devflare 1.0.0-next.7 → 1.0.0-next.70

package/dist/_chunks/vite-process-CDa3yQui.js

@@ -0,0 +1,2929 @@
+import { i as resolveConfigPath } from "./loader-BC0skbnH.js";
+import { g as normalizeR2Binding, n as getLocalKVNamespaceIdentifier, r as getSingleBrowserBindingName, t as getLocalD1DatabaseIdentifier } from "./schema-normalization-CTdiY17P.js";
+import { C as buildSendEmailConfig, D as buildVersionMetadataConfig, E as buildTailConsumersConfig, O as buildWorkerLoadersConfig, S as buildSecretsStoreConfig, T as buildStreamingTailConsumersConfig, _ as buildMtlsCertificatesConfig, b as buildQueueProducers, c as buildAiSearchInstancesConfig, d as buildArtifactsConfig, f as buildDispatchNamespacesConfig, g as buildMediaConfig, h as buildImagesConfig, k as buildWorkflowsConfig, l as buildAiSearchNamespacesConfig, m as buildHyperdrivesConfig, n as getRouteDirectoryCandidate, p as buildFlagshipConfig, u as buildAnalyticsEngineConfig, v as buildPipelinesConfig, w as buildStreamConfig, x as buildRateLimitsConfig, y as buildQueueConsumers } from "./routes-CRXB3-iw.js";
+import { r as transformDurableObject } from "./durable-object-DuMPM8re.js";
+import { i as findFiles } from "./glob-DRw9sbfF.js";
+import { d as DEFAULT_FETCH_ENTRY_FILES, f as DEFAULT_QUEUE_ENTRY_FILES, g as discoverDurableObjectFiles, h as resolveWorkerSurfacePaths, i as writeGeneratedViteConfig, m as hasWorkerSurfacePaths, p as DEFAULT_SCHEDULED_ENTRY_FILES, u as DEFAULT_EMAIL_ENTRY_FILES } from "./vite-Bml-Whp8.js";
+import { a as createWorkerdBundlerDefaults, i as writeWorkerCompatibleBundle, n as ensureDebugShim, r as resolveWorkerCompatibleRolldownConfig } from "./worker-bundler-Isj5jiW6.js";
+import { t as R2_PRESIGN_RUNTIME_JS } from "./r2-presign-runtime-C75FkLMd.js";
+import { n as buildLocalSecretWrappedBindingConfig } from "./local-secrets-C0n5oRgI.js";
+import { t as buildLocalBindingShimServiceConfig } from "./local-media-bindings-ZQe-epuw.js";
+import { i as waitForViteReady, n as resolveViteMode } from "./vite-utils-D8kPPxUy.js";
+import { existsSync } from "node:fs";
+import { dirname, relative, resolve } from "pathe";
+import { spawn } from "node:child_process";
+import { homedir } from "node:os";
+import { join as join$1 } from "node:path";
+import picomatch from "picomatch";
+import { createHash } from "node:crypto";
+import { createInterface } from "node:readline";
+import { createServer } from "node:http";
+import { Browser, detectBrowserPlatform, install, resolveBuildId } from "@puppeteer/browsers";
+import puppeteerCore from "puppeteer-core";
+//#region src/bundler/do-bundler.ts
+/**
+* Convert PascalCase class name to SCREAMING_SNAKE_CASE binding name
+*/
+function classToBindingName(className) {
+	return className.replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/([A-Z]+)([A-Z][a-z])/g, "$1_$2").toUpperCase();
+}
+/**
+* Discover DO classes from a glob pattern.
+* Respects .gitignore automatically.
+*/
+async function discoverDOs(cwd, pattern) {
+	const discovered = [];
+	const files = await discoverDurableObjectFiles(cwd, pattern);
+	for (const [filePath, classNames] of files) for (const className of classNames) discovered.push({
+		filePath,
+		className,
+		bindingName: classToBindingName(className)
+	});
+	return discovered;
+}
+/**
+* Strip @durableObject decorator and its import from source code
+* For dev mode, we just need to remove the decorator syntax - the DO class works as-is
+*/
+function stripDecoratorSyntax(code) {
+	let result = code;
+	result = result.replace(/@durableObject\s*\([^)]*\)\s*\n?\s*(?=export\s+class)/g, "");
+	result = result.replace(/import\s*\{([^}]*)\bdurableObject\b[^}]*\}\s*from\s*['"]devflare\/runtime['"]\s*;?/g, (match, imports) => {
+		const cleanedImports = imports.split(",").map((s) => s.trim()).filter((s) => !s.startsWith("durableObject")).join(", ");
+		if (cleanedImports.trim() === "") return "";
+		return `import { ${cleanedImports} } from 'devflare/runtime'`;
+	});
+	return result;
+}
+/**
+* Bundle a single DO file using Rolldown
+*
+* Strategy:
+* 1. Read the source file
+* 2. Strip @durableObject decorator (not needed at runtime - just a marker)
+* 3. Feed the cleaned code to Rolldown through a virtual-entry plugin whose id
+*    sits in the source directory, so relative imports resolve identically to
+*    the original Durable Object module — without ever writing a temp file
+*    next to user source.
+* 4. Bundle with Rolldown.
+*/
+async function bundleDOFile(sourcePath, className, outDir, cwd, bundleOptions) {
+	const fs = await import("node:fs/promises");
+	await fs.mkdir(outDir, { recursive: true });
+	const sourceCode = await fs.readFile(sourcePath, "utf-8");
+	const entryCode = `${(await transformDurableObject(sourceCode, sourcePath))?.code ?? stripDecoratorSyntax(sourceCode)}
+
+// Default export for worker (required by Miniflare)
+export default {
+	async fetch(request) {
+		return new Response('DO Worker for ${className}', { status: 200 });
+	}
+};
+`;
+	const virtualEntryId = resolve(dirname(sourcePath), `.devflare-do-${className}.virtual.ts`);
+	const classOutDir = resolve(outDir, className);
+	try {
+		await fs.rm(classOutDir, {
+			recursive: true,
+			force: true
+		});
+	} catch {}
+	await fs.mkdir(classOutDir, { recursive: true });
+	const debugShimPath = await ensureDebugShim(outDir);
+	const virtualEntryPlugin = {
+		name: "devflare-do-virtual-entry",
+		resolveId(id) {
+			if (id === virtualEntryId) return virtualEntryId;
+			return null;
+		},
+		load(id) {
+			if (id === virtualEntryId) return entryCode;
+			return null;
+		}
+	};
+	const userRolldownOptions = bundleOptions?.rolldownOptions;
+	const userPlugins = userRolldownOptions?.plugins;
+	const mergedPlugins = userPlugins === void 0 ? [virtualEntryPlugin] : Array.isArray(userPlugins) ? [virtualEntryPlugin, ...userPlugins] : [virtualEntryPlugin, userPlugins];
+	const outFile = resolve(classOutDir, "index.js");
+	const defaults = createWorkerdBundlerDefaults();
+	const { inputOptions, outputOptions } = resolveWorkerCompatibleRolldownConfig({
+		cwd,
+		inputFile: virtualEntryId,
+		outFile,
+		...defaults,
+		platform: "neutral",
+		alias: { debug: debugShimPath },
+		rolldownOptions: {
+			...userRolldownOptions,
+			plugins: mergedPlugins
+		},
+		sourcemap: bundleOptions?.sourcemap ?? defaults.sourcemap,
+		minify: bundleOptions?.minify ?? defaults.minify,
+		inlineDynamicImports: true,
+		defaultTsconfigMode: "always"
+	});
+	await writeWorkerCompatibleBundle({
+		inputOptions,
+		outputOptions,
+		outFile
+	});
+	return resolve(classOutDir, "index.js");
+}
+/**
+* Bundle all discovered DOs
+*/
+async function bundleAllDOs(discovered, outDir, cwd, logger, bundleOptions) {
+	await import("node:fs/promises");
+	const bundles = /* @__PURE__ */ new Map();
+	const classes = /* @__PURE__ */ new Map();
+	const sourceFiles = /* @__PURE__ */ new Map();
+	const errors = [];
+	for (const do_ of discovered) {
+		const existing = sourceFiles.get(do_.filePath) || [];
+		existing.push(do_.className);
+		sourceFiles.set(do_.filePath, existing);
+	}
+	for (const do_ of discovered) try {
+		logger?.debug(`Bundling ${do_.className} from ${do_.filePath}`);
+		const outFile = await bundleDOFile(do_.filePath, do_.className, outDir, cwd, bundleOptions);
+		bundles.set(do_.bindingName, outFile);
+		classes.set(do_.bindingName, do_.className);
+		logger?.debug(`  → ${outFile}`);
+	} catch (error) {
+		const err = error instanceof Error ? error : new Error(String(error));
+		errors.push(err);
+		logger?.error(`Failed to bundle ${do_.className}:`, err.message);
+	}
+	return {
+		bundles,
+		classes,
+		sourceFiles,
+		errors
+	};
+}
+/**
+* Create a DO bundler with watch support
+*/
+function createDOBundler(options) {
+	const { cwd, pattern, outDir, logger, onRebuild, rolldownOptions, sourcemap, minify } = options;
+	let result = {
+		bundles: /* @__PURE__ */ new Map(),
+		classes: /* @__PURE__ */ new Map(),
+		sourceFiles: /* @__PURE__ */ new Map(),
+		errors: []
+	};
+	let watcher = null;
+	let chokidarWatcher = null;
+	/**
+	* Perform initial build
+	*/
+	async function build() {
+		const discovered = await discoverDOs(cwd, pattern);
+		if (discovered.length === 0) {
+			logger?.debug("No DOs found matching pattern:", pattern);
+			return result;
+		}
+		logger?.info(`Found ${discovered.length} Durable Object(s)`);
+		for (const do_ of discovered) logger?.info(`  • ${do_.className} → ${do_.bindingName}`);
+		result = await bundleAllDOs(discovered, outDir, cwd, logger, {
+			rolldownOptions,
+			sourcemap,
+			minify
+		});
+		if (result.errors.length === 0) logger?.success(`Bundled ${result.bundles.size} DO(s) to ${outDir}`);
+		return result;
+	}
+	/**
+	* Watch for changes and rebuild
+	*
+	* Strategy: Watch parent directories of DO files with a filter for matching files.
+	* This allows detection of new DO files created during dev.
+	* Uses compiled picomatch for fast pattern matching instead of re-globbing on every event.
+	*/
+	async function watch() {
+		const chokidar = await import("chokidar");
+		const files = await findFiles(pattern, { cwd });
+		let dirsToWatch;
+		if (files.length > 0) dirsToWatch = [...new Set(files.map((f) => dirname(f)))];
+		else {
+			const patternDir = dirname(pattern);
+			const absolutePatternDir = resolve(cwd, patternDir === "." ? "" : patternDir) || cwd;
+			dirsToWatch = [absolutePatternDir];
+			logger?.debug(`No DO files yet, watching pattern directory: ${absolutePatternDir}`);
+		}
+		logger?.info(`Watching ${files.length} DO file(s) in ${dirsToWatch.length} director(ies)...`);
+		const isWindows = process.platform === "win32";
+		chokidarWatcher = chokidar.watch(dirsToWatch, {
+			ignoreInitial: true,
+			usePolling: isWindows,
+			interval: isWindows ? 300 : void 0,
+			awaitWriteFinish: {
+				stabilityThreshold: 100,
+				pollInterval: 50
+			},
+			depth: 0
+		});
+		const normalizePath = (p) => {
+			let normalized = p.replace(/\\/g, "/");
+			if (isWindows && /^[a-zA-Z]:/.test(normalized)) normalized = normalized[0].toLowerCase() + normalized.slice(1);
+			return normalized;
+		};
+		const isMatch = picomatch(pattern, {
+			dot: true,
+			matchBase: false
+		});
+		const matchesPattern = (filePath) => {
+			const normalizedPath = normalizePath(filePath);
+			return isMatch(relative(normalizePath(cwd), normalizedPath));
+		};
+		let isRebuilding = false;
+		let pendingRebuild = null;
+		let rebuildTimeout = null;
+		const scheduleRebuild = (changedPath) => {
+			if (rebuildTimeout) clearTimeout(rebuildTimeout);
+			rebuildTimeout = setTimeout(() => {
+				triggerRebuild(changedPath);
+			}, 150);
+		};
+		const triggerRebuild = async (changedPath) => {
+			if (isRebuilding) {
+				pendingRebuild = changedPath;
+				logger?.debug(`Rebuild already in progress, queuing: ${changedPath}`);
+				return;
+			}
+			isRebuilding = true;
+			try {
+				logger?.info(`DO file changed: ${changedPath}`);
+				logger?.info("Rebuilding DOs...");
+				const startTime = Date.now();
+				result = await build();
+				const elapsed = Date.now() - startTime;
+				logger?.success(`DO rebuild complete (${elapsed}ms)`);
+				await onRebuild?.(result);
+			} catch (error) {
+				logger?.error("DO rebuild failed:", error);
+			} finally {
+				isRebuilding = false;
+				if (pendingRebuild) {
+					const nextPath = pendingRebuild;
+					pendingRebuild = null;
+					triggerRebuild(nextPath);
+				}
+			}
+		};
+		chokidarWatcher.on("change", (filePath) => {
+			if (matchesPattern(filePath)) {
+				logger?.debug(`File changed: ${filePath}`);
+				scheduleRebuild(filePath);
+			}
+		});
+		chokidarWatcher.on("add", (filePath) => {
+			if (matchesPattern(filePath)) {
+				logger?.debug(`File added: ${filePath}`);
+				scheduleRebuild(filePath);
+			}
+		});
+		chokidarWatcher.on("unlink", (filePath) => {
+			if (matchesPattern(filePath)) {
+				logger?.debug(`File removed: ${filePath}`);
+				scheduleRebuild(filePath);
+			}
+		});
+		chokidarWatcher.on("ready", () => {
+			logger?.info("DO file watcher ready");
+		});
+		chokidarWatcher.on("error", (error) => {
+			logger?.error("DO file watcher error:", error);
+		});
+	}
+	/**
+	* Stop watching
+	*/
+	async function close() {
+		if (watcher) {
+			await watcher.close();
+			watcher = null;
+		}
+		if (chokidarWatcher) {
+			await chokidarWatcher.close();
+			chokidarWatcher = null;
+		}
+	}
+	/**
+	* Get the latest result
+	*/
+	function getResult() {
+		return result;
+	}
+	return {
+		build,
+		watch,
+		close,
+		getResult
+	};
+}
+//#endregion
+//#region src/dev-server/miniflare-log.ts
+const ANSI_ESCAPE_REGEX = /\u001B\[[0-9;]*m/g;
+const COMPATIBILITY_DATE_FALLBACK_REGEX = /^The latest compatibility date supported by the installed Cloudflare Workers Runtime is "([^"]+)", but you've requested "([^"]+)"\. Falling back to "([^"]+)"\.\.\.$/;
+const MINIFLARE_LOG_LEVEL_FALLBACKS = {
+	WARN: 2,
+	DEBUG: 4
+};
+function normalizeMiniflareMessage(message) {
+	return message.replace(ANSI_ESCAPE_REGEX, "").replace(/\s+/g, " ").trim();
+}
+function formatCompatibilityDateFallbackNotice(message) {
+	const normalizedMessage = normalizeMiniflareMessage(message);
+	const match = COMPATIBILITY_DATE_FALLBACK_REGEX.exec(normalizedMessage);
+	if (!match) return null;
+	const [, _supportedDate, requestedDate, fallbackDate] = match;
+	return `Using latest supported Cloudflare Workers Runtime compatibility date ${fallbackDate} (requested ${requestedDate})`;
+}
+function resolveMiniflareLogLevel(logLevel, levelName) {
+	return logLevel?.[levelName] ?? MINIFLARE_LOG_LEVEL_FALLBACKS[levelName];
+}
+function createMiniflareLog(BaseLog, logLevel, levelName, logger) {
+	if (!BaseLog) return;
+	return createCompatibilityAwareMiniflareLog(BaseLog, resolveMiniflareLogLevel(logLevel, levelName), logger);
+}
+function createCompatibilityAwareMiniflareLog(BaseLog, level, logger) {
+	const log = new BaseLog(level);
+	const originalWarn = log.warn.bind(log);
+	const originalInfo = log.info.bind(log);
+	log.warn = (message) => {
+		const notice = formatCompatibilityDateFallbackNotice(message);
+		if (!notice) {
+			originalWarn(message);
+			return;
+		}
+		if (logger) {
+			logger.info(notice);
+			return;
+		}
+		originalInfo(notice);
+	};
+	return log;
+}
+//#endregion
+//#region src/bridge/gateway-runtime.ts
+/**
+* Shared gateway helpers (base64, R2 serializers, email) and the RPC method
+* dispatcher. Designed to be embedded verbatim at the top level of a worker
+* module. All symbols are declared with `function`/`const` so they are
+* hoisted in both embedding sites.
+*/
+const GATEWAY_RUNTIME_JS = `
+const RAW_EMAIL = 'EmailMessage::raw'
+
+// Inline body cap for proxied DO/service-fetch responses. Matches
+// HTTP_TRANSFER_THRESHOLD in wire.ts (512 KB). A larger body would exceed
+// workerd's ~1 MB WebSocket message limit once base64-encoded into the rpc.ok
+// frame, so it is rejected with a clear error rather than silently truncated.
+const HTTP_TRANSFER_THRESHOLD = 512 * 1024
+
+function arrayBufferToBase64(buffer) {
+	const bytes = new Uint8Array(buffer)
+	let binary = ''
+	for (let i = 0; i < bytes.byteLength; i++) binary += String.fromCharCode(bytes[i])
+	return btoa(binary)
+}
+
+function base64ToArrayBuffer(base64) {
+	const binary = atob(base64)
+	const bytes = new Uint8Array(binary.length)
+	for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i)
+	return bytes.buffer
+}
+
+// Binary WsData frame codec (10-byte header: kind:u8, id:u32 LE, seq:u32 LE,
+// flags:u8 + payload). MUST match wire.ts encodeBinaryFrame/decodeBinaryFrame so
+// the bridge client and this gateway agree on the WS-data wire format
+// (BinaryKind.WsData = 2, BinaryFlags.TEXT = 2).
+function encodeWsDataFrame(wid, flags, payload) {
+	const frame = new Uint8Array(10 + payload.byteLength)
+	const view = new DataView(frame.buffer)
+	view.setUint8(0, 2)
+	view.setUint32(1, wid, true)
+	view.setUint32(5, 0, true)
+	view.setUint8(9, flags)
+	frame.set(payload, 10)
+	return frame
+}
+
+function decodeWsDataFrame(buffer) {
+	const bytes = new Uint8Array(buffer)
+	if (bytes.byteLength < 10) return null
+	const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength)
+	return {
+		kind: view.getUint8(0),
+		id: view.getUint32(1, true),
+		flags: view.getUint8(9),
+		payload: bytes.subarray(10)
+	}
+}
+
+function serializeR2Object(obj) {
+	if (!obj) return null
+	return {
+		__type: 'R2Object',
+		key: obj.key,
+		version: obj.version,
+		size: obj.size,
+		etag: obj.etag,
+		httpEtag: obj.httpEtag,
+		checksums: obj.checksums,
+		uploaded: obj.uploaded?.toISOString(),
+		httpMetadata: obj.httpMetadata,
+		customMetadata: obj.customMetadata,
+		range: obj.range,
+		storageClass: obj.storageClass
+	}
+}
+
+function serializeR2ObjectBody(obj, bodyData) {
+	if (!obj) return null
+	return {
+		__type: 'R2ObjectBody',
+		key: obj.key,
+		version: obj.version,
+		size: obj.size,
+		etag: obj.etag,
+		httpEtag: obj.httpEtag,
+		checksums: obj.checksums,
+		uploaded: obj.uploaded?.toISOString(),
+		httpMetadata: obj.httpMetadata,
+		customMetadata: obj.customMetadata,
+		range: obj.range,
+		storageClass: obj.storageClass,
+		bodyData
+	}
+}
+
+function serializeR2Objects(result) {
+	if (!result) return null
+	return {
+		objects: result.objects.map(serializeR2Object),
+		truncated: result.truncated,
+		cursor: result.cursor,
+		delimitedPrefixes: result.delimitedPrefixes
+	}
+}
+
+// Read each Set-Cookie value separately. entries()/forEach() combine multiple
+// Set-Cookie headers into one comma-joined value (Fetch sort-and-combine), which
+// corrupts cookies. getSetCookie() keeps them apart on a compat date
+// >= 2023-08-01; older workerd predates it but still exposes getAll('set-cookie').
+// MUST match readSetCookieValues in v2/value-serialization.ts.
+function readSetCookieValues(headers) {
+	if (typeof headers.getSetCookie === 'function') {
+		const values = headers.getSetCookie()
+		return Array.isArray(values) ? values : null
+	}
+	if (typeof headers.getAll === 'function') {
+		try {
+			const values = headers.getAll('set-cookie')
+			return Array.isArray(values) ? values : null
+		} catch (error) {
+			return null
+		}
+	}
+	return null
+}
+
+// Flatten headers to [name, value] pairs without collapsing multiple Set-Cookie
+// into one. Each cookie becomes its own pair so the client's new Headers(pairs)
+// re-appends them individually. Falls back to the combined value when the
+// runtime can split neither. MUST match serializeHeaders in v2/value-serialization.ts.
+function serializeHeaders(headers) {
+	const setCookies = readSetCookieValues(headers)
+	const pairs = []
+	headers.forEach((value, key) => {
+		if (setCookies !== null && key.toLowerCase() === 'set-cookie') return
+		pairs.push([key, value])
+	})
+	if (setCookies) {
+		for (const cookie of setCookies) pairs.push(['set-cookie', cookie])
+	}
+	return pairs
+}
+
+async function serializeResponse(response) {
+	let body = null
+	if (response.body) {
+		const bytes = await response.arrayBuffer()
+		if (bytes.byteLength > HTTP_TRANSFER_THRESHOLD) {
+			throw new Error(
+				'[devflare][bridge] Response body (' + bytes.byteLength + ' bytes) exceeds the '
+				+ HTTP_TRANSFER_THRESHOLD + '-byte inline limit. DO and service-binding fetch responses '
+				+ 'are delivered inline over the bridge WebSocket and cannot be streamed locally; keep '
+				+ 'proxied response bodies under the limit (large R2 objects are exempt — read them through '
+				+ 'the R2 binding, which uses the HTTP transfer side-channel).'
+			)
+		}
+		if (bytes.byteLength > 0) {
+			body = { type: 'bytes', data: arrayBufferToBase64(bytes) }
+		}
+	}
+	return {
+		status: response.status,
+		statusText: response.statusText,
+		headers: serializeHeaders(response.headers),
+		body
+	}
+}
+
+function deserializeRequest(serializedReq) {
+	return new Request(serializedReq.url, {
+		method: serializedReq.method,
+		headers: serializedReq.headers,
+		body: serializedReq.body?.type === 'bytes'
+			? base64ToArrayBuffer(serializedReq.body.data)
+			: undefined,
+		redirect: serializedReq.redirect
+	})
+}
+
+function createEmailMessageRaw(raw) {
+	if (typeof raw === 'string' || raw instanceof ReadableStream) {
+		return raw
+	}
+	if (raw instanceof ArrayBuffer || raw instanceof Uint8Array) {
+		return new Response(raw).body
+	}
+	throw new Error('Unsupported EmailMessage raw payload')
+}
+
+function isDurableObjectNamespace(binding) {
+	return !!binding
+		&& typeof binding.idFromName === 'function'
+		&& typeof binding.idFromString === 'function'
+		&& typeof binding.newUniqueId === 'function'
+}
+
+/**
+ * Resolve a (possibly jurisdiction-scoped) DurableObjectNamespace.
+ * Forwards the jurisdiction faithfully when the binding supports it
+ * (real Cloudflare), and degrades to the plain binding otherwise
+ * (miniflare/workerd local emulation, which does not pin jurisdictions).
+ */
+function resolveDoNamespace(binding, jurisdiction) {
+	if (jurisdiction && typeof binding.jurisdiction === 'function') {
+		return binding.jurisdiction(jurisdiction)
+	}
+	return binding
+}
+
+// Dispatch a single Durable Object RPC method call to its stub.
+//
+// A DO that extends DurableObject (from cloudflare:workers) exposes its methods
+// as native RPC on the stub, so the method is invoked DIRECTLY as
+// stub[method](...args) — exactly as on real Cloudflare. This is the ONLY
+// correct path for a DO that ALSO defines its own fetch(): routing the call
+// through fetch() would hand devflare's internal _rpc probe to the user handler,
+// which may reject it (e.g. a websocket-only fetch() returning 426) and yield a
+// non-JSON body that then fails to parse (the reported crash).
+//
+// The fetch _rpc convention is kept only as a fallback for DOs that are not
+// RPC-enabled: the stub proxies every property as callable, so such a DO only
+// reveals itself when the native call throws "does not support RPC".
+async function callDurableObjectRpc(stub, methodName, args) {
+	if (typeof stub[methodName] === 'function') {
+		try {
+			return await stub[methodName](...args)
+		} catch (error) {
+			if (!isDurableObjectRpcUnsupported(error)) throw error
+		}
+	}
+	const response = await stub.fetch(new Request('http://do/_rpc', {
+		method: 'POST',
+		headers: { 'Content-Type': 'application/json' },
+		body: JSON.stringify({ method: methodName, params: args })
+	}))
+	const result = await response.json()
+	if (!result.ok) throw new Error(result.error?.message || 'RPC failed')
+	return result.result
+}
+
+function isDurableObjectRpcUnsupported(error) {
+	const message = error && error.message ? String(error.message) : String(error)
+	return message.indexOf('does not support RPC') !== -1
+}
+
+/**
+ * Execute an RPC method against the gateway's bindings.
+ *
+ * Method format: "binding.operation". Operations must be namespaced by
+ * binding kind (e.g. "kv.get", "r2.head", "d1.stmt.first", "do.fetch",
+ * "service.fetch", "queue.send", "email.send", "ai.run"). Bare verbs and the legacy
+ * "stmt.*" / "stub.*" sub-prefixes were removed in B3-final and now throw.
+ * Method vocabulary must stay in sync with the canonical server in
+ * src/bridge/server.ts.
+ */
+async function executeRpcMethod(method, params, env, _ctx) {
+	const parts = method.split('.')
+	if (parts.length < 2) throw new Error('Invalid method format: ' + method)
+
+	const bindingName = parts[0]
+	const operation = parts.slice(1).join('.')
+	const binding = env[bindingName]
+
+	if (!binding) throw new Error('Binding not found: ' + bindingName)
+
+	const isNamespaced =
+		operation.indexOf('kv.') === 0 ||
+		operation.indexOf('r2.') === 0 ||
+		operation.indexOf('d1.') === 0 ||
+		operation.indexOf('do.') === 0 ||
+		operation.indexOf('service.') === 0 ||
+		operation.indexOf('queue.') === 0 ||
+		operation.indexOf('email.') === 0 ||
+		operation.indexOf('ai.') === 0 ||
+		operation.indexOf('workflow.') === 0 ||
+		operation.indexOf('var.') === 0
+	if (!isNamespaced) {
+		throw new Error(createUnsupportedBridgeOperationErrorMessage(bindingName, operation))
+	}
+
+	// KV
+	if (operation === 'kv.get') return binding.get(params[0], params[1])
+	if (operation === 'kv.put') return binding.put(params[0], params[1], params[2])
+	if (operation === 'kv.delete') return binding.delete(params[0])
+	if (operation === 'kv.list') return binding.list(params[0])
+	if (operation === 'kv.getWithMetadata') return binding.getWithMetadata(params[0], params[1])
+
+	// DO get (returns DOStub reference)
+	if (operation === 'do.get') {
+		return { __type: 'DOStub', binding: bindingName, id: params[0] }
+	}
+
+	// R2
+	if (operation === 'r2.head') return serializeR2Object(await binding.head(params[0]))
+	if (operation === 'r2.get') {
+		const obj = await binding.get(params[0], params[1])
+		if (!obj) return null
+		const body = await obj.arrayBuffer()
+		return serializeR2ObjectBody(obj, arrayBufferToBase64(body))
+	}
+	if (operation === 'r2.put') {
+		let value = params[1]
+		if (value && typeof value === 'object') {
+			if (value.__type === 'ArrayBuffer' || value.__type === 'Uint8Array') {
+				value = base64ToArrayBuffer(value.data)
+			}
+		}
+		return serializeR2Object(await binding.put(params[0], value, params[2]))
+	}
+	if (operation === 'r2.delete') return binding.delete(params[0])
+	if (operation === 'r2.list') return serializeR2Objects(await binding.list(params[0]))
+
+	// D1
+	if (operation === 'd1.exec') return binding.exec(params[0])
+	if (operation === 'd1.batch') {
+		const statements = params[0].map((s) => binding.prepare(s.sql).bind(...(s.bindings || [])))
+		return binding.batch(statements)
+	}
+	if (operation.indexOf('d1.stmt.') === 0) {
+		const mode = operation.split('.')[2]
+		const [sql, ...rest] = params
+		let bindings = rest
+		let extraParam
+		if (mode === 'first' || mode === 'raw') {
+			extraParam = rest[rest.length - 1]
+			bindings = rest.slice(0, -1)
+		}
+		let stmt = binding.prepare(sql)
+		if (bindings.length > 0) stmt = stmt.bind(...bindings)
+		if (mode === 'first') {
+			if (typeof extraParam === 'string' && extraParam.length > 0) return stmt.first(extraParam)
+			return stmt.first()
+		}
+		if (mode === 'all') return stmt.all()
+		if (mode === 'run') return stmt.run()
+		if (mode === 'raw') return stmt.raw(extraParam)
+		throw new Error('Unknown stmt mode: ' + mode)
+	}
+
+	// Durable Objects
+	if (operation === 'do.idFromName') {
+		const ns = resolveDoNamespace(binding, params[1])
+		const id = ns.idFromName(params[0])
+		return { __type: 'DOId', hex: id.toString() }
+	}
+	if (operation === 'do.idFromString') {
+		const id = binding.idFromString(params[0])
+		return { __type: 'DOId', hex: id.toString() }
+	}
+	if (operation === 'do.newUniqueId') {
+		const ns = resolveDoNamespace(binding, params[1])
+		const id = ns.newUniqueId(params[0])
+		return { __type: 'DOId', hex: id.toString() }
+	}
+	if (operation === 'do.fetch') {
+		const [, serializedId, serializedReq] = params
+		const id = binding.idFromString(serializedId.hex)
+		const stub = binding.get(id)
+		const response = await stub.fetch(new Request(serializedReq.url, {
+			method: serializedReq.method,
+			headers: serializedReq.headers,
+			body: serializedReq.body?.type === 'bytes'
+				? base64ToArrayBuffer(serializedReq.body.data)
+				: undefined
+		}))
+		return serializeResponse(response)
+	}
+	if (operation === 'do.rpc') {
+		const [, serializedId, methodName, args] = params
+		const id = binding.idFromString(serializedId.hex)
+		const stub = binding.get(id)
+		return callDurableObjectRpc(stub, methodName, Array.isArray(args) ? args : [])
+	}
+
+	// Service Bindings
+	if (operation === 'service.fetch') {
+		if (!binding || typeof binding.fetch !== 'function') {
+			throw new Error('Service binding ' + bindingName + ' does not support fetch()')
+		}
+		const response = await binding.fetch(deserializeRequest(params[0]))
+		return serializeResponse(response)
+	}
+	if (operation === 'service.rpc') {
+		const methodName = params[0]
+		if (typeof methodName !== 'string') {
+			throw new Error('Service binding ' + bindingName + ' RPC method name must be a string')
+		}
+		const args = Array.isArray(params[1]) ? params[1] : []
+		const method = binding && binding[methodName]
+		if (typeof method !== 'function') {
+			throw new Error('Service binding ' + bindingName + ' does not support ' + methodName + '()')
+		}
+		return method.apply(binding, args)
+	}
+
+	// Queues
+	if (operation === 'queue.send') return binding.send(params[0], params[1])
+	if (operation === 'queue.sendBatch') return binding.sendBatch(params[0], params[1])
+
+	// Send Email
+	if (operation === 'email.send') {
+		if (binding && typeof binding.send === 'function') {
+			const message = params[0]
+			if (message && typeof message === 'object' && 'from' in message && 'to' in message && 'raw' in message) {
+				return binding.send({
+					from: message.from,
+					to: message.to,
+					[RAW_EMAIL]: createEmailMessageRaw(message.raw)
+				})
+			}
+			return binding.send(message)
+		}
+		return { ok: true, simulated: true }
+	}
+
+	// Workflows
+	if (operation === 'workflow.create') {
+		return serializeWorkflowInstance(await binding.create(params[0]))
+	}
+	if (operation === 'workflow.get') {
+		return serializeWorkflowInstance(await binding.get(params[0]))
+	}
+	if (operation === 'workflow.status') {
+		return (await binding.get(params[0])).status()
+	}
+	if (operation === 'workflow.pause') {
+		return (await binding.get(params[0])).pause()
+	}
+	if (operation === 'workflow.resume') {
+		return (await binding.get(params[0])).resume()
+	}
+	if (operation === 'workflow.terminate') {
+		return (await binding.get(params[0])).terminate()
+	}
+	if (operation === 'workflow.restart') {
+		return (await binding.get(params[0])).restart()
+	}
+	if (operation === 'workflow.sendEvent') {
+		return (await binding.get(params[0])).sendEvent(params[1])
+	}
+
+	// AI / generic run()
+	if (operation === 'ai.run') {
+		if (typeof binding.run !== 'function') {
+			throw new Error('Binding ' + bindingName + ' does not support run(): ' + method)
+		}
+		return binding.run(params[0], params[1])
+	}
+
+	throw new Error('Unknown operation: ' + method)
+}
+
+function createUnsupportedBridgeOperationErrorMessage(bindingName, operation) {
+	const base = "[devflare][bridge] Unsupported bridge operation '" + operation + "' for binding '" + bindingName + "'."
+	if (operation === 'fetch') {
+		return base + ' Devflare could not dispatch fetch() for this binding through the local bridge. '
+			+ 'Expected Cloudflare API: env.' + bindingName + '.fetch(request). '
+			+ 'If this came from SvelteKit platform.env, make sure the binding is declared as a service binding; '
+			+ 'this is a Devflare local bridge issue when service bindings fall back to a bare fetch operation.'
+	}
+	if (operation === 'toString') {
+		return base + ' A platform.env value was coerced to a string through the bridge. '
+			+ 'For SvelteKit local dev, declared vars should be plain string values and missing env names should read as undefined.'
+	}
+	return base + ' Bare verbs and the legacy stmt.*/stub.* sub-prefixes are not supported; '
+		+ 'use the namespaced form (e.g. kv.get, r2.put, d1.stmt.first, do.fetch, service.fetch).'
+}
+
+function serializeWorkflowInstance(instance) {
+	return {
+		__type: 'WorkflowInstance',
+		id: instance.id
+	}
+}
+
+// ---------------------------------------------------------------------------
+// WebSocket bridge (shared with src/bridge/server.ts in shape)
+// ---------------------------------------------------------------------------
+// NOTE: wsProxies is intentionally created per handleBridgeWebSocket call so
+// state never leaks across connections or across gateway-script regenerations.
+
+async function handleBridgeRpcCall(msg, ws, env, ctx) {
+	try {
+		const result = await executeRpcMethod(msg.method, msg.params, env, ctx)
+		ws.send(JSON.stringify({ t: 'rpc.ok', id: msg.id, result }))
+	} catch (error) {
+		ws.send(JSON.stringify({
+			t: 'rpc.err',
+			id: msg.id,
+			error: {
+				code: error?.code || 'INTERNAL_ERROR',
+				message: error?.message || String(error)
+			}
+		}))
+	}
+}
+
+async function handleBridgeWsOpen(msg, ws, env, wsProxies) {
+	try {
+		const binding = env[msg.target.binding]
+		const id = binding.idFromString(msg.target.id)
+		const stub = binding.get(id)
+
+		const headers = new Headers(msg.target.headers || [])
+		headers.set('Upgrade', 'websocket')
+
+		const response = await stub.fetch(new Request(msg.target.url, { method: 'GET', headers }))
+		const doWs = response.webSocket
+
+		if (!doWs) {
+			ws.send(JSON.stringify({
+				t: 'rpc.err',
+				id: 'ws_' + msg.wid,
+				error: { code: 'WS_FAILED', message: 'No WebSocket returned' }
+			}))
+			return
+		}
+
+		doWs.accept()
+		wsProxies.set(msg.wid, { doWs })
+
+		doWs.addEventListener('message', (event) => {
+			const isText = typeof event.data === 'string'
+			const payload = isText
+				? new TextEncoder().encode(event.data)
+				: new Uint8Array(event.data)
+			const flags = isText ? 2 : 0
+			ws.send(encodeWsDataFrame(msg.wid, flags, payload))
+		})
+
+		doWs.addEventListener('close', (event) => {
+			ws.send(JSON.stringify({ t: 'ws.close', wid: msg.wid, code: event.code, reason: event.reason }))
+			wsProxies.delete(msg.wid)
+		})
+
+		ws.send(JSON.stringify({ t: 'ws.opened', wid: msg.wid }))
+	} catch (error) {
+		ws.send(JSON.stringify({
+			t: 'rpc.err',
+			id: 'ws_' + msg.wid,
+			error: { code: 'WS_FAILED', message: error.message }
+		}))
+	}
+}
+
+function handleBridgeWsClose(msg, wsProxies) {
+	const proxy = wsProxies.get(msg.wid)
+	if (proxy) {
+		proxy.doWs.close(msg.code, msg.reason)
+		wsProxies.delete(msg.wid)
+	}
+}
+
+// Relay an inbound binary WsData frame (client -> DO). Mirrors server.ts
+// handleBinaryMessage: decode the frame, look up the proxy by ws id, and forward
+// the payload to the DO socket honoring the TEXT flag.
+function handleBridgeBinaryMessage(buffer, wsProxies) {
+	const frame = decodeWsDataFrame(buffer)
+	if (!frame || frame.kind !== 2) return
+	const proxy = wsProxies.get(frame.id)
+	if (!proxy) return
+	if ((frame.flags & 2) !== 0) {
+		proxy.doWs.send(new TextDecoder().decode(frame.payload))
+	} else {
+		proxy.doWs.send(frame.payload)
+	}
+}
+
+async function handleBridgeJsonMessage(data, ws, env, ctx, wsProxies) {
+	const msg = JSON.parse(data)
+	switch (msg.t) {
+		case 'hello':
+			// v2 handshake — acknowledge with welcome echoing the negotiated
+			// capability intersection. The gateway advertises only what it
+			// implements end-to-end: 'ws-relay' (binary WsData relay to/from DO
+			// sockets) and 'http-transfer' (the R2 transfer HTTP side-channel).
+			// 'streams' is intentionally NOT advertised — large DO/service-fetch
+			// responses are inlined, not streamed, in this gateway.
+			ws.send(JSON.stringify({
+				t: 'welcome',
+				protocolVersion: 2,
+				capabilities: ['ws-relay', 'http-transfer']
+					.filter((c) => Array.isArray(msg.capabilities) && msg.capabilities.includes(c))
+					.sort()
+			}))
+			break
+		case 'rpc.call':
+			await handleBridgeRpcCall(msg, ws, env, ctx)
+			break
+		case 'ws.open':
+			await handleBridgeWsOpen(msg, ws, env, wsProxies)
+			break
+		case 'ws.close':
+			handleBridgeWsClose(msg, wsProxies)
+			break
+	}
+}
+
+// Pass-through DO WebSocket upgrade (bridge client -> gateway -> DO).
+//
+// The bridge client's openDoWebSocket() opens a REAL loopback WebSocket to this
+// endpoint (/_devflare/do-ws?binding&id&u) instead of tunneling frames over the
+// bridge socket. We resolve the DO by id and RETURN the DO's 101 response
+// verbatim (webSocket included), so miniflare wires the inbound connection to
+// the DO's client socket. That genuine inbound connection is what makes workerd
+// dispatch the DO's hibernation handlers (webSocketMessage/webSocketClose) and
+// deliver ctx.getWebSockets() broadcasts. Pumping the DO socket in-process (the
+// legacy handleBridgeWsOpen path) never triggers hibernation, so two sockets to
+// one getByName(id) could not see each other's messages. This mirrors the
+// browser WS_ROUTES pass-through (handleDoWebSocket) and real Cloudflare.
+//
+// NOTE: the devflare/test gateway (src/test/simple-context-gateway-script.ts)
+// keeps a byte-equivalent copy of this handler because it is a separately-bundled
+// Worker template that cannot import this runtime — keep the two in sync.
+async function handleBridgeDoWebSocket(request, env, url) {
+	try {
+		const bindingName = url.searchParams.get('binding')
+		const idHex = url.searchParams.get('id')
+		const targetUrl = url.searchParams.get('u') || url.toString()
+
+		const binding = env[bindingName]
+		if (!binding || typeof binding.idFromString !== 'function') {
+			return new Response('Durable Object binding not found: ' + bindingName, { status: 500 })
+		}
+		if (!idHex) {
+			return new Response('Missing Durable Object id', { status: 400 })
+		}
+
+		const stub = binding.get(binding.idFromString(idHex))
+		// Forward the real upgrade request (its headers carry any auth/cookies the
+		// caller passed to connect()) and pass the DO's 101 response straight back.
+		return stub.fetch(new Request(targetUrl, { method: 'GET', headers: request.headers }))
+	} catch (error) {
+		return new Response('Error opening DO WebSocket: ' + (error?.message || String(error)), {
+			status: 500
+		})
+	}
+}
+
+function handleBridgeWebSocket(request, env, ctx) {
+	const { 0: client, 1: server } = new WebSocketPair()
+	server.accept()
+
+	// Per-connection state: recreated for every bridge client so reloads and
+	// concurrent clients never share WS proxy entries.
+	const wsProxies = new Map()
+
+	server.addEventListener('message', async (event) => {
+		try {
+			if (typeof event.data === 'string') {
+				await handleBridgeJsonMessage(event.data, server, env, ctx, wsProxies)
+			} else {
+				handleBridgeBinaryMessage(event.data, wsProxies)
+			}
+		} catch (error) {
+			console.error('[Gateway] Error:', error)
+		}
+	})
+
+	server.addEventListener('close', () => {
+		for (const proxy of wsProxies.values()) {
+			// Best-effort cleanup: the DO-side WS may already be closed or in an
+			// invalid state; any throw here would abort sibling closes. Surface
+			// the swallowed error when DEVFLARE_DEBUG_BRIDGE is enabled.
+			try { proxy.doWs.close() } catch (error) {
+				if (globalThis.DEVFLARE_DEBUG_BRIDGE) {
+					console.warn('[devflare:bridge] proxy.doWs.close() failed', error)
+				}
+			}
+		}
+		wsProxies.clear()
+	})
+
+	return new Response(null, { status: 101, webSocket: client })
+}
+
+// ---------------------------------------------------------------------------
+// HTTP transfer for R2 bodies (shared with src/bridge/server.ts in shape)
+// ---------------------------------------------------------------------------
+
+async function handleHttpTransfer(request, env, url) {
+	const transferIdEncoded = url.pathname.split('/').pop()
+	const transferId = decodeURIComponent(transferIdEncoded || '')
+	const [binding, ...keyParts] = transferId.split(':')
+	const key = keyParts.join(':')
+	const bucket = env[binding]
+
+	if (!bucket) return new Response('Bucket not found: ' + binding, { status: 404 })
+
+	if (request.method === 'PUT' || request.method === 'POST') {
+		const result = await bucket.put(key, request.body)
+		return new Response(JSON.stringify(serializeR2Object(result)), {
+			headers: { 'Content-Type': 'application/json' }
+		})
+	}
+
+	if (request.method === 'GET') {
+		const object = await bucket.get(key)
+		if (!object) return new Response('Not found', { status: 404 })
+		return new Response(object.body, {
+			headers: {
+				'Content-Type': object.httpMetadata?.contentType || 'application/octet-stream',
+				'Content-Length': String(object.size)
+			}
+		})
+	}
+
+	return new Response('Method not allowed', { status: 405 })
+}
+`;
+//#endregion
+//#region src/dev-server/d1-migrations.ts
+const MIGRATION_RETRY_DELAYS_MS = [
+	500,
+	1e3,
+	1500,
+	2e3
+];
+function collectMigrationStatements(sql) {
+	return sql.split("\n").filter((line) => !line.trim().startsWith("--")).join("\n").split(";").map((statement) => statement.trim()).filter((statement) => statement.length > 0);
+}
+function hashSql(sql) {
+	return createHash("sha256").update(sql).digest("hex");
+}
+function getErrorMessage(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+async function waitForRetry(delayMs) {
+	await new Promise((resolvePromise) => setTimeout(resolvePromise, delayMs));
+}
+async function applyMigrationsToBinding(options) {
+	const { bindingName, statements, files, miniflarePort, logger } = options;
+	let lastError;
+	for (let attempt = 0; attempt <= MIGRATION_RETRY_DELAYS_MS.length; attempt++) {
+		if (attempt > 0) await waitForRetry(MIGRATION_RETRY_DELAYS_MS[attempt - 1]);
+		try {
+			const response = await fetch(`http://127.0.0.1:${miniflarePort}/_devflare/migrate`, {
+				method: "POST",
+				headers: { "Content-Type": "application/json" },
+				body: JSON.stringify({
+					bindingName,
+					statements,
+					files
+				})
+			});
+			if (!response.ok) {
+				const text = await response.text();
+				throw new Error(`HTTP ${response.status}: ${text}`);
+			}
+			const result = await response.json();
+			if (result.success) {
+				if (Array.isArray(result.warnings)) for (const warning of result.warnings) console.warn(`[devflare] D1 migration file "${warning.filename}" for binding ${bindingName} has changed since it was applied; skipping re-apply to protect existing data.`);
+				const appliedCount = result.applied?.length ?? 0;
+				const skippedCount = result.skipped?.length ?? 0;
+				if (appliedCount > 0 || skippedCount > 0) logger?.success(`D1 migrations for ${bindingName}: ${appliedCount} applied, ${skippedCount} skipped`);
+				else logger?.success(`D1 migrations applied to ${bindingName}`);
+				return;
+			}
+			throw new Error(result.error || "Unknown error");
+		} catch (error) {
+			lastError = error;
+		}
+	}
+	logger?.warn(`Failed to apply migrations to ${bindingName}: ${getErrorMessage(lastError)}`);
+}
+/**
+* Run D1 migrations from migrations/ directory.
+*
+* Resolution per D1 binding (in order):
+*   1. `<cwd>/migrations/<BINDING_NAME>/*.sql` — per-binding directory.
+*      NOTE: if the per-binding directory EXISTS but contains no .sql files,
+*      the binding is skipped — the shared fallback is NOT used.
+*   2. `<cwd>/migrations/*.sql` — shared fallback, used ONLY when the
+*      per-binding directory does not exist.
+*   3. Otherwise, skip the binding with a debug log.
+*
+* Applied-migration ledger:
+*   The gateway maintains a `_devflare_migrations` table per D1 binding with
+*   columns (filename TEXT PRIMARY KEY, applied_at TEXT NOT NULL,
+*   sha256 TEXT NOT NULL). On each run the gateway, for every file we send:
+*     - if filename is present AND sha256 matches — skip silently
+*     - if filename is present but sha256 differs — surface a warning that
+*       the client turns into a `console.warn`; the file is skipped to
+*       protect existing data (there is no force-reapply flag today)
+*     - if filename is absent — apply the file's SQL, then record the entry
+*   We pass each file (filename + sha256 + statements) in a single
+*   /_devflare/migrate request so ledger read/write stays in-process inside
+*   workerd.
+*
+* Uses the gateway worker HTTP endpoint to run migrations inside workerd.
+*/
+async function runD1Migrations(options) {
+	const { cwd, config, miniflarePort, logger } = options;
+	if (!config?.bindings?.d1) return;
+	const { existsSync, readdirSync, readFileSync, statSync } = await import("node:fs");
+	const migrationsDir = resolve(cwd, "migrations");
+	if (!existsSync(migrationsDir)) {
+		logger?.debug("No migrations/ directory found, skipping D1 migrations");
+		return;
+	}
+	const sharedFiles = readdirSync(migrationsDir).filter((file) => file.endsWith(".sql")).sort();
+	let sharedFileEntries = null;
+	if (sharedFiles.length > 0) {
+		sharedFileEntries = [];
+		for (const file of sharedFiles) {
+			const sql = readFileSync(resolve(migrationsDir, file), "utf-8");
+			const fileStatements = collectMigrationStatements(sql);
+			sharedFileEntries.push({
+				filename: file,
+				sha256: hashSql(sql),
+				statements: fileStatements
+			});
+			logger?.debug(`Shared file ${file}: ${fileStatements.length} statement(s)`);
+		}
+	}
+	for (const [bindingName] of Object.entries(config.bindings.d1)) {
+		const perBindingDir = resolve(migrationsDir, bindingName);
+		const hasPerBindingDir = existsSync(perBindingDir) && statSync(perBindingDir).isDirectory();
+		let files = [];
+		let sourceLabel = "";
+		if (hasPerBindingDir) {
+			const perBindingFiles = readdirSync(perBindingDir).filter((file) => file.endsWith(".sql")).sort();
+			if (perBindingFiles.length === 0) {
+				logger?.debug(`No SQL migration files in migrations/${bindingName}/, skipping ${bindingName}`);
+				continue;
+			}
+			for (const file of perBindingFiles) {
+				const sql = readFileSync(resolve(perBindingDir, file), "utf-8");
+				const fileStatements = collectMigrationStatements(sql);
+				files.push({
+					filename: file,
+					sha256: hashSql(sql),
+					statements: fileStatements
+				});
+				logger?.debug(`File ${bindingName}/${file}: ${fileStatements.length} statement(s)`);
+			}
+			sourceLabel = `migrations/${bindingName}/`;
+		} else if (sharedFileEntries !== null) {
+			files = sharedFileEntries;
+			sourceLabel = "migrations/ [shared fallback]";
+		} else {
+			logger?.debug(`No migrations found for ${bindingName}, skipping`);
+			continue;
+		}
+		const statements = files.flatMap((file) => file.statements);
+		logger?.info(`Running ${files.length} D1 migration(s) for ${bindingName} (from ${sourceLabel})`);
+		if (statements.length === 0) {
+			logger?.debug(`No executable D1 migration statements for ${bindingName}`);
+			continue;
+		}
+		await applyMigrationsToBinding({
+			bindingName,
+			statements,
+			files,
+			miniflarePort,
+			logger
+		});
+	}
+}
+//#endregion
+//#region src/browser-shim/binding-worker.ts
+const MAX_CHUNK_SIZE = 1048575;
+/**
+* Generate the browser binding worker script
+* @param browserShimUrl - URL of the external browser shim server (e.g., http://127.0.0.1:8788)
+* @param debug - Enable debug logging (default: false)
+*/
+function getBrowserBindingScript(browserShimUrl, debug = false) {
+	return `
+// Browser Binding Worker — Proxies puppeteer requests to external browser shim
+// Handles WebSocket upgrades using WebSocketPair for @cloudflare/puppeteer compatibility
+
+const BROWSER_SHIM_URL = ${JSON.stringify(browserShimUrl)}
+const MAX_CHUNK_SIZE = ${MAX_CHUNK_SIZE}
+const DEBUG = ${debug}
+const log = (...args) => DEBUG && console.log('[BrowserBinding]', ...args)
+
+export default {
+	async fetch(request, env, ctx) {
+		const url = new URL(request.url)
+		const upgradeHeader = request.headers.get('Upgrade')
+		const isWebSocket = upgradeHeader && upgradeHeader.toLowerCase() === 'websocket'
+		
+		log('Request:', url.pathname, isWebSocket ? '(WebSocket)' : '(HTTP)')
+
+		// Handle WebSocket upgrade for DevTools connection
+		if (url.pathname === '/v1/connectDevtools' && isWebSocket) {
+			return handleDevToolsWebSocket(request, url)
+		}
+
+		// Proxy all other requests to the browser shim server
+		return proxyToBrowserShim(request, url)
+	}
+}
+
+// Proxy HTTP requests to the external browser shim server
+async function proxyToBrowserShim(request, url) {
+	const shimUrl = new URL(url.pathname + url.search, BROWSER_SHIM_URL)
+	
+	log('Proxying to:', shimUrl.toString())
+	
+	const response = await fetch(shimUrl.toString(), {
+		method: request.method,
+		headers: request.headers,
+		body: request.method !== 'GET' && request.method !== 'HEAD' ? request.body : undefined
+	})
+	
+	log('Response:', response.status)
+	
+	// Return the response as-is
+	return new Response(response.body, {
+		status: response.status,
+		statusText: response.statusText,
+		headers: response.headers
+	})
+}
+
+// Validate WebSocket close code to be in valid range
+function validateCloseCode(code) {
+	if (typeof code !== 'number' || isNaN(code)) return 1000
+	if (code < 1000 || code > 4999) return 1000
+	return code
+}
+
+// Split a message into chunks following @cloudflare/puppeteer protocol
+// First chunk has 4-byte LE length header, subsequent chunks are raw payload
+function messageToChunks(message) {
+	const data = typeof message === 'string'
+		? new TextEncoder().encode(message)
+		: new Uint8Array(message)
+	
+	const chunks = []
+	const totalLength = data.length
+	let offset = 0
+	let isFirst = true
+	
+	while (offset < totalLength) {
+		const remaining = totalLength - offset
+		let chunkSize
+		
+		if (isFirst) {
+			// First chunk: 4-byte header + payload
+			chunkSize = Math.min(remaining, MAX_CHUNK_SIZE - 4)
+			const chunk = new Uint8Array(chunkSize + 4)
+			new DataView(chunk.buffer).setUint32(0, totalLength, true) // little-endian
+			chunk.set(data.subarray(offset, offset + chunkSize), 4)
+			chunks.push(chunk)
+			isFirst = false
+		} else {
+			// Subsequent chunks: raw payload only
+			chunkSize = Math.min(remaining, MAX_CHUNK_SIZE)
+			const chunk = data.subarray(offset, offset + chunkSize)
+			chunks.push(chunk)
+		}
+		
+		offset += chunkSize
+	}
+	
+	return chunks
+}
+
+// Reassemble chunks back into a complete message
+// Returns null if more chunks are needed
+function chunksToMessage(chunks) {
+	if (chunks.length === 0) return null
+	
+	// First chunk must have 4-byte header
+	const firstChunk = chunks[0]
+	if (firstChunk.length < 4) return null
+	
+	const expectedLength = new DataView(firstChunk.buffer, firstChunk.byteOffset).getUint32(0, true)
+	
+	// Calculate total received payload
+	let totalReceived = firstChunk.length - 4 // first chunk payload (minus header)
+	for (let i = 1; i < chunks.length; i++) {
+		totalReceived += chunks[i].length
+	}
+	
+	if (totalReceived < expectedLength) {
+		return null // Need more chunks
+	}
+	
+	// Reassemble the message
+	const assembled = new Uint8Array(expectedLength)
+	let offset = 0
+	
+	// Copy first chunk payload (skip 4-byte header)
+	const firstPayload = firstChunk.subarray(4)
+	assembled.set(firstPayload, offset)
+	offset += firstPayload.length
+	
+	// Copy remaining chunks
+	for (let i = 1; i < chunks.length; i++) {
+		const chunk = chunks[i]
+		const toCopy = Math.min(chunk.length, expectedLength - offset)
+		assembled.set(chunk.subarray(0, toCopy), offset)
+		offset += toCopy
+	}
+	
+	return new TextDecoder().decode(assembled)
+}
+
+// Handle WebSocket upgrade for DevTools connection
+// Creates a WebSocketPair and proxies to Chrome's DevTools WebSocket
+async function handleDevToolsWebSocket(request, url) {
+	const sessionId = url.searchParams.get('browser_session')
+	if (!sessionId) {
+		return new Response('browser_session parameter required', { status: 400 })
+	}
+	
+	log('DevTools WebSocket request for session:', sessionId)
+	
+	// Get session info from browser shim (includes Chrome's wsEndpoint)
+	const sessionUrl = new URL('/v1/session/' + sessionId, BROWSER_SHIM_URL)
+	
+	// Add timeout for session fetch
+	const controller = new AbortController()
+	const timeout = setTimeout(() => controller.abort(), 5000)
+	
+	let sessionRes
+	try {
+		sessionRes = await fetch(sessionUrl.toString(), { signal: controller.signal })
+	} catch (e) {
+		DEBUG && console.error('[BrowserBinding] Session fetch timeout or error:', e.message)
+		return new Response('Session fetch timeout', { status: 504 })
+	} finally {
+		clearTimeout(timeout)
+	}
+	
+	if (!sessionRes.ok) {
+		DEBUG && console.error('[BrowserBinding] Session not found:', sessionId)
+		return new Response('Session not found', { status: 404 })
+	}
+	
+	const sessionInfo = await sessionRes.json()
+	const wsEndpoint = sessionInfo.wsEndpoint
+	
+	if (!wsEndpoint) {
+		DEBUG && console.error('[BrowserBinding] No wsEndpoint in session info')
+		return new Response('No wsEndpoint for session', { status: 500 })
+	}
+	
+	log('Connecting to Chrome DevTools:', wsEndpoint)
+	
+	// Connect to Chrome's DevTools WebSocket
+	// Chrome uses ws:// but fetch expects http:// for WebSocket upgrade
+	const chromeUrl = wsEndpoint.replace('ws://', 'http://').replace('wss://', 'https://')
+	
+	const chromeRes = await fetch(chromeUrl, {
+		headers: { Upgrade: 'websocket' }
+	})
+	
+	if (!chromeRes.webSocket) {
+		DEBUG && console.error('[BrowserBinding] Failed to connect to Chrome DevTools')
+		return new Response('Failed to connect to Chrome DevTools', { status: 502 })
+	}
+	
+	const chromeWs = chromeRes.webSocket
+	chromeWs.accept()
+	
+	log('Connected to Chrome DevTools')
+	
+	// Create WebSocketPair for client connection
+	const { 0: client, 1: server } = new WebSocketPair()
+	server.accept()
+	
+	// Chunk buffer for reassembling multi-chunk messages from puppeteer
+	let chunks = []
+	const MAX_BUFFER_SIZE = 50 * 1024 * 1024 // 50MB max buffer
+	let bufferSize = 0
+	
+	// Proxy messages from client (puppeteer) to Chrome
+	// Handle multi-chunk framing protocol
+	server.addEventListener('message', (event) => {
+		// Keep-alive ping from puppeteer
+		if (event.data === 'ping') {
+			return
+		}
+		
+		// Handle binary data (chunked protocol)
+		if (event.data instanceof ArrayBuffer) {
+			const chunk = new Uint8Array(event.data)
+			bufferSize += chunk.length
+			
+			// Prevent unbounded buffering
+			if (bufferSize > MAX_BUFFER_SIZE) {
+				DEBUG && console.error('[BrowserBinding] Buffer overflow, closing connection')
+				server.close(1009, 'Message too big')
+				chromeWs.close(1009, 'Message too big')
+				return
+			}
+			
+			chunks.push(chunk)
+			
+			// Try to reassemble complete message
+			const message = chunksToMessage(chunks)
+			if (message !== null) {
+				// Send complete message to Chrome
+				if (chromeWs.readyState === 1) { // OPEN
+					chromeWs.send(message)
+				}
+				// Clear buffer
+				chunks = []
+				bufferSize = 0
+			}
+		} else if (typeof event.data === 'string') {
+			// Shouldn't happen in normal protocol, but handle it
+			if (chromeWs.readyState === 1) {
+				chromeWs.send(event.data)
+			}
+		}
+	})
+	
+	// Proxy messages from Chrome to client (puppeteer)
+	// Split into chunks following the multi-chunk protocol
+	chromeWs.addEventListener('message', (event) => {
+		if (server.readyState !== 1) return // Not OPEN
+		
+		// Split message into chunks
+		const outChunks = messageToChunks(event.data)
+		for (const chunk of outChunks) {
+			server.send(chunk)
+		}
+	})
+	
+	// Handle close events with validated codes
+	server.addEventListener('close', (event) => {
+		log('Client WebSocket closed:', event.code)
+		const code = validateCloseCode(event.code)
+		try {
+			if (chromeWs.readyState === 1 || chromeWs.readyState === 0) {
+				chromeWs.close(code, event.reason || '')
+			}
+		} catch {}
+	})
+	
+	chromeWs.addEventListener('close', (event) => {
+		log('Chrome WebSocket closed:', event.code)
+		const code = validateCloseCode(event.code)
+		try {
+			if (server.readyState === 1 || server.readyState === 0) {
+				server.close(code, event.reason || '')
+			}
+		} catch {}
+	})
+	
+	// Handle errors
+	server.addEventListener('error', (event) => {
+		DEBUG && console.error('[BrowserBinding] Client WebSocket error')
+		try { chromeWs.close(1011, 'Client error') } catch {}
+	})
+	
+	chromeWs.addEventListener('error', (event) => {
+		DEBUG && console.error('[BrowserBinding] Chrome WebSocket error')
+		try { server.close(1011, 'Chrome error') } catch {}
+	})
+	
+	log('WebSocket proxy established')
+	
+	// Return Cloudflare-style WebSocket response
+	return new Response(null, {
+		status: 101,
+		webSocket: client
+	})
+}
+`;
+}
+//#endregion
+//#region src/dev-server/gateway-script.ts
+/**
+* Generates the dev-server gateway worker script inline.
+*
+* All in-sandbox RPC behavior (method dispatch, error envelope, serialization,
+* WebSocket bridge, HTTP transfer) lives in `GATEWAY_RUNTIME_JS` and is shared
+* with `src/bridge/miniflare.ts`. The canonical TypeScript equivalent lives in
+* `src/bridge/server.ts`. The local presigned-R2 endpoint handler is shared
+* via `R2_PRESIGN_RUNTIME_JS` (`src/bridge/r2-presign-runtime.ts`).
+*
+* This file only owns the pieces that are genuinely dev-server-specific:
+*   - WebSocket route matching & DO WebSocket forwarding (`WS_ROUTES`)
+*   - D1 migration endpoint
+*   - Inbound email ingestion endpoint
+*   - Service-binding fallthrough to the app worker
+*
+* @param wsRoutes - WebSocket routes for DO proxying
+* @param debug - Enable debug logging in gateway
+* @param appServiceBindingName - Service binding name for the app worker (if any)
+*/
+function getGatewayScript(wsRoutes = [], debug = false, appServiceBindingName = null) {
+	return `
+${GATEWAY_RUNTIME_JS}
+
+${R2_PRESIGN_RUNTIME_JS}
+
+// Bridge Gateway Worker — Dev Server
+// Dev-server-specific overlay on top of the shared GATEWAY_RUNTIME_JS:
+// WS route DO forwarding, D1 migration, email ingest, app-worker fallthrough.
+
+const DEBUG = ${debug}
+const log = (...args) => DEBUG && console.log('[Gateway]', ...args)
+
+const WS_ROUTES = ${JSON.stringify(wsRoutes)}
+const APP_SERVICE_BINDING = ${JSON.stringify(appServiceBindingName)}
+
+export default {
+	async fetch(request, env, ctx) {
+		const url = new URL(request.url)
+		const isWebSocket = request.headers.get('Upgrade') === 'websocket'
+
+		if (isWebSocket) {
+			// Bridge DO connect(): a real pass-through upgrade to a Durable Object
+			// (hibernation-correct), distinct from the bridge RPC/relay socket.
+			if (url.pathname === '/_devflare/do-ws') {
+				return handleBridgeDoWebSocket(request, env, url)
+			}
+			const matchedRoute = matchWsRoute(url.pathname)
+			if (matchedRoute) {
+				return handleDoWebSocket(request, env, url, matchedRoute)
+			}
+			// Worker mode: the app worker (SvelteKit etc.) owns app WebSocket routes.
+			// A handler like GET /api/doc/:id/subscribe that does
+			// \`return stub.fetch(clientUpgradeRequest)\` must reach the app worker so
+			// its returned 101 (with the DO's client socket) flows back to the
+			// browser and the DO's hibernation handlers fire. The gateway previously
+			// hijacked EVERY unmatched WS upgrade into the in-worker bridge socket
+			// (handleBridgeWebSocket), so the app route never ran and two tabs never
+			// shared the DO. Forward to the app first; only fall back to the bridge
+			// socket when the app did not answer with a WebSocket upgrade (e.g. a
+			// Node-side bridge RPC client, which only exists when there is no app).
+			const appWsResponse = await forwardWebSocketToApp(request, env)
+			if (appWsResponse) {
+				return appWsResponse
+			}
+			return handleBridgeWebSocket(request, env, ctx)
+		}
+
+		if (url.pathname.startsWith('/_devflare/transfer/')) {
+			return handleHttpTransfer(request, env, url)
+		}
+
+		const presignResponse = await __devflareR2PresignHandle(request, env, url)
+		if (presignResponse) {
+			return presignResponse
+		}
+
+		if (url.pathname === '/_devflare/migrate' && request.method === 'POST') {
+			return handleMigration(request, env)
+		}
+
+		if (url.pathname === '/cdn-cgi/handler/email' && request.method === 'POST') {
+			return handleEmailIncoming(request, env, ctx, url)
+		}
+
+		if (url.pathname === '/_devflare/health') {
+			return new Response(JSON.stringify({
+				ok: true,
+				bindings: Object.keys(env),
+				wsRoutes: WS_ROUTES
+			}), { headers: { 'Content-Type': 'application/json' } })
+		}
+
+		if (APP_SERVICE_BINDING) {
+			const appWorker = env[APP_SERVICE_BINDING]
+			if (appWorker && typeof appWorker.fetch === 'function') {
+				return appWorker.fetch(request)
+			}
+		}
+
+		return new Response('Devflare Bridge Gateway', { status: 200 })
+	}
+}
+
+async function handleMigration(request, env) {
+	try {
+		const { bindingName, statements, files } = await request.json()
+		log('Migration request for binding:', bindingName, 'statements count:', statements?.length, 'files:', files?.length, 'bindings:', Object.keys(env))
+		const db = env[bindingName]
+		if (!db) {
+			return Response.json({ error: 'Binding not found: ' + bindingName }, { status: 404 })
+		}
+
+		// Ledger-aware path: when the client sends per-file metadata, we track
+		// applied migrations in a \`_devflare_migrations\` table and skip files
+		// whose filename+sha256 is already recorded. Files with a drifting hash
+		// are reported as warnings and skipped — we refuse to re-apply to avoid
+		// stomping on user data.
+		if (Array.isArray(files) && files.length > 0) {
+			try {
+				await db.prepare(
+					'CREATE TABLE IF NOT EXISTS _devflare_migrations (filename TEXT PRIMARY KEY, applied_at TEXT NOT NULL, sha256 TEXT NOT NULL)'
+				).run()
+			} catch (error) {
+				const msg = error?.message || String(error)
+				log('Failed to ensure migration ledger:', msg)
+				return Response.json({ error: 'Failed to ensure migration ledger: ' + msg }, { status: 500 })
+			}
+
+			let ledgerRows = []
+			try {
+				const ledger = await db.prepare('SELECT filename, sha256 FROM _devflare_migrations').all()
+				ledgerRows = ledger?.results || []
+			} catch (error) {
+				log('Failed to read migration ledger:', error?.message || String(error))
+			}
+			const ledgerByFilename = new Map()
+			for (const row of ledgerRows) {
+				ledgerByFilename.set(row.filename, row.sha256)
+			}
+
+			const applied = []
+			const skipped = []
+			const warnings = []
+			const results = []
+
+			for (const file of files) {
+				const existingHash = ledgerByFilename.get(file.filename)
+				if (existingHash === file.sha256) {
+					skipped.push(file.filename)
+					continue
+				}
+				if (existingHash && existingHash !== file.sha256) {
+					warnings.push({
+						filename: file.filename,
+						message: 'sha256 drifted since last apply; skipped'
+					})
+					skipped.push(file.filename)
+					continue
+				}
+
+				let fileFailed = false
+				for (const sql of file.statements || []) {
+					try {
+						log('Running migration SQL:', sql.slice(0, 80))
+						await db.prepare(sql).run()
+						results.push({ sql: sql.slice(0, 50), success: true })
+					} catch (error) {
+						const msg = error?.message || String(error)
+						log('Migration SQL error:', msg)
+						if (msg.includes('already exists')) {
+							results.push({ sql: sql.slice(0, 50), success: true, skipped: true })
+						} else {
+							results.push({ sql: sql.slice(0, 50), success: false, error: msg })
+							fileFailed = true
+						}
+					}
+				}
+
+				if (!fileFailed) {
+					try {
+						await db.prepare(
+							'INSERT OR REPLACE INTO _devflare_migrations (filename, applied_at, sha256) VALUES (?, ?, ?)'
+						).bind(file.filename, new Date().toISOString(), file.sha256).run()
+						applied.push(file.filename)
+					} catch (error) {
+						log('Failed to record migration in ledger:', error?.message || String(error))
+					}
+				}
+			}
+
+			return Response.json({ success: true, results, applied, skipped, warnings })
+		}
+
+		// Legacy path: flat statement list, no ledger tracking.
+		const results = []
+		for (const sql of statements) {
+			try {
+				log('Running migration SQL:', sql.slice(0, 80))
+				await db.prepare(sql).run()
+				results.push({ sql: sql.slice(0, 50), success: true })
+				log('Migration SQL succeeded')
+			} catch (error) {
+				const msg = error?.message || String(error)
+				log('Migration SQL error:', msg)
+				if (msg.includes('already exists')) {
+					results.push({ sql: sql.slice(0, 50), success: true, skipped: true })
+				} else {
+					results.push({ sql: sql.slice(0, 50), success: false, error: msg })
+				}
+			}
+		}
+
+		try {
+			const tables = await db.prepare(\"SELECT name FROM sqlite_master WHERE type='table'\").all()
+			log('Tables after migration:', JSON.stringify(tables))
+		} catch (e) {
+			log('Error listing tables:', e.message)
+		}
+
+		return Response.json({ success: true, results })
+	} catch (error) {
+		return Response.json({ error: error?.message || String(error) }, { status: 500 })
+	}
+}
+
+async function handleEmailIncoming(request, env, ctx, url) {
+	try {
+		const from = url.searchParams.get('from') || 'unknown@example.com'
+		const to = url.searchParams.get('to') || 'worker@example.com'
+		const rawBody = await request.text()
+
+		log('Email incoming:', { from, to, bodyLength: rawBody.length })
+
+		if (APP_SERVICE_BINDING) {
+			const appWorker = env[APP_SERVICE_BINDING]
+			if (appWorker && typeof appWorker.fetch === 'function') {
+				const response = await appWorker.fetch(new Request('http://devflare.internal/_devflare/internal/email', {
+					method: 'POST',
+					headers: {
+						'x-devflare-event': 'email',
+						'x-devflare-email-from': from,
+						'x-devflare-email-to': to,
+						'content-type': request.headers.get('content-type') || 'text/plain'
+					},
+					body: rawBody
+				}))
+
+				if (!response.ok) {
+					return response
+				}
+			}
+		}
+
+		return new Response(JSON.stringify({ ok: true, from, to }), {
+			headers: { 'Content-Type': 'application/json' }
+		})
+	} catch (error) {
+		console.error('[Gateway] Email handler error:', error)
+		return Response.json({ error: error?.message || String(error) }, { status: 500 })
+	}
+}
+
+function matchWsRoute(pathname) {
+	for (const route of WS_ROUTES) {
+		if (pathname === route.pattern || pathname.startsWith(route.pattern + '?')) {
+			return route
+		}
+	}
+	return null
+}
+
+// Forward a WebSocket upgrade to the app worker (worker mode) and pass through
+// its response ONLY when the app answered with a genuine WebSocket upgrade
+// (status 101 + a webSocket). Returns null otherwise so the caller falls back to
+// the in-worker bridge socket. This is what lets an app route that does
+// \`return stub.fetch(clientUpgradeRequest)\` reach the DO and stream the DO's
+// client socket back to the browser (hibernation handlers then fire, and two
+// tabs share one DO instance). A GET upgrade has no body, so forwarding the same
+// request and — on a non-101 answer — discarding it is safe (no stream consumed).
+async function forwardWebSocketToApp(request, env) {
+	if (!APP_SERVICE_BINDING) return null
+	const appWorker = env[APP_SERVICE_BINDING]
+	if (!appWorker || typeof appWorker.fetch !== 'function') return null
+	const response = await appWorker.fetch(request)
+	if (response.status === 101 && response.webSocket) {
+		return response
+	}
+	return null
+}
+
+async function handleDoWebSocket(request, env, url, route) {
+	try {
+		const namespace = env[route.doNamespace]
+		if (!namespace) {
+			console.error('[Gateway] DO namespace not found:', route.doNamespace)
+			return new Response('DO namespace not found: ' + route.doNamespace, { status: 500 })
+		}
+
+		const idValue = url.searchParams.get(route.idParam) || 'default'
+		const doId = namespace.idFromName(idValue)
+		const stub = namespace.get(doId)
+
+		const forwardUrl = new URL(route.forwardPath, url.origin)
+		url.searchParams.forEach((v, k) => forwardUrl.searchParams.set(k, v))
+
+		log('Forwarding WebSocket to DO:', route.doNamespace, 'id:', idValue, 'path:', forwardUrl.pathname)
+
+		return stub.fetch(forwardUrl.toString(), {
+			method: request.method,
+			headers: request.headers
+		})
+	} catch (error) {
+		console.error('[Gateway] Error forwarding to DO:', error)
+		return new Response('Error forwarding to DO: ' + error.message, { status: 500 })
+	}
+}
+`;
+}
+//#endregion
+//#region src/dev-server/miniflare-worker-config.ts
+const DEFAULT_MODULE_RULES = [
+	{
+		type: "ESModule",
+		include: [
+			"**/*.ts",
+			"**/*.tsx",
+			"**/*.mts",
+			"**/*.mjs"
+		]
+	},
+	{
+		type: "CommonJS",
+		include: ["**/*.js", "**/*.cjs"]
+	},
+	{
+		type: "ESModule",
+		include: ["**/*.jsx"]
+	}
+];
+function toMiniflareModuleRule(rule) {
+	return {
+		type: rule.type,
+		include: rule.globs,
+		...rule.fallthrough !== void 0 && { fallthrough: rule.fallthrough }
+	};
+}
+/**
+* Build the per-worker `serviceBindings` map. Combines user-declared
+* `bindings.services` (config) with any extra bindings the caller wants to
+* inject (e.g. internal gateway -> app routing).
+*/
+function buildServiceBindings(bindings, extraBindings = {}) {
+	const serviceBindings = {};
+	if (bindings.services) for (const [bindingName, serviceConfig] of Object.entries(bindings.services)) serviceBindings[bindingName] = {
+		name: serviceConfig.service,
+		...serviceConfig.entrypoint && { entrypoint: serviceConfig.entrypoint },
+		...serviceConfig.props !== void 0 && { props: serviceConfig.props }
+	};
+	for (const [bindingName, target] of Object.entries(extraBindings)) serviceBindings[bindingName] = target;
+	return Object.keys(serviceBindings).length > 0 ? serviceBindings : void 0;
+}
+/**
+* Build a single worker config object for Miniflare's `workers` array.
+* All inputs are passed explicitly (no closures over the caller's locals).
+*/
+function makeMiniflareWorker(context, options) {
+	const { cwd, loadedConfig, bindings, sendEmailConfig, rateLimitsConfig, versionMetadataConfig, workerLoadersConfig, mtlsCertificatesConfig, dispatchNamespacesConfig, workflowsConfig, pipelinesConfig, hyperdrivesConfig, imagesConfig, mediaConfig, streamConfig, flagshipConfig, analyticsEngineConfig, tailConsumersConfig, streamingTailConsumersConfig, artifactsConfig, aiSearchNamespacesConfig, aiSearchInstancesConfig, secretsStoreConfig, localSecretWrappedBindingConfig, queueProducers } = context;
+	const baseFlags = loadedConfig.compatibilityFlags ?? [];
+	const compatFlags = baseFlags.includes("nodejs_compat") ? baseFlags : [...baseFlags, "nodejs_compat"];
+	const workerBindings = {
+		...loadedConfig.vars ?? {},
+		...context.injectedVars ?? {}
+	};
+	const localWrappedBindings = { ...localSecretWrappedBindingConfig?.wrappedBindings ?? {} };
+	const workerConfig = {
+		name: options.name,
+		modules: true,
+		compatibilityDate: loadedConfig.compatibilityDate,
+		compatibilityFlags: compatFlags,
+		...bindings.kv && { kvNamespaces: Object.fromEntries(Object.entries(bindings.kv).map(([bindingName, bindingConfig]) => {
+			return [bindingName, getLocalKVNamespaceIdentifier(bindingConfig)];
+		})) },
+		...bindings.r2 && { r2Buckets: Object.fromEntries(Object.entries(bindings.r2).map(([bindingName, bindingConfig]) => {
+			return [bindingName, normalizeR2Binding(bindingConfig).bucketName];
+		})) },
+		...bindings.d1 && { d1Databases: Object.fromEntries(Object.entries(bindings.d1).map(([bindingName, bindingConfig]) => {
+			return [bindingName, getLocalD1DatabaseIdentifier(bindingConfig)];
+		})) },
+		...Object.keys(workerBindings).length > 0 && { bindings: workerBindings },
+		...sendEmailConfig && { email: sendEmailConfig },
+		...rateLimitsConfig && { ratelimits: rateLimitsConfig },
+		...versionMetadataConfig && { versionMetadata: versionMetadataConfig },
+		...workerLoadersConfig && { workerLoaders: workerLoadersConfig },
+		...mtlsCertificatesConfig && { mtlsCertificates: mtlsCertificatesConfig },
+		...dispatchNamespacesConfig && { dispatchNamespaces: dispatchNamespacesConfig },
+		...workflowsConfig && { workflows: workflowsConfig },
+		...pipelinesConfig && { pipelines: pipelinesConfig },
+		...hyperdrivesConfig && { hyperdrives: hyperdrivesConfig },
+		...imagesConfig && { images: imagesConfig },
+		...mediaConfig && { media: mediaConfig },
+		...streamConfig && { stream: streamConfig },
+		...flagshipConfig && { flagship: flagshipConfig },
+		...analyticsEngineConfig && { analyticsEngineDatasets: analyticsEngineConfig },
+		...tailConsumersConfig && { tails: tailConsumersConfig },
+		...streamingTailConsumersConfig && { streamingTails: streamingTailConsumersConfig },
+		...artifactsConfig && { artifacts: artifactsConfig },
+		...aiSearchNamespacesConfig && { aiSearchNamespaces: aiSearchNamespacesConfig },
+		...aiSearchInstancesConfig && { aiSearchInstances: aiSearchInstancesConfig },
+		...secretsStoreConfig && { secretsStoreSecrets: secretsStoreConfig },
+		...Object.keys(localWrappedBindings).length > 0 && { wrappedBindings: localWrappedBindings },
+		...queueProducers && { queueProducers },
+		...options.queueConsumers && { queueConsumers: options.queueConsumers },
+		...options.triggers && { triggers: options.triggers }
+	};
+	if (options.scriptPath) {
+		workerConfig.scriptPath = options.scriptPath;
+		workerConfig.modulesRoot = loadedConfig.baseDir ? resolve(cwd, loadedConfig.baseDir) : cwd;
+		workerConfig.modulesRules = [...loadedConfig.rules?.map(toMiniflareModuleRule) ?? [], ...DEFAULT_MODULE_RULES];
+	}
+	if (options.script) workerConfig.script = options.script;
+	if (options.durableObjects && Object.keys(options.durableObjects).length > 0) workerConfig.durableObjects = options.durableObjects;
+	if (options.serviceBindings && Object.keys(options.serviceBindings).length > 0) workerConfig.serviceBindings = options.serviceBindings;
+	if (options.outboundService !== void 0) workerConfig.outboundService = options.outboundService;
+	return workerConfig;
+}
+//#endregion
+//#region src/dev-server/worker-surface-paths.ts
+const DEFAULT_TRANSPORT_ENTRY_FILES = [
+	"src/transport.ts",
+	"src/transport.js",
+	"src/transport.mts",
+	"src/transport.mjs"
+];
+const resolveMainWorkerSurfacePaths = resolveWorkerSurfacePaths;
+function addWorkerWatchRoots(roots, cwd, configuredPath, defaultEntries) {
+	if (configuredPath === false || configuredPath === null) return;
+	if (typeof configuredPath === "string" && configuredPath) {
+		roots.add(dirname(resolve(cwd, configuredPath)));
+		return;
+	}
+	for (const defaultEntry of defaultEntries) roots.add(dirname(resolve(cwd, defaultEntry)));
+}
+function collectWorkerWatchRoots(cwd, config, mainWorkerSurfacePaths) {
+	const roots = /* @__PURE__ */ new Set();
+	for (const surfacePath of Object.values(mainWorkerSurfacePaths)) if (surfacePath) roots.add(dirname(surfacePath));
+	addWorkerWatchRoots(roots, cwd, config.files?.fetch, DEFAULT_FETCH_ENTRY_FILES);
+	addWorkerWatchRoots(roots, cwd, config.files?.queue, DEFAULT_QUEUE_ENTRY_FILES);
+	addWorkerWatchRoots(roots, cwd, config.files?.scheduled, DEFAULT_SCHEDULED_ENTRY_FILES);
+	addWorkerWatchRoots(roots, cwd, config.files?.email, DEFAULT_EMAIL_ENTRY_FILES);
+	addWorkerWatchRoots(roots, cwd, config.files?.transport, DEFAULT_TRANSPORT_ENTRY_FILES);
+	const routeDirectory = getRouteDirectoryCandidate(cwd, config);
+	if (routeDirectory) roots.add(routeDirectory.absoluteDir);
+	return [...roots];
+}
+//#endregion
+//#region src/dev-server/miniflare-dev-config.ts
+const INTERNAL_APP_SERVICE_BINDING = "__DEVFLARE_APP";
+/**
+* Resolve the browser-facing origin of the local dev runtime, used inside
+* locally-presigned R2 URLs. Honors `server.publicUrl` (reverse proxy /
+* tunnel setups); otherwise derives `http(s)://<host>:<port>` from the
+* Miniflare listen address, normalizing wildcard hosts to `localhost`.
+*/
+function resolveR2PresignOrigin(serverConfig, miniflareHost, miniflarePort) {
+	if (serverConfig?.publicUrl) return serverConfig.publicUrl.replace(/\/$/, "");
+	return `${serverConfig?.https ? "https" : "http"}://${miniflareHost === "0.0.0.0" || miniflareHost === "::" ? "localhost" : miniflareHost}:${miniflarePort}`;
+}
+/**
+* Build the complete Miniflare configuration for the dev server.
+*
+* IMPORTANT: When using multi-worker setup, ALL workers must go in the
+* `workers` array. The FIRST worker is the entrypoint and receives all
+* HTTP requests. Top-level script/modules options are NOT used when
+* workers array is present.
+*/
+function buildMiniflareDevConfig(input) {
+	const { config: loadedConfig, cwd, miniflarePort, miniflareHost = "127.0.0.1", persist, enableVite, debug, mainWorkerSurfacePaths, mainWorkerRoutes, mainWorkerScriptPath, bundledMainWorkerScriptPath, workflowEntrypointScript, browserShimPort, doResult, serviceBindingResolution, r2PresignSecret, additionalInjectedVars, logger } = input;
+	const bindings = loadedConfig.bindings ?? {};
+	const persistPath = process.env.DEVFLARE_PERSIST_DIR ? resolve(cwd, process.env.DEVFLARE_PERSIST_DIR) : resolve(cwd, ".devflare/data");
+	const appWorkerName = loadedConfig.name;
+	const shouldRunMainWorker = !enableVite && (hasWorkerSurfacePaths(mainWorkerSurfacePaths) || Boolean(mainWorkerRoutes?.routes.length));
+	const queueProducers = buildQueueProducers(bindings);
+	const queueConsumers = buildQueueConsumers(bindings);
+	const serverConfig = loadedConfig.server;
+	const sharedOptions = {
+		port: miniflarePort,
+		host: miniflareHost,
+		kvPersist: persist ? `${persistPath}/kv` : void 0,
+		r2Persist: persist ? `${persistPath}/r2` : void 0,
+		d1Persist: persist ? `${persistPath}/d1` : void 0,
+		cachePersist: persist ? `${persistPath}/cache` : void 0,
+		durableObjectsPersist: persist ? `${persistPath}/do` : void 0,
+		workflowsPersist: persist ? `${persistPath}/workflows` : void 0,
+		imagesPersist: persist ? `${persistPath}/images` : void 0,
+		streamPersist: persist ? `${persistPath}/stream` : void 0,
+		...serverConfig?.https !== void 0 && { https: serverConfig.https },
+		...serverConfig?.httpsKeyPath !== void 0 && { httpsKeyPath: serverConfig.httpsKeyPath },
+		...serverConfig?.httpsCertPath !== void 0 && { httpsCertPath: serverConfig.httpsCertPath },
+		...serverConfig?.inspectorPort !== void 0 && { inspectorPort: serverConfig.inspectorPort },
+		...serverConfig?.inspectorHost !== void 0 && { inspectorHost: serverConfig.inspectorHost },
+		...serverConfig?.upstream !== void 0 && { upstream: serverConfig.upstream },
+		...serverConfig?.liveReload !== void 0 && { liveReload: serverConfig.liveReload },
+		...serverConfig?.verbose !== void 0 && { verbose: serverConfig.verbose },
+		...serverConfig?.logRequests !== void 0 && { logRequests: serverConfig.logRequests },
+		...serverConfig?.cf !== void 0 && { cf: serverConfig.cf },
+		...serverConfig?.publicUrl !== void 0 && { publicUrl: serverConfig.publicUrl }
+	};
+	const localBindingShimServiceConfig = buildLocalBindingShimServiceConfig(loadedConfig);
+	const createServiceBindings = (extraBindings = {}) => buildServiceBindings(bindings, {
+		...serviceBindingResolution?.primaryServiceBindings ?? {},
+		...localBindingShimServiceConfig.serviceBindings,
+		...extraBindings
+	});
+	const sendEmailConfig = buildSendEmailConfig(bindings);
+	const rateLimitsConfig = buildRateLimitsConfig(bindings);
+	const versionMetadataConfig = buildVersionMetadataConfig(bindings);
+	const workerLoadersConfig = buildWorkerLoadersConfig(bindings);
+	const mtlsCertificatesConfig = buildMtlsCertificatesConfig(bindings);
+	const dispatchNamespacesConfig = buildDispatchNamespacesConfig(bindings);
+	const workflowsConfig = buildWorkflowsConfig(bindings);
+	const pipelinesConfig = buildPipelinesConfig(bindings);
+	const hyperdrivesConfig = buildHyperdrivesConfig(bindings);
+	const imagesConfig = bindings.images ? void 0 : buildImagesConfig(bindings);
+	const mediaConfig = bindings.media ? void 0 : buildMediaConfig(bindings);
+	const streamConfig = buildStreamConfig(bindings);
+	const flagshipConfig = buildFlagshipConfig(bindings);
+	const analyticsEngineConfig = buildAnalyticsEngineConfig(bindings);
+	const tailConsumersConfig = buildTailConsumersConfig(loadedConfig);
+	const streamingTailConsumersConfig = buildStreamingTailConsumersConfig(loadedConfig);
+	const artifactsConfig = buildArtifactsConfig(bindings);
+	const aiSearchNamespacesConfig = buildAiSearchNamespacesConfig(bindings);
+	const aiSearchInstancesConfig = buildAiSearchInstancesConfig(bindings);
+	const localSecretWrappedBindingConfig = buildLocalSecretWrappedBindingConfig(loadedConfig, cwd);
+	const localSecretBindingNames = new Set(localSecretWrappedBindingConfig.localBindingNames);
+	const secretsStoreConfig = buildSecretsStoreConfig(bindings, loadedConfig.secretsStoreId, localSecretBindingNames);
+	const presignVars = bindings.r2 && r2PresignSecret ? {
+		DEVFLARE_R2_PRESIGN_SECRET: r2PresignSecret,
+		DEVFLARE_R2_PRESIGN_ORIGIN: resolveR2PresignOrigin(serverConfig, miniflareHost, miniflarePort)
+	} : void 0;
+	const hasAdditional = additionalInjectedVars !== void 0 && Object.keys(additionalInjectedVars).length > 0;
+	const workerContext = {
+		cwd,
+		loadedConfig,
+		bindings,
+		sendEmailConfig,
+		rateLimitsConfig,
+		versionMetadataConfig,
+		workerLoadersConfig,
+		mtlsCertificatesConfig,
+		dispatchNamespacesConfig,
+		workflowsConfig,
+		pipelinesConfig,
+		hyperdrivesConfig,
+		imagesConfig,
+		mediaConfig,
+		streamConfig,
+		flagshipConfig,
+		analyticsEngineConfig,
+		tailConsumersConfig,
+		streamingTailConsumersConfig,
+		artifactsConfig,
+		aiSearchNamespacesConfig,
+		aiSearchInstancesConfig,
+		secretsStoreConfig,
+		localSecretWrappedBindingConfig,
+		queueProducers,
+		injectedVars: presignVars || hasAdditional ? {
+			...presignVars ?? {},
+			...hasAdditional ? additionalInjectedVars : {}
+		} : void 0
+	};
+	const createWorkerConfig = (options) => makeMiniflareWorker(workerContext, options);
+	const gatewayWorker = createWorkerConfig({
+		name: "gateway",
+		script: [workflowEntrypointScript, getGatewayScript(loadedConfig.wsRoutes, debug, shouldRunMainWorker ? INTERNAL_APP_SERVICE_BINDING : null)].filter(Boolean).join("\n\n"),
+		serviceBindings: shouldRunMainWorker ? createServiceBindings({ [INTERNAL_APP_SERVICE_BINDING]: { name: appWorkerName } }) : createServiceBindings()
+	});
+	gatewayWorker.routes = ["*"];
+	const hasDurableObjectBundles = !!doResult && doResult.bundles.size > 0;
+	const browserBindingName = getSingleBrowserBindingName(bindings.browser);
+	const needsBrowserWorker = Boolean(browserBindingName && (hasDurableObjectBundles || shouldRunMainWorker));
+	const workers = [];
+	const durableObjects = {};
+	const browserShimUrl = `http://127.0.0.1:${browserShimPort}`;
+	const browserWorkerName = "browser-binding";
+	if (shouldRunMainWorker && mainWorkerScriptPath) {
+		const mainWorkerServiceBindings = createServiceBindings(browserBindingName ? { [browserBindingName]: { name: browserWorkerName } } : {});
+		const mainWorkerConfig = createWorkerConfig({
+			name: appWorkerName,
+			scriptPath: bundledMainWorkerScriptPath ?? mainWorkerScriptPath,
+			serviceBindings: mainWorkerServiceBindings,
+			queueConsumers,
+			triggers: loadedConfig.triggers?.crons?.length ? { crons: loadedConfig.triggers.crons } : void 0
+		});
+		workers.push(mainWorkerConfig);
+	}
+	if (doResult) for (const [bindingName, bundlePath] of doResult.bundles) {
+		const className = doResult.classes.get(bindingName);
+		if (!className) continue;
+		const workerName = `do-${bindingName.toLowerCase()}`;
+		const workerConfig = createWorkerConfig({
+			name: workerName,
+			scriptPath: bundlePath,
+			durableObjects: { [bindingName]: className },
+			serviceBindings: createServiceBindings(browserBindingName ? { [browserBindingName]: { name: browserWorkerName } } : {})
+		});
+		if (browserBindingName) logger?.debug(`DO ${workerName} has browser service binding: ${browserBindingName} → ${browserWorkerName}`);
+		logger?.debug(`DO ${workerName} config:`, JSON.stringify(workerConfig, null, 2));
+		workers.push(workerConfig);
+		durableObjects[bindingName] = {
+			className,
+			scriptName: workerName
+		};
+	}
+	if (needsBrowserWorker) {
+		const browserWorker = createWorkerConfig({
+			name: browserWorkerName,
+			script: getBrowserBindingScript(browserShimUrl, debug)
+		});
+		workers.push(browserWorker);
+		logger?.info(`Browser binding worker configured: ${browserBindingName} → ${browserShimUrl}`);
+	}
+	if (Object.keys(durableObjects).length > 0) {
+		gatewayWorker.durableObjects = durableObjects;
+		if (shouldRunMainWorker) {
+			const mainWorker = workers.find((worker) => worker.name === appWorkerName);
+			if (mainWorker) mainWorker.durableObjects = durableObjects;
+		}
+	}
+	return {
+		...sharedOptions,
+		workers: [
+			gatewayWorker,
+			...workers,
+			...serviceBindingResolution?.workers ?? [],
+			...localSecretWrappedBindingConfig.workers,
+			...localBindingShimServiceConfig.workers
+		]
+	};
+}
+//#endregion
+//#region src/dev-server/runtime-stdio.ts
+function writeStdout(logger, message) {
+	if (typeof logger?.log === "function") {
+		logger.log(message);
+		return;
+	}
+	if (typeof logger?.info === "function") {
+		logger.info(message);
+		return;
+	}
+	console.log(message);
+}
+function writeStderr(logger, message) {
+	if (typeof logger?.error === "function") {
+		logger.error(message);
+		return;
+	}
+	console.error(message);
+}
+function createRuntimeStdioForwarder(logger) {
+	return (stdout, stderr) => {
+		createInterface({ input: stdout }).on("line", (data) => {
+			writeStdout(logger, data);
+		});
+		createInterface({ input: stderr }).on("line", (data) => {
+			writeStderr(logger, data);
+		});
+	};
+}
+//#endregion
+//#region src/browser-shim/server.ts
+/**
+* Devflare's **local browser-rendering shim**.
+*
+* Accepts only loopback browser origins (e.g. `http://127.0.0.1:*`,
+* `http://localhost:*`) plus origin-less tool traffic (Puppeteer, curl, and
+* other non-browser clients that do not send an `Origin` header). Cross-origin
+* browser traffic is rejected at the request boundary.
+*
+* This is NOT a user-facing app route — it is devflare's protected helper
+* endpoint used by the local Browser Rendering binding to satisfy the
+* `@cloudflare/puppeteer` contract during local dev. The loopback-only posture
+* applies to this shim only and does not apply to the user's normal worker
+* routes.
+*/
+let cachedExecutablePath = null;
+/**
+* Default Chrome flags used when launching headless Chrome for local
+* browser-rendering emulation. Each flag is included for a deliberate reason;
+* edit cautiously.
+*
+* NOTE: `--no-sandbox` / `--disable-setuid-sandbox` are intentionally NOT part
+* of the defaults. Disabling the sandbox removes the primary boundary between
+* untrusted web content and the host and must be opted into explicitly via
+* `BrowserShimOptions.allowNoSandbox`.
+*/
+const DEFAULT_CHROME_FLAGS = [
+	"--disable-dev-shm-usage",
+	"--disable-gpu",
+	"--disable-software-rasterizer",
+	"--disable-extensions",
+	"--disable-background-networking",
+	"--disable-background-timer-throttling",
+	"--disable-backgrounding-occluded-windows",
+	"--disable-renderer-backgrounding",
+	"--disable-features=TranslateUI",
+	"--disable-ipc-flooding-protection",
+	"--disable-default-apps",
+	"--mute-audio",
+	"--js-flags=--max-old-space-size=4096"
+];
+/**
+* Flags appended only when `allowNoSandbox` is explicitly enabled. Kept in a
+* separate constant so callers and tests can assert they are opt-in.
+*/
+const NO_SANDBOX_FLAGS = ["--no-sandbox", "--disable-setuid-sandbox"];
+/**
+* Resolve the Chrome argv for a shim launch. Exported for testability.
+*/
+function resolveChromeFlags(options = {}) {
+	const flags = [...DEFAULT_CHROME_FLAGS];
+	if (options.allowNoSandbox) flags.unshift(...NO_SANDBOX_FLAGS);
+	return flags;
+}
+/**
+* Create a download progress logger that emits at most one "start" line and
+* exactly one "complete" line per download. Avoids the previous heuristic
+* percent-spam which could log the same bucket multiple times.
+*
+* The returned callback matches `@puppeteer/browsers` `downloadProgressCallback`.
+*/
+function createDownloadProgressLogger(logger, label = "Chrome") {
+	const state = {
+		started: false,
+		completed: false,
+		progress: {
+			bytesReceived: 0,
+			totalBytes: 0
+		}
+	};
+	return {
+		onProgress(downloadedBytes, totalBytes) {
+			if (state.completed) return;
+			state.progress.bytesReceived = downloadedBytes;
+			state.progress.totalBytes = totalBytes;
+			if (!state.started) {
+				state.started = true;
+				logger?.info(`[BrowserShim] Downloading ${label}...`);
+			}
+			if (totalBytes > 0 && downloadedBytes >= totalBytes) {
+				state.completed = true;
+				logger?.info(`[BrowserShim] ${label} download complete`);
+			}
+		},
+		finalize() {
+			if (!state.started || state.completed) return;
+			state.completed = true;
+			logger?.info(`[BrowserShim] ${label} download complete`);
+		},
+		get progress() {
+			return state.progress;
+		},
+		get started() {
+			return state.started;
+		},
+		get completed() {
+			return state.completed;
+		}
+	};
+}
+/**
+* Get or install Chrome Headless Shell
+* Uses a shared cache directory so Chrome is only installed once globally
+*/
+async function ensureChrome(cacheDir, logger) {
+	if (cachedExecutablePath && existsSync(cachedExecutablePath)) return cachedExecutablePath;
+	const platform = detectBrowserPlatform();
+	if (!platform) throw new Error("Could not detect browser platform");
+	const buildId = await resolveBuildId(Browser.CHROMEHEADLESSSHELL, platform, "stable");
+	logger?.debug(`[BrowserShim] Resolved Chrome Headless Shell build: ${buildId}`);
+	const progressLogger = createDownloadProgressLogger(logger, "Chrome");
+	const installedBrowser = await install({
+		browser: Browser.CHROMEHEADLESSSHELL,
+		buildId,
+		cacheDir,
+		downloadProgressCallback: (downloadedBytes, totalBytes) => {
+			progressLogger.onProgress(downloadedBytes, totalBytes);
+		}
+	});
+	progressLogger.finalize();
+	cachedExecutablePath = installedBrowser.executablePath;
+	logger?.success(`[BrowserShim] Chrome ready: ${installedBrowser.executablePath}`);
+	return installedBrowser.executablePath;
+}
+function createBrowserShim(options = {}) {
+	const { port = 8788, host = "127.0.0.1", logger, verbose = false, keepAlive = 6e4, cacheDir = join$1(homedir(), ".devflare", "chrome"), allowNoSandbox = false } = options;
+	const chromeLaunchArgs = resolveChromeFlags({ allowNoSandbox });
+	if (allowNoSandbox) logger?.warn("[BrowserShim] Launching Chrome with --no-sandbox (allowNoSandbox=true). Only use this in trusted CI/rootless environments.");
+	let server = null;
+	let executablePath = null;
+	const sessions = /* @__PURE__ */ new Map();
+	const history = [];
+	let WebSocketServerClass = null;
+	let WebSocketClass = null;
+	const maxRequestBodyBytes = 1024 * 1024;
+	function getRequestOrigin(req) {
+		const origin = req.headers.origin;
+		if (typeof origin === "string") return origin;
+		if (Array.isArray(origin) && origin[0]) return origin[0];
+		return null;
+	}
+	function isLoopbackOrigin(origin) {
+		try {
+			const url = new URL(origin);
+			return url.hostname === "127.0.0.1" || url.hostname === "localhost" || url.hostname === "::1" || url.hostname === "[::1]";
+		} catch {
+			return false;
+		}
+	}
+	function applyCorsHeaders(req, res) {
+		const origin = getRequestOrigin(req);
+		if (!origin) return true;
+		if (!isLoopbackOrigin(origin)) {
+			res.writeHead(403, { "Content-Type": "application/json" });
+			res.end(JSON.stringify({ error: "Forbidden origin" }));
+			return false;
+		}
+		res.setHeader("Access-Control-Allow-Origin", origin);
+		res.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
+		res.setHeader("Access-Control-Allow-Headers", "Content-Type");
+		res.setHeader("Vary", "Origin");
+		return true;
+	}
+	/**
+	* Launch a new browser and create a session
+	*/
+	async function acquireSession(acquireOptions) {
+		if (!executablePath) throw new Error("Chrome not initialized");
+		const browser = await puppeteerCore.launch({
+			executablePath,
+			headless: true,
+			protocolTimeout: 12e4,
+			args: chromeLaunchArgs
+		});
+		const wsEndpoint = browser.wsEndpoint();
+		const sessionId = crypto.randomUUID();
+		const session = {
+			sessionId,
+			browser,
+			wsEndpoint,
+			startTime: Date.now()
+		};
+		sessions.set(sessionId, session);
+		const timeout = acquireOptions?.keep_alive ?? keepAlive;
+		if (timeout > 0) session.idleTimeout = setTimeout(async () => {
+			const s = sessions.get(sessionId);
+			if (s && !s.connectionId) await closeSession(sessionId, 2, "BrowserIdle");
+		}, timeout);
+		if (verbose) logger?.debug(`[BrowserShim] Acquired session ${sessionId}`);
+		return { sessionId };
+	}
+	/**
+	* Close a browser session
+	*/
+	async function closeSession(sessionId, closeReason = 1, closeReasonText = "NormalClosure") {
+		const session = sessions.get(sessionId);
+		if (!session) return;
+		if (session.idleTimeout) clearTimeout(session.idleTimeout);
+		try {
+			await session.browser.close();
+		} catch {}
+		sessions.delete(sessionId);
+		history.unshift({
+			sessionId,
+			startTime: session.startTime,
+			endTime: Date.now(),
+			closeReason,
+			closeReasonText
+		});
+		if (history.length > 100) history.pop();
+		if (verbose) logger?.debug(`[BrowserShim] Closed session ${sessionId}: ${closeReasonText}`);
+	}
+	/**
+	* Handle HTTP requests
+	*/
+	async function handleRequest(req, res) {
+		const url = new URL(req.url || "/", `http://${host}:${port}`);
+		const method = req.method || "GET";
+		logger?.debug(`[BrowserShim] ${method} ${url.pathname}${url.search ? url.search : ""}`);
+		if (!applyCorsHeaders(req, res)) return;
+		if (method === "OPTIONS") {
+			res.writeHead(204);
+			res.end();
+			return;
+		}
+		if (url.pathname === "/v1/acquire" && (method === "POST" || method === "GET")) {
+			try {
+				let acquireOptions = {};
+				if (method === "GET") {
+					const keepAlive = url.searchParams.get("keep_alive");
+					if (keepAlive) acquireOptions.keep_alive = Number.parseInt(keepAlive, 10);
+				} else try {
+					const body = await readBody(req);
+					acquireOptions = JSON.parse(body);
+				} catch {}
+				sendJson(res, 200, await acquireSession(acquireOptions));
+			} catch (error) {
+				const msg = error instanceof Error ? error.message : "Failed to acquire browser";
+				logger?.error(`[BrowserShim] Acquire failed: ${msg}`);
+				sendJson(res, 500, { error: msg });
+			}
+			return;
+		}
+		if (url.pathname === "/v1/sessions" && method === "GET") {
+			sendJson(res, 200, Array.from(sessions.values()).map((s) => ({
+				sessionId: s.sessionId,
+				startTime: s.startTime,
+				connectionId: s.connectionId,
+				connectionStartTime: s.connectionStartTime
+			})));
+			return;
+		}
+		if (url.pathname === "/v1/history" && method === "GET") {
+			sendJson(res, 200, history.slice(0, 50));
+			return;
+		}
+		if (url.pathname === "/v1/limits" && method === "GET") {
+			sendJson(res, 200, {
+				activeSessions: Array.from(sessions.keys()).map((id) => ({ id })),
+				allowedBrowserAcquisitions: 10,
+				maxConcurrentSessions: 10,
+				timeUntilNextAllowedBrowserAcquisition: 0
+			});
+			return;
+		}
+		if (url.pathname.startsWith("/v1/session/") && method === "GET") {
+			const sessionId = url.pathname.slice(12);
+			const session = sessions.get(sessionId);
+			if (!session) {
+				sendJson(res, 404, { error: "Session not found" });
+				return;
+			}
+			sendJson(res, 200, {
+				sessionId: session.sessionId,
+				wsEndpoint: session.wsEndpoint,
+				startTime: session.startTime,
+				connectionId: session.connectionId,
+				connectionStartTime: session.connectionStartTime
+			});
+			return;
+		}
+		if (url.pathname === "/_devflare/browser/health") {
+			sendJson(res, 200, {
+				ok: true,
+				activeSessions: sessions.size,
+				historySize: history.length,
+				executablePath
+			});
+			return;
+		}
+		if (url.pathname === "/v1/connectDevtools") {
+			res.writeHead(426, { "Content-Type": "text/plain" });
+			res.end("WebSocket upgrade required");
+			return;
+		}
+		res.writeHead(404, { "Content-Type": "text/plain" });
+		res.end("Not found");
+	}
+	/**
+	* Read request body as string
+	*/
+	function readBody(req) {
+		return new Promise((resolve, reject) => {
+			const chunks = [];
+			let totalBytes = 0;
+			req.on("data", (chunk) => {
+				totalBytes += chunk.length;
+				if (totalBytes > maxRequestBodyBytes) {
+					req.destroy();
+					reject(/* @__PURE__ */ new Error(`Request body exceeds ${maxRequestBodyBytes} bytes`));
+					return;
+				}
+				chunks.push(chunk);
+			});
+			req.on("end", () => resolve(Buffer.concat(chunks).toString()));
+			req.on("error", reject);
+		});
+	}
+	/**
+	* Send JSON response
+	*/
+	function sendJson(res, status, data) {
+		const body = JSON.stringify(data);
+		res.writeHead(status, {
+			"Content-Type": "application/json",
+			"Content-Length": Buffer.byteLength(body)
+		});
+		res.end(body);
+	}
+	/**
+	* Start the browser shim server
+	*/
+	async function start() {
+		logger?.info("[BrowserShim] Ensuring Chrome Headless Shell is available...");
+		executablePath = await ensureChrome(cacheDir, logger);
+		try {
+			const wsModule = await import("ws");
+			WebSocketServerClass = wsModule.WebSocketServer || wsModule.default?.WebSocketServer;
+			WebSocketClass = wsModule.WebSocket || wsModule.default?.WebSocket || wsModule.default;
+		} catch {
+			logger?.warn("[BrowserShim] ws package not found, WebSocket proxy disabled");
+			logger?.warn("[BrowserShim] Install with: npm install ws");
+		}
+		server = createServer((req, res) => {
+			handleRequest(req, res).catch((error) => {
+				logger?.error("[BrowserShim] Request error:", error);
+				res.writeHead(500);
+				res.end("Internal server error");
+			});
+		});
+		if (WebSocketServerClass) {
+			const wss = new WebSocketServerClass({ noServer: true });
+			server.on("upgrade", (request, socket, head) => {
+				const origin = getRequestOrigin(request);
+				if (origin && !isLoopbackOrigin(origin)) {
+					socket.write("HTTP/1.1 403 Forbidden\r\n\r\n");
+					socket.destroy();
+					return;
+				}
+				const url = new URL(request.url || "/", `http://${host}:${port}`);
+				if (url.pathname !== "/v1/connectDevtools") {
+					socket.destroy();
+					return;
+				}
+				const sessionId = url.searchParams.get("browser_session");
+				if (!sessionId) {
+					socket.write("HTTP/1.1 400 Bad Request\r\n\r\n");
+					socket.destroy();
+					return;
+				}
+				const session = sessions.get(sessionId);
+				if (!session) {
+					socket.write("HTTP/1.1 404 Not Found\r\n\r\n");
+					socket.destroy();
+					return;
+				}
+				const connectionId = crypto.randomUUID();
+				session.connectionId = connectionId;
+				session.connectionStartTime = Date.now();
+				if (session.idleTimeout) {
+					clearTimeout(session.idleTimeout);
+					session.idleTimeout = void 0;
+				}
+				wss.handleUpgrade(request, socket, head, (ws) => {
+					if (verbose) logger?.debug(`[BrowserShim] WebSocket connected for session ${sessionId}`);
+					const chromeWs = new WebSocketClass(session.wsEndpoint);
+					let chromeConnected = false;
+					const connectTimeout = setTimeout(() => {
+						if (!chromeConnected) {
+							logger?.error("[BrowserShim] Chrome connection timeout");
+							try {
+								ws.close(1011, "Chrome connection timeout");
+								chromeWs.close();
+							} catch {}
+							closeSession(sessionId, 5, "ChromeConnectionTimeout").catch(() => {});
+						}
+					}, 1e4);
+					chromeWs.on("open", () => {
+						chromeConnected = true;
+						clearTimeout(connectTimeout);
+						if (verbose) logger?.debug("[BrowserShim] Connected to Chrome DevTools");
+					});
+					chromeWs.on("message", (data) => {
+						if (ws.readyState === 1) ws.send(data);
+					});
+					chromeWs.on("close", (code, reason) => {
+						if (verbose) logger?.debug(`[BrowserShim] Chrome WS closed: ${code}`);
+						const validCode = typeof code === "number" && code >= 1e3 && code <= 4999 ? code : 1e3;
+						try {
+							ws.close(validCode, reason?.toString?.() || "");
+						} catch {}
+						closeSession(sessionId, 2, "ChromeDisconnected").catch((err) => {
+							logger?.error("[BrowserShim] Error closing session after Chrome disconnect:", err);
+						});
+					});
+					chromeWs.on("error", (error) => {
+						logger?.error("[BrowserShim] Chrome WS error:", error.message);
+						try {
+							ws.close(1011, "Chrome WebSocket error");
+						} catch {}
+						closeSession(sessionId, 4, "ChromeError").catch((err) => {
+							logger?.error("[BrowserShim] Error closing session after Chrome error:", err);
+						});
+					});
+					ws.on("message", (data) => {
+						if (chromeWs.readyState === 1) chromeWs.send(data);
+					});
+					ws.on("close", (code, reason) => {
+						if (verbose) logger?.debug(`[BrowserShim] Client WS closed for session ${sessionId}`);
+						const validCode = typeof code === "number" && code >= 1e3 && code <= 4999 ? code : 1e3;
+						try {
+							chromeWs.close(validCode, reason?.toString?.() || "");
+						} catch {}
+						const s = sessions.get(sessionId);
+						if (s && s.connectionId === connectionId) {
+							s.connectionId = void 0;
+							s.connectionStartTime = void 0;
+							closeSession(sessionId, 1, "ClientDisconnected").catch((err) => {
+								logger?.error("[BrowserShim] Error closing session after disconnect:", err);
+							});
+						}
+					});
+					ws.on("error", (error) => {
+						logger?.error("[BrowserShim] Client WS error:", error.message);
+						try {
+							chromeWs.close();
+						} catch {}
+					});
+				});
+			});
+		}
+		await new Promise((resolve, reject) => {
+			server.on("error", reject);
+			server.listen(port, host, () => {
+				resolve();
+			});
+		});
+		logger?.success(`Browser shim server ready on http://${host}:${port}`);
+	}
+	/**
+	* Stop the server and close all browsers
+	*/
+	async function stop() {
+		for (const sessionId of Array.from(sessions.keys())) await closeSession(sessionId, 3, "ServerShutdown");
+		if (server) {
+			await new Promise((resolve) => {
+				server.close(() => resolve());
+			});
+			server = null;
+		}
+		logger?.info("Browser shim server stopped");
+	}
+	/**
+	* Get the server URL
+	*/
+	function getUrl() {
+		return `http://${host}:${port}`;
+	}
+	return {
+		start,
+		stop,
+		getUrl
+	};
+}
+//#endregion
+//#region src/dev-server/server-startup-helpers.ts
+/**
+* Emit informational/warning lines about detected worker handlers in
+* worker-only (no-Vite) mode.
+*/
+function logWorkerHandlerDetection(logger, enableVite, hasSurface, mainWorkerSurfacePaths, mainWorkerRoutes) {
+	if (enableVite) return;
+	if (hasSurface) {
+		const detectedWorkerHandlers = Object.entries(mainWorkerSurfacePaths).filter(([, surfacePath]) => !!surfacePath).map(([surfaceName, surfacePath]) => `${surfaceName}=${surfacePath}`);
+		const detectedRouteHandlers = mainWorkerRoutes?.routes.map((route) => `route=${route.filePath}`) ?? [];
+		logger?.info(`Worker handlers detected: ${[...detectedWorkerHandlers, ...detectedRouteHandlers].join(", ")}`);
+	} else logger?.warn("No local worker handler entry was found for worker-only mode");
+}
+/**
+* Emit warnings about remote-only bindings (AI, Vectorize) and any missing
+* prerequisites (accountId, wrangler login).
+*/
+function logRemoteBindingRequirements(logger, remoteCheck) {
+	if (!remoteCheck.hasRemoteBindings) return;
+	logger?.info("");
+	logger?.warn("⚠️  Remote-only bindings detected:");
+	for (const binding of remoteCheck.remoteBindings) logger?.warn(`   • ${binding}`);
+	logger?.info("");
+	if (remoteCheck.missingAccountId) {
+		logger?.warn("⚠️  WARN: accountId is not set in devflare.config.ts");
+		logger?.warn("   Remote bindings (AI, Vectorize) require accountId to charge the correct account.");
+		logger?.warn("   Add: accountId: 'your-cloudflare-account-id'");
+		logger?.info("");
+	}
+	if (remoteCheck.notLoggedIn) {
+		logger?.warn("⚠️  WARN: Not logged in to Wrangler");
+		logger?.warn("   Remote bindings require authentication.");
+		logger?.warn("   Run: bunx wrangler login");
+		logger?.info("");
+	}
+	if (!remoteCheck.missingAccountId && !remoteCheck.notLoggedIn) {
+		logger?.success("✓ Remote binding requirements met");
+		logger?.info("");
+	}
+}
+function formatErrorMessage(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+/**
+* Resolve the path to watch for config changes. Prefers an explicit
+* `configPath` if it's directly accessible on disk, otherwise falls back to
+* the auto-discovered config path under `cwd`. Returns `null` when neither
+* is available.
+*/
+async function resolveWorkerConfigWatchPath(cwd, configPath) {
+	if (configPath) {
+		const explicitPath = resolve(cwd, configPath);
+		const fs = await import("node:fs/promises");
+		try {
+			await fs.access(explicitPath);
+			return explicitPath;
+		} catch {}
+	}
+	return await resolveConfigPath(cwd) ?? null;
+}
+/**
+* Pretty-print the resolved Miniflare config (truncating long inline scripts)
+* before `Miniflare` is constructed. Only emits when verbose/debug logging is
+* requested by the caller.
+*/
+function logMiniflareConfigDiagnostics(logger, mfConfig) {
+	logger?.info("=== MINIFLARE CONFIG DEBUG ===");
+	logger?.info("Full config:", JSON.stringify(mfConfig, (key, value) => {
+		if (key === "script" && typeof value === "string" && value.length > 200) return value.substring(0, 200) + "...[truncated]";
+		return value;
+	}, 2));
+	if (mfConfig.workers) {
+		logger?.info("Workers order:");
+		for (const w of mfConfig.workers) {
+			logger?.info(`  → ${w.name}:`);
+			logger?.info(`      script: ${w.script ? "inline" : w.scriptPath}`);
+			logger?.info(`      browserRendering: ${JSON.stringify(w.browserRendering)}`);
+			logger?.info(`      durableObjects: ${JSON.stringify(w.durableObjects)}`);
+		}
+	}
+}
+/**
+* After `Miniflare` is `ready`, query each declared worker's bindings and
+* log them. Best-effort: any per-worker failure is logged at debug and does
+* not abort the rest of the diagnostics.
+*/
+async function logMiniflareBindingDiagnostics(logger, miniflare, mfConfig) {
+	try {
+		const gatewayBindings = await miniflare.getBindings("gateway");
+		logger?.info("Gateway worker bindings:", Object.keys(gatewayBindings));
+		if (mfConfig.workers) {
+			for (const w of mfConfig.workers) if (w.name !== "gateway") try {
+				const doBindings = await miniflare.getBindings(w.name);
+				logger?.info(`${w.name} worker bindings:`, Object.keys(doBindings));
+				if ("BROWSER" in doBindings) logger?.success(`${w.name} has BROWSER binding!`);
+				else logger?.warn(`${w.name} is MISSING BROWSER binding`);
+			} catch (error) {
+				logger?.debug(`Skipping binding diagnostics for ${w.name}: ${formatErrorMessage(error)}`);
+			}
+		}
+	} catch (error) {
+		logger?.debug(`Skipping Miniflare binding diagnostics: ${formatErrorMessage(error)}`);
+	}
+}
+/**
+* If the config declares a single browser-rendering binding, construct and
+* start a `BrowserShim` listening on `browserShimPort`. Returns `null` when
+* no browser binding is configured (no shim needed).
+*/
+async function maybeStartBrowserShim(config, options) {
+	const browserBinding = getSingleBrowserBindingName(config.bindings?.browser);
+	if (!browserBinding) return null;
+	options.logger?.info(`Starting Browser Rendering shim (binding: ${browserBinding})...`);
+	const shim = createBrowserShim({
+		port: options.browserShimPort,
+		host: "127.0.0.1",
+		logger: options.logger,
+		verbose: options.verbose
+	});
+	await shim.start();
+	return shim;
+}
+/**
+* If the config declares a `files.durableObjects` glob, construct a
+* `DOBundler`, run an initial build, and start watching. Returns
+* `{ bundler, result }` (`{ null, null }` when no DO pattern is configured).
+* The `onRebuild` callback fires on each subsequent rebuild — typically used
+* to schedule a Miniflare reload.
+*/
+async function maybeStartDOBundler(config, options) {
+	const doPattern = config.files?.durableObjects;
+	if (typeof doPattern !== "string" || !doPattern) return {
+		bundler: null,
+		result: null
+	};
+	const outDir = resolve(options.cwd, ".devflare/do-bundles");
+	const bundler = createDOBundler({
+		cwd: options.cwd,
+		pattern: doPattern,
+		outDir,
+		rolldownOptions: config.rolldown?.options,
+		sourcemap: config.rolldown?.sourcemap,
+		minify: config.rolldown?.minify,
+		logger: options.logger,
+		onRebuild: options.onRebuild
+	});
+	const result = await bundler.build();
+	await bundler.watch();
+	return {
+		bundler,
+		result
+	};
+}
+/**
+* Resolve whether Vite should run for this package, and if so, write the
+* generated Vite config under `.devflare/`. Returns:
+*   - `{ enableVite: false, generatedViteConfigPath: null }` when Vite is
+*     not requested or no Vite config exists for this package
+*   - `{ enableVite: true, generatedViteConfigPath }` after writing the
+*     generated config
+*/
+async function resolveViteIntegration(options) {
+	if (!options.enableViteRequested) return {
+		enableVite: false,
+		generatedViteConfigPath: null
+	};
+	const viteMode = await resolveViteMode(options.cwd, { requested: true });
+	if (!viteMode.enableVite) {
+		options.logger?.info("Vite disabled: no vite config found for this package");
+		return {
+			enableVite: false,
+			generatedViteConfigPath: null
+		};
+	}
+	const generatedViteConfigPath = await writeGeneratedViteConfig({
+		cwd: options.cwd,
+		configPath: options.configPath,
+		localConfigPath: viteMode.viteConfigPath,
+		bridgePort: options.miniflarePort
+	});
+	options.logger?.debug(`Generated Vite config → ${generatedViteConfigPath}`);
+	return {
+		enableVite: true,
+		generatedViteConfigPath
+	};
+}
+//#endregion
+//#region src/dev-server/vite-process.ts
+/**
+* Start the Vite dev server process.
+*/
+async function startViteProcess(options) {
+	const { cwd, configPath, vitePort, miniflarePort, generatedViteConfigPath, r2Presign, logger } = options;
+	const args = [
+		"vite",
+		"dev",
+		"--port",
+		String(vitePort)
+	];
+	if (generatedViteConfigPath) args.push("--config", generatedViteConfigPath);
+	const viteProcess = spawn("bunx", args, {
+		cwd,
+		stdio: [
+			"inherit",
+			"pipe",
+			"pipe"
+		],
+		windowsHide: true,
+		env: {
+			...process.env,
+			DEVFLARE_DEV: "true",
+			DEVFLARE_BRIDGE_PORT: String(miniflarePort),
+			...configPath ? { DEVFLARE_CONFIG_PATH: configPath } : {},
+			...r2Presign ? {
+				DEVFLARE_R2_PRESIGN_SECRET: r2Presign.secret,
+				DEVFLARE_R2_PRESIGN_ORIGIN: r2Presign.origin
+			} : {},
+			FORCE_COLOR: "1"
+		}
+	});
+	const readyUrl = await waitForViteReady(viteProcess, {
+		onStdout(chunk) {
+			process.stdout.write(chunk);
+		},
+		onStderr(chunk) {
+			process.stderr.write(chunk);
+		}
+	});
+	if (readyUrl) {
+		logger?.success(`Vite dev server started on ${readyUrl}`);
+		return viteProcess;
+	}
+	logger?.warn("Vite process started, but the final local URL could not be confirmed yet");
+	return viteProcess;
+}
+//#endregion
+export { createMiniflareLog as _, logWorkerHandlerDetection as a, resolveViteIntegration as c, createRuntimeStdioForwarder as d, buildMiniflareDevConfig as f, runD1Migrations as g, resolveMainWorkerSurfacePaths as h, logRemoteBindingRequirements as i, resolveWorkerConfigWatchPath as l, collectWorkerWatchRoots as m, logMiniflareBindingDiagnostics as n, maybeStartBrowserShim as o, resolveR2PresignOrigin as p, logMiniflareConfigDiagnostics as r, maybeStartDOBundler as s, startViteProcess as t, createBrowserShim as u, createDOBundler as v };