devflare 1.0.0-next.59 → 1.0.0-next.60

package/dist/runtime/index.js

@@ -1,5 +1,5 @@
 import { n as getDurableObjectOptions, t as durableObject } from "../_chunks/decorators-QmV57ixr.js";
 import { A as createTailEvent, C as createDurableObjectWebSocketCloseEvent, D as createFetchEvent, E as createEmailEvent, O as createQueueEvent, S as createDurableObjectFetchEvent, T as createDurableObjectWebSocketMessageEvent, _ as runWithContext, a as getDurableObjectFetchEvent, b as createContextProxy, c as getDurableObjectWebSocketMessageEvent, d as getEventContextOrNull, f as getFetchEvent, g as hasContext, h as getTailEvent, i as getDurableObjectEvent, k as createScheduledEvent, l as getEmailEvent, m as getScheduledEvent, n as getContextOrNull, o as getDurableObjectWebSocketCloseEvent, p as getQueueEvent, r as getDurableObjectAlarmEvent, s as getDurableObjectWebSocketErrorEvent, t as getContext, u as getEventContext, v as runWithEventContext, w as createDurableObjectWebSocketErrorEvent, x as createDurableObjectAlarmEvent, y as ContextAccessError } from "../_chunks/context-CX50Y2Kb.js";
 import { clearLocalSendEmailBindings, setLocalSendEmailBindings } from "../utils/send-email.js";
-import { _ as ctx, a as assertExplicitQueueHandlerStyle, b as locals, c as defineFetchHandler, d as invokeFetchHandler, f as invokeFetchModule, g as sequence, h as resolveFetchHandler, i as assertExplicit2ArgStyle, l as defineQueueHandler, m as markWorkerStyle, n as invokeRouteModules, o as assertExplicitScheduledHandlerStyle, p as markResolveStyle, r as matchFetchRoute, s as createResolveFetch, t as createRouteResolve, u as defineScheduledHandler, v as env, x as vars, y as event } from "../_chunks/runtime-DL-Nz3k8.js";
-export { ContextAccessError, assertExplicit2ArgStyle, assertExplicitQueueHandlerStyle, assertExplicitScheduledHandlerStyle, clearLocalSendEmailBindings, createContextProxy, createDurableObjectAlarmEvent, createDurableObjectFetchEvent, createDurableObjectWebSocketCloseEvent, createDurableObjectWebSocketErrorEvent, createDurableObjectWebSocketMessageEvent, createEmailEvent, createFetchEvent, createQueueEvent, createResolveFetch, createRouteResolve, createScheduledEvent, createTailEvent, ctx, defineFetchHandler, defineQueueHandler, defineScheduledHandler, durableObject, env, event, getContext, getContextOrNull, getDurableObjectAlarmEvent, getDurableObjectEvent, getDurableObjectFetchEvent, getDurableObjectOptions, getDurableObjectWebSocketCloseEvent, getDurableObjectWebSocketErrorEvent, getDurableObjectWebSocketMessageEvent, getEmailEvent, getEventContext, getEventContextOrNull, getFetchEvent, getQueueEvent, getScheduledEvent, getTailEvent, hasContext, invokeFetchHandler, invokeFetchModule, invokeRouteModules, locals, markResolveStyle, markWorkerStyle, matchFetchRoute, resolveFetchHandler, runWithContext, runWithEventContext, sequence, setLocalSendEmailBindings, vars };
+import { C as vars, S as locals, _ as resolveFetchHandler, a as matchFetchRoute, b as env, c as assertExplicitScheduledHandlerStyle, d as defineQueueHandler, f as defineScheduledHandler, g as markWorkerStyle, h as markResolveStyle, i as invokeRouteModules, l as createResolveFetch, m as invokeFetchModule, n as presignR2Put, o as assertExplicit2ArgStyle, p as invokeFetchHandler, r as createRouteResolve, s as assertExplicitQueueHandlerStyle, t as presignR2Get, u as defineFetchHandler, v as sequence, x as event, y as ctx } from "../_chunks/runtime-RekfD_2X.js";
+export { ContextAccessError, assertExplicit2ArgStyle, assertExplicitQueueHandlerStyle, assertExplicitScheduledHandlerStyle, clearLocalSendEmailBindings, createContextProxy, createDurableObjectAlarmEvent, createDurableObjectFetchEvent, createDurableObjectWebSocketCloseEvent, createDurableObjectWebSocketErrorEvent, createDurableObjectWebSocketMessageEvent, createEmailEvent, createFetchEvent, createQueueEvent, createResolveFetch, createRouteResolve, createScheduledEvent, createTailEvent, ctx, defineFetchHandler, defineQueueHandler, defineScheduledHandler, durableObject, env, event, getContext, getContextOrNull, getDurableObjectAlarmEvent, getDurableObjectEvent, getDurableObjectFetchEvent, getDurableObjectOptions, getDurableObjectWebSocketCloseEvent, getDurableObjectWebSocketErrorEvent, getDurableObjectWebSocketMessageEvent, getEmailEvent, getEventContext, getEventContextOrNull, getFetchEvent, getQueueEvent, getScheduledEvent, getTailEvent, hasContext, invokeFetchHandler, invokeFetchModule, invokeRouteModules, locals, markResolveStyle, markWorkerStyle, matchFetchRoute, presignR2Get, presignR2Put, resolveFetchHandler, runWithContext, runWithEventContext, sequence, setLocalSendEmailBindings, vars };

package/dist/runtime/r2-presign.d.ts

@@ -0,0 +1,164 @@
+/** URL path prefix of the local presign endpoint served by devflare gateways. */
+export declare const R2_PRESIGN_LOCAL_PATH_PREFIX = "/_devflare/r2/presigned/";
+/** Env/var names devflare injects in local dev + tests to enable local presigning. */
+export declare const R2_PRESIGN_SECRET_VAR = "DEVFLARE_R2_PRESIGN_SECRET";
+export declare const R2_PRESIGN_ORIGIN_VAR = "DEVFLARE_R2_PRESIGN_ORIGIN";
+/** Var (injected at deploy compile time) mapping R2 binding names to bucket metadata. */
+export declare const R2_BUCKETS_VAR = "DEVFLARE_R2_BUCKETS";
+/** Default env/secret names for R2 S3 API credentials in production. */
+export declare const R2_ACCOUNT_ID_VAR = "R2_ACCOUNT_ID";
+export declare const R2_ACCESS_KEY_ID_VAR = "R2_ACCESS_KEY_ID";
+export declare const R2_SECRET_ACCESS_KEY_VAR = "R2_SECRET_ACCESS_KEY";
+/**
+ * R2 S3 API credentials used for production presigning.
+ * Create them under Cloudflare Dashboard → R2 → Manage R2 API Tokens.
+ */
+export interface R2PresignCredentials {
+    /** Cloudflare account id that owns the bucket (not secret). */
+    accountId: string;
+    /** R2 S3 API access key id. */
+    accessKeyId: string;
+    /** R2 S3 API secret access key. Store as a Worker secret, never in config. */
+    secretAccessKey: string;
+}
+/**
+ * Options shared by `presignR2Put` and `presignR2Get`.
+ */
+export interface R2PresignBaseOptions {
+    /**
+     * URL lifetime in seconds. Enforced by R2 in production and by the
+     * devflare gateway locally.
+     *
+     * @default 900 (15 minutes). Maximum 604800 (7 days).
+     */
+    expiresIn?: number;
+    /**
+     * Production credentials override. When omitted they are read from `env`
+     * under `R2_ACCOUNT_ID`, `R2_ACCESS_KEY_ID` and `R2_SECRET_ACCESS_KEY`.
+     * Ignored in local dev (the gateway signs with its own per-boot secret).
+     */
+    credentials?: R2PresignCredentials;
+    /**
+     * Production bucket name override. When omitted it is resolved from the
+     * `DEVFLARE_R2_BUCKETS` var that `devflare` injects at deploy compile
+     * time from `bindings.r2`. Ignored in local dev (the binding name routes
+     * directly to the local bucket).
+     */
+    bucketName?: string;
+    /**
+     * Jurisdiction of the production bucket (e.g. `'eu'`), which changes the
+     * S3 endpoint host. When omitted it is resolved from `DEVFLARE_R2_BUCKETS`
+     * (i.e. from the `jurisdiction` field on the R2 binding config).
+     */
+    jurisdiction?: string;
+}
+/**
+ * Options for `presignR2Put`.
+ */
+export interface R2PresignPutOptions extends R2PresignBaseOptions {
+    /**
+     * Content type the uploader must send. Enforced cryptographically in both
+     * environments: it is a signed header in production and part of the
+     * signed canonical string locally, so a mismatching `Content-Type` on the
+     * actual PUT is rejected.
+     */
+    contentType?: string;
+    /**
+     * Exact body size in bytes the uploader must send. Enforced in both
+     * environments (signed `Content-Length` header in production; header +
+     * actual byte count locally). Prefer this over `maxSizeBytes` when the
+     * file size is known up front — it is the only size guarantee real R2
+     * presigned PUTs can enforce. GOTCHA: the client must then send a
+     * fixed-size body (`File`/`Blob`/`ArrayBuffer`); a streamed body carries
+     * no `Content-Length` header and fails the signed-header check.
+     */
+    contentLength?: number;
+    /**
+     * Upper size bound in bytes. Enforced by the devflare gateway locally.
+     * GOTCHA: real R2 presigned PUT URLs CANNOT enforce an upper bound —
+     * only an exact signed `Content-Length` — so in production this value is
+     * advisory. Always confirm the object with a server-side `head()` before
+     * committing quota.
+     */
+    maxSizeBytes?: number;
+}
+/**
+ * Options for `presignR2Get`.
+ */
+export type R2PresignGetOptions = R2PresignBaseOptions;
+/**
+ * A presigned request the browser can execute directly against storage.
+ */
+export interface PresignedR2Request {
+    /** Fully-signed URL to fetch. Treat as opaque; it embeds the signature. */
+    url: string;
+    /** HTTP method the URL was signed for (`HEAD` is also accepted for `GET` URLs). */
+    method: 'PUT' | 'GET';
+    /**
+     * Headers the client MUST send for the signature to validate (e.g. the
+     * pinned `content-type`). `content-length` is intentionally omitted —
+     * browsers set it automatically from the request body and reject manual
+     * assignment.
+     */
+    headers: Record<string, string>;
+    /** Moment the URL stops being accepted. */
+    expiresAt: Date;
+    /** Object key the URL operates on. */
+    key: string;
+    /** `'local'` when served by the devflare gateway, `'remote'` for real R2. */
+    mode: 'local' | 'remote';
+}
+/**
+ * Presign a direct-to-R2 `PUT` URL for a browser (or any HTTP client) upload.
+ *
+ * Resolves to a real R2 S3 presigned URL in production and to a signed
+ * devflare-gateway URL in local dev and the test harness — same call, same
+ * guarantees (signature, expiry, method, content type, size), so upload and
+ * quota logic can be exercised identically in every environment.
+ *
+ * @param env - The platform env (`platform.env` in SvelteKit, `env` in a
+ * Worker handler). Used to detect the local dev context and to read
+ * production credentials/bucket mapping.
+ * @param binding - The R2 binding name from `bindings.r2` (e.g. `'BUCKET'`).
+ * @param key - Object key to upload to. Percent-encoding is handled internally.
+ * @param options - Expiry, enforcement (content type / length / max size) and
+ * production credential overrides.
+ * @returns The presigned request: `url` to PUT to, `headers` the client must
+ * send, and `expiresAt`.
+ * @throws {Error} in production when credentials or the bucket mapping are missing.
+ * @throws {TypeError | RangeError} on invalid inputs.
+ *
+ * @example
+ * ```ts
+ * // Server (SvelteKit endpoint) — reserve quota first, then presign:
+ * const { url, headers } = await presignR2Put(platform.env, 'BUCKET', `media/${id}.png`, {
+ *   expiresIn: 600,
+ *   contentType: file.type,
+ *   contentLength: file.size
+ * })
+ *
+ * // Browser — upload directly to storage:
+ * await fetch(url, { method: 'PUT', body: file, headers })
+ *
+ * // Server — finalize: confirm the object before committing quota:
+ * const head = await platform.env.BUCKET.head(`media/${id}.png`)
+ * ```
+ */
+export declare function presignR2Put(env: Record<string, unknown>, binding: string, key: string, options?: R2PresignPutOptions): Promise<PresignedR2Request>;
+/**
+ * Presign a direct-from-R2 `GET` URL (also valid for `HEAD`) so a browser can
+ * download an object without routing the bytes through the Worker.
+ *
+ * Same dev/prod symmetry as {@link presignR2Put}. Note that browser reads
+ * from real R2 additionally require CORS rules on the bucket itself.
+ *
+ * @param env - The platform env (see {@link presignR2Put}).
+ * @param binding - The R2 binding name from `bindings.r2`.
+ * @param key - Object key to read.
+ * @param options - Expiry and production credential overrides.
+ * @returns The presigned request; `headers` is always empty for GET.
+ * @throws {Error} in production when credentials or the bucket mapping are missing.
+ * @throws {TypeError | RangeError} on invalid inputs.
+ */
+export declare function presignR2Get(env: Record<string, unknown>, binding: string, key: string, options?: R2PresignGetOptions): Promise<PresignedR2Request>;
+//# sourceMappingURL=r2-presign.d.ts.map

package/dist/runtime/r2-presign.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"r2-presign.d.ts","sourceRoot":"","sources":["../../src/runtime/r2-presign.ts"],"names":[],"mappings":"AAuBA,iFAAiF;AACjF,eAAO,MAAM,4BAA4B,6BAA6B,CAAA;AAKtE,sFAAsF;AACtF,eAAO,MAAM,qBAAqB,+BAA+B,CAAA;AACjE,eAAO,MAAM,qBAAqB,+BAA+B,CAAA;AAEjE,yFAAyF;AACzF,eAAO,MAAM,cAAc,wBAAwB,CAAA;AAEnD,wEAAwE;AACxE,eAAO,MAAM,iBAAiB,kBAAkB,CAAA;AAChD,eAAO,MAAM,oBAAoB,qBAAqB,CAAA;AACtD,eAAO,MAAM,wBAAwB,yBAAyB,CAAA;AAY9D;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACpC,+DAA+D;IAC/D,SAAS,EAAE,MAAM,CAAA;IACjB,+BAA+B;IAC/B,WAAW,EAAE,MAAM,CAAA;IACnB,8EAA8E;IAC9E,eAAe,EAAE,MAAM,CAAA;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACpC;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAElB;;;;OAIG;IACH,WAAW,CAAC,EAAE,oBAAoB,CAAA;IAElC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IAEnB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAoB,SAAQ,oBAAoB;IAChE;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IAEpB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IAEtB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;CACrB;AAED;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG,oBAAoB,CAAA;AAEtD;;GAEG;AACH,MAAM,WAAW,kBAAkB;IAClC,2EAA2E;IAC3E,GAAG,EAAE,MAAM,CAAA;IACX,mFAAmF;IACnF,MAAM,EAAE,KAAK,GAAG,KAAK,CAAA;IACrB;;;;;OAKG;IACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B,2CAA2C;IAC3C,SAAS,EAAE,IAAI,CAAA;IACf,sCAAsC;IACtC,GAAG,EAAE,MAAM,CAAA;IACX,6EAA6E;IAC7E,IAAI,EAAE,OAAO,GAAG,QAAQ,CAAA;CACxB;AAqYD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAsB,YAAY,CACjC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,mBAAwB,GAC/B,OAAO,CAAC,kBAAkB,CAAC,CA0B7B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,YAAY,CACjC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,mBAAwB,GAC/B,OAAO,CAAC,kBAAkB,CAAC,CAe7B"}

package/dist/test/index.js

@@ -7,12 +7,12 @@ import { d as getPrimaryAccount, n as getEffectiveAccountId } from "../_chunks/p
 import { A as createTailEvent, D as createFetchEvent, E as createEmailEvent, F as BridgeClient, M as createEnvProxy, O as createQueueEvent, P as setBindingHints, _ as runWithContext, k as createScheduledEvent, v as runWithEventContext, x as createDurableObjectAlarmEvent } from "../_chunks/context-CX50Y2Kb.js";
 import { createLocalSendEmailBinding, wrapEnvSendEmailBindings } from "../utils/send-email.js";
 import { n as __setTestContext, r as env, t as __clearTestContext } from "../_chunks/env-S0_nMVz1.js";
-import { f as invokeFetchModule, h as resolveFetchHandler, r as matchFetchRoute, t as createRouteResolve } from "../_chunks/runtime-DL-Nz3k8.js";
+import { _ as resolveFetchHandler, a as matchFetchRoute, m as invokeFetchModule, r as createRouteResolve } from "../_chunks/runtime-RekfD_2X.js";
 import { i as extractBindingHints, n as createLocalWorkerLoaderBinding, r as disposeLocalWorkerLoaderBindings, t as createLocalHyperdrive } from "../_chunks/local-hyperdrive-CJ90j46O.js";
 import { E as buildTailConsumersConfig, T as buildStreamingTailConsumersConfig, a as hasServiceBindings, i as hasCrossWorkerDOs, m as buildHyperdrivesConfig, o as resolveDOBindings, r as clearBundleCache, s as resolveServiceBindings, t as discoverRoutes, u as buildAnalyticsEngineConfig } from "../_chunks/routes-BMU7ga_l.js";
 import { i as findFiles, t as DEFAULT_DO_PATTERN } from "../_chunks/glob-CmQOvunB.js";
 import { a as isRemoteModeActive, i as getRemoteModeStatus } from "../_chunks/remote-config-D39BY9ji.js";
-import { t as bundleWorkflowEntrypointScript } from "../_chunks/local-workflow-entrypoints-ZIL7apIa.js";
+import { n as bundleWorkflowEntrypointScript, t as R2_PRESIGN_RUNTIME_JS } from "../_chunks/r2-presign-runtime-zTOLS0Ea.js";
 import { a as resolveLocalSecretValuesForBindings, n as buildLocalSecretWrappedBindingConfig } from "../_chunks/local-secrets-6sMstHXw.js";
 import { t as buildLocalBindingShimServiceConfig } from "../_chunks/local-media-bindings-DsAW4AMF.js";
 import { t as canProceedWithTest } from "../_chunks/usage-BBTGzjon.js";
@@ -1574,6 +1574,8 @@ function buildRemoteAndStaticBindings(config) {
 //#region src/test/simple-context-gateway-script.ts
 function buildGatewayScript(bundledCode, wrappers, nativeRpcBindingNames = []) {
 	return `
+${R2_PRESIGN_RUNTIME_JS}
+
 // Bundled transport + DO classes
 ${bundledCode}
 
@@ -1630,6 +1632,10 @@ export default {
 			})
 			return new Response(null, { status: 101, webSocket: client })
 		}
+		const presignResponse = await __devflareR2PresignHandle(request, env, new URL(request.url))
+		if (presignResponse) {
+			return presignResponse
+		}
 		return new Response('Gateway')
 	}
 }
@@ -3332,6 +3338,20 @@ function createDisposeContext(state) {
 //#endregion
 //#region src/test/simple-context-mfconfig.ts
 /**
+* Return `bindings` with the local R2 presign gateway origin added, when (and
+* only when) the presign secret was wired in. The origin can only be built at
+* boot time — the test context picks a fresh port per startup attempt — so
+* this runs next to each `new Miniflare(...)` call rather than in the config
+* builder.
+*/
+function addR2PresignOriginVar(bindings, port) {
+	if (!bindings || typeof bindings.DEVFLARE_R2_PRESIGN_SECRET !== "string") return bindings;
+	return {
+		...bindings,
+		DEVFLARE_R2_PRESIGN_ORIGIN: `http://127.0.0.1:${port}`
+	};
+}
+/**
 * Build the seed Miniflare config for an inline (single-worker) bridge.
 * Pure: no I/O, no closures.
 */
@@ -3484,6 +3504,7 @@ function applyMultiWorkerConfig(mfConfig, config, serviceBindingResolution, doBi
 		...mfConfig.artifacts && { artifacts: mfConfig.artifacts },
 		...mfConfig.secretsStoreSecrets && { secretsStoreSecrets: mfConfig.secretsStoreSecrets },
 		...mfConfig.wrappedBindings && { wrappedBindings: mfConfig.wrappedBindings },
+		...mfConfig.bindings && { bindings: mfConfig.bindings },
 		...mfConfig.email && { email: mfConfig.email },
 		...Object.keys(primaryDurableObjects).length > 0 && { durableObjects: primaryDurableObjects },
 		...mfConfig.serviceBindings || serviceBindingResolution?.primaryServiceBindings ? { serviceBindings: {
@@ -3529,6 +3550,7 @@ function applyMultiWorkerConfig(mfConfig, config, serviceBindingResolution, doBi
 	delete mfConfig.artifacts;
 	delete mfConfig.secretsStoreSecrets;
 	delete mfConfig.wrappedBindings;
+	delete mfConfig.bindings;
 	delete mfConfig.serviceBindings;
 	delete mfConfig.__devflareLocalSecretWorkers;
 	delete mfConfig.__devflareLocalBindingWorkers;
@@ -3597,10 +3619,13 @@ async function startBridgeBackedTestContext(mfConfig) {
 		let miniflare = null;
 		let client = null;
 		try {
-			miniflare = new Miniflare(expandLocalBindingWorkers({
+			const attemptConfig = {
 				...mfConfig,
 				port
-			}));
+			};
+			const bindingsWithOrigin = addR2PresignOriginVar(attemptConfig.bindings, port);
+			if (bindingsWithOrigin) attemptConfig.bindings = bindingsWithOrigin;
+			miniflare = new Miniflare(expandLocalBindingWorkers(attemptConfig));
 			await miniflare.ready;
 			const miniflareBindings = wrapEnvSendEmailBindings(await miniflare.getBindings());
 			client = await connectBridgeClientWithRetry(`ws://localhost:${port}`);
@@ -3636,6 +3661,9 @@ async function bootTestRuntime(mfConfig, usesMultiWorker) {
 	if (usesMultiWorker) {
 		const { Miniflare } = await import("miniflare");
 		const activePort = await getAvailablePort();
+		const primaryWorker = Array.isArray(mfConfig.workers) ? mfConfig.workers[0] : void 0;
+		const primaryBindings = addR2PresignOriginVar(primaryWorker?.bindings, activePort);
+		if (primaryWorker && primaryBindings) primaryWorker.bindings = primaryBindings;
 		const miniflare = new Miniflare({
 			...mfConfig,
 			port: activePort
@@ -3728,6 +3756,11 @@ async function createTestContext(configPath) {
 	if (needsMultiWorkerForServices) serviceBindingResolution = await resolveServiceBindings(config, configDir);
 	if (needsMultiWorkerForDOs) doBindingResolution = await resolveDOBindings(config, configDir);
 	const mfConfig = buildInlineBridgeMfConfig(config, { cwd: configDir });
+	const r2PresignSecret = config.bindings?.r2 ? `${crypto.randomUUID()}${crypto.randomUUID()}` : null;
+	if (r2PresignSecret) mfConfig.bindings = {
+		...mfConfig.bindings,
+		DEVFLARE_R2_PRESIGN_SECRET: r2PresignSecret
+	};
 	const transportFile = resolveTransportFile(configDir, config.files?.transport);
 	if (transportFile) state.transportDecode = await loadTransportDecoders(configDir, transportFile);
 	const gateway = await buildDurableObjectGateway(config, configDir, transportFile);
@@ -3742,6 +3775,10 @@ async function createTestContext(configPath) {
 	state.miniflare = runtime.miniflare;
 	state.miniflareBindings = runtime.miniflareBindings;
 	state.client = runtime.client;
+	if (r2PresignSecret && state.miniflareBindings) {
+		state.miniflareBindings.DEVFLARE_R2_PRESIGN_SECRET = r2PresignSecret;
+		state.miniflareBindings.DEVFLARE_R2_PRESIGN_ORIGIN = `http://127.0.0.1:${activePort}`;
+	}
 	const disposeContext = createDisposeContext(state);
 	const getTestEnv = () => {
 		return new Proxy({}, {

package/dist/test/simple-context-gateway-script.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"simple-context-gateway-script.d.ts","sourceRoot":"","sources":["../../src/test/simple-context-gateway-script.ts"],"names":[],"mappings":"AAAA,wBAAgB,kBAAkB,CACjC,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,qBAAqB,GAAE,MAAM,EAAO,GAClC,MAAM,CAoNR"}
+{"version":3,"file":"simple-context-gateway-script.d.ts","sourceRoot":"","sources":["../../src/test/simple-context-gateway-script.ts"],"names":[],"mappings":"AAEA,wBAAgB,kBAAkB,CACjC,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,qBAAqB,GAAE,MAAM,EAAO,GAClC,MAAM,CA0NR"}

package/dist/test/simple-context-mfconfig.d.ts

@@ -2,6 +2,14 @@ import type { DevflareConfig } from '../config/index.js';
 export interface BuildInlineBridgeMfConfigOptions {
     cwd?: string;
 }
+/**
+ * Return `bindings` with the local R2 presign gateway origin added, when (and
+ * only when) the presign secret was wired in. The origin can only be built at
+ * boot time — the test context picks a fresh port per startup attempt — so
+ * this runs next to each `new Miniflare(...)` call rather than in the config
+ * builder.
+ */
+export declare function addR2PresignOriginVar(bindings: Record<string, unknown> | undefined, port: number): Record<string, unknown> | undefined;
 /**
  * Build the seed Miniflare config for an inline (single-worker) bridge.
  * Pure: no I/O, no closures.

package/dist/test/simple-context-mfconfig.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"simple-context-mfconfig.d.ts","sourceRoot":"","sources":["../../src/test/simple-context-mfconfig.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAU/C,MAAM,WAAW,gCAAgC;IAChD,GAAG,CAAC,EAAE,MAAM,CAAA;CACZ;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CACxC,MAAM,EAAE,cAAc,EACtB,OAAO,GAAE,gCAAqC,GAC5C,GAAG,CA6QL"}
+{"version":3,"file":"simple-context-mfconfig.d.ts","sourceRoot":"","sources":["../../src/test/simple-context-mfconfig.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAU/C,MAAM,WAAW,gCAAgC;IAChD,GAAG,CAAC,EAAE,MAAM,CAAA;CACZ;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACpC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC7C,IAAI,EAAE,MAAM,GACV,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAKrC;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CACxC,MAAM,EAAE,cAAc,EACtB,OAAO,GAAE,gCAAqC,GAC5C,GAAG,CA6QL"}

package/dist/test/simple-context-multi-worker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"simple-context-multi-worker.d.ts","sourceRoot":"","sources":["../../src/test/simple-context-multi-worker.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAC/C,OAAO,KAAK,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAA;AAE3F,KAAK,wBAAwB,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,sBAAsB,CAAC,CAAC,CAAA;AAClF,KAAK,mBAAmB,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC,CAAA;AAExE;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACrC,QAAQ,EAAE,GAAG,EACb,MAAM,EAAE,cAAc,EACtB,wBAAwB,EAAE,wBAAwB,GAAG,IAAI,EACzD,mBAAmB,EAAE,mBAAmB,GAAG,IAAI,GAC7C,IAAI,CA0FN"}
+{"version":3,"file":"simple-context-multi-worker.d.ts","sourceRoot":"","sources":["../../src/test/simple-context-multi-worker.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAC/C,OAAO,KAAK,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAA;AAE3F,KAAK,wBAAwB,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,sBAAsB,CAAC,CAAC,CAAA;AAClF,KAAK,mBAAmB,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC,CAAA;AAExE;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACrC,QAAQ,EAAE,GAAG,EACb,MAAM,EAAE,cAAc,EACtB,wBAAwB,EAAE,wBAAwB,GAAG,IAAI,EACzD,mBAAmB,EAAE,mBAAmB,GAAG,IAAI,GAC7C,IAAI,CA+FN"}

package/dist/test/simple-context-runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"simple-context-runtime.d.ts","sourceRoot":"","sources":["../../src/test/simple-context-runtime.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAKpD,MAAM,WAAW,iBAAiB;IACjC,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,GAAG,CAAA;IACd,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC1C,8CAA8C;IAC9C,MAAM,EAAE,YAAY,GAAG,IAAI,CAAA;CAC3B;AAED;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CACpC,QAAQ,EAAE,GAAG,EACb,eAAe,EAAE,OAAO,GACtB,OAAO,CAAC,iBAAiB,CAAC,CAoB5B"}
+{"version":3,"file":"simple-context-runtime.d.ts","sourceRoot":"","sources":["../../src/test/simple-context-runtime.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAMpD,MAAM,WAAW,iBAAiB;IACjC,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,GAAG,CAAA;IACd,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC1C,8CAA8C;IAC9C,MAAM,EAAE,YAAY,GAAG,IAAI,CAAA;CAC3B;AAED;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CACpC,QAAQ,EAAE,GAAG,EACb,eAAe,EAAE,OAAO,GACtB,OAAO,CAAC,iBAAiB,CAAC,CA6B5B"}

package/dist/test/simple-context-startup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"simple-context-startup.d.ts","sourceRoot":"","sources":["../../src/test/simple-context-startup.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAS/C,MAAM,WAAW,8BAA8B;IAC9C,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,YAAY,CAAA;IACpB,SAAS,EAAE,GAAG,CAAA;IACd,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC1C;AAED,wBAAgB,kCAAkC,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAa1E;AAUD,wBAAsB,4BAA4B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CA2BrF;AAiDD,wBAAsB,4BAA4B,CACjD,QAAQ,EAAE,GAAG,GACX,OAAO,CAAC,8BAA8B,CAAC,CAiDzC"}
+{"version":3,"file":"simple-context-startup.d.ts","sourceRoot":"","sources":["../../src/test/simple-context-startup.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAU/C,MAAM,WAAW,8BAA8B;IAC9C,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,YAAY,CAAA;IACpB,SAAS,EAAE,GAAG,CAAA;IACd,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC1C;AAED,wBAAgB,kCAAkC,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAa1E;AAUD,wBAAsB,4BAA4B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CA2BrF;AAiDD,wBAAsB,4BAA4B,CACjD,QAAQ,EAAE,GAAG,GACX,OAAO,CAAC,8BAA8B,CAAC,CAkDzC"}

package/dist/test/simple-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"simple-context.d.ts","sourceRoot":"","sources":["../../src/test/simple-context.ts"],"names":[],"mappings":"AA2EA;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAiH1E;AAED;;GAEG;AACH,MAAM,WAAW,OAAO;IACvB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACxB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,WAAW,GAAG,UAAU,CAAC,WAAW,CAAA;AAEhD,OAAO,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAA"}
+{"version":3,"file":"simple-context.d.ts","sourceRoot":"","sources":["../../src/test/simple-context.ts"],"names":[],"mappings":"AA2EA;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAmI1E;AAED;;GAEG;AACH,MAAM,WAAW,OAAO;IACvB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACxB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,WAAW,GAAG,UAAU,CAAC,WAAW,CAAA;AAEhD,OAAO,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAA"}

package/dist/vite/index.js

@@ -1,2 +1,2 @@
-import { a as devflarePlugin, c as getDevflareConfigs, i as writeGeneratedViteConfig, n as resolveEffectiveViteProject, o as getPluginContext, r as resolveViteUserConfig, s as getCloudflareConfig, t as hasInlineViteConfig } from "../_chunks/vite-De7bGxC6.js";
+import { a as devflarePlugin, c as getDevflareConfigs, i as writeGeneratedViteConfig, n as resolveEffectiveViteProject, o as getPluginContext, r as resolveViteUserConfig, s as getCloudflareConfig, t as hasInlineViteConfig } from "../_chunks/vite-CtvgOi1c.js";
 export { devflarePlugin as default, devflarePlugin, getCloudflareConfig, getDevflareConfigs, getPluginContext, hasInlineViteConfig, resolveEffectiveViteProject, resolveViteUserConfig, writeGeneratedViteConfig };

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "devflare",
-	"version": "1.0.0-next.59",
+	"version": "1.0.0-next.60",
 	"description": "Devflare is a developer-first toolkit for Cloudflare Workers that sits on top of Miniflare and Wrangler-compatible config",
 	"repository": {
 		"type": "git",
@@ -84,7 +84,7 @@
 		"test:unit": "bun test tests/unit",
 		"test:coverage": "bun test tests/unit --coverage",
 		"test:integration:control": "bun test tests/integration/cli tests/integration/examples tests/integration/package-entry tests/integration/vite",
-		"test:integration:bridge": "bun test tests/integration/bridge/bridge-proxy.test.ts --parallel=1 --max-concurrency=1 && bun test tests/integration/bridge/case18-do.test.ts --parallel=1 --max-concurrency=1 && bun test tests/integration/bridge/durable-object.test.ts --parallel=1 --max-concurrency=1 && bun test tests/integration/bridge/do-websocket.test.ts --parallel=1 --max-concurrency=1 && bun test tests/integration/bridge/miniflare.test.ts --parallel=1 --max-concurrency=1 && bun test tests/integration/bridge/r2-transfer.test.ts --parallel=1 --max-concurrency=1",
+		"test:integration:bridge": "bun test tests/integration/bridge/bridge-proxy.test.ts --parallel=1 --max-concurrency=1 && bun test tests/integration/bridge/case18-do.test.ts --parallel=1 --max-concurrency=1 && bun test tests/integration/bridge/durable-object.test.ts --parallel=1 --max-concurrency=1 && bun test tests/integration/bridge/do-websocket.test.ts --parallel=1 --max-concurrency=1 && bun test tests/integration/bridge/miniflare.test.ts --parallel=1 --max-concurrency=1 && bun test tests/integration/bridge/r2-transfer.test.ts --parallel=1 --max-concurrency=1 && bun test tests/integration/bridge/r2-presign.test.ts --parallel=1 --max-concurrency=1",
 		"test:integration:test-context": "bun test tests/integration/test-context --parallel=1 --max-concurrency=1",
 		"test:integration:dev-server": "bun test tests/integration/dev-server --parallel=1 --max-concurrency=1",
 		"test:integration:shims": "bun test tests/integration/shims --parallel=1 --max-concurrency=1",
@@ -95,6 +95,7 @@
 	},
 	"dependencies": {
 		"@puppeteer/browsers": "^2.10.3",
+		"aws4fetch": "^1.0.20",
 		"c12": "^2.0.1",
 		"chokidar": "^4.0.3",
 		"citty": "^0.1.6",

package/dist/_chunks/local-workflow-entrypoints-ZIL7apIa.js

@@ -1,90 +0,0 @@
-import { x as normalizeWorkflowBinding } from "./schema-normalization-Zgm4W6O6.js";
-import { i as findFiles, r as DEFAULT_WORKFLOW_PATTERN } from "./glob-CmQOvunB.js";
-import { t as bundleWorkerEntry } from "./worker-bundler-dTTnYU3n.js";
-import { mkdir, readFile, writeFile } from "node:fs/promises";
-import { join, relative, resolve } from "pathe";
-//#region src/workflows/local-workflow-entrypoints.ts
-function findExportedClasses(code) {
-	const classes = [];
-	const classPattern = /export\s+class\s+(\w+)/g;
-	let match = classPattern.exec(code);
-	while (match !== null) {
-		classes.push(match[1]);
-		match = classPattern.exec(code);
-	}
-	return classes;
-}
-function toImportSpecifier(fromDir, filePath) {
-	const relativePath = relative(fromDir, filePath).replace(/\\/g, "/");
-	return relativePath.startsWith(".") ? relativePath : `./${relativePath}`;
-}
-async function discoverWorkflowClasses(config, configDir) {
-	const classToFilePath = /* @__PURE__ */ new Map();
-	const workflowPatternConfig = config.files?.workflows;
-	const workflowPattern = typeof workflowPatternConfig === "string" ? workflowPatternConfig : DEFAULT_WORKFLOW_PATTERN;
-	if (workflowPatternConfig === false) return classToFilePath;
-	const files = await findFiles(workflowPattern, { cwd: configDir });
-	for (const filePath of files) try {
-		const code = await readFile(filePath, "utf-8");
-		for (const className of findExportedClasses(code)) classToFilePath.set(className, filePath);
-	} catch {}
-	return classToFilePath;
-}
-async function resolveLocalWorkflowEntrypoints(config, configDir) {
-	const workflows = config.bindings?.workflows;
-	if (!workflows || Object.keys(workflows).length === 0) return [];
-	const classToFilePath = await discoverWorkflowClasses(config, configDir);
-	const entrypoints = [];
-	for (const [bindingName, binding] of Object.entries(workflows)) {
-		const normalized = normalizeWorkflowBinding(binding);
-		if (normalized.scriptName) continue;
-		const scriptPath = classToFilePath.get(normalized.className);
-		if (!scriptPath) throw new Error(`Workflow binding ${bindingName} (className: '${normalized.className}') not found.\nEither set files.workflows to match the workflow source file, or set scriptName when the workflow lives in another worker.`);
-		entrypoints.push({
-			bindingName,
-			className: normalized.className,
-			scriptPath
-		});
-	}
-	return entrypoints;
-}
-function buildWorkflowVirtualEntry(entrypoints, entryDir) {
-	const imports = entrypoints.map((entrypoint, index) => {
-		const importName = `__DevflareWorkflow${index}`;
-		const importPath = toImportSpecifier(entryDir, entrypoint.scriptPath);
-		return {
-			importName,
-			className: entrypoint.className,
-			line: `import { ${entrypoint.className} as ${importName} } from '${importPath}'`
-		};
-	});
-	const exports = imports.map((entrypoint) => {
-		return `export { ${entrypoint.importName} as ${entrypoint.className} }`;
-	});
-	return [
-		...imports.map((entrypoint) => entrypoint.line),
-		"",
-		...exports
-	].join("\n");
-}
-async function bundleWorkflowEntrypointScript(config, configDir, options = {}) {
-	const entrypoints = await resolveLocalWorkflowEntrypoints(config, configDir);
-	if (entrypoints.length === 0) return "";
-	const entryDir = resolve(configDir, ".devflare", "workflow-entrypoints");
-	const entryPath = join(entryDir, "__entry.ts");
-	const outFile = join(entryDir, "index.js");
-	await mkdir(entryDir, { recursive: true });
-	await writeFile(entryPath, buildWorkflowVirtualEntry(entrypoints, entryDir));
-	await bundleWorkerEntry({
-		cwd: configDir,
-		inputFile: entryPath,
-		outFile,
-		rolldownOptions: config.rolldown?.options,
-		sourcemap: config.rolldown?.sourcemap,
-		minify: config.rolldown?.minify,
-		logger: options.logger
-	});
-	return await readFile(outFile, "utf-8");
-}
-//#endregion
-export { bundleWorkflowEntrypointScript as t };