devflare 1.0.0-next.16 → 1.0.0-next.18

package/dist/{dev-7ef5e2j1.js → dev-dg8dh5c1.js}

@@ -25,29 +25,32 @@ import {
   resolveEffectiveViteProject,
   resolveWorkerSurfacePaths,
   writeGeneratedViteConfig
-} from "./index-yqbxjysa.js";
+} from "./index-p97s12vf.js";
 import {
   discoverRoutes,
   getRouteDirectoryCandidate
 } from "./index-1p814k7s.js";
 import"./index-rbht7m9r.js";
 import"./index-9wt9x09k.js";
+import {
+  GATEWAY_RUNTIME_JS
+} from "./index-q34rvh5a.js";
 import {
   clearLocalSendEmailBindings,
   setLocalSendEmailBindings
-} from "./index-h18pxvzs.js";
-import"./index-11m5a8wd.js";
+} from "./index-124e9t4t.js";
+import"./index-n8k8chde.js";
 import {
   getLocalD1DatabaseIdentifier,
   getLocalKVNamespaceIdentifier,
   getSingleBrowserBindingName,
   loadConfig,
   resolveConfigPath
-} from "./index-yzddwp02.js";
-import"./index-jb75kwa4.js";
-import"./index-0w826dsr.js";
+} from "./index-dmbdj6va.js";
+import"./index-nte9n8w9.js";
+import"./index-z9fjnwa8.js";
 import"./index-p296ban8.js";
-import"./index-t08te69w.js";
+import"./index-tte89s31.js";
 import {
   __require
 } from "./index-37x76zdn.js";
@@ -71,8 +74,6 @@ import {
   detectBrowserPlatform,
   Browser as BrowserType
 } from "@puppeteer/browsers";
-var sessions = new Map;
-var history = [];
 var cachedExecutablePath = null;
 async function ensureChrome(cacheDir, logger) {
   if (cachedExecutablePath && existsSync(cachedExecutablePath)) {
@@ -112,8 +113,45 @@ function createBrowserShim(options = {}) {
   } = options;
   let server = null;
   let executablePath = null;
+  const sessions = new Map;
+  const history = [];
   let WebSocketServerClass = null;
   let WebSocketClass = null;
+  const maxRequestBodyBytes = 1024 * 1024;
+  function getRequestOrigin(req) {
+    const origin = req.headers.origin;
+    if (typeof origin === "string") {
+      return origin;
+    }
+    if (Array.isArray(origin) && origin[0]) {
+      return origin[0];
+    }
+    return null;
+  }
+  function isLoopbackOrigin(origin) {
+    try {
+      const url = new URL(origin);
+      return url.hostname === "127.0.0.1" || url.hostname === "localhost" || url.hostname === "::1" || url.hostname === "[::1]";
+    } catch {
+      return false;
+    }
+  }
+  function applyCorsHeaders(req, res) {
+    const origin = getRequestOrigin(req);
+    if (!origin) {
+      return true;
+    }
+    if (!isLoopbackOrigin(origin)) {
+      res.writeHead(403, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: "Forbidden origin" }));
+      return false;
+    }
+    res.setHeader("Access-Control-Allow-Origin", origin);
+    res.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
+    res.setHeader("Access-Control-Allow-Headers", "Content-Type");
+    res.setHeader("Vary", "Origin");
+    return true;
+  }
   async function acquireSession(acquireOptions) {
     if (!executablePath) {
       throw new Error("Chrome not initialized");
@@ -192,9 +230,9 @@ function createBrowserShim(options = {}) {
     const url = new URL(req.url || "/", `http://${host}:${port}`);
     const method = req.method || "GET";
     logger?.debug(`[BrowserShim] ${method} ${url.pathname}${url.search ? url.search : ""}`);
-    res.setHeader("Access-Control-Allow-Origin", "*");
-    res.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
-    res.setHeader("Access-Control-Allow-Headers", "Content-Type");
+    if (!applyCorsHeaders(req, res)) {
+      return;
+    }
     if (method === "OPTIONS") {
       res.writeHead(204);
       res.end();
@@ -282,7 +320,16 @@ function createBrowserShim(options = {}) {
   function readBody(req) {
     return new Promise((resolve, reject) => {
       const chunks = [];
-      req.on("data", (chunk) => chunks.push(chunk));
+      let totalBytes = 0;
+      req.on("data", (chunk) => {
+        totalBytes += chunk.length;
+        if (totalBytes > maxRequestBodyBytes) {
+          req.destroy();
+          reject(new Error(`Request body exceeds ${maxRequestBodyBytes} bytes`));
+          return;
+        }
+        chunks.push(chunk);
+      });
       req.on("end", () => resolve(Buffer.concat(chunks).toString()));
       req.on("error", reject);
     });
@@ -316,6 +363,14 @@ function createBrowserShim(options = {}) {
     if (WebSocketServerClass) {
       const wss = new WebSocketServerClass({ noServer: true });
       server.on("upgrade", (request, socket, head) => {
+        const origin = getRequestOrigin(request);
+        if (origin && !isLoopbackOrigin(origin)) {
+          socket.write(`HTTP/1.1 403 Forbidden\r
+\r
+`);
+          socket.destroy();
+          return;
+        }
         const url = new URL(request.url || "/", `http://${host}:${port}`);
         if (url.pathname !== "/v1/connectDevtools") {
           socket.destroy();
@@ -433,7 +488,7 @@ function createBrowserShim(options = {}) {
     logger?.success(`Browser shim server ready on http://${host}:${port}`);
   }
   async function stop() {
-    for (const sessionId of sessions.keys()) {
+    for (const sessionId of Array.from(sessions.keys())) {
       await closeSession(sessionId, 3, "ServerShutdown");
     }
     if (server) {
@@ -879,33 +934,59 @@ async function runD1Migrations(options) {
   if (!config?.bindings?.d1) {
     return;
   }
-  const { existsSync: existsSync2, readdirSync, readFileSync } = await import("node:fs");
+  const { existsSync: existsSync2, readdirSync, readFileSync, statSync } = await import("node:fs");
   const migrationsDir = resolve(cwd, "migrations");
   if (!existsSync2(migrationsDir)) {
     logger?.debug("No migrations/ directory found, skipping D1 migrations");
     return;
   }
-  const files = readdirSync(migrationsDir).filter((file) => file.endsWith(".sql")).sort();
-  if (files.length === 0) {
-    logger?.debug("No SQL migration files found");
-    return;
-  }
-  logger?.info(`Running ${files.length} D1 migration(s)...`);
-  const allStatements = [];
-  for (const file of files) {
-    const sql = readFileSync(resolve(migrationsDir, file), "utf-8");
-    const statements = collectMigrationStatements(sql);
-    allStatements.push(...statements);
-    logger?.debug(`File ${file}: ${statements.length} statement(s)`);
-  }
-  if (allStatements.length === 0) {
-    logger?.debug("No executable D1 migration statements found");
-    return;
+  const sharedFiles = readdirSync(migrationsDir).filter((file) => file.endsWith(".sql")).sort();
+  let sharedStatements = null;
+  if (sharedFiles.length > 0) {
+    sharedStatements = [];
+    for (const file of sharedFiles) {
+      const sql = readFileSync(resolve(migrationsDir, file), "utf-8");
+      const fileStatements = collectMigrationStatements(sql);
+      sharedStatements.push(...fileStatements);
+      logger?.debug(`Shared file ${file}: ${fileStatements.length} statement(s)`);
+    }
   }
   for (const [bindingName] of Object.entries(config.bindings.d1)) {
+    const perBindingDir = resolve(migrationsDir, bindingName);
+    const hasPerBindingDir = existsSync2(perBindingDir) && statSync(perBindingDir).isDirectory();
+    let statements = [];
+    let fileCount = 0;
+    let sourceLabel = "";
+    if (hasPerBindingDir) {
+      const perBindingFiles = readdirSync(perBindingDir).filter((file) => file.endsWith(".sql")).sort();
+      if (perBindingFiles.length === 0) {
+        logger?.debug(`No SQL migration files in migrations/${bindingName}/, skipping ${bindingName}`);
+        continue;
+      }
+      for (const file of perBindingFiles) {
+        const sql = readFileSync(resolve(perBindingDir, file), "utf-8");
+        const fileStatements = collectMigrationStatements(sql);
+        statements.push(...fileStatements);
+        logger?.debug(`File ${bindingName}/${file}: ${fileStatements.length} statement(s)`);
+      }
+      fileCount = perBindingFiles.length;
+      sourceLabel = `migrations/${bindingName}/`;
+    } else if (sharedStatements !== null) {
+      statements = sharedStatements;
+      fileCount = sharedFiles.length;
+      sourceLabel = "migrations/ [shared fallback]";
+    } else {
+      logger?.debug(`No migrations found for ${bindingName}, skipping`);
+      continue;
+    }
+    logger?.info(`Running ${fileCount} D1 migration(s) for ${bindingName} (from ${sourceLabel})`);
+    if (statements.length === 0) {
+      logger?.debug(`No executable D1 migration statements for ${bindingName}`);
+      continue;
+    }
     await applyMigrationsToBinding({
       bindingName,
-      statements: allStatements,
+      statements,
       miniflarePort,
       logger
     });
@@ -917,18 +998,16 @@ function getGatewayScript(wsRoutes = [], debug = false, appServiceBindingName =
   const wsRoutesJson = JSON.stringify(wsRoutes);
   const appServiceBindingJson = JSON.stringify(appServiceBindingName);
   return `
-// Bridge Gateway Worker — RPC Handler
-// Handles all binding operations via WebSocket RPC
-// Also handles WebSocket proxying to Durable Objects
+${GATEWAY_RUNTIME_JS}
+
+// Bridge Gateway Worker — Dev Server
+// Handles WebSocket RPC, DO WS proxying, HTTP transfer, D1 migration, email ingest
 
 const DEBUG = ${debug}
 const log = (...args) => DEBUG && console.log('[Gateway]', ...args)
 
-const activeStreams = new Map()
 const wsProxies = new Map()
-const incomingStreams = new Map()
 
-// WebSocket routes configuration (injected at build time)
 const WS_ROUTES = ${wsRoutesJson}
 const APP_SERVICE_BINDING = ${appServiceBindingJson}
 
@@ -937,32 +1016,26 @@ export default {
 		const url = new URL(request.url)
 		const isWebSocket = request.headers.get('Upgrade') === 'websocket'
 
-		// Check if this is a WebSocket request matching a DO route
 		if (isWebSocket) {
 			const matchedRoute = matchWsRoute(url.pathname)
 			if (matchedRoute) {
 				return handleDoWebSocket(request, env, url, matchedRoute)
 			}
-			// Otherwise handle as bridge RPC WebSocket
 			return handleBridgeWebSocket(request, env, ctx)
 		}
 
-		// HTTP endpoint for large file transfers
 		if (url.pathname.startsWith('/_devflare/transfer/')) {
 			return handleHttpTransfer(request, env, url)
 		}
 
-		// D1 migration endpoint
 		if (url.pathname === '/_devflare/migrate' && request.method === 'POST') {
 			return handleMigration(request, env)
 		}
 
-		// Email handler endpoint (simulates incoming email)
 		if (url.pathname === '/cdn-cgi/handler/email' && request.method === 'POST') {
 			return handleEmailIncoming(request, env, ctx, url)
 		}
 
-		// Health check
 		if (url.pathname === '/_devflare/health') {
 			return new Response(JSON.stringify({
 				ok: true,
@@ -982,7 +1055,6 @@ export default {
 	}
 }
 
-// Handle D1 migrations
 async function handleMigration(request, env) {
 	try {
 		const { bindingName, statements } = await request.json()
@@ -1009,28 +1081,26 @@ async function handleMigration(request, env) {
 				}
 			}
 		}
-		
-		// Verify table exists after migration
+
 		try {
 			const tables = await db.prepare("SELECT name FROM sqlite_master WHERE type='table'").all()
 			log('Tables after migration:', JSON.stringify(tables))
 		} catch (e) {
 			log('Error listing tables:', e.message)
 		}
-		
+
 		return Response.json({ success: true, results })
 	} catch (error) {
 		return Response.json({ error: error?.message || String(error) }, { status: 500 })
 	}
 }
 
-// Handle incoming email (simulates email() handler)
 async function handleEmailIncoming(request, env, ctx, url) {
 	try {
 		const from = url.searchParams.get('from') || 'unknown@example.com'
 		const to = url.searchParams.get('to') || 'worker@example.com'
 		const rawBody = await request.text()
-		
+
 		log('Email incoming:', { from, to, bodyLength: rawBody.length })
 
 		if (APP_SERVICE_BINDING) {
@@ -1052,7 +1122,7 @@ async function handleEmailIncoming(request, env, ctx, url) {
 				}
 			}
 		}
-		
+
 		return new Response(JSON.stringify({ ok: true, from, to }), {
 			headers: { 'Content-Type': 'application/json' }
 		})
@@ -1062,10 +1132,8 @@ async function handleEmailIncoming(request, env, ctx, url) {
 	}
 }
 
-// Match URL path against configured WS routes
 function matchWsRoute(pathname) {
 	for (const route of WS_ROUTES) {
-		// Simple exact match for now (could add glob/regex later)
 		if (pathname === route.pattern || pathname.startsWith(route.pattern + '?')) {
 			return route
 		}
@@ -1073,31 +1141,23 @@ function matchWsRoute(pathname) {
 	return null
 }
 
-// Handle WebSocket upgrade that should go to a Durable Object
 async function handleDoWebSocket(request, env, url, route) {
 	try {
-		// Get the DO namespace
 		const namespace = env[route.doNamespace]
 		if (!namespace) {
 			console.error('[Gateway] DO namespace not found:', route.doNamespace)
 			return new Response('DO namespace not found: ' + route.doNamespace, { status: 500 })
 		}
 
-		// Get the instance ID from query params
 		const idValue = url.searchParams.get(route.idParam) || 'default'
-
-		// Get or create DO instance
 		const doId = namespace.idFromName(idValue)
 		const stub = namespace.get(doId)
 
-		// Construct the forward URL for the DO
 		const forwardUrl = new URL(route.forwardPath, url.origin)
-		// Forward all query params
 		url.searchParams.forEach((v, k) => forwardUrl.searchParams.set(k, v))
 
 		log('Forwarding WebSocket to DO:', route.doNamespace, 'id:', idValue, 'path:', forwardUrl.pathname)
 
-		// Forward the request to the DO
 		return stub.fetch(forwardUrl.toString(), {
 			method: request.method,
 			headers: request.headers
@@ -1108,7 +1168,6 @@ async function handleDoWebSocket(request, env, url, route) {
 	}
 }
 
-// Handle bridge RPC WebSocket (for Node.js Vite server communication)
 function handleBridgeWebSocket(request, env, ctx) {
 	const { 0: client, 1: server } = new WebSocketPair()
 	server.accept()
@@ -1124,7 +1183,6 @@ function handleBridgeWebSocket(request, env, ctx) {
 	})
 
 	server.addEventListener('close', () => {
-		activeStreams.clear()
 		wsProxies.clear()
 	})
 
@@ -1155,180 +1213,11 @@ async function handleRpcCall(msg, ws, env, ctx) {
 		ws.send(JSON.stringify({
 			t: 'rpc.err',
 			id: msg.id,
-			error: { code: error.code || 'INTERNAL_ERROR', message: error.message }
+			error: { code: error?.code || 'INTERNAL_ERROR', message: error?.message || String(error) }
 		}))
 	}
 }
 
-async function executeRpcMethod(method, params, env, ctx) {
-	const parts = method.split('.')
-	const bindingName = parts[0]
-	const operation = parts.slice(1).join('.')
-	const binding = env[bindingName]
-	const RAW_EMAIL = 'EmailMessage::raw'
-
-	if (!binding) throw new Error('Binding not found: ' + bindingName)
-
-	// KV operations
-	if (operation === 'get') return binding.get(params[0], params[1])
-	if (operation === 'put') return binding.put(params[0], params[1], params[2])
-	if (operation === 'delete') return binding.delete(params[0])
-	if (operation === 'list') return binding.list(params[0])
-	if (operation === 'getWithMetadata') return binding.getWithMetadata(params[0], params[1])
-
-	// R2 operations
-	if (operation === 'head') return serializeR2Object(await binding.head(params[0]))
-	if (operation === 'r2.get') {
-		const obj = await binding.get(params[0], params[1])
-		if (!obj) return null
-		const body = await obj.arrayBuffer()
-		return serializeR2ObjectBody(obj, arrayBufferToBase64(body))
-	}
-	if (operation === 'r2.put') {
-		// Deserialize the value if it's a serialized ArrayBuffer/Uint8Array
-		let value = params[1]
-		if (value && typeof value === 'object') {
-			if (value.__type === 'ArrayBuffer') {
-				value = base64ToArrayBuffer(value.data)
-			} else if (value.__type === 'Uint8Array') {
-				value = base64ToArrayBuffer(value.data)
-			}
-		}
-		return serializeR2Object(await binding.put(params[0], value, params[2]))
-	}
-	if (operation === 'r2.delete') return binding.delete(params[0])
-	if (operation === 'r2.list') return serializeR2Objects(await binding.list(params[0]))
-
-	// D1 operations
-	if (operation === 'exec') return binding.exec(params[0])
-	if (operation.startsWith('stmt.')) {
-		log('D1 RPC:', bindingName, operation, 'sql:', String(params[0]).slice(0, 60))
-		const mode = operation.split('.')[1]
-		const [sql, ...rest] = params
-		
-		// For first/raw, the last element is the column/options parameter (may be undefined)
-		// For all/run, rest contains only bindings
-		let bindings = rest
-		let extraParam = undefined
-		
-		if (mode === 'first' || mode === 'raw') {
-			// Last element is the column/options (may be undefined)
-			extraParam = rest[rest.length - 1]
-			bindings = rest.slice(0, -1)
-		}
-		
-		let stmt = binding.prepare(sql)
-		if (bindings.length > 0) stmt = stmt.bind(...bindings)
-		
-		if (mode === 'first') {
-			// Only pass column if it's a non-empty string
-			if (typeof extraParam === 'string' && extraParam.length > 0) {
-				return stmt.first(extraParam)
-			}
-			return stmt.first()
-		}
-		if (mode === 'all') return stmt.all()
-		if (mode === 'run') return stmt.run()
-		if (mode === 'raw') return stmt.raw(extraParam)
-	}
-
-	// DO operations
-	if (operation === 'idFromName') {
-		const id = binding.idFromName(params[0])
-		return { __type: 'DOId', hex: id.toString() }
-	}
-	if (operation === 'idFromString') {
-		const id = binding.idFromString(params[0])
-		return { __type: 'DOId', hex: id.toString() }
-	}
-	if (operation === 'newUniqueId') {
-		const id = binding.newUniqueId(params[0])
-		return { __type: 'DOId', hex: id.toString() }
-	}
-	if (operation === 'stub.fetch') {
-		const [, serializedId, serializedReq] = params
-		log('stub.fetch request:', {
-			url: serializedReq.url,
-			method: serializedReq.method,
-			headers: serializedReq.headers,
-			hasBody: !!serializedReq.body
-		})
-		const id = binding.idFromString(serializedId.hex)
-		const stub = binding.get(id)
-		try {
-			const response = await stub.fetch(new Request(serializedReq.url, {
-				method: serializedReq.method,
-				headers: serializedReq.headers,
-				body: serializedReq.body?.type === 'bytes' ? base64ToArrayBuffer(serializedReq.body.data) : undefined
-			}))
-			// Clone to read body for logging if there's an error
-			const cloned = response.clone()
-			const serialized = await serializeResponse(response)
-			log('stub.fetch response:', {
-				status: serialized.status,
-				headers: serialized.headers,
-				bodyLength: serialized.body?.data?.length || 0
-			})
-			// If 500, log the body content
-			if (response.status >= 400) {
-				const errBody = await cloned.text()
-				log('Error response body:', errBody)
-			}
-			return serialized
-		} catch (err) {
-			console.error('[Gateway] stub.fetch error:', err)
-			throw err
-		}
-	}
-	if (operation === 'stub.rpc') {
-		const [, serializedId, methodName, args] = params
-		const id = binding.idFromString(serializedId.hex)
-		const stub = binding.get(id)
-		const response = await stub.fetch(new Request('http://do/_rpc', {
-			method: 'POST',
-			headers: { 'Content-Type': 'application/json' },
-			body: JSON.stringify({ method: methodName, params: args })
-		}))
-		const result = await response.json()
-		if (!result.ok) throw new Error(result.error?.message || 'RPC failed')
-		return result.result
-	}
-
-	// Queue operations
-	if (operation === 'send') return binding.send(params[0], params[1])
-	if (operation === 'sendBatch') return binding.sendBatch(params[0], params[1])
-
-	// Email send operations (send_email binding)
-	if (operation === 'email.send') {
-		const message = params[0]
-		log('Email send:', { from: message?.from, to: message?.to })
-		if (binding && typeof binding.send === 'function') {
-			if (message && typeof message === 'object' && 'from' in message && 'to' in message && 'raw' in message) {
-				return binding.send({
-					from: message.from,
-					to: message.to,
-					[RAW_EMAIL]: createEmailMessageRaw(message.raw)
-				})
-			}
-			return binding.send(message)
-		}
-		// Return success even if no real binding (simulated)
-		return { ok: true, simulated: true }
-	}
-
-	throw new Error('Unknown operation: ' + method)
-}
-
-function createEmailMessageRaw(raw) {
-	if (typeof raw === 'string' || raw instanceof ReadableStream) {
-		return raw
-	}
-	if (raw instanceof ArrayBuffer || raw instanceof Uint8Array) {
-		return new Response(raw).body
-	}
-	throw new Error('Unsupported EmailMessage raw payload')
-}
-
 async function handleWsOpen(msg, ws, env) {
 	try {
 		const binding = env[msg.target.binding]
@@ -1385,7 +1274,7 @@ async function handleHttpTransfer(request, env, url) {
 
 	if (request.method === 'PUT' || request.method === 'POST') {
 		const result = await bucket.put(key, request.body)
-		return new Response(JSON.stringify(result), { headers: { 'Content-Type': 'application/json' } })
+		return new Response(JSON.stringify(serializeR2Object(result)), { headers: { 'Content-Type': 'application/json' } })
 	}
 
 	if (request.method === 'GET') {
@@ -1401,70 +1290,6 @@ async function handleHttpTransfer(request, env, url) {
 
 	return new Response('Method not allowed', { status: 405 })
 }
-
-// Helpers
-function serializeR2Object(obj) {
-	if (!obj) return null
-	return {
-		__type: 'R2Object',
-		key: obj.key,
-		version: obj.version,
-		size: obj.size,
-		etag: obj.etag,
-		httpEtag: obj.httpEtag,
-		checksums: obj.checksums,
-		uploaded: obj.uploaded?.toISOString(),
-		httpMetadata: obj.httpMetadata,
-		customMetadata: obj.customMetadata,
-		range: obj.range,
-		storageClass: obj.storageClass
-	}
-}
-function serializeR2ObjectBody(obj, bodyData) {
-	if (!obj) return null
-	return {
-		__type: 'R2ObjectBody',
-		key: obj.key,
-		version: obj.version,
-		size: obj.size,
-		etag: obj.etag,
-		httpEtag: obj.httpEtag,
-		checksums: obj.checksums,
-		uploaded: obj.uploaded?.toISOString(),
-		httpMetadata: obj.httpMetadata,
-		customMetadata: obj.customMetadata,
-		range: obj.range,
-		storageClass: obj.storageClass,
-		bodyData
-	}
-}
-function serializeR2Objects(result) {
-	if (!result) return null
-	return { objects: result.objects.map(serializeR2Object), truncated: result.truncated, cursor: result.cursor }
-}
-async function serializeResponse(response) {
-	// Read body as bytes and encode as base64
-	let body = null
-	if (response.body) {
-		const bytes = await response.arrayBuffer()
-		if (bytes.byteLength > 0) {
-			body = { type: 'bytes', data: arrayBufferToBase64(bytes) }
-		}
-	}
-	return { status: response.status, statusText: response.statusText, headers: [...response.headers.entries()], body }
-}
-function arrayBufferToBase64(buffer) {
-	const bytes = new Uint8Array(buffer)
-	let binary = ''
-	for (let i = 0; i < bytes.byteLength; i++) binary += String.fromCharCode(bytes[i])
-	return btoa(binary)
-}
-function base64ToArrayBuffer(base64) {
-	const binary = atob(base64)
-	const bytes = new Uint8Array(binary.length)
-	for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i)
-	return bytes.buffer
-}
 `;
 }