[pull] main from cloudflare:main

AGENTS.md

@@ -63,6 +63,21 @@ This is the **Cloudflare Workers SDK** monorepo containing tools and libraries f
 - Shared ESLint config in `packages/eslint-config-shared/`
 - Dependency management via pnpm catalog system
 
+## WHERE TO LOOK
+
+| Task                                           | Location                                       | Notes                                                            |
+| ---------------------------------------------- | ---------------------------------------------- | ---------------------------------------------------------------- |
+| Add/modify a CLI command                       | `packages/wrangler/src/`                       | Commands registered in `src/index.ts` (2k+ line yargs tree)      |
+| Change local dev behavior                      | `packages/miniflare/src/`                      | `src/index.ts` is the main `Miniflare` class                     |
+| Modify Workers runtime simulation              | `packages/miniflare/src/workers/`              | ~30 embedded worker scripts, built via `worker:` virtual imports |
+| Add a test fixture                             | `fixtures/`                                    | Each fixture is a full workspace member with own `package.json`  |
+| Shared config types/validation                 | `packages/workers-utils/src/config/`           | `validation.ts` is the config normalizer (large file)            |
+| Test helpers (runInTempDir, seed, mockConsole) | `packages/workers-utils/src/test-helpers/`     | Shared across wrangler, miniflare, others                        |
+| Cloudflare API mocks for tests                 | `packages/wrangler/src/__tests__/helpers/msw/` | MSW handlers per API domain                                      |
+| CI workflows                                   | `.github/workflows/`                           | `test-and-check.yml` is the primary gate                         |
+| Build/deploy scripts                           | `tools/deployments/`                           | Validation + deployment helpers, run via `esbuild-register`      |
+| Changeset config and rules                     | `.changeset/README.md`                         | Must read before creating changesets                             |
+
 ## Development Guidelines
 
 **Requirements:**
@@ -84,17 +99,34 @@ This is the **Cloudflare Workers SDK** monorepo containing tools and libraries f
 - Format with Prettier - run `pnpm prettify` in the workspace root before committing
 - All changes to published packages require a changeset (see below)
 
+**Formatting (Prettier):**
+
+- Tabs (not spaces), double quotes, semicolons, trailing commas (es5)
+- Import order enforced: builtins → third-party → parent → sibling → index → types
+- `prettier-plugin-packagejson` sorts package.json keys
+
+**Security:**
+
+- Custom ESLint rule `workers-sdk/no-unsafe-command-execution`: no template literals or string concatenation in `exec`/`spawn`/`execFile` calls (command injection prevention, CWE-78). Disabled in test files only.
+
+**Dependencies:**
+
+- Packages must bundle deps into distributables; runtime `dependencies` are forbidden except for an explicit allowlist
+- External (non-bundled) deps must be declared in `scripts/deps.ts` with `EXTERNAL_DEPENDENCIES` and a comment explaining why
+
 **Testing Standards:**
 
 - Unit tests with Vitest for all packages
 - Fixture tests in `/fixtures` directory for filesystem/Worker scenarios
 - E2E tests require real Cloudflare account credentials
 - Use `vitest-pool-workers` for testing actual Workers runtime behavior
+- Shared vitest config (`vitest.shared.ts`): 50s timeouts, `retry: 2`, `restoreMocks: true`
 
 **Git Workflow:**
 
 - Check you are not on main before committing. Create a new branch for your work from main if needed.
 - Clean commit history required before first review
+- Don't squash commits after review
 - Never commit without changesets for user-facing changes
 - PR template requirements: Remove "Fixes #..." line when no relevant issue exists, keep all checkboxes (don't delete unchecked ones)
 
@@ -108,12 +140,12 @@ This is the **Cloudflare Workers SDK** monorepo containing tools and libraries f
 
 ## Key Locations
 
-- `/fixtures` - Test fixtures and example applications
+- `/fixtures` - Test fixtures and example applications (each a workspace member)
 - `/packages/wrangler/src` - Main Wrangler CLI source code
 - `/packages/miniflare/src` - Miniflare source
-- `/tools` - Build scripts and deployment utilities
+- `/tools` - Build scripts and deployment utilities (run via `esbuild-register`, no build step)
 - `turbo.json` - Turbo build configuration
-- `pnpm-workspace.yaml` - Workspace configuration
+- `pnpm-workspace.yaml` - Workspace configuration (~156 workspace members)
 
 ## Testing Strategy
 
@@ -132,3 +164,37 @@ Every change to package code requires a changeset or it will not trigger a relea
 
 The changeset descriptions can either use conventional commit prefixes (e.g., "fix: remove unused option") or
 start with a capital letter and describe the change directly (e.g., "Remove unused option" not").
+
+**Changeset Rules:**
+
+- Major versions for `wrangler` are currently **forbidden**
+- `patch`: bug fixes; `minor`: new features, deprecations, experimental breaking changes; `major`: stable breaking changes only
+- No h1/h2/h3 headers in changeset descriptions (changelog uses h3)
+- Config examples must use `wrangler.json` (JSONC), not `wrangler.toml`
+- Separate changesets for distinct changes; do not lump unrelated changes
+
+## Anti-Patterns
+
+These are explicitly forbidden across the repo:
+
+- **npm/yarn** → use pnpm
+- **`any` type** → properly type everything
+- **Non-null assertions (`!`)** → use type narrowing
+- **Floating promises** → await or void explicitly
+- **Missing curly braces** → always brace control flow
+- **`console.*` in wrangler** → use the `logger` singleton
+- **Direct Cloudflare REST API calls** → use the Cloudflare TypeScript SDK
+- **Named imports from `ci-info`** → use default import (`import ci from "ci-info"`)
+- **Runtime dependencies** → bundle deps; external deps need explicit allowlist entry
+- **Committing to main** → always work on a branch
+
+## Subdirectory Knowledge
+
+Packages with their own AGENTS.md for deeper context:
+
+- `packages/wrangler/AGENTS.md` - CLI architecture, command structure, test patterns
+- `packages/miniflare/AGENTS.md` - Worker simulation, embedded workers, build system
+- `packages/vite-plugin-cloudflare/AGENTS.md` - Plugin architecture, playground setup
+- `packages/create-cloudflare/AGENTS.md` - Scaffolding, template system
+- `packages/vitest-pool-workers/AGENTS.md` - 3-context architecture, cloudflare:test module
+- `packages/workers-utils/AGENTS.md` - Shared config validation, test helpers

packages/create-cloudflare/AGENTS.md

@@ -0,0 +1,31 @@
+# AGENTS.md — Create Cloudflare (C3)
+
+## OVERVIEW
+
+Project scaffolding CLI for Cloudflare Workers. Single entry: `src/cli.ts` serves as CLI, library export, and bin target.
+
+## STRUCTURE
+
+- `src/cli.ts` — Main entry. Exports `main(argv)` for programmatic use, has shebang for direct execution
+- `templates/` — Scaffolding templates (excluded from linting and most formatting)
+- `scripts/build.ts` — esbuild-based build → `dist/cli.js`
+
+## BUILD
+
+- esbuild bundles `src/cli.ts` as CJS → `dist/cli.js`
+- `package.json` `main`, `exports["."]`, and `bin` all point at `dist/cli.js`
+- No separate bin shim — the built output IS the bin
+
+## CONVENTIONS
+
+- `no-console: error` — use project's logging utilities
+- Own `.prettierrc` — same settings as root but without `prettier-plugin-packagejson`
+- Templates excluded from linting (except `c3.ts` files within templates)
+- Templates excluded from formatting (except hello-world templates)
+
+## TESTING
+
+- E2E tests run across pnpm/npm (yarn/bun also supported but not in CI), Linux/Windows
+- Own vitest setup: mocks `log-update` and `@cloudflare/cli/streams`
+- CI has experimental matrix for framework testing
+- Python/UV installed in CI for Python framework E2E tests

packages/create-cloudflare/CHANGELOG.md

@@ -1,5 +1,59 @@
 # create-cloudflare
 
+## 2.64.3
+
+### Patch Changes
+
+- [#12630](https://github.com/cloudflare/workers-sdk/pull/12630) [`e8fddc5`](https://github.com/cloudflare/workers-sdk/commit/e8fddc58fb99892f2ce5d1bb8c940b29acbe6c2a) Thanks [@dependabot](https://github.com/apps/dependabot)! - Update dependencies of "create-cloudflare"
+
+  The following dependency versions have been updated:
+
+  | Dependency | From   | To     |
+  | ---------- | ------ | ------ |
+  | create-vue | 3.21.0 | 3.21.1 |
+
+- [#12631](https://github.com/cloudflare/workers-sdk/pull/12631) [`5641c52`](https://github.com/cloudflare/workers-sdk/commit/5641c525bf65395918de0495fed2dd0c42f56d85) Thanks [@dependabot](https://github.com/apps/dependabot)! - Update dependencies of "create-cloudflare"
+
+  The following dependency versions have been updated:
+
+  | Dependency  | From    | To      |
+  | ----------- | ------- | ------- |
+  | create-vike | 0.0.575 | 0.0.581 |
+
+- [#12633](https://github.com/cloudflare/workers-sdk/pull/12633) [`35c8ebd`](https://github.com/cloudflare/workers-sdk/commit/35c8ebd688e7d4aaf30b3a147fa5b65e405f740f) Thanks [@dependabot](https://github.com/apps/dependabot)! - Update dependencies of "create-cloudflare"
+
+  The following dependency versions have been updated:
+
+  | Dependency             | From   | To     |
+  | ---------------------- | ------ | ------ |
+  | @tanstack/create-start | 0.59.3 | 0.59.8 |
+
+- [#12634](https://github.com/cloudflare/workers-sdk/pull/12634) [`11ace96`](https://github.com/cloudflare/workers-sdk/commit/11ace963bd195792bd53f7eec444c35fbbb27ec9) Thanks [@dependabot](https://github.com/apps/dependabot)! - Update dependencies of "create-cloudflare"
+
+  The following dependency versions have been updated:
+
+  | Dependency | From   | To     |
+  | ---------- | ------ | ------ |
+  | sv         | 0.12.1 | 0.12.2 |
+
+- [#12635](https://github.com/cloudflare/workers-sdk/pull/12635) [`4cee91e`](https://github.com/cloudflare/workers-sdk/commit/4cee91e87edddf6decfded0ef6fb503d36d25961) Thanks [@dependabot](https://github.com/apps/dependabot)! - Update dependencies of "create-cloudflare"
+
+  The following dependency versions have been updated:
+
+  | Dependency   | From   | To     |
+  | ------------ | ------ | ------ |
+  | create-solid | 0.6.11 | 0.6.13 |
+
+- [#12609](https://github.com/cloudflare/workers-sdk/pull/12609) [`1714b9b`](https://github.com/cloudflare/workers-sdk/commit/1714b9bbc834d6eac5982a41daf91026c1ad44b1) Thanks [@Hari-07](https://github.com/Hari-07)! - Fix --variant flag being ignored for pages
+
+  When creating a Pages project using `npm create cloudflare -- --type pages --variant <variant>`,
+  the `--variant` flag was being ignored, causing users to be prompted for variant selection
+  or defaulting to an unexpected variant. This now correctly passes the variant to the project setup.
+
+- [#12602](https://github.com/cloudflare/workers-sdk/pull/12602) [`58a4020`](https://github.com/cloudflare/workers-sdk/commit/58a4020eaafcb56cb81dd7d08c58d3d75da08603) Thanks [@anonrig](https://github.com/anonrig)! - Optimize filesystem operations by using Node.js's throwIfNoEntry: false option
+
+  This reduces the number of system calls made when checking for file existence by avoiding the overhead of throwing and catching errors for missing paths. This is an internal performance optimization with no user-visible behavioral changes.
+
 ## 2.64.2
 
 ### Patch Changes

packages/create-cloudflare/e2e/tests/frameworks/test-config.ts

@@ -167,6 +167,9 @@ function getFrameworkTestConfig(pm: string): NamedFrameworkTestConfig[] {
 			},
 			nodeCompat: false,
 			flags: ["--style", "sass"],
+			// TODO: currently the Angular tests are failing with `URL with hostname "localhost" is not allowed.`
+			//       we need to investigate this so that we can un-quarantine the Angular tests
+			quarantine: true,
 		},
 		{
 			name: "angular:workers",
@@ -186,6 +189,9 @@ function getFrameworkTestConfig(pm: string): NamedFrameworkTestConfig[] {
 			},
 			nodeCompat: false,
 			flags: ["--style", "sass"],
+			// TODO: currently the Angular tests are failing with `URL with hostname "localhost" is not allowed.`
+			//       we need to investigate this so that we can un-quarantine the Angular tests
+			quarantine: true,
 		},
 		{
 			name: "gatsby:pages",
@@ -784,6 +790,9 @@ function getExperimentalFrameworkTestConfig(
 			nodeCompat: false,
 			flags: ["--style", "sass"],
 			verifyTypes: false,
+			// TODO: currently the Angular tests are failing with `URL with hostname "localhost" is not allowed.`
+			//       we need to investigate this so that we can un-quarantine the Angular tests
+			quarantine: true,
 		},
 		{
 			name: "nuxt:workers",

packages/create-cloudflare/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "create-cloudflare",
-	"version": "2.64.2",
+	"version": "2.64.3",
 	"description": "A CLI for creating and deploying new applications to Cloudflare.",
 	"keywords": [
 		"cloudflare",

packages/create-cloudflare/src/frameworks/package.json

@@ -15,7 +15,7 @@
 		"create-vite": "8.3.0",
 		"create-rwsdk": "3.1.3",
 		"create-react-router": "7.13.0",
-		"create-solid": "0.6.11",
+		"create-solid": "0.6.13",
 		"create-vike": "0.0.581",
 		"create-vue": "3.21.1",
 		"create-waku": "0.12.5-1.0.0-alpha.3-0",