[wrangler] Fetch the remote config diff from the configured compliance region

[WalshyDev]

When a Worker was last deployed from the dashboard (last_deployed_from === "dash"), wrangler deploy and wrangler versions upload download its remote configuration and diff it against the local config. fetchWorkerConfig sends six parallel requests for this (bindings, routes, custom domains, subdomain, environment metadata and cron triggers). All six passed COMPLIANCE_REGION_CONFIG_UNKNOWN, so they only honoured the CLOUDFLARE_COMPLIANCE_REGION env var and ignored compliance_region in the Wrangler config file.

With compliance_region: "fedramp_high" set in the config file, the rest of the deploy goes to api.fed.cloudflare.com, but after a dashboard deploy these six requests went to api.cloudflare.com. They failed with 401s and the deploy aborted. After the next successful Wrangler deploy, last_deployed_from is no longer dash and the failure goes away. That made it look intermittent.

This change passes a ComplianceConfig through fetchWorkerConfig / downloadWorkerConfig. Deploy validation passes the loaded config. wrangler init --from-dash has no config file, so it keeps passing COMPLIANCE_REGION_CONFIG_UNKNOWN, which still honours the env var.

The new test deploys a dash-deployed Worker with the region set in the config file, then again with it set in the env var. It checks that every request goes to api.fed.cloudflare.com. Without the fix, the config-file case fails.

---

• Tests
  • Tests included/updated
  • Automated tests not possible - manual testing has been completed as follows:
  • Additional testing not necessary because:
• Public documentation
  • Cloudflare docs PR(s):
  • Documentation not necessary because: bug fix, no change to documented behaviour

---

[changeset-bot]

🦋 Changeset detected

Latest commit: 673c7fc

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 4 packages

Name	Type
@cloudflare/deploy-helpers	Patch
wrangler	Patch
@cloudflare/remote-bindings	Patch
@cloudflare/vitest-plugin	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[workers-devprod]

Codeowners approval required for this PR:

• ✅ @cloudflare/wrangler

Show detailed file reviewers

[ask-bonk]

LGTM

github run

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[clanky-the-clanker]

✅ Approved — No issues found. The compliance config now reaches all six remote-config requests. Every caller has been updated, and the new test covers both the config-file and the env-var cases.

_{The decision is advisory: this comment never approves, blocks or requests changes on the pull request.}

---

✅ All checks passed

📋 Code Quality: ✅ LGTM

fetchWorkerConfig and downloadWorkerConfig now take a ComplianceConfig, and the change applies it consistently:

• Requests: All six fetchResult calls in fetchWorkerConfig use the config that is passed in. None of them still uses COMPLIANCE_REGION_CONFIG_UNKNOWN.
• Callers: There are only two, and both are updated:
  • Deploy and versions-upload validation (validate-worker-props.ts:234) passes the loaded config, so compliance_region from the config file is honoured.
  • wrangler init --from-dash (init.ts:197) has no config file, so it keeps passing COMPLIANCE_REGION_CONFIG_UNKNOWN. That still honours the CLOUDFLARE_COMPLIANCE_REGION env var.
• Wrangler wrappers: packages/wrangler/src/utils/download-worker-config.ts passes the new parameter straight through.
• Test: The new test deploys a Worker last deployed from the dashboard twice: once with the region set in the config file and once with it set in the env var. Both times it checks that every request goes to api.fed.cloudflare.com, so the config-file case would fail without the fix.

---

📝 Documentation: ✅ LGTM

The changeset bumps both @cloudflare/deploy-helpers and wrangler as patches. It describes the user-visible symptom and the fix accurately. The fix doesn't change documented behaviour, so no public documentation update is needed.

---

_{Reviewed commit: 673c7fc6}

[pkg-pr-new]

@cloudflare/autoconfig

npm i https://pkg.pr.new/@cloudflare/autoconfig@16370

@cloudflare/build-output-utils

npm i https://pkg.pr.new/@cloudflare/build-output-utils@16370

@cloudflare/codemods

npm i https://pkg.pr.new/@cloudflare/codemods@16370

@cloudflare/config

npm i https://pkg.pr.new/@cloudflare/config@16370

@cloudflare/containers-shared

npm i https://pkg.pr.new/@cloudflare/containers-shared@16370

create-cloudflare

npm i https://pkg.pr.new/create-cloudflare@16370

@cloudflare/deploy-helpers

npm i https://pkg.pr.new/@cloudflare/deploy-helpers@16370

@cloudflare/kv-asset-handler

npm i https://pkg.pr.new/@cloudflare/kv-asset-handler@16370

miniflare

npm i https://pkg.pr.new/miniflare@16370

@cloudflare/pages-functions

npm i https://pkg.pr.new/@cloudflare/pages-functions@16370

@cloudflare/pages-shared

npm i https://pkg.pr.new/@cloudflare/pages-shared@16370

@cloudflare/runtime-types

npm i https://pkg.pr.new/@cloudflare/runtime-types@16370

@cloudflare/unenv-preset

npm i https://pkg.pr.new/@cloudflare/unenv-preset@16370

@cloudflare/vite-plugin

npm i https://pkg.pr.new/@cloudflare/vite-plugin@16370

@cloudflare/vitest-plugin

npm i https://pkg.pr.new/@cloudflare/vitest-plugin@16370

@cloudflare/workers-auth

npm i https://pkg.pr.new/@cloudflare/workers-auth@16370

@cloudflare/workers-editor-shared

npm i https://pkg.pr.new/@cloudflare/workers-editor-shared@16370

@cloudflare/workers-utils

npm i https://pkg.pr.new/@cloudflare/workers-utils@16370

wrangler

npm i https://pkg.pr.new/wrangler@16370

commit: 673c7fc

[workers-devprod]

Codeowners reviews satisfied