[pull] main from cloudflare:main

.changeset/bundle-private-deploy-helpers-deps.md

@@ -0,0 +1,7 @@
+---
+"@cloudflare/deploy-helpers": patch
+---
+
+Bundle private internal dependencies in deploy helpers
+
+`@cloudflare/deploy-helpers` no longer declares private workspace packages as runtime dependencies, so installing the package from npm does not require unpublished internal packages.

.changeset/graduate-autoconfig-stable.md

@@ -0,0 +1,9 @@
+---
+"wrangler": minor
+---
+
+Graduate autoconfig from experimental to stable
+
+The `--experimental-autoconfig` and `--x-autoconfig` deploy CLI flags have been replaced with `--autoconfig`.
+
+Note that the `--autoconfig` flag defaults to `true` and that it can be used to disable Wrangler's auto-configuration logic by setting it to `false` via `--autoconfig=false` or `--no-autoconfig`

.changeset/suggest-skills-after-commands.md

@@ -0,0 +1,9 @@
+---
+"wrangler": minor
+---
+
+Suggest Cloudflare skills installation after commands instead of before
+
+The automatic prompt to install Cloudflare skills for detected AI coding agents no longer runs before every Wrangler command. Instead, Wrangler now suggests installing skills, when appropriate, after some commands complete successfully. Commands that output JSON suppress the suggestion to keep their output clean. The `--install-skills` flag remains available on all commands to explicitly run the skills installation flow before the command executes, without prompting.
+
+As before, Wrangler asks the skills installation question at most once. The skills install metadata file is now written before the confirmation prompt is shown, so even if the user interrupts the process (e.g. CTRL+C, closing the terminal) during the prompt, the question is recorded as unanswered and will not reappear on subsequent runs.

.changeset/temporary-preview-accounts.md

@@ -0,0 +1,8 @@
+---
+"wrangler": minor
+"@cloudflare/workers-auth": minor
+---
+
+Add a `--temporary` flag that creates and uses a temporary Cloudflare preview account when you have no credentials, instead of starting the OAuth login flow.
+
+It's registered only on the commands the short-lived account token can serve — Workers (`deploy`, `versions upload`, and related commands), KV, D1, Hyperdrive, Queues, and certificate commands — and is for unauthenticated use only: passing it while already authenticated (OAuth, `CLOUDFLARE_API_TOKEN`, or a global API key) errors rather than silently ignoring the flag. Before provisioning, Wrangler handles Cloudflare's Terms of Service and Privacy Policy (interactive terminals prompt for `yes`; non-interactive shells print a notice and continue). Wrangler then runs with the short-lived token and prints a claim URL so the account can be claimed before it expires. The cached account is cleared on successful login or logout.

.changeset/tidy-clouds-config.md

@@ -0,0 +1,7 @@
+---
+"@cloudflare/deploy-helpers": minor
+---
+
+Expose Cloudflare config conversion utilities from deploy helpers
+
+`@cloudflare/deploy-helpers` now re-exports `ConfigSchema` and `convertToWranglerConfig` from the internal `@cloudflare/config` package, so consumers can parse and convert Cloudflare config files without depending on the unpublished package directly.

packages/config/tsdown.config.ts

@@ -9,4 +9,8 @@ export default defineConfig({
 	outDir: "dist",
 	dts: true,
 	tsconfig: "tsconfig.json",
+	// Keep zod external so consumers that bundle this package (wrangler,
+	// deploy-helpers, vite-plugin) share a single zod copy instead of inlining
+	// one per consumed entry point.
+	external: [/^zod(\/.*)?$/],
 });

packages/deploy-helpers/package.json

@@ -38,8 +38,6 @@
 	},
 	"dependencies": {
 		"@cloudflare/cli-shared-helpers": "workspace:*",
-		"@cloudflare/containers-shared": "workspace:*",
-		"@cloudflare/workers-shared": "workspace:*",
 		"@cloudflare/workers-utils": "workspace:*",
 		"blake3-wasm": "2.1.5",
 		"chalk": "catalog:default",
@@ -51,6 +49,9 @@
 		"undici": "catalog:default"
 	},
 	"devDependencies": {
+		"@cloudflare/config": "workspace:*",
+		"@cloudflare/containers-shared": "workspace:*",
+		"@cloudflare/workers-shared": "workspace:*",
 		"@cloudflare/workers-tsconfig": "workspace:*",
 		"@cspotcode/source-map-support": "0.8.1",
 		"@types/command-exists": "^1.2.0",
@@ -63,7 +64,16 @@
 		"ts-dedent": "^2.2.0",
 		"tsup": "8.3.0",
 		"typescript": "catalog:default",
-		"vitest": "catalog:default"
+		"vitest": "catalog:default",
+		"zod": "^4.4.3"
+	},
+	"peerDependencies": {
+		"zod": "^4.4.3"
+	},
+	"peerDependenciesMeta": {
+		"zod": {
+			"optional": true
+		}
 	},
 	"volta": {
 		"extends": "../../package.json"

packages/deploy-helpers/scripts/deps.ts

@@ -8,9 +8,7 @@ export const EXTERNAL_DEPENDENCIES = [
 	// Workspace packages kept external so consumers share a single copy of
 	// types and runtime code (e.g. ParseError instanceof checks).
 	"@cloudflare/cli-shared-helpers",
-	"@cloudflare/containers-shared",
 	"@cloudflare/workers-utils",
-	"@cloudflare/workers-shared",
 	"miniflare",
 
 	// These are externalized to avoid duplication in wrangler's bundle,
@@ -22,4 +20,9 @@ export const EXTERNAL_DEPENDENCIES = [
 	"p-queue",
 	"pretty-bytes",
 	"undici",
+
+	// Externalized so wrangler bundles a single shared zod copy instead of
+	// inlining one via this package. Declared as a peerDependency (the
+	// consumer provides zod).
+	"zod",
 ];

packages/deploy-helpers/src/config.ts

@@ -0,0 +1,2 @@
+import { ConfigSchema, convertToWranglerConfig } from "@cloudflare/config";
+export { ConfigSchema, convertToWranglerConfig };

packages/deploy-helpers/src/index.ts

@@ -1,4 +1,5 @@
 export * from "./shared/types";
+export { ConfigSchema, convertToWranglerConfig } from "./config";
 export { initDeployHelpersContext } from "./shared/context";
 export { default as deploy } from "./deploy/deploy";
 export type { DeployCallbacks } from "./deploy/deploy";

packages/deploy-helpers/tsup.config.ts

@@ -19,6 +19,11 @@ export default defineConfig(() => [
 		tsconfig: "tsconfig.json",
 		metafile: true,
 		sourcemap: process.env.SOURCEMAPS !== "false",
+		noExternal: [
+			"@cloudflare/config",
+			"@cloudflare/containers-shared",
+			/^@cloudflare\/workers-shared(\/.*)?$/,
+		],
 		external: [
 			/^@cloudflare\//,
 			"blake3-wasm",
@@ -30,6 +35,9 @@ export default defineConfig(() => [
 			"dotenv",
 			"command-exists",
 			"esbuild",
+			// Keep zod external so wrangler (the only consumer) bundles a single
+			// shared copy rather than inlining one here.
+			/^zod(\/.*)?$/,
 		],
 	},
 ]);

packages/workers-auth/src/config-file/auth.ts

@@ -0,0 +1,15 @@
+import type { ConfigStorage } from ".";
+
+/**
+ * The data that may be read from the on-disk user auth config file.
+ */
+export interface UserAuthConfig {
+	oauth_token?: string;
+	refresh_token?: string;
+	expiration_time?: string;
+	scopes?: string[];
+	/** @deprecated - this field was only provided by the deprecated v1 `wrangler config` command. */
+	api_token?: string;
+}
+
+export type AuthConfigStorage = ConfigStorage<UserAuthConfig>;

packages/workers-auth/src/config-file/index.ts

@@ -0,0 +1,16 @@
+/**
+ * Pluggable persistence for a typed config blob
+ */
+export interface ConfigStorage<T> {
+	/**
+	 * Read and parse the stored config.
+	 * @throws if the backing store is missing or cannot be parsed.
+	 */
+	read(): T;
+	/** Serialize and persist the config. */
+	write(config: T): void;
+	/** Remove the backing store; returns whether anything existed beforehand. */
+	clear(): boolean;
+	/** Human-readable location of the backing store, for display and warnings. */
+	path(): string;
+}

packages/workers-auth/src/config-file/temporary.ts

@@ -0,0 +1,19 @@
+import type { ConfigStorage } from ".";
+
+/**
+ * A short-lived "temporary preview account"
+ */
+export type TemporaryPreviewAccount = {
+	account: {
+		id: string;
+		name: string;
+		apiToken: string;
+		expiresAt: string;
+	};
+	claim: {
+		url: string;
+		expiresAt: string;
+	};
+};
+
+export type TemporaryAccountStorage = ConfigStorage<TemporaryPreviewAccount>;

packages/workers-auth/src/context.ts

@@ -1,7 +1,25 @@
-import type { AuthConfigStorage } from "./auth-config-file";
+import type { AuthConfigStorage } from "./config-file/auth";
+import type { TemporaryAccountStorage } from "./config-file/temporary";
 import type { generateAuthUrl as defaultGenerateAuthUrl } from "./generate-auth-url";
 import type { generateRandomState as defaultGenerateRandomState } from "./generate-random-state";
 
+/**
+ * The dependencies the OAuth flow needs to mint/reuse a short-lived "temporary
+ * preview account"
+ */
+export interface OAuthFlowTemporaryContext {
+	/** Persistence backend for the cached temporary preview account. */
+	storage: TemporaryAccountStorage;
+	/**
+	 * Hook to customise the terms-acceptance interactive prompt
+	 *  - question: the question to ask a user in interactive mode.
+	 *    return answer === "yes" (must be the literal string)
+	 *  - notice: the notice to print on stderr if in non-interactive mode
+	 *    always return true
+	 */
+	prompt: (question: string, notice: string) => Promise<boolean>;
+}
+
 /**
  * The branded OAuth consent pages the provider redirects the browser to after
  * the user grants or denies consent.
@@ -90,6 +108,18 @@ export interface OAuthFlowContext {
 	 */
 	storage: AuthConfigStorage;
 
+	/**
+	 * Whether the flow's credential resolvers (`getAPIToken` / `requireApiToken`)
+	 * should honour the global API key + email pair in addition to scoped API
+	 * tokens.
+	 */
+	allowGlobalAuthKey: boolean;
+
+	/**
+	 * Dependencies for minting/reusing a temporary preview account.
+	 */
+	temporary: OAuthFlowTemporaryContext | undefined;
+
 	/**
 	 * Override the OAuth authorize URL generator. Used by tests to produce a
 	 * deterministic URL for snapshot testing. Defaults to the standard

packages/workers-auth/src/credentials.ts

@@ -2,8 +2,8 @@ import {
 	getEnvironmentVariableFactory,
 	UserError,
 } from "@cloudflare/workers-utils";
-import { type AuthConfigStorage } from "./auth-config-file";
 import { readStoredAuthState } from "./state";
+import type { AuthConfigStorage } from "./config-file/auth";
 import type { OAuthFlowLogger } from "./context";
 import type { ApiCredentials } from "@cloudflare/workers-utils";