Merge branch 'production' into ngayerie/SPM-3038-improve-http-error-docs

Author: WalshyDev

.opencode/command/review-code-example.md

@@ -4,7 +4,7 @@
 	"type": "module",
 	"scripts": {
 		"astro": "npx astro",
-		"build": "export NODE_OPTIONS='--max-old-space-size=6192' || set NODE_OPTIONS='--max-old-space-size=6192'&& npx astro build",
+		"build": "export NODE_OPTIONS='--max-old-space-size=6192' || set NODE_OPTIONS=\"--max-old-space-size=6192\" && npx astro build",
 		"typegen:worker": "npx wrangler types ./worker/worker-configuration.d.ts",
 		"check": "npm run check:astro && npm run check:worker",
 		"check:astro": "npx astro check",

package.json

@@ -0,0 +1,44 @@
+---
+title: New functions for array and map operations
+description: Rulesets now support split, join, has_key, and has_value functions for advanced expression logic.
+date: 2026-01-20
+---
+
+## New functions for array and map operations
+
+Cloudflare Rulesets now include new functions that enable advanced expression logic for evaluating arrays and maps. These functions allow you to build rules that match against lists of values in request or response headers, enabling use cases like country-based blocking using custom headers.
+
+---
+
+### New functions
+
+| Function | Description |
+| --- | --- |
+| `split(source, delimiter)` | Splits a string into an array of strings using the specified delimiter. |
+| `join(array, delimiter)` | Joins an array of strings into a single string using the specified delimiter. |
+| `has_key(map, key)` | Returns `true` if the specified key exists in the map. |
+| `has_value(map, value)` | Returns `true` if the specified value exists in the map. |
+
+---
+
+### Example use cases
+
+**Check if a country code exists in a header list:**
+
+```txt
+has_value(split(http.response.headers["x-allow-country"][0], ","), ip.src.country)
+```
+
+**Check if a specific header key exists:**
+
+```txt
+has_key(http.request.headers, "x-custom-header")
+```
+
+**Join array values for logging or comparison:**
+
+```txt
+join(http.request.headers.names, ", ")
+```
+
+For more information, refer to the [Functions reference](/ruleset-engine/rules-language/functions/).

src/content/changelog/rules/2026-01-20-array-map-functions.mdx

@@ -0,0 +1,52 @@
+---
+title: "WAF Release - 2026-01-20"
+description: Cloudflare WAF managed rulesets 2026-01-20 release
+date: 2026-01-20
+---
+
+import { RuleID } from "~/components";
+
+This week's release focuses on improvements to existing detections to enhance coverage. 
+
+**Key Findings**
+
+- Existing rule enhancements have been deployed to improve detection resilience against SQL injection.
+
+
+<table style="width: 100%">
+	<thead>
+		<tr>
+			<th>Ruleset</th>
+			<th>Rule ID</th>
+			<th>Legacy Rule ID</th>
+			<th>Description</th>
+			<th>Previous Action</th>
+			<th>New Action</th>
+			<th>Comments</th>
+		</tr>
+	</thead>
+    <tbody>
+	<tr>
+      <td>Cloudflare Managed Ruleset</td>
+      <td>
+        <RuleID id="a291bd530fa346d18cc1ce5a68d90c8f" />
+      </td>
+      <td>N/A</td>
+      <td>SQLi - Comment - Beta</td>
+      <td>Log</td>
+      <td>Block</td>
+      <td>This rule is merged into the original rule "SQLi - Comment" (ID: <RuleID id="42c424998d2a42c9808ab49c6d8d8fe4" />)</td>
+   </tr>
+   <tr>
+      <td>Cloudflare Managed Ruleset</td>
+      <td>
+        <RuleID id="da289f9e692e4f5397d915fbfaa045cf" />
+      </td>
+      <td>N/A</td>
+      <td>SQLi - Comparison - Beta</td>
+      <td>Log</td>
+      <td>Block</td>      
+      <td>This rule is merged into the original rule "SQLi - Comparison" (ID: <RuleID id="8166da327a614849bfa29317e7907480" />)</td>
+   </tr>
+  </tbody>    
+</table>

src/content/changelog/waf/2026-01-20-waf-release.mdx

@@ -1,7 +1,7 @@
 ---
-title: WAF Release - Scheduled changes for 2026-01-19
-description: WAF managed ruleset changes scheduled for 2026-01-19
-date: 2026-01-15
+title: WAF Release - Scheduled changes for 2026-01-26
+description: WAF managed ruleset changes scheduled for 2026-01-26
+date: 2026-01-20
 scheduled: true
 ---
 
@@ -22,28 +22,6 @@ The planned release has been postponed to ensure a smooth deployment.
     </tr>
   </thead>
   <tbody>
-  <tr>
-      <td>2025-12-01</td>
-      <td>2026-01-19</td>
-      <td>Log</td>
-      <td>N/A</td>
-      <td>
-        <RuleID id="a291bd530fa346d18cc1ce5a68d90c8f" />
-      </td>
-      <td>SQLi - Comment - Beta</td>
-      <td>This is a beta detection and will replace the action on original detection "SQLi - Comment" (ID: <RuleID id="42c424998d2a42c9808ab49c6d8d8fe4" />)</td>
-   </tr>
-   <tr>
-      <td>2025-12-01</td>
-      <td>2026-01-19</td>
-      <td>Log</td>
-      <td>N/A</td>
-      <td>
-        <RuleID id="da289f9e692e4f5397d915fbfaa045cf" />
-      </td>
-      <td>SQLi - Comparison - Beta</td>
-      <td>This is a beta detection and will replace the action on original detection "SQLi - Comparison" (ID: <RuleID id="8166da327a614849bfa29317e7907480" />)</td>
-   </tr>
     <tr>
       <td>2025-12-01</td>
       <td>2026-01-26</td>

src/content/changelog/waf/scheduled-waf-release.mdx

@@ -0,0 +1,32 @@
+---
+title: Use auxiliary Workers alongside full-stack frameworks
+description: Auxiliary Workers are now fully supported when using full-stack frameworks with the Cloudflare Vite plugin
+products:
+  - workers
+date: 2026-01-20
+---
+
+Auxiliary Workers are now fully supported when using full-stack frameworks, such as [React Router](/workers/framework-guides/web-apps/react-router/) and [TanStack Start](/workers/framework-guides/web-apps/tanstack-start/), that integrate with the [Cloudflare Vite plugin](/workers/vite-plugin/reference/api/).
+They are included alongside the framework's build output in the build output directory.
+Note that this feature requires Vite 7 or above.
+
+Auxiliary Workers are additional Workers that can be called via [service bindings](/workers/runtime-apis/bindings/service-bindings/) from your main (entry) Worker.
+They are defined in the plugin config, as in the example below:
+
+```ts title="vite.config.ts"
+import { defineConfig } from "vite";
+import { tanstackStart } from "@tanstack/react-start/plugin/vite";
+import { cloudflare } from "@cloudflare/vite-plugin";
+
+export default defineConfig({
+	plugins: [
+		tanstackStart(),
+		cloudflare({
+			viteEnvironment: { name: "ssr" },
+			auxiliaryWorkers: [{ configPath: "./wrangler.aux.jsonc" }],
+		}),
+	],
+});
+```
+
+See the Vite plugin [API docs](/workers/vite-plugin/reference/api/) for more info.

src/content/changelog/workers/2026-01-20-auxiliary-workers.mdx

@@ -0,0 +1,17 @@
+---
+title: Import SQL files as additional modules by default
+description: The `.sql` file extension is now automatically configured to be importable in your Worker code
+products:
+  - workers
+date: 2026-01-20
+---
+
+The `.sql` file extension is now automatically configured to be importable in your Worker code when using [Wrangler](/workers/wrangler/bundling/#including-non-javascript-modules) or the [Cloudflare Vite plugin](/workers/vite-plugin/reference/non-javascript-modules/).
+This is particular useful for importing migrations in Durable Objects and means you no longer need to configure custom rules when using [Drizzle](https://orm.drizzle.team/docs/connect-cloudflare-do).
+
+SQL files are imported as JavaScript strings:
+
+```ts
+// `example` will be a JavaScript string
+import example from "./example.sql";
+```

src/content/changelog/workers/2026-01-20-sql-module-rule.mdx

@@ -343,7 +343,7 @@ class MyAgent extends Agent {
     // Add an MCP server
     await this.addMcpServer(
       "GitHub",
-      "https://mcp.example.com/sse",
+      "https://mcp.example.com/mcp",
       "https://my-worker.example.workers.dev", // callback host for OAuth
       "agents" // routing prefix
     );

src/content/docs/agents/concepts/agent-class.mdx

@@ -11,7 +11,7 @@ import { Details, Render, PackageManagers } from "~/components";
 
 ## Deploy your first MCP server
 
-This guide will show you how to deploy your own remote MCP server on Cloudflare, with two options:
+This guide will show you how to deploy your own remote MCP server on Cloudflare using [Streamable HTTP transport](/agents/model-context-protocol/transport/), the current MCP specification standard. You have two options:
 
 - **Without authentication** — anyone can connect and use the server (no login required).
 - **With [authentication and authorization](/agents/guides/remote-mcp-server/#add-authentication)** — users sign in before accessing tools, and you can control which tools an agent can call based on the user's permissions.
@@ -22,7 +22,7 @@ The button below will guide you through everything you need to do to deploy this
 
 [![Deploy to Workers](https://deploy.workers.cloudflare.com/button)](https://deploy.workers.cloudflare.com/?url=https://github.com/cloudflare/ai/tree/main/demos/remote-mcp-authless)
 
-Once deployed, this server will be live at your workers.dev subdomain (e.g. remote-mcp-server-authless.your-account.workers.dev/sse). You can connect to it immediately using the [AI Playground](https://playground.ai.cloudflare.com/) (a remote MCP client), [MCP inspector](https://github.com/modelcontextprotocol/inspector) or [other MCP clients](/agents/guides/remote-mcp-server/#connect-your-remote-mcp-server-to-claude-and-other-mcp-clients-via-a-local-proxy). Then, once you're ready, you can customize the MCP server and add your own [tools](/agents/model-context-protocol/tools/).
+Once deployed, this server will be live at your workers.dev subdomain (e.g. remote-mcp-server-authless.your-account.workers.dev/mcp). You can connect to it immediately using the [AI Playground](https://playground.ai.cloudflare.com/) (a remote MCP client), [MCP inspector](https://github.com/modelcontextprotocol/inspector) or [other MCP clients](/agents/guides/remote-mcp-server/#connect-your-remote-mcp-server-to-claude-and-other-mcp-clients-via-a-local-proxy). Then, once you're ready, you can customize the MCP server and add your own [tools](/agents/model-context-protocol/tools/).
 
 If you're using the "Deploy to Cloudflare" button, a new git repository will be set up on your GitHub or GitLab account for your MCP server, configured to automatically deploy to Cloudflare each time you push a change or merge a pull request to the main branch of the repository. You can then clone this repository, [develop locally](/agents/guides/remote-mcp-server/#local-development), and start writing code and building.
 
@@ -50,7 +50,7 @@ In the directory of your new project, run the following command to start the dev
 npm start
 ```
 
-Your MCP server is now running on `http://localhost:8788/sse`.
+Your MCP server is now running on `http://localhost:8788/mcp`.
 
 In a new terminal, run the [MCP inspector](https://github.com/modelcontextprotocol/inspector). The MCP inspector is an interactive MCP client that allows you to connect to your MCP server and invoke tools from a web browser.
 
@@ -64,7 +64,7 @@ Open the MCP inspector in your web browser:
 open http://localhost:5173
 ```
 
-In the inspector, enter the URL of your MCP server, `http://localhost:8788/sse`, and click **Connect**. You should see the "List Tools" button, which will list the tools that your MCP server exposes.
+In the inspector, enter the URL of your MCP server, `http://localhost:8788/mcp`, and click **Connect**. You should see the "List Tools" button, which will list the tools that your MCP server exposes.
 
 ![MCP inspector — authenticated](~/assets/images/agents/mcp-inspector-authenticated.png)
 
@@ -84,7 +84,7 @@ After deploying, take the URL of your deployed MCP server, and enter it in the M
 
 Now that your MCP server is running, you can use the [`mcp-remote` local proxy](https://www.npmjs.com/package/mcp-remote) to connect Claude Desktop or other MCP clients to it — even though these tools aren't yet _remote_ MCP clients, and don't support remote transport or authorization on the client side. This lets you test what an interaction with your MCP server will be like with a real MCP client.
 
-Update your Claude Desktop configuration to point to the URL of your MCP server. You can use either the `localhost:8787/sse` URL, or the URL of your deployed MCP server:
+Update your Claude Desktop configuration to point to the URL of your MCP server. You can use either the `localhost:8788/mcp` URL, or the URL of your deployed MCP server:
 
 ```json
 {
@@ -93,7 +93,7 @@ Update your Claude Desktop configuration to point to the URL of your MCP server.
 			"command": "npx",
 			"args": [
 				"mcp-remote",
-				"https://your-worker-name.your-account.workers.dev/sse"
+				"https://your-worker-name.your-account.workers.dev/mcp"
 			]
 		}
 	}
@@ -138,7 +138,7 @@ You'll notice that in the example MCP server, if you open `src/index.ts`, the pr
 import GitHubHandler from "./github-handler";
 
 export default new OAuthProvider({
-	apiRoute: "/sse",
+	apiRoute: "/mcp",
 	apiHandler: MyMCP.Router,
 	defaultHandler: GitHubHandler,
 	authorizeEndpoint: "/authorize",
@@ -178,7 +178,7 @@ Run the following command to start the development server:
 npm start
 ```
 
-Your MCP server is now running on `http://localhost:8788/sse`.
+Your MCP server is now running on `http://localhost:8788/mcp`.
 
 In a new terminal, run the [MCP inspector](https://github.com/modelcontextprotocol/inspector). The MCP inspector is an interactive MCP client that allows you to connect to your MCP server and invoke tools from a web browser.
 
@@ -192,9 +192,9 @@ Open the MCP inspector in your web browser:
 open http://localhost:5173
 ```
 
-In the inspector, set **Transport Type** to `SSE` and enter the URL of your MCP server, `http://localhost:8788/sse`
+In the inspector, enter the URL of your MCP server, `http://localhost:8788/mcp`
 
-In the main panel on the right, click the **Open OAuth Settings** button and then click **Quick OAuth Flow**.
+In the main panel on the right, click the **OAuth Settings** button and then click **Quick OAuth Flow**.
 
 You should be redirected to a GitHub login or authorization page. After authorizing the MCP Client (the inspector) access to your GitHub account, you will be redirected back to the inspector.
 
@@ -229,32 +229,37 @@ When you create the first secret, Wrangler will ask if you want to create a new
 :::
 
 #### Set up a KV namespace
-- Create the KV namespace: 
+
+- Create the KV namespace:
+
 ```bash
 npx wrangler kv namespace create "OAUTH_KV"
 ```
+
 - Update the `wrangler.jsonc` file with the resulting KV ID:
 
 ```json
 {
-  "kvNamespaces": [
-    {
-      "binding": "OAUTH_KV",
-      "id": "<YOUR_KV_NAMESPACE_ID>"
-    }
-  ]
+	"kvNamespaces": [
+		{
+			"binding": "OAUTH_KV",
+			"id": "<YOUR_KV_NAMESPACE_ID>"
+		}
+	]
 }
 ```
+
 #### Deploy your server
 
 Deploy the MCP server to your Cloudflare `workers.dev` domain:
+
 ```bash
 npm run deploy
 ```
 
 #### Finally, connect to your MCP server
 
-Now that you've added the ID and secret of your production OAuth app, you should now be able to connect to your MCP server running at `worker-name.account-name.workers.dev/sse` using the [AI Playground](https://playground.ai.cloudflare.com/), MCP inspector or ([other MCP clients](/agents/guides/remote-mcp-server/#connect-your-mcp-server-to-claude-and-other-mcp-clients)), and authenticate with GitHub.
+Now that you've added the ID and secret of your production OAuth app, you should now be able to connect to your MCP server running at `worker-name.account-name.workers.dev/mcp` using the [AI Playground](https://playground.ai.cloudflare.com/), MCP inspector or ([other MCP clients](/agents/guides/remote-mcp-server/#connect-your-mcp-server-to-claude-and-other-mcp-clients)), and authenticate with GitHub.
 
 ## Next steps
 

src/content/docs/agents/guides/remote-mcp-server.mdx

@@ -25,7 +25,7 @@ You can build and deploy [Model Context Protocol (MCP)](https://modelcontextprot
 
 The MCP standard supports two modes of operation:
 
-- **Remote MCP connections**: MCP clients connect to MCP servers over the Internet, establishing a [long-lived connection using HTTP and Server-Sent Events (SSE)](/agents/model-context-protocol/transport/), and authorizing the MCP client access to resources on the user's account using [OAuth](/agents/model-context-protocol/authorization/).
+- **Remote MCP connections**: MCP clients connect to MCP servers over the Internet, establishing a connection using [Streamable HTTP](/agents/model-context-protocol/transport/), and authorizing the MCP client access to resources on the user's account using [OAuth](/agents/model-context-protocol/authorization/).
 - **Local MCP connections**: MCP clients connect to MCP servers on the same machine, using [stdio](https://spec.modelcontextprotocol.io/specification/draft/basic/transports/#stdio) as a local transport method.
 
 ### Best Practices