cloudflare_workers_script: `worker_loader` binding type is read into state but rejected by the schema validator

[jackemcpherson]

Confirmation

• This is a bug with an existing resource and is not a feature request or enhancement.
• I have searched the issue tracker and my issue isn't already found.
• I have replicated my issue using the latest version of the provider and it is still present.

Terraform and Cloudflare provider version

OpenTofu 1.12.3 with provider cloudflare/cloudflare 5.23.0. The same
behaviour occurs on 5.22.0.

Affected resource(s)

• cloudflare_workers_script

Terraform configuration files

resource "cloudflare_workers_script" "this" {
  account_id         = var.account_id
  script_name        = "my-worker"
  content_file       = var.bundle
  main_module        = "index.js"
  compatibility_date = "2026-04-01"

  bindings = [
    { type = "worker_loader", name = "LOADER" },
  ]
}

Actual Behaviour

The bindings[].type schema validator rejects worker_loader:

Invalid Attribute Value Match: Attribute bindings[0].type value must be one of:
["ai" "ai_search" ... "wasm_module" "vpc_service" "vpc_network"], got: "worker_loader"

The Read path decodes an existing worker_loader binding from the live script
into state. A binding of this type can only be created out-of-band with
wrangler or the dashboard. The two behaviours together make the binding
impossible to manage: every plan proposes to remove a binding that the
configuration cannot declare.

~ bindings = [
    - {
        - name = "LOADER" -> null
        - type = "worker_loader" -> null
      },
      # (3 unchanged elements hidden)
  ]

Setting keep_bindings = ["worker_loader"] preserves the live binding through
an apply. I verified through the Workers settings API that the binding remains
after the apply. The plan never converges: every plan and every drift run
shows the same pending removal.

Expected Behaviour

The validator accepts worker_loader in bindings[].type. This value matches
what the Workers API returns for scripts that use the Worker Loader feature
for dynamic isolate loading. The bug appears to be the same class of issue as
the missing ratelimit type that was fixed earlier (see the regression test
in internal/services/workers_script/resource_test.go).

Steps to reproduce

1. Create a Worker with a Worker Loader binding out-of-band, for example with
   wrangler and worker_loaders = [{ binding = "LOADER" }].
2. Manage the script with cloudflare_workers_script without declaring the
   binding. Every plan shows the removal above.
3. Declare { type = "worker_loader", name = "LOADER" } in bindings. The
   validation error above occurs.