[akshitsinha]

Follow-up to #15330.

cf flagship ... --local uses the Local Explorer API, but its Flagship implementation requires an app bound to a Worker and exposes routes and request shapes that differ from the public API. This prevents CLI commands from managing arbitrary local apps, with some reporting no local equivalent.

This PR lets the Explorer open a Flagship store by app ID without a Worker binding or running dev server. A dedicated entrypoint provides that access while keeping Worker bindings scoped to their configured app. Existing CLI flag commands can use it once cf upgrades to a Miniflare release containing this change.

Flagship’s public endpoints now come from the published OpenAPI schema instead of separate local definitions. OPENAPI_COMMIT is bumped from 45402b29 to 2d3b9ab6 to include named rule and condition schemas, PATCH, metadata, has/not_has, and STATIC. The filtered schema, validators, and client types are regenerated from that revision.

Because the schema revision is shared across Explorer products, regeneration also requires two compatibility fixes outside Flagship:

• R2: list-buckets responses now include the required result_info.total_count alongside the existing count. This is additive: the bucket list and existing response fields are unchanged.
• KV: the updated delete-key schema declares no request body, so the generated client rejects body: null. Both UI call sites now omit it. Deletion behavior is unchanged, although TypeScript callers using the updated generated client must likewise omit body.

Neither change modifies storage behavior or the remote KV/R2 APIs.

The Flagship UI follows the updated endpoints: toggles use PATCH, edits use PUT, and listing follows pagination. Local flags also store, validate, and return metadata in evaluation results. Wrangler’s update commands preserve metadata when replacing flags, and pull copies it into the local store.

---

• Tests
  • Tests included/updated
  • Automated tests not possible - manual testing has been completed as follows:
  • Additional testing not necessary because:
• Public documentation
  • Cloudflare docs PR(s): [Flagship] Document the local flag store for wrangler dev cloudflare-docs#32879
  • Documentation not necessary because:

---

[changeset-bot]

🦋 Changeset detected

Latest commit: 62fba53

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 8 packages

Name	Type
miniflare	Minor
wrangler	Patch
@cloudflare/deploy-helpers	Patch
@cloudflare/pages-shared	Patch
@cloudflare/remote-bindings	Patch
@cloudflare/runtime-types	Patch
@cloudflare/vite-plugin	Patch
@cloudflare/vitest-plugin	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[github-actions]

Hi @akshitsinha. Thanks for taking the time to contribute to Workers SDK.

This PR has been automatically closed because you are not currently a registered (vouched) collaborator for this repository.

AI tools now let our team generate proposed code changes quickly. Reviewing changes, checking that they solve the right problem, and maintaining code quality over time still take substantial care and effort. We therefore limit PRs to registered collaborators so we can focus that effort where it is most useful.

For the majority of external contributors, the most effective way to help is through issues: describing a problem or use case, providing a minimal reproduction, investigating its cause, or helping us verify a fix. Those contributions help us understand what needs to change and are very welcome.

We will take an initial look at this PR and decide whether it is something we want to invest time in reviewing and maintaining. We may reopen it if we decide to proceed, but we cannot guarantee that it will be reopened or receive a full review.

[workers-devprod]

Codeowners approval required for this PR:

• ✅ @cloudflare/wrangler

Show detailed file reviewers

[clanky-the-clanker]

✅ Approved — No issues found. The new FlagshipExplorer entrypoint keeps Worker bindings limited to their configured app, the Explorer handlers match the regenerated schema, and metadata is validated and kept across PUT and PATCH.

_{The decision is advisory: this comment never approves, blocks or requests changes on the pull request.}

---

✅ All checks passed

🚀 Release: ✅ LGTM

Risk: Low. Changesets cover the Miniflare, local-explorer-ui and Wrangler changes.

---

🔒 Security: ✅ LGTM

The Explorer gets access to any app's store through a separate FlagshipExplorer entrypoint, bound only into the Local Explorer worker. User Worker bindings still go through FlagshipBinding, which is fixed to the app ID in its props.

Metadata validation rejects:

• prototype-related keys (__proto__, constructor, prototype)
• values that are not finite
• metadata over the entry-count and byte limits

---

📖 AGENTS.md: ✅ LGTM

The change follows the repository conventions: generated files were regenerated from the bumped OpenAPI revision rather than edited by hand, the shared behaviour lives in Miniflare, and changesets are included.

---

📋 Code Quality: ✅ LGTM

Moving the admin logic into createAdmin(stub, fallbackAccountTag) lets FlagshipBinding and the new FlagshipExplorer entrypoint use the same code, and FlagshipBinding still opens only its own props.appId.

The Explorer Flagship handlers in resources/flagship.ts look correct:

• Listing: results are sorted by key and paginated by the last key returned. limit is safe because the query validator coerces it and the generated schema requires gte(1).lte(200).
• Status codes: a missing flag returns 404, a duplicate key returns 409 with the new conflict code, and create returns 201.
• PUT vs PATCH: PUT replaces the flag using the key from the path, and PATCH keeps any fields that are omitted.

Metadata is handled consistently:

• FlagshipObject.patch keeps the current metadata unless the request sets it.
• toStoredFlag drops empty metadata.
• Evaluation results and typed details include the metadata.

Tests are included in Miniflare, the UI and Wrangler.

---

⚡ Performance: ✅ LGTM

List pagination is done in memory over the app's flags. That is fine for a local store. Removing the per-request peer lookups for flag operations also cuts out extra fetches.

---

📝 Documentation: ✅ LGTM

The changesets and JSDoc describe the behaviour changes correctly. That includes the additive R2 total_count change and the KV delete client change.

---

_{Reviewed commit: 780d71fa}

[petebacondarwin]

clanker review

[pkg-pr-new]

@cloudflare/autoconfig

npm i https://pkg.pr.new/@cloudflare/autoconfig@16489

@cloudflare/build-output-utils

npm i https://pkg.pr.new/@cloudflare/build-output-utils@16489

@cloudflare/codemods

npm i https://pkg.pr.new/@cloudflare/codemods@16489

@cloudflare/config

npm i https://pkg.pr.new/@cloudflare/config@16489

@cloudflare/containers-shared

npm i https://pkg.pr.new/@cloudflare/containers-shared@16489

create-cloudflare

npm i https://pkg.pr.new/create-cloudflare@16489

@cloudflare/deploy-helpers

npm i https://pkg.pr.new/@cloudflare/deploy-helpers@16489

@cloudflare/kv-asset-handler

npm i https://pkg.pr.new/@cloudflare/kv-asset-handler@16489

miniflare

npm i https://pkg.pr.new/miniflare@16489

@cloudflare/pages-functions

npm i https://pkg.pr.new/@cloudflare/pages-functions@16489

@cloudflare/pages-shared

npm i https://pkg.pr.new/@cloudflare/pages-shared@16489

@cloudflare/runtime-types

npm i https://pkg.pr.new/@cloudflare/runtime-types@16489

@cloudflare/unenv-preset

npm i https://pkg.pr.new/@cloudflare/unenv-preset@16489

@cloudflare/vite-plugin

npm i https://pkg.pr.new/@cloudflare/vite-plugin@16489

@cloudflare/vitest-plugin

npm i https://pkg.pr.new/@cloudflare/vitest-plugin@16489

@cloudflare/workers-auth

npm i https://pkg.pr.new/@cloudflare/workers-auth@16489

@cloudflare/workers-editor-shared

npm i https://pkg.pr.new/@cloudflare/workers-editor-shared@16489

@cloudflare/workers-utils

npm i https://pkg.pr.new/@cloudflare/workers-utils@16489

wrangler

npm i https://pkg.pr.new/wrangler@16489

commit: 62fba53

[workers-devprod]

Codeowners reviews satisfied