[penalosa]

Related to cloudflare/cf#298.

workers-auth now uses each CLI's temporary-account flag in authentication errors: --temporary-account for cf and --temporary for Wrangler. Export AuthenticationError so consumers can inspect login/refresh failure reasons without matching messages, while preserving Wrangler's existing telemetry type and label.

Fix the Windows CI teardown race by waiting for pending unbundled rebuilds and disposing the entrypoint build context before removing build directories.

Validation after rebasing onto origin/main (a4eb57d33), using the frozen lockfile:

• Wrangler and its workspace dependencies build successfully, including declaration generation.
• Wrangler source, template, unit-test, and E2E-test type checks passed.
• workers-auth: 205 tests passed, 3 skipped; source type check passed.
• Affected Wrangler test files: 81 tests passed. The teardown regression was verified to fail against the original code.
• Changed-file lint and formatting passed.
• Separate workers-auth test type checking still has existing errors in credentials.test.ts, state.test.ts, and token-exchange.test.ts, previously verified on unchanged base 7d57659636.

---

• Tests
  • Tests included/updated
  • Automated tests not possible - manual testing has been completed as follows:
  • Additional testing not necessary because:
• Public documentation
  • Cloudflare docs PR(s):
  • Documentation not necessary because: this corrects internal auth integration and development cleanup without adding a user-facing command.

[changeset-bot]

🦋 Changeset detected

Latest commit: 870d3f7

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
@cloudflare/workers-auth	Minor
@cloudflare/remote-bindings	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[ask-bonk]

LGTM

github run

[pkg-pr-new]

@cloudflare/autoconfig

npm i https://pkg.pr.new/@cloudflare/autoconfig@16375

@cloudflare/build-output-utils

npm i https://pkg.pr.new/@cloudflare/build-output-utils@16375

@cloudflare/codemods

npm i https://pkg.pr.new/@cloudflare/codemods@16375

@cloudflare/config

npm i https://pkg.pr.new/@cloudflare/config@16375

@cloudflare/containers-shared

npm i https://pkg.pr.new/@cloudflare/containers-shared@16375

create-cloudflare

npm i https://pkg.pr.new/create-cloudflare@16375

@cloudflare/deploy-helpers

npm i https://pkg.pr.new/@cloudflare/deploy-helpers@16375

@cloudflare/kv-asset-handler

npm i https://pkg.pr.new/@cloudflare/kv-asset-handler@16375

miniflare

npm i https://pkg.pr.new/miniflare@16375

@cloudflare/pages-functions

npm i https://pkg.pr.new/@cloudflare/pages-functions@16375

@cloudflare/pages-shared

npm i https://pkg.pr.new/@cloudflare/pages-shared@16375

@cloudflare/runtime-types

npm i https://pkg.pr.new/@cloudflare/runtime-types@16375

@cloudflare/unenv-preset

npm i https://pkg.pr.new/@cloudflare/unenv-preset@16375

@cloudflare/vite-plugin

npm i https://pkg.pr.new/@cloudflare/vite-plugin@16375

@cloudflare/vitest-plugin

npm i https://pkg.pr.new/@cloudflare/vitest-plugin@16375

@cloudflare/workers-auth

npm i https://pkg.pr.new/@cloudflare/workers-auth@16375

@cloudflare/workers-editor-shared

npm i https://pkg.pr.new/@cloudflare/workers-editor-shared@16375

@cloudflare/workers-utils

npm i https://pkg.pr.new/@cloudflare/workers-utils@16375

wrangler

npm i https://pkg.pr.new/wrangler@16375

commit: 870d3f7

[workers-devprod]

Codeowners approval required for this PR:

• ✅ @cloudflare/wrangler

Show detailed file reviewers

[clanky-the-clanker]

💬 Approved with comments — No correctness, security or performance problems found. The only comment is optional: add a Wrangler changeset for the --no-bundle watch teardown fix.

Findings: 1 suggestion

_{The decision is advisory: this comment never approves, blocks or requests changes on the pull request.}

🔧 Fix with your agent

Paste the following into your coding agent to investigate and fix these issues.

Fix the following code review issues found in pull request #16375.

Before making changes, review each issue and present a brief summary table:
- For each finding, state whether you agree, disagree, or need clarification
- If you disagree (e.g., the fix would require disproportionate changes
  for minimal ROI, or the finding is factually incorrect), explain why
- If you need to clarify something before deciding, ask those questions
- Then share your plan for which issues to tackle and in what order

## SUGGESTION (1)

### [Release] Consider adding a Wrangler patch changeset for the `--no-bundle` watch teardown and rebuild-serialization fix in `use-esbuild.ts`. The only changeset covers `@cloudflare/workers-auth`.
- **File:** packages/wrangler/src/dev/use-esbuild.ts:309

---

🚀 Release: 💬 1 suggestion

The changeset covers workers-auth but not the Wrangler --no-bundle teardown fix.

Recommendation: 💬 Optional Nits

• [SUGGESTION] Consider adding a Wrangler patch changeset for the --no-bundle watch teardown and rebuild-serialization fix in use-esbuild.ts. The only changeset covers @cloudflare/workers-auth. (packages/wrangler/src/dev/use-esbuild.ts:309)

View full review

Risk: Low

The @cloudflare/workers-auth minor changeset matches the auth changes. This pull request also changes Wrangler behaviour in packages/wrangler/src/dev/use-esbuild.ts:290-316, in watch mode with --no-bundle:

• Rebuilds now run one at a time.
• Rebuild errors go to onErr.
• Stopping now disposes the entrypoint build context.

Users can notice this, for example in how errors appear and how wrangler dev stops, so it is more than a test-only or CI-only change. .changeset/README.md asks for every package with user-facing changes to be covered. Consider adding a Wrangler patch changeset for this fix.

---

✅ All other checks passed

🔒 Security: ✅ LGTM

No security issues found in the authentication error changes or the dev teardown changes.

---

📖 AGENTS.md: ✅ LGTM

No AGENTS.md updates are needed for this change.

---

📋 Code Quality: ✅ LGTM

No issues found.

• The temporary-account flag defaults to --temporary-account, and Wrangler overrides it with --temporary. Both the "already authenticated" error and the terms-not-accepted error use the configured flag.
• AuthenticationError extends UserError, so existing instanceof UserError checks still match it. Wrangler's getErrorType keeps reporting the existing telemetry type and label.
• In use-esbuild.ts, --no-bundle change handlers now run one after another on a promise chain, and their errors go to onErr instead of becoming unhandled rejections. stopWatching now closes the watcher, waits for pending rebuilds, and then stops the entrypoint build context. Before, it only closed the watcher.
• factory.test.ts, handle-errors.test.ts and BundleController.test.ts cover the new behaviour.

---

⚡ Performance: ✅ LGTM

No performance issues found.

---

📝 Documentation: ✅ LGTM

No documentation issues found.

---

_{Reviewed commit: 870d3f7d}

[dario-piotrowicz]

LGTM 🙂

[workers-devprod]

Codeowners reviews satisfied

[devin-ai-integration]

Devin Review found 1 new potential issue.

⚠️ 1 issue in files not directly in the diff

⚠️ Wrangler watcher fix lacks release entry

The runBuild teardown fix has no Wrangler changeset after this deletion. The remaining auth changeset does not describe the fix, so Wrangler users lose its changelog entry.