WC-2972: Allow Workers Assets to be mounted to a path

[WalshyDev]

Fixes WC-2972.

Allow Workers Assets to be mounted to a wildcard path. We are still limiting unwildcarded paths like example.com/test for the minute though.

We will log a warning saying that we will attempt to serve assets along with the asset dir being matched. Also with a note saying unmatched will go to the Worker

Wording TBD here.

---

• Tests
  • TODO (before merge)
  • Tests included
  • Tests not necessary because:
• E2E Tests CI Job required? (Use "e2e" label or ask maintainer to run separately)
  • I don't know
  • Required
  • Not required because: not covered there
• Public documentation
  • TODO (before merge)
  • Cloudflare docs PR(s): Mounted assets docs cloudflare-docs#18657
  • Documentation not necessary because:

[changeset-bot]

🦋 Changeset detected

Latest commit: 65b102b

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
wrangler	Minor
@cloudflare/vitest-pool-workers	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[github-actions]

A wrangler prerelease is available for testing. You can install this latest build in your project with:

npm install --save-dev https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/12378030574/npm-package-wrangler-7476

You can reference the automatically updated head of this PR with:

npm install --save-dev https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/prs/7476/npm-package-wrangler-7476

Or you can use npx with this latest build directly:

npx https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/12378030574/npm-package-wrangler-7476 dev path/to/script.js

Additional artifacts:

wget https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/12378030574/npm-package-cloudflare-workers-bindings-extension-7476 -O ./cloudflare-workers-bindings-extension.0.0.0-vd048aae22.vsix && code --install-extension ./cloudflare-workers-bindings-extension.0.0.0-vd048aae22.vsix

npx https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/12378030574/npm-package-create-cloudflare-7476 --no-auto-update

npm install https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/12378030574/npm-package-cloudflare-kv-asset-handler-7476

npm install https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/12378030574/npm-package-miniflare-7476

npm install https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/12378030574/npm-package-cloudflare-pages-shared-7476

npm install https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/12378030574/npm-package-cloudflare-unenv-preset-7476

npm install https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/12378030574/npm-package-cloudflare-vitest-pool-workers-7476

npm install https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/12378030574/npm-package-cloudflare-workers-editor-shared-7476

npm install https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/12378030574/npm-package-cloudflare-workers-shared-7476

npm install https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/12378030574/npm-package-cloudflare-workflows-shared-7476

Note that these links will no longer work once the GitHub Actions artifact expires.

---

wrangler@3.97.0 includes the following runtime dependencies:

Package	Constraint	Resolved
miniflare	workspace:*	3.20241205.0
workerd	1.20241205.0	1.20241205.0
workerd --version	1.20241205.0	2024-12-05

Please ensure constraints are pinned, and miniflare/workerd minor versions match.

[Cherry]

This is awesome to see, but "masking" is an odd way to describe this feature. "Masking" to me implies a sense of temporary-ness, or fake-ness, vs the industry standard of mounting that you see across lots of different software when you mount files/folders at a specific location, like inside containers.

Hopefully the naming is finalised, because "mount" makes way more senses than "mask" in my opinion.

[GregBrimble]

Sorry, not strictly related to your change, but before we release this, can we also make sure we have some asset-worker tests which assert that we do not leak out assets for requests like example.com/blog/../home and example.com/blog/%2E%2E/home? If we're saying in the docs that assets like /home.html are not directly accessible, we need to be confident in that.