[petebacondarwin]

Backports the Vite plugin v1 runtime behavior from #16521 and #16489, and supplies #16492's temporary-directory cleanup fix. Reuses the existing backport; no separate dependency-only PR is needed for either merged release #16529 or #16553.

V1 passes asset directories to Miniflare, exposes Local Explorer, and awaits Miniflare disposal when closing a dev server. Pin the now-published Miniflare 5.20261023.2-beta in all three direct consumers, Wrangler 4.155.0 in the plugin/peer/registry fixtures, and deploy-helpers 0.24.2. Align retained consumers with the published helper graph (workers-utils 0.50.0, containers-shared 0.23.4, cli-shared-helpers 0.2.10). Preserve private workspace:* references. Regenerate the real pnpm lockfile and retain the 1.66.0 version/changelog from merged #16544.

This enables strict source/build-output .assetsignore encoding validation, app-ID Local Explorer Flagship management/evaluation metadata, and awaited temporary-file cleanup. The same graph supplies the dependency portion of #16536; its retained Analytics Engine proxy wrapper remains a separate feature backport. #16529 was reverted by #16554 and replaced by #16553 with the same Miniflare release and Wrangler 4.155.0; no duplicate release changeset is added.

Validation with Node 22.22.1 / pnpm 10.33.0: frozen install; pnpm check (build plus all 58 check tasks); pnpm test:ci (all 8 tasks); pnpm test:fixtures (30 registry, 5 Vitest and 2 Playwright tests); asset/WebSocket playgrounds in dev (11 passed, one build-only skip) and build/preview (12 passed). Through the built plugin's dev/build/preview APIs, manually verified Local Explorer app-ID flag creation/evaluation retains metadata and invalid UTF-8 .assetsignore is rejected in preview. V1-specific adaptation: the build previously decoded source .assetsignore with replacement characters before emitting it, masking malformed bytes from the runtime validator. Backport the strict reader and its tests in retained workers-shared, export that reader for the plugin output path, and cover real plugin builds with invalid UTF-8 and null-containing source files (both fail before this change and pass after it). The retained helper now has a concrete v1 build caller. Public dependency source/tests were not restored or duplicated. The combined changeset is minor because app-ID Flagship management adds a capability.

---

• Tests
  • Tests included/updated
  • Automated tests not possible - manual testing has been completed as follows: exercised actual plugin dev/build/preview APIs above; existing retained suites and integration fixtures pass against the published graph.
  • Additional testing not necessary because:
• Public documentation
  • Cloudflare docs PR(s):
  • Documentation not necessary because: the plugin changeset describes inherited runtime behavior; this adds no plugin configuration API.

Note

This is a contribution from an AI agent: Codex, under the authorized v1 backport automation.

Final reviewed stack validation: all 58 check tasks, all 8 retained test tasks (231 plugin, 32 remote-bindings and 94 retained shared utility tests), and 12 asset/WebSocket build-preview playground tests pass. All private workspace references are preserved.

[changeset-bot]

🦋 Changeset detected

Latest commit: 76336fe

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@cloudflare/vite-plugin	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[petebacondarwin]

@petebacondarwin (original author) @dario-piotrowicz (human ant-core approver): please check this v1 backport coverage of #16521 and approve it if it looks good. For v1, v1 uses the installed Miniflare asset walker, so consume invalid-encoding validation through the intended runtime rather than copying unused retained helpers or public tests. #16539 already supplies the published .1 runtime and #16542 the retained remote-proxy flag. This remains a draft: Miniflare 5.20261023.2-beta, Wrangler 4.154.1 and deploy-helpers 0.24.2 are not on npm yet (pending #16529); the parent lockfile is preserved without fabricated metadata. Regenerate the lock and validate the actual plugin asset/Explorer integration after publication before merging.

[petebacondarwin]

@akshitsinha (original author) @dario-piotrowicz (human ant-core approver): please check this v1 backport coverage of #16489 and approve it if it looks good. For v1, v1 exposes Local Explorer and legacy Flagship bindings, so the same intended runtime supplies Explorer management by app ID and flag evaluation metadata; no public source/generated files or CLI tests are restored. #16539 already supplies the published .1 runtime and #16542 the retained remote-proxy flag. This remains a draft: Miniflare 5.20261023.2-beta, Wrangler 4.154.1 and deploy-helpers 0.24.2 are not on npm yet (pending #16529); the parent lockfile is preserved without fabricated metadata. Regenerate the lock and validate the actual plugin asset/Explorer integration after publication before merging.

[pkg-pr-new]

npm i https://pkg.pr.new/@cloudflare/vite-plugin@16543

commit: 76336fe

[workers-devprod]

Codeowners approval required for this PR:

• @cloudflare/deploy-config
• ✅ @cloudflare/wrangler

[petebacondarwin]

@Hrushikesh-ramilla (original author) @petebacondarwin (verified human ant-core approver): please check this v1 coverage of #16492 and approve it if it looks good. V1 awaits Miniflare disposal on dev-server close/restart; this existing backport now pins published Miniflare 5.20261023.2-beta, which supplies awaited temporary-file cleanup. The real lockfile, build/types/checks, retained tests/fixtures and plugin dev/preview integration checks pass. No separate dependency-only PR or upstream regression test was added.

[petebacondarwin]

@workers-devprod (recorded release PR author, ANT Bot) @dario-piotrowicz (verified human ant-core approver): please check this v1 runtime backport supplied by #16553 and approve it if it looks good. The published Miniflare 5.20261023.2-beta and coupled Wrangler 4.155.0/helper graph now replace the previous unpublished intent in this existing PR. All direct Miniflare consumers are aligned; real pnpm lock/install, build/types/checks, retained suites/fixtures and plugin asset/Explorer dev/preview validation pass. #16529 was reverted and replaced by #16553; no duplicate release-only PR or changeset was created. The retained Analytics Engine proxy wrapper is handled in a separate feature backport.

[clanky-the-clanker]

✅ Approved — No issues found. The strict .assetsignore reader is used correctly on the plugin build output path, has test coverage, and the dependency pins are consistent. The changeset is now minor, which settles the earlier patch-vs-minor suggestion.

_{The decision is advisory: this comment never approves, blocks or requests changes on the pull request.}

---

✅ All checks passed

🚀 Release: ✅ LGTM

Risk: Low

The changeset is now minor. This settles the earlier suggestion that the Flagship management-by-app-ID capability calls for a minor bump.

---

🔒 Security: ✅ LGTM

No security concerns.

---

📖 AGENTS.md: ✅ LGTM

The change follows the repository guidance:

• Public SDK packages are pinned to exact versions.
• Private packages stay workspace:*.
• Tests use real files and temporary directories.
• A plugin changeset is included.

---

📋 Code Quality: ✅ LGTM

Strict reader (packages/workers-shared/utils/helpers.ts)

• readAssetsIgnoreFile returns undefined only when the file is missing (ENOENT). Any other read error is rethrown.
• It decodes with TextDecoder("utf-8", { fatal: true }), which also strips a leading BOM.
• It rejects content containing null characters, which catches BOM-less UTF-16.

Plugin build path (output-config.ts)

• The build now reads the source .assetsignore with the strict reader. Malformed bytes are no longer silently replaced before the file is emitted.
• A missing or empty file still produces an empty string.

Tests

• The plugin spec runs real builds against temporary directories, covering invalid UTF-8 and null-containing files.
• The workers-shared tests cover a BOM, UTF-16 variants, invalid UTF-8, null characters and an empty file.

Dependencies

• Version pins are consistent across consumers, and private packages remain workspace:*.

---

⚡ Performance: ✅ LGTM

No performance concerns.

---

📝 Documentation: ✅ LGTM

The changeset accurately describes the inherited runtime behaviour.

---

_{Reviewed commit: 76336fed}

[dario-piotrowicz]

LGTM, although instead of a single changeset encompassing everything I think it would be much cleaner to have a few separate changesets