devflare 1.0.0-next.5 → 1.0.0-next.50

package/package.json

@@ -1,116 +1,159 @@
-{
-	"name": "devflare",
-	"version": "1.0.0-next.5",
-	"description": "Devflare is a developer-first toolkit for Cloudflare Workers that sits on top of Miniflare and Wrangler-compatible config",
-	"type": "module",
-	"main": "./dist/index.js",
-	"types": "./dist/index.d.ts",
-	"exports": {
-		".": {
-			"types": "./dist/index.d.ts",
-			"import": "./dist/index.js",
-			"default": "./dist/index.js"
-		},
-		"./runtime": {
-			"types": "./dist/runtime/index.d.ts",
-			"import": "./dist/runtime/index.js",
-			"default": "./dist/runtime/index.js"
-		},
-		"./test": {
-			"types": "./dist/test/index.d.ts",
-			"import": "./dist/test/index.js",
-			"default": "./dist/test/index.js"
-		},
-		"./vite": {
-			"types": "./dist/vite/index.d.ts",
-			"import": "./dist/vite/index.js",
-			"default": "./dist/vite/index.js"
-		},
-		"./sveltekit": {
-			"types": "./dist/sveltekit/index.d.ts",
-			"import": "./dist/sveltekit/index.js",
-			"default": "./dist/sveltekit/index.js"
-		},
-		"./cloudflare": {
-			"types": "./dist/cloudflare/index.d.ts",
-			"import": "./dist/cloudflare/index.js",
-			"default": "./dist/cloudflare/index.js"
-		},
-		"./decorators": {
-			"types": "./dist/decorators/index.d.ts",
-			"import": "./dist/decorators/index.js",
-			"default": "./dist/decorators/index.js"
-		}
-	},
-	"bin": {
-		"devflare": "./bin/devflare.js"
-	},
-	"files": [
-		"dist",
-		"bin",
-		"LLM.md",
-		"R2.md"
-	],
-	"scripts": {
-		"prebuild": "node -e \"require('fs').rmSync('./dist', { recursive: true, force: true })\"",
-		"build": "bun build ./src/index.ts ./src/runtime/index.ts ./src/test/index.ts ./src/vite/index.ts ./src/sveltekit/index.ts ./src/cloudflare/index.ts ./src/decorators/index.ts --outdir ./dist --splitting --target node --packages=external && tsgo --declaration --emitDeclarationOnly --noEmit false --outDir ./dist",
-		"dev": "bun --watch ./src/cli/index.ts",
-		"test": "bun test",
-		"test:watch": "bun test --watch",
-		"typecheck": "tsgo --noEmit"
-	},
-	"dependencies": {
-		"@puppeteer/browsers": "^2.10.3",
-		"c12": "^2.0.1",
-		"chokidar": "^4.0.3",
-		"citty": "^0.1.6",
-		"consola": "^3.4.0",
-		"defu": "^6.1.4",
-		"es-module-lexer": "^1.6.0",
-		"execa": "^9.5.2",
-		"fast-glob": "^3.3.3",
-		"globby": "^16.1.0",
-		"jsonc-parser": "^3.3.1",
-		"magic-string": "^0.30.17",
-		"pathe": "^2.0.2",
-		"picomatch": "^4.0.3",
-		"puppeteer-core": "^24.5.0",
-		"rolldown": "^1.0.0-beta.59",
-		"ws": "^8.19.0",
-		"zod": "^3.24.1"
-	},
-	"devDependencies": {
-		"@cloudflare/vite-plugin": "^1.0.0",
-		"@cloudflare/workers-types": "^4.20250109.0",
-		"@types/bun": "^1.1.14",
-		"@types/picomatch": "^4.0.2",
-		"@types/ws": "^8.18.1",
-		"miniflare": "^3.20250109.0",
-		"typescript": "^5.7.2",
-		"vite": "^6.0.0"
-	},
-	"peerDependencies": {
-		"@cloudflare/vite-plugin": "^1.0.0",
-		"vite": "^6.0.0 || ^7.0.0 || ^8.0.0",
-		"wrangler": "^3.99.0"
-	},
-	"peerDependenciesMeta": {
-		"@cloudflare/vite-plugin": {
-			"optional": true
-		},
-		"vite": {
-			"optional": true
-		}
-	},
-	"keywords": [
-		"cloudflare",
-		"workers",
-		"wrangler",
-		"config",
-		"cli",
-		"durable-objects",
-		"middleware"
-	],
-	"author": "",
-	"license": "MIT"
-}
+{
+	"name": "devflare",
+	"version": "1.0.0-next.50",
+	"description": "Devflare is a developer-first toolkit for Cloudflare Workers that sits on top of Miniflare and Wrangler-compatible config",
+	"repository": {
+		"type": "git",
+		"url": "git+https://github.com/Refzlund/devflare.git",
+		"directory": "packages/devflare"
+	},
+	"homepage": "https://github.com/Refzlund/devflare#readme",
+	"bugs": {
+		"url": "https://github.com/Refzlund/devflare/issues"
+	},
+	"type": "module",
+	"sideEffects": false,
+	"main": "./dist/index.js",
+	"types": "./dist/index.d.ts",
+	"exports": {
+		".": {
+			"types": "./dist/index.d.ts",
+			"browser": "./dist/browser.js",
+			"import": "./dist/index.js",
+			"default": "./dist/index.js"
+		},
+		"./config": {
+			"types": "./dist/config-entry.d.ts",
+			"import": "./dist/config-entry.js",
+			"default": "./dist/config-entry.js"
+		},
+		"./runtime": {
+			"types": "./dist/runtime/index.d.ts",
+			"import": "./dist/runtime/index.js",
+			"default": "./dist/runtime/index.js"
+		},
+		"./test": {
+			"types": "./dist/test/index.d.ts",
+			"import": "./dist/test/index.js",
+			"default": "./dist/test/index.js"
+		},
+		"./vite": {
+			"types": "./dist/vite/index.d.ts",
+			"import": "./dist/vite/index.js",
+			"default": "./dist/vite/index.js"
+		},
+		"./sveltekit": {
+			"types": "./dist/sveltekit/index.d.ts",
+			"import": "./dist/sveltekit/index.js",
+			"default": "./dist/sveltekit/index.js"
+		},
+		"./cloudflare": {
+			"types": "./dist/cloudflare/index.d.ts",
+			"import": "./dist/cloudflare/index.js",
+			"default": "./dist/cloudflare/index.js"
+		},
+		"./decorators": {
+			"types": "./dist/decorators/index.d.ts",
+			"import": "./dist/decorators/index.js",
+			"default": "./dist/decorators/index.js"
+		},
+		"./internal/send-email": {
+			"types": "./dist/utils/send-email.d.ts",
+			"import": "./dist/utils/send-email.js",
+			"default": "./dist/utils/send-email.js"
+		},
+		"./package.json": "./package.json"
+	},
+	"bin": {
+		"devflare": "./bin/devflare.js"
+	},
+	"files": [
+		"dist",
+		"bin",
+		"LLM.md"
+	],
+	"scripts": {
+		"llm:generate": "bun ./scripts/generate-llm.ts",
+		"refresh-permission-groups": "bun ./scripts/refresh-permission-groups.ts",
+		"clean:dist": "bun ./scripts/clean-dist.ts",
+		"verify:dist": "bun ./scripts/verify-dist.ts",
+		"build": "bun run clean:dist && rolldown -c rolldown.config.ts && tsgo --declaration --emitDeclarationOnly --noEmit false --outDir ./dist && bun ./scripts/fix-dts-extensions.ts",
+		"dev": "bun --watch ./src/cli/index.ts",
+		"prepack": "bun run llm:generate",
+		"test": "bun run test:unit && bun run test:integration:control && bun run test:integration:bridge && bun run test:integration:test-context && bun run test:integration:dev-server && bun run test:integration:shims",
+		"test:unit": "bun test tests/unit",
+		"test:coverage": "bun test tests/unit --coverage",
+		"test:integration:control": "bun test tests/integration/cli tests/integration/examples tests/integration/package-entry tests/integration/vite",
+		"test:integration:bridge": "bun test tests/integration/bridge/bridge-proxy.test.ts --parallel=1 --max-concurrency=1 && bun test tests/integration/bridge/case18-do.test.ts --parallel=1 --max-concurrency=1 && bun test tests/integration/bridge/durable-object.test.ts --parallel=1 --max-concurrency=1 && bun test tests/integration/bridge/do-websocket.test.ts --parallel=1 --max-concurrency=1 && bun test tests/integration/bridge/miniflare.test.ts --parallel=1 --max-concurrency=1 && bun test tests/integration/bridge/r2-transfer.test.ts --parallel=1 --max-concurrency=1",
+		"test:integration:test-context": "bun test tests/integration/test-context --parallel=1 --max-concurrency=1",
+		"test:integration:dev-server": "bun test tests/integration/dev-server --parallel=1 --max-concurrency=1",
+		"test:integration:shims": "bun test tests/integration/shims --parallel=1 --max-concurrency=1",
+		"test:watch": "bun test --watch",
+		"typecheck": "tsgo --noEmit",
+		"types": "bun run typecheck",
+		"check": "bun run typecheck"
+	},
+	"dependencies": {
+		"@puppeteer/browsers": "^2.10.3",
+		"c12": "^2.0.1",
+		"chokidar": "^4.0.3",
+		"citty": "^0.1.6",
+		"consola": "^3.4.0",
+		"defu": "^6.1.4",
+		"es-module-lexer": "^1.6.0",
+		"execa": "^9.5.2",
+		"fast-glob": "^3.3.3",
+		"globby": "^16.1.0",
+		"jsonc-parser": "^3.3.1",
+		"magic-string": "^0.30.17",
+		"miniflare": "^4.20260424.0",
+		"pathe": "^2.0.2",
+		"picomatch": "^4.0.3",
+		"puppeteer-core": "^24.5.0",
+		"rolldown": "^1.0.0-rc.12",
+		"smol-toml": "^1.6.1",
+		"typescript": "^5.7.2",
+		"wrangler": "^4.85.0",
+		"ws": "^8.19.0",
+		"zod": "^3.25.0"
+	},
+	"devDependencies": {
+		"@cloudflare/vite-plugin": "^1.0.0",
+		"@cloudflare/workers-types": "^4.20260426.1",
+		"@types/bun": "^1.1.14",
+		"@types/picomatch": "^4.0.2",
+		"@types/ws": "^8.18.1",
+		"vite": "^6.0.0"
+	},
+	"peerDependencies": {
+		"@cloudflare/vite-plugin": "^1.0.0",
+		"@cloudflare/workers-types": "^4.20260426.1",
+		"vite": "^6.0.0 || ^7.0.0 || ^8.0.0"
+	},
+	"peerDependenciesMeta": {
+		"@cloudflare/vite-plugin": {
+			"optional": true
+		},
+		"@cloudflare/workers-types": {
+			"optional": true
+		},
+		"vite": {
+			"optional": true
+		}
+	},
+	"engines": {
+		"node": ">=20",
+		"bun": ">=1.1"
+	},
+	"keywords": [
+		"cloudflare",
+		"workers",
+		"wrangler",
+		"config",
+		"cli",
+		"durable-objects",
+		"middleware"
+	],
+	"author": "Arthur (Refzlund) <arthur@refzlund.com>",
+	"license": "MIT"
+}

package/R2.md

@@ -1,170 +0,0 @@
-# R2
-
-A short guide for handling uploads and file delivery with Cloudflare R2.
-
----
-
-## Quick rules
-
-- Use **presigned `PUT` URLs** for direct user uploads to R2
-- Use a **public bucket on a custom domain** for truly public assets
-- Use a **private bucket + Worker authorization** for authenticated/private assets
-- Use **Cloudflare Access** for teammate/org-only buckets
-- Use **WAF token auth / HMAC validation** or a **Worker** for expiring custom-domain media links
-- Do **not** use `r2.dev` for production delivery
-- If you protect a custom-domain bucket with Access or WAF, **disable `r2.dev`** or the bucket may still be reachable there
-
----
-
-## Uploads
-
-The usual safe upload flow is:
-
-1. frontend asks your app for upload permission
-2. your Worker/app authenticates the user and validates file type, size, and target key
-3. your backend returns a short-lived **presigned `PUT` URL**
-4. the browser uploads **directly to R2**
-5. your app stores the **object key + metadata**, not the presigned URL
-
-Good practice:
-
-- generate keys server-side, for example `users/<userId>/<uuid>.jpg`
-- restrict `Content-Type` when signing uploads
-- keep upload URLs short-lived
-- configure bucket **CORS** if the browser uploads directly
-
-Cloudflare docs:
-
-- [Presigned URLs](https://developers.cloudflare.com/r2/api/s3/presigned-urls/)
-- [Configure CORS](https://developers.cloudflare.com/r2/buckets/cors/)
-- [Storing user generated content](https://developers.cloudflare.com/reference-architecture/diagrams/storage/storing-user-generated-content/)
-
----
-
-## Viewing / serving files
-
-### Public files
-
-For public images, media, and assets:
-
-- use a **public bucket**
-- attach a **custom domain**
-- serve stable URLs from that domain
-- let Cloudflare cache them
-
-This is the best fit for avatars, product images, blog images, and other content that anyone may view.
-
-Cloudflare docs:
-
-- [Public buckets](https://developers.cloudflare.com/r2/buckets/public-buckets/)
-
-### Private or authenticated files
-
-For invoices, receipts, private user uploads, paid content, or tenant-scoped assets:
-
-- keep the bucket **private**
-- store only the object key in your database
-- serve through a **Worker** that checks session/JWT/permissions before reading from R2
-
-This is usually the best default when access depends on the current user.
-
-Cloudflare docs:
-
-- [Use R2 from Workers](https://developers.cloudflare.com/r2/api/workers/workers-api-usage/)
-
-### Time-limited direct access
-
-You can also mint a **presigned `GET` URL** for temporary direct viewing or download.
-
-Important caveat:
-
-- presigned URLs work on the **R2 S3 endpoint**
-- they **do not work with custom domains**
-- treat them as **bearer tokens**
-
-So they are good for short-lived direct access, but not for polished custom-domain media delivery.
-
-Cloudflare docs:
-
-- [Presigned URLs](https://developers.cloudflare.com/r2/api/s3/presigned-urls/)
-
-### Team-only / org-only files
-
-If access should be limited to employees or teammates, protect the R2 custom domain with **Cloudflare Access**.
-
-Cloudflare docs:
-
-- [Protect an R2 Bucket with Cloudflare Access](https://developers.cloudflare.com/r2/tutorials/cloudflare-access/)
-
-### Signed links on a custom domain
-
-If you want expiring links on `https://cdn.example.com/...`, R2 presigned URLs are not the right tool.
-
-Instead use:
-
-- a **Worker** that signs and verifies access tokens, or
-- **Cloudflare WAF token authentication / HMAC validation** on the custom domain
-
-Cloudflare docs:
-
-- [Configure token authentication](https://developers.cloudflare.com/waf/custom-rules/use-cases/configure-token-authentication/)
-- [HMAC validation function](https://developers.cloudflare.com/ruleset-engine/rules-language/functions/#hmac-validation)
-- [Workers request signing example](https://developers.cloudflare.com/workers/examples/signing-requests/)
-
----
-
-## Development vs production
-
-### Development
-
-By default, local Worker development uses **local simulated bindings**, including local R2-style storage.
-
-Use this for normal development.
-
-Only connect to real remote buckets when you intentionally need integration testing, and prefer **separate dev/staging buckets** instead of production buckets.
-
-Important remote-dev reality:
-
-- remote bindings touch **real data**
-- remote bindings incur **real costs**
-- avoid pointing local development at production uploads unless absolutely necessary
-
-Cloudflare docs:
-
-- [Workers development & testing](https://developers.cloudflare.com/workers/development-testing/)
-- [Remote bindings](https://developers.cloudflare.com/workers/development-testing/#remote-bindings)
-
-### Production
-
-For production:
-
-- use a **custom domain**, not `r2.dev`
-- choose public vs private intentionally per bucket or per content class
-- keep sensitive content private behind a Worker, Access, or token validation
-- configure **CORS** intentionally for browser upload/download flows
-- use separate **dev**, **staging**, and **prod** buckets
-
-Optional performance feature:
-
-- if users upload from many regions, consider **Local Uploads** for better upload performance
-
-Cloudflare docs:
-
-- [Public buckets](https://developers.cloudflare.com/r2/buckets/public-buckets/)
-- [Local uploads](https://developers.cloudflare.com/r2/buckets/local-uploads/)
-
----
-
-## Recommended defaults
-
-If you need a sane default architecture:
-
-- **public assets** → public bucket + custom domain
-- **user uploads** → presigned `PUT` upload + object key stored in DB
-- **private assets** → private bucket + Worker-gated reads
-- **internal assets** → custom domain + Cloudflare Access
-- **custom-domain expiring links** → Worker token auth or WAF HMAC validation
-
-If you only remember one rule, remember this:
-
-> Use **presigned URLs** for short-lived direct R2 access, but use a **Worker/custom domain auth layer** for polished private media delivery.