devflare 1.0.0-next.59 → 1.0.0-next.60

package/dist/_chunks/{runtime-DL-Nz3k8.js → runtime-RekfD_2X.js}

@@ -1,4 +1,5 @@
 import { D as createFetchEvent, b as createContextProxy, n as getContextOrNull, v as runWithEventContext } from "./context-CX50Y2Kb.js";
+import { AwsV4Signer } from "aws4fetch";
 //#region src/runtime/exports.ts
 /**
 * Creates a readonly proxy that throws on mutation attempts. Thin wrapper
@@ -547,4 +548,327 @@ function createRouteResolve(routes, initialEvent) {
 	};
 }
 //#endregion
-export { ctx as _, assertExplicitQueueHandlerStyle as a, locals as b, defineFetchHandler as c, invokeFetchHandler as d, invokeFetchModule as f, sequence as g, resolveFetchHandler as h, assertExplicit2ArgStyle as i, defineQueueHandler as l, markWorkerStyle as m, invokeRouteModules as n, assertExplicitScheduledHandlerStyle as o, markResolveStyle as p, matchFetchRoute as r, createResolveFetch as s, createRouteResolve as t, defineScheduledHandler as u, env as v, vars as x, event as y };
+//#region src/runtime/r2-presign.ts
+/** URL path prefix of the local presign endpoint served by devflare gateways. */
+const R2_PRESIGN_LOCAL_PATH_PREFIX = "/_devflare/r2/presigned/";
+/** Version tag prepended to the local canonical string (breaks old URLs on format changes). */
+const LOCAL_CANONICAL_VERSION = "devflare:r2-presign:v1";
+/** Env/var names devflare injects in local dev + tests to enable local presigning. */
+const R2_PRESIGN_SECRET_VAR = "DEVFLARE_R2_PRESIGN_SECRET";
+const R2_PRESIGN_ORIGIN_VAR = "DEVFLARE_R2_PRESIGN_ORIGIN";
+/** Var (injected at deploy compile time) mapping R2 binding names to bucket metadata. */
+const R2_BUCKETS_VAR = "DEVFLARE_R2_BUCKETS";
+/** Default env/secret names for R2 S3 API credentials in production. */
+const R2_ACCOUNT_ID_VAR = "R2_ACCOUNT_ID";
+const R2_ACCESS_KEY_ID_VAR = "R2_ACCESS_KEY_ID";
+const R2_SECRET_ACCESS_KEY_VAR = "R2_SECRET_ACCESS_KEY";
+/** Maximum expiry accepted by S3-style presigned URLs (7 days, in seconds). */
+const MAX_EXPIRES_IN_SECONDS = 10080 * 60;
+/** Default presigned URL lifetime (15 minutes, in seconds). */
+const DEFAULT_EXPIRES_IN_SECONDS = 900;
+/**
+* Read a string value by name from the platform `env`, falling back to
+* `process.env`. Handles dev-mode env proxies gracefully: any non-string
+* (e.g. a bridge binding proxy) is treated as absent.
+*/
+function readEnvString(env, name) {
+	let own;
+	try {
+		own = env?.[name];
+	} catch {
+		own = void 0;
+	}
+	if (typeof own === "string" && own.length > 0) return own;
+	const fromProcess = (globalThis.process?.env)?.[name];
+	return typeof fromProcess === "string" && fromProcess.length > 0 ? fromProcess : void 0;
+}
+/**
+* Resolve the local presign context (origin + secret) injected by devflare in
+* dev/test. Returns `null` outside devflare-managed local environments.
+*/
+function resolveLocalContext(env) {
+	const secret = readEnvString(env, R2_PRESIGN_SECRET_VAR);
+	const origin = readEnvString(env, R2_PRESIGN_ORIGIN_VAR);
+	if (!secret || !origin) return null;
+	return {
+		origin: origin.replace(/\/$/, ""),
+		secret
+	};
+}
+/**
+* Parse the injected `DEVFLARE_R2_BUCKETS` mapping from `env`. Accepts either
+* a JSON string var or an already-parsed object (wrangler JSON vars).
+*/
+function readBucketsVar(env) {
+	let raw;
+	try {
+		raw = env?.[R2_BUCKETS_VAR];
+	} catch {
+		return null;
+	}
+	if (raw === void 0 || raw === null) raw = (globalThis.process?.env)?.[R2_BUCKETS_VAR];
+	if (typeof raw === "string") try {
+		raw = JSON.parse(raw);
+	} catch {
+		return null;
+	}
+	if (!raw || typeof raw !== "object") return null;
+	const entries = {};
+	for (const [binding, value] of Object.entries(raw)) {
+		if (!value || typeof value !== "object") continue;
+		const bucketName = value.bucketName;
+		if (typeof bucketName !== "string" || bucketName.length === 0) continue;
+		const jurisdiction = value.jurisdiction;
+		entries[binding] = {
+			bucketName,
+			...typeof jurisdiction === "string" && jurisdiction.length > 0 && { jurisdiction }
+		};
+	}
+	return entries;
+}
+/**
+* Validate the binding/key/options tuple shared by PUT and GET presigning.
+* Returns the effective expiry in seconds.
+*
+* @throws {RangeError} on out-of-range `expiresIn`, `contentLength` or `maxSizeBytes`.
+* @throws {TypeError} on an empty binding or key.
+*/
+function validateCommonInputs(binding, key, options) {
+	if (typeof binding !== "string" || binding.length === 0) throw new TypeError("[devflare] presignR2*: `binding` must be a non-empty R2 binding name.");
+	if (typeof key !== "string" || key.length === 0) throw new TypeError("[devflare] presignR2*: `key` must be a non-empty object key.");
+	if (key.startsWith("/")) throw new TypeError("[devflare] presignR2*: `key` must not start with \"/\".");
+	const controlChars = /[\u0000-\u001f\u007f]/;
+	if (controlChars.test(key) || controlChars.test(binding)) throw new TypeError("[devflare] presignR2*: `binding`/`key` must not contain control characters.");
+	const expiresIn = options.expiresIn ?? DEFAULT_EXPIRES_IN_SECONDS;
+	if (!Number.isInteger(expiresIn) || expiresIn < 1 || expiresIn > MAX_EXPIRES_IN_SECONDS) throw new RangeError(`[devflare] presignR2*: \`expiresIn\` must be an integer between 1 and ${MAX_EXPIRES_IN_SECONDS} seconds (got ${expiresIn}).`);
+	if (options.contentLength !== void 0) {
+		if (!Number.isInteger(options.contentLength) || options.contentLength < 0) throw new RangeError("[devflare] presignR2Put: `contentLength` must be a non-negative integer byte count.");
+	}
+	if (options.maxSizeBytes !== void 0) {
+		if (!Number.isInteger(options.maxSizeBytes) || options.maxSizeBytes < 1) throw new RangeError("[devflare] presignR2Put: `maxSizeBytes` must be a positive integer byte count.");
+	}
+	if (options.contentLength !== void 0 && options.maxSizeBytes !== void 0 && options.contentLength > options.maxSizeBytes) throw new RangeError(`[devflare] presignR2Put: \`contentLength\` (${options.contentLength}) exceeds \`maxSizeBytes\` (${options.maxSizeBytes}).`);
+	return expiresIn;
+}
+/**
+* Percent-encode an object key for use in a URL path, RFC 3986-strict
+* (S3 canonical-URI compatible), preserving `/` as the segment separator.
+*/
+function encodeKeyPath(key) {
+	return key.split("/").map((segment) => encodeURIComponent(segment).replace(/[!'()*]/g, (char) => `%${char.charCodeAt(0).toString(16).toUpperCase()}`)).join("/");
+}
+/** Compute a lowercase hex HMAC-SHA256 of `message` with `secret` via WebCrypto. */
+async function hmacSha256Hex(secret, message) {
+	const encoder = new TextEncoder();
+	const cryptoKey = await crypto.subtle.importKey("raw", encoder.encode(secret), {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["sign"]);
+	const signature = await crypto.subtle.sign("HMAC", cryptoKey, encoder.encode(message));
+	return [...new Uint8Array(signature)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+/**
+* Build the canonical string covered by the local signature. MUST match
+* `buildCanonicalString` in `src/bridge/r2-presign-runtime.ts` byte-for-byte.
+*/
+function buildLocalCanonicalString(input) {
+	return [
+		LOCAL_CANONICAL_VERSION,
+		input.method,
+		input.binding,
+		input.key,
+		String(input.expires),
+		input.contentType ?? "",
+		input.contentLength !== void 0 ? String(input.contentLength) : "",
+		input.maxSizeBytes !== void 0 ? String(input.maxSizeBytes) : ""
+	].join("\n");
+}
+/** Mint a signed URL against the devflare gateway's local presign endpoint. */
+async function presignLocal(input) {
+	const expires = Math.floor(Date.now() / 1e3) + input.expiresIn;
+	const signature = await hmacSha256Hex(input.secret, buildLocalCanonicalString({
+		method: input.method,
+		binding: input.binding,
+		key: input.key,
+		expires,
+		contentType: input.contentType,
+		contentLength: input.contentLength,
+		maxSizeBytes: input.maxSizeBytes
+	}));
+	const url = new URL(`${input.origin}${R2_PRESIGN_LOCAL_PATH_PREFIX}${encodeURIComponent(input.binding)}/${encodeKeyPath(input.key)}`);
+	url.searchParams.set("X-Devflare-Method", input.method);
+	url.searchParams.set("X-Devflare-Expires", String(expires));
+	if (input.contentType !== void 0) url.searchParams.set("X-Devflare-Content-Type", input.contentType);
+	if (input.contentLength !== void 0) url.searchParams.set("X-Devflare-Content-Length", String(input.contentLength));
+	if (input.maxSizeBytes !== void 0) url.searchParams.set("X-Devflare-Max-Size", String(input.maxSizeBytes));
+	url.searchParams.set("X-Devflare-Signature", signature);
+	return {
+		url: url.toString(),
+		method: input.method,
+		headers: input.contentType !== void 0 ? { "content-type": input.contentType } : {},
+		expiresAt: /* @__PURE__ */ new Date(expires * 1e3),
+		key: input.key,
+		mode: "local"
+	};
+}
+/**
+* Resolve production credentials from options or env.
+*
+* @throws {Error} naming exactly which credential values are missing.
+*/
+function resolveCredentials(env, options) {
+	if (options.credentials) return options.credentials;
+	const accountId = readEnvString(env, R2_ACCOUNT_ID_VAR);
+	const accessKeyId = readEnvString(env, R2_ACCESS_KEY_ID_VAR);
+	const secretAccessKey = readEnvString(env, R2_SECRET_ACCESS_KEY_VAR);
+	if (accountId && accessKeyId && secretAccessKey) return {
+		accountId,
+		accessKeyId,
+		secretAccessKey
+	};
+	const missing = [
+		!accountId && "R2_ACCOUNT_ID",
+		!accessKeyId && "R2_ACCESS_KEY_ID",
+		!secretAccessKey && "R2_SECRET_ACCESS_KEY"
+	].filter(Boolean);
+	throw new Error(`[devflare] presignR2*: missing R2 S3 credentials (${missing.join(", ")}). Provide them as Worker secrets (\`wrangler secret put <NAME>\`) or pass \`options.credentials\`. Create R2 S3 credentials under Cloudflare Dashboard → R2 → Manage R2 API Tokens. In devflare local dev no credentials are needed — this error usually means the code runs in production without the secrets set.`);
+}
+/**
+* Resolve the production bucket for a binding from options or the injected
+* `DEVFLARE_R2_BUCKETS` mapping.
+*
+* @throws {Error} when the bucket cannot be resolved.
+*/
+function resolveBucket(env, binding, options) {
+	if (options.bucketName) return {
+		bucketName: options.bucketName,
+		...options.jurisdiction && { jurisdiction: options.jurisdiction }
+	};
+	const entry = readBucketsVar(env)?.[binding];
+	if (entry) return {
+		bucketName: entry.bucketName,
+		...(options.jurisdiction ?? entry.jurisdiction) && { jurisdiction: options.jurisdiction ?? entry.jurisdiction }
+	};
+	throw new Error(`[devflare] presignR2*: cannot resolve the bucket name for binding '${binding}'. Deploy through devflare (which injects the ${R2_BUCKETS_VAR} var from \`bindings.r2\`) or pass \`options.bucketName\` explicitly.`);
+}
+/** Mint a real S3 SigV4 presigned URL against the R2 S3 endpoint. */
+async function presignRemote(input) {
+	const jurisdictionHost = input.bucket.jurisdiction ? `.${input.bucket.jurisdiction}` : "";
+	const endpoint = new URL(`https://${input.credentials.accountId}${jurisdictionHost}.r2.cloudflarestorage.com/${input.bucket.bucketName}/${encodeKeyPath(input.key)}`);
+	endpoint.searchParams.set("X-Amz-Expires", String(input.expiresIn));
+	const signedHeaders = {};
+	if (input.contentType !== void 0) signedHeaders["content-type"] = input.contentType;
+	if (input.contentLength !== void 0) signedHeaders["content-length"] = String(input.contentLength);
+	return {
+		url: (await new AwsV4Signer({
+			url: endpoint.toString(),
+			method: input.method,
+			accessKeyId: input.credentials.accessKeyId,
+			secretAccessKey: input.credentials.secretAccessKey,
+			region: "auto",
+			service: "s3",
+			signQuery: true,
+			allHeaders: true,
+			headers: signedHeaders
+		}).sign()).url.toString(),
+		method: input.method,
+		headers: input.contentType !== void 0 ? { "content-type": input.contentType } : {},
+		expiresAt: new Date(Date.now() + input.expiresIn * 1e3),
+		key: input.key,
+		mode: "remote"
+	};
+}
+/**
+* Presign a direct-to-R2 `PUT` URL for a browser (or any HTTP client) upload.
+*
+* Resolves to a real R2 S3 presigned URL in production and to a signed
+* devflare-gateway URL in local dev and the test harness — same call, same
+* guarantees (signature, expiry, method, content type, size), so upload and
+* quota logic can be exercised identically in every environment.
+*
+* @param env - The platform env (`platform.env` in SvelteKit, `env` in a
+* Worker handler). Used to detect the local dev context and to read
+* production credentials/bucket mapping.
+* @param binding - The R2 binding name from `bindings.r2` (e.g. `'BUCKET'`).
+* @param key - Object key to upload to. Percent-encoding is handled internally.
+* @param options - Expiry, enforcement (content type / length / max size) and
+* production credential overrides.
+* @returns The presigned request: `url` to PUT to, `headers` the client must
+* send, and `expiresAt`.
+* @throws {Error} in production when credentials or the bucket mapping are missing.
+* @throws {TypeError | RangeError} on invalid inputs.
+*
+* @example
+* ```ts
+* // Server (SvelteKit endpoint) — reserve quota first, then presign:
+* const { url, headers } = await presignR2Put(platform.env, 'BUCKET', `media/${id}.png`, {
+*   expiresIn: 600,
+*   contentType: file.type,
+*   contentLength: file.size
+* })
+*
+* // Browser — upload directly to storage:
+* await fetch(url, { method: 'PUT', body: file, headers })
+*
+* // Server — finalize: confirm the object before committing quota:
+* const head = await platform.env.BUCKET.head(`media/${id}.png`)
+* ```
+*/
+async function presignR2Put(env, binding, key, options = {}) {
+	const expiresIn = validateCommonInputs(binding, key, options);
+	const local = resolveLocalContext(env);
+	if (local) return presignLocal({
+		...local,
+		method: "PUT",
+		binding,
+		key,
+		expiresIn,
+		contentType: options.contentType,
+		contentLength: options.contentLength,
+		maxSizeBytes: options.maxSizeBytes
+	});
+	return presignRemote({
+		credentials: resolveCredentials(env, options),
+		bucket: resolveBucket(env, binding, options),
+		method: "PUT",
+		key,
+		expiresIn,
+		contentType: options.contentType,
+		contentLength: options.contentLength
+	});
+}
+/**
+* Presign a direct-from-R2 `GET` URL (also valid for `HEAD`) so a browser can
+* download an object without routing the bytes through the Worker.
+*
+* Same dev/prod symmetry as {@link presignR2Put}. Note that browser reads
+* from real R2 additionally require CORS rules on the bucket itself.
+*
+* @param env - The platform env (see {@link presignR2Put}).
+* @param binding - The R2 binding name from `bindings.r2`.
+* @param key - Object key to read.
+* @param options - Expiry and production credential overrides.
+* @returns The presigned request; `headers` is always empty for GET.
+* @throws {Error} in production when credentials or the bucket mapping are missing.
+* @throws {TypeError | RangeError} on invalid inputs.
+*/
+async function presignR2Get(env, binding, key, options = {}) {
+	const expiresIn = validateCommonInputs(binding, key, options);
+	const local = resolveLocalContext(env);
+	if (local) return presignLocal({
+		...local,
+		method: "GET",
+		binding,
+		key,
+		expiresIn
+	});
+	return presignRemote({
+		credentials: resolveCredentials(env, options),
+		bucket: resolveBucket(env, binding, options),
+		method: "GET",
+		key,
+		expiresIn
+	});
+}
+//#endregion
+export { vars as C, locals as S, resolveFetchHandler as _, matchFetchRoute as a, env as b, assertExplicitScheduledHandlerStyle as c, defineQueueHandler as d, defineScheduledHandler as f, markWorkerStyle as g, markResolveStyle as h, invokeRouteModules as i, createResolveFetch as l, invokeFetchModule as m, presignR2Put as n, assertExplicit2ArgStyle as o, invokeFetchHandler as p, createRouteResolve as r, assertExplicitQueueHandlerStyle as s, presignR2Get as t, defineFetchHandler as u, sequence as v, event as x, ctx as y };

package/dist/_chunks/{vite-De7bGxC6.js → vite-CtvgOi1c.js}

@@ -1,8 +1,8 @@
 import { d as resolveConfigEnvVars } from "./preview-C3Cdr8an.js";
 import { i as resolveConfigPath, o as loadResolvedConfig, r as loadConfig, s as resolveResources, u as resolveConfigForEnvironment } from "./loader-E_UGyTrJ.js";
 import { o as normalizeDOBinding } from "./schema-normalization-Zgm4W6O6.js";
-import { c as writeWranglerConfig, i as isolateViteBuildOutputPaths, n as compileConfig, o as rebaseWranglerConfigPaths, r as compileToProgrammaticConfig, t as compileBuildConfig } from "./compiler-okj8qvCh.js";
-import { h as resolveFetchHandler, i as assertExplicit2ArgStyle } from "./runtime-DL-Nz3k8.js";
+import { c as writeWranglerConfig, i as isolateViteBuildOutputPaths, n as compileConfig, o as rebaseWranglerConfigPaths, r as compileToProgrammaticConfig, t as compileBuildConfig } from "./compiler-CgIFPfRA.js";
+import { _ as resolveFetchHandler, o as assertExplicit2ArgStyle } from "./runtime-RekfD_2X.js";
 import { s as resolveServiceBindings, t as discoverRoutes } from "./routes-BMU7ga_l.js";
 import { n as findDurableObjectClasses } from "./durable-object-DMtH0XYX.js";
 import { r as SUPPORTED_WORKER_EXTENSIONS } from "./worker-entrypoint-CQW77lG8.js";

package/dist/bridge/miniflare-gateway.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Local presign context for a running Miniflare instance: the HTTP origin the
+ * gateway listens on plus the per-boot HMAC secret it validates presigned R2
+ * URLs with. Feed these to `presignR2Put`/`presignR2Get` (as
+ * `DEVFLARE_R2_PRESIGN_ORIGIN`/`DEVFLARE_R2_PRESIGN_SECRET` env values) to
+ * mint URLs this instance accepts.
+ */
+export interface R2PresignContext {
+    /** Gateway HTTP origin, e.g. `http://127.0.0.1:8787`. */
+    origin: string;
+    /** Per-boot HMAC signing secret shared with the gateway worker. */
+    secret: string;
+}
+/** Binding-map shapes accepted by Miniflare options (array or name → id record). */
+type NamedBindings = string[] | Record<string, string> | undefined;
+/** Whether a Miniflare binding map actually declares at least one binding. */
+export declare function hasNamedBindings(bindings: NamedBindings): boolean;
+/**
+ * Generates a lightweight HTTP-only gateway worker script for
+ * `startMiniflare()` usage (tests, scripts, programmatic access).
+ *
+ * The RPC dispatch logic is shared with `dev-server/gateway-script.ts` via
+ * `GATEWAY_RUNTIME_JS`, and the local presigned-R2 endpoint via
+ * `R2_PRESIGN_RUNTIME_JS`. This gateway exposes the dispatcher over a plain
+ * HTTP endpoint (`POST /_devflare/rpc`). The full WebSocket bridge with
+ * streaming and WebSocket proxying lives in `./server.ts` / the dev-server
+ * gateway.
+ */
+export declare function generateGatewayScript(): string;
+/**
+ * Ensure a per-boot R2 presign secret is present in the worker bindings when
+ * R2 buckets are configured, so the embedded gateway endpoint can validate
+ * presigned URLs. Respects a caller-provided secret; returns a `null` context
+ * (and the options untouched) when the instance has no R2 buckets.
+ */
+export declare function resolveR2PresignSetup<TOptions extends {
+    r2Buckets?: NamedBindings;
+    port?: number;
+    bindings?: Record<string, unknown>;
+}>(options: TOptions): {
+    options: TOptions;
+    r2Presign: R2PresignContext | null;
+};
+export {};
+//# sourceMappingURL=miniflare-gateway.d.ts.map

package/dist/bridge/miniflare-gateway.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"miniflare-gateway.d.ts","sourceRoot":"","sources":["../../src/bridge/miniflare-gateway.ts"],"names":[],"mappings":"AAWA;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAChC,yDAAyD;IACzD,MAAM,EAAE,MAAM,CAAA;IACd,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAA;CACd;AAED,oFAAoF;AACpF,KAAK,aAAa,GAAG,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAA;AAElE,8EAA8E;AAC9E,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,aAAa,GAAG,OAAO,CAUjE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,CA2C9C;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACpC,QAAQ,SAAS;IAChB,SAAS,CAAC,EAAE,aAAa,CAAA;IACzB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAClC,EACA,OAAO,EAAE,QAAQ,GAAG;IAAE,OAAO,EAAE,QAAQ,CAAC;IAAC,SAAS,EAAE,gBAAgB,GAAG,IAAI,CAAA;CAAE,CAuB9E"}

package/dist/bridge/miniflare.d.ts

@@ -1,9 +1,16 @@
 import type { Miniflare as MiniflareType } from 'miniflare';
 import { type DevflareConfig } from '../config/index.js';
 import { type LocalSecretWrappedBindingConfig } from '../secrets/local-secrets.js';
+import { type R2PresignContext } from './miniflare-gateway.js';
+export type { R2PresignContext } from './miniflare-gateway.js';
 export interface MiniflareInstance {
     /** Ready promise - resolves when Miniflare is ready */
     ready: Promise<void>;
+    /**
+     * Local R2 presign context. Present when the instance was started with R2
+     * buckets; `null` otherwise.
+     */
+    r2Presign: R2PresignContext | null;
     /** Dispose the Miniflare instance */
     dispose(): Promise<void>;
     /** Get bindings directly from Miniflare */
@@ -133,7 +140,7 @@ export interface MiniflareOptions {
     /** Compatibility flags */
     compatibilityFlags?: string[];
 }
-export declare function createMiniflareInstanceHandle(mf: MiniflareType, primaryWorkerName?: string, nodeBindingOverrides?: Record<string, unknown>): MiniflareInstance;
+export declare function createMiniflareInstanceHandle(mf: MiniflareType, primaryWorkerName?: string, nodeBindingOverrides?: Record<string, unknown>, r2Presign?: R2PresignContext | null): MiniflareInstance;
 /**
  * Start a Miniflare instance with the given configuration
  */

package/dist/bridge/miniflare.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"miniflare.d.ts","sourceRoot":"","sources":["../../src/bridge/miniflare.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,WAAW,CAAA;AAC3D,OAAO,EACN,KAAK,cAAc,EAcnB,MAAM,WAAW,CAAA;AAOlB,OAAO,EACN,KAAK,+BAA+B,EAGpC,MAAM,0BAA0B,CAAA;AAQjC,MAAM,WAAW,iBAAiB;IACjC,uDAAuD;IACvD,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;IACpB,qCAAqC;IACrC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IACxB,2CAA2C;IAC3C,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IAC/C,kDAAkD;IAClD,cAAc,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAA;IAC/C,+CAA+C;IAC/C,WAAW,EAAE,aAAa,CAAC,aAAa,CAAC,CAAA;IACzC,iDAAiD;IACjD,aAAa,EAAE,aAAa,CAAC,eAAe,CAAC,CAAA;IAC7C,qDAAqD;IACrD,yBAAyB,EAAE,aAAa,CAAC,2BAA2B,CAAC,CAAA;IACrE,2CAA2C;IAC3C,aAAa,EAAE,aAAa,CAAC,eAAe,CAAC,CAAA;IAC7C,wCAAwC;IACxC,GAAG,EAAE,aAAa,CAAA;CAClB;AAED,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAOxE;AAED,MAAM,WAAW,gBAAgB;IAChC,8CAA8C;IAC9C,MAAM,CAAC,EAAE,cAAc,CAAA;IACvB,2CAA2C;IAC3C,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,2BAA2B;IAC3B,OAAO,CAAC,EAAE,OAAO,GAAG,MAAM,CAAA;IAC1B,gDAAgD;IAChD,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,6BAA6B;IAC7B,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,yCAAyC;IACzC,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC3E,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChD,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC7C,yEAAyE;IACzE,WAAW,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/C,qBAAqB;IACrB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,6BAA6B;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,EAAE,GAAG,EAAE,CAAA;SAAE,CAAA;KAAE,CAAC,CAAA;IAC3E,oCAAoC;IACpC,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,6BAA6B;IAC7B,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAA;IACrD,gCAAgC;IAChC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;IAC/E,kCAAkC;IAClC,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC1D,wBAAwB;IACxB,SAAS,CAAC,EAAE,MAAM,CACjB,MAAM,EACN;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAC5E,CAAA;IACD,wBAAwB;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACzD,qBAAqB;IACrB,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;IAC5B,oCAAoC;IACpC,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;IAC3B,wCAAwC;IACxC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACrD,+DAA+D;IAC/D,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,mFAAmF;IACnF,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAA;IACjC,yBAAyB;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACjD,6BAA6B;IAC7B,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACxE,0BAA0B;IAC1B,SAAS,CAAC,EAAE,MAAM,CACjB,MAAM,EACN;QACC,kBAAkB,CAAC,EAAE,MAAM,CAAA;QAC3B,2BAA2B,CAAC,EAAE,MAAM,EAAE,CAAA;QACtC,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAA;QACjC,MAAM,CAAC,EAAE,OAAO,CAAA;KAChB,CACD,CAAA;IACD,4BAA4B;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAClC,uBAAuB;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACvE,mEAAmE;IACnE,eAAe,CAAC,EAAE,+BAA+B,CAAC,iBAAiB,CAAC,CAAA;IACpE,2DAA2D;IAC3D,gBAAgB,CAAC,EAAE,+BAA+B,CAAC,SAAS,CAAC,CAAA;IAC7D,kEAAkE;IAClE,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC9C,+EAA+E;IAC/E,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,kEAAkE;IAClE,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,wEAAwE;IACxE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,yBAAyB;IACzB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,0BAA0B;IAC1B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAA;CAC7B;AAigBD,wBAAgB,6BAA6B,CAC5C,EAAE,EAAE,aAAa,EACjB,iBAAiB,CAAC,EAAE,MAAM,EAC1B,oBAAoB,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAChD,iBAAiB,CAqCnB;AAMD;;GAEG;AACH,wBAAsB,cAAc,CAAC,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAW/F;AAMD;;GAEG;AACH,wBAAsB,wBAAwB,CAC7C,MAAM,EAAE,cAAc,EACtB,OAAO,GAAE,OAAO,CAAC,gBAAgB,CAAM,GACrC,OAAO,CAAC,iBAAiB,CAAC,CAmO5B;AAQD;;GAEG;AACH,wBAAsB,YAAY,CAAC,OAAO,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAKzF;AAED;;GAEG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAKnD"}
+{"version":3,"file":"miniflare.d.ts","sourceRoot":"","sources":["../../src/bridge/miniflare.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,WAAW,CAAA;AAC3D,OAAO,EACN,KAAK,cAAc,EAcnB,MAAM,WAAW,CAAA;AAOlB,OAAO,EACN,KAAK,+BAA+B,EAGpC,MAAM,0BAA0B,CAAA;AAEjC,OAAO,EACN,KAAK,gBAAgB,EAIrB,MAAM,qBAAqB,CAAA;AAE5B,YAAY,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAM3D,MAAM,WAAW,iBAAiB;IACjC,uDAAuD;IACvD,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;IACpB;;;OAGG;IACH,SAAS,EAAE,gBAAgB,GAAG,IAAI,CAAA;IAClC,qCAAqC;IACrC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IACxB,2CAA2C;IAC3C,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IAC/C,kDAAkD;IAClD,cAAc,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAA;IAC/C,+CAA+C;IAC/C,WAAW,EAAE,aAAa,CAAC,aAAa,CAAC,CAAA;IACzC,iDAAiD;IACjD,aAAa,EAAE,aAAa,CAAC,eAAe,CAAC,CAAA;IAC7C,qDAAqD;IACrD,yBAAyB,EAAE,aAAa,CAAC,2BAA2B,CAAC,CAAA;IACrE,2CAA2C;IAC3C,aAAa,EAAE,aAAa,CAAC,eAAe,CAAC,CAAA;IAC7C,wCAAwC;IACxC,GAAG,EAAE,aAAa,CAAA;CAClB;AAED,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAOxE;AAED,MAAM,WAAW,gBAAgB;IAChC,8CAA8C;IAC9C,MAAM,CAAC,EAAE,cAAc,CAAA;IACvB,2CAA2C;IAC3C,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,2BAA2B;IAC3B,OAAO,CAAC,EAAE,OAAO,GAAG,MAAM,CAAA;IAC1B,gDAAgD;IAChD,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,6BAA6B;IAC7B,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,yCAAyC;IACzC,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC3E,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChD,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC7C,yEAAyE;IACzE,WAAW,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/C,qBAAqB;IACrB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,6BAA6B;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,EAAE,GAAG,EAAE,CAAA;SAAE,CAAA;KAAE,CAAC,CAAA;IAC3E,oCAAoC;IACpC,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,6BAA6B;IAC7B,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAA;IACrD,gCAAgC;IAChC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;IAC/E,kCAAkC;IAClC,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC1D,wBAAwB;IACxB,SAAS,CAAC,EAAE,MAAM,CACjB,MAAM,EACN;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAC5E,CAAA;IACD,wBAAwB;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACzD,qBAAqB;IACrB,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;IAC5B,oCAAoC;IACpC,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;IAC3B,wCAAwC;IACxC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACrD,+DAA+D;IAC/D,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,mFAAmF;IACnF,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAA;IACjC,yBAAyB;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACjD,6BAA6B;IAC7B,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACxE,0BAA0B;IAC1B,SAAS,CAAC,EAAE,MAAM,CACjB,MAAM,EACN;QACC,kBAAkB,CAAC,EAAE,MAAM,CAAA;QAC3B,2BAA2B,CAAC,EAAE,MAAM,EAAE,CAAA;QACtC,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAA;QACjC,MAAM,CAAC,EAAE,OAAO,CAAA;KAChB,CACD,CAAA;IACD,4BAA4B;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAClC,uBAAuB;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACvE,mEAAmE;IACnE,eAAe,CAAC,EAAE,+BAA+B,CAAC,iBAAiB,CAAC,CAAA;IACpE,2DAA2D;IAC3D,gBAAgB,CAAC,EAAE,+BAA+B,CAAC,SAAS,CAAC,CAAA;IAC7D,kEAAkE;IAClE,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC9C,+EAA+E;IAC/E,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,kEAAkE;IAClE,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,wEAAwE;IACxE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,yBAAyB;IACzB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,0BAA0B;IAC1B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAA;CAC7B;AAicD,wBAAgB,6BAA6B,CAC5C,EAAE,EAAE,aAAa,EACjB,iBAAiB,CAAC,EAAE,MAAM,EAC1B,oBAAoB,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,EAClD,SAAS,GAAE,gBAAgB,GAAG,IAAW,GACvC,iBAAiB,CAuCnB;AAMD;;GAEG;AACH,wBAAsB,cAAc,CAAC,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAa/F;AAMD;;GAEG;AACH,wBAAsB,wBAAwB,CAC7C,MAAM,EAAE,cAAc,EACtB,OAAO,GAAE,OAAO,CAAC,gBAAgB,CAAM,GACrC,OAAO,CAAC,iBAAiB,CAAC,CAmO5B;AAQD;;GAEG;AACH,wBAAsB,YAAY,CAAC,OAAO,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAKzF;AAED;;GAEG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAKnD"}

package/dist/bridge/r2-presign-runtime.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Inline JS defining `__devflareR2PresignHandle(request, env, url)`, which
+ * returns a `Response` when the request targets the local presign endpoint
+ * and `null` otherwise. Enforces signature, expiry, method, content type and
+ * size against the per-boot secret in `env.DEVFLARE_R2_PRESIGN_SECRET`, then
+ * executes the object operation on the local R2 binding.
+ */
+export declare const R2_PRESIGN_RUNTIME_JS = "\nconst __devflareR2PresignPrefix = '/_devflare/r2/presigned/'\n\nconst __devflareR2PresignCors = {\n\t'Access-Control-Allow-Origin': '*',\n\t'Access-Control-Allow-Methods': 'GET, HEAD, PUT, OPTIONS',\n\t'Access-Control-Allow-Headers': 'Content-Type',\n\t'Access-Control-Expose-Headers': 'ETag, Content-Type, Content-Length'\n}\n\nfunction __devflareR2PresignError(status, code, message) {\n\treturn new Response(JSON.stringify({ error: { code, message } }), {\n\t\tstatus,\n\t\theaders: { 'Content-Type': 'application/json', ...__devflareR2PresignCors }\n\t})\n}\n\nasync function __devflareR2PresignHmacHex(secret, message) {\n\tconst encoder = new TextEncoder()\n\tconst key = await crypto.subtle.importKey(\n\t\t'raw',\n\t\tencoder.encode(secret),\n\t\t{ name: 'HMAC', hash: 'SHA-256' },\n\t\tfalse,\n\t\t['sign']\n\t)\n\tconst signature = await crypto.subtle.sign('HMAC', key, encoder.encode(message))\n\treturn [...new Uint8Array(signature)].map((b) => b.toString(16).padStart(2, '0')).join('')\n}\n\n// Constant-time hex comparison (uses workerd's timingSafeEqual when present).\nfunction __devflareR2PresignEqual(expectedHex, actualHex) {\n\tif (typeof actualHex !== 'string' || actualHex.length !== expectedHex.length) return false\n\tconst encoder = new TextEncoder()\n\tconst expected = encoder.encode(expectedHex)\n\tconst actual = encoder.encode(actualHex)\n\tconst subtle = crypto.subtle\n\tif (subtle && typeof subtle.timingSafeEqual === 'function') {\n\t\treturn subtle.timingSafeEqual(expected, actual)\n\t}\n\tlet diff = 0\n\tfor (let i = 0; i < expected.length; i++) diff |= expected[i] ^ actual[i]\n\treturn diff === 0\n}\n\n// MUST match buildLocalCanonicalString in src/runtime/r2-presign.ts.\nfunction __devflareR2PresignCanonical(method, binding, key, expires, contentType, contentLength, maxSize) {\n\treturn [\n\t\t'devflare:r2-presign:v1',\n\t\tmethod,\n\t\tbinding,\n\t\tkey,\n\t\texpires,\n\t\tcontentType || '',\n\t\tcontentLength || '',\n\t\tmaxSize || ''\n\t].join('\\n')\n}\n\n/**\n * Handle a request to the local presigned R2 endpoint; returns null when the\n * path does not match so gateways can fall through to their other routes.\n */\nasync function __devflareR2PresignHandle(request, env, url) {\n\tif (!url.pathname.startsWith(__devflareR2PresignPrefix)) return null\n\n\tif (request.method === 'OPTIONS') {\n\t\treturn new Response(null, {\n\t\t\tstatus: 204,\n\t\t\theaders: { ...__devflareR2PresignCors, 'Access-Control-Max-Age': '86400' }\n\t\t})\n\t}\n\n\tconst rest = url.pathname.slice(__devflareR2PresignPrefix.length)\n\tconst slashIndex = rest.indexOf('/')\n\tif (slashIndex <= 0 || slashIndex === rest.length - 1) {\n\t\treturn __devflareR2PresignError(400, 'bad_request', 'Expected /_devflare/r2/presigned/<binding>/<key>.')\n\t}\n\tconst binding = decodeURIComponent(rest.slice(0, slashIndex))\n\tconst key = rest\n\t\t.slice(slashIndex + 1)\n\t\t.split('/')\n\t\t.map((segment) => decodeURIComponent(segment))\n\t\t.join('/')\n\n\tconst secret = env.DEVFLARE_R2_PRESIGN_SECRET\n\tif (typeof secret !== 'string' || secret.length === 0) {\n\t\treturn __devflareR2PresignError(\n\t\t\t500,\n\t\t\t'presign_unconfigured',\n\t\t\t'DEVFLARE_R2_PRESIGN_SECRET is not configured on the devflare gateway. '\n\t\t\t\t+ 'This endpoint is only served for configs with R2 bindings.'\n\t\t)\n\t}\n\n\tconst params = url.searchParams\n\tconst signedMethod = params.get('X-Devflare-Method')\n\tconst expires = params.get('X-Devflare-Expires')\n\tconst providedSignature = params.get('X-Devflare-Signature')\n\tconst signedContentType = params.get('X-Devflare-Content-Type')\n\tconst signedContentLength = params.get('X-Devflare-Content-Length')\n\tconst signedMaxSize = params.get('X-Devflare-Max-Size')\n\n\tif (!signedMethod || !expires || !providedSignature) {\n\t\treturn __devflareR2PresignError(403, 'missing_parameters', 'Missing presign query parameters.')\n\t}\n\n\tconst expectedSignature = await __devflareR2PresignHmacHex(\n\t\tsecret,\n\t\t__devflareR2PresignCanonical(\n\t\t\tsignedMethod, binding, key, expires, signedContentType, signedContentLength, signedMaxSize\n\t\t)\n\t)\n\tif (!__devflareR2PresignEqual(expectedSignature, providedSignature)) {\n\t\treturn __devflareR2PresignError(403, 'invalid_signature', 'Presigned URL signature mismatch.')\n\t}\n\n\tif (Math.floor(Date.now() / 1000) > Number(expires)) {\n\t\treturn __devflareR2PresignError(403, 'expired', 'Presigned URL has expired.')\n\t}\n\n\tconst methodAllowed = signedMethod === 'GET'\n\t\t? request.method === 'GET' || request.method === 'HEAD'\n\t\t: request.method === signedMethod\n\tif (!methodAllowed) {\n\t\treturn __devflareR2PresignError(\n\t\t\t403,\n\t\t\t'method_mismatch',\n\t\t\t'URL was presigned for ' + signedMethod + ', got ' + request.method + '.'\n\t\t)\n\t}\n\n\tconst bucket = env[binding]\n\tif (!bucket || typeof bucket.put !== 'function' || typeof bucket.head !== 'function') {\n\t\treturn __devflareR2PresignError(404, 'unknown_binding', 'R2 binding not found: ' + binding)\n\t}\n\n\tif (request.method === 'PUT') {\n\t\tconst sentContentType = request.headers.get('Content-Type')\n\t\tif (signedContentType !== null && sentContentType !== signedContentType) {\n\t\t\treturn __devflareR2PresignError(\n\t\t\t\t403,\n\t\t\t\t'content_type_mismatch',\n\t\t\t\t'URL was presigned for Content-Type \"' + signedContentType + '\", got \"' + sentContentType + '\".'\n\t\t\t)\n\t\t}\n\n\t\tconst body = await request.arrayBuffer()\n\t\tif (signedContentLength !== null && body.byteLength !== Number(signedContentLength)) {\n\t\t\treturn __devflareR2PresignError(\n\t\t\t\t403,\n\t\t\t\t'content_length_mismatch',\n\t\t\t\t'URL was presigned for exactly ' + signedContentLength + ' bytes, got ' + body.byteLength + '.'\n\t\t\t)\n\t\t}\n\t\tif (signedMaxSize !== null && body.byteLength > Number(signedMaxSize)) {\n\t\t\treturn __devflareR2PresignError(\n\t\t\t\t413,\n\t\t\t\t'too_large',\n\t\t\t\t'Body of ' + body.byteLength + ' bytes exceeds the presigned maximum of ' + signedMaxSize + '.'\n\t\t\t)\n\t\t}\n\n\t\tconst putContentType = sentContentType || signedContentType || undefined\n\t\tconst result = await bucket.put(key, body, {\n\t\t\t...(putContentType && { httpMetadata: { contentType: putContentType } })\n\t\t})\n\t\treturn new Response(null, {\n\t\t\tstatus: 200,\n\t\t\theaders: { ...__devflareR2PresignCors, ...(result?.httpEtag && { ETag: result.httpEtag }) }\n\t\t})\n\t}\n\n\t// GET / HEAD\n\tconst objectHeaders = (object) => ({\n\t\t...__devflareR2PresignCors,\n\t\t'Content-Type': object.httpMetadata?.contentType || 'application/octet-stream',\n\t\t'Content-Length': String(object.size),\n\t\t...(object.httpEtag && { ETag: object.httpEtag })\n\t})\n\n\tif (request.method === 'HEAD') {\n\t\tconst object = await bucket.head(key)\n\t\tif (!object) return __devflareR2PresignError(404, 'not_found', 'Object not found: ' + key)\n\t\treturn new Response(null, { status: 200, headers: objectHeaders(object) })\n\t}\n\n\tconst object = await bucket.get(key)\n\tif (!object) return __devflareR2PresignError(404, 'not_found', 'Object not found: ' + key)\n\treturn new Response(object.body, { status: 200, headers: objectHeaders(object) })\n}\n";
+//# sourceMappingURL=r2-presign-runtime.d.ts.map

package/dist/bridge/r2-presign-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"r2-presign-runtime.d.ts","sourceRoot":"","sources":["../../src/bridge/r2-presign-runtime.ts"],"names":[],"mappings":"AAeA;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,yiOA+LjC,CAAA"}

package/dist/cli/index.js

@@ -1,2 +1,2 @@
-import { n as runCli, t as parseArgs } from "../_chunks/cli-yOO5yCaf.js";
+import { n as runCli, t as parseArgs } from "../_chunks/cli-BlVetiEh.js";
 export { parseArgs, runCli };

package/dist/config/compiler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"compiler.d.ts","sourceRoot":"","sources":["../../src/config/compiler.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAwB,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAG5E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AACtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAE9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAC7D,OAAO,EACN,2BAA2B,EAC3B,kBAAkB,EAClB,yBAAyB,EACzB,eAAe,EACf,mBAAmB,EACnB,MAAM,kBAAkB,CAAA;AACzB,YAAY,EACX,oBAAoB,EACpB,cAAc,EACd,yBAAyB,EACzB,yBAAyB,EACzB,0BAA0B,EAC1B,kBAAkB,EAClB,MAAM,kBAAkB,CAAA;AAEzB;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,cAAc,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,cAAc,CAE1F;AAED,wBAAgB,kBAAkB,CACjC,MAAM,EAAE,cAAc,EACtB,WAAW,CAAC,EAAE,MAAM,EACpB,OAAO,GAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAO,GACzC,cAAc,CAKhB;AAsID;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAC1C,MAAM,EAAE,cAAc,EACtB,WAAW,CAAC,EAAE,MAAM,EACpB,OAAO,GAAE;IAAE,qBAAqB,CAAC,EAAE,OAAO,CAAA;CAAO,GAC/C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAIzB"}
+{"version":3,"file":"compiler.d.ts","sourceRoot":"","sources":["../../src/config/compiler.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAwB,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAG5E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AACtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAG9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAC7D,OAAO,EACN,2BAA2B,EAC3B,kBAAkB,EAClB,yBAAyB,EACzB,eAAe,EACf,mBAAmB,EACnB,MAAM,kBAAkB,CAAA;AACzB,YAAY,EACX,oBAAoB,EACpB,cAAc,EACd,yBAAyB,EACzB,yBAAyB,EACzB,0BAA0B,EAC1B,kBAAkB,EAClB,MAAM,kBAAkB,CAAA;AAEzB;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,cAAc,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,cAAc,CAE1F;AAED,wBAAgB,kBAAkB,CACjC,MAAM,EAAE,cAAc,EACtB,WAAW,CAAC,EAAE,MAAM,EACpB,OAAO,GAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAO,GACzC,cAAc,CAKhB;AA2KD;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAC1C,MAAM,EAAE,cAAc,EACtB,WAAW,CAAC,EAAE,MAAM,EACpB,OAAO,GAAE;IAAE,qBAAqB,CAAC,EAAE,OAAO,CAAA;CAAO,GAC/C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAIzB"}

package/dist/dev-server/gateway-script.d.ts

@@ -5,7 +5,8 @@ import type { WsRouteConfig } from '../config/index.js';
  * All in-sandbox RPC behavior (method dispatch, error envelope, serialization,
  * WebSocket bridge, HTTP transfer) lives in `GATEWAY_RUNTIME_JS` and is shared
  * with `src/bridge/miniflare.ts`. The canonical TypeScript equivalent lives in
- * `src/bridge/server.ts`.
+ * `src/bridge/server.ts`. The local presigned-R2 endpoint handler is shared
+ * via `R2_PRESIGN_RUNTIME_JS` (`src/bridge/r2-presign-runtime.ts`).
  *
  * This file only owns the pieces that are genuinely dev-server-specific:
  *   - WebSocket route matching & DO WebSocket forwarding (`WS_ROUTES`)

package/dist/dev-server/gateway-script.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gateway-script.d.ts","sourceRoot":"","sources":["../../src/dev-server/gateway-script.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAE9C;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAC/B,QAAQ,GAAE,aAAa,EAAO,EAC9B,KAAK,UAAQ,EACb,qBAAqB,GAAE,MAAM,GAAG,IAAW,GACzC,MAAM,CAgQR"}
+{"version":3,"file":"gateway-script.d.ts","sourceRoot":"","sources":["../../src/dev-server/gateway-script.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAE9C;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,gBAAgB,CAC/B,QAAQ,GAAE,aAAa,EAAO,EAC9B,KAAK,UAAQ,EACb,qBAAqB,GAAE,MAAM,GAAG,IAAW,GACzC,MAAM,CAuQR"}

package/dist/dev-server/miniflare-dev-config.d.ts

@@ -21,8 +21,21 @@ export interface BuildMiniflareDevConfigInput {
     browserShimPort: number;
     doResult: DOBundleResult | null;
     serviceBindingResolution?: ServiceBindingResolution | null;
+    /**
+     * Per-boot HMAC secret for the local R2 presign endpoint. Injected (with
+     * the gateway origin) as `DEVFLARE_R2_PRESIGN_*` vars into every worker
+     * when the config declares R2 bindings; ignored otherwise.
+     */
+    r2PresignSecret?: string | null;
     logger?: ConsolaInstance;
 }
+/**
+ * Resolve the browser-facing origin of the local dev runtime, used inside
+ * locally-presigned R2 URLs. Honors `server.publicUrl` (reverse proxy /
+ * tunnel setups); otherwise derives `http(s)://<host>:<port>` from the
+ * Miniflare listen address, normalizing wildcard hosts to `localhost`.
+ */
+export declare function resolveR2PresignOrigin(serverConfig: DevflareConfig['server'], miniflareHost: string, miniflarePort: number): string;
 /**
  * Build the complete Miniflare configuration for the dev server.
  *

package/dist/dev-server/miniflare-dev-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"miniflare-dev-config.d.ts","sourceRoot":"","sources":["../../src/dev-server/miniflare-dev-config.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAG9C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAChD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAI/C,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAA;AAC9E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAA;AAgClE,OAAO,EAAE,KAAK,kBAAkB,EAAyB,MAAM,wBAAwB,CAAA;AAGvF,KAAK,wBAAwB,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,sBAAsB,CAAC,CAAC,CAAA;AAElF,MAAM,WAAW,4BAA4B;IAC5C,MAAM,EAAE,cAAc,CAAA;IACtB,GAAG,EAAE,MAAM,CAAA;IACX,aAAa,EAAE,MAAM,CAAA;IACrB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,EAAE,OAAO,CAAA;IACnB,KAAK,EAAE,OAAO,CAAA;IACd,sBAAsB,EAAE,kBAAkB,CAAA;IAC1C,gBAAgB,EAAE,oBAAoB,GAAG,IAAI,CAAA;IAC7C,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAA;IACnC,2BAA2B,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1C,wBAAwB,EAAE,MAAM,CAAA;IAChC,eAAe,EAAE,MAAM,CAAA;IACvB,QAAQ,EAAE,cAAc,GAAG,IAAI,CAAA;IAC/B,wBAAwB,CAAC,EAAE,wBAAwB,GAAG,IAAI,CAAA;IAC1D,MAAM,CAAC,EAAE,eAAe,CAAA;CACxB;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,4BAA4B,GAAG,GAAG,CAwPhF"}
+{"version":3,"file":"miniflare-dev-config.d.ts","sourceRoot":"","sources":["../../src/dev-server/miniflare-dev-config.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAG9C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAChD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAI/C,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAA;AAC9E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAA;AAgClE,OAAO,EAAE,KAAK,kBAAkB,EAAyB,MAAM,wBAAwB,CAAA;AAGvF,KAAK,wBAAwB,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,sBAAsB,CAAC,CAAC,CAAA;AAElF,MAAM,WAAW,4BAA4B;IAC5C,MAAM,EAAE,cAAc,CAAA;IACtB,GAAG,EAAE,MAAM,CAAA;IACX,aAAa,EAAE,MAAM,CAAA;IACrB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,EAAE,OAAO,CAAA;IACnB,KAAK,EAAE,OAAO,CAAA;IACd,sBAAsB,EAAE,kBAAkB,CAAA;IAC1C,gBAAgB,EAAE,oBAAoB,GAAG,IAAI,CAAA;IAC7C,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAA;IACnC,2BAA2B,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1C,wBAAwB,EAAE,MAAM,CAAA;IAChC,eAAe,EAAE,MAAM,CAAA;IACvB,QAAQ,EAAE,cAAc,GAAG,IAAI,CAAA;IAC/B,wBAAwB,CAAC,EAAE,wBAAwB,GAAG,IAAI,CAAA;IAC1D;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,MAAM,CAAC,EAAE,eAAe,CAAA;CACxB;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACrC,YAAY,EAAE,cAAc,CAAC,QAAQ,CAAC,EACtC,aAAa,EAAE,MAAM,EACrB,aAAa,EAAE,MAAM,GACnB,MAAM,CAOR;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,4BAA4B,GAAG,GAAG,CAwQhF"}

package/dist/dev-server/miniflare-worker-config.d.ts

@@ -83,6 +83,13 @@ export interface MakeMiniflareWorkerContext {
         queueName: string;
         deliveryDelay?: number;
     }> | undefined;
+    /**
+     * Devflare-internal plain-string vars merged into every worker's
+     * `bindings` on top of `config.vars` (e.g. the local R2 presign
+     * secret/origin). Collisions win over user vars — these names are
+     * `DEVFLARE_`-prefixed and reserved.
+     */
+    injectedVars?: Record<string, string>;
 }
 /**
  * Build a single worker config object for Miniflare's `workers` array.

package/dist/dev-server/miniflare-worker-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"miniflare-worker-config.d.ts","sourceRoot":"","sources":["../../src/dev-server/miniflare-worker-config.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAM/C,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,0BAA0B,CAAA;AAC/E,OAAO,KAAK,EACX,4BAA4B,EAC5B,6BAA6B,EAC7B,0BAA0B,EAC1B,oBAAoB,EACpB,6BAA6B,EAC7B,mBAAmB,EACnB,sBAAsB,EACtB,iBAAiB,EACjB,gBAAgB,EAChB,2BAA2B,EAC3B,oBAAoB,EACpB,qBAAqB,EACrB,uBAAuB,EACvB,oBAAoB,EACpB,iBAAiB,EACjB,iCAAiC,EACjC,wBAAwB,EACxB,0BAA0B,EAC1B,wBAAwB,EACxB,oBAAoB,EACpB,MAAM,sBAAsB,CAAA;AAE7B,KAAK,QAAQ,GAAG,WAAW,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAA;AACvD,KAAK,eAAe,GAAG,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAA;AAC9D,KAAK,gBAAgB,GAAG,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAA;AAChE,KAAK,qBAAqB,GAAG,UAAU,CAAC,OAAO,0BAA0B,CAAC,CAAA;AAC1E,KAAK,mBAAmB,GAAG,UAAU,CAAC,OAAO,wBAAwB,CAAC,CAAA;AACtE,KAAK,sBAAsB,GAAG,UAAU,CAAC,OAAO,2BAA2B,CAAC,CAAA;AAC5E,KAAK,wBAAwB,GAAG,UAAU,CAAC,OAAO,6BAA6B,CAAC,CAAA;AAChF,KAAK,eAAe,GAAG,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAA;AAC9D,KAAK,eAAe,GAAG,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAA;AAC9D,KAAK,iBAAiB,GAAG,UAAU,CAAC,OAAO,sBAAsB,CAAC,CAAA;AAClE,KAAK,YAAY,GAAG,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAA;AACxD,KAAK,WAAW,GAAG,UAAU,CAAC,OAAO,gBAAgB,CAAC,CAAA;AACtD,KAAK,YAAY,GAAG,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAA;AACxD,KAAK,cAAc,GAAG,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAC5D,KAAK,qBAAqB,GAAG,UAAU,CAAC,OAAO,0BAA0B,CAAC,CAAA;AAC1E,KAAK,mBAAmB,GAAG,UAAU,CAAC,OAAO,wBAAwB,CAAC,CAAA;AACtE,KAAK,4BAA4B,GAAG,UAAU,CAAC,OAAO,iCAAiC,CAAC,CAAA;AACxF,KAAK,eAAe,GAAG,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAA;AAC9D,KAAK,wBAAwB,GAAG,UAAU,CAAC,OAAO,6BAA6B,CAAC,CAAA;AAChF,KAAK,uBAAuB,GAAG,UAAU,CAAC,OAAO,4BAA4B,CAAC,CAAA;AAC9E,KAAK,kBAAkB,GAAG,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAA;AAGpE,MAAM,MAAM,uBAAuB,GAAG;IACrC,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC/B,CAAA;AAoBD;;;;GAIG;AACH,wBAAgB,oBAAoB,CACnC,QAAQ,EAAE,QAAQ,EAClB,aAAa,GAAE,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAM,GACzD,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,GAAG,SAAS,CAkBrD;AAED,MAAM,WAAW,0BAA0B;IAC1C,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACnF,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAA;IACzD,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IACxD,QAAQ,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAA;IAC/B;;;;;OAKG;IACH,eAAe,CAAC,EAAE,uBAAuB,GAAG,MAAM,CAAA;CAClD;AAED,MAAM,WAAW,0BAA0B;IAC1C,GAAG,EAAE,MAAM,CAAA;IACX,YAAY,EAAE,cAAc,CAAA;IAC5B,QAAQ,EAAE,QAAQ,CAAA;IAClB,eAAe,EAAE,eAAe,CAAA;IAChC,gBAAgB,EAAE,gBAAgB,CAAA;IAClC,qBAAqB,EAAE,qBAAqB,CAAA;IAC5C,mBAAmB,EAAE,mBAAmB,CAAA;IACxC,sBAAsB,EAAE,sBAAsB,CAAA;IAC9C,wBAAwB,EAAE,wBAAwB,CAAA;IAClD,eAAe,EAAE,eAAe,CAAA;IAChC,eAAe,EAAE,eAAe,CAAA;IAChC,iBAAiB,EAAE,iBAAiB,CAAA;IACpC,YAAY,EAAE,YAAY,CAAA;IAC1B,WAAW,EAAE,WAAW,CAAA;IACxB,YAAY,EAAE,YAAY,CAAA;IAC1B,cAAc,EAAE,cAAc,CAAA;IAC9B,qBAAqB,EAAE,qBAAqB,CAAA;IAC5C,mBAAmB,EAAE,mBAAmB,CAAA;IACxC,4BAA4B,CAAC,EAAE,4BAA4B,CAAA;IAC3D,eAAe,EAAE,eAAe,CAAA;IAChC,wBAAwB,EAAE,wBAAwB,CAAA;IAClD,uBAAuB,EAAE,uBAAuB,CAAA;IAChD,kBAAkB,EAAE,kBAAkB,CAAA;IACtC,+BAA+B,CAAC,EAAE,+BAA+B,CAAA;IACjE,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,SAAS,CAAA;CACzF;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAClC,OAAO,EAAE,0BAA0B,EACnC,OAAO,EAAE,0BAA0B,GACjC,GAAG,CAqHL"}
+{"version":3,"file":"miniflare-worker-config.d.ts","sourceRoot":"","sources":["../../src/dev-server/miniflare-worker-config.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAM/C,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,0BAA0B,CAAA;AAC/E,OAAO,KAAK,EACX,4BAA4B,EAC5B,6BAA6B,EAC7B,0BAA0B,EAC1B,oBAAoB,EACpB,6BAA6B,EAC7B,mBAAmB,EACnB,sBAAsB,EACtB,iBAAiB,EACjB,gBAAgB,EAChB,2BAA2B,EAC3B,oBAAoB,EACpB,qBAAqB,EACrB,uBAAuB,EACvB,oBAAoB,EACpB,iBAAiB,EACjB,iCAAiC,EACjC,wBAAwB,EACxB,0BAA0B,EAC1B,wBAAwB,EACxB,oBAAoB,EACpB,MAAM,sBAAsB,CAAA;AAE7B,KAAK,QAAQ,GAAG,WAAW,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAA;AACvD,KAAK,eAAe,GAAG,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAA;AAC9D,KAAK,gBAAgB,GAAG,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAA;AAChE,KAAK,qBAAqB,GAAG,UAAU,CAAC,OAAO,0BAA0B,CAAC,CAAA;AAC1E,KAAK,mBAAmB,GAAG,UAAU,CAAC,OAAO,wBAAwB,CAAC,CAAA;AACtE,KAAK,sBAAsB,GAAG,UAAU,CAAC,OAAO,2BAA2B,CAAC,CAAA;AAC5E,KAAK,wBAAwB,GAAG,UAAU,CAAC,OAAO,6BAA6B,CAAC,CAAA;AAChF,KAAK,eAAe,GAAG,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAA;AAC9D,KAAK,eAAe,GAAG,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAA;AAC9D,KAAK,iBAAiB,GAAG,UAAU,CAAC,OAAO,sBAAsB,CAAC,CAAA;AAClE,KAAK,YAAY,GAAG,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAA;AACxD,KAAK,WAAW,GAAG,UAAU,CAAC,OAAO,gBAAgB,CAAC,CAAA;AACtD,KAAK,YAAY,GAAG,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAA;AACxD,KAAK,cAAc,GAAG,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAC5D,KAAK,qBAAqB,GAAG,UAAU,CAAC,OAAO,0BAA0B,CAAC,CAAA;AAC1E,KAAK,mBAAmB,GAAG,UAAU,CAAC,OAAO,wBAAwB,CAAC,CAAA;AACtE,KAAK,4BAA4B,GAAG,UAAU,CAAC,OAAO,iCAAiC,CAAC,CAAA;AACxF,KAAK,eAAe,GAAG,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAA;AAC9D,KAAK,wBAAwB,GAAG,UAAU,CAAC,OAAO,6BAA6B,CAAC,CAAA;AAChF,KAAK,uBAAuB,GAAG,UAAU,CAAC,OAAO,4BAA4B,CAAC,CAAA;AAC9E,KAAK,kBAAkB,GAAG,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAA;AAGpE,MAAM,MAAM,uBAAuB,GAAG;IACrC,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC/B,CAAA;AAoBD;;;;GAIG;AACH,wBAAgB,oBAAoB,CACnC,QAAQ,EAAE,QAAQ,EAClB,aAAa,GAAE,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAM,GACzD,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,GAAG,SAAS,CAkBrD;AAED,MAAM,WAAW,0BAA0B;IAC1C,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACnF,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAA;IACzD,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IACxD,QAAQ,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAA;IAC/B;;;;;OAKG;IACH,eAAe,CAAC,EAAE,uBAAuB,GAAG,MAAM,CAAA;CAClD;AAED,MAAM,WAAW,0BAA0B;IAC1C,GAAG,EAAE,MAAM,CAAA;IACX,YAAY,EAAE,cAAc,CAAA;IAC5B,QAAQ,EAAE,QAAQ,CAAA;IAClB,eAAe,EAAE,eAAe,CAAA;IAChC,gBAAgB,EAAE,gBAAgB,CAAA;IAClC,qBAAqB,EAAE,qBAAqB,CAAA;IAC5C,mBAAmB,EAAE,mBAAmB,CAAA;IACxC,sBAAsB,EAAE,sBAAsB,CAAA;IAC9C,wBAAwB,EAAE,wBAAwB,CAAA;IAClD,eAAe,EAAE,eAAe,CAAA;IAChC,eAAe,EAAE,eAAe,CAAA;IAChC,iBAAiB,EAAE,iBAAiB,CAAA;IACpC,YAAY,EAAE,YAAY,CAAA;IAC1B,WAAW,EAAE,WAAW,CAAA;IACxB,YAAY,EAAE,YAAY,CAAA;IAC1B,cAAc,EAAE,cAAc,CAAA;IAC9B,qBAAqB,EAAE,qBAAqB,CAAA;IAC5C,mBAAmB,EAAE,mBAAmB,CAAA;IACxC,4BAA4B,CAAC,EAAE,4BAA4B,CAAA;IAC3D,eAAe,EAAE,eAAe,CAAA;IAChC,wBAAwB,EAAE,wBAAwB,CAAA;IAClD,uBAAuB,EAAE,uBAAuB,CAAA;IAChD,kBAAkB,EAAE,kBAAkB,CAAA;IACtC,+BAA+B,CAAC,EAAE,+BAA+B,CAAA;IACjE,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,SAAS,CAAA;IACzF;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACrC;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAClC,OAAO,EAAE,0BAA0B,EACnC,OAAO,EAAE,0BAA0B,GACjC,GAAG,CAwHL"}

package/dist/dev-server/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/dev-server/server.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAC9C,OAAO,KAAK,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,WAAW,CAAA;AAiD3D,MAAM,WAAW,gBAAgB;IAChC,6BAA6B;IAC7B,GAAG,EAAE,MAAM,CAAA;IACX,kCAAkC;IAClC,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,2CAA2C;IAC3C,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,iDAAiD;IACjD,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,wEAAwE;IACxE,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,6CAA6C;IAC7C,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,2BAA2B;IAC3B,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,sBAAsB;IACtB,MAAM,CAAC,EAAE,eAAe,CAAA;IACxB,6BAA6B;IAC7B,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,0DAA0D;IAC1D,KAAK,CAAC,EAAE,OAAO,CAAA;CACf;AAED,MAAM,WAAW,SAAS;IACzB,2BAA2B;IAC3B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IACtB,0BAA0B;IAC1B,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IACrB,yCAAyC;IACzC,YAAY,IAAI,aAAa,GAAG,IAAI,CAAA;CACpC;AAMD,wBAAgB,eAAe,CAAC,OAAO,EAAE,gBAAgB,GAAG,SAAS,CA4XpE"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/dev-server/server.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAC9C,OAAO,KAAK,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,WAAW,CAAA;AAiD3D,MAAM,WAAW,gBAAgB;IAChC,6BAA6B;IAC7B,GAAG,EAAE,MAAM,CAAA;IACX,kCAAkC;IAClC,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,2CAA2C;IAC3C,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,iDAAiD;IACjD,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,wEAAwE;IACxE,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,6CAA6C;IAC7C,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,2BAA2B;IAC3B,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,sBAAsB;IACtB,MAAM,CAAC,EAAE,eAAe,CAAA;IACxB,6BAA6B;IAC7B,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,0DAA0D;IAC1D,KAAK,CAAC,EAAE,OAAO,CAAA;CACf;AAED,MAAM,WAAW,SAAS;IACzB,2BAA2B;IAC3B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IACtB,0BAA0B;IAC1B,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IACrB,yCAAyC;IACzC,YAAY,IAAI,aAAa,GAAG,IAAI,CAAA;CACpC;AAMD,wBAAgB,eAAe,CAAC,OAAO,EAAE,gBAAgB,GAAG,SAAS,CAwYpE"}

package/dist/dev-server/vite-process.d.ts

@@ -6,6 +6,15 @@ export interface StartViteProcessOptions {
     vitePort: number;
     miniflarePort: number;
     generatedViteConfigPath: string | null;
+    /**
+     * Local R2 presign context, exposed to the app process as
+     * `DEVFLARE_R2_PRESIGN_SECRET`/`DEVFLARE_R2_PRESIGN_ORIGIN` so
+     * `presignR2Put`/`presignR2Get` mint gateway-local URLs in dev.
+     */
+    r2Presign?: {
+        secret: string;
+        origin: string;
+    } | null;
     logger?: ConsolaInstance;
 }
 /**

package/dist/dev-server/vite-process.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vite-process.d.ts","sourceRoot":"","sources":["../../src/dev-server/vite-process.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,YAAY,EAAS,MAAM,oBAAoB,CAAA;AAC7D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAG9C,MAAM,WAAW,uBAAuB;IACvC,GAAG,EAAE,MAAM,CAAA;IACX,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,aAAa,EAAE,MAAM,CAAA;IACrB,uBAAuB,EAAE,MAAM,GAAG,IAAI,CAAA;IACtC,MAAM,CAAC,EAAE,eAAe,CAAA;CACxB;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,YAAY,CAAC,CAqC9F"}
+{"version":3,"file":"vite-process.d.ts","sourceRoot":"","sources":["../../src/dev-server/vite-process.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,YAAY,EAAS,MAAM,oBAAoB,CAAA;AAC7D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAG9C,MAAM,WAAW,uBAAuB;IACvC,GAAG,EAAE,MAAM,CAAA;IACX,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,aAAa,EAAE,MAAM,CAAA;IACrB,uBAAuB,EAAE,MAAM,GAAG,IAAI,CAAA;IACtC;;;;OAIG;IACH,SAAS,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAA;IACrD,MAAM,CAAC,EAAE,eAAe,CAAA;CACxB;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,YAAY,CAAC,CA4C9F"}

package/dist/index.js

@@ -1,9 +1,9 @@
 import { n as defineConfig, t as ref } from "./_chunks/ref-CYJNAAe_.js";
 import { i as preview } from "./_chunks/preview-C3Cdr8an.js";
 import { a as ConfigResourceResolutionError, d as configSchema, n as ConfigValidationError, o as loadResolvedConfig, r as loadConfig, t as ConfigNotFoundError } from "./_chunks/loader-E_UGyTrJ.js";
-import { n as compileConfig, s as stringifyConfig } from "./_chunks/compiler-okj8qvCh.js";
+import { n as compileConfig, s as stringifyConfig } from "./_chunks/compiler-CgIFPfRA.js";
 import { t as workerName } from "./_chunks/workerName-CFJsLZA-.js";
 import { n as getDurableObjectOptions, t as durableObject } from "./_chunks/decorators-QmV57ixr.js";
-import { n as runCli, t as parseArgs } from "./_chunks/cli-yOO5yCaf.js";
+import { n as runCli, t as parseArgs } from "./_chunks/cli-BlVetiEh.js";
 import { i as vars, r as env } from "./_chunks/env-S0_nMVz1.js";
 export { ConfigNotFoundError, ConfigResourceResolutionError, ConfigValidationError, compileConfig, configSchema, defineConfig as default, defineConfig, durableObject, env, getDurableObjectOptions, loadConfig, loadResolvedConfig, parseArgs, preview, ref, runCli, stringifyConfig, vars, workerName };

package/dist/runtime/index.d.ts

@@ -8,4 +8,5 @@ export { matchFetchRoute, invokeRouteModules, createRouteResolve } from './route
 export type { RouteSegment, RouteModuleDefinition, RouteMatchResult } from './router/types.js';
 export { durableObject, getDurableObjectOptions, type DurableObjectOptions } from '../decorators/index.js';
 export { setLocalSendEmailBindings, clearLocalSendEmailBindings, type LocalSendEmailBindingConfig } from '../utils/send-email.js';
+export { presignR2Put, presignR2Get, type R2PresignCredentials, type R2PresignBaseOptions, type R2PresignPutOptions, type R2PresignGetOptions, type PresignedR2Request } from './r2-presign.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/runtime/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/runtime/index.ts"],"names":[],"mappings":"AAWA,OAAO,EACN,GAAG,EACH,IAAI,EACJ,GAAG,EACH,KAAK,EACL,MAAM,EACN,MAAM,WAAW,CAAA;AAElB,YAAY,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAG7C,OAAO,EACN,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,6BAA6B,EAC7B,6BAA6B,EAC7B,wCAAwC,EACxC,sCAAsC,EACtC,sCAAsC,EACtC,cAAc,EACd,mBAAmB,EACnB,UAAU,EACV,gBAAgB,EAChB,eAAe,EACf,qBAAqB,EACrB,aAAa,EACb,aAAa,EACb,iBAAiB,EACjB,aAAa,EACb,YAAY,EACZ,qBAAqB,EACrB,0BAA0B,EAC1B,0BAA0B,EAC1B,qCAAqC,EACrC,mCAAmC,EACnC,mCAAmC,EACnC,UAAU,EACV,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,MAAM,WAAW,CAAA;AAElB,YAAY,EACX,UAAU,EACV,UAAU,EACV,cAAc,EACd,UAAU,EACV,SAAS,EACT,kBAAkB,EAClB,uBAAuB,EACvB,uBAAuB,EACvB,kCAAkC,EAClC,gCAAgC,EAChC,gCAAgC,EAChC,WAAW,EACX,QAAQ,EACR,MAAM,WAAW,CAAA;AAGlB,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AAGrE,OAAO,EACN,QAAQ,EACR,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,sBAAsB,EACtB,gBAAgB,EAChB,eAAe,EACf,uBAAuB,EACvB,+BAA+B,EAC/B,mCAAmC,EACnC,KAAK,SAAS,EACd,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,MAAM,cAAc,CAAA;AAErB,OAAO,EACN,eAAe,EACf,kBAAkB,EAClB,kBAAkB,EAClB,MAAM,UAAU,CAAA;AAEjB,YAAY,EACX,YAAY,EACZ,qBAAqB,EACrB,gBAAgB,EAChB,MAAM,gBAAgB,CAAA;AAGvB,OAAO,EACN,aAAa,EACb,uBAAuB,EACvB,KAAK,oBAAoB,EACzB,MAAM,eAAe,CAAA;AAKtB,OAAO,EACN,yBAAyB,EACzB,2BAA2B,EAC3B,KAAK,2BAA2B,EAChC,MAAM,qBAAqB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/runtime/index.ts"],"names":[],"mappings":"AAWA,OAAO,EACN,GAAG,EACH,IAAI,EACJ,GAAG,EACH,KAAK,EACL,MAAM,EACN,MAAM,WAAW,CAAA;AAElB,YAAY,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAG7C,OAAO,EACN,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,6BAA6B,EAC7B,6BAA6B,EAC7B,wCAAwC,EACxC,sCAAsC,EACtC,sCAAsC,EACtC,cAAc,EACd,mBAAmB,EACnB,UAAU,EACV,gBAAgB,EAChB,eAAe,EACf,qBAAqB,EACrB,aAAa,EACb,aAAa,EACb,iBAAiB,EACjB,aAAa,EACb,YAAY,EACZ,qBAAqB,EACrB,0BAA0B,EAC1B,0BAA0B,EAC1B,qCAAqC,EACrC,mCAAmC,EACnC,mCAAmC,EACnC,UAAU,EACV,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,MAAM,WAAW,CAAA;AAElB,YAAY,EACX,UAAU,EACV,UAAU,EACV,cAAc,EACd,UAAU,EACV,SAAS,EACT,kBAAkB,EAClB,uBAAuB,EACvB,uBAAuB,EACvB,kCAAkC,EAClC,gCAAgC,EAChC,gCAAgC,EAChC,WAAW,EACX,QAAQ,EACR,MAAM,WAAW,CAAA;AAGlB,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AAGrE,OAAO,EACN,QAAQ,EACR,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,sBAAsB,EACtB,gBAAgB,EAChB,eAAe,EACf,uBAAuB,EACvB,+BAA+B,EAC/B,mCAAmC,EACnC,KAAK,SAAS,EACd,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,MAAM,cAAc,CAAA;AAErB,OAAO,EACN,eAAe,EACf,kBAAkB,EAClB,kBAAkB,EAClB,MAAM,UAAU,CAAA;AAEjB,YAAY,EACX,YAAY,EACZ,qBAAqB,EACrB,gBAAgB,EAChB,MAAM,gBAAgB,CAAA;AAGvB,OAAO,EACN,aAAa,EACb,uBAAuB,EACvB,KAAK,oBAAoB,EACzB,MAAM,eAAe,CAAA;AAKtB,OAAO,EACN,yBAAyB,EACzB,2BAA2B,EAC3B,KAAK,2BAA2B,EAChC,MAAM,qBAAqB,CAAA;AAG5B,OAAO,EACN,YAAY,EACZ,YAAY,EACZ,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,MAAM,cAAc,CAAA"}