devflare 1.0.0-next.16 → 1.0.0-next.18

package/dist/{dev-grznx8fn.js → dev-ct3344kv.js}

@@ -1,12 +1,13 @@
 import {
   bundleWorkerEntry,
   createDOBundler
-} from "./index-9fbtk7gv.js";
+} from "./index-5gmf048z.js";
 import {
   detectViteProject,
+  resolveViteMode,
   stopSpawnedProcessTree,
   waitForViteReady
-} from "./index-y1d8za14.js";
+} from "./index-gn5wy09x.js";
 import {
   createCliTheme,
   cyanBold,
@@ -25,29 +26,32 @@ import {
   resolveEffectiveViteProject,
   resolveWorkerSurfacePaths,
   writeGeneratedViteConfig
-} from "./index-jwd8pcb2.js";
+} from "./index-v3znz08m.js";
 import {
   discoverRoutes,
   getRouteDirectoryCandidate
 } from "./index-1p814k7s.js";
 import"./index-rbht7m9r.js";
-import"./index-9wt9x09k.js";
+import"./index-vhqww6tt.js";
+import {
+  GATEWAY_RUNTIME_JS
+} from "./index-3xfe2dst.js";
 import {
   clearLocalSendEmailBindings,
   setLocalSendEmailBindings
-} from "./index-h18pxvzs.js";
-import"./index-61jsjnsv.js";
+} from "./index-124e9t4t.js";
+import"./index-j47hhb3r.js";
 import {
   getLocalD1DatabaseIdentifier,
   getLocalKVNamespaceIdentifier,
   getSingleBrowserBindingName,
   loadConfig,
   resolveConfigPath
-} from "./index-43dq8yx8.js";
-import"./index-xk9djfjp.js";
-import"./index-0w826dsr.js";
-import"./index-6jef5emv.js";
-import"./index-t08te69w.js";
+} from "./index-ngbzr9gz.js";
+import"./index-3egad6wm.js";
+import"./index-hjz2x9nq.js";
+import"./index-p296ban8.js";
+import"./index-tte89s31.js";
 import {
   __require
 } from "./index-37x76zdn.js";
@@ -71,8 +75,6 @@ import {
   detectBrowserPlatform,
   Browser as BrowserType
 } from "@puppeteer/browsers";
-var sessions = new Map;
-var history = [];
 var cachedExecutablePath = null;
 async function ensureChrome(cacheDir, logger) {
   if (cachedExecutablePath && existsSync(cachedExecutablePath)) {
@@ -112,8 +114,45 @@ function createBrowserShim(options = {}) {
   } = options;
   let server = null;
   let executablePath = null;
+  const sessions = new Map;
+  const history = [];
   let WebSocketServerClass = null;
   let WebSocketClass = null;
+  const maxRequestBodyBytes = 1024 * 1024;
+  function getRequestOrigin(req) {
+    const origin = req.headers.origin;
+    if (typeof origin === "string") {
+      return origin;
+    }
+    if (Array.isArray(origin) && origin[0]) {
+      return origin[0];
+    }
+    return null;
+  }
+  function isLoopbackOrigin(origin) {
+    try {
+      const url = new URL(origin);
+      return url.hostname === "127.0.0.1" || url.hostname === "localhost" || url.hostname === "::1" || url.hostname === "[::1]";
+    } catch {
+      return false;
+    }
+  }
+  function applyCorsHeaders(req, res) {
+    const origin = getRequestOrigin(req);
+    if (!origin) {
+      return true;
+    }
+    if (!isLoopbackOrigin(origin)) {
+      res.writeHead(403, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: "Forbidden origin" }));
+      return false;
+    }
+    res.setHeader("Access-Control-Allow-Origin", origin);
+    res.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
+    res.setHeader("Access-Control-Allow-Headers", "Content-Type");
+    res.setHeader("Vary", "Origin");
+    return true;
+  }
   async function acquireSession(acquireOptions) {
     if (!executablePath) {
       throw new Error("Chrome not initialized");
@@ -192,9 +231,9 @@ function createBrowserShim(options = {}) {
     const url = new URL(req.url || "/", `http://${host}:${port}`);
     const method = req.method || "GET";
     logger?.debug(`[BrowserShim] ${method} ${url.pathname}${url.search ? url.search : ""}`);
-    res.setHeader("Access-Control-Allow-Origin", "*");
-    res.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
-    res.setHeader("Access-Control-Allow-Headers", "Content-Type");
+    if (!applyCorsHeaders(req, res)) {
+      return;
+    }
     if (method === "OPTIONS") {
       res.writeHead(204);
       res.end();
@@ -282,7 +321,16 @@ function createBrowserShim(options = {}) {
   function readBody(req) {
     return new Promise((resolve, reject) => {
       const chunks = [];
-      req.on("data", (chunk) => chunks.push(chunk));
+      let totalBytes = 0;
+      req.on("data", (chunk) => {
+        totalBytes += chunk.length;
+        if (totalBytes > maxRequestBodyBytes) {
+          req.destroy();
+          reject(new Error(`Request body exceeds ${maxRequestBodyBytes} bytes`));
+          return;
+        }
+        chunks.push(chunk);
+      });
       req.on("end", () => resolve(Buffer.concat(chunks).toString()));
       req.on("error", reject);
     });
@@ -316,6 +364,14 @@ function createBrowserShim(options = {}) {
     if (WebSocketServerClass) {
       const wss = new WebSocketServerClass({ noServer: true });
       server.on("upgrade", (request, socket, head) => {
+        const origin = getRequestOrigin(request);
+        if (origin && !isLoopbackOrigin(origin)) {
+          socket.write(`HTTP/1.1 403 Forbidden\r
+\r
+`);
+          socket.destroy();
+          return;
+        }
         const url = new URL(request.url || "/", `http://${host}:${port}`);
         if (url.pathname !== "/v1/connectDevtools") {
           socket.destroy();
@@ -433,7 +489,7 @@ function createBrowserShim(options = {}) {
     logger?.success(`Browser shim server ready on http://${host}:${port}`);
   }
   async function stop() {
-    for (const sessionId of sessions.keys()) {
+    for (const sessionId of Array.from(sessions.keys())) {
       await closeSession(sessionId, 3, "ServerShutdown");
     }
     if (server) {
@@ -879,33 +935,59 @@ async function runD1Migrations(options) {
   if (!config?.bindings?.d1) {
     return;
   }
-  const { existsSync: existsSync2, readdirSync, readFileSync } = await import("node:fs");
+  const { existsSync: existsSync2, readdirSync, readFileSync, statSync } = await import("node:fs");
   const migrationsDir = resolve(cwd, "migrations");
   if (!existsSync2(migrationsDir)) {
     logger?.debug("No migrations/ directory found, skipping D1 migrations");
     return;
   }
-  const files = readdirSync(migrationsDir).filter((file) => file.endsWith(".sql")).sort();
-  if (files.length === 0) {
-    logger?.debug("No SQL migration files found");
-    return;
-  }
-  logger?.info(`Running ${files.length} D1 migration(s)...`);
-  const allStatements = [];
-  for (const file of files) {
-    const sql = readFileSync(resolve(migrationsDir, file), "utf-8");
-    const statements = collectMigrationStatements(sql);
-    allStatements.push(...statements);
-    logger?.debug(`File ${file}: ${statements.length} statement(s)`);
-  }
-  if (allStatements.length === 0) {
-    logger?.debug("No executable D1 migration statements found");
-    return;
+  const sharedFiles = readdirSync(migrationsDir).filter((file) => file.endsWith(".sql")).sort();
+  let sharedStatements = null;
+  if (sharedFiles.length > 0) {
+    sharedStatements = [];
+    for (const file of sharedFiles) {
+      const sql = readFileSync(resolve(migrationsDir, file), "utf-8");
+      const fileStatements = collectMigrationStatements(sql);
+      sharedStatements.push(...fileStatements);
+      logger?.debug(`Shared file ${file}: ${fileStatements.length} statement(s)`);
+    }
   }
   for (const [bindingName] of Object.entries(config.bindings.d1)) {
+    const perBindingDir = resolve(migrationsDir, bindingName);
+    const hasPerBindingDir = existsSync2(perBindingDir) && statSync(perBindingDir).isDirectory();
+    let statements = [];
+    let fileCount = 0;
+    let sourceLabel = "";
+    if (hasPerBindingDir) {
+      const perBindingFiles = readdirSync(perBindingDir).filter((file) => file.endsWith(".sql")).sort();
+      if (perBindingFiles.length === 0) {
+        logger?.debug(`No SQL migration files in migrations/${bindingName}/, skipping ${bindingName}`);
+        continue;
+      }
+      for (const file of perBindingFiles) {
+        const sql = readFileSync(resolve(perBindingDir, file), "utf-8");
+        const fileStatements = collectMigrationStatements(sql);
+        statements.push(...fileStatements);
+        logger?.debug(`File ${bindingName}/${file}: ${fileStatements.length} statement(s)`);
+      }
+      fileCount = perBindingFiles.length;
+      sourceLabel = `migrations/${bindingName}/`;
+    } else if (sharedStatements !== null) {
+      statements = sharedStatements;
+      fileCount = sharedFiles.length;
+      sourceLabel = "migrations/ [shared fallback]";
+    } else {
+      logger?.debug(`No migrations found for ${bindingName}, skipping`);
+      continue;
+    }
+    logger?.info(`Running ${fileCount} D1 migration(s) for ${bindingName} (from ${sourceLabel})`);
+    if (statements.length === 0) {
+      logger?.debug(`No executable D1 migration statements for ${bindingName}`);
+      continue;
+    }
     await applyMigrationsToBinding({
       bindingName,
-      statements: allStatements,
+      statements,
       miniflarePort,
       logger
     });
@@ -917,18 +999,15 @@ function getGatewayScript(wsRoutes = [], debug = false, appServiceBindingName =
   const wsRoutesJson = JSON.stringify(wsRoutes);
   const appServiceBindingJson = JSON.stringify(appServiceBindingName);
   return `
-// Bridge Gateway Worker — RPC Handler
-// Handles all binding operations via WebSocket RPC
-// Also handles WebSocket proxying to Durable Objects
+${GATEWAY_RUNTIME_JS}
+
+// Bridge Gateway Worker — Dev Server
+// Dev-server-specific overlay on top of the shared GATEWAY_RUNTIME_JS:
+// WS route DO forwarding, D1 migration, email ingest, app-worker fallthrough.
 
 const DEBUG = ${debug}
 const log = (...args) => DEBUG && console.log('[Gateway]', ...args)
 
-const activeStreams = new Map()
-const wsProxies = new Map()
-const incomingStreams = new Map()
-
-// WebSocket routes configuration (injected at build time)
 const WS_ROUTES = ${wsRoutesJson}
 const APP_SERVICE_BINDING = ${appServiceBindingJson}
 
@@ -937,32 +1016,26 @@ export default {
 		const url = new URL(request.url)
 		const isWebSocket = request.headers.get('Upgrade') === 'websocket'
 
-		// Check if this is a WebSocket request matching a DO route
 		if (isWebSocket) {
 			const matchedRoute = matchWsRoute(url.pathname)
 			if (matchedRoute) {
 				return handleDoWebSocket(request, env, url, matchedRoute)
 			}
-			// Otherwise handle as bridge RPC WebSocket
 			return handleBridgeWebSocket(request, env, ctx)
 		}
 
-		// HTTP endpoint for large file transfers
 		if (url.pathname.startsWith('/_devflare/transfer/')) {
 			return handleHttpTransfer(request, env, url)
 		}
 
-		// D1 migration endpoint
 		if (url.pathname === '/_devflare/migrate' && request.method === 'POST') {
 			return handleMigration(request, env)
 		}
 
-		// Email handler endpoint (simulates incoming email)
 		if (url.pathname === '/cdn-cgi/handler/email' && request.method === 'POST') {
 			return handleEmailIncoming(request, env, ctx, url)
 		}
 
-		// Health check
 		if (url.pathname === '/_devflare/health') {
 			return new Response(JSON.stringify({
 				ok: true,
@@ -982,7 +1055,6 @@ export default {
 	}
 }
 
-// Handle D1 migrations
 async function handleMigration(request, env) {
 	try {
 		const { bindingName, statements } = await request.json()
@@ -1009,28 +1081,26 @@ async function handleMigration(request, env) {
 				}
 			}
 		}
-		
-		// Verify table exists after migration
+
 		try {
 			const tables = await db.prepare("SELECT name FROM sqlite_master WHERE type='table'").all()
 			log('Tables after migration:', JSON.stringify(tables))
 		} catch (e) {
 			log('Error listing tables:', e.message)
 		}
-		
+
 		return Response.json({ success: true, results })
 	} catch (error) {
 		return Response.json({ error: error?.message || String(error) }, { status: 500 })
 	}
 }
 
-// Handle incoming email (simulates email() handler)
 async function handleEmailIncoming(request, env, ctx, url) {
 	try {
 		const from = url.searchParams.get('from') || 'unknown@example.com'
 		const to = url.searchParams.get('to') || 'worker@example.com'
 		const rawBody = await request.text()
-		
+
 		log('Email incoming:', { from, to, bodyLength: rawBody.length })
 
 		if (APP_SERVICE_BINDING) {
@@ -1052,7 +1122,7 @@ async function handleEmailIncoming(request, env, ctx, url) {
 				}
 			}
 		}
-		
+
 		return new Response(JSON.stringify({ ok: true, from, to }), {
 			headers: { 'Content-Type': 'application/json' }
 		})
@@ -1062,10 +1132,8 @@ async function handleEmailIncoming(request, env, ctx, url) {
 	}
 }
 
-// Match URL path against configured WS routes
 function matchWsRoute(pathname) {
 	for (const route of WS_ROUTES) {
-		// Simple exact match for now (could add glob/regex later)
 		if (pathname === route.pattern || pathname.startsWith(route.pattern + '?')) {
 			return route
 		}
@@ -1073,31 +1141,23 @@ function matchWsRoute(pathname) {
 	return null
 }
 
-// Handle WebSocket upgrade that should go to a Durable Object
 async function handleDoWebSocket(request, env, url, route) {
 	try {
-		// Get the DO namespace
 		const namespace = env[route.doNamespace]
 		if (!namespace) {
 			console.error('[Gateway] DO namespace not found:', route.doNamespace)
 			return new Response('DO namespace not found: ' + route.doNamespace, { status: 500 })
 		}
 
-		// Get the instance ID from query params
 		const idValue = url.searchParams.get(route.idParam) || 'default'
-
-		// Get or create DO instance
 		const doId = namespace.idFromName(idValue)
 		const stub = namespace.get(doId)
 
-		// Construct the forward URL for the DO
 		const forwardUrl = new URL(route.forwardPath, url.origin)
-		// Forward all query params
 		url.searchParams.forEach((v, k) => forwardUrl.searchParams.set(k, v))
 
 		log('Forwarding WebSocket to DO:', route.doNamespace, 'id:', idValue, 'path:', forwardUrl.pathname)
 
-		// Forward the request to the DO
 		return stub.fetch(forwardUrl.toString(), {
 			method: request.method,
 			headers: request.headers
@@ -1107,364 +1167,6 @@ async function handleDoWebSocket(request, env, url, route) {
 		return new Response('Error forwarding to DO: ' + error.message, { status: 500 })
 	}
 }
-
-// Handle bridge RPC WebSocket (for Node.js Vite server communication)
-function handleBridgeWebSocket(request, env, ctx) {
-	const { 0: client, 1: server } = new WebSocketPair()
-	server.accept()
-
-	server.addEventListener('message', async (event) => {
-		try {
-			if (typeof event.data === 'string') {
-				await handleJsonMessage(event.data, server, env, ctx)
-			}
-		} catch (error) {
-			console.error('[Gateway] Error:', error)
-		}
-	})
-
-	server.addEventListener('close', () => {
-		activeStreams.clear()
-		wsProxies.clear()
-	})
-
-	return new Response(null, { status: 101, webSocket: client })
-}
-
-async function handleJsonMessage(data, ws, env, ctx) {
-	const msg = JSON.parse(data)
-
-	switch (msg.t) {
-		case 'rpc.call':
-			await handleRpcCall(msg, ws, env, ctx)
-			break
-		case 'ws.open':
-			await handleWsOpen(msg, ws, env)
-			break
-		case 'ws.close':
-			handleWsClose(msg)
-			break
-	}
-}
-
-async function handleRpcCall(msg, ws, env, ctx) {
-	try {
-		const result = await executeRpcMethod(msg.method, msg.params, env, ctx)
-		ws.send(JSON.stringify({ t: 'rpc.ok', id: msg.id, result }))
-	} catch (error) {
-		ws.send(JSON.stringify({
-			t: 'rpc.err',
-			id: msg.id,
-			error: { code: error.code || 'INTERNAL_ERROR', message: error.message }
-		}))
-	}
-}
-
-async function executeRpcMethod(method, params, env, ctx) {
-	const parts = method.split('.')
-	const bindingName = parts[0]
-	const operation = parts.slice(1).join('.')
-	const binding = env[bindingName]
-	const RAW_EMAIL = 'EmailMessage::raw'
-
-	if (!binding) throw new Error('Binding not found: ' + bindingName)
-
-	// KV operations
-	if (operation === 'get') return binding.get(params[0], params[1])
-	if (operation === 'put') return binding.put(params[0], params[1], params[2])
-	if (operation === 'delete') return binding.delete(params[0])
-	if (operation === 'list') return binding.list(params[0])
-	if (operation === 'getWithMetadata') return binding.getWithMetadata(params[0], params[1])
-
-	// R2 operations
-	if (operation === 'head') return serializeR2Object(await binding.head(params[0]))
-	if (operation === 'r2.get') {
-		const obj = await binding.get(params[0], params[1])
-		if (!obj) return null
-		const body = await obj.arrayBuffer()
-		return serializeR2ObjectBody(obj, arrayBufferToBase64(body))
-	}
-	if (operation === 'r2.put') {
-		// Deserialize the value if it's a serialized ArrayBuffer/Uint8Array
-		let value = params[1]
-		if (value && typeof value === 'object') {
-			if (value.__type === 'ArrayBuffer') {
-				value = base64ToArrayBuffer(value.data)
-			} else if (value.__type === 'Uint8Array') {
-				value = base64ToArrayBuffer(value.data)
-			}
-		}
-		return serializeR2Object(await binding.put(params[0], value, params[2]))
-	}
-	if (operation === 'r2.delete') return binding.delete(params[0])
-	if (operation === 'r2.list') return serializeR2Objects(await binding.list(params[0]))
-
-	// D1 operations
-	if (operation === 'exec') return binding.exec(params[0])
-	if (operation.startsWith('stmt.')) {
-		log('D1 RPC:', bindingName, operation, 'sql:', String(params[0]).slice(0, 60))
-		const mode = operation.split('.')[1]
-		const [sql, ...rest] = params
-		
-		// For first/raw, the last element is the column/options parameter (may be undefined)
-		// For all/run, rest contains only bindings
-		let bindings = rest
-		let extraParam = undefined
-		
-		if (mode === 'first' || mode === 'raw') {
-			// Last element is the column/options (may be undefined)
-			extraParam = rest[rest.length - 1]
-			bindings = rest.slice(0, -1)
-		}
-		
-		let stmt = binding.prepare(sql)
-		if (bindings.length > 0) stmt = stmt.bind(...bindings)
-		
-		if (mode === 'first') {
-			// Only pass column if it's a non-empty string
-			if (typeof extraParam === 'string' && extraParam.length > 0) {
-				return stmt.first(extraParam)
-			}
-			return stmt.first()
-		}
-		if (mode === 'all') return stmt.all()
-		if (mode === 'run') return stmt.run()
-		if (mode === 'raw') return stmt.raw(extraParam)
-	}
-
-	// DO operations
-	if (operation === 'idFromName') {
-		const id = binding.idFromName(params[0])
-		return { __type: 'DOId', hex: id.toString() }
-	}
-	if (operation === 'idFromString') {
-		const id = binding.idFromString(params[0])
-		return { __type: 'DOId', hex: id.toString() }
-	}
-	if (operation === 'newUniqueId') {
-		const id = binding.newUniqueId(params[0])
-		return { __type: 'DOId', hex: id.toString() }
-	}
-	if (operation === 'stub.fetch') {
-		const [, serializedId, serializedReq] = params
-		log('stub.fetch request:', {
-			url: serializedReq.url,
-			method: serializedReq.method,
-			headers: serializedReq.headers,
-			hasBody: !!serializedReq.body
-		})
-		const id = binding.idFromString(serializedId.hex)
-		const stub = binding.get(id)
-		try {
-			const response = await stub.fetch(new Request(serializedReq.url, {
-				method: serializedReq.method,
-				headers: serializedReq.headers,
-				body: serializedReq.body?.type === 'bytes' ? base64ToArrayBuffer(serializedReq.body.data) : undefined
-			}))
-			// Clone to read body for logging if there's an error
-			const cloned = response.clone()
-			const serialized = await serializeResponse(response)
-			log('stub.fetch response:', {
-				status: serialized.status,
-				headers: serialized.headers,
-				bodyLength: serialized.body?.data?.length || 0
-			})
-			// If 500, log the body content
-			if (response.status >= 400) {
-				const errBody = await cloned.text()
-				log('Error response body:', errBody)
-			}
-			return serialized
-		} catch (err) {
-			console.error('[Gateway] stub.fetch error:', err)
-			throw err
-		}
-	}
-	if (operation === 'stub.rpc') {
-		const [, serializedId, methodName, args] = params
-		const id = binding.idFromString(serializedId.hex)
-		const stub = binding.get(id)
-		const response = await stub.fetch(new Request('http://do/_rpc', {
-			method: 'POST',
-			headers: { 'Content-Type': 'application/json' },
-			body: JSON.stringify({ method: methodName, params: args })
-		}))
-		const result = await response.json()
-		if (!result.ok) throw new Error(result.error?.message || 'RPC failed')
-		return result.result
-	}
-
-	// Queue operations
-	if (operation === 'send') return binding.send(params[0], params[1])
-	if (operation === 'sendBatch') return binding.sendBatch(params[0], params[1])
-
-	// Email send operations (send_email binding)
-	if (operation === 'email.send') {
-		const message = params[0]
-		log('Email send:', { from: message?.from, to: message?.to })
-		if (binding && typeof binding.send === 'function') {
-			if (message && typeof message === 'object' && 'from' in message && 'to' in message && 'raw' in message) {
-				return binding.send({
-					from: message.from,
-					to: message.to,
-					[RAW_EMAIL]: createEmailMessageRaw(message.raw)
-				})
-			}
-			return binding.send(message)
-		}
-		// Return success even if no real binding (simulated)
-		return { ok: true, simulated: true }
-	}
-
-	throw new Error('Unknown operation: ' + method)
-}
-
-function createEmailMessageRaw(raw) {
-	if (typeof raw === 'string' || raw instanceof ReadableStream) {
-		return raw
-	}
-	if (raw instanceof ArrayBuffer || raw instanceof Uint8Array) {
-		return new Response(raw).body
-	}
-	throw new Error('Unsupported EmailMessage raw payload')
-}
-
-async function handleWsOpen(msg, ws, env) {
-	try {
-		const binding = env[msg.target.binding]
-		const id = binding.idFromString(msg.target.id)
-		const stub = binding.get(id)
-
-		const headers = new Headers(msg.target.headers || [])
-		headers.set('Upgrade', 'websocket')
-
-		const response = await stub.fetch(new Request(msg.target.url, { method: 'GET', headers }))
-		const doWs = response.webSocket
-
-		if (!doWs) {
-			ws.send(JSON.stringify({ t: 'rpc.err', id: 'ws_' + msg.wid, error: { code: 'WS_FAILED', message: 'No WebSocket returned' } }))
-			return
-		}
-
-		doWs.accept()
-		wsProxies.set(msg.wid, { doWs })
-
-		doWs.addEventListener('message', (event) => {
-			const isText = typeof event.data === 'string'
-			const data = isText ? event.data : arrayBufferToBase64(event.data)
-			ws.send(JSON.stringify({ t: 'ws.data', wid: msg.wid, data, isText }))
-		})
-
-		doWs.addEventListener('close', (event) => {
-			ws.send(JSON.stringify({ t: 'ws.close', wid: msg.wid, code: event.code, reason: event.reason }))
-			wsProxies.delete(msg.wid)
-		})
-
-		ws.send(JSON.stringify({ t: 'ws.opened', wid: msg.wid }))
-	} catch (error) {
-		ws.send(JSON.stringify({ t: 'rpc.err', id: 'ws_' + msg.wid, error: { code: 'WS_FAILED', message: error.message } }))
-	}
-}
-
-function handleWsClose(msg) {
-	const proxy = wsProxies.get(msg.wid)
-	if (proxy) {
-		proxy.doWs.close(msg.code, msg.reason)
-		wsProxies.delete(msg.wid)
-	}
-}
-
-async function handleHttpTransfer(request, env, url) {
-	const transferIdEncoded = url.pathname.split('/').pop()
-	const transferId = decodeURIComponent(transferIdEncoded || '')
-	const [binding, ...keyParts] = transferId.split(':')
-	const key = keyParts.join(':')
-	const bucket = env[binding]
-
-	if (!bucket) return new Response('Bucket not found: ' + binding, { status: 404 })
-
-	if (request.method === 'PUT' || request.method === 'POST') {
-		const result = await bucket.put(key, request.body)
-		return new Response(JSON.stringify(result), { headers: { 'Content-Type': 'application/json' } })
-	}
-
-	if (request.method === 'GET') {
-		const object = await bucket.get(key)
-		if (!object) return new Response('Not found', { status: 404 })
-		return new Response(object.body, {
-			headers: {
-				'Content-Type': object.httpMetadata?.contentType || 'application/octet-stream',
-				'Content-Length': String(object.size)
-			}
-		})
-	}
-
-	return new Response('Method not allowed', { status: 405 })
-}
-
-// Helpers
-function serializeR2Object(obj) {
-	if (!obj) return null
-	return {
-		__type: 'R2Object',
-		key: obj.key,
-		version: obj.version,
-		size: obj.size,
-		etag: obj.etag,
-		httpEtag: obj.httpEtag,
-		checksums: obj.checksums,
-		uploaded: obj.uploaded?.toISOString(),
-		httpMetadata: obj.httpMetadata,
-		customMetadata: obj.customMetadata,
-		range: obj.range,
-		storageClass: obj.storageClass
-	}
-}
-function serializeR2ObjectBody(obj, bodyData) {
-	if (!obj) return null
-	return {
-		__type: 'R2ObjectBody',
-		key: obj.key,
-		version: obj.version,
-		size: obj.size,
-		etag: obj.etag,
-		httpEtag: obj.httpEtag,
-		checksums: obj.checksums,
-		uploaded: obj.uploaded?.toISOString(),
-		httpMetadata: obj.httpMetadata,
-		customMetadata: obj.customMetadata,
-		range: obj.range,
-		storageClass: obj.storageClass,
-		bodyData
-	}
-}
-function serializeR2Objects(result) {
-	if (!result) return null
-	return { objects: result.objects.map(serializeR2Object), truncated: result.truncated, cursor: result.cursor }
-}
-async function serializeResponse(response) {
-	// Read body as bytes and encode as base64
-	let body = null
-	if (response.body) {
-		const bytes = await response.arrayBuffer()
-		if (bytes.byteLength > 0) {
-			body = { type: 'bytes', data: arrayBufferToBase64(bytes) }
-		}
-	}
-	return { status: response.status, statusText: response.statusText, headers: [...response.headers.entries()], body }
-}
-function arrayBufferToBase64(buffer) {
-	const bytes = new Uint8Array(buffer)
-	let binary = ''
-	for (let i = 0; i < bytes.byteLength; i++) binary += String.fromCharCode(bytes[i])
-	return btoa(binary)
-}
-function base64ToArrayBuffer(base64) {
-	const binary = atob(base64)
-	const bytes = new Uint8Array(binary.length)
-	for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i)
-	return bytes.buffer
-}
 `;
 }
 
@@ -1574,6 +1276,48 @@ async function startViteProcess(options) {
   return viteProcess;
 }
 
+// src/dev-server/reload-queue.ts
+function createReloadQueue({ reload, logger }) {
+  let running = null;
+  let pending = null;
+  async function runOnce() {
+    try {
+      await reload();
+    } catch (error) {
+      logger?.error("[devflare dev] reload failed:", error);
+    }
+  }
+  function schedule() {
+    if (!running) {
+      running = runOnce().finally(() => {
+        running = null;
+      });
+      return running;
+    }
+    if (!pending) {
+      const runningSnapshot = running;
+      pending = runningSnapshot.then(() => {
+        pending = null;
+        running = runOnce().finally(() => {
+          running = null;
+        });
+        return running;
+      });
+    }
+    return pending;
+  }
+  async function drain() {
+    while (running || pending) {
+      if (pending) {
+        await pending;
+      } else if (running) {
+        await running;
+      }
+    }
+  }
+  return { schedule, drain };
+}
+
 // src/dev-server/worker-surface-paths.ts
 import { dirname, resolve as resolve2 } from "pathe";
 var DEFAULT_TRANSPORT_ENTRY_FILES = [
@@ -1719,12 +1463,13 @@ function createDevServer(options) {
     configPath,
     vitePort = 5173,
     miniflarePort = 8787,
-    enableVite = true,
+    enableVite: enableViteRequested = true,
     persist = true,
     logger,
     verbose = false,
     debug = process.env.DEVFLARE_DEBUG === "true"
   } = options;
+  let enableVite = enableViteRequested;
   let miniflare = null;
   let doBundler = null;
   let workerSourceWatcher = null;
@@ -1745,7 +1490,20 @@ function createDevServer(options) {
   let currentDoResult = null;
   let mainWorkerRoutes = null;
   let generatedViteConfigPath = null;
-  let reloadChain = Promise.resolve();
+  const reloadQueue = createReloadQueue({
+    reload: async () => {
+      if (!miniflare)
+        return;
+      const { Log, LogLevel } = await import("miniflare");
+      const mfConfig = buildMiniflareConfig(currentDoResult);
+      mfConfig.log = createCompatibilityAwareMiniflareLog(Log, LogLevel.DEBUG, logger);
+      mfConfig.handleRuntimeStdio = createRuntimeStdioForwarder(logger);
+      logger?.info("Reloading Miniflare...");
+      await miniflare.setOptions(mfConfig);
+      logger?.success("Miniflare reloaded");
+    },
+    logger
+  });
   async function bundleMainWorker() {
     if (!mainWorkerScriptPath || !config) {
       bundledMainWorkerScriptPath = null;
@@ -2018,19 +1776,7 @@ function createDevServer(options) {
   }
   async function reloadMiniflare(doResult) {
     currentDoResult = doResult;
-    const queuedReload = reloadChain.then(async () => {
-      if (!miniflare)
-        return;
-      const { Log, LogLevel } = await import("miniflare");
-      const mfConfig = buildMiniflareConfig(currentDoResult);
-      mfConfig.log = createCompatibilityAwareMiniflareLog(Log, LogLevel.DEBUG, logger);
-      mfConfig.handleRuntimeStdio = createRuntimeStdioForwarder(logger);
-      logger?.info("Reloading Miniflare...");
-      await miniflare.setOptions(mfConfig);
-      logger?.success("Miniflare reloaded");
-    });
-    reloadChain = queuedReload.catch(() => {});
-    await queuedReload;
+    await reloadQueue.schedule();
   }
   async function resolveWorkerConfigWatchPath() {
     if (configPath) {
@@ -2120,14 +1866,19 @@ function createDevServer(options) {
     resolvedWorkerConfigPath = await resolveWorkerConfigWatchPath();
     logger?.debug("Loaded config:", config.name);
     if (enableVite) {
-      const viteProject = await detectViteProject(cwd);
-      generatedViteConfigPath = await writeGeneratedViteConfig({
-        cwd,
-        configPath,
-        localConfigPath: viteProject.viteConfigPath,
-        bridgePort: miniflarePort
-      });
-      logger?.debug(`Generated Vite config → ${generatedViteConfigPath}`);
+      const viteMode = await resolveViteMode(cwd, { requested: true });
+      if (!viteMode.enableVite) {
+        logger?.info("Vite disabled: no vite config found for this package");
+        enableVite = false;
+      } else {
+        generatedViteConfigPath = await writeGeneratedViteConfig({
+          cwd,
+          configPath,
+          localConfigPath: viteMode.viteConfigPath,
+          bridgePort: miniflarePort
+        });
+        logger?.debug(`Generated Vite config → ${generatedViteConfigPath}`);
+      }
     }
     await refreshWorkerOnlySurfaceState();
     if (!enableVite && (hasWorkerSurfacePaths(mainWorkerSurfacePaths) || Boolean(mainWorkerRoutes?.routes.length))) {