, "verifyWorkerMatchesCITag");
   }
 });
+
+// ../workers-shared/utils/base-path.ts
+function normalizeBasePath(value) {
+  if (value === "/") {
+    return { valid: true, value: "/" };
+  }
+  if (typeof value !== "string") {
+    return {
+      valid: false,
+      error: `Expected a string but got ${typeof value}.`
+    };
+  }
+  if (value.length === 0) {
+    return { valid: false, error: `The value must not be empty.` };
+  }
+  if (value.startsWith("//") || /^[a-zA-Z][a-zA-Z\d+.-]*:/.test(value)) {
+    return {
+      valid: false,
+      error: `The value must be a pathname, not a URL.`
+    };
+  }
+  if (value.includes("\\")) {
+    return { valid: false, error: `The value must not contain backslashes.` };
+  }
+  if (CONTROL_CHARACTER.test(value)) {
+    return {
+      valid: false,
+      error: `The value must not contain control characters.`
+    };
+  }
+  if (value.includes("?") || value.includes("#")) {
+    return {
+      valid: false,
+      error: `The value must not contain query strings or fragments.`
+    };
+  }
+  if (value.includes("%")) {
+    return {
+      valid: false,
+      error: `The value must not contain percent-encoded sequences.`
+    };
+  }
+  const normalizedSegments = [];
+  for (const segment of value.split("/")) {
+    if (segment === "" || segment === ".") {
+      continue;
+    }
+    if (segment === "..") {
+      normalizedSegments.pop();
+      continue;
+    }
+    normalizedSegments.push(segment);
+  }
+  const canonical = normalizedSegments.length === 0 ? "/" : `/${normalizedSegments.join("/")}/`;
+  return { valid: true, value: canonical };
+}
+var CONTROL_CHARACTER;
+var init_base_path = __esm({
+  "../workers-shared/utils/base-path.ts"() {
+    init_import_meta_url();
+    CONTROL_CHARACTER = /[\u0000-\u001f\u007f]/;
+    __name(normalizeBasePath, "normalizeBasePath");
+  }
+});
+function routeMatchesPath(route, pathname) {
+  if (typeof route !== "string" && route.custom_domain) {
+    return !("enabled" in route) || route.enabled !== false;
+  }
+  const pattern = typeof route === "string" ? route : route.pattern;
+  const patternWithoutScheme = pattern.replace(/^https?:\/\//, "");
+  const pathStart = patternWithoutScheme.indexOf("/");
+  if (pathStart === -1) {
+    return false;
+  }
+  const pathPattern = patternWithoutScheme.slice(pathStart);
+  const regexpPattern = pathPattern.split("*").map((part) => part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join(".*");
+  return new RegExp(`^${regexpPattern}$`).test(pathname);
+}
 var validateRoutes2;
 var init_validate_routes = __esm({
   "../deploy-helpers/src/deploy/helpers/validate-routes.ts"() {
     init_import_meta_url();
+    init_base_path();
     init_src();
     init_context();
-    validateRoutes2 = /* @__PURE__ */ __name((routes, assets) => {
+    validateRoutes2 = /* @__PURE__ */ __name((routes, assets, workersDevEnabled) => {
       const invalidRoutes = {};
       const mountedAssetRoutes = [];
       for (const route of routes) {
@@ -175382,6 +175513,12 @@ var init_validate_routes = __esm({
           { telemetryMessage: "deploy invalid routes" }
         );
       }
+      const basePath = normalizeBasePath(assets?.assetConfig.base_path);
+      if (workersDevEnabled === false && basePath.valid && basePath.value !== "/" && !routes.some((route) => routeMatchesPath(route, basePath.value))) {
+        logger.warn(
+          `The configured assets base path "${basePath.value}" is not reachable through any configured route. Add a route that matches "${basePath.value}" or enable \`workers_dev\`.`
+        );
+      }
       if (mountedAssetRoutes.length > 0 && assets?.directory !== void 0) {
         const relativeAssetsDir = path28__namespace.default.relative(process.cwd(), assets.directory);
         const warnFn = logger.once?.warn ?? logger.warn;
@@ -175398,6 +175535,7 @@ ${mountedAssetRoutes.map((route) => {
         );
       }
     }, "validateRoutes");
+    __name(routeMatchesPath, "routeMatchesPath");
   }
 });
 function validateWorkerProps(props, config2) {
@@ -175446,7 +175584,12 @@ See https://developers.cloudflare.com/workers/platform/compatibility-dates for m
   validateOwnedWorkflowDeclarations(config2, name2);
   if (props.command === "deploy") {
     validateEventTriggerTargets(config2, name2);
-    validateRoutes2(props.routes, props.assetsOptions);
+    const workersDevEnabled = getSubdomainValues(
+      config2.workers_dev,
+      config2.preview_urls,
+      props.routes
+    ).workers_dev;
+    validateRoutes2(props.routes, props.assetsOptions, workersDevEnabled);
     assert38__default.default(
       !config2.site || config2.site.bucket,
       "A [site] definition requires a `bucket` field with a path to the site's assets directory."
@@ -176624,6 +176767,42 @@ var init_versions_upload = __esm({
     __name(uploadWorkerVersion, "uploadWorkerVersion");
   }
 });
+function gitCommandText(stdout2) {
+  if (typeof stdout2 === "string") {
+    return stdout2;
+  }
+  if (stdout2 instanceof Uint8Array) {
+    return new TextDecoder().decode(stdout2);
+  }
+  return "";
+}
+function resolveGitBranchName() {
+  try {
+    childProcess.execSync(`git rev-parse --is-inside-work-tree`, {
+      stdio: ["ignore", "ignore", "ignore"]
+    });
+  } catch {
+    return void 0;
+  }
+  try {
+    const branch = gitCommandText(
+      childProcess.execSync(`git branch --show-current`, {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"]
+      })
+    ).trim();
+    return branch || void 0;
+  } catch {
+    return void 0;
+  }
+}
+var init_git_branch = __esm({
+  "../deploy-helpers/src/shared/git-branch.ts"() {
+    init_import_meta_url();
+    __name(gitCommandText, "gitCommandText");
+    __name(resolveGitBranchName, "resolveGitBranchName");
+  }
+});
 function truncateWithSuffix(body, suffix, maxLength) {
   const maxBodyLength = Math.max(0, maxLength - suffix.length);
   return `${body.slice(0, maxBodyLength)}${suffix}`;
@@ -176648,12 +176827,7 @@ function getBranchName() {
   if (ciBranchName) {
     return ciBranchName;
   }
-  try {
-    childProcess.execSync(`git rev-parse --is-inside-work-tree`, { stdio: "ignore" });
-    return childProcess.execSync(`git rev-parse --abbrev-ref HEAD`).toString().trim();
-  } catch {
-    return void 0;
-  }
+  return resolveGitBranchName();
 }
 function createTruncatedAlias(branchName, sanitizedAlias, availableSpace) {
   const hash2 = crypto2.createHash("sha256").update(branchName).digest("hex").slice(0, HASH_LENGTH);
@@ -176695,6 +176869,7 @@ var init_preview_alias = __esm({
     init_import_meta_url();
     init_src();
     init_context();
+    init_git_branch();
     init_names();
     MAX_DNS_LABEL_LENGTH = 63;
     HASH_LENGTH = 4;
@@ -176914,6 +177089,14 @@ var init_api2 = __esm({
     __name(patchPreviewBaseConfig, "patchPreviewBaseConfig");
   }
 });
+function readGitStdout(command2) {
+  return gitCommandText(
+    childProcess.execSync(command2, {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    })
+  ).trim();
+}
 function getBranchName2() {
   const workersCIBranch = getWorkersCIBranchName();
   if (workersCIBranch) {
@@ -176927,12 +177110,7 @@ function getBranchName2() {
   if (gitlabBranch) {
     return gitlabBranch;
   }
-  try {
-    childProcess.execSync(`git rev-parse --is-inside-work-tree`, { stdio: "ignore" });
-    return childProcess.execSync(`git rev-parse --abbrev-ref HEAD`).toString().trim();
-  } catch {
-    return void 0;
-  }
+  return resolveGitBranchName();
 }
 function shouldUseCIMetadataFallback() {
   return process.env.CI === "1" || process.env.CI === "true";
@@ -176940,7 +177118,7 @@ function shouldUseCIMetadataFallback() {
 function getHeadCommitRef() {
   try {
     childProcess.execSync(`git rev-parse --is-inside-work-tree`, { stdio: "ignore" });
-    return childProcess.execSync(`git rev-parse --short HEAD`).toString().trim();
+    return readGitStdout(`git rev-parse --short HEAD`);
   } catch {
     return void 0;
   }
@@ -176948,7 +177126,7 @@ function getHeadCommitRef() {
 function getHeadCommitMessage() {
   try {
     childProcess.execSync(`git rev-parse --is-inside-work-tree`, { stdio: "ignore" });
-    return childProcess.execSync(`git log -1 --format=%B`).toString().trim();
+    return readGitStdout(`git log -1 --format=%B`);
   } catch {
     return void 0;
   }
@@ -177001,7 +177179,7 @@ function getRepositoryUrl() {
   try {
     childProcess.execSync(`git rev-parse --is-inside-work-tree`, { stdio: "ignore" });
     return normalizeRepositoryUrl(
-      childProcess.execSync(`git config --get remote.origin.url`).toString()
+      readGitStdout(`git config --get remote.origin.url`)
     );
   } catch {
     return void 0;
@@ -177438,8 +177616,10 @@ var init_shared2 = __esm({
   "../deploy-helpers/src/preview/shared.ts"() {
     init_import_meta_url();
     init_src();
+    init_git_branch();
     init_names();
     MAX_CONTAINER_APP_NAME_LENGTH = 253;
+    __name(readGitStdout, "readGitStdout");
     __name(getBranchName2, "getBranchName");
     __name(shouldUseCIMetadataFallback, "shouldUseCIMetadataFallback");
     __name(getHeadCommitRef, "getHeadCommitRef");
@@ -177752,6 +177932,7 @@ async function assemblePreviewDeploymentSettings(config2, buildResult, accountId
       config: {
         html_handling: options.assetsOptions.assetConfig.html_handling,
         not_found_handling: options.assetsOptions.assetConfig.not_found_handling,
+        base_path: options.assetsOptions.assetConfig.base_path,
         run_worker_first: options.assetsOptions.run_worker_first
       }
     };
@@ -179593,7 +179774,7 @@ var CF_KEYRING_SERVICE_NAME, CF_CLI_NAME, CF_DISPLAY_NAME, CF_OAUTH_CALLBACK_URL
 var init_cf = __esm({
   "../workers-auth/dist/cf/index.mjs"() {
     init_import_meta_url();
-    init_chunk_VVLCNASF();
+    init_chunk_PGZZHNWG();
     init_chunk_VAZEJK55();
     init_src();
     nodeModule.createRequire(import_meta_url || (typeof __filename === "string" ? __filename : "/"));
@@ -180606,7 +180787,7 @@ var init_dist14 = __esm({
     init_wrapper();
     init_create_worker_upload_form();
     import_undici13 = __toESM(require_undici(), 1);
-    version3 = "0.0.43";
+    version3 = "0.0.44";
     NoDefaultValueProvided2 = class extends UserError {
       static {
         __name(this, "NoDefaultValueProvided");
@@ -186587,6 +186768,12 @@ var init_dev = __esm({
         "tunnel-name": {
           describe: "Use an existing named Cloudflare Tunnel when `--tunnel` is enabled.",
           type: "string"
+        },
+        "tunnel-allowed-mail": {
+          describe: "Require email authentication for a Quick Tunnel. Accepts an exact address or domain wildcard such as user@example.com or *@example.org. May be repeated or comma-separated.",
+          type: "string",
+          array: true,
+          nargs: 1
         }
       },
       async validateArgs(args) {
@@ -186602,6 +186789,14 @@ var init_dev = __esm({
             { telemetryMessage: "dev command live reload remote conflict" }
           );
         }
+        if (args.tunnelName && (args.tunnelAllowedMail?.length ?? 0) > 0) {
+          throw new UserError(
+            "--tunnel-allowed-mail is only supported for Quick Tunnels and cannot be used with --tunnel-name.",
+            {
+              telemetryMessage: "dev command tunnel allowed mail named conflict"
+            }
+          );
+        }
         if (args.tunnel && args.remote) {
           throw new UserError(
             "--tunnel cannot be used with --remote. Tunnels expose your local dev server to the internet, which is only applicable in local mode. Remove --remote to use --tunnel, or remove --tunnel to use --remote.",
@@ -203576,14 +203771,267 @@ function constructTypeKey(key) {
   }
   return `"${escapeTypeScriptString(key)}"`;
 }
-function constructTSModuleGlob(glob) {
+function getTSModuleGlob(glob) {
   if (!glob.includes("*")) {
-    return glob;
-  } else if (glob.includes(".")) {
-    return `*.${glob.split(".").at(-1)}`;
-  } else {
-    return glob.replace("**/*", "*").replace("**/", "*/").replace("/**", "/*");
+    return {
+      moduleGlob: glob,
+      fallbackModuleGlob: getFallbackModuleGlob(glob),
+      preservesScope: true,
+      isRecursiveFallback: false,
+      emitsFallback: false
+    };
+  }
+  const moduleGlob = glob.replaceAll("**/*", "*").replaceAll("**/", "*/").replaceAll("/**", "/*");
+  const fallbackModuleGlob = getFallbackModuleGlob(glob);
+  const preservesScope = moduleGlob.indexOf("*") === moduleGlob.lastIndexOf("*");
+  return {
+    moduleGlob: preservesScope ? moduleGlob : fallbackModuleGlob ?? "*",
+    fallbackModuleGlob,
+    preservesScope,
+    isRecursiveFallback: preservesScope && moduleGlob === fallbackModuleGlob && glob.startsWith("**/"),
+    emitsFallback: true
+  };
+}
+function getFallbackModuleGlob(glob) {
+  const lastAsteriskIndex = glob.lastIndexOf("*");
+  if (lastAsteriskIndex !== -1) {
+    const suffix = glob.slice(lastAsteriskIndex + 1);
+    return suffix ? `*${suffix}` : void 0;
+  }
+  const lastSlashIndex = Math.max(
+    glob.lastIndexOf("/"),
+    glob.lastIndexOf("\\")
+  );
+  const lastDotIndex = glob.lastIndexOf(".");
+  return lastDotIndex > lastSlashIndex ? `*${glob.slice(lastDotIndex)}` : void 0;
+}
+function isAdditionalModuleDiscoveryEnabled(config2) {
+  return config2.find_additional_modules ?? config2.no_bundle === true;
+}
+function generateModuleTypeDeclarations(rules = [], resolveOverlappingGlobs = false, findAdditionalModules2 = false) {
+  const moduleTypeMap = {
+    CompiledWasm: "WebAssembly.Module",
+    Data: "ArrayBuffer",
+    Text: "string"
+  };
+  const declarations = new Array();
+  if (!resolveOverlappingGlobs) {
+    for (const rule of rules) {
+      const typeScriptType = moduleTypeMap[rule.type];
+      if (typeScriptType === void 0) {
+        continue;
+      }
+      for (const glob of rule.globs) {
+        declarations.push(
+          generateModuleTypeDeclaration(getTSModuleGlob(glob).moduleGlob, [
+            typeScriptType
+          ])
+        );
+      }
+    }
+    return declarations;
+  }
+  return generateCombinedModuleTypeDeclarations([
+    { findAdditionalModules: findAdditionalModules2, rules }
+  ]);
+}
+function resolveModuleTypeDeclarations(ruleSet5) {
+  const { findAdditionalModules: findAdditionalModules2, rules } = ruleSet5;
+  const moduleTypeMap = {
+    CompiledWasm: "WebAssembly.Module",
+    Data: "ArrayBuffer",
+    Text: "string"
+  };
+  const seenRuleGlobs = /* @__PURE__ */ new Set();
+  const scopedDeclarations = /* @__PURE__ */ new Map();
+  const fallbackDeclarations = /* @__PURE__ */ new Map();
+  const matchingRules = new Array();
+  for (const rule of rules) {
+    const typeScriptType = moduleTypeMap[rule.type];
+    if (typeScriptType === void 0) {
+      continue;
+    }
+    for (const glob of rule.globs) {
+      const {
+        moduleGlob,
+        fallbackModuleGlob,
+        preservesScope,
+        isRecursiveFallback,
+        emitsFallback
+      } = getTSModuleGlob(glob);
+      if (seenRuleGlobs.has(glob)) {
+        continue;
+      }
+      seenRuleGlobs.add(glob);
+      matchingRules.push({
+        deploymentGlob: glob,
+        isConservativeFallback: !preservesScope,
+        moduleGlob,
+        type: typeScriptType
+      });
+      if (fallbackModuleGlob === void 0) {
+        const types14 = scopedDeclarations.get(moduleGlob) ?? /* @__PURE__ */ new Set();
+        types14.add(typeScriptType);
+        scopedDeclarations.set(moduleGlob, types14);
+        continue;
+      }
+      const fallbackDeclaration = fallbackDeclarations.get(
+        fallbackModuleGlob
+      ) ?? {
+        types: /* @__PURE__ */ new Set(),
+        recursiveRuleSeen: false,
+        shouldEmit: false
+      };
+      if (fallbackDeclaration.recursiveRuleSeen) {
+        continue;
+      }
+      if (preservesScope && moduleGlob !== fallbackModuleGlob) {
+        const types14 = scopedDeclarations.get(moduleGlob) ?? /* @__PURE__ */ new Set();
+        types14.add(typeScriptType);
+        scopedDeclarations.set(moduleGlob, types14);
+      }
+      fallbackDeclaration.types.add(typeScriptType);
+      fallbackDeclaration.recursiveRuleSeen = isRecursiveFallback;
+      fallbackDeclaration.shouldEmit ||= emitsFallback;
+      fallbackDeclarations.set(fallbackModuleGlob, fallbackDeclaration);
+    }
   }
+  return {
+    findAdditionalModules: findAdditionalModules2,
+    scoped: scopedDeclarations,
+    fallbacks: fallbackDeclarations,
+    matchingRules
+  };
+}
+function intersectModuleGlobs(left2, right2) {
+  const leftAsteriskIndex = left2.indexOf("*");
+  const rightAsteriskIndex = right2.indexOf("*");
+  if (leftAsteriskIndex === -1) {
+    return moduleGlobMatches(right2, left2) ? left2 : void 0;
+  }
+  if (rightAsteriskIndex === -1) {
+    return moduleGlobMatches(left2, right2) ? right2 : void 0;
+  }
+  const leftPrefix = left2.slice(0, leftAsteriskIndex);
+  const rightPrefix = right2.slice(0, rightAsteriskIndex);
+  if (!leftPrefix.startsWith(rightPrefix) && !rightPrefix.startsWith(leftPrefix)) {
+    return void 0;
+  }
+  const leftSuffix = left2.slice(leftAsteriskIndex + 1);
+  const rightSuffix = right2.slice(rightAsteriskIndex + 1);
+  if (!leftSuffix.endsWith(rightSuffix) && !rightSuffix.endsWith(leftSuffix)) {
+    return void 0;
+  }
+  const prefix = leftPrefix.length >= rightPrefix.length ? leftPrefix : rightPrefix;
+  const suffix = leftSuffix.length >= rightSuffix.length ? leftSuffix : rightSuffix;
+  return `${prefix}*${suffix}`;
+}
+function moduleGlobMatches(moduleGlob, moduleName) {
+  const asteriskIndex = moduleGlob.indexOf("*");
+  if (asteriskIndex === -1) {
+    return moduleGlob === moduleName;
+  }
+  const prefix = moduleGlob.slice(0, asteriskIndex);
+  const suffix = moduleGlob.slice(asteriskIndex + 1);
+  return moduleName.length >= prefix.length + suffix.length && moduleName.startsWith(prefix) && moduleName.endsWith(suffix);
+}
+function moduleGlobContains(container, contained) {
+  const containedAsteriskIndex = contained.indexOf("*");
+  if (containedAsteriskIndex === -1) {
+    return moduleGlobMatches(container, contained);
+  }
+  const containerAsteriskIndex = container.indexOf("*");
+  if (containerAsteriskIndex === -1) {
+    return false;
+  }
+  const containerPrefix = container.slice(0, containerAsteriskIndex);
+  const containedPrefix = contained.slice(0, containedAsteriskIndex);
+  const containerSuffix = container.slice(containerAsteriskIndex + 1);
+  const containedSuffix = contained.slice(containedAsteriskIndex + 1);
+  return containedPrefix.startsWith(containerPrefix) && containedSuffix.endsWith(containerSuffix);
+}
+function resolveMatchingModuleTypes(moduleGlob, matchingRules, findAdditionalModules2) {
+  const types14 = /* @__PURE__ */ new Set();
+  const coveredPatterns = new Array();
+  const exactModuleName = moduleGlob.includes("*") ? void 0 : moduleGlob;
+  for (const rule of matchingRules) {
+    const deploymentRegExp = findAdditionalModules2 ? (0, import_glob_to_regexp3.default)(rule.deploymentGlob, { globstar: true }) : (0, import_glob_to_regexp3.default)(rule.deploymentGlob);
+    const conservativeFallbackMatchesExact = exactModuleName !== void 0 && rule.isConservativeFallback && deploymentRegExp.test(exactModuleName);
+    if (exactModuleName !== void 0 && rule.isConservativeFallback && !conservativeFallbackMatchesExact) {
+      continue;
+    }
+    const overlap = intersectModuleGlobs(moduleGlob, rule.moduleGlob);
+    if (overlap === void 0 || coveredPatterns.some((pattern) => moduleGlobContains(pattern, overlap))) {
+      continue;
+    }
+    types14.add(rule.type);
+    if (!rule.isConservativeFallback || conservativeFallbackMatchesExact) {
+      coveredPatterns.push(overlap);
+      if (moduleGlobContains(rule.moduleGlob, moduleGlob)) {
+        break;
+      }
+    }
+  }
+  return types14;
+}
+function generateCombinedModuleTypeDeclarations(ruleSets) {
+  const combinedDeclarations = /* @__PURE__ */ new Map();
+  const combinedFallbacks = /* @__PURE__ */ new Map();
+  const resolvedRuleSets = ruleSets.map(resolveModuleTypeDeclarations);
+  for (const { scoped, fallbacks } of resolvedRuleSets) {
+    for (const moduleGlob of scoped.keys()) {
+      combinedDeclarations.set(
+        moduleGlob,
+        combinedDeclarations.get(moduleGlob) ?? /* @__PURE__ */ new Set()
+      );
+    }
+    for (const [moduleGlob, { types: types14, shouldEmit }] of fallbacks) {
+      const combinedFallback = combinedFallbacks.get(moduleGlob) ?? {
+        types: /* @__PURE__ */ new Set(),
+        shouldEmit: false
+      };
+      for (const type of types14) {
+        combinedFallback.types.add(type);
+      }
+      combinedFallback.shouldEmit ||= shouldEmit;
+      combinedFallbacks.set(moduleGlob, combinedFallback);
+    }
+  }
+  for (const [moduleGlob, { types: types14, shouldEmit }] of combinedFallbacks) {
+    if (!shouldEmit && types14.size === 1) {
+      continue;
+    }
+    combinedDeclarations.set(
+      moduleGlob,
+      combinedDeclarations.get(moduleGlob) ?? /* @__PURE__ */ new Set()
+    );
+  }
+  for (const [moduleGlob, combinedTypes] of combinedDeclarations) {
+    for (const { findAdditionalModules: findAdditionalModules2, matchingRules } of resolvedRuleSets) {
+      for (const type of resolveMatchingModuleTypes(
+        moduleGlob,
+        matchingRules,
+        findAdditionalModules2
+      )) {
+        combinedTypes.add(type);
+      }
+    }
+  }
+  return [...combinedDeclarations].map(
+    ([moduleGlob, types14]) => generateModuleTypeDeclaration(moduleGlob, types14)
+  );
+}
+function generateModuleTypeDeclaration(moduleGlob, types14) {
+  return `declare module "${moduleGlob}" {
+	const value: ${[...types14].join(" | ")};
+	export default value;
+}`;
+}
+function generateServiceWorkerTypes(typeDefinitions, envTypeStructure) {
+  return [
+    ...typeDefinitions,
+    ...envTypeStructure.map((value) => `declare const ${value}`)
+  ].join("\n");
 }
 function generateImportSpecifier(from, to) {
   const relativePath = path28.relative(path28.dirname(from), path28.dirname(to)).replace(/\\/g, "/");
@@ -203843,33 +204291,22 @@ async function generateSimpleEnvTypes(config2, collectionArgs, envInterface, out
       });
     }
   }
-  const modulesTypeStructure = new Array();
-  if (config2.rules) {
-    const moduleTypeMap = {
-      CompiledWasm: "WebAssembly.Module",
-      Data: "ArrayBuffer",
-      Text: "string"
-    };
-    for (const ruleObject of config2.rules) {
-      const typeScriptType = moduleTypeMap[ruleObject.type];
-      if (typeScriptType === void 0) {
-        continue;
-      }
-      for (const glob of ruleObject.globs) {
-        modulesTypeStructure.push(`declare module "${constructTSModuleGlob(glob)}" {
-	const value: ${typeScriptType};
-	export default value;
-}`);
-      }
-    }
-  }
-  const typesHaveBeenFound = envTypeStructure.length > 0 || modulesTypeStructure.length > 0;
+  const configuredModulesTypeStructure = generateModuleTypeDeclarations(
+    config2.rules
+  );
+  const effectiveModulesTypeStructure = generateModuleTypeDeclarations(
+    parseRules(config2.rules, log2).rules,
+    true,
+    isAdditionalModuleDiscoveryEnabled(config2)
+  );
+  const typesHaveBeenFound = envTypeStructure.length > 0 || effectiveModulesTypeStructure.length > 0;
   if (entrypointFormat === "modules" || typesHaveBeenFound) {
     const { consoleOutput, fileContent } = generateTypeStrings(
       entrypointFormat,
       envInterface,
       envTypeStructure.map(({ key, type }) => `${key}: ${type};`),
-      modulesTypeStructure,
+      configuredModulesTypeStructure,
+      effectiveModulesTypeStructure,
       stringKeys,
       config2.compatibility_date,
       config2.compatibility_flags,
@@ -203882,7 +204319,7 @@ async function generateSimpleEnvTypes(config2, collectionArgs, envInterface, out
       ],
       typeDefinitions
     );
-    const hash2 = crypto2.createHash("sha256").update(consoleOutput).digest("hex").slice(0, 32);
+    const hash2 = crypto2.createHash("sha256").update(fileContent).digest("hex").slice(0, 32);
     if (log2) {
       logger2.log(source_default.dim(consoleOutput));
     }
@@ -204149,31 +204586,41 @@ ${bindingLines}
       });
     }
   }
-  const modulesTypeStructure = new Array();
-  if (config2.rules) {
-    const moduleTypeMap = {
-      CompiledWasm: "WebAssembly.Module",
-      Data: "ArrayBuffer",
-      Text: "string"
-    };
-    for (const ruleObject of config2.rules) {
-      const typeScriptType = moduleTypeMap[ruleObject.type];
-      if (typeScriptType !== void 0) {
-        for (const glob of ruleObject.globs) {
-          modulesTypeStructure.push(`declare module "${constructTSModuleGlob(glob)}" {
-	const value: ${typeScriptType};
-	export default value;
-	}`);
-        }
-      }
-    }
-  }
+  const environmentRuleSets = [
+    {
+      findAdditionalModules: isAdditionalModuleDiscoveryEnabled(config2),
+      rules: config2.rules
+    },
+    ...envNames.map((envName) => {
+      const environmentConfig = readConfig(
+        { ...collectionArgs, env: envName },
+        { hideWarnings: true }
+      );
+      return {
+        findAdditionalModules: isAdditionalModuleDiscoveryEnabled(environmentConfig),
+        rules: environmentConfig.rules
+      };
+    })
+  ];
+  const uniqueRuleSets = [
+    ...new Map(
+      environmentRuleSets.map((ruleSet5) => [JSON.stringify(ruleSet5), ruleSet5])
+    ).values()
+  ];
+  const configuredModulesTypeStructure = generateCombinedModuleTypeDeclarations(uniqueRuleSets);
+  const effectiveModulesTypeStructure = generateCombinedModuleTypeDeclarations(
+    uniqueRuleSets.map(({ findAdditionalModules: findAdditionalModules2, rules }) => ({
+      findAdditionalModules: findAdditionalModules2,
+      rules: parseRules(rules, log2).rules
+    }))
+  );
   const { consoleOutput, fileContent } = generatePerEnvTypeStrings(
     entrypointFormat,
     envInterface,
     perEnvInterfaces,
     aggregatedEnvBindings,
-    modulesTypeStructure,
+    configuredModulesTypeStructure,
+    effectiveModulesTypeStructure,
     stringKeys,
     config2.compatibility_date,
     config2.compatibility_flags,
@@ -204186,7 +204633,7 @@ ${bindingLines}
     ],
     [...typeDefinitions]
   );
-  const hash2 = crypto2.createHash("sha256").update(consoleOutput).digest("hex").slice(0, 32);
+  const hash2 = crypto2.createHash("sha256").update(fileContent).digest("hex").slice(0, 32);
   if (log2) {
     logger2.log(source_default.dim(consoleOutput));
   }
@@ -204198,8 +204645,9 @@ ${bindingLines}
 function prefixEnvInterface(envInterface) {
   return `__BaseEnv_${envInterface}`;
 }
-function generatePerEnvTypeStrings(formatType, envInterface, perEnvInterfaces, aggregatedEnvBindings, modulesTypeStructure, stringKeys, compatibilityDate, compatibilityFlags, entrypointModule, configuredDurableObjects, typeDefinitions = []) {
+function generatePerEnvTypeStrings(formatType, envInterface, perEnvInterfaces, aggregatedEnvBindings, consoleModulesTypeStructure, fileModulesTypeStructure, stringKeys, compatibilityDate, compatibilityFlags, entrypointModule, configuredDurableObjects, typeDefinitions = []) {
   let baseContent = "";
+  let fileBaseContent;
   let processEnv = "";
   const typeDefsContent = typeDefinitions.length > 0 ? typeDefinitions.map((def) => `	${def}`).join("\n") : "";
   if (formatType === "modules") {
@@ -204236,17 +204684,22 @@ interface ${envInterface} extends ${internalEnvInterface} {}${processEnv}`;
 declare global {
 ${envBindingLines}
 }`;
+    fileBaseContent = generateServiceWorkerTypes(
+      typeDefinitions,
+      aggregatedEnvBindings.map(({ key, type }) => `${key}: ${type};`)
+    );
   }
-  const modulesContent = modulesTypeStructure.join("\n");
+  const consoleModulesContent = consoleModulesTypeStructure.join("\n");
+  const fileModulesContent = fileModulesTypeStructure.join("\n");
   return {
     consoleOutput: `${baseContent}
-${modulesContent}`,
-    fileContent: `${baseContent}
-${modulesContent}`
+${consoleModulesContent}`,
+    fileContent: [fileBaseContent ?? baseContent, fileModulesContent].filter((content) => content.length > 0).join("\n")
   };
 }
-function generateTypeStrings(formatType, envInterface, envTypeStructure, modulesTypeStructure, stringKeys, compatibilityDate, compatibilityFlags, entrypointModule, configuredDurableObjects, typeDefinitions = []) {
+function generateTypeStrings(formatType, envInterface, envTypeStructure, consoleModulesTypeStructure, fileModulesTypeStructure, stringKeys, compatibilityDate, compatibilityFlags, entrypointModule, configuredDurableObjects, typeDefinitions = []) {
   let baseContent = "";
+  let fileBaseContent;
   let processEnv = "";
   const typeDefsContent = typeDefinitions.length > 0 ? typeDefinitions.map((def) => `	${def}`).join("\n") : "";
   if (formatType === "modules") {
@@ -204278,13 +204731,17 @@ interface ${envInterface} extends ${internalEnvInterface} {}${processEnv}`;
 declare global {
 ${envTypeStructure.map((value) => `	const ${value}`).join("\n")}
 }`;
+    fileBaseContent = generateServiceWorkerTypes(
+      typeDefinitions,
+      envTypeStructure
+    );
   }
-  const modulesContent = modulesTypeStructure.join("\n");
+  const consoleModulesContent = consoleModulesTypeStructure.join("\n");
+  const fileModulesContent = fileModulesTypeStructure.join("\n");
   return {
-    fileContent: `${baseContent}
-${modulesContent}`,
+    fileContent: [fileBaseContent ?? baseContent, fileModulesContent].filter((content) => content.length > 0).join("\n"),
     consoleOutput: `${baseContent}
-${modulesContent}`
+${consoleModulesContent}`
   };
 }
 function readTsconfigTypes(tsconfigPath) {
@@ -205853,7 +206310,7 @@ function collectPipelinesPerEnvironment(args) {
   }
   return result;
 }
-var typesCommand, validateTypesFile, logHorizontalRule, INHERITABLE_BINDINGS;
+var import_glob_to_regexp3, typesCommand, validateTypesFile, logHorizontalRule, INHERITABLE_BINDINGS;
 var init_type_generation = __esm({
   "src/type-generation/index.ts"() {
     init_import_meta_url();
@@ -205861,10 +206318,12 @@ var init_type_generation = __esm({
     init_src();
     init_source();
     init_find();
+    import_glob_to_regexp3 = __toESM(require_glob_to_regexp());
     init_yargs();
     init_config6();
     init_create_command();
     init_entry();
+    init_rules13();
     init_class_names_sqlite();
     init_dev_vars();
     init_logger2();
@@ -206041,7 +206500,18 @@ var init_type_generation = __esm({
     __name(isValidIdentifier2, "isValidIdentifier");
     __name(escapeTypeScriptString, "escapeTypeScriptString");
     __name(constructTypeKey, "constructTypeKey");
-    __name(constructTSModuleGlob, "constructTSModuleGlob");
+    __name(getTSModuleGlob, "getTSModuleGlob");
+    __name(getFallbackModuleGlob, "getFallbackModuleGlob");
+    __name(isAdditionalModuleDiscoveryEnabled, "isAdditionalModuleDiscoveryEnabled");
+    __name(generateModuleTypeDeclarations, "generateModuleTypeDeclarations");
+    __name(resolveModuleTypeDeclarations, "resolveModuleTypeDeclarations");
+    __name(intersectModuleGlobs, "intersectModuleGlobs");
+    __name(moduleGlobMatches, "moduleGlobMatches");
+    __name(moduleGlobContains, "moduleGlobContains");
+    __name(resolveMatchingModuleTypes, "resolveMatchingModuleTypes");
+    __name(generateCombinedModuleTypeDeclarations, "generateCombinedModuleTypeDeclarations");
+    __name(generateModuleTypeDeclaration, "generateModuleTypeDeclaration");
+    __name(generateServiceWorkerTypes, "generateServiceWorkerTypes");
     __name(generateImportSpecifier, "generateImportSpecifier");
     __name(hasConfigSecrets, "hasConfigSecrets");
     __name(generateEnvTypes, "generateEnvTypes");
@@ -232135,7 +232605,7 @@ async function executeSql({
   preview: preview2
 }) {
   const existingLogLevel = logger2.loggerLevel;
-  if (json2) {
+  if (json2 && existingLogLevel !== "none") {
     logger2.loggerLevel = "error";
   }
   try {
@@ -232594,7 +233064,7 @@ var init_execute = __esm({
           preview: preview2
         } = args;
         const existingLogLevel = logger2.loggerLevel;
-        if (json2) {
+        if (json2 && existingLogLevel !== "none") {
           logger2.loggerLevel = "error";
         }
         if (file3 && command2) {
@@ -295650,7 +296120,7 @@ var init_split = __esm({
               conditions: [],
               serve_variation: variation,
               rollout: {
-                percentage: Math.min(100, Number(cumulative.toFixed(6))),
+                percentage: Math.min(100, Number(cumulative.toFixed(2))),
                 attribute: args.by
               }
             });
@@ -297833,6 +298303,14 @@ var init_kv2 = __esm({
           describe: 'The jurisdiction where the new namespace will be created (e.g. "us", "eu", "fedramp")',
           requiresArg: true
         },
+        "experimental-mode": {
+          alias: "x-mode",
+          type: "string",
+          describe: "The storage mode for the new namespace. Instant mode offers lower-latency reads and faster global updates [private beta].\nCannot be combined with --jurisdiction.",
+          choices: ["instant"],
+          requiresArg: true,
+          conflicts: "jurisdiction"
+        },
         ...sharedResourceCreationArgs
       },
       positionalArgs: ["namespace"],
@@ -297841,18 +298319,19 @@ var init_kv2 = __esm({
         const environment = args.env ? `${args.env}-` : "";
         const preview2 = args.preview ? "_preview" : "";
         const title = `${environment}${args.namespace}${preview2}`;
-        const { jurisdiction } = args;
+        const { jurisdiction, experimentalMode: mode } = args;
         const accountId = await requireAuth(config2);
         printResourceLocation("remote");
         logger2.log(
-          `\u{1F300} Creating namespace with title "${title}"${jurisdiction ? ` (jurisdiction: ${jurisdiction})` : ""}`
+          `\u{1F300} Creating namespace with title "${title}"${jurisdiction ? ` (jurisdiction: ${jurisdiction})` : ""}${mode ? ` (mode: ${mode})` : ""}`
         );
         let namespaceId;
         try {
           const createParams = {
             account_id: accountId,
             title,
-            jurisdiction
+            jurisdiction,
+            mode
           };
           const result = await sdk.kv.namespaces.create(createParams);
           namespaceId = result.id;
@@ -304842,6 +305321,7 @@ ${JSON.stringify(defaultRoutesJSONSpec, null, 2)}`
             tsconfig: void 0,
             minify: void 0,
             tunnelName: void 0,
+            tunnelAllowedMail: void 0,
             env: void 0,
             envFile: void 0,
             ip,
@@ -305257,6 +305737,19 @@ var init_getLegacyScriptName = __esm({
 });
 
 // src/secret/index.ts
+function throwIfLatestVersionNotDeployed(e11, versionsCommand, telemetryMessage) {
+  if (e11 instanceof APIError && e11.code !== void 0 && VERSION_NOT_DEPLOYED_ERR_CODES.includes(e11.code)) {
+    throw new UserError(
+      `Secret edit failed. You attempted to modify a secret, but the latest version of your Worker isn't currently deployed.
+This limitation exists to prevent accidental deployment when using Worker versions and secrets together.
+To resolve this, you have two options:
+(1) use the \`${versionsCommand}\` instead, which allows you to update secrets without deploying; or
+(2) deploy the latest version first, then modify secrets.
+Alternatively, you can use the Cloudflare dashboard to modify secrets and deploy the version.`,
+      { telemetryMessage }
+    );
+  }
+}
 async function createDraftWorker({
   config: config2,
   accountId,
@@ -305325,14 +305818,23 @@ async function putBulkSecrets(config2, accountId, scriptName, content) {
       secrets[key] = null;
     }
   }
-  const resp = await fetchResult2(config2, url4, {
-    method: "PATCH",
-    headers: { "Content-Type": "application/merge-patch+json" },
-    body: JSON.stringify({ secrets })
-  });
-  return [resp, toCreate, toDelete];
+  try {
+    const resp = await fetchResult2(config2, url4, {
+      method: "PATCH",
+      headers: { "Content-Type": "application/merge-patch+json" },
+      body: JSON.stringify({ secrets })
+    });
+    return [resp, toCreate, toDelete];
+  } catch (e11) {
+    throwIfLatestVersionNotDeployed(
+      e11,
+      "wrangler versions secret bulk",
+      "secret bulk version not deployed"
+    );
+    throw e11;
+  }
 }
-var VERSION_NOT_DEPLOYED_ERR_CODE, secretNamespace, secretPutCommand, secretDeleteCommand, secretListCommand, secretBulkCommand;
+var VERSION_NOT_DEPLOYED_ERR_CODE, VERSION_SETTINGS_NOT_DEPLOYED_ERR_CODE, VERSION_NOT_DEPLOYED_ERR_CODES, secretNamespace, secretPutCommand, secretDeleteCommand, secretListCommand, secretBulkCommand;
 var init_secret = __esm({
   "src/secret/index.ts"() {
     init_import_meta_url();
@@ -305349,6 +305851,12 @@ var init_secret = __esm({
     init_std();
     init_src3();
     VERSION_NOT_DEPLOYED_ERR_CODE = 10215;
+    VERSION_SETTINGS_NOT_DEPLOYED_ERR_CODE = 10214;
+    VERSION_NOT_DEPLOYED_ERR_CODES = [
+      VERSION_NOT_DEPLOYED_ERR_CODE,
+      VERSION_SETTINGS_NOT_DEPLOYED_ERR_CODE
+    ];
+    __name(throwIfLatestVersionNotDeployed, "throwIfLatestVersionNotDeployed");
     __name(createDraftWorker, "createDraftWorker");
     secretNamespace = createNamespace({
       metadata: {
@@ -305415,14 +305923,12 @@ var init_secret = __esm({
               })
             });
           } catch (e11) {
-            if (e11 instanceof APIError && e11.code === VERSION_NOT_DEPLOYED_ERR_CODE) {
-              throw new UserError(
-                "Secret edit failed. You attempted to modify a secret, but the latest version of your Worker isn't currently deployed.\nThis limitation exists to prevent accidental deployment when using Worker versions and secrets together.\nTo resolve this, you have two options:\n(1) use the `wrangler versions secret put` instead, which allows you to update secrets without deploying; or\n(2) deploy the latest version first, then modify secrets.\nAlternatively, you can use the Cloudflare dashboard to modify secrets and deploy the version.",
-                { telemetryMessage: "secret put version not deployed" }
-              );
-            } else {
-              throw e11;
-            }
+            throwIfLatestVersionNotDeployed(
+              e11,
+              "wrangler versions secret put",
+              "secret put version not deployed"
+            );
+            throw e11;
           }
         }
         __name(submitSecret, "submitSecret");
@@ -344981,7 +345487,23 @@ function parseSourceArgument(source, args) {
     case "artifacts" /* ARTIFACTS */:
       return { type: "artifacts" /* ARTIFACTS */ };
     case "artifacts.repo" /* ARTIFACTS_REPO */:
-      return { type: "artifacts.repo" /* ARTIFACTS_REPO */ };
+      if (!args.sourceNamespace) {
+        throw new UserError(
+          `--source-namespace is required when using source '${"artifacts.repo" /* ARTIFACTS_REPO */}'`,
+          { telemetryMessage: "queues subscription create missing namespace" }
+        );
+      }
+      if (!args.sourceRepoName) {
+        throw new UserError(
+          `--source-repo-name is required when using source '${"artifacts.repo" /* ARTIFACTS_REPO */}'`,
+          { telemetryMessage: "queues subscription create missing repo name" }
+        );
+      }
+      return {
+        type: "artifacts.repo" /* ARTIFACTS_REPO */,
+        namespace: args.sourceNamespace,
+        repo_name: args.sourceRepoName
+      };
     case "browserRun" /* BROWSER_RUN */:
       return { type: "browserRun" /* BROWSER_RUN */ };
     case "email.sending" /* EMAIL_SENDING */:
@@ -345085,7 +345607,7 @@ var init_create18 = __esm({
           choices: EVENT_SOURCE_TYPES
         },
         events: {
-          describe: "Comma-separated list of event types to subscribe to",
+          describe: "Comma-separated list of event types to subscribe to (for artifacts.repo, use pushed, not cf.artifacts.repo.pushed)",
           type: "string",
           demandOption: true
         },
@@ -345117,6 +345639,14 @@ var init_create18 = __esm({
         domain: {
           describe: "Sending domain \u2014 zone apex or verified subdomain (required for email.sending source)",
           type: "string"
+        },
+        "source-namespace": {
+          describe: "Artifacts namespace (required for artifacts.repo source)",
+          type: "string"
+        },
+        "source-repo-name": {
+          describe: "Artifacts repository name (required for artifacts.repo source)",
+          type: "string"
         }
       },
       async handler(args, { config: config2 }) {
@@ -345125,7 +345655,9 @@ var init_create18 = __esm({
           workerName: args.workerName,
           workflowName: args.workflowName,
           zoneId: args.zoneId,
-          domain: args.domain
+          domain: args.domain,
+          sourceNamespace: args.sourceNamespace,
+          sourceRepoName: args.sourceRepoName
         });
         const events7 = args.events.split(",").map((event) => event.trim()).filter(Boolean);
         if (events7.length === 0) {
@@ -345223,6 +345755,8 @@ function getSourceType(source) {
 }
 function getSourceResource(source) {
   switch (source.type) {
+    case "artifacts.repo" /* ARTIFACTS_REPO */:
+      return `${source.namespace}/${source.repo_name}`;
     case "email.sending" /* EMAIL_SENDING */:
       return source.domain;
     case "workersAi.model" /* WORKERS_AI_MODEL */:
@@ -348057,7 +348591,7 @@ async function usingLocalBucket(persistTo, config2, bucketName, closure) {
         try {
           if (request.method !== "PUT") return new Response(null, { status: 405 });
           const url = new URL(request.url);
-          const key = url.pathname.substring(1);
+          const key = decodeURIComponent(url.pathname.substring(1));
           const optsHeader = request.headers.get("Wrangler-R2-Put-Options");
           const opts = JSON.parse(optsHeader);
           await env.BUCKET.put(key, request.body, opts);
@@ -348456,15 +348990,18 @@ var init_object3 = __esm({
                   cacheExpiry: yArgs.expires === void 0 ? void 0 : parseInt(yArgs.expires)
                 }
               };
-              await mf.dispatchFetch(`http://localhost/${key}`, {
-                method: "PUT",
-                body: objectStream,
-                duplex: "half",
-                headers: {
-                  "Content-Length": String(sizeBytes),
-                  "Wrangler-R2-Put-Options": JSON.stringify(putOptions)
+              await mf.dispatchFetch(
+                `http://localhost/${encodeURIComponent(key)}`,
+                {
+                  method: "PUT",
+                  body: objectStream,
+                  duplex: "half",
+                  headers: {
+                    "Content-Length": String(sizeBytes),
+                    "Wrangler-R2-Put-Options": JSON.stringify(putOptions)
+                  }
                 }
-              });
+              );
             }
           );
         } else {
@@ -348709,15 +349246,18 @@ var init_object3 = __esm({
                   if ((index + 1) % 100 === 0 || index + 1 === entries2.length) {
                     logBulkProgress2("Uploaded", index + 1, entries2.length);
                   }
-                  await mf.dispatchFetch(`http://localhost/${entry.key}`, {
-                    method: "PUT",
-                    body: Stream__namespace.Readable.toWeb(fs14__namespace.createReadStream(entry.file)),
-                    duplex: "half",
-                    headers: {
-                      "Content-Length": String(entry.size),
-                      "Wrangler-R2-Put-Options": jsonPutOptions
+                  await mf.dispatchFetch(
+                    `http://localhost/${encodeURIComponent(entry.key)}`,
+                    {
+                      method: "PUT",
+                      body: Stream__namespace.Readable.toWeb(fs14__namespace.createReadStream(entry.file)),
+                      duplex: "half",
+                      headers: {
+                        "Content-Length": String(entry.size),
+                        "Wrangler-R2-Put-Options": jsonPutOptions
+                      }
                     }
-                  });
+                  );
                 })
               );
               try {
@@ -355006,7 +355546,7 @@ var init_bulk5 = __esm({
     init_secrets6();
     versionsSecretBulkCommand = createCommand({
       metadata: {
-        description: "Create or update a secret variable for a Worker",
+        description: "Create, update, or delete multiple secret variables for a Worker",
         owner: "Workers: Authoring and Testing",
         status: "stable"
       },
@@ -355018,7 +355558,7 @@ var init_bulk5 = __esm({
       },
       args: {
         file: {
-          describe: `The file of key-value pairs to upload, as JSON in form {"key": value, ...} or .dev.vars file in the form KEY=VALUE`,
+          describe: `The file of key-value pairs to create, update, or delete, as JSON in form {"key": "value", ...} or .env file in the form KEY=VALUE. Set a key to null in the JSON file to delete it. Deletion is not supported with .env files. If omitted, Wrangler expects to receive input from stdin rather than a file.`,
           type: "string"
         },
         name: {
@@ -355048,9 +355588,9 @@ var init_bulk5 = __esm({
         }
         const accountId = await requireAuth(config2);
         logger2.log(
-          `\u{1F300} Creating the secrets for the Worker "${scriptName}" ${args.env ? `(${args.env})` : ""}`
+          `\u{1F300} Processing the secrets for the Worker "${scriptName}" ${args.env ? `(${args.env})` : ""}`
         );
-        const result = await parseBulkInputToObject(args.file);
+        const result = await parseBulkInputToObject(args.file, true);
         if (!result) {
           return logger2.error(`No content found in file or piped input.`);
         }
@@ -355066,8 +355606,16 @@ var init_bulk5 = __esm({
           sendMetrics: config2.send_metrics,
           noVersionsTelemetryMessage: "versions secrets bulk no uploaded versions"
         });
-        for (const [name2] of secretEntries) {
-          logger2.log(`\u2728 Successfully created secret for key: ${name2}`);
+        let created = 0;
+        let deleted = 0;
+        for (const [name2, value] of secretEntries) {
+          if (value === null) {
+            deleted++;
+            logger2.log(`\u{1F4A5} Successfully deleted secret for key: ${name2}`);
+          } else {
+            created++;
+            logger2.log(`\u2728 Successfully created secret for key: ${name2}`);
+          }
         }
         sendMetricsEvent(
           "create encrypted variable",
@@ -355082,7 +355630,7 @@ var init_bulk5 = __esm({
           }
         );
         logger2.log(
-          `\u2728 Success! Created version ${newVersion.id} with ${secretEntries.length} secrets.
+          `\u2728 Success! Created version ${newVersion.id} with ${created} secret${created === 1 ? "" : "s"} created and ${deleted} secret${deleted === 1 ? "" : "s"} deleted.
 \u27A1\uFE0F  To deploy this version to production traffic use the command "wrangler versions deploy".`
         );
       }, "versionsSecretPutBulkHandler")
@@ -366901,7 +367449,7 @@ var init_dev3 = __esm({
         const tunnelConfig = this.getCurrentTunnelConfig();
         const isQuickTunnel = tunnelConfig?.name === void 0;
         logger2.warn(
-          (isQuickTunnel ? source_default.dim("Once connected, this tunnel will be ") + "publicly accessible" : source_default.dim(
+          (isQuickTunnel ? source_default.dim("Once connected, this tunnel may be ") + "publicly accessible" : source_default.dim(
             "Once connected, this tunnel may be reachable from the Internet"
           )) + source_default.dim(". Anyone who can reach it can:\n") + source_default.dim(
             "- Call ungated endpoints\n- Trigger logic that uses remote bindings\n- Reach internal services if your Worker proxies requests\n\n" + (isQuickTunnel ? "Consider using a named tunnel with Cloudflare Access to restrict access.\n" : "Consider using Cloudflare Access to restrict access.\n")
@@ -366914,6 +367462,7 @@ var init_dev3 = __esm({
         const nextTunnel = startTunnel({
           origin,
           token: namedTunnel?.token,
+          allowedMail: tunnelConfig?.allowedMail,
           extendHint: "Press [a] to extend by 1 hour.",
           logger: logger2
         });
@@ -368194,7 +368743,7 @@ var init_compatibility_flags = __esm({
 });
 
 // ../workers-shared/asset-worker/src/utils/base-path.ts
-var init_base_path = __esm({
+var init_base_path2 = __esm({
   "../workers-shared/asset-worker/src/utils/base-path.ts"() {
     init_import_meta_url();
   }
@@ -368226,7 +368775,7 @@ var init_handler2 = __esm({
     init_responses2();
     init_tracing2();
     init_compatibility_flags();
-    init_base_path();
+    init_base_path2();
     init_headers();
     init_rules_engine();
   }
@@ -369501,7 +370050,8 @@ async function setupDevEnv(devEnv, configPath, auth2, args) {
         experimentalNewConfig: args.experimentalNewConfig,
         tunnel: {
           enabled: args.tunnel ?? false,
-          name: args.tunnelName
+          name: args.tunnelName,
+          allowedMail: args.tunnelAllowedMail?.length ? args.tunnelAllowedMail : void 0
         }
       },
       legacy: {
@@ -369724,6 +370274,7 @@ unstable_dev()'s behaviour will likely change in future releases`
     types: false,
     tunnel: void 0,
     tunnelName: void 0,
+    tunnelAllowedMail: void 0,
     experimentalNewConfig: false
   };
   const devServer = await run(