devflare 1.0.0-next.59 → 1.0.0-next.60

package/dist/_chunks/{build-IR-IaQN1.js → build-Dp8k2SWa.js}

@@ -1,5 +1,5 @@
 import { a as cyanBold, f as logLine, o as dim, r as createCliTheme } from "./ui-BUoZApvE.js";
-import { t as prepareBuildArtifacts } from "./build-artifacts-C7JfIRnw.js";
+import { t as prepareBuildArtifacts } from "./build-artifacts-DLEYfdVL.js";
 //#region src/cli/commands/build.ts
 async function runBuildCommand(parsed, logger, options) {
 	const theme = createCliTheme(parsed.options);

package/dist/_chunks/{build-artifacts-C7JfIRnw.js → build-artifacts-DLEYfdVL.js}

@@ -1,10 +1,10 @@
 import { d as resolveConfigEnvVars } from "./preview-C3Cdr8an.js";
 import { r as loadConfig, u as resolveConfigForEnvironment } from "./loader-E_UGyTrJ.js";
-import { c as writeWranglerConfig, i as isolateViteBuildOutputPaths$1, o as rebaseWranglerConfigPaths, t as compileBuildConfig } from "./compiler-okj8qvCh.js";
+import { c as writeWranglerConfig, i as isolateViteBuildOutputPaths$1, o as rebaseWranglerConfigPaths, t as compileBuildConfig } from "./compiler-CgIFPfRA.js";
 import { f as logLine } from "./ui-BUoZApvE.js";
 import { n as getPackageVersion } from "./package-metadata-DjHBLB-z.js";
 import { t as resolvePackageSpecifier } from "./resolve-package-qizBfCIm.js";
-import { i as writeGeneratedViteConfig, l as prepareComposedWorkerEntrypoint, n as resolveEffectiveViteProject } from "./vite-De7bGxC6.js";
+import { i as writeGeneratedViteConfig, l as prepareComposedWorkerEntrypoint, n as resolveEffectiveViteProject } from "./vite-CtvgOi1c.js";
 import { t as bundleWorkerEntry } from "./worker-bundler-dTTnYU3n.js";
 import { t as detectViteProject } from "./vite-utils-OVLMV605.js";
 import { t as getDependencies } from "./dependencies-C2oxFjU_.js";

package/dist/_chunks/{cli-yOO5yCaf.js → cli-BlVetiEh.js}

@@ -1101,15 +1101,15 @@ async function runInit(parsed, logger, options) {
 	return runInitCommand(parsed, logger, options);
 }
 async function runDev(parsed, logger, options) {
-	const { runDevCommand } = await import("./dev-BgQl56Bd.js");
+	const { runDevCommand } = await import("./dev-DRP6LR2H.js");
 	return runDevCommand(parsed, logger, options);
 }
 async function runBuild(parsed, logger, options) {
-	const { runBuildCommand } = await import("./build-IR-IaQN1.js");
+	const { runBuildCommand } = await import("./build-Dp8k2SWa.js");
 	return runBuildCommand(parsed, logger, options);
 }
 async function runDeploy(parsed, logger, options) {
-	const { runDeployCommand } = await import("./deploy-BG2PHaWu.js");
+	const { runDeployCommand } = await import("./deploy-Blrdr3Gv.js");
 	return runDeployCommand(parsed, logger, {
 		...options,
 		requireExplicitDeployTarget: true
@@ -1124,7 +1124,7 @@ async function runDoctor(parsed, logger, options) {
 	return runDoctorCommand(parsed, logger, options);
 }
 async function runConfig(parsed, logger, options) {
-	const { runConfigCommand } = await import("./config-C8Qux0NR.js");
+	const { runConfigCommand } = await import("./config-BwRb2_vD.js");
 	return runConfigCommand(parsed, logger, options);
 }
 async function runAccount(parsed, logger, options) {
@@ -1136,7 +1136,7 @@ async function runLogin(parsed, logger, options) {
 	return runLoginCommand(parsed, logger, options);
 }
 async function runPreviews(parsed, logger, options) {
-	const { runPreviewsCommand } = await import("./previews-fTFp1WkQ.js");
+	const { runPreviewsCommand } = await import("./previews-D-GPVCeq.js");
 	return runPreviewsCommand(parsed, logger, options);
 }
 async function runProductions(parsed, logger, options) {

package/dist/_chunks/{compiler-okj8qvCh.js → compiler-CgIFPfRA.js}

@@ -458,7 +458,11 @@ function compileConfigInternal(config, environment, options = {}) {
 		...consumer.environment && { environment: consumer.environment }
 	});
 	if (mergedConfig.streamingTailConsumers && mergedConfig.streamingTailConsumers.length > 0) result.streaming_tail_consumers = mergedConfig.streamingTailConsumers.map((consumer) => typeof consumer === "string" ? { service: consumer } : { service: consumer.service });
-	if (mergedConfig.vars && Object.keys(mergedConfig.vars).length > 0) result.vars = mergedConfig.vars;
+	const r2BucketsVar = buildR2BucketsVar(mergedConfig.bindings?.r2);
+	if (mergedConfig.vars && Object.keys(mergedConfig.vars).length > 0 || r2BucketsVar) result.vars = {
+		...r2BucketsVar && { DEVFLARE_R2_BUCKETS: r2BucketsVar },
+		...mergedConfig.vars
+	};
 	const secrets = toWranglerSecretsConfig(mergedConfig.secrets);
 	if (secrets) result.secrets = secrets;
 	if (mergedConfig.routes && mergedConfig.routes.length > 0) result.routes = mergedConfig.routes.map((route) => ({
@@ -485,6 +489,24 @@ function compileConfigInternal(config, environment, options = {}) {
 	return result;
 }
 /**
+* Build the JSON value of the injected `DEVFLARE_R2_BUCKETS` var: a mapping
+* of R2 binding name → `{ bucketName, jurisdiction? }` that `presignR2Put`/
+* `presignR2Get` read at runtime to presign against the right bucket without
+* the app hardcoding bucket names. Returns `undefined` when the config has
+* no R2 bindings.
+*/
+function buildR2BucketsVar(r2Bindings) {
+	if (!r2Bindings || Object.keys(r2Bindings).length === 0) return;
+	const mapping = Object.fromEntries(Object.entries(r2Bindings).map(([bindingName, bindingConfig]) => {
+		const normalized = normalizeR2Binding(bindingConfig);
+		return [bindingName, {
+			bucketName: normalized.bucketName,
+			...normalized.jurisdiction && { jurisdiction: normalized.jurisdiction }
+		}];
+	}));
+	return JSON.stringify(mapping);
+}
+/**
 * Compile DevflareConfig to programmatic config for @cloudflare/vite-plugin.
 * This is used instead of wrangler.jsonc in dev mode.
 *

package/dist/_chunks/{config-C8Qux0NR.js → config-BwRb2_vD.js}

@@ -1,6 +1,6 @@
 import { d as resolveConfigEnvVars } from "./preview-C3Cdr8an.js";
 import { a as ConfigResourceResolutionError, o as loadResolvedConfig, r as loadConfig, s as resolveResources } from "./loader-E_UGyTrJ.js";
-import { n as compileConfig, t as compileBuildConfig } from "./compiler-okj8qvCh.js";
+import { n as compileConfig, t as compileBuildConfig } from "./compiler-CgIFPfRA.js";
 //#region src/cli/commands/config.ts
 function isSupportedFormat(value) {
 	return value === "devflare" || value === "wrangler";

package/dist/_chunks/{deploy-BG2PHaWu.js → deploy-Blrdr3Gv.js}

@@ -1,13 +1,13 @@
 import { a as resolvePreviewIdentifier, d as resolveConfigEnvVars } from "./preview-C3Cdr8an.js";
 import { c as prepareConfigResourcesForDeploy, r as loadConfig, u as resolveConfigForEnvironment } from "./loader-E_UGyTrJ.js";
-import { a as readWranglerConfig, c as writeWranglerConfig, n as compileConfig, o as rebaseWranglerConfigPaths, s as stringifyConfig, t as compileBuildConfig } from "./compiler-okj8qvCh.js";
+import { a as readWranglerConfig, c as writeWranglerConfig, n as compileConfig, o as rebaseWranglerConfigPaths, s as stringifyConfig, t as compileBuildConfig } from "./compiler-CgIFPfRA.js";
 import { d as getPrimaryAccount, n as getEffectiveAccountId } from "./preferences-BKp_7XJx.js";
 import { D as listWorkerVersions, E as listWorkerDeployments, O as listWorkers, T as getWorkersSubdomain, c as reconcilePreviewRegistry, w as getWorkerVersionDetail, x as formatWorkersDevUrl } from "./preview-registry-ClAbLTHH.js";
 import { _ as yellowBold, d as green, f as logLine, g as yellow, o as dim, r as createCliTheme } from "./ui-BUoZApvE.js";
 import { n as getPackageVersion } from "./package-metadata-DjHBLB-z.js";
 import { t as resolvePackageSpecifier } from "./resolve-package-qizBfCIm.js";
 import { t as asOptionalString } from "./command-utils-CSnoFdxM.js";
-import { a as createBuildManifest, i as compareManifests, n as applyDeploymentStrategy, o as formatDriftWarning, r as describeDeploymentStrategy, s as readBuildManifest, t as prepareBuildArtifacts } from "./build-artifacts-C7JfIRnw.js";
+import { a as createBuildManifest, i as compareManifests, n as applyDeploymentStrategy, o as formatDriftWarning, r as describeDeploymentStrategy, s as readBuildManifest, t as prepareBuildArtifacts } from "./build-artifacts-DLEYfdVL.js";
 import { t as getDependencies } from "./dependencies-C2oxFjU_.js";
 import { n as preparePreviewScopedResourcesForDeploy } from "./preview-resources-D_aFwtZR.js";
 import { mkdir, open, readFile, rm, writeFile } from "node:fs/promises";

package/dist/_chunks/{dev-BgQl56Bd.js → dev-DRP6LR2H.js}

@@ -7,9 +7,9 @@ import { clearLocalSendEmailBindings, setLocalSendEmailBindings } from "../utils
 import { C as buildSendEmailConfig, D as buildVersionMetadataConfig, E as buildTailConsumersConfig, O as buildWorkerLoadersConfig, S as buildSecretsStoreConfig, T as buildStreamingTailConsumersConfig, _ as buildMtlsCertificatesConfig, b as buildQueueProducers, c as buildAiSearchInstancesConfig, d as buildArtifactsConfig, f as buildDispatchNamespacesConfig, g as buildMediaConfig, h as buildImagesConfig, k as buildWorkflowsConfig, l as buildAiSearchNamespacesConfig, m as buildHyperdrivesConfig, n as getRouteDirectoryCandidate, p as buildFlagshipConfig, s as resolveServiceBindings, t as discoverRoutes, u as buildAnalyticsEngineConfig, v as buildPipelinesConfig, w as buildStreamConfig, x as buildRateLimitsConfig, y as buildQueueConsumers } from "./routes-BMU7ga_l.js";
 import { r as transformDurableObject } from "./durable-object-DMtH0XYX.js";
 import { i as findFiles } from "./glob-CmQOvunB.js";
-import { d as DEFAULT_FETCH_ENTRY_FILES, f as DEFAULT_QUEUE_ENTRY_FILES, g as discoverDurableObjectFiles, h as resolveWorkerSurfacePaths, i as writeGeneratedViteConfig, l as prepareComposedWorkerEntrypoint, m as hasWorkerSurfacePaths, n as resolveEffectiveViteProject, p as DEFAULT_SCHEDULED_ENTRY_FILES, u as DEFAULT_EMAIL_ENTRY_FILES } from "./vite-De7bGxC6.js";
+import { d as DEFAULT_FETCH_ENTRY_FILES, f as DEFAULT_QUEUE_ENTRY_FILES, g as discoverDurableObjectFiles, h as resolveWorkerSurfacePaths, i as writeGeneratedViteConfig, l as prepareComposedWorkerEntrypoint, m as hasWorkerSurfacePaths, n as resolveEffectiveViteProject, p as DEFAULT_SCHEDULED_ENTRY_FILES, u as DEFAULT_EMAIL_ENTRY_FILES } from "./vite-CtvgOi1c.js";
 import { a as createWorkerdBundlerDefaults, i as writeWorkerCompatibleBundle, n as ensureDebugShim, r as resolveWorkerCompatibleRolldownConfig, t as bundleWorkerEntry } from "./worker-bundler-dTTnYU3n.js";
-import { t as bundleWorkflowEntrypointScript } from "./local-workflow-entrypoints-ZIL7apIa.js";
+import { n as bundleWorkflowEntrypointScript, t as R2_PRESIGN_RUNTIME_JS } from "./r2-presign-runtime-zTOLS0Ea.js";
 import { n as buildLocalSecretWrappedBindingConfig } from "./local-secrets-6sMstHXw.js";
 import { t as buildLocalBindingShimServiceConfig } from "./local-media-bindings-DsAW4AMF.js";
 import { i as waitForViteReady, n as resolveViteMode, r as stopSpawnedProcessTree, t as detectViteProject } from "./vite-utils-OVLMV605.js";
@@ -1592,7 +1592,8 @@ async function handleDevToolsWebSocket(request, url) {
 * All in-sandbox RPC behavior (method dispatch, error envelope, serialization,
 * WebSocket bridge, HTTP transfer) lives in `GATEWAY_RUNTIME_JS` and is shared
 * with `src/bridge/miniflare.ts`. The canonical TypeScript equivalent lives in
-* `src/bridge/server.ts`.
+* `src/bridge/server.ts`. The local presigned-R2 endpoint handler is shared
+* via `R2_PRESIGN_RUNTIME_JS` (`src/bridge/r2-presign-runtime.ts`).
 *
 * This file only owns the pieces that are genuinely dev-server-specific:
 *   - WebSocket route matching & DO WebSocket forwarding (`WS_ROUTES`)
@@ -1608,6 +1609,8 @@ function getGatewayScript(wsRoutes = [], debug = false, appServiceBindingName =
 	return `
 ${GATEWAY_RUNTIME_JS}
 
+${R2_PRESIGN_RUNTIME_JS}
+
 // Bridge Gateway Worker — Dev Server
 // Dev-server-specific overlay on top of the shared GATEWAY_RUNTIME_JS:
 // WS route DO forwarding, D1 migration, email ingest, app-worker fallthrough.
@@ -1635,6 +1638,11 @@ export default {
 			return handleHttpTransfer(request, env, url)
 		}
 
+		const presignResponse = await __devflareR2PresignHandle(request, env, url)
+		if (presignResponse) {
+			return presignResponse
+		}
+
 		if (url.pathname === '/_devflare/migrate' && request.method === 'POST') {
 			return handleMigration(request, env)
 		}
@@ -1909,7 +1917,10 @@ function makeMiniflareWorker(context, options) {
 	const { cwd, loadedConfig, bindings, sendEmailConfig, rateLimitsConfig, versionMetadataConfig, workerLoadersConfig, mtlsCertificatesConfig, dispatchNamespacesConfig, workflowsConfig, pipelinesConfig, hyperdrivesConfig, imagesConfig, mediaConfig, streamConfig, flagshipConfig, analyticsEngineConfig, tailConsumersConfig, streamingTailConsumersConfig, artifactsConfig, aiSearchNamespacesConfig, aiSearchInstancesConfig, secretsStoreConfig, localSecretWrappedBindingConfig, queueProducers } = context;
 	const baseFlags = loadedConfig.compatibilityFlags ?? [];
 	const compatFlags = baseFlags.includes("nodejs_compat") ? baseFlags : [...baseFlags, "nodejs_compat"];
-	const workerBindings = loadedConfig.vars ?? {};
+	const workerBindings = {
+		...loadedConfig.vars ?? {},
+		...context.injectedVars ?? {}
+	};
 	const localWrappedBindings = { ...localSecretWrappedBindingConfig?.wrappedBindings ?? {} };
 	const workerConfig = {
 		name: options.name,
@@ -1995,6 +2006,16 @@ function collectWorkerWatchRoots(cwd, config, mainWorkerSurfacePaths) {
 //#region src/dev-server/miniflare-dev-config.ts
 const INTERNAL_APP_SERVICE_BINDING = "__DEVFLARE_APP";
 /**
+* Resolve the browser-facing origin of the local dev runtime, used inside
+* locally-presigned R2 URLs. Honors `server.publicUrl` (reverse proxy /
+* tunnel setups); otherwise derives `http(s)://<host>:<port>` from the
+* Miniflare listen address, normalizing wildcard hosts to `localhost`.
+*/
+function resolveR2PresignOrigin(serverConfig, miniflareHost, miniflarePort) {
+	if (serverConfig?.publicUrl) return serverConfig.publicUrl.replace(/\/$/, "");
+	return `${serverConfig?.https ? "https" : "http"}://${miniflareHost === "0.0.0.0" || miniflareHost === "::" ? "localhost" : miniflareHost}:${miniflarePort}`;
+}
+/**
 * Build the complete Miniflare configuration for the dev server.
 *
 * IMPORTANT: When using multi-worker setup, ALL workers must go in the
@@ -2003,7 +2024,7 @@ const INTERNAL_APP_SERVICE_BINDING = "__DEVFLARE_APP";
 * workers array is present.
 */
 function buildMiniflareDevConfig(input) {
-	const { config: loadedConfig, cwd, miniflarePort, miniflareHost = "127.0.0.1", persist, enableVite, debug, mainWorkerSurfacePaths, mainWorkerRoutes, mainWorkerScriptPath, bundledMainWorkerScriptPath, workflowEntrypointScript, browserShimPort, doResult, serviceBindingResolution, logger } = input;
+	const { config: loadedConfig, cwd, miniflarePort, miniflareHost = "127.0.0.1", persist, enableVite, debug, mainWorkerSurfacePaths, mainWorkerRoutes, mainWorkerScriptPath, bundledMainWorkerScriptPath, workflowEntrypointScript, browserShimPort, doResult, serviceBindingResolution, r2PresignSecret, logger } = input;
 	const bindings = loadedConfig.bindings ?? {};
 	const persistPath = resolve(cwd, ".devflare/data");
 	const appWorkerName = loadedConfig.name;
@@ -2086,7 +2107,11 @@ function buildMiniflareDevConfig(input) {
 		aiSearchInstancesConfig,
 		secretsStoreConfig: buildSecretsStoreConfig(bindings, loadedConfig.secretsStoreId, localSecretBindingNames),
 		localSecretWrappedBindingConfig,
-		queueProducers
+		queueProducers,
+		injectedVars: bindings.r2 && r2PresignSecret ? {
+			DEVFLARE_R2_PRESIGN_SECRET: r2PresignSecret,
+			DEVFLARE_R2_PRESIGN_ORIGIN: resolveR2PresignOrigin(serverConfig, miniflareHost, miniflarePort)
+		} : void 0
 	};
 	const createWorkerConfig = (options) => makeMiniflareWorker(workerContext, options);
 	const gatewayWorker = createWorkerConfig({
@@ -2902,7 +2927,7 @@ async function resolveViteIntegration(options) {
 * Start the Vite dev server process.
 */
 async function startViteProcess(options) {
-	const { cwd, configPath, vitePort, miniflarePort, generatedViteConfigPath, logger } = options;
+	const { cwd, configPath, vitePort, miniflarePort, generatedViteConfigPath, r2Presign, logger } = options;
 	const args = [
 		"vite",
 		"dev",
@@ -2923,6 +2948,10 @@ async function startViteProcess(options) {
 			DEVFLARE_DEV: "true",
 			DEVFLARE_BRIDGE_PORT: String(miniflarePort),
 			...configPath ? { DEVFLARE_CONFIG_PATH: configPath } : {},
+			...r2Presign ? {
+				DEVFLARE_R2_PRESIGN_SECRET: r2Presign.secret,
+				DEVFLARE_R2_PRESIGN_ORIGIN: r2Presign.origin
+			} : {},
 			FORCE_COLOR: "1"
 		}
 	});
@@ -3050,6 +3079,7 @@ async function applyWatcherTargetDiff(watcher, currentTargets, nextTargets) {
 function createDevServer(options) {
 	const { cwd, configPath, vitePort = 5173, miniflarePort = 8787, miniflareHost = "127.0.0.1", enableVite: enableViteRequested = true, persist = true, logger, verbose = false, debug = process.env.DEVFLARE_DEBUG === "true" } = options;
 	const state = createDevServerState({ enableVite: enableViteRequested });
+	const r2PresignSecret = `${crypto.randomUUID()}${crypto.randomUUID()}`;
 	const reloadQueue = createReloadQueue({
 		reload: async () => {
 			if (!state.miniflare) return;
@@ -3098,6 +3128,7 @@ function createDevServer(options) {
 			browserShimPort: state.browserShimPort,
 			doResult,
 			serviceBindingResolution: state.serviceBindingResolution,
+			r2PresignSecret,
 			logger
 		});
 	}
@@ -3269,6 +3300,10 @@ function createDevServer(options) {
 			vitePort,
 			miniflarePort,
 			generatedViteConfigPath: state.generatedViteConfigPath,
+			r2Presign: state.config.bindings?.r2 ? {
+				secret: r2PresignSecret,
+				origin: resolveR2PresignOrigin(state.config.server, miniflareHost, miniflarePort)
+			} : null,
 			logger
 		});
 		else logger?.info("Vite startup skipped (no effective Vite config found for this package)");

package/dist/_chunks/{previews-fTFp1WkQ.js → previews-D-GPVCeq.js}

@@ -1,6 +1,6 @@
 import { a as resolvePreviewIdentifier } from "./preview-C3Cdr8an.js";
 import { i as resolveConfigPath, o as loadResolvedConfig, r as loadConfig, t as ConfigNotFoundError } from "./loader-E_UGyTrJ.js";
-import { t as compileBuildConfig } from "./compiler-okj8qvCh.js";
+import { t as compileBuildConfig } from "./compiler-CgIFPfRA.js";
 import { t as account } from "./cloudflare-BaloqI3H.js";
 import { _ as yellowBold, a as cyanBold, d as green, f as logLine, g as yellow, h as whiteDim, m as red, n as bold, o as dim, r as createCliTheme, u as formatTableLine } from "./ui-BUoZApvE.js";
 import { i as resolveNamedSelection, r as resolveCloudflareAccountId, t as asOptionalString } from "./command-utils-CSnoFdxM.js";

package/dist/_chunks/r2-presign-runtime-zTOLS0Ea.js

@@ -0,0 +1,291 @@
+import { x as normalizeWorkflowBinding } from "./schema-normalization-Zgm4W6O6.js";
+import { i as findFiles, r as DEFAULT_WORKFLOW_PATTERN } from "./glob-CmQOvunB.js";
+import { t as bundleWorkerEntry } from "./worker-bundler-dTTnYU3n.js";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { join, relative, resolve } from "pathe";
+//#region src/workflows/local-workflow-entrypoints.ts
+function findExportedClasses(code) {
+	const classes = [];
+	const classPattern = /export\s+class\s+(\w+)/g;
+	let match = classPattern.exec(code);
+	while (match !== null) {
+		classes.push(match[1]);
+		match = classPattern.exec(code);
+	}
+	return classes;
+}
+function toImportSpecifier(fromDir, filePath) {
+	const relativePath = relative(fromDir, filePath).replace(/\\/g, "/");
+	return relativePath.startsWith(".") ? relativePath : `./${relativePath}`;
+}
+async function discoverWorkflowClasses(config, configDir) {
+	const classToFilePath = /* @__PURE__ */ new Map();
+	const workflowPatternConfig = config.files?.workflows;
+	const workflowPattern = typeof workflowPatternConfig === "string" ? workflowPatternConfig : DEFAULT_WORKFLOW_PATTERN;
+	if (workflowPatternConfig === false) return classToFilePath;
+	const files = await findFiles(workflowPattern, { cwd: configDir });
+	for (const filePath of files) try {
+		const code = await readFile(filePath, "utf-8");
+		for (const className of findExportedClasses(code)) classToFilePath.set(className, filePath);
+	} catch {}
+	return classToFilePath;
+}
+async function resolveLocalWorkflowEntrypoints(config, configDir) {
+	const workflows = config.bindings?.workflows;
+	if (!workflows || Object.keys(workflows).length === 0) return [];
+	const classToFilePath = await discoverWorkflowClasses(config, configDir);
+	const entrypoints = [];
+	for (const [bindingName, binding] of Object.entries(workflows)) {
+		const normalized = normalizeWorkflowBinding(binding);
+		if (normalized.scriptName) continue;
+		const scriptPath = classToFilePath.get(normalized.className);
+		if (!scriptPath) throw new Error(`Workflow binding ${bindingName} (className: '${normalized.className}') not found.\nEither set files.workflows to match the workflow source file, or set scriptName when the workflow lives in another worker.`);
+		entrypoints.push({
+			bindingName,
+			className: normalized.className,
+			scriptPath
+		});
+	}
+	return entrypoints;
+}
+function buildWorkflowVirtualEntry(entrypoints, entryDir) {
+	const imports = entrypoints.map((entrypoint, index) => {
+		const importName = `__DevflareWorkflow${index}`;
+		const importPath = toImportSpecifier(entryDir, entrypoint.scriptPath);
+		return {
+			importName,
+			className: entrypoint.className,
+			line: `import { ${entrypoint.className} as ${importName} } from '${importPath}'`
+		};
+	});
+	const exports = imports.map((entrypoint) => {
+		return `export { ${entrypoint.importName} as ${entrypoint.className} }`;
+	});
+	return [
+		...imports.map((entrypoint) => entrypoint.line),
+		"",
+		...exports
+	].join("\n");
+}
+async function bundleWorkflowEntrypointScript(config, configDir, options = {}) {
+	const entrypoints = await resolveLocalWorkflowEntrypoints(config, configDir);
+	if (entrypoints.length === 0) return "";
+	const entryDir = resolve(configDir, ".devflare", "workflow-entrypoints");
+	const entryPath = join(entryDir, "__entry.ts");
+	const outFile = join(entryDir, "index.js");
+	await mkdir(entryDir, { recursive: true });
+	await writeFile(entryPath, buildWorkflowVirtualEntry(entrypoints, entryDir));
+	await bundleWorkerEntry({
+		cwd: configDir,
+		inputFile: entryPath,
+		outFile,
+		rolldownOptions: config.rolldown?.options,
+		sourcemap: config.rolldown?.sourcemap,
+		minify: config.rolldown?.minify,
+		logger: options.logger
+	});
+	return await readFile(outFile, "utf-8");
+}
+//#endregion
+//#region src/bridge/r2-presign-runtime.ts
+/**
+* Inline JS defining `__devflareR2PresignHandle(request, env, url)`, which
+* returns a `Response` when the request targets the local presign endpoint
+* and `null` otherwise. Enforces signature, expiry, method, content type and
+* size against the per-boot secret in `env.DEVFLARE_R2_PRESIGN_SECRET`, then
+* executes the object operation on the local R2 binding.
+*/
+const R2_PRESIGN_RUNTIME_JS = `
+const __devflareR2PresignPrefix = '/_devflare/r2/presigned/'
+
+const __devflareR2PresignCors = {
+	'Access-Control-Allow-Origin': '*',
+	'Access-Control-Allow-Methods': 'GET, HEAD, PUT, OPTIONS',
+	'Access-Control-Allow-Headers': 'Content-Type',
+	'Access-Control-Expose-Headers': 'ETag, Content-Type, Content-Length'
+}
+
+function __devflareR2PresignError(status, code, message) {
+	return new Response(JSON.stringify({ error: { code, message } }), {
+		status,
+		headers: { 'Content-Type': 'application/json', ...__devflareR2PresignCors }
+	})
+}
+
+async function __devflareR2PresignHmacHex(secret, message) {
+	const encoder = new TextEncoder()
+	const key = await crypto.subtle.importKey(
+		'raw',
+		encoder.encode(secret),
+		{ name: 'HMAC', hash: 'SHA-256' },
+		false,
+		['sign']
+	)
+	const signature = await crypto.subtle.sign('HMAC', key, encoder.encode(message))
+	return [...new Uint8Array(signature)].map((b) => b.toString(16).padStart(2, '0')).join('')
+}
+
+// Constant-time hex comparison (uses workerd's timingSafeEqual when present).
+function __devflareR2PresignEqual(expectedHex, actualHex) {
+	if (typeof actualHex !== 'string' || actualHex.length !== expectedHex.length) return false
+	const encoder = new TextEncoder()
+	const expected = encoder.encode(expectedHex)
+	const actual = encoder.encode(actualHex)
+	const subtle = crypto.subtle
+	if (subtle && typeof subtle.timingSafeEqual === 'function') {
+		return subtle.timingSafeEqual(expected, actual)
+	}
+	let diff = 0
+	for (let i = 0; i < expected.length; i++) diff |= expected[i] ^ actual[i]
+	return diff === 0
+}
+
+// MUST match buildLocalCanonicalString in src/runtime/r2-presign.ts.
+function __devflareR2PresignCanonical(method, binding, key, expires, contentType, contentLength, maxSize) {
+	return [
+		'devflare:r2-presign:v1',
+		method,
+		binding,
+		key,
+		expires,
+		contentType || '',
+		contentLength || '',
+		maxSize || ''
+	].join('\\n')
+}
+
+/**
+ * Handle a request to the local presigned R2 endpoint; returns null when the
+ * path does not match so gateways can fall through to their other routes.
+ */
+async function __devflareR2PresignHandle(request, env, url) {
+	if (!url.pathname.startsWith(__devflareR2PresignPrefix)) return null
+
+	if (request.method === 'OPTIONS') {
+		return new Response(null, {
+			status: 204,
+			headers: { ...__devflareR2PresignCors, 'Access-Control-Max-Age': '86400' }
+		})
+	}
+
+	const rest = url.pathname.slice(__devflareR2PresignPrefix.length)
+	const slashIndex = rest.indexOf('/')
+	if (slashIndex <= 0 || slashIndex === rest.length - 1) {
+		return __devflareR2PresignError(400, 'bad_request', 'Expected /_devflare/r2/presigned/<binding>/<key>.')
+	}
+	const binding = decodeURIComponent(rest.slice(0, slashIndex))
+	const key = rest
+		.slice(slashIndex + 1)
+		.split('/')
+		.map((segment) => decodeURIComponent(segment))
+		.join('/')
+
+	const secret = env.DEVFLARE_R2_PRESIGN_SECRET
+	if (typeof secret !== 'string' || secret.length === 0) {
+		return __devflareR2PresignError(
+			500,
+			'presign_unconfigured',
+			'DEVFLARE_R2_PRESIGN_SECRET is not configured on the devflare gateway. '
+				+ 'This endpoint is only served for configs with R2 bindings.'
+		)
+	}
+
+	const params = url.searchParams
+	const signedMethod = params.get('X-Devflare-Method')
+	const expires = params.get('X-Devflare-Expires')
+	const providedSignature = params.get('X-Devflare-Signature')
+	const signedContentType = params.get('X-Devflare-Content-Type')
+	const signedContentLength = params.get('X-Devflare-Content-Length')
+	const signedMaxSize = params.get('X-Devflare-Max-Size')
+
+	if (!signedMethod || !expires || !providedSignature) {
+		return __devflareR2PresignError(403, 'missing_parameters', 'Missing presign query parameters.')
+	}
+
+	const expectedSignature = await __devflareR2PresignHmacHex(
+		secret,
+		__devflareR2PresignCanonical(
+			signedMethod, binding, key, expires, signedContentType, signedContentLength, signedMaxSize
+		)
+	)
+	if (!__devflareR2PresignEqual(expectedSignature, providedSignature)) {
+		return __devflareR2PresignError(403, 'invalid_signature', 'Presigned URL signature mismatch.')
+	}
+
+	if (Math.floor(Date.now() / 1000) > Number(expires)) {
+		return __devflareR2PresignError(403, 'expired', 'Presigned URL has expired.')
+	}
+
+	const methodAllowed = signedMethod === 'GET'
+		? request.method === 'GET' || request.method === 'HEAD'
+		: request.method === signedMethod
+	if (!methodAllowed) {
+		return __devflareR2PresignError(
+			403,
+			'method_mismatch',
+			'URL was presigned for ' + signedMethod + ', got ' + request.method + '.'
+		)
+	}
+
+	const bucket = env[binding]
+	if (!bucket || typeof bucket.put !== 'function' || typeof bucket.head !== 'function') {
+		return __devflareR2PresignError(404, 'unknown_binding', 'R2 binding not found: ' + binding)
+	}
+
+	if (request.method === 'PUT') {
+		const sentContentType = request.headers.get('Content-Type')
+		if (signedContentType !== null && sentContentType !== signedContentType) {
+			return __devflareR2PresignError(
+				403,
+				'content_type_mismatch',
+				'URL was presigned for Content-Type "' + signedContentType + '", got "' + sentContentType + '".'
+			)
+		}
+
+		const body = await request.arrayBuffer()
+		if (signedContentLength !== null && body.byteLength !== Number(signedContentLength)) {
+			return __devflareR2PresignError(
+				403,
+				'content_length_mismatch',
+				'URL was presigned for exactly ' + signedContentLength + ' bytes, got ' + body.byteLength + '.'
+			)
+		}
+		if (signedMaxSize !== null && body.byteLength > Number(signedMaxSize)) {
+			return __devflareR2PresignError(
+				413,
+				'too_large',
+				'Body of ' + body.byteLength + ' bytes exceeds the presigned maximum of ' + signedMaxSize + '.'
+			)
+		}
+
+		const putContentType = sentContentType || signedContentType || undefined
+		const result = await bucket.put(key, body, {
+			...(putContentType && { httpMetadata: { contentType: putContentType } })
+		})
+		return new Response(null, {
+			status: 200,
+			headers: { ...__devflareR2PresignCors, ...(result?.httpEtag && { ETag: result.httpEtag }) }
+		})
+	}
+
+	// GET / HEAD
+	const objectHeaders = (object) => ({
+		...__devflareR2PresignCors,
+		'Content-Type': object.httpMetadata?.contentType || 'application/octet-stream',
+		'Content-Length': String(object.size),
+		...(object.httpEtag && { ETag: object.httpEtag })
+	})
+
+	if (request.method === 'HEAD') {
+		const object = await bucket.head(key)
+		if (!object) return __devflareR2PresignError(404, 'not_found', 'Object not found: ' + key)
+		return new Response(null, { status: 200, headers: objectHeaders(object) })
+	}
+
+	const object = await bucket.get(key)
+	if (!object) return __devflareR2PresignError(404, 'not_found', 'Object not found: ' + key)
+	return new Response(object.body, { status: 200, headers: objectHeaders(object) })
+}
+`;
+//#endregion
+export { bundleWorkflowEntrypointScript as n, R2_PRESIGN_RUNTIME_JS as t };