devflare 1.0.0-next.6 → 1.0.0-next.61

package/dist/_chunks/dev-Buf8Lnt-.js

@@ -0,0 +1,3553 @@
+import { c as getDevflareDotenvPaths, d as resolveConfigEnvVars, o as EnvVarResolutionError } from "./preview-C3Cdr8an.js";
+import { i as resolveConfigPath, r as loadConfig } from "./loader-E_UGyTrJ.js";
+import { g as normalizeR2Binding, n as getLocalKVNamespaceIdentifier, r as getSingleBrowserBindingName, t as getLocalD1DatabaseIdentifier } from "./schema-normalization-Zgm4W6O6.js";
+import { t as applyLocalDevVarsToConfig } from "./local-dev-vars-CTSa-wvF.js";
+import { a as cyanBold, f as logLine, g as yellow, o as dim, r as createCliTheme } from "./ui-BUoZApvE.js";
+import { clearLocalSendEmailBindings, setLocalSendEmailBindings } from "../utils/send-email.js";
+import { C as buildSendEmailConfig, D as buildVersionMetadataConfig, E as buildTailConsumersConfig, O as buildWorkerLoadersConfig, S as buildSecretsStoreConfig, T as buildStreamingTailConsumersConfig, _ as buildMtlsCertificatesConfig, b as buildQueueProducers, c as buildAiSearchInstancesConfig, d as buildArtifactsConfig, f as buildDispatchNamespacesConfig, g as buildMediaConfig, h as buildImagesConfig, k as buildWorkflowsConfig, l as buildAiSearchNamespacesConfig, m as buildHyperdrivesConfig, n as getRouteDirectoryCandidate, p as buildFlagshipConfig, s as resolveServiceBindings, t as discoverRoutes, u as buildAnalyticsEngineConfig, v as buildPipelinesConfig, w as buildStreamConfig, x as buildRateLimitsConfig, y as buildQueueConsumers } from "./routes-BMU7ga_l.js";
+import { r as transformDurableObject } from "./durable-object-DMtH0XYX.js";
+import { i as findFiles } from "./glob-CmQOvunB.js";
+import { d as DEFAULT_FETCH_ENTRY_FILES, f as DEFAULT_QUEUE_ENTRY_FILES, g as discoverDurableObjectFiles, h as resolveWorkerSurfacePaths, i as writeGeneratedViteConfig, l as prepareComposedWorkerEntrypoint, m as hasWorkerSurfacePaths, n as resolveEffectiveViteProject, p as DEFAULT_SCHEDULED_ENTRY_FILES, u as DEFAULT_EMAIL_ENTRY_FILES } from "./vite-CtvgOi1c.js";
+import { a as createWorkerdBundlerDefaults, i as writeWorkerCompatibleBundle, n as ensureDebugShim, r as resolveWorkerCompatibleRolldownConfig, t as bundleWorkerEntry } from "./worker-bundler-dTTnYU3n.js";
+import { n as bundleWorkflowEntrypointScript, t as R2_PRESIGN_RUNTIME_JS } from "./r2-presign-runtime-zTOLS0Ea.js";
+import { n as buildLocalSecretWrappedBindingConfig } from "./local-secrets-6sMstHXw.js";
+import { t as buildLocalBindingShimServiceConfig } from "./local-media-bindings-DsAW4AMF.js";
+import { i as waitForViteReady, n as resolveViteMode, r as stopSpawnedProcessTree, t as detectViteProject } from "./vite-utils-OVLMV605.js";
+import { existsSync } from "node:fs";
+import { dirname, relative, resolve } from "pathe";
+import { exec, spawn } from "node:child_process";
+import { homedir } from "node:os";
+import { join as join$1 } from "node:path";
+import { createConsola } from "consola";
+import picomatch from "picomatch";
+import { createHash } from "node:crypto";
+import { promisify } from "node:util";
+import { createInterface } from "node:readline";
+import { createServer } from "node:http";
+import { Browser, detectBrowserPlatform, install, resolveBuildId } from "@puppeteer/browsers";
+import puppeteerCore from "puppeteer-core";
+//#region src/bundler/do-bundler.ts
+/**
+* Convert PascalCase class name to SCREAMING_SNAKE_CASE binding name
+*/
+function classToBindingName(className) {
+	return className.replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/([A-Z]+)([A-Z][a-z])/g, "$1_$2").toUpperCase();
+}
+/**
+* Discover DO classes from a glob pattern.
+* Respects .gitignore automatically.
+*/
+async function discoverDOs(cwd, pattern) {
+	const discovered = [];
+	const files = await discoverDurableObjectFiles(cwd, pattern);
+	for (const [filePath, classNames] of files) for (const className of classNames) discovered.push({
+		filePath,
+		className,
+		bindingName: classToBindingName(className)
+	});
+	return discovered;
+}
+/**
+* Strip @durableObject decorator and its import from source code
+* For dev mode, we just need to remove the decorator syntax - the DO class works as-is
+*/
+function stripDecoratorSyntax(code) {
+	let result = code;
+	result = result.replace(/@durableObject\s*\([^)]*\)\s*\n?\s*(?=export\s+class)/g, "");
+	result = result.replace(/import\s*\{([^}]*)\bdurableObject\b[^}]*\}\s*from\s*['"]devflare\/runtime['"]\s*;?/g, (match, imports) => {
+		const cleanedImports = imports.split(",").map((s) => s.trim()).filter((s) => !s.startsWith("durableObject")).join(", ");
+		if (cleanedImports.trim() === "") return "";
+		return `import { ${cleanedImports} } from 'devflare/runtime'`;
+	});
+	return result;
+}
+/**
+* Bundle a single DO file using Rolldown
+*
+* Strategy:
+* 1. Read the source file
+* 2. Strip @durableObject decorator (not needed at runtime - just a marker)
+* 3. Feed the cleaned code to Rolldown through a virtual-entry plugin whose id
+*    sits in the source directory, so relative imports resolve identically to
+*    the original Durable Object module — without ever writing a temp file
+*    next to user source.
+* 4. Bundle with Rolldown.
+*/
+async function bundleDOFile(sourcePath, className, outDir, cwd, bundleOptions) {
+	const fs = await import("node:fs/promises");
+	await fs.mkdir(outDir, { recursive: true });
+	const sourceCode = await fs.readFile(sourcePath, "utf-8");
+	const entryCode = `${(await transformDurableObject(sourceCode, sourcePath))?.code ?? stripDecoratorSyntax(sourceCode)}
+
+// Default export for worker (required by Miniflare)
+export default {
+	async fetch(request) {
+		return new Response('DO Worker for ${className}', { status: 200 });
+	}
+};
+`;
+	const virtualEntryId = resolve(dirname(sourcePath), `.devflare-do-${className}.virtual.ts`);
+	const classOutDir = resolve(outDir, className);
+	try {
+		await fs.rm(classOutDir, {
+			recursive: true,
+			force: true
+		});
+	} catch {}
+	await fs.mkdir(classOutDir, { recursive: true });
+	const debugShimPath = await ensureDebugShim(outDir);
+	const virtualEntryPlugin = {
+		name: "devflare-do-virtual-entry",
+		resolveId(id) {
+			if (id === virtualEntryId) return virtualEntryId;
+			return null;
+		},
+		load(id) {
+			if (id === virtualEntryId) return entryCode;
+			return null;
+		}
+	};
+	const userRolldownOptions = bundleOptions?.rolldownOptions;
+	const userPlugins = userRolldownOptions?.plugins;
+	const mergedPlugins = userPlugins === void 0 ? [virtualEntryPlugin] : Array.isArray(userPlugins) ? [virtualEntryPlugin, ...userPlugins] : [virtualEntryPlugin, userPlugins];
+	const outFile = resolve(classOutDir, "index.js");
+	const defaults = createWorkerdBundlerDefaults();
+	const { inputOptions, outputOptions } = resolveWorkerCompatibleRolldownConfig({
+		cwd,
+		inputFile: virtualEntryId,
+		outFile,
+		...defaults,
+		platform: "neutral",
+		alias: { debug: debugShimPath },
+		rolldownOptions: {
+			...userRolldownOptions,
+			plugins: mergedPlugins
+		},
+		sourcemap: bundleOptions?.sourcemap ?? defaults.sourcemap,
+		minify: bundleOptions?.minify ?? defaults.minify,
+		inlineDynamicImports: true,
+		defaultTsconfigMode: "always"
+	});
+	await writeWorkerCompatibleBundle({
+		inputOptions,
+		outputOptions,
+		outFile
+	});
+	return resolve(classOutDir, "index.js");
+}
+/**
+* Bundle all discovered DOs
+*/
+async function bundleAllDOs(discovered, outDir, cwd, logger, bundleOptions) {
+	await import("node:fs/promises");
+	const bundles = /* @__PURE__ */ new Map();
+	const classes = /* @__PURE__ */ new Map();
+	const sourceFiles = /* @__PURE__ */ new Map();
+	const errors = [];
+	for (const do_ of discovered) {
+		const existing = sourceFiles.get(do_.filePath) || [];
+		existing.push(do_.className);
+		sourceFiles.set(do_.filePath, existing);
+	}
+	for (const do_ of discovered) try {
+		logger?.debug(`Bundling ${do_.className} from ${do_.filePath}`);
+		const outFile = await bundleDOFile(do_.filePath, do_.className, outDir, cwd, bundleOptions);
+		bundles.set(do_.bindingName, outFile);
+		classes.set(do_.bindingName, do_.className);
+		logger?.debug(`  → ${outFile}`);
+	} catch (error) {
+		const err = error instanceof Error ? error : new Error(String(error));
+		errors.push(err);
+		logger?.error(`Failed to bundle ${do_.className}:`, err.message);
+	}
+	return {
+		bundles,
+		classes,
+		sourceFiles,
+		errors
+	};
+}
+/**
+* Create a DO bundler with watch support
+*/
+function createDOBundler(options) {
+	const { cwd, pattern, outDir, logger, onRebuild, rolldownOptions, sourcemap, minify } = options;
+	let result = {
+		bundles: /* @__PURE__ */ new Map(),
+		classes: /* @__PURE__ */ new Map(),
+		sourceFiles: /* @__PURE__ */ new Map(),
+		errors: []
+	};
+	let watcher = null;
+	let chokidarWatcher = null;
+	/**
+	* Perform initial build
+	*/
+	async function build() {
+		const discovered = await discoverDOs(cwd, pattern);
+		if (discovered.length === 0) {
+			logger?.debug("No DOs found matching pattern:", pattern);
+			return result;
+		}
+		logger?.info(`Found ${discovered.length} Durable Object(s)`);
+		for (const do_ of discovered) logger?.info(`  • ${do_.className} → ${do_.bindingName}`);
+		result = await bundleAllDOs(discovered, outDir, cwd, logger, {
+			rolldownOptions,
+			sourcemap,
+			minify
+		});
+		if (result.errors.length === 0) logger?.success(`Bundled ${result.bundles.size} DO(s) to ${outDir}`);
+		return result;
+	}
+	/**
+	* Watch for changes and rebuild
+	*
+	* Strategy: Watch parent directories of DO files with a filter for matching files.
+	* This allows detection of new DO files created during dev.
+	* Uses compiled picomatch for fast pattern matching instead of re-globbing on every event.
+	*/
+	async function watch() {
+		const chokidar = await import("chokidar");
+		const files = await findFiles(pattern, { cwd });
+		let dirsToWatch;
+		if (files.length > 0) dirsToWatch = [...new Set(files.map((f) => dirname(f)))];
+		else {
+			const patternDir = dirname(pattern);
+			const absolutePatternDir = resolve(cwd, patternDir === "." ? "" : patternDir) || cwd;
+			dirsToWatch = [absolutePatternDir];
+			logger?.debug(`No DO files yet, watching pattern directory: ${absolutePatternDir}`);
+		}
+		logger?.info(`Watching ${files.length} DO file(s) in ${dirsToWatch.length} director(ies)...`);
+		const isWindows = process.platform === "win32";
+		chokidarWatcher = chokidar.watch(dirsToWatch, {
+			ignoreInitial: true,
+			usePolling: isWindows,
+			interval: isWindows ? 300 : void 0,
+			awaitWriteFinish: {
+				stabilityThreshold: 100,
+				pollInterval: 50
+			},
+			depth: 0
+		});
+		const normalizePath = (p) => {
+			let normalized = p.replace(/\\/g, "/");
+			if (isWindows && /^[a-zA-Z]:/.test(normalized)) normalized = normalized[0].toLowerCase() + normalized.slice(1);
+			return normalized;
+		};
+		const isMatch = picomatch(pattern, {
+			dot: true,
+			matchBase: false
+		});
+		const matchesPattern = (filePath) => {
+			const normalizedPath = normalizePath(filePath);
+			return isMatch(relative(normalizePath(cwd), normalizedPath));
+		};
+		let isRebuilding = false;
+		let pendingRebuild = null;
+		let rebuildTimeout = null;
+		const scheduleRebuild = (changedPath) => {
+			if (rebuildTimeout) clearTimeout(rebuildTimeout);
+			rebuildTimeout = setTimeout(() => {
+				triggerRebuild(changedPath);
+			}, 150);
+		};
+		const triggerRebuild = async (changedPath) => {
+			if (isRebuilding) {
+				pendingRebuild = changedPath;
+				logger?.debug(`Rebuild already in progress, queuing: ${changedPath}`);
+				return;
+			}
+			isRebuilding = true;
+			try {
+				logger?.info(`DO file changed: ${changedPath}`);
+				logger?.info("Rebuilding DOs...");
+				const startTime = Date.now();
+				result = await build();
+				const elapsed = Date.now() - startTime;
+				logger?.success(`DO rebuild complete (${elapsed}ms)`);
+				await onRebuild?.(result);
+			} catch (error) {
+				logger?.error("DO rebuild failed:", error);
+			} finally {
+				isRebuilding = false;
+				if (pendingRebuild) {
+					const nextPath = pendingRebuild;
+					pendingRebuild = null;
+					triggerRebuild(nextPath);
+				}
+			}
+		};
+		chokidarWatcher.on("change", (filePath) => {
+			if (matchesPattern(filePath)) {
+				logger?.debug(`File changed: ${filePath}`);
+				scheduleRebuild(filePath);
+			}
+		});
+		chokidarWatcher.on("add", (filePath) => {
+			if (matchesPattern(filePath)) {
+				logger?.debug(`File added: ${filePath}`);
+				scheduleRebuild(filePath);
+			}
+		});
+		chokidarWatcher.on("unlink", (filePath) => {
+			if (matchesPattern(filePath)) {
+				logger?.debug(`File removed: ${filePath}`);
+				scheduleRebuild(filePath);
+			}
+		});
+		chokidarWatcher.on("ready", () => {
+			logger?.info("DO file watcher ready");
+		});
+		chokidarWatcher.on("error", (error) => {
+			logger?.error("DO file watcher error:", error);
+		});
+	}
+	/**
+	* Stop watching
+	*/
+	async function close() {
+		if (watcher) {
+			await watcher.close();
+			watcher = null;
+		}
+		if (chokidarWatcher) {
+			await chokidarWatcher.close();
+			chokidarWatcher = null;
+		}
+	}
+	/**
+	* Get the latest result
+	*/
+	function getResult() {
+		return result;
+	}
+	return {
+		build,
+		watch,
+		close,
+		getResult
+	};
+}
+//#endregion
+//#region src/dev-server/miniflare-log.ts
+const ANSI_ESCAPE_REGEX = /\u001B\[[0-9;]*m/g;
+const COMPATIBILITY_DATE_FALLBACK_REGEX = /^The latest compatibility date supported by the installed Cloudflare Workers Runtime is "([^"]+)", but you've requested "([^"]+)"\. Falling back to "([^"]+)"\.\.\.$/;
+const MINIFLARE_LOG_LEVEL_FALLBACKS = {
+	WARN: 2,
+	DEBUG: 4
+};
+function normalizeMiniflareMessage(message) {
+	return message.replace(ANSI_ESCAPE_REGEX, "").replace(/\s+/g, " ").trim();
+}
+function formatCompatibilityDateFallbackNotice(message) {
+	const normalizedMessage = normalizeMiniflareMessage(message);
+	const match = COMPATIBILITY_DATE_FALLBACK_REGEX.exec(normalizedMessage);
+	if (!match) return null;
+	const [, _supportedDate, requestedDate, fallbackDate] = match;
+	return `Using latest supported Cloudflare Workers Runtime compatibility date ${fallbackDate} (requested ${requestedDate})`;
+}
+function resolveMiniflareLogLevel(logLevel, levelName) {
+	return logLevel?.[levelName] ?? MINIFLARE_LOG_LEVEL_FALLBACKS[levelName];
+}
+function createMiniflareLog(BaseLog, logLevel, levelName, logger) {
+	if (!BaseLog) return;
+	return createCompatibilityAwareMiniflareLog(BaseLog, resolveMiniflareLogLevel(logLevel, levelName), logger);
+}
+function createCompatibilityAwareMiniflareLog(BaseLog, level, logger) {
+	const log = new BaseLog(level);
+	const originalWarn = log.warn.bind(log);
+	const originalInfo = log.info.bind(log);
+	log.warn = (message) => {
+		const notice = formatCompatibilityDateFallbackNotice(message);
+		if (!notice) {
+			originalWarn(message);
+			return;
+		}
+		if (logger) {
+			logger.info(notice);
+			return;
+		}
+		originalInfo(notice);
+	};
+	return log;
+}
+//#endregion
+//#region src/bridge/gateway-runtime.ts
+/**
+* Shared gateway helpers (base64, R2 serializers, email) and the RPC method
+* dispatcher. Designed to be embedded verbatim at the top level of a worker
+* module. All symbols are declared with `function`/`const` so they are
+* hoisted in both embedding sites.
+*/
+const GATEWAY_RUNTIME_JS = `
+const RAW_EMAIL = 'EmailMessage::raw'
+
+// Inline body cap for proxied DO/service-fetch responses. Matches
+// HTTP_TRANSFER_THRESHOLD in wire.ts (512 KB). A larger body would exceed
+// workerd's ~1 MB WebSocket message limit once base64-encoded into the rpc.ok
+// frame, so it is rejected with a clear error rather than silently truncated.
+const HTTP_TRANSFER_THRESHOLD = 512 * 1024
+
+function arrayBufferToBase64(buffer) {
+	const bytes = new Uint8Array(buffer)
+	let binary = ''
+	for (let i = 0; i < bytes.byteLength; i++) binary += String.fromCharCode(bytes[i])
+	return btoa(binary)
+}
+
+function base64ToArrayBuffer(base64) {
+	const binary = atob(base64)
+	const bytes = new Uint8Array(binary.length)
+	for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i)
+	return bytes.buffer
+}
+
+// Binary WsData frame codec (10-byte header: kind:u8, id:u32 LE, seq:u32 LE,
+// flags:u8 + payload). MUST match wire.ts encodeBinaryFrame/decodeBinaryFrame so
+// the bridge client and this gateway agree on the WS-data wire format
+// (BinaryKind.WsData = 2, BinaryFlags.TEXT = 2).
+function encodeWsDataFrame(wid, flags, payload) {
+	const frame = new Uint8Array(10 + payload.byteLength)
+	const view = new DataView(frame.buffer)
+	view.setUint8(0, 2)
+	view.setUint32(1, wid, true)
+	view.setUint32(5, 0, true)
+	view.setUint8(9, flags)
+	frame.set(payload, 10)
+	return frame
+}
+
+function decodeWsDataFrame(buffer) {
+	const bytes = new Uint8Array(buffer)
+	if (bytes.byteLength < 10) return null
+	const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength)
+	return {
+		kind: view.getUint8(0),
+		id: view.getUint32(1, true),
+		flags: view.getUint8(9),
+		payload: bytes.subarray(10)
+	}
+}
+
+function serializeR2Object(obj) {
+	if (!obj) return null
+	return {
+		__type: 'R2Object',
+		key: obj.key,
+		version: obj.version,
+		size: obj.size,
+		etag: obj.etag,
+		httpEtag: obj.httpEtag,
+		checksums: obj.checksums,
+		uploaded: obj.uploaded?.toISOString(),
+		httpMetadata: obj.httpMetadata,
+		customMetadata: obj.customMetadata,
+		range: obj.range,
+		storageClass: obj.storageClass
+	}
+}
+
+function serializeR2ObjectBody(obj, bodyData) {
+	if (!obj) return null
+	return {
+		__type: 'R2ObjectBody',
+		key: obj.key,
+		version: obj.version,
+		size: obj.size,
+		etag: obj.etag,
+		httpEtag: obj.httpEtag,
+		checksums: obj.checksums,
+		uploaded: obj.uploaded?.toISOString(),
+		httpMetadata: obj.httpMetadata,
+		customMetadata: obj.customMetadata,
+		range: obj.range,
+		storageClass: obj.storageClass,
+		bodyData
+	}
+}
+
+function serializeR2Objects(result) {
+	if (!result) return null
+	return {
+		objects: result.objects.map(serializeR2Object),
+		truncated: result.truncated,
+		cursor: result.cursor,
+		delimitedPrefixes: result.delimitedPrefixes
+	}
+}
+
+async function serializeResponse(response) {
+	let body = null
+	if (response.body) {
+		const bytes = await response.arrayBuffer()
+		if (bytes.byteLength > HTTP_TRANSFER_THRESHOLD) {
+			throw new Error(
+				'[devflare][bridge] Response body (' + bytes.byteLength + ' bytes) exceeds the '
+				+ HTTP_TRANSFER_THRESHOLD + '-byte inline limit. DO and service-binding fetch responses '
+				+ 'are delivered inline over the bridge WebSocket and cannot be streamed locally; keep '
+				+ 'proxied response bodies under the limit (large R2 objects are exempt — read them through '
+				+ 'the R2 binding, which uses the HTTP transfer side-channel).'
+			)
+		}
+		if (bytes.byteLength > 0) {
+			body = { type: 'bytes', data: arrayBufferToBase64(bytes) }
+		}
+	}
+	return {
+		status: response.status,
+		statusText: response.statusText,
+		headers: [...response.headers.entries()],
+		body
+	}
+}
+
+function deserializeRequest(serializedReq) {
+	return new Request(serializedReq.url, {
+		method: serializedReq.method,
+		headers: serializedReq.headers,
+		body: serializedReq.body?.type === 'bytes'
+			? base64ToArrayBuffer(serializedReq.body.data)
+			: undefined,
+		redirect: serializedReq.redirect
+	})
+}
+
+function createEmailMessageRaw(raw) {
+	if (typeof raw === 'string' || raw instanceof ReadableStream) {
+		return raw
+	}
+	if (raw instanceof ArrayBuffer || raw instanceof Uint8Array) {
+		return new Response(raw).body
+	}
+	throw new Error('Unsupported EmailMessage raw payload')
+}
+
+function isDurableObjectNamespace(binding) {
+	return !!binding
+		&& typeof binding.idFromName === 'function'
+		&& typeof binding.idFromString === 'function'
+		&& typeof binding.newUniqueId === 'function'
+}
+
+/**
+ * Resolve a (possibly jurisdiction-scoped) DurableObjectNamespace.
+ * Forwards the jurisdiction faithfully when the binding supports it
+ * (real Cloudflare), and degrades to the plain binding otherwise
+ * (miniflare/workerd local emulation, which does not pin jurisdictions).
+ */
+function resolveDoNamespace(binding, jurisdiction) {
+	if (jurisdiction && typeof binding.jurisdiction === 'function') {
+		return binding.jurisdiction(jurisdiction)
+	}
+	return binding
+}
+
+// Dispatch a single Durable Object RPC method call to its stub.
+//
+// A DO that extends DurableObject (from cloudflare:workers) exposes its methods
+// as native RPC on the stub, so the method is invoked DIRECTLY as
+// stub[method](...args) — exactly as on real Cloudflare. This is the ONLY
+// correct path for a DO that ALSO defines its own fetch(): routing the call
+// through fetch() would hand devflare's internal _rpc probe to the user handler,
+// which may reject it (e.g. a websocket-only fetch() returning 426) and yield a
+// non-JSON body that then fails to parse (the reported crash).
+//
+// The fetch _rpc convention is kept only as a fallback for DOs that are not
+// RPC-enabled: the stub proxies every property as callable, so such a DO only
+// reveals itself when the native call throws "does not support RPC".
+async function callDurableObjectRpc(stub, methodName, args) {
+	if (typeof stub[methodName] === 'function') {
+		try {
+			return await stub[methodName](...args)
+		} catch (error) {
+			if (!isDurableObjectRpcUnsupported(error)) throw error
+		}
+	}
+	const response = await stub.fetch(new Request('http://do/_rpc', {
+		method: 'POST',
+		headers: { 'Content-Type': 'application/json' },
+		body: JSON.stringify({ method: methodName, params: args })
+	}))
+	const result = await response.json()
+	if (!result.ok) throw new Error(result.error?.message || 'RPC failed')
+	return result.result
+}
+
+function isDurableObjectRpcUnsupported(error) {
+	const message = error && error.message ? String(error.message) : String(error)
+	return message.indexOf('does not support RPC') !== -1
+}
+
+/**
+ * Execute an RPC method against the gateway's bindings.
+ *
+ * Method format: "binding.operation". Operations must be namespaced by
+ * binding kind (e.g. "kv.get", "r2.head", "d1.stmt.first", "do.fetch",
+ * "service.fetch", "queue.send", "email.send", "ai.run"). Bare verbs and the legacy
+ * "stmt.*" / "stub.*" sub-prefixes were removed in B3-final and now throw.
+ * Method vocabulary must stay in sync with the canonical server in
+ * src/bridge/server.ts.
+ */
+async function executeRpcMethod(method, params, env, _ctx) {
+	const parts = method.split('.')
+	if (parts.length < 2) throw new Error('Invalid method format: ' + method)
+
+	const bindingName = parts[0]
+	const operation = parts.slice(1).join('.')
+	const binding = env[bindingName]
+
+	if (!binding) throw new Error('Binding not found: ' + bindingName)
+
+	const isNamespaced =
+		operation.indexOf('kv.') === 0 ||
+		operation.indexOf('r2.') === 0 ||
+		operation.indexOf('d1.') === 0 ||
+		operation.indexOf('do.') === 0 ||
+		operation.indexOf('service.') === 0 ||
+		operation.indexOf('queue.') === 0 ||
+		operation.indexOf('email.') === 0 ||
+		operation.indexOf('ai.') === 0 ||
+		operation.indexOf('workflow.') === 0 ||
+		operation.indexOf('var.') === 0
+	if (!isNamespaced) {
+		throw new Error(createUnsupportedBridgeOperationErrorMessage(bindingName, operation))
+	}
+
+	// KV
+	if (operation === 'kv.get') return binding.get(params[0], params[1])
+	if (operation === 'kv.put') return binding.put(params[0], params[1], params[2])
+	if (operation === 'kv.delete') return binding.delete(params[0])
+	if (operation === 'kv.list') return binding.list(params[0])
+	if (operation === 'kv.getWithMetadata') return binding.getWithMetadata(params[0], params[1])
+
+	// DO get (returns DOStub reference)
+	if (operation === 'do.get') {
+		return { __type: 'DOStub', binding: bindingName, id: params[0] }
+	}
+
+	// R2
+	if (operation === 'r2.head') return serializeR2Object(await binding.head(params[0]))
+	if (operation === 'r2.get') {
+		const obj = await binding.get(params[0], params[1])
+		if (!obj) return null
+		const body = await obj.arrayBuffer()
+		return serializeR2ObjectBody(obj, arrayBufferToBase64(body))
+	}
+	if (operation === 'r2.put') {
+		let value = params[1]
+		if (value && typeof value === 'object') {
+			if (value.__type === 'ArrayBuffer' || value.__type === 'Uint8Array') {
+				value = base64ToArrayBuffer(value.data)
+			}
+		}
+		return serializeR2Object(await binding.put(params[0], value, params[2]))
+	}
+	if (operation === 'r2.delete') return binding.delete(params[0])
+	if (operation === 'r2.list') return serializeR2Objects(await binding.list(params[0]))
+
+	// D1
+	if (operation === 'd1.exec') return binding.exec(params[0])
+	if (operation === 'd1.batch') {
+		const statements = params[0].map((s) => binding.prepare(s.sql).bind(...(s.bindings || [])))
+		return binding.batch(statements)
+	}
+	if (operation.indexOf('d1.stmt.') === 0) {
+		const mode = operation.split('.')[2]
+		const [sql, ...rest] = params
+		let bindings = rest
+		let extraParam
+		if (mode === 'first' || mode === 'raw') {
+			extraParam = rest[rest.length - 1]
+			bindings = rest.slice(0, -1)
+		}
+		let stmt = binding.prepare(sql)
+		if (bindings.length > 0) stmt = stmt.bind(...bindings)
+		if (mode === 'first') {
+			if (typeof extraParam === 'string' && extraParam.length > 0) return stmt.first(extraParam)
+			return stmt.first()
+		}
+		if (mode === 'all') return stmt.all()
+		if (mode === 'run') return stmt.run()
+		if (mode === 'raw') return stmt.raw(extraParam)
+		throw new Error('Unknown stmt mode: ' + mode)
+	}
+
+	// Durable Objects
+	if (operation === 'do.idFromName') {
+		const ns = resolveDoNamespace(binding, params[1])
+		const id = ns.idFromName(params[0])
+		return { __type: 'DOId', hex: id.toString() }
+	}
+	if (operation === 'do.idFromString') {
+		const id = binding.idFromString(params[0])
+		return { __type: 'DOId', hex: id.toString() }
+	}
+	if (operation === 'do.newUniqueId') {
+		const ns = resolveDoNamespace(binding, params[1])
+		const id = ns.newUniqueId(params[0])
+		return { __type: 'DOId', hex: id.toString() }
+	}
+	if (operation === 'do.fetch') {
+		const [, serializedId, serializedReq] = params
+		const id = binding.idFromString(serializedId.hex)
+		const stub = binding.get(id)
+		const response = await stub.fetch(new Request(serializedReq.url, {
+			method: serializedReq.method,
+			headers: serializedReq.headers,
+			body: serializedReq.body?.type === 'bytes'
+				? base64ToArrayBuffer(serializedReq.body.data)
+				: undefined
+		}))
+		return serializeResponse(response)
+	}
+	if (operation === 'do.rpc') {
+		const [, serializedId, methodName, args] = params
+		const id = binding.idFromString(serializedId.hex)
+		const stub = binding.get(id)
+		return callDurableObjectRpc(stub, methodName, Array.isArray(args) ? args : [])
+	}
+
+	// Service Bindings
+	if (operation === 'service.fetch') {
+		if (!binding || typeof binding.fetch !== 'function') {
+			throw new Error('Service binding ' + bindingName + ' does not support fetch()')
+		}
+		const response = await binding.fetch(deserializeRequest(params[0]))
+		return serializeResponse(response)
+	}
+	if (operation === 'service.rpc') {
+		const methodName = params[0]
+		if (typeof methodName !== 'string') {
+			throw new Error('Service binding ' + bindingName + ' RPC method name must be a string')
+		}
+		const args = Array.isArray(params[1]) ? params[1] : []
+		const method = binding && binding[methodName]
+		if (typeof method !== 'function') {
+			throw new Error('Service binding ' + bindingName + ' does not support ' + methodName + '()')
+		}
+		return method.apply(binding, args)
+	}
+
+	// Queues
+	if (operation === 'queue.send') return binding.send(params[0], params[1])
+	if (operation === 'queue.sendBatch') return binding.sendBatch(params[0], params[1])
+
+	// Send Email
+	if (operation === 'email.send') {
+		if (binding && typeof binding.send === 'function') {
+			const message = params[0]
+			if (message && typeof message === 'object' && 'from' in message && 'to' in message && 'raw' in message) {
+				return binding.send({
+					from: message.from,
+					to: message.to,
+					[RAW_EMAIL]: createEmailMessageRaw(message.raw)
+				})
+			}
+			return binding.send(message)
+		}
+		return { ok: true, simulated: true }
+	}
+
+	// Workflows
+	if (operation === 'workflow.create') {
+		return serializeWorkflowInstance(await binding.create(params[0]))
+	}
+	if (operation === 'workflow.get') {
+		return serializeWorkflowInstance(await binding.get(params[0]))
+	}
+	if (operation === 'workflow.status') {
+		return (await binding.get(params[0])).status()
+	}
+	if (operation === 'workflow.pause') {
+		return (await binding.get(params[0])).pause()
+	}
+	if (operation === 'workflow.resume') {
+		return (await binding.get(params[0])).resume()
+	}
+	if (operation === 'workflow.terminate') {
+		return (await binding.get(params[0])).terminate()
+	}
+	if (operation === 'workflow.restart') {
+		return (await binding.get(params[0])).restart()
+	}
+	if (operation === 'workflow.sendEvent') {
+		return (await binding.get(params[0])).sendEvent(params[1])
+	}
+
+	// AI / generic run()
+	if (operation === 'ai.run') {
+		if (typeof binding.run !== 'function') {
+			throw new Error('Binding ' + bindingName + ' does not support run(): ' + method)
+		}
+		return binding.run(params[0], params[1])
+	}
+
+	throw new Error('Unknown operation: ' + method)
+}
+
+function createUnsupportedBridgeOperationErrorMessage(bindingName, operation) {
+	const base = "[devflare][bridge] Unsupported bridge operation '" + operation + "' for binding '" + bindingName + "'."
+	if (operation === 'fetch') {
+		return base + ' Devflare could not dispatch fetch() for this binding through the local bridge. '
+			+ 'Expected Cloudflare API: env.' + bindingName + '.fetch(request). '
+			+ 'If this came from SvelteKit platform.env, make sure the binding is declared as a service binding; '
+			+ 'this is a Devflare local bridge issue when service bindings fall back to a bare fetch operation.'
+	}
+	if (operation === 'toString') {
+		return base + ' A platform.env value was coerced to a string through the bridge. '
+			+ 'For SvelteKit local dev, declared vars should be plain string values and missing env names should read as undefined.'
+	}
+	return base + ' Bare verbs and the legacy stmt.*/stub.* sub-prefixes are not supported; '
+		+ 'use the namespaced form (e.g. kv.get, r2.put, d1.stmt.first, do.fetch, service.fetch).'
+}
+
+function serializeWorkflowInstance(instance) {
+	return {
+		__type: 'WorkflowInstance',
+		id: instance.id
+	}
+}
+
+// ---------------------------------------------------------------------------
+// WebSocket bridge (shared with src/bridge/server.ts in shape)
+// ---------------------------------------------------------------------------
+// NOTE: wsProxies is intentionally created per handleBridgeWebSocket call so
+// state never leaks across connections or across gateway-script regenerations.
+
+async function handleBridgeRpcCall(msg, ws, env, ctx) {
+	try {
+		const result = await executeRpcMethod(msg.method, msg.params, env, ctx)
+		ws.send(JSON.stringify({ t: 'rpc.ok', id: msg.id, result }))
+	} catch (error) {
+		ws.send(JSON.stringify({
+			t: 'rpc.err',
+			id: msg.id,
+			error: {
+				code: error?.code || 'INTERNAL_ERROR',
+				message: error?.message || String(error)
+			}
+		}))
+	}
+}
+
+async function handleBridgeWsOpen(msg, ws, env, wsProxies) {
+	try {
+		const binding = env[msg.target.binding]
+		const id = binding.idFromString(msg.target.id)
+		const stub = binding.get(id)
+
+		const headers = new Headers(msg.target.headers || [])
+		headers.set('Upgrade', 'websocket')
+
+		const response = await stub.fetch(new Request(msg.target.url, { method: 'GET', headers }))
+		const doWs = response.webSocket
+
+		if (!doWs) {
+			ws.send(JSON.stringify({
+				t: 'rpc.err',
+				id: 'ws_' + msg.wid,
+				error: { code: 'WS_FAILED', message: 'No WebSocket returned' }
+			}))
+			return
+		}
+
+		doWs.accept()
+		wsProxies.set(msg.wid, { doWs })
+
+		doWs.addEventListener('message', (event) => {
+			const isText = typeof event.data === 'string'
+			const payload = isText
+				? new TextEncoder().encode(event.data)
+				: new Uint8Array(event.data)
+			const flags = isText ? 2 : 0
+			ws.send(encodeWsDataFrame(msg.wid, flags, payload))
+		})
+
+		doWs.addEventListener('close', (event) => {
+			ws.send(JSON.stringify({ t: 'ws.close', wid: msg.wid, code: event.code, reason: event.reason }))
+			wsProxies.delete(msg.wid)
+		})
+
+		ws.send(JSON.stringify({ t: 'ws.opened', wid: msg.wid }))
+	} catch (error) {
+		ws.send(JSON.stringify({
+			t: 'rpc.err',
+			id: 'ws_' + msg.wid,
+			error: { code: 'WS_FAILED', message: error.message }
+		}))
+	}
+}
+
+function handleBridgeWsClose(msg, wsProxies) {
+	const proxy = wsProxies.get(msg.wid)
+	if (proxy) {
+		proxy.doWs.close(msg.code, msg.reason)
+		wsProxies.delete(msg.wid)
+	}
+}
+
+// Relay an inbound binary WsData frame (client -> DO). Mirrors server.ts
+// handleBinaryMessage: decode the frame, look up the proxy by ws id, and forward
+// the payload to the DO socket honoring the TEXT flag.
+function handleBridgeBinaryMessage(buffer, wsProxies) {
+	const frame = decodeWsDataFrame(buffer)
+	if (!frame || frame.kind !== 2) return
+	const proxy = wsProxies.get(frame.id)
+	if (!proxy) return
+	if ((frame.flags & 2) !== 0) {
+		proxy.doWs.send(new TextDecoder().decode(frame.payload))
+	} else {
+		proxy.doWs.send(frame.payload)
+	}
+}
+
+async function handleBridgeJsonMessage(data, ws, env, ctx, wsProxies) {
+	const msg = JSON.parse(data)
+	switch (msg.t) {
+		case 'hello':
+			// v2 handshake — acknowledge with welcome echoing the negotiated
+			// capability intersection. The gateway advertises only what it
+			// implements end-to-end: 'ws-relay' (binary WsData relay to/from DO
+			// sockets) and 'http-transfer' (the R2 transfer HTTP side-channel).
+			// 'streams' is intentionally NOT advertised — large DO/service-fetch
+			// responses are inlined, not streamed, in this gateway.
+			ws.send(JSON.stringify({
+				t: 'welcome',
+				protocolVersion: 2,
+				capabilities: ['ws-relay', 'http-transfer']
+					.filter((c) => Array.isArray(msg.capabilities) && msg.capabilities.includes(c))
+					.sort()
+			}))
+			break
+		case 'rpc.call':
+			await handleBridgeRpcCall(msg, ws, env, ctx)
+			break
+		case 'ws.open':
+			await handleBridgeWsOpen(msg, ws, env, wsProxies)
+			break
+		case 'ws.close':
+			handleBridgeWsClose(msg, wsProxies)
+			break
+	}
+}
+
+function handleBridgeWebSocket(request, env, ctx) {
+	const { 0: client, 1: server } = new WebSocketPair()
+	server.accept()
+
+	// Per-connection state: recreated for every bridge client so reloads and
+	// concurrent clients never share WS proxy entries.
+	const wsProxies = new Map()
+
+	server.addEventListener('message', async (event) => {
+		try {
+			if (typeof event.data === 'string') {
+				await handleBridgeJsonMessage(event.data, server, env, ctx, wsProxies)
+			} else {
+				handleBridgeBinaryMessage(event.data, wsProxies)
+			}
+		} catch (error) {
+			console.error('[Gateway] Error:', error)
+		}
+	})
+
+	server.addEventListener('close', () => {
+		for (const proxy of wsProxies.values()) {
+			// Best-effort cleanup: the DO-side WS may already be closed or in an
+			// invalid state; any throw here would abort sibling closes. Surface
+			// the swallowed error when DEVFLARE_DEBUG_BRIDGE is enabled.
+			try { proxy.doWs.close() } catch (error) {
+				if (globalThis.DEVFLARE_DEBUG_BRIDGE) {
+					console.warn('[devflare:bridge] proxy.doWs.close() failed', error)
+				}
+			}
+		}
+		wsProxies.clear()
+	})
+
+	return new Response(null, { status: 101, webSocket: client })
+}
+
+// ---------------------------------------------------------------------------
+// HTTP transfer for R2 bodies (shared with src/bridge/server.ts in shape)
+// ---------------------------------------------------------------------------
+
+async function handleHttpTransfer(request, env, url) {
+	const transferIdEncoded = url.pathname.split('/').pop()
+	const transferId = decodeURIComponent(transferIdEncoded || '')
+	const [binding, ...keyParts] = transferId.split(':')
+	const key = keyParts.join(':')
+	const bucket = env[binding]
+
+	if (!bucket) return new Response('Bucket not found: ' + binding, { status: 404 })
+
+	if (request.method === 'PUT' || request.method === 'POST') {
+		const result = await bucket.put(key, request.body)
+		return new Response(JSON.stringify(serializeR2Object(result)), {
+			headers: { 'Content-Type': 'application/json' }
+		})
+	}
+
+	if (request.method === 'GET') {
+		const object = await bucket.get(key)
+		if (!object) return new Response('Not found', { status: 404 })
+		return new Response(object.body, {
+			headers: {
+				'Content-Type': object.httpMetadata?.contentType || 'application/octet-stream',
+				'Content-Length': String(object.size)
+			}
+		})
+	}
+
+	return new Response('Method not allowed', { status: 405 })
+}
+`;
+//#endregion
+//#region src/bridge/miniflare.ts
+function isIgnorableMiniflareDisposeError(error) {
+	if (!(error instanceof Error)) return false;
+	const details = error;
+	return details.code === "EBADF" && details.syscall === "kill";
+}
+//#endregion
+//#region src/cli/wrangler-auth.ts
+const execAsync = promisify(exec);
+/**
+* Check if the config contains any bindings that require remote access
+*/
+function detectRemoteBindings(config) {
+	const remoteBindings = [];
+	const bindings = config.bindings;
+	if (!bindings) return remoteBindings;
+	if (bindings.ai) remoteBindings.push(`AI (binding: ${bindings.ai.binding})`);
+	if (bindings.vectorize) for (const [name] of Object.entries(bindings.vectorize)) remoteBindings.push(`Vectorize (binding: ${name})`);
+	return remoteBindings;
+}
+/**
+* Check if wrangler is logged in by running `wrangler whoami`
+*
+* Returns:
+* - loggedIn: true if user is authenticated
+* - accountId: the account ID if available
+* - email: the email if available
+* - error: error message if check failed
+*/
+async function checkWranglerAuth() {
+	try {
+		const { stdout, stderr } = await execAsync("bunx wrangler whoami", { timeout: 15e3 });
+		const output = stdout + stderr;
+		if (output.includes("not authenticated") || output.includes("Not logged in") || output.includes("wrangler login")) return {
+			loggedIn: false,
+			error: "Not logged in to Wrangler"
+		};
+		const emailMatch = output.match(/email[:\s]+([^\s!]+)/i);
+		const accountMatch = output.match(/Account\s+ID[:\s]+([a-f0-9]+)/i);
+		return {
+			loggedIn: true,
+			email: emailMatch?.[1],
+			accountId: accountMatch?.[1]
+		};
+	} catch (error) {
+		const msg = error instanceof Error ? error.message : String(error);
+		if (msg.includes("ENOENT") || msg.includes("not found")) return {
+			loggedIn: false,
+			error: "Wrangler not installed. Run: npm install -g wrangler"
+		};
+		return {
+			loggedIn: false,
+			error: msg
+		};
+	}
+}
+/**
+* Check if remote bindings are properly configured
+*
+* Returns warnings if:
+* - Config has remote-only bindings but no accountId
+* - Config has remote-only bindings but user is not logged in to wrangler
+*/
+async function checkRemoteBindingRequirements(config) {
+	const remoteBindings = detectRemoteBindings(config);
+	if (remoteBindings.length === 0) return {
+		hasRemoteBindings: false,
+		remoteBindings: [],
+		missingAccountId: false,
+		notLoggedIn: false
+	};
+	return {
+		hasRemoteBindings: true,
+		remoteBindings,
+		missingAccountId: !config.accountId,
+		notLoggedIn: !(await checkWranglerAuth()).loggedIn
+	};
+}
+//#endregion
+//#region src/dev-server/d1-migrations.ts
+const MIGRATION_RETRY_DELAYS_MS = [
+	500,
+	1e3,
+	1500,
+	2e3
+];
+function collectMigrationStatements(sql) {
+	return sql.split("\n").filter((line) => !line.trim().startsWith("--")).join("\n").split(";").map((statement) => statement.trim()).filter((statement) => statement.length > 0);
+}
+function hashSql(sql) {
+	return createHash("sha256").update(sql).digest("hex");
+}
+function getErrorMessage(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+async function waitForRetry(delayMs) {
+	await new Promise((resolvePromise) => setTimeout(resolvePromise, delayMs));
+}
+async function applyMigrationsToBinding(options) {
+	const { bindingName, statements, files, miniflarePort, logger } = options;
+	let lastError;
+	for (let attempt = 0; attempt <= MIGRATION_RETRY_DELAYS_MS.length; attempt++) {
+		if (attempt > 0) await waitForRetry(MIGRATION_RETRY_DELAYS_MS[attempt - 1]);
+		try {
+			const response = await fetch(`http://127.0.0.1:${miniflarePort}/_devflare/migrate`, {
+				method: "POST",
+				headers: { "Content-Type": "application/json" },
+				body: JSON.stringify({
+					bindingName,
+					statements,
+					files
+				})
+			});
+			if (!response.ok) {
+				const text = await response.text();
+				throw new Error(`HTTP ${response.status}: ${text}`);
+			}
+			const result = await response.json();
+			if (result.success) {
+				if (Array.isArray(result.warnings)) for (const warning of result.warnings) console.warn(`[devflare] D1 migration file "${warning.filename}" for binding ${bindingName} has changed since it was applied; skipping re-apply to protect existing data.`);
+				const appliedCount = result.applied?.length ?? 0;
+				const skippedCount = result.skipped?.length ?? 0;
+				if (appliedCount > 0 || skippedCount > 0) logger?.success(`D1 migrations for ${bindingName}: ${appliedCount} applied, ${skippedCount} skipped`);
+				else logger?.success(`D1 migrations applied to ${bindingName}`);
+				return;
+			}
+			throw new Error(result.error || "Unknown error");
+		} catch (error) {
+			lastError = error;
+		}
+	}
+	logger?.warn(`Failed to apply migrations to ${bindingName}: ${getErrorMessage(lastError)}`);
+}
+/**
+* Run D1 migrations from migrations/ directory.
+*
+* Resolution per D1 binding (in order):
+*   1. `<cwd>/migrations/<BINDING_NAME>/*.sql` — per-binding directory.
+*      NOTE: if the per-binding directory EXISTS but contains no .sql files,
+*      the binding is skipped — the shared fallback is NOT used.
+*   2. `<cwd>/migrations/*.sql` — shared fallback, used ONLY when the
+*      per-binding directory does not exist.
+*   3. Otherwise, skip the binding with a debug log.
+*
+* Applied-migration ledger:
+*   The gateway maintains a `_devflare_migrations` table per D1 binding with
+*   columns (filename TEXT PRIMARY KEY, applied_at TEXT NOT NULL,
+*   sha256 TEXT NOT NULL). On each run the gateway, for every file we send:
+*     - if filename is present AND sha256 matches — skip silently
+*     - if filename is present but sha256 differs — surface a warning that
+*       the client turns into a `console.warn`; the file is skipped to
+*       protect existing data (there is no force-reapply flag today)
+*     - if filename is absent — apply the file's SQL, then record the entry
+*   We pass each file (filename + sha256 + statements) in a single
+*   /_devflare/migrate request so ledger read/write stays in-process inside
+*   workerd.
+*
+* Uses the gateway worker HTTP endpoint to run migrations inside workerd.
+*/
+async function runD1Migrations(options) {
+	const { cwd, config, miniflarePort, logger } = options;
+	if (!config?.bindings?.d1) return;
+	const { existsSync, readdirSync, readFileSync, statSync } = await import("node:fs");
+	const migrationsDir = resolve(cwd, "migrations");
+	if (!existsSync(migrationsDir)) {
+		logger?.debug("No migrations/ directory found, skipping D1 migrations");
+		return;
+	}
+	const sharedFiles = readdirSync(migrationsDir).filter((file) => file.endsWith(".sql")).sort();
+	let sharedFileEntries = null;
+	if (sharedFiles.length > 0) {
+		sharedFileEntries = [];
+		for (const file of sharedFiles) {
+			const sql = readFileSync(resolve(migrationsDir, file), "utf-8");
+			const fileStatements = collectMigrationStatements(sql);
+			sharedFileEntries.push({
+				filename: file,
+				sha256: hashSql(sql),
+				statements: fileStatements
+			});
+			logger?.debug(`Shared file ${file}: ${fileStatements.length} statement(s)`);
+		}
+	}
+	for (const [bindingName] of Object.entries(config.bindings.d1)) {
+		const perBindingDir = resolve(migrationsDir, bindingName);
+		const hasPerBindingDir = existsSync(perBindingDir) && statSync(perBindingDir).isDirectory();
+		let files = [];
+		let sourceLabel = "";
+		if (hasPerBindingDir) {
+			const perBindingFiles = readdirSync(perBindingDir).filter((file) => file.endsWith(".sql")).sort();
+			if (perBindingFiles.length === 0) {
+				logger?.debug(`No SQL migration files in migrations/${bindingName}/, skipping ${bindingName}`);
+				continue;
+			}
+			for (const file of perBindingFiles) {
+				const sql = readFileSync(resolve(perBindingDir, file), "utf-8");
+				const fileStatements = collectMigrationStatements(sql);
+				files.push({
+					filename: file,
+					sha256: hashSql(sql),
+					statements: fileStatements
+				});
+				logger?.debug(`File ${bindingName}/${file}: ${fileStatements.length} statement(s)`);
+			}
+			sourceLabel = `migrations/${bindingName}/`;
+		} else if (sharedFileEntries !== null) {
+			files = sharedFileEntries;
+			sourceLabel = "migrations/ [shared fallback]";
+		} else {
+			logger?.debug(`No migrations found for ${bindingName}, skipping`);
+			continue;
+		}
+		const statements = files.flatMap((file) => file.statements);
+		logger?.info(`Running ${files.length} D1 migration(s) for ${bindingName} (from ${sourceLabel})`);
+		if (statements.length === 0) {
+			logger?.debug(`No executable D1 migration statements for ${bindingName}`);
+			continue;
+		}
+		await applyMigrationsToBinding({
+			bindingName,
+			statements,
+			files,
+			miniflarePort,
+			logger
+		});
+	}
+}
+//#endregion
+//#region src/dev-server/dev-server-state.ts
+/**
+* Build a fresh `DevServerState` with all handles in their not-yet-started
+* positions. `enableVite` is the user's request — `start()` may downgrade it
+* later via `resolveViteIntegration`.
+*/
+function createDevServerState(initial) {
+	return {
+		enableVite: initial.enableVite,
+		miniflare: null,
+		doBundler: null,
+		workerSourceWatcher: null,
+		workerWatchTargets: [],
+		viteProcess: null,
+		config: null,
+		serviceBindingResolution: null,
+		browserShim: null,
+		browserShimPort: initial.browserShimPort ?? 8788,
+		mainWorkerSurfacePaths: {
+			fetch: null,
+			queue: null,
+			scheduled: null,
+			email: null,
+			tail: null
+		},
+		resolvedWorkerConfigPath: null,
+		mainWorkerScriptPath: null,
+		bundledMainWorkerScriptPath: null,
+		workflowEntrypointScript: "",
+		currentDoResult: null,
+		mainWorkerRoutes: null,
+		generatedViteConfigPath: null
+	};
+}
+/**
+* Tear down everything in `state` in the same order the legacy `stop()`
+* function used. After this returns, every handle on `state` is `null` again
+* and the local sendEmail bindings have been cleared.
+*
+* Order is important and intentionally mirrors the production sequence:
+* 1. DO bundler (stop rebuilds before Miniflare goes away)
+* 2. Worker source watcher (stop FS callbacks before Miniflare disposal)
+* 3. Miniflare itself
+* 4. Vite child process (after Miniflare so requests cannot race shutdown)
+* 5. Browser shim
+* 6. Local sendEmail registry reset
+*/
+async function disposeDevServerState(state) {
+	if (state.doBundler) {
+		await state.doBundler.close();
+		state.doBundler = null;
+	}
+	if (state.workerSourceWatcher) {
+		await state.workerSourceWatcher.close();
+		state.workerSourceWatcher = null;
+	}
+	if (state.miniflare) {
+		try {
+			await state.miniflare.dispose();
+		} catch (error) {
+			if (!isIgnorableMiniflareDisposeError(error)) throw error;
+		}
+		state.miniflare = null;
+	}
+	if (state.viteProcess) {
+		await stopSpawnedProcessTree(state.viteProcess);
+		state.viteProcess = null;
+	}
+	if (state.browserShim) {
+		await state.browserShim.stop();
+		state.browserShim = null;
+	}
+	clearLocalSendEmailBindings();
+}
+//#endregion
+//#region src/browser-shim/binding-worker.ts
+const MAX_CHUNK_SIZE = 1048575;
+/**
+* Generate the browser binding worker script
+* @param browserShimUrl - URL of the external browser shim server (e.g., http://127.0.0.1:8788)
+* @param debug - Enable debug logging (default: false)
+*/
+function getBrowserBindingScript(browserShimUrl, debug = false) {
+	return `
+// Browser Binding Worker — Proxies puppeteer requests to external browser shim
+// Handles WebSocket upgrades using WebSocketPair for @cloudflare/puppeteer compatibility
+
+const BROWSER_SHIM_URL = ${JSON.stringify(browserShimUrl)}
+const MAX_CHUNK_SIZE = ${MAX_CHUNK_SIZE}
+const DEBUG = ${debug}
+const log = (...args) => DEBUG && console.log('[BrowserBinding]', ...args)
+
+export default {
+	async fetch(request, env, ctx) {
+		const url = new URL(request.url)
+		const upgradeHeader = request.headers.get('Upgrade')
+		const isWebSocket = upgradeHeader && upgradeHeader.toLowerCase() === 'websocket'
+		
+		log('Request:', url.pathname, isWebSocket ? '(WebSocket)' : '(HTTP)')
+
+		// Handle WebSocket upgrade for DevTools connection
+		if (url.pathname === '/v1/connectDevtools' && isWebSocket) {
+			return handleDevToolsWebSocket(request, url)
+		}
+
+		// Proxy all other requests to the browser shim server
+		return proxyToBrowserShim(request, url)
+	}
+}
+
+// Proxy HTTP requests to the external browser shim server
+async function proxyToBrowserShim(request, url) {
+	const shimUrl = new URL(url.pathname + url.search, BROWSER_SHIM_URL)
+	
+	log('Proxying to:', shimUrl.toString())
+	
+	const response = await fetch(shimUrl.toString(), {
+		method: request.method,
+		headers: request.headers,
+		body: request.method !== 'GET' && request.method !== 'HEAD' ? request.body : undefined
+	})
+	
+	log('Response:', response.status)
+	
+	// Return the response as-is
+	return new Response(response.body, {
+		status: response.status,
+		statusText: response.statusText,
+		headers: response.headers
+	})
+}
+
+// Validate WebSocket close code to be in valid range
+function validateCloseCode(code) {
+	if (typeof code !== 'number' || isNaN(code)) return 1000
+	if (code < 1000 || code > 4999) return 1000
+	return code
+}
+
+// Split a message into chunks following @cloudflare/puppeteer protocol
+// First chunk has 4-byte LE length header, subsequent chunks are raw payload
+function messageToChunks(message) {
+	const data = typeof message === 'string'
+		? new TextEncoder().encode(message)
+		: new Uint8Array(message)
+	
+	const chunks = []
+	const totalLength = data.length
+	let offset = 0
+	let isFirst = true
+	
+	while (offset < totalLength) {
+		const remaining = totalLength - offset
+		let chunkSize
+		
+		if (isFirst) {
+			// First chunk: 4-byte header + payload
+			chunkSize = Math.min(remaining, MAX_CHUNK_SIZE - 4)
+			const chunk = new Uint8Array(chunkSize + 4)
+			new DataView(chunk.buffer).setUint32(0, totalLength, true) // little-endian
+			chunk.set(data.subarray(offset, offset + chunkSize), 4)
+			chunks.push(chunk)
+			isFirst = false
+		} else {
+			// Subsequent chunks: raw payload only
+			chunkSize = Math.min(remaining, MAX_CHUNK_SIZE)
+			const chunk = data.subarray(offset, offset + chunkSize)
+			chunks.push(chunk)
+		}
+		
+		offset += chunkSize
+	}
+	
+	return chunks
+}
+
+// Reassemble chunks back into a complete message
+// Returns null if more chunks are needed
+function chunksToMessage(chunks) {
+	if (chunks.length === 0) return null
+	
+	// First chunk must have 4-byte header
+	const firstChunk = chunks[0]
+	if (firstChunk.length < 4) return null
+	
+	const expectedLength = new DataView(firstChunk.buffer, firstChunk.byteOffset).getUint32(0, true)
+	
+	// Calculate total received payload
+	let totalReceived = firstChunk.length - 4 // first chunk payload (minus header)
+	for (let i = 1; i < chunks.length; i++) {
+		totalReceived += chunks[i].length
+	}
+	
+	if (totalReceived < expectedLength) {
+		return null // Need more chunks
+	}
+	
+	// Reassemble the message
+	const assembled = new Uint8Array(expectedLength)
+	let offset = 0
+	
+	// Copy first chunk payload (skip 4-byte header)
+	const firstPayload = firstChunk.subarray(4)
+	assembled.set(firstPayload, offset)
+	offset += firstPayload.length
+	
+	// Copy remaining chunks
+	for (let i = 1; i < chunks.length; i++) {
+		const chunk = chunks[i]
+		const toCopy = Math.min(chunk.length, expectedLength - offset)
+		assembled.set(chunk.subarray(0, toCopy), offset)
+		offset += toCopy
+	}
+	
+	return new TextDecoder().decode(assembled)
+}
+
+// Handle WebSocket upgrade for DevTools connection
+// Creates a WebSocketPair and proxies to Chrome's DevTools WebSocket
+async function handleDevToolsWebSocket(request, url) {
+	const sessionId = url.searchParams.get('browser_session')
+	if (!sessionId) {
+		return new Response('browser_session parameter required', { status: 400 })
+	}
+	
+	log('DevTools WebSocket request for session:', sessionId)
+	
+	// Get session info from browser shim (includes Chrome's wsEndpoint)
+	const sessionUrl = new URL('/v1/session/' + sessionId, BROWSER_SHIM_URL)
+	
+	// Add timeout for session fetch
+	const controller = new AbortController()
+	const timeout = setTimeout(() => controller.abort(), 5000)
+	
+	let sessionRes
+	try {
+		sessionRes = await fetch(sessionUrl.toString(), { signal: controller.signal })
+	} catch (e) {
+		DEBUG && console.error('[BrowserBinding] Session fetch timeout or error:', e.message)
+		return new Response('Session fetch timeout', { status: 504 })
+	} finally {
+		clearTimeout(timeout)
+	}
+	
+	if (!sessionRes.ok) {
+		DEBUG && console.error('[BrowserBinding] Session not found:', sessionId)
+		return new Response('Session not found', { status: 404 })
+	}
+	
+	const sessionInfo = await sessionRes.json()
+	const wsEndpoint = sessionInfo.wsEndpoint
+	
+	if (!wsEndpoint) {
+		DEBUG && console.error('[BrowserBinding] No wsEndpoint in session info')
+		return new Response('No wsEndpoint for session', { status: 500 })
+	}
+	
+	log('Connecting to Chrome DevTools:', wsEndpoint)
+	
+	// Connect to Chrome's DevTools WebSocket
+	// Chrome uses ws:// but fetch expects http:// for WebSocket upgrade
+	const chromeUrl = wsEndpoint.replace('ws://', 'http://').replace('wss://', 'https://')
+	
+	const chromeRes = await fetch(chromeUrl, {
+		headers: { Upgrade: 'websocket' }
+	})
+	
+	if (!chromeRes.webSocket) {
+		DEBUG && console.error('[BrowserBinding] Failed to connect to Chrome DevTools')
+		return new Response('Failed to connect to Chrome DevTools', { status: 502 })
+	}
+	
+	const chromeWs = chromeRes.webSocket
+	chromeWs.accept()
+	
+	log('Connected to Chrome DevTools')
+	
+	// Create WebSocketPair for client connection
+	const { 0: client, 1: server } = new WebSocketPair()
+	server.accept()
+	
+	// Chunk buffer for reassembling multi-chunk messages from puppeteer
+	let chunks = []
+	const MAX_BUFFER_SIZE = 50 * 1024 * 1024 // 50MB max buffer
+	let bufferSize = 0
+	
+	// Proxy messages from client (puppeteer) to Chrome
+	// Handle multi-chunk framing protocol
+	server.addEventListener('message', (event) => {
+		// Keep-alive ping from puppeteer
+		if (event.data === 'ping') {
+			return
+		}
+		
+		// Handle binary data (chunked protocol)
+		if (event.data instanceof ArrayBuffer) {
+			const chunk = new Uint8Array(event.data)
+			bufferSize += chunk.length
+			
+			// Prevent unbounded buffering
+			if (bufferSize > MAX_BUFFER_SIZE) {
+				DEBUG && console.error('[BrowserBinding] Buffer overflow, closing connection')
+				server.close(1009, 'Message too big')
+				chromeWs.close(1009, 'Message too big')
+				return
+			}
+			
+			chunks.push(chunk)
+			
+			// Try to reassemble complete message
+			const message = chunksToMessage(chunks)
+			if (message !== null) {
+				// Send complete message to Chrome
+				if (chromeWs.readyState === 1) { // OPEN
+					chromeWs.send(message)
+				}
+				// Clear buffer
+				chunks = []
+				bufferSize = 0
+			}
+		} else if (typeof event.data === 'string') {
+			// Shouldn't happen in normal protocol, but handle it
+			if (chromeWs.readyState === 1) {
+				chromeWs.send(event.data)
+			}
+		}
+	})
+	
+	// Proxy messages from Chrome to client (puppeteer)
+	// Split into chunks following the multi-chunk protocol
+	chromeWs.addEventListener('message', (event) => {
+		if (server.readyState !== 1) return // Not OPEN
+		
+		// Split message into chunks
+		const outChunks = messageToChunks(event.data)
+		for (const chunk of outChunks) {
+			server.send(chunk)
+		}
+	})
+	
+	// Handle close events with validated codes
+	server.addEventListener('close', (event) => {
+		log('Client WebSocket closed:', event.code)
+		const code = validateCloseCode(event.code)
+		try {
+			if (chromeWs.readyState === 1 || chromeWs.readyState === 0) {
+				chromeWs.close(code, event.reason || '')
+			}
+		} catch {}
+	})
+	
+	chromeWs.addEventListener('close', (event) => {
+		log('Chrome WebSocket closed:', event.code)
+		const code = validateCloseCode(event.code)
+		try {
+			if (server.readyState === 1 || server.readyState === 0) {
+				server.close(code, event.reason || '')
+			}
+		} catch {}
+	})
+	
+	// Handle errors
+	server.addEventListener('error', (event) => {
+		DEBUG && console.error('[BrowserBinding] Client WebSocket error')
+		try { chromeWs.close(1011, 'Client error') } catch {}
+	})
+	
+	chromeWs.addEventListener('error', (event) => {
+		DEBUG && console.error('[BrowserBinding] Chrome WebSocket error')
+		try { server.close(1011, 'Chrome error') } catch {}
+	})
+	
+	log('WebSocket proxy established')
+	
+	// Return Cloudflare-style WebSocket response
+	return new Response(null, {
+		status: 101,
+		webSocket: client
+	})
+}
+`;
+}
+//#endregion
+//#region src/dev-server/gateway-script.ts
+/**
+* Generates the dev-server gateway worker script inline.
+*
+* All in-sandbox RPC behavior (method dispatch, error envelope, serialization,
+* WebSocket bridge, HTTP transfer) lives in `GATEWAY_RUNTIME_JS` and is shared
+* with `src/bridge/miniflare.ts`. The canonical TypeScript equivalent lives in
+* `src/bridge/server.ts`. The local presigned-R2 endpoint handler is shared
+* via `R2_PRESIGN_RUNTIME_JS` (`src/bridge/r2-presign-runtime.ts`).
+*
+* This file only owns the pieces that are genuinely dev-server-specific:
+*   - WebSocket route matching & DO WebSocket forwarding (`WS_ROUTES`)
+*   - D1 migration endpoint
+*   - Inbound email ingestion endpoint
+*   - Service-binding fallthrough to the app worker
+*
+* @param wsRoutes - WebSocket routes for DO proxying
+* @param debug - Enable debug logging in gateway
+* @param appServiceBindingName - Service binding name for the app worker (if any)
+*/
+function getGatewayScript(wsRoutes = [], debug = false, appServiceBindingName = null) {
+	return `
+${GATEWAY_RUNTIME_JS}
+
+${R2_PRESIGN_RUNTIME_JS}
+
+// Bridge Gateway Worker — Dev Server
+// Dev-server-specific overlay on top of the shared GATEWAY_RUNTIME_JS:
+// WS route DO forwarding, D1 migration, email ingest, app-worker fallthrough.
+
+const DEBUG = ${debug}
+const log = (...args) => DEBUG && console.log('[Gateway]', ...args)
+
+const WS_ROUTES = ${JSON.stringify(wsRoutes)}
+const APP_SERVICE_BINDING = ${JSON.stringify(appServiceBindingName)}
+
+export default {
+	async fetch(request, env, ctx) {
+		const url = new URL(request.url)
+		const isWebSocket = request.headers.get('Upgrade') === 'websocket'
+
+		if (isWebSocket) {
+			const matchedRoute = matchWsRoute(url.pathname)
+			if (matchedRoute) {
+				return handleDoWebSocket(request, env, url, matchedRoute)
+			}
+			return handleBridgeWebSocket(request, env, ctx)
+		}
+
+		if (url.pathname.startsWith('/_devflare/transfer/')) {
+			return handleHttpTransfer(request, env, url)
+		}
+
+		const presignResponse = await __devflareR2PresignHandle(request, env, url)
+		if (presignResponse) {
+			return presignResponse
+		}
+
+		if (url.pathname === '/_devflare/migrate' && request.method === 'POST') {
+			return handleMigration(request, env)
+		}
+
+		if (url.pathname === '/cdn-cgi/handler/email' && request.method === 'POST') {
+			return handleEmailIncoming(request, env, ctx, url)
+		}
+
+		if (url.pathname === '/_devflare/health') {
+			return new Response(JSON.stringify({
+				ok: true,
+				bindings: Object.keys(env),
+				wsRoutes: WS_ROUTES
+			}), { headers: { 'Content-Type': 'application/json' } })
+		}
+
+		if (APP_SERVICE_BINDING) {
+			const appWorker = env[APP_SERVICE_BINDING]
+			if (appWorker && typeof appWorker.fetch === 'function') {
+				return appWorker.fetch(request)
+			}
+		}
+
+		return new Response('Devflare Bridge Gateway', { status: 200 })
+	}
+}
+
+async function handleMigration(request, env) {
+	try {
+		const { bindingName, statements, files } = await request.json()
+		log('Migration request for binding:', bindingName, 'statements count:', statements?.length, 'files:', files?.length, 'bindings:', Object.keys(env))
+		const db = env[bindingName]
+		if (!db) {
+			return Response.json({ error: 'Binding not found: ' + bindingName }, { status: 404 })
+		}
+
+		// Ledger-aware path: when the client sends per-file metadata, we track
+		// applied migrations in a \`_devflare_migrations\` table and skip files
+		// whose filename+sha256 is already recorded. Files with a drifting hash
+		// are reported as warnings and skipped — we refuse to re-apply to avoid
+		// stomping on user data.
+		if (Array.isArray(files) && files.length > 0) {
+			try {
+				await db.prepare(
+					'CREATE TABLE IF NOT EXISTS _devflare_migrations (filename TEXT PRIMARY KEY, applied_at TEXT NOT NULL, sha256 TEXT NOT NULL)'
+				).run()
+			} catch (error) {
+				const msg = error?.message || String(error)
+				log('Failed to ensure migration ledger:', msg)
+				return Response.json({ error: 'Failed to ensure migration ledger: ' + msg }, { status: 500 })
+			}
+
+			let ledgerRows = []
+			try {
+				const ledger = await db.prepare('SELECT filename, sha256 FROM _devflare_migrations').all()
+				ledgerRows = ledger?.results || []
+			} catch (error) {
+				log('Failed to read migration ledger:', error?.message || String(error))
+			}
+			const ledgerByFilename = new Map()
+			for (const row of ledgerRows) {
+				ledgerByFilename.set(row.filename, row.sha256)
+			}
+
+			const applied = []
+			const skipped = []
+			const warnings = []
+			const results = []
+
+			for (const file of files) {
+				const existingHash = ledgerByFilename.get(file.filename)
+				if (existingHash === file.sha256) {
+					skipped.push(file.filename)
+					continue
+				}
+				if (existingHash && existingHash !== file.sha256) {
+					warnings.push({
+						filename: file.filename,
+						message: 'sha256 drifted since last apply; skipped'
+					})
+					skipped.push(file.filename)
+					continue
+				}
+
+				let fileFailed = false
+				for (const sql of file.statements || []) {
+					try {
+						log('Running migration SQL:', sql.slice(0, 80))
+						await db.prepare(sql).run()
+						results.push({ sql: sql.slice(0, 50), success: true })
+					} catch (error) {
+						const msg = error?.message || String(error)
+						log('Migration SQL error:', msg)
+						if (msg.includes('already exists')) {
+							results.push({ sql: sql.slice(0, 50), success: true, skipped: true })
+						} else {
+							results.push({ sql: sql.slice(0, 50), success: false, error: msg })
+							fileFailed = true
+						}
+					}
+				}
+
+				if (!fileFailed) {
+					try {
+						await db.prepare(
+							'INSERT OR REPLACE INTO _devflare_migrations (filename, applied_at, sha256) VALUES (?, ?, ?)'
+						).bind(file.filename, new Date().toISOString(), file.sha256).run()
+						applied.push(file.filename)
+					} catch (error) {
+						log('Failed to record migration in ledger:', error?.message || String(error))
+					}
+				}
+			}
+
+			return Response.json({ success: true, results, applied, skipped, warnings })
+		}
+
+		// Legacy path: flat statement list, no ledger tracking.
+		const results = []
+		for (const sql of statements) {
+			try {
+				log('Running migration SQL:', sql.slice(0, 80))
+				await db.prepare(sql).run()
+				results.push({ sql: sql.slice(0, 50), success: true })
+				log('Migration SQL succeeded')
+			} catch (error) {
+				const msg = error?.message || String(error)
+				log('Migration SQL error:', msg)
+				if (msg.includes('already exists')) {
+					results.push({ sql: sql.slice(0, 50), success: true, skipped: true })
+				} else {
+					results.push({ sql: sql.slice(0, 50), success: false, error: msg })
+				}
+			}
+		}
+
+		try {
+			const tables = await db.prepare(\"SELECT name FROM sqlite_master WHERE type='table'\").all()
+			log('Tables after migration:', JSON.stringify(tables))
+		} catch (e) {
+			log('Error listing tables:', e.message)
+		}
+
+		return Response.json({ success: true, results })
+	} catch (error) {
+		return Response.json({ error: error?.message || String(error) }, { status: 500 })
+	}
+}
+
+async function handleEmailIncoming(request, env, ctx, url) {
+	try {
+		const from = url.searchParams.get('from') || 'unknown@example.com'
+		const to = url.searchParams.get('to') || 'worker@example.com'
+		const rawBody = await request.text()
+
+		log('Email incoming:', { from, to, bodyLength: rawBody.length })
+
+		if (APP_SERVICE_BINDING) {
+			const appWorker = env[APP_SERVICE_BINDING]
+			if (appWorker && typeof appWorker.fetch === 'function') {
+				const response = await appWorker.fetch(new Request('http://devflare.internal/_devflare/internal/email', {
+					method: 'POST',
+					headers: {
+						'x-devflare-event': 'email',
+						'x-devflare-email-from': from,
+						'x-devflare-email-to': to,
+						'content-type': request.headers.get('content-type') || 'text/plain'
+					},
+					body: rawBody
+				}))
+
+				if (!response.ok) {
+					return response
+				}
+			}
+		}
+
+		return new Response(JSON.stringify({ ok: true, from, to }), {
+			headers: { 'Content-Type': 'application/json' }
+		})
+	} catch (error) {
+		console.error('[Gateway] Email handler error:', error)
+		return Response.json({ error: error?.message || String(error) }, { status: 500 })
+	}
+}
+
+function matchWsRoute(pathname) {
+	for (const route of WS_ROUTES) {
+		if (pathname === route.pattern || pathname.startsWith(route.pattern + '?')) {
+			return route
+		}
+	}
+	return null
+}
+
+async function handleDoWebSocket(request, env, url, route) {
+	try {
+		const namespace = env[route.doNamespace]
+		if (!namespace) {
+			console.error('[Gateway] DO namespace not found:', route.doNamespace)
+			return new Response('DO namespace not found: ' + route.doNamespace, { status: 500 })
+		}
+
+		const idValue = url.searchParams.get(route.idParam) || 'default'
+		const doId = namespace.idFromName(idValue)
+		const stub = namespace.get(doId)
+
+		const forwardUrl = new URL(route.forwardPath, url.origin)
+		url.searchParams.forEach((v, k) => forwardUrl.searchParams.set(k, v))
+
+		log('Forwarding WebSocket to DO:', route.doNamespace, 'id:', idValue, 'path:', forwardUrl.pathname)
+
+		return stub.fetch(forwardUrl.toString(), {
+			method: request.method,
+			headers: request.headers
+		})
+	} catch (error) {
+		console.error('[Gateway] Error forwarding to DO:', error)
+		return new Response('Error forwarding to DO: ' + error.message, { status: 500 })
+	}
+}
+`;
+}
+//#endregion
+//#region src/dev-server/miniflare-worker-config.ts
+const DEFAULT_MODULE_RULES = [
+	{
+		type: "ESModule",
+		include: [
+			"**/*.ts",
+			"**/*.tsx",
+			"**/*.mts",
+			"**/*.mjs"
+		]
+	},
+	{
+		type: "CommonJS",
+		include: ["**/*.js", "**/*.cjs"]
+	},
+	{
+		type: "ESModule",
+		include: ["**/*.jsx"]
+	}
+];
+function toMiniflareModuleRule(rule) {
+	return {
+		type: rule.type,
+		include: rule.globs,
+		...rule.fallthrough !== void 0 && { fallthrough: rule.fallthrough }
+	};
+}
+/**
+* Build the per-worker `serviceBindings` map. Combines user-declared
+* `bindings.services` (config) with any extra bindings the caller wants to
+* inject (e.g. internal gateway -> app routing).
+*/
+function buildServiceBindings(bindings, extraBindings = {}) {
+	const serviceBindings = {};
+	if (bindings.services) for (const [bindingName, serviceConfig] of Object.entries(bindings.services)) serviceBindings[bindingName] = {
+		name: serviceConfig.service,
+		...serviceConfig.entrypoint && { entrypoint: serviceConfig.entrypoint },
+		...serviceConfig.props !== void 0 && { props: serviceConfig.props }
+	};
+	for (const [bindingName, target] of Object.entries(extraBindings)) serviceBindings[bindingName] = target;
+	return Object.keys(serviceBindings).length > 0 ? serviceBindings : void 0;
+}
+/**
+* Build a single worker config object for Miniflare's `workers` array.
+* All inputs are passed explicitly (no closures over the caller's locals).
+*/
+function makeMiniflareWorker(context, options) {
+	const { cwd, loadedConfig, bindings, sendEmailConfig, rateLimitsConfig, versionMetadataConfig, workerLoadersConfig, mtlsCertificatesConfig, dispatchNamespacesConfig, workflowsConfig, pipelinesConfig, hyperdrivesConfig, imagesConfig, mediaConfig, streamConfig, flagshipConfig, analyticsEngineConfig, tailConsumersConfig, streamingTailConsumersConfig, artifactsConfig, aiSearchNamespacesConfig, aiSearchInstancesConfig, secretsStoreConfig, localSecretWrappedBindingConfig, queueProducers } = context;
+	const baseFlags = loadedConfig.compatibilityFlags ?? [];
+	const compatFlags = baseFlags.includes("nodejs_compat") ? baseFlags : [...baseFlags, "nodejs_compat"];
+	const workerBindings = {
+		...loadedConfig.vars ?? {},
+		...context.injectedVars ?? {}
+	};
+	const localWrappedBindings = { ...localSecretWrappedBindingConfig?.wrappedBindings ?? {} };
+	const workerConfig = {
+		name: options.name,
+		modules: true,
+		compatibilityDate: loadedConfig.compatibilityDate,
+		compatibilityFlags: compatFlags,
+		...bindings.kv && { kvNamespaces: Object.fromEntries(Object.entries(bindings.kv).map(([bindingName, bindingConfig]) => {
+			return [bindingName, getLocalKVNamespaceIdentifier(bindingConfig)];
+		})) },
+		...bindings.r2 && { r2Buckets: Object.fromEntries(Object.entries(bindings.r2).map(([bindingName, bindingConfig]) => {
+			return [bindingName, normalizeR2Binding(bindingConfig).bucketName];
+		})) },
+		...bindings.d1 && { d1Databases: Object.fromEntries(Object.entries(bindings.d1).map(([bindingName, bindingConfig]) => {
+			return [bindingName, getLocalD1DatabaseIdentifier(bindingConfig)];
+		})) },
+		...Object.keys(workerBindings).length > 0 && { bindings: workerBindings },
+		...sendEmailConfig && { email: sendEmailConfig },
+		...rateLimitsConfig && { ratelimits: rateLimitsConfig },
+		...versionMetadataConfig && { versionMetadata: versionMetadataConfig },
+		...workerLoadersConfig && { workerLoaders: workerLoadersConfig },
+		...mtlsCertificatesConfig && { mtlsCertificates: mtlsCertificatesConfig },
+		...dispatchNamespacesConfig && { dispatchNamespaces: dispatchNamespacesConfig },
+		...workflowsConfig && { workflows: workflowsConfig },
+		...pipelinesConfig && { pipelines: pipelinesConfig },
+		...hyperdrivesConfig && { hyperdrives: hyperdrivesConfig },
+		...imagesConfig && { images: imagesConfig },
+		...mediaConfig && { media: mediaConfig },
+		...streamConfig && { stream: streamConfig },
+		...flagshipConfig && { flagship: flagshipConfig },
+		...analyticsEngineConfig && { analyticsEngineDatasets: analyticsEngineConfig },
+		...tailConsumersConfig && { tails: tailConsumersConfig },
+		...streamingTailConsumersConfig && { streamingTails: streamingTailConsumersConfig },
+		...artifactsConfig && { artifacts: artifactsConfig },
+		...aiSearchNamespacesConfig && { aiSearchNamespaces: aiSearchNamespacesConfig },
+		...aiSearchInstancesConfig && { aiSearchInstances: aiSearchInstancesConfig },
+		...secretsStoreConfig && { secretsStoreSecrets: secretsStoreConfig },
+		...Object.keys(localWrappedBindings).length > 0 && { wrappedBindings: localWrappedBindings },
+		...queueProducers && { queueProducers },
+		...options.queueConsumers && { queueConsumers: options.queueConsumers },
+		...options.triggers && { triggers: options.triggers }
+	};
+	if (options.scriptPath) {
+		workerConfig.scriptPath = options.scriptPath;
+		workerConfig.modulesRoot = loadedConfig.baseDir ? resolve(cwd, loadedConfig.baseDir) : cwd;
+		workerConfig.modulesRules = [...loadedConfig.rules?.map(toMiniflareModuleRule) ?? [], ...DEFAULT_MODULE_RULES];
+	}
+	if (options.script) workerConfig.script = options.script;
+	if (options.durableObjects && Object.keys(options.durableObjects).length > 0) workerConfig.durableObjects = options.durableObjects;
+	if (options.serviceBindings && Object.keys(options.serviceBindings).length > 0) workerConfig.serviceBindings = options.serviceBindings;
+	if (options.outboundService !== void 0) workerConfig.outboundService = options.outboundService;
+	return workerConfig;
+}
+//#endregion
+//#region src/dev-server/worker-surface-paths.ts
+const DEFAULT_TRANSPORT_ENTRY_FILES = [
+	"src/transport.ts",
+	"src/transport.js",
+	"src/transport.mts",
+	"src/transport.mjs"
+];
+const resolveMainWorkerSurfacePaths = resolveWorkerSurfacePaths;
+function addWorkerWatchRoots(roots, cwd, configuredPath, defaultEntries) {
+	if (configuredPath === false || configuredPath === null) return;
+	if (typeof configuredPath === "string" && configuredPath) {
+		roots.add(dirname(resolve(cwd, configuredPath)));
+		return;
+	}
+	for (const defaultEntry of defaultEntries) roots.add(dirname(resolve(cwd, defaultEntry)));
+}
+function collectWorkerWatchRoots(cwd, config, mainWorkerSurfacePaths) {
+	const roots = /* @__PURE__ */ new Set();
+	for (const surfacePath of Object.values(mainWorkerSurfacePaths)) if (surfacePath) roots.add(dirname(surfacePath));
+	addWorkerWatchRoots(roots, cwd, config.files?.fetch, DEFAULT_FETCH_ENTRY_FILES);
+	addWorkerWatchRoots(roots, cwd, config.files?.queue, DEFAULT_QUEUE_ENTRY_FILES);
+	addWorkerWatchRoots(roots, cwd, config.files?.scheduled, DEFAULT_SCHEDULED_ENTRY_FILES);
+	addWorkerWatchRoots(roots, cwd, config.files?.email, DEFAULT_EMAIL_ENTRY_FILES);
+	addWorkerWatchRoots(roots, cwd, config.files?.transport, DEFAULT_TRANSPORT_ENTRY_FILES);
+	const routeDirectory = getRouteDirectoryCandidate(cwd, config);
+	if (routeDirectory) roots.add(routeDirectory.absoluteDir);
+	return [...roots];
+}
+//#endregion
+//#region src/dev-server/miniflare-dev-config.ts
+const INTERNAL_APP_SERVICE_BINDING = "__DEVFLARE_APP";
+/**
+* Resolve the browser-facing origin of the local dev runtime, used inside
+* locally-presigned R2 URLs. Honors `server.publicUrl` (reverse proxy /
+* tunnel setups); otherwise derives `http(s)://<host>:<port>` from the
+* Miniflare listen address, normalizing wildcard hosts to `localhost`.
+*/
+function resolveR2PresignOrigin(serverConfig, miniflareHost, miniflarePort) {
+	if (serverConfig?.publicUrl) return serverConfig.publicUrl.replace(/\/$/, "");
+	return `${serverConfig?.https ? "https" : "http"}://${miniflareHost === "0.0.0.0" || miniflareHost === "::" ? "localhost" : miniflareHost}:${miniflarePort}`;
+}
+/**
+* Build the complete Miniflare configuration for the dev server.
+*
+* IMPORTANT: When using multi-worker setup, ALL workers must go in the
+* `workers` array. The FIRST worker is the entrypoint and receives all
+* HTTP requests. Top-level script/modules options are NOT used when
+* workers array is present.
+*/
+function buildMiniflareDevConfig(input) {
+	const { config: loadedConfig, cwd, miniflarePort, miniflareHost = "127.0.0.1", persist, enableVite, debug, mainWorkerSurfacePaths, mainWorkerRoutes, mainWorkerScriptPath, bundledMainWorkerScriptPath, workflowEntrypointScript, browserShimPort, doResult, serviceBindingResolution, r2PresignSecret, logger } = input;
+	const bindings = loadedConfig.bindings ?? {};
+	const persistPath = resolve(cwd, ".devflare/data");
+	const appWorkerName = loadedConfig.name;
+	const shouldRunMainWorker = !enableVite && (hasWorkerSurfacePaths(mainWorkerSurfacePaths) || Boolean(mainWorkerRoutes?.routes.length));
+	const queueProducers = buildQueueProducers(bindings);
+	const queueConsumers = buildQueueConsumers(bindings);
+	const serverConfig = loadedConfig.server;
+	const sharedOptions = {
+		port: miniflarePort,
+		host: miniflareHost,
+		kvPersist: persist ? `${persistPath}/kv` : void 0,
+		r2Persist: persist ? `${persistPath}/r2` : void 0,
+		d1Persist: persist ? `${persistPath}/d1` : void 0,
+		cachePersist: persist ? `${persistPath}/cache` : void 0,
+		durableObjectsPersist: persist ? `${persistPath}/do` : void 0,
+		workflowsPersist: persist ? `${persistPath}/workflows` : void 0,
+		imagesPersist: persist ? `${persistPath}/images` : void 0,
+		streamPersist: persist ? `${persistPath}/stream` : void 0,
+		...serverConfig?.https !== void 0 && { https: serverConfig.https },
+		...serverConfig?.httpsKeyPath !== void 0 && { httpsKeyPath: serverConfig.httpsKeyPath },
+		...serverConfig?.httpsCertPath !== void 0 && { httpsCertPath: serverConfig.httpsCertPath },
+		...serverConfig?.inspectorPort !== void 0 && { inspectorPort: serverConfig.inspectorPort },
+		...serverConfig?.inspectorHost !== void 0 && { inspectorHost: serverConfig.inspectorHost },
+		...serverConfig?.upstream !== void 0 && { upstream: serverConfig.upstream },
+		...serverConfig?.liveReload !== void 0 && { liveReload: serverConfig.liveReload },
+		...serverConfig?.verbose !== void 0 && { verbose: serverConfig.verbose },
+		...serverConfig?.logRequests !== void 0 && { logRequests: serverConfig.logRequests },
+		...serverConfig?.cf !== void 0 && { cf: serverConfig.cf },
+		...serverConfig?.publicUrl !== void 0 && { publicUrl: serverConfig.publicUrl }
+	};
+	const localBindingShimServiceConfig = buildLocalBindingShimServiceConfig(loadedConfig);
+	const createServiceBindings = (extraBindings = {}) => buildServiceBindings(bindings, {
+		...serviceBindingResolution?.primaryServiceBindings ?? {},
+		...localBindingShimServiceConfig.serviceBindings,
+		...extraBindings
+	});
+	const sendEmailConfig = buildSendEmailConfig(bindings);
+	const rateLimitsConfig = buildRateLimitsConfig(bindings);
+	const versionMetadataConfig = buildVersionMetadataConfig(bindings);
+	const workerLoadersConfig = buildWorkerLoadersConfig(bindings);
+	const mtlsCertificatesConfig = buildMtlsCertificatesConfig(bindings);
+	const dispatchNamespacesConfig = buildDispatchNamespacesConfig(bindings);
+	const workflowsConfig = buildWorkflowsConfig(bindings);
+	const pipelinesConfig = buildPipelinesConfig(bindings);
+	const hyperdrivesConfig = buildHyperdrivesConfig(bindings);
+	const imagesConfig = bindings.images ? void 0 : buildImagesConfig(bindings);
+	const mediaConfig = bindings.media ? void 0 : buildMediaConfig(bindings);
+	const streamConfig = buildStreamConfig(bindings);
+	const flagshipConfig = buildFlagshipConfig(bindings);
+	const analyticsEngineConfig = buildAnalyticsEngineConfig(bindings);
+	const tailConsumersConfig = buildTailConsumersConfig(loadedConfig);
+	const streamingTailConsumersConfig = buildStreamingTailConsumersConfig(loadedConfig);
+	const artifactsConfig = buildArtifactsConfig(bindings);
+	const aiSearchNamespacesConfig = buildAiSearchNamespacesConfig(bindings);
+	const aiSearchInstancesConfig = buildAiSearchInstancesConfig(bindings);
+	const localSecretWrappedBindingConfig = buildLocalSecretWrappedBindingConfig(loadedConfig, cwd);
+	const localSecretBindingNames = new Set(localSecretWrappedBindingConfig.localBindingNames);
+	const workerContext = {
+		cwd,
+		loadedConfig,
+		bindings,
+		sendEmailConfig,
+		rateLimitsConfig,
+		versionMetadataConfig,
+		workerLoadersConfig,
+		mtlsCertificatesConfig,
+		dispatchNamespacesConfig,
+		workflowsConfig,
+		pipelinesConfig,
+		hyperdrivesConfig,
+		imagesConfig,
+		mediaConfig,
+		streamConfig,
+		flagshipConfig,
+		analyticsEngineConfig,
+		tailConsumersConfig,
+		streamingTailConsumersConfig,
+		artifactsConfig,
+		aiSearchNamespacesConfig,
+		aiSearchInstancesConfig,
+		secretsStoreConfig: buildSecretsStoreConfig(bindings, loadedConfig.secretsStoreId, localSecretBindingNames),
+		localSecretWrappedBindingConfig,
+		queueProducers,
+		injectedVars: bindings.r2 && r2PresignSecret ? {
+			DEVFLARE_R2_PRESIGN_SECRET: r2PresignSecret,
+			DEVFLARE_R2_PRESIGN_ORIGIN: resolveR2PresignOrigin(serverConfig, miniflareHost, miniflarePort)
+		} : void 0
+	};
+	const createWorkerConfig = (options) => makeMiniflareWorker(workerContext, options);
+	const gatewayWorker = createWorkerConfig({
+		name: "gateway",
+		script: [workflowEntrypointScript, getGatewayScript(loadedConfig.wsRoutes, debug, shouldRunMainWorker ? INTERNAL_APP_SERVICE_BINDING : null)].filter(Boolean).join("\n\n"),
+		serviceBindings: shouldRunMainWorker ? createServiceBindings({ [INTERNAL_APP_SERVICE_BINDING]: { name: appWorkerName } }) : createServiceBindings()
+	});
+	gatewayWorker.routes = ["*"];
+	const hasDurableObjectBundles = !!doResult && doResult.bundles.size > 0;
+	const browserBindingName = getSingleBrowserBindingName(bindings.browser);
+	const needsBrowserWorker = Boolean(browserBindingName && (hasDurableObjectBundles || shouldRunMainWorker));
+	const workers = [];
+	const durableObjects = {};
+	const browserShimUrl = `http://127.0.0.1:${browserShimPort}`;
+	const browserWorkerName = "browser-binding";
+	if (shouldRunMainWorker && mainWorkerScriptPath) {
+		const mainWorkerServiceBindings = createServiceBindings(browserBindingName ? { [browserBindingName]: { name: browserWorkerName } } : {});
+		const mainWorkerConfig = createWorkerConfig({
+			name: appWorkerName,
+			scriptPath: bundledMainWorkerScriptPath ?? mainWorkerScriptPath,
+			serviceBindings: mainWorkerServiceBindings,
+			queueConsumers,
+			triggers: loadedConfig.triggers?.crons?.length ? { crons: loadedConfig.triggers.crons } : void 0
+		});
+		workers.push(mainWorkerConfig);
+	}
+	if (doResult) for (const [bindingName, bundlePath] of doResult.bundles) {
+		const className = doResult.classes.get(bindingName);
+		if (!className) continue;
+		const workerName = `do-${bindingName.toLowerCase()}`;
+		const workerConfig = createWorkerConfig({
+			name: workerName,
+			scriptPath: bundlePath,
+			durableObjects: { [bindingName]: className },
+			serviceBindings: createServiceBindings(browserBindingName ? { [browserBindingName]: { name: browserWorkerName } } : {})
+		});
+		if (browserBindingName) logger?.debug(`DO ${workerName} has browser service binding: ${browserBindingName} → ${browserWorkerName}`);
+		logger?.debug(`DO ${workerName} config:`, JSON.stringify(workerConfig, null, 2));
+		workers.push(workerConfig);
+		durableObjects[bindingName] = {
+			className,
+			scriptName: workerName
+		};
+	}
+	if (needsBrowserWorker) {
+		const browserWorker = createWorkerConfig({
+			name: browserWorkerName,
+			script: getBrowserBindingScript(browserShimUrl, debug)
+		});
+		workers.push(browserWorker);
+		logger?.info(`Browser binding worker configured: ${browserBindingName} → ${browserShimUrl}`);
+	}
+	if (Object.keys(durableObjects).length > 0) {
+		gatewayWorker.durableObjects = durableObjects;
+		if (shouldRunMainWorker) {
+			const mainWorker = workers.find((worker) => worker.name === appWorkerName);
+			if (mainWorker) mainWorker.durableObjects = durableObjects;
+		}
+	}
+	return {
+		...sharedOptions,
+		workers: [
+			gatewayWorker,
+			...workers,
+			...serviceBindingResolution?.workers ?? [],
+			...localSecretWrappedBindingConfig.workers,
+			...localBindingShimServiceConfig.workers
+		]
+	};
+}
+//#endregion
+//#region src/dev-server/reload-queue.ts
+function createReloadQueue({ reload, logger }) {
+	let running = null;
+	let pending = null;
+	async function runOnce() {
+		try {
+			await reload();
+		} catch (error) {
+			logger?.error("[devflare dev] reload failed:", error);
+		}
+	}
+	function schedule() {
+		if (!running) {
+			running = runOnce().finally(() => {
+				running = null;
+			});
+			return running;
+		}
+		if (!pending) pending = running.then(() => {
+			pending = null;
+			running = runOnce().finally(() => {
+				running = null;
+			});
+			return running;
+		});
+		return pending;
+	}
+	async function drain() {
+		while (running || pending) if (pending) await pending;
+		else if (running) await running;
+	}
+	return {
+		schedule,
+		drain
+	};
+}
+//#endregion
+//#region src/dev-server/runtime-stdio.ts
+function writeStdout(logger, message) {
+	if (typeof logger?.log === "function") {
+		logger.log(message);
+		return;
+	}
+	if (typeof logger?.info === "function") {
+		logger.info(message);
+		return;
+	}
+	console.log(message);
+}
+function writeStderr(logger, message) {
+	if (typeof logger?.error === "function") {
+		logger.error(message);
+		return;
+	}
+	console.error(message);
+}
+function createRuntimeStdioForwarder(logger) {
+	return (stdout, stderr) => {
+		createInterface({ input: stdout }).on("line", (data) => {
+			writeStdout(logger, data);
+		});
+		createInterface({ input: stderr }).on("line", (data) => {
+			writeStderr(logger, data);
+		});
+	};
+}
+//#endregion
+//#region src/browser-shim/server.ts
+/**
+* Devflare's **local browser-rendering shim**.
+*
+* Accepts only loopback browser origins (e.g. `http://127.0.0.1:*`,
+* `http://localhost:*`) plus origin-less tool traffic (Puppeteer, curl, and
+* other non-browser clients that do not send an `Origin` header). Cross-origin
+* browser traffic is rejected at the request boundary.
+*
+* This is NOT a user-facing app route — it is devflare's protected helper
+* endpoint used by the local Browser Rendering binding to satisfy the
+* `@cloudflare/puppeteer` contract during local dev. The loopback-only posture
+* applies to this shim only and does not apply to the user's normal worker
+* routes.
+*/
+let cachedExecutablePath = null;
+/**
+* Default Chrome flags used when launching headless Chrome for local
+* browser-rendering emulation. Each flag is included for a deliberate reason;
+* edit cautiously.
+*
+* NOTE: `--no-sandbox` / `--disable-setuid-sandbox` are intentionally NOT part
+* of the defaults. Disabling the sandbox removes the primary boundary between
+* untrusted web content and the host and must be opted into explicitly via
+* `BrowserShimOptions.allowNoSandbox`.
+*/
+const DEFAULT_CHROME_FLAGS = [
+	"--disable-dev-shm-usage",
+	"--disable-gpu",
+	"--disable-software-rasterizer",
+	"--disable-extensions",
+	"--disable-background-networking",
+	"--disable-background-timer-throttling",
+	"--disable-backgrounding-occluded-windows",
+	"--disable-renderer-backgrounding",
+	"--disable-features=TranslateUI",
+	"--disable-ipc-flooding-protection",
+	"--disable-default-apps",
+	"--mute-audio",
+	"--js-flags=--max-old-space-size=4096"
+];
+/**
+* Flags appended only when `allowNoSandbox` is explicitly enabled. Kept in a
+* separate constant so callers and tests can assert they are opt-in.
+*/
+const NO_SANDBOX_FLAGS = ["--no-sandbox", "--disable-setuid-sandbox"];
+/**
+* Resolve the Chrome argv for a shim launch. Exported for testability.
+*/
+function resolveChromeFlags(options = {}) {
+	const flags = [...DEFAULT_CHROME_FLAGS];
+	if (options.allowNoSandbox) flags.unshift(...NO_SANDBOX_FLAGS);
+	return flags;
+}
+/**
+* Create a download progress logger that emits at most one "start" line and
+* exactly one "complete" line per download. Avoids the previous heuristic
+* percent-spam which could log the same bucket multiple times.
+*
+* The returned callback matches `@puppeteer/browsers` `downloadProgressCallback`.
+*/
+function createDownloadProgressLogger(logger, label = "Chrome") {
+	const state = {
+		started: false,
+		completed: false,
+		progress: {
+			bytesReceived: 0,
+			totalBytes: 0
+		}
+	};
+	return {
+		onProgress(downloadedBytes, totalBytes) {
+			if (state.completed) return;
+			state.progress.bytesReceived = downloadedBytes;
+			state.progress.totalBytes = totalBytes;
+			if (!state.started) {
+				state.started = true;
+				logger?.info(`[BrowserShim] Downloading ${label}...`);
+			}
+			if (totalBytes > 0 && downloadedBytes >= totalBytes) {
+				state.completed = true;
+				logger?.info(`[BrowserShim] ${label} download complete`);
+			}
+		},
+		finalize() {
+			if (!state.started || state.completed) return;
+			state.completed = true;
+			logger?.info(`[BrowserShim] ${label} download complete`);
+		},
+		get progress() {
+			return state.progress;
+		},
+		get started() {
+			return state.started;
+		},
+		get completed() {
+			return state.completed;
+		}
+	};
+}
+/**
+* Get or install Chrome Headless Shell
+* Uses a shared cache directory so Chrome is only installed once globally
+*/
+async function ensureChrome(cacheDir, logger) {
+	if (cachedExecutablePath && existsSync(cachedExecutablePath)) return cachedExecutablePath;
+	const platform = detectBrowserPlatform();
+	if (!platform) throw new Error("Could not detect browser platform");
+	const buildId = await resolveBuildId(Browser.CHROMEHEADLESSSHELL, platform, "stable");
+	logger?.debug(`[BrowserShim] Resolved Chrome Headless Shell build: ${buildId}`);
+	const progressLogger = createDownloadProgressLogger(logger, "Chrome");
+	const installedBrowser = await install({
+		browser: Browser.CHROMEHEADLESSSHELL,
+		buildId,
+		cacheDir,
+		downloadProgressCallback: (downloadedBytes, totalBytes) => {
+			progressLogger.onProgress(downloadedBytes, totalBytes);
+		}
+	});
+	progressLogger.finalize();
+	cachedExecutablePath = installedBrowser.executablePath;
+	logger?.success(`[BrowserShim] Chrome ready: ${installedBrowser.executablePath}`);
+	return installedBrowser.executablePath;
+}
+function createBrowserShim(options = {}) {
+	const { port = 8788, host = "127.0.0.1", logger, verbose = false, keepAlive = 6e4, cacheDir = join$1(homedir(), ".devflare", "chrome"), allowNoSandbox = false } = options;
+	const chromeLaunchArgs = resolveChromeFlags({ allowNoSandbox });
+	if (allowNoSandbox) logger?.warn("[BrowserShim] Launching Chrome with --no-sandbox (allowNoSandbox=true). Only use this in trusted CI/rootless environments.");
+	let server = null;
+	let executablePath = null;
+	const sessions = /* @__PURE__ */ new Map();
+	const history = [];
+	let WebSocketServerClass = null;
+	let WebSocketClass = null;
+	const maxRequestBodyBytes = 1024 * 1024;
+	function getRequestOrigin(req) {
+		const origin = req.headers.origin;
+		if (typeof origin === "string") return origin;
+		if (Array.isArray(origin) && origin[0]) return origin[0];
+		return null;
+	}
+	function isLoopbackOrigin(origin) {
+		try {
+			const url = new URL(origin);
+			return url.hostname === "127.0.0.1" || url.hostname === "localhost" || url.hostname === "::1" || url.hostname === "[::1]";
+		} catch {
+			return false;
+		}
+	}
+	function applyCorsHeaders(req, res) {
+		const origin = getRequestOrigin(req);
+		if (!origin) return true;
+		if (!isLoopbackOrigin(origin)) {
+			res.writeHead(403, { "Content-Type": "application/json" });
+			res.end(JSON.stringify({ error: "Forbidden origin" }));
+			return false;
+		}
+		res.setHeader("Access-Control-Allow-Origin", origin);
+		res.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
+		res.setHeader("Access-Control-Allow-Headers", "Content-Type");
+		res.setHeader("Vary", "Origin");
+		return true;
+	}
+	/**
+	* Launch a new browser and create a session
+	*/
+	async function acquireSession(acquireOptions) {
+		if (!executablePath) throw new Error("Chrome not initialized");
+		const browser = await puppeteerCore.launch({
+			executablePath,
+			headless: true,
+			protocolTimeout: 12e4,
+			args: chromeLaunchArgs
+		});
+		const wsEndpoint = browser.wsEndpoint();
+		const sessionId = crypto.randomUUID();
+		const session = {
+			sessionId,
+			browser,
+			wsEndpoint,
+			startTime: Date.now()
+		};
+		sessions.set(sessionId, session);
+		const timeout = acquireOptions?.keep_alive ?? keepAlive;
+		if (timeout > 0) session.idleTimeout = setTimeout(async () => {
+			const s = sessions.get(sessionId);
+			if (s && !s.connectionId) await closeSession(sessionId, 2, "BrowserIdle");
+		}, timeout);
+		if (verbose) logger?.debug(`[BrowserShim] Acquired session ${sessionId}`);
+		return { sessionId };
+	}
+	/**
+	* Close a browser session
+	*/
+	async function closeSession(sessionId, closeReason = 1, closeReasonText = "NormalClosure") {
+		const session = sessions.get(sessionId);
+		if (!session) return;
+		if (session.idleTimeout) clearTimeout(session.idleTimeout);
+		try {
+			await session.browser.close();
+		} catch {}
+		sessions.delete(sessionId);
+		history.unshift({
+			sessionId,
+			startTime: session.startTime,
+			endTime: Date.now(),
+			closeReason,
+			closeReasonText
+		});
+		if (history.length > 100) history.pop();
+		if (verbose) logger?.debug(`[BrowserShim] Closed session ${sessionId}: ${closeReasonText}`);
+	}
+	/**
+	* Handle HTTP requests
+	*/
+	async function handleRequest(req, res) {
+		const url = new URL(req.url || "/", `http://${host}:${port}`);
+		const method = req.method || "GET";
+		logger?.debug(`[BrowserShim] ${method} ${url.pathname}${url.search ? url.search : ""}`);
+		if (!applyCorsHeaders(req, res)) return;
+		if (method === "OPTIONS") {
+			res.writeHead(204);
+			res.end();
+			return;
+		}
+		if (url.pathname === "/v1/acquire" && (method === "POST" || method === "GET")) {
+			try {
+				let acquireOptions = {};
+				if (method === "GET") {
+					const keepAlive = url.searchParams.get("keep_alive");
+					if (keepAlive) acquireOptions.keep_alive = Number.parseInt(keepAlive, 10);
+				} else try {
+					const body = await readBody(req);
+					acquireOptions = JSON.parse(body);
+				} catch {}
+				sendJson(res, 200, await acquireSession(acquireOptions));
+			} catch (error) {
+				const msg = error instanceof Error ? error.message : "Failed to acquire browser";
+				logger?.error(`[BrowserShim] Acquire failed: ${msg}`);
+				sendJson(res, 500, { error: msg });
+			}
+			return;
+		}
+		if (url.pathname === "/v1/sessions" && method === "GET") {
+			sendJson(res, 200, Array.from(sessions.values()).map((s) => ({
+				sessionId: s.sessionId,
+				startTime: s.startTime,
+				connectionId: s.connectionId,
+				connectionStartTime: s.connectionStartTime
+			})));
+			return;
+		}
+		if (url.pathname === "/v1/history" && method === "GET") {
+			sendJson(res, 200, history.slice(0, 50));
+			return;
+		}
+		if (url.pathname === "/v1/limits" && method === "GET") {
+			sendJson(res, 200, {
+				activeSessions: Array.from(sessions.keys()).map((id) => ({ id })),
+				allowedBrowserAcquisitions: 10,
+				maxConcurrentSessions: 10,
+				timeUntilNextAllowedBrowserAcquisition: 0
+			});
+			return;
+		}
+		if (url.pathname.startsWith("/v1/session/") && method === "GET") {
+			const sessionId = url.pathname.slice(12);
+			const session = sessions.get(sessionId);
+			if (!session) {
+				sendJson(res, 404, { error: "Session not found" });
+				return;
+			}
+			sendJson(res, 200, {
+				sessionId: session.sessionId,
+				wsEndpoint: session.wsEndpoint,
+				startTime: session.startTime,
+				connectionId: session.connectionId,
+				connectionStartTime: session.connectionStartTime
+			});
+			return;
+		}
+		if (url.pathname === "/_devflare/browser/health") {
+			sendJson(res, 200, {
+				ok: true,
+				activeSessions: sessions.size,
+				historySize: history.length,
+				executablePath
+			});
+			return;
+		}
+		if (url.pathname === "/v1/connectDevtools") {
+			res.writeHead(426, { "Content-Type": "text/plain" });
+			res.end("WebSocket upgrade required");
+			return;
+		}
+		res.writeHead(404, { "Content-Type": "text/plain" });
+		res.end("Not found");
+	}
+	/**
+	* Read request body as string
+	*/
+	function readBody(req) {
+		return new Promise((resolve, reject) => {
+			const chunks = [];
+			let totalBytes = 0;
+			req.on("data", (chunk) => {
+				totalBytes += chunk.length;
+				if (totalBytes > maxRequestBodyBytes) {
+					req.destroy();
+					reject(/* @__PURE__ */ new Error(`Request body exceeds ${maxRequestBodyBytes} bytes`));
+					return;
+				}
+				chunks.push(chunk);
+			});
+			req.on("end", () => resolve(Buffer.concat(chunks).toString()));
+			req.on("error", reject);
+		});
+	}
+	/**
+	* Send JSON response
+	*/
+	function sendJson(res, status, data) {
+		const body = JSON.stringify(data);
+		res.writeHead(status, {
+			"Content-Type": "application/json",
+			"Content-Length": Buffer.byteLength(body)
+		});
+		res.end(body);
+	}
+	/**
+	* Start the browser shim server
+	*/
+	async function start() {
+		logger?.info("[BrowserShim] Ensuring Chrome Headless Shell is available...");
+		executablePath = await ensureChrome(cacheDir, logger);
+		try {
+			const wsModule = await import("ws");
+			WebSocketServerClass = wsModule.WebSocketServer || wsModule.default?.WebSocketServer;
+			WebSocketClass = wsModule.WebSocket || wsModule.default?.WebSocket || wsModule.default;
+		} catch {
+			logger?.warn("[BrowserShim] ws package not found, WebSocket proxy disabled");
+			logger?.warn("[BrowserShim] Install with: npm install ws");
+		}
+		server = createServer((req, res) => {
+			handleRequest(req, res).catch((error) => {
+				logger?.error("[BrowserShim] Request error:", error);
+				res.writeHead(500);
+				res.end("Internal server error");
+			});
+		});
+		if (WebSocketServerClass) {
+			const wss = new WebSocketServerClass({ noServer: true });
+			server.on("upgrade", (request, socket, head) => {
+				const origin = getRequestOrigin(request);
+				if (origin && !isLoopbackOrigin(origin)) {
+					socket.write("HTTP/1.1 403 Forbidden\r\n\r\n");
+					socket.destroy();
+					return;
+				}
+				const url = new URL(request.url || "/", `http://${host}:${port}`);
+				if (url.pathname !== "/v1/connectDevtools") {
+					socket.destroy();
+					return;
+				}
+				const sessionId = url.searchParams.get("browser_session");
+				if (!sessionId) {
+					socket.write("HTTP/1.1 400 Bad Request\r\n\r\n");
+					socket.destroy();
+					return;
+				}
+				const session = sessions.get(sessionId);
+				if (!session) {
+					socket.write("HTTP/1.1 404 Not Found\r\n\r\n");
+					socket.destroy();
+					return;
+				}
+				const connectionId = crypto.randomUUID();
+				session.connectionId = connectionId;
+				session.connectionStartTime = Date.now();
+				if (session.idleTimeout) {
+					clearTimeout(session.idleTimeout);
+					session.idleTimeout = void 0;
+				}
+				wss.handleUpgrade(request, socket, head, (ws) => {
+					if (verbose) logger?.debug(`[BrowserShim] WebSocket connected for session ${sessionId}`);
+					const chromeWs = new WebSocketClass(session.wsEndpoint);
+					let chromeConnected = false;
+					const connectTimeout = setTimeout(() => {
+						if (!chromeConnected) {
+							logger?.error("[BrowserShim] Chrome connection timeout");
+							try {
+								ws.close(1011, "Chrome connection timeout");
+								chromeWs.close();
+							} catch {}
+							closeSession(sessionId, 5, "ChromeConnectionTimeout").catch(() => {});
+						}
+					}, 1e4);
+					chromeWs.on("open", () => {
+						chromeConnected = true;
+						clearTimeout(connectTimeout);
+						if (verbose) logger?.debug("[BrowserShim] Connected to Chrome DevTools");
+					});
+					chromeWs.on("message", (data) => {
+						if (ws.readyState === 1) ws.send(data);
+					});
+					chromeWs.on("close", (code, reason) => {
+						if (verbose) logger?.debug(`[BrowserShim] Chrome WS closed: ${code}`);
+						const validCode = typeof code === "number" && code >= 1e3 && code <= 4999 ? code : 1e3;
+						try {
+							ws.close(validCode, reason?.toString?.() || "");
+						} catch {}
+						closeSession(sessionId, 2, "ChromeDisconnected").catch((err) => {
+							logger?.error("[BrowserShim] Error closing session after Chrome disconnect:", err);
+						});
+					});
+					chromeWs.on("error", (error) => {
+						logger?.error("[BrowserShim] Chrome WS error:", error.message);
+						try {
+							ws.close(1011, "Chrome WebSocket error");
+						} catch {}
+						closeSession(sessionId, 4, "ChromeError").catch((err) => {
+							logger?.error("[BrowserShim] Error closing session after Chrome error:", err);
+						});
+					});
+					ws.on("message", (data) => {
+						if (chromeWs.readyState === 1) chromeWs.send(data);
+					});
+					ws.on("close", (code, reason) => {
+						if (verbose) logger?.debug(`[BrowserShim] Client WS closed for session ${sessionId}`);
+						const validCode = typeof code === "number" && code >= 1e3 && code <= 4999 ? code : 1e3;
+						try {
+							chromeWs.close(validCode, reason?.toString?.() || "");
+						} catch {}
+						const s = sessions.get(sessionId);
+						if (s && s.connectionId === connectionId) {
+							s.connectionId = void 0;
+							s.connectionStartTime = void 0;
+							closeSession(sessionId, 1, "ClientDisconnected").catch((err) => {
+								logger?.error("[BrowserShim] Error closing session after disconnect:", err);
+							});
+						}
+					});
+					ws.on("error", (error) => {
+						logger?.error("[BrowserShim] Client WS error:", error.message);
+						try {
+							chromeWs.close();
+						} catch {}
+					});
+				});
+			});
+		}
+		await new Promise((resolve, reject) => {
+			server.on("error", reject);
+			server.listen(port, host, () => {
+				resolve();
+			});
+		});
+		logger?.success(`Browser shim server ready on http://${host}:${port}`);
+	}
+	/**
+	* Stop the server and close all browsers
+	*/
+	async function stop() {
+		for (const sessionId of Array.from(sessions.keys())) await closeSession(sessionId, 3, "ServerShutdown");
+		if (server) {
+			await new Promise((resolve) => {
+				server.close(() => resolve());
+			});
+			server = null;
+		}
+		logger?.info("Browser shim server stopped");
+	}
+	/**
+	* Get the server URL
+	*/
+	function getUrl() {
+		return `http://${host}:${port}`;
+	}
+	return {
+		start,
+		stop,
+		getUrl
+	};
+}
+//#endregion
+//#region src/dev-server/server-startup-helpers.ts
+/**
+* Emit informational/warning lines about detected worker handlers in
+* worker-only (no-Vite) mode.
+*/
+function logWorkerHandlerDetection(logger, enableVite, hasSurface, mainWorkerSurfacePaths, mainWorkerRoutes) {
+	if (enableVite) return;
+	if (hasSurface) {
+		const detectedWorkerHandlers = Object.entries(mainWorkerSurfacePaths).filter(([, surfacePath]) => !!surfacePath).map(([surfaceName, surfacePath]) => `${surfaceName}=${surfacePath}`);
+		const detectedRouteHandlers = mainWorkerRoutes?.routes.map((route) => `route=${route.filePath}`) ?? [];
+		logger?.info(`Worker handlers detected: ${[...detectedWorkerHandlers, ...detectedRouteHandlers].join(", ")}`);
+	} else logger?.warn("No local worker handler entry was found for worker-only mode");
+}
+/**
+* Emit warnings about remote-only bindings (AI, Vectorize) and any missing
+* prerequisites (accountId, wrangler login).
+*/
+function logRemoteBindingRequirements(logger, remoteCheck) {
+	if (!remoteCheck.hasRemoteBindings) return;
+	logger?.info("");
+	logger?.warn("⚠️  Remote-only bindings detected:");
+	for (const binding of remoteCheck.remoteBindings) logger?.warn(`   • ${binding}`);
+	logger?.info("");
+	if (remoteCheck.missingAccountId) {
+		logger?.warn("⚠️  WARN: accountId is not set in devflare.config.ts");
+		logger?.warn("   Remote bindings (AI, Vectorize) require accountId to charge the correct account.");
+		logger?.warn("   Add: accountId: 'your-cloudflare-account-id'");
+		logger?.info("");
+	}
+	if (remoteCheck.notLoggedIn) {
+		logger?.warn("⚠️  WARN: Not logged in to Wrangler");
+		logger?.warn("   Remote bindings require authentication.");
+		logger?.warn("   Run: bunx wrangler login");
+		logger?.info("");
+	}
+	if (!remoteCheck.missingAccountId && !remoteCheck.notLoggedIn) {
+		logger?.success("✓ Remote binding requirements met");
+		logger?.info("");
+	}
+}
+function formatErrorMessage(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+/**
+* Resolve the path to watch for config changes. Prefers an explicit
+* `configPath` if it's directly accessible on disk, otherwise falls back to
+* the auto-discovered config path under `cwd`. Returns `null` when neither
+* is available.
+*/
+async function resolveWorkerConfigWatchPath(cwd, configPath) {
+	if (configPath) {
+		const explicitPath = resolve(cwd, configPath);
+		const fs = await import("node:fs/promises");
+		try {
+			await fs.access(explicitPath);
+			return explicitPath;
+		} catch {}
+	}
+	return await resolveConfigPath(cwd) ?? null;
+}
+/**
+* Pretty-print the resolved Miniflare config (truncating long inline scripts)
+* before `Miniflare` is constructed. Only emits when verbose/debug logging is
+* requested by the caller.
+*/
+function logMiniflareConfigDiagnostics(logger, mfConfig) {
+	logger?.info("=== MINIFLARE CONFIG DEBUG ===");
+	logger?.info("Full config:", JSON.stringify(mfConfig, (key, value) => {
+		if (key === "script" && typeof value === "string" && value.length > 200) return value.substring(0, 200) + "...[truncated]";
+		return value;
+	}, 2));
+	if (mfConfig.workers) {
+		logger?.info("Workers order:");
+		for (const w of mfConfig.workers) {
+			logger?.info(`  → ${w.name}:`);
+			logger?.info(`      script: ${w.script ? "inline" : w.scriptPath}`);
+			logger?.info(`      browserRendering: ${JSON.stringify(w.browserRendering)}`);
+			logger?.info(`      durableObjects: ${JSON.stringify(w.durableObjects)}`);
+		}
+	}
+}
+/**
+* After `Miniflare` is `ready`, query each declared worker's bindings and
+* log them. Best-effort: any per-worker failure is logged at debug and does
+* not abort the rest of the diagnostics.
+*/
+async function logMiniflareBindingDiagnostics(logger, miniflare, mfConfig) {
+	try {
+		const gatewayBindings = await miniflare.getBindings("gateway");
+		logger?.info("Gateway worker bindings:", Object.keys(gatewayBindings));
+		if (mfConfig.workers) {
+			for (const w of mfConfig.workers) if (w.name !== "gateway") try {
+				const doBindings = await miniflare.getBindings(w.name);
+				logger?.info(`${w.name} worker bindings:`, Object.keys(doBindings));
+				if ("BROWSER" in doBindings) logger?.success(`${w.name} has BROWSER binding!`);
+				else logger?.warn(`${w.name} is MISSING BROWSER binding`);
+			} catch (error) {
+				logger?.debug(`Skipping binding diagnostics for ${w.name}: ${formatErrorMessage(error)}`);
+			}
+		}
+	} catch (error) {
+		logger?.debug(`Skipping Miniflare binding diagnostics: ${formatErrorMessage(error)}`);
+	}
+}
+/**
+* If the config declares a single browser-rendering binding, construct and
+* start a `BrowserShim` listening on `browserShimPort`. Returns `null` when
+* no browser binding is configured (no shim needed).
+*/
+async function maybeStartBrowserShim(config, options) {
+	const browserBinding = getSingleBrowserBindingName(config.bindings?.browser);
+	if (!browserBinding) return null;
+	options.logger?.info(`Starting Browser Rendering shim (binding: ${browserBinding})...`);
+	const shim = createBrowserShim({
+		port: options.browserShimPort,
+		host: "127.0.0.1",
+		logger: options.logger,
+		verbose: options.verbose
+	});
+	await shim.start();
+	return shim;
+}
+/**
+* If the config declares a `files.durableObjects` glob, construct a
+* `DOBundler`, run an initial build, and start watching. Returns
+* `{ bundler, result }` (`{ null, null }` when no DO pattern is configured).
+* The `onRebuild` callback fires on each subsequent rebuild — typically used
+* to schedule a Miniflare reload.
+*/
+async function maybeStartDOBundler(config, options) {
+	const doPattern = config.files?.durableObjects;
+	if (typeof doPattern !== "string" || !doPattern) return {
+		bundler: null,
+		result: null
+	};
+	const outDir = resolve(options.cwd, ".devflare/do-bundles");
+	const bundler = createDOBundler({
+		cwd: options.cwd,
+		pattern: doPattern,
+		outDir,
+		rolldownOptions: config.rolldown?.options,
+		sourcemap: config.rolldown?.sourcemap,
+		minify: config.rolldown?.minify,
+		logger: options.logger,
+		onRebuild: options.onRebuild
+	});
+	const result = await bundler.build();
+	await bundler.watch();
+	return {
+		bundler,
+		result
+	};
+}
+/**
+* Resolve whether Vite should run for this package, and if so, write the
+* generated Vite config under `.devflare/`. Returns:
+*   - `{ enableVite: false, generatedViteConfigPath: null }` when Vite is
+*     not requested or no Vite config exists for this package
+*   - `{ enableVite: true, generatedViteConfigPath }` after writing the
+*     generated config
+*/
+async function resolveViteIntegration(options) {
+	if (!options.enableViteRequested) return {
+		enableVite: false,
+		generatedViteConfigPath: null
+	};
+	const viteMode = await resolveViteMode(options.cwd, { requested: true });
+	if (!viteMode.enableVite) {
+		options.logger?.info("Vite disabled: no vite config found for this package");
+		return {
+			enableVite: false,
+			generatedViteConfigPath: null
+		};
+	}
+	const generatedViteConfigPath = await writeGeneratedViteConfig({
+		cwd: options.cwd,
+		configPath: options.configPath,
+		localConfigPath: viteMode.viteConfigPath,
+		bridgePort: options.miniflarePort
+	});
+	options.logger?.debug(`Generated Vite config → ${generatedViteConfigPath}`);
+	return {
+		enableVite: true,
+		generatedViteConfigPath
+	};
+}
+//#endregion
+//#region src/dev-server/vite-process.ts
+/**
+* Start the Vite dev server process.
+*/
+async function startViteProcess(options) {
+	const { cwd, configPath, vitePort, miniflarePort, generatedViteConfigPath, r2Presign, logger } = options;
+	const args = [
+		"vite",
+		"dev",
+		"--port",
+		String(vitePort)
+	];
+	if (generatedViteConfigPath) args.push("--config", generatedViteConfigPath);
+	const viteProcess = spawn("bunx", args, {
+		cwd,
+		stdio: [
+			"inherit",
+			"pipe",
+			"pipe"
+		],
+		windowsHide: true,
+		env: {
+			...process.env,
+			DEVFLARE_DEV: "true",
+			DEVFLARE_BRIDGE_PORT: String(miniflarePort),
+			...configPath ? { DEVFLARE_CONFIG_PATH: configPath } : {},
+			...r2Presign ? {
+				DEVFLARE_R2_PRESIGN_SECRET: r2Presign.secret,
+				DEVFLARE_R2_PRESIGN_ORIGIN: r2Presign.origin
+			} : {},
+			FORCE_COLOR: "1"
+		}
+	});
+	const readyUrl = await waitForViteReady(viteProcess, {
+		onStdout(chunk) {
+			process.stdout.write(chunk);
+		},
+		onStderr(chunk) {
+			process.stderr.write(chunk);
+		}
+	});
+	if (readyUrl) {
+		logger?.success(`Vite dev server started on ${readyUrl}`);
+		return viteProcess;
+	}
+	logger?.warn("Vite process started, but the final local URL could not be confirmed yet");
+	return viteProcess;
+}
+//#endregion
+//#region src/dev-server/worker-source-watcher.ts
+async function startWorkerSourceWatcher(options) {
+	const { watchTargets, resolvedWorkerConfigPath, logger, onConfigChange, onWorkerChange } = options;
+	if (watchTargets.length === 0) return null;
+	const chokidar = await import("chokidar");
+	const isWindows = process.platform === "win32";
+	const ignoredSegments = [
+		"/node_modules/",
+		"/.git/",
+		"/.devflare/",
+		"/dist/"
+	];
+	const normalizePath = (filePath) => filePath.replace(/\\/g, "/");
+	const isIgnoredPath = (filePath) => {
+		const normalizedPath = normalizePath(filePath);
+		return ignoredSegments.some((segment) => normalizedPath.includes(segment));
+	};
+	let reloadTimeout = null;
+	let reloadInProgress = false;
+	let pendingReloadPath = null;
+	const flushPendingReload = async () => {
+		if (!pendingReloadPath) return;
+		const nextPath = pendingReloadPath;
+		pendingReloadPath = null;
+		await triggerReload(nextPath);
+	};
+	const triggerReload = async (filePath) => {
+		if (reloadInProgress) {
+			pendingReloadPath = filePath;
+			return;
+		}
+		reloadInProgress = true;
+		try {
+			const normalizedConfigPath = resolvedWorkerConfigPath ? normalizePath(resolvedWorkerConfigPath) : null;
+			if (normalizedConfigPath && normalizePath(filePath) === normalizedConfigPath) {
+				logger?.info(`Devflare config changed: ${filePath}`);
+				await onConfigChange();
+				return;
+			}
+			logger?.info(`Worker source changed: ${filePath}`);
+			await onWorkerChange();
+		} catch (error) {
+			logger?.error("Worker source reload failed:", error);
+		} finally {
+			reloadInProgress = false;
+			await flushPendingReload();
+		}
+	};
+	const scheduleReload = (filePath) => {
+		if (reloadTimeout) clearTimeout(reloadTimeout);
+		reloadTimeout = setTimeout(() => {
+			reloadTimeout = null;
+			triggerReload(filePath);
+		}, 150);
+	};
+	const watcher = chokidar.watch(watchTargets, {
+		ignoreInitial: true,
+		usePolling: isWindows,
+		interval: isWindows ? 300 : void 0,
+		awaitWriteFinish: {
+			stabilityThreshold: 100,
+			pollInterval: 50
+		},
+		ignored: (filePath) => isIgnoredPath(filePath)
+	});
+	const onFileEvent = (filePath) => {
+		if (isIgnoredPath(filePath)) return;
+		scheduleReload(filePath);
+	};
+	watcher.on("change", onFileEvent);
+	watcher.on("add", onFileEvent);
+	watcher.on("unlink", onFileEvent);
+	watcher.on("error", (error) => {
+		logger?.error("Worker source watcher error:", error);
+	});
+	await new Promise((resolvePromise, rejectPromise) => {
+		const handleReady = () => {
+			watcher.off("error", handleInitialError);
+			logger?.info(`Worker source watcher ready (${watchTargets.length} target(s))`);
+			resolvePromise();
+		};
+		const handleInitialError = (error) => {
+			watcher.off("ready", handleReady);
+			rejectPromise(error instanceof Error ? error : new Error(String(error)));
+		};
+		watcher.once("ready", handleReady);
+		watcher.once("error", handleInitialError);
+	});
+	return watcher;
+}
+/**
+* Compute the diff between current and next watch-target lists and apply it
+* to the given watcher. Returns the deduped next-targets array which the
+* caller should store as the new "current" state.
+*/
+async function applyWatcherTargetDiff(watcher, currentTargets, nextTargets) {
+	const nextSet = new Set(nextTargets);
+	const targetsToRemove = currentTargets.filter((t) => !nextSet.has(t));
+	const targetsToAdd = nextTargets.filter((t) => !currentTargets.includes(t));
+	if (targetsToRemove.length > 0) await watcher.unwatch(targetsToRemove);
+	if (targetsToAdd.length > 0) watcher.add(targetsToAdd);
+	return nextTargets;
+}
+//#endregion
+//#region src/dev-server/server.ts
+function createDevServer(options) {
+	const { cwd, configPath, vitePort = 5173, miniflarePort = 8787, miniflareHost = "127.0.0.1", enableVite: enableViteRequested = true, persist = true, logger, verbose = false, debug = process.env.DEVFLARE_DEBUG === "true" } = options;
+	const state = createDevServerState({ enableVite: enableViteRequested });
+	const r2PresignSecret = `${crypto.randomUUID()}${crypto.randomUUID()}`;
+	const reloadQueue = createReloadQueue({
+		reload: async () => {
+			if (!state.miniflare) return;
+			const { Log, LogLevel } = await import("miniflare");
+			const mfConfig = buildMiniflareConfig(state.currentDoResult);
+			const log = createMiniflareLog(Log, LogLevel, "DEBUG", logger);
+			if (log) mfConfig.log = log;
+			mfConfig.handleRuntimeStdio = createRuntimeStdioForwarder(logger);
+			logger?.info("Reloading Miniflare...");
+			await state.miniflare.setOptions(mfConfig);
+			logger?.success("Miniflare reloaded");
+		},
+		logger
+	});
+	async function bundleMainWorker() {
+		if (!state.mainWorkerScriptPath || !state.config) {
+			state.bundledMainWorkerScriptPath = null;
+			return;
+		}
+		state.bundledMainWorkerScriptPath = await bundleWorkerEntry({
+			cwd,
+			inputFile: state.mainWorkerScriptPath,
+			outFile: resolve(cwd, ".devflare", "worker-entrypoints", "main.js"),
+			rolldownOptions: state.config.rolldown?.options,
+			sourcemap: state.config.rolldown?.sourcemap,
+			minify: state.config.rolldown?.minify,
+			logger
+		});
+		logger?.debug(`Bundled main worker → ${state.bundledMainWorkerScriptPath}`);
+	}
+	function buildMiniflareConfig(doResult) {
+		if (!state.config) throw new Error("Config not loaded");
+		return buildMiniflareDevConfig({
+			config: state.config,
+			cwd,
+			miniflarePort,
+			miniflareHost,
+			persist,
+			enableVite: state.enableVite,
+			debug,
+			mainWorkerSurfacePaths: state.mainWorkerSurfacePaths,
+			mainWorkerRoutes: state.mainWorkerRoutes,
+			mainWorkerScriptPath: state.mainWorkerScriptPath,
+			bundledMainWorkerScriptPath: state.bundledMainWorkerScriptPath,
+			workflowEntrypointScript: state.workflowEntrypointScript,
+			browserShimPort: state.browserShimPort,
+			doResult,
+			serviceBindingResolution: state.serviceBindingResolution,
+			r2PresignSecret,
+			logger
+		});
+	}
+	async function bundleWorkflowEntrypoints() {
+		if (!state.config) {
+			state.workflowEntrypointScript = "";
+			return;
+		}
+		state.workflowEntrypointScript = await bundleWorkflowEntrypointScript(state.config, cwd, { logger });
+	}
+	/**
+	* Start Miniflare with current config
+	*/
+	async function startMiniflare(doResult) {
+		const { Miniflare, Log, LogLevel } = await import("miniflare");
+		const mfConfig = buildMiniflareConfig(doResult);
+		const log = createMiniflareLog(Log, LogLevel, "DEBUG", logger);
+		if (log) mfConfig.log = log;
+		mfConfig.handleRuntimeStdio = createRuntimeStdioForwarder(logger);
+		const shouldLogMiniflareDiagnostics = verbose || debug;
+		if (shouldLogMiniflareDiagnostics) logMiniflareConfigDiagnostics(logger, mfConfig);
+		state.miniflare = new Miniflare(mfConfig);
+		await state.miniflare.ready;
+		const displayHost = miniflareHost === "0.0.0.0" || miniflareHost === "::" ? "localhost" : miniflareHost;
+		logger?.success(`Miniflare ready on http://${displayHost}:${miniflarePort}`);
+		if (shouldLogMiniflareDiagnostics) await logMiniflareBindingDiagnostics(logger, state.miniflare, mfConfig);
+	}
+	/**
+	* Reload Miniflare with updated DO bundles
+	*/
+	async function reloadMiniflare(doResult) {
+		state.currentDoResult = doResult;
+		await reloadQueue.schedule();
+	}
+	async function refreshWorkerOnlySurfaceState() {
+		if (!state.config) return;
+		state.mainWorkerSurfacePaths = await resolveMainWorkerSurfacePaths(cwd, state.config);
+		state.mainWorkerRoutes = await discoverRoutes(cwd, state.config);
+		const composedMainEntry = await prepareComposedWorkerEntrypoint(cwd, state.config, void 0, { devInternalEmail: true });
+		state.mainWorkerScriptPath = composedMainEntry ? composedMainEntry : null;
+		if (state.mainWorkerScriptPath) await bundleMainWorker();
+		else state.bundledMainWorkerScriptPath = null;
+		await syncWorkerWatchTargets();
+	}
+	function getWorkerWatchTargets() {
+		if (state.enableVite || !state.config) return [];
+		const targets = collectWorkerWatchRoots(cwd, state.config, state.mainWorkerSurfacePaths);
+		if (state.resolvedWorkerConfigPath) targets.push(state.resolvedWorkerConfigPath);
+		return [...new Set(targets)];
+	}
+	async function syncWorkerWatchTargets() {
+		if (!state.workerSourceWatcher) return;
+		state.workerWatchTargets = await applyWatcherTargetDiff(state.workerSourceWatcher, state.workerWatchTargets, getWorkerWatchTargets());
+	}
+	async function reloadWorkerOnlyConfig() {
+		await loadRuntimeConfigWhenEnvReady();
+		if (!state.config) return;
+		setLocalSendEmailBindings(state.config.bindings?.sendEmail ?? {});
+		await bundleWorkflowEntrypoints();
+		await refreshWorkerOnlySurfaceState();
+		await reloadMiniflare(state.currentDoResult);
+	}
+	async function loadRuntimeConfig() {
+		state.resolvedWorkerConfigPath = await resolveWorkerConfigWatchPath(cwd, configPath);
+		state.config = await applyLocalDevVarsToConfig(await resolveConfigEnvVars(await loadConfig({
+			cwd,
+			configFile: configPath
+		}), {
+			cwd,
+			configPath: state.resolvedWorkerConfigPath ?? configPath,
+			mode: "dev"
+		}), {
+			cwd,
+			configPath: state.resolvedWorkerConfigPath ?? void 0
+		});
+		state.serviceBindingResolution = state.config.bindings?.services ? await resolveServiceBindings(state.config, state.resolvedWorkerConfigPath ? dirname(state.resolvedWorkerConfigPath) : cwd) : null;
+	}
+	async function waitForDotenvChange() {
+		const configWatchPath = state.resolvedWorkerConfigPath ?? await resolveWorkerConfigWatchPath(cwd, configPath);
+		const watchPaths = getDevflareDotenvPaths(configWatchPath ? dirname(configWatchPath) : cwd);
+		const { watch } = await import("chokidar");
+		await new Promise((resolveWait, rejectWait) => {
+			const watcher = watch(watchPaths, {
+				ignoreInitial: true,
+				awaitWriteFinish: {
+					stabilityThreshold: 100,
+					pollInterval: 25
+				}
+			});
+			const finish = () => {
+				watcher.close().then(resolveWait, rejectWait);
+			};
+			watcher.on("add", finish);
+			watcher.on("change", finish);
+			watcher.on("unlink", finish);
+			watcher.on("error", rejectWait);
+		});
+	}
+	async function loadRuntimeConfigWhenEnvReady() {
+		while (true) try {
+			await loadRuntimeConfig();
+			return;
+		} catch (error) {
+			if (!(error instanceof EnvVarResolutionError)) throw error;
+			logger?.warn(error.message);
+			logger?.info("Devflare dev is waiting for .env or .env.dev to change before starting.");
+			await waitForDotenvChange();
+		}
+	}
+	async function startWorkerSourceWatcher$1() {
+		if (state.enableVite || !state.config) return;
+		const watchTargets = getWorkerWatchTargets();
+		if (watchTargets.length === 0) return;
+		state.workerWatchTargets = watchTargets;
+		state.workerSourceWatcher = await startWorkerSourceWatcher({
+			watchTargets,
+			resolvedWorkerConfigPath: state.resolvedWorkerConfigPath,
+			logger,
+			onConfigChange: reloadWorkerOnlyConfig,
+			onWorkerChange: async () => {
+				await refreshWorkerOnlySurfaceState();
+				await reloadMiniflare(state.currentDoResult);
+			}
+		});
+	}
+	/**
+	* Start the complete dev server
+	*/
+	async function start() {
+		logger?.info("Starting unified dev server...");
+		await loadRuntimeConfigWhenEnvReady();
+		if (!state.config) throw new Error("Config not loaded");
+		setLocalSendEmailBindings(state.config.bindings?.sendEmail ?? {});
+		logger?.debug("Loaded config:", state.config.name);
+		await bundleWorkflowEntrypoints();
+		const viteIntegration = await resolveViteIntegration({
+			cwd,
+			configPath,
+			miniflarePort,
+			enableViteRequested: state.enableVite,
+			logger
+		});
+		state.enableVite = viteIntegration.enableVite;
+		state.generatedViteConfigPath = viteIntegration.generatedViteConfigPath;
+		await refreshWorkerOnlySurfaceState();
+		if (!state.enableVite && (hasWorkerSurfacePaths(state.mainWorkerSurfacePaths) || Boolean(state.mainWorkerRoutes?.routes.length))) logWorkerHandlerDetection(logger, state.enableVite, true, state.mainWorkerSurfacePaths, state.mainWorkerRoutes);
+		else if (!state.enableVite) logWorkerHandlerDetection(logger, state.enableVite, false, state.mainWorkerSurfacePaths, state.mainWorkerRoutes);
+		logRemoteBindingRequirements(logger, await checkRemoteBindingRequirements(state.config));
+		state.browserShim = await maybeStartBrowserShim(state.config, {
+			browserShimPort: state.browserShimPort,
+			logger,
+			verbose
+		});
+		const doInit = await maybeStartDOBundler(state.config, {
+			cwd,
+			logger,
+			onRebuild: async (result) => {
+				await reloadMiniflare(result);
+			}
+		});
+		state.doBundler = doInit.bundler;
+		const doResult = doInit.result;
+		state.currentDoResult = doResult;
+		await startMiniflare(doResult);
+		await startWorkerSourceWatcher$1();
+		if (state.enableVite) state.viteProcess = await startViteProcess({
+			cwd,
+			configPath,
+			vitePort,
+			miniflarePort,
+			generatedViteConfigPath: state.generatedViteConfigPath,
+			r2Presign: state.config.bindings?.r2 ? {
+				secret: r2PresignSecret,
+				origin: resolveR2PresignOrigin(state.config.server, miniflareHost, miniflarePort)
+			} : null,
+			logger
+		});
+		else logger?.info("Vite startup skipped (no effective Vite config found for this package)");
+		await new Promise((r) => setTimeout(r, 1e3));
+		await runD1Migrations({
+			cwd,
+			config: state.config,
+			miniflarePort,
+			logger
+		});
+	}
+	/**
+	* Stop the dev server
+	*/
+	async function stop() {
+		await disposeDevServerState(state);
+	}
+	/**
+	* Get Miniflare instance
+	*/
+	function getMiniflare() {
+		return state.miniflare;
+	}
+	return {
+		start,
+		stop,
+		getMiniflare
+	};
+}
+//#endregion
+//#region src/cli/commands/dev.ts
+function readStringOption(value) {
+	return typeof value === "string" ? value : void 0;
+}
+function parsePort(value, source) {
+	const port = Number(value);
+	if (!Number.isInteger(port) || port <= 0 || port > 65535) throw new Error(`${source} must be an integer between 1 and 65535`);
+	return port;
+}
+function resolveSinglePort(runtimePort, bridgePort, source) {
+	if (runtimePort && bridgePort && runtimePort !== bridgePort) throw new Error(`Conflicting Devflare runtime ports: ${source} runtime port is ${runtimePort}, but bridge port is ${bridgePort}. Use one value for both.`);
+	const value = runtimePort ?? bridgePort;
+	return value ? parsePort(value, source) : void 0;
+}
+function resolveDevRuntimePort(options, env = process.env, configPort) {
+	return resolveSinglePort(readStringOption(options["runtime-port"]), readStringOption(options["bridge-port"]), "CLI") ?? resolveSinglePort(env.DEVFLARE_RUNTIME_PORT, env.DEVFLARE_BRIDGE_PORT, "environment") ?? configPort ?? 8787;
+}
+/**
+* Resolve the host the local Miniflare runtime instance binds to.
+*
+* Precedence: `--runtime-host` CLI flag > `DEVFLARE_RUNTIME_HOST` env var >
+* `server.host` config value > `127.0.0.1`.
+*/
+function resolveDevRuntimeHost(options, env = process.env, configHost) {
+	const envHost = env.DEVFLARE_RUNTIME_HOST?.trim();
+	return readStringOption(options["runtime-host"]) ?? (envHost ? envHost : void 0) ?? configHost ?? "127.0.0.1";
+}
+/**
+* Create a log writer that writes to both terminal and file
+*/
+async function createLogWriter(cwd, options) {
+	if (!options.log && !options.logTemp) return null;
+	const fs = await import("node:fs");
+	let logPath;
+	if (options.logTemp) logPath = resolve(cwd, ".log");
+	else logPath = resolve(cwd, `.log-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").replace("T", "_").slice(0, 19)}`);
+	const fileStream = fs.createWriteStream(logPath, { flags: "w" });
+	const ansiRegex = /\x1b\[[0-9;]*m/g;
+	return {
+		path: logPath,
+		write(data, source) {
+			const str = typeof data === "string" ? data : data.toString();
+			if (!str.trim()) return;
+			const timestamp = (/* @__PURE__ */ new Date()).toISOString().slice(11, 23);
+			const prefix = source ? `[${timestamp}][${source.toUpperCase()}] ` : `[${timestamp}] `;
+			const cleanStr = str.replace(ansiRegex, "");
+			fileStream.write(prefix + cleanStr + (cleanStr.endsWith("\n") ? "" : "\n"));
+		},
+		close() {
+			fileStream.end();
+		}
+	};
+}
+async function runDevCommand(parsed, logger, options) {
+	const cwd = options.cwd || parsed.options.cwd || process.cwd();
+	const configPath = parsed.options.config;
+	const port = parsed.options.port;
+	const logEnabled = parsed.options.log === true;
+	const logTempEnabled = parsed.options["log-temp"] === true;
+	const persistEnabled = parsed.options.persist === true;
+	const debugEnabled = parsed.options.debug === true || process.env.DEVFLARE_DEBUG === "true";
+	const verbose = parsed.options.verbose === true || debugEnabled;
+	const theme = createCliTheme(parsed.options);
+	const config = await loadConfig({
+		cwd,
+		configFile: configPath
+	});
+	let miniflarePort;
+	let miniflareHost;
+	try {
+		miniflarePort = resolveDevRuntimePort(parsed.options, process.env, config.server?.port);
+		miniflareHost = resolveDevRuntimeHost(parsed.options, process.env, config.server?.host);
+	} catch (error) {
+		logger.error(error instanceof Error ? error.message : String(error));
+		return { exitCode: 1 };
+	}
+	const viteProject = resolveEffectiveViteProject(await detectViteProject(cwd), config);
+	const logWriter = await createLogWriter(cwd, {
+		log: logEnabled,
+		logTemp: logTempEnabled
+	});
+	if (logWriter) {
+		const logFile = relative(cwd, logWriter.path) || ".log";
+		logLine(logger, `${dim("logging", theme)} ${logFile}`);
+	}
+	const devLogger = createConsola({ level: verbose ? 4 : 3 });
+	if (logWriter) {
+		const wrapLog = (original, prefix = "") => {
+			return (message, ...args) => {
+				original(message, ...args);
+				const formatted = prefix ? `${prefix} ${[message, ...args].join(" ")}` : [message, ...args].join(" ");
+				logWriter.write(formatted);
+			};
+		};
+		Object.assign(devLogger.log, wrapLog(devLogger.log.bind(devLogger)));
+		Object.assign(devLogger.info, wrapLog(devLogger.info.bind(devLogger)));
+		Object.assign(devLogger.error, wrapLog(devLogger.error.bind(devLogger), "[ERROR]"));
+		Object.assign(devLogger.warn, wrapLog(devLogger.warn.bind(devLogger), "[WARN]"));
+		Object.assign(devLogger.success, wrapLog(devLogger.success.bind(devLogger), "[OK]"));
+		Object.assign(devLogger.debug, wrapLog(devLogger.debug.bind(devLogger), "[DEBUG]"));
+	}
+	try {
+		logLine(logger);
+		if (viteProject.shouldStartVite) {
+			logLine(logger, `${cyanBold("dev", theme)} ${dim("Unified Dev Server", theme)}`);
+			logLine(logger, "   ├─ Vite: Full HMR for frontend");
+			logLine(logger, "   ├─ Miniflare: All Cloudflare bindings");
+			logLine(logger, "   ├─ Rolldown: Worker + DO bundling with watch");
+			logLine(logger, "   └─ Bridge: WebSocket RPC connection");
+		} else {
+			logLine(logger, `${cyanBold("dev", theme)} ${dim("Worker Dev Server", theme)}`);
+			logLine(logger, "   ├─ Miniflare: All Cloudflare bindings");
+			logLine(logger, "   ├─ Rolldown: Worker + DO bundling with watch");
+			logLine(logger, "   └─ Vite: Disabled (no effective Vite config found)");
+			if (viteProject.wantsViteIntegration) {
+				logger.warn("Vite-related settings were detected, but no effective Vite config was available");
+				logger.warn("Skipping Vite startup and running in worker-only mode");
+			}
+		}
+		logLine(logger);
+		const devServer = createDevServer({
+			cwd,
+			configPath,
+			vitePort: port ? Number.parseInt(port, 10) : 5173,
+			miniflarePort,
+			miniflareHost,
+			enableVite: viteProject.shouldStartVite,
+			persist: persistEnabled,
+			logger: devLogger,
+			verbose,
+			debug: debugEnabled
+		});
+		let isCleaningUp = false;
+		const cleanupHandlers = /* @__PURE__ */ new Map();
+		const removeCleanupHandlers = () => {
+			for (const [event, handler] of cleanupHandlers) process.off(event, handler);
+			cleanupHandlers.clear();
+		};
+		const cleanup = async (exitCode, reason) => {
+			if (isCleaningUp) return;
+			isCleaningUp = true;
+			removeCleanupHandlers();
+			if (reason) {
+				const message = reason instanceof Error ? reason.stack ?? reason.message : String(reason);
+				logger.error(message);
+			}
+			logLine(logger);
+			logLine(logger, `${yellow("dev", theme)} ${dim("Shutting down…", theme)}`);
+			try {
+				await devServer.stop();
+			} finally {
+				logWriter?.close();
+				process.exit(exitCode);
+			}
+		};
+		const registerCleanupHandler = (event, handler) => {
+			cleanupHandlers.set(event, handler);
+			process.on(event, handler);
+		};
+		registerCleanupHandler("SIGINT", () => {
+			cleanup(0);
+		});
+		registerCleanupHandler("SIGTERM", () => {
+			cleanup(0);
+		});
+		registerCleanupHandler("SIGHUP", () => {
+			cleanup(0);
+		});
+		registerCleanupHandler("uncaughtException", (error) => {
+			cleanup(1, error);
+		});
+		registerCleanupHandler("unhandledRejection", (reason) => {
+			cleanup(1, reason);
+		});
+		await devServer.start();
+		await new Promise(() => {});
+		return { exitCode: 0 };
+	} catch (error) {
+		logWriter?.close();
+		if (error instanceof Error) {
+			logger.error("Dev server failed:", error.message);
+			if (verbose) logger.error(error.stack);
+		}
+		return { exitCode: 1 };
+	}
+}
+//#endregion
+export { runDevCommand };