devflare 1.0.0-next.7 → 1.0.0-next.70

package/dist/runtime/middleware.d.ts

@@ -1,82 +1,134 @@
+import { type FetchEvent } from './context.js';
+type AnyFunction = (...args: any[]) => any;
+type FetchModule = Record<string, unknown>;
 /**
- * A function that handles a request and returns a Response
- * Can return null to indicate "pass through" to next handler
+ * Promise-or-value helper used by worker-safe runtime APIs.
  */
-export type Handler = () => Promise<Response | null>;
+export type Awaitable<T> = T | Promise<T>;
 /**
- * Middleware function that wraps a handler
+ * Resolve the next request-wide middleware or module-local leaf handler.
  *
- * @param next - Call this to continue to the next middleware/handler
- * @returns Response from the middleware or the wrapped handler
+ * Passing a new event mirrors SvelteKit's `resolve(event)` pattern and lets
+ * middleware continue the chain with a modified request context.
+ */
+export type ResolveFetch<TEvent extends FetchEvent = FetchEvent> = (event?: TEvent) => Promise<Response>;
+/**
+ * Request-wide fetch middleware.
+ *
+ * These are intended for the single module-level fetch entry export such as:
+ * - `export const fetch = sequence(corsHandle, appFetch)`
+ * - `export const handle = sequence(corsHandle, appFetch)`
+ *
+ * `fetch` and `handle` are aliases for the same primary fetch entry, so a
+ * module should export one or the other, not both.
+ */
+export type FetchMiddleware<TEvent extends FetchEvent = FetchEvent> = (event: TEvent, resolve: ResolveFetch<TEvent>) => Awaitable<Response>;
+interface FetchResolveOptions<TEvent extends FetchEvent> {
+    fallbackResolve?: ResolveFetch<TEvent>;
+}
+/**
+ * Tag a handler as resolve-style: `(event, resolve) => Response`.
+ *
+ * Attaches `FETCH_RESOLVE_STYLE_SYMBOL` so detection survives minification
+ * (which rewrites parameter names and function source output).
+ */
+export declare function markResolveStyle<T extends AnyFunction>(handler: T): T;
+/**
+ * Tag a handler as worker-style: `(request, env)` or `(request, env, ctx)`.
  *
- * @example
- * ```ts
- * const authMiddleware: Middleware = async (next) => {
- *   const token = event.request?.headers.get('Authorization')
- *   if (!token) {
- *     return new Response('Unauthorized', { status: 401 })
- *   }
- *   locals.user = await validateToken(token)
- *   return next()
- * }
- * ```
- */
-export type Middleware = (next: () => Promise<Response>) => Promise<Response>;
-/**
- * Composes multiple middlewares into a single function
+ * Required for 2-argument worker-style handlers because devflare can no
+ * longer disambiguate `(event, resolve)` vs `(request, env)` from arity
+ * alone — the parameter-name fallback was removed in R1-strict.
+ */
+export declare function markWorkerStyle<T extends AnyFunction>(handler: T): T;
+/**
+ * Explicit escape hatch for declaring a handler's calling convention.
  *
- * Middlewares execute in the order provided:
- * - Before next(): runs on the way "in"
- * - After next(): runs on the way "out"
+ * - `options.style === 'resolve'` marks the handler so it is dispatched as
+ *   `(event, resolve) => Response`.
+ * - `options.style === 'worker'` marks the handler so it is dispatched as
+ *   `(request, env[, ctx]) => Response`.
  *
- * @param middlewares - Array of middleware functions to compose
- * @returns A function that accepts a handler and returns a composed handler
+ * The marker is required for 2-argument handlers; 1-arg `(event)` and
+ * 3-arg `(request, env, ctx)` handlers do not need to be wrapped.
+ */
+export declare function defineFetchHandler<T extends AnyFunction>(handler: T, options?: {
+    style?: 'resolve' | 'worker';
+}): T;
+/**
+ * Throw a clear error for ambiguous unmarked 2-argument fetch handlers.
  *
- * @example
- * ```ts
- * const handler = sequence(
- *   corsMiddleware,
- *   authMiddleware,
- *   loggingMiddleware
- * )(myHandler)
- * ```
- */
-export declare function sequence(...middlewares: Middleware[]): (handler: Handler) => Handler;
-/**
- * Chains multiple handlers, trying each until one returns a Response
+ * In R1-strict, devflare no longer guesses the calling convention from
+ * parameter names. 2-arg handlers must be marked with
+ * `defineFetchHandler(fn, { style: 'resolve' | 'worker' })` (or wrapped via
+ * `markResolveStyle` / `markWorkerStyle` / `sequence(...)`) so dispatch is
+ * unambiguous and minification-safe.
+ */
+export declare function assertExplicit2ArgStyle(handler: AnyFunction): void;
+/**
+ * Tag a queue handler as worker-style: `(batch, env)` or `(batch, env, ctx)`.
  *
- * Handlers are tried in order. The first handler to return a non-null
- * Response wins. If all handlers return null, resolve() returns null.
+ * Required for 2-argument worker-style queue handlers because devflare can
+ * no longer disambiguate `(event)` vs `(batch, env)` from arity alone in
+ * R1-strict.
+ */
+export declare function defineQueueHandler<T extends AnyFunction>(handler: T): T;
+/**
+ * Tag a scheduled handler as worker-style: `(controller, env)` or
+ * `(controller, env, ctx)`.
+ */
+export declare function defineScheduledHandler<T extends AnyFunction>(handler: T): T;
+/**
+ * Throw a clear error for ambiguous unmarked 2-argument queue handlers.
  *
- * @param handlers - Array of handler functions to try
- * @returns A combined handler
+ * Mirrors `assertExplicit2ArgStyle` for the queue surface. 2-arg handlers
+ * must be wrapped with `defineQueueHandler(fn)` so dispatch is unambiguous
+ * and minification-safe; 1-arg `(event)` and 3-arg `(batch, env, ctx)` do
+ * not require wrapping.
+ */
+export declare function assertExplicitQueueHandlerStyle(handler: AnyFunction): void;
+/**
+ * Throw a clear error for ambiguous unmarked 2-argument scheduled handlers.
+ */
+export declare function assertExplicitScheduledHandlerStyle(handler: AnyFunction): void;
+/**
+ * Compose request-wide middleware into a single fetch surface.
+ */
+export declare function sequence<TEvent extends FetchEvent = FetchEvent>(...middlewares: FetchMiddleware<TEvent>[]): FetchMiddleware<TEvent>;
+/**
+ * Resolve the primary fetch surface for a module.
  *
- * @example
- * ```ts
- * const handler = resolve(
- *   staticFileHandler,   // Returns null if not a static file
- *   apiHandler,          // Returns null if not an API route
- *   notFoundHandler      // Fallback - always returns Response
- * )
- * ```
- */
-export declare function resolve(...handlers: Handler[]): Handler;
-/**
- * Creates a handler that applies middleware before running resolve
+ * `fetch` and `handle` are treated as aliases for the same primary fetch
+ * entry. Exporting more than one primary entry from the same module is
+ * rejected as ambiguous.
+ */
+export declare function resolveFetchHandler(module: FetchModule): AnyFunction | null;
+/**
+ * Invoke a fetch entry handler with the supported calling conventions.
  *
- * Convenience function combining sequence() and resolve()
+ * This supports:
+ * - `fetch(request)`
+ * - `fetch(request, env)`
+ * - `fetch(request, env, ctx)`
+ * - `fetch(event)`
+ * - `fetch(event, resolve)` / `handle(event, resolve)`
+ */
+export declare function invokeFetchHandler<TEvent extends FetchEvent>(handler: unknown, event: TEvent, resolve?: ResolveFetch<TEvent>): Promise<Response>;
+/**
+ * Create a SvelteKit-style `resolve(event)` callback for a fetch module.
  *
- * @param middlewares - Middlewares to apply
- * @param handlers - Handlers to resolve
- * @returns A composed handler
+ * Resolution order is:
+ * - matching HTTP method export such as `GET()` / `POST()` / `ALL()`
+ * - 404 response
+ */
+export declare function createResolveFetch<TEvent extends FetchEvent>(module: FetchModule, _currentEntry: unknown, initialEvent: TEvent, options?: FetchResolveOptions<TEvent>): ResolveFetch<TEvent>;
+/**
+ * Invoke the resolved fetch surface for a module.
  *
- * @example
- * ```ts
- * const handler = pipe(
- *   [authMiddleware, loggingMiddleware],
- *   [apiHandler, staticHandler, fallbackHandler]
- * )
- * ```
- */
-export declare function pipe(middlewares: Middleware[], handlers: Handler[]): Handler;
+ * This lets runtime wrappers support a single request-wide `handle` or
+ * `fetch` export, default exports, and same-module method handlers such as
+ * `GET()`.
+ */
+export declare function invokeFetchModule<TEvent extends FetchEvent>(module: FetchModule, event: TEvent, fallbackResolve?: ResolveFetch<TEvent>): Promise<Response>;
+export {};
 //# sourceMappingURL=middleware.d.ts.map

package/dist/runtime/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/runtime/middleware.ts"],"names":[],"mappings":"AAMA;;;GAGG;AACH,MAAM,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAA;AAEpD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,IAAI,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;AAE7E;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,QAAQ,CAAC,GAAG,WAAW,EAAE,UAAU,EAAE,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CA+BpF;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,OAAO,CAAC,GAAG,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAUvD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,IAAI,CACnB,WAAW,EAAE,UAAU,EAAE,EACzB,QAAQ,EAAE,OAAO,EAAE,GACjB,OAAO,CAET"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/runtime/middleware.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,KAAK,UAAU,EAAuB,MAAM,WAAW,CAAA;AAEhE,KAAK,WAAW,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAA;AAC1C,KAAK,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAQ1C;;GAEG;AACH,MAAM,MAAM,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;AAEzC;;;;;GAKG;AACH,MAAM,MAAM,YAAY,CAAC,MAAM,SAAS,UAAU,GAAG,UAAU,IAAI,CAClE,KAAK,CAAC,EAAE,MAAM,KACV,OAAO,CAAC,QAAQ,CAAC,CAAA;AAEtB;;;;;;;;;GASG;AACH,MAAM,MAAM,eAAe,CAAC,MAAM,SAAS,UAAU,GAAG,UAAU,IAAI,CACrE,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,YAAY,CAAC,MAAM,CAAC,KACzB,SAAS,CAAC,QAAQ,CAAC,CAAA;AAExB,UAAU,mBAAmB,CAAC,MAAM,SAAS,UAAU;IACtD,eAAe,CAAC,EAAE,YAAY,CAAC,MAAM,CAAC,CAAA;CACtC;AAUD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,SAAS,WAAW,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,CASrE;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,WAAW,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,CASpE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,SAAS,WAAW,EACvD,OAAO,EAAE,CAAC,EACV,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAA;CAAE,GACxC,CAAC,CAUH;AAwBD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,WAAW,GAAG,IAAI,CAgBlE;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,SAAS,WAAW,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,CASvE;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,CAAC,SAAS,WAAW,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,CAS3E;AAYD;;;;;;;GAOG;AACH,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,WAAW,GAAG,IAAI,CAc1E;AAED;;GAEG;AACH,wBAAgB,mCAAmC,CAAC,OAAO,EAAE,WAAW,GAAG,IAAI,CAc9E;AA2ED;;GAEG;AACH,wBAAgB,QAAQ,CAAC,MAAM,SAAS,UAAU,GAAG,UAAU,EAC9D,GAAG,WAAW,EAAE,eAAe,CAAC,MAAM,CAAC,EAAE,GACvC,eAAe,CAAC,MAAM,CAAC,CAWzB;AAuID;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,WAAW,GAAG,WAAW,GAAG,IAAI,CAI3E;AAED;;;;;;;;;GASG;AACH,wBAAsB,kBAAkB,CAAC,MAAM,SAAS,UAAU,EACjE,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,YAAY,CAAC,MAAM,CAAwC,GAClE,OAAO,CAAC,QAAQ,CAAC,CAkBnB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,SAAS,UAAU,EAC3D,MAAM,EAAE,WAAW,EACnB,aAAa,EAAE,OAAO,EACtB,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE,mBAAmB,CAAC,MAAM,CAAM,GACvC,YAAY,CAAC,MAAM,CAAC,CAsBtB;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,SAAS,UAAU,EAChE,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,MAAM,EACb,eAAe,CAAC,EAAE,YAAY,CAAC,MAAM,CAAC,GACpC,OAAO,CAAC,QAAQ,CAAC,CAYnB"}

package/dist/runtime/r2-presign.d.ts

@@ -0,0 +1,164 @@
+/** URL path prefix of the local presign endpoint served by devflare gateways. */
+export declare const R2_PRESIGN_LOCAL_PATH_PREFIX = "/_devflare/r2/presigned/";
+/** Env/var names devflare injects in local dev + tests to enable local presigning. */
+export declare const R2_PRESIGN_SECRET_VAR = "DEVFLARE_R2_PRESIGN_SECRET";
+export declare const R2_PRESIGN_ORIGIN_VAR = "DEVFLARE_R2_PRESIGN_ORIGIN";
+/** Var (injected at deploy compile time) mapping R2 binding names to bucket metadata. */
+export declare const R2_BUCKETS_VAR = "DEVFLARE_R2_BUCKETS";
+/** Default env/secret names for R2 S3 API credentials in production. */
+export declare const R2_ACCOUNT_ID_VAR = "R2_ACCOUNT_ID";
+export declare const R2_ACCESS_KEY_ID_VAR = "R2_ACCESS_KEY_ID";
+export declare const R2_SECRET_ACCESS_KEY_VAR = "R2_SECRET_ACCESS_KEY";
+/**
+ * R2 S3 API credentials used for production presigning.
+ * Create them under Cloudflare Dashboard → R2 → Manage R2 API Tokens.
+ */
+export interface R2PresignCredentials {
+    /** Cloudflare account id that owns the bucket (not secret). */
+    accountId: string;
+    /** R2 S3 API access key id. */
+    accessKeyId: string;
+    /** R2 S3 API secret access key. Store as a Worker secret, never in config. */
+    secretAccessKey: string;
+}
+/**
+ * Options shared by `presignR2Put` and `presignR2Get`.
+ */
+export interface R2PresignBaseOptions {
+    /**
+     * URL lifetime in seconds. Enforced by R2 in production and by the
+     * devflare gateway locally.
+     *
+     * @default 900 (15 minutes). Maximum 604800 (7 days).
+     */
+    expiresIn?: number;
+    /**
+     * Production credentials override. When omitted they are read from `env`
+     * under `R2_ACCOUNT_ID`, `R2_ACCESS_KEY_ID` and `R2_SECRET_ACCESS_KEY`.
+     * Ignored in local dev (the gateway signs with its own per-boot secret).
+     */
+    credentials?: R2PresignCredentials;
+    /**
+     * Production bucket name override. When omitted it is resolved from the
+     * `DEVFLARE_R2_BUCKETS` var that `devflare` injects at deploy compile
+     * time from `bindings.r2`. Ignored in local dev (the binding name routes
+     * directly to the local bucket).
+     */
+    bucketName?: string;
+    /**
+     * Jurisdiction of the production bucket (e.g. `'eu'`), which changes the
+     * S3 endpoint host. When omitted it is resolved from `DEVFLARE_R2_BUCKETS`
+     * (i.e. from the `jurisdiction` field on the R2 binding config).
+     */
+    jurisdiction?: string;
+}
+/**
+ * Options for `presignR2Put`.
+ */
+export interface R2PresignPutOptions extends R2PresignBaseOptions {
+    /**
+     * Content type the uploader must send. Enforced cryptographically in both
+     * environments: it is a signed header in production and part of the
+     * signed canonical string locally, so a mismatching `Content-Type` on the
+     * actual PUT is rejected.
+     */
+    contentType?: string;
+    /**
+     * Exact body size in bytes the uploader must send. Enforced in both
+     * environments (signed `Content-Length` header in production; header +
+     * actual byte count locally). Prefer this over `maxSizeBytes` when the
+     * file size is known up front — it is the only size guarantee real R2
+     * presigned PUTs can enforce. GOTCHA: the client must then send a
+     * fixed-size body (`File`/`Blob`/`ArrayBuffer`); a streamed body carries
+     * no `Content-Length` header and fails the signed-header check.
+     */
+    contentLength?: number;
+    /**
+     * Upper size bound in bytes. Enforced by the devflare gateway locally.
+     * GOTCHA: real R2 presigned PUT URLs CANNOT enforce an upper bound —
+     * only an exact signed `Content-Length` — so in production this value is
+     * advisory. Always confirm the object with a server-side `head()` before
+     * committing quota.
+     */
+    maxSizeBytes?: number;
+}
+/**
+ * Options for `presignR2Get`.
+ */
+export type R2PresignGetOptions = R2PresignBaseOptions;
+/**
+ * A presigned request the browser can execute directly against storage.
+ */
+export interface PresignedR2Request {
+    /** Fully-signed URL to fetch. Treat as opaque; it embeds the signature. */
+    url: string;
+    /** HTTP method the URL was signed for (`HEAD` is also accepted for `GET` URLs). */
+    method: 'PUT' | 'GET';
+    /**
+     * Headers the client MUST send for the signature to validate (e.g. the
+     * pinned `content-type`). `content-length` is intentionally omitted —
+     * browsers set it automatically from the request body and reject manual
+     * assignment.
+     */
+    headers: Record<string, string>;
+    /** Moment the URL stops being accepted. */
+    expiresAt: Date;
+    /** Object key the URL operates on. */
+    key: string;
+    /** `'local'` when served by the devflare gateway, `'remote'` for real R2. */
+    mode: 'local' | 'remote';
+}
+/**
+ * Presign a direct-to-R2 `PUT` URL for a browser (or any HTTP client) upload.
+ *
+ * Resolves to a real R2 S3 presigned URL in production and to a signed
+ * devflare-gateway URL in local dev and the test harness — same call, same
+ * guarantees (signature, expiry, method, content type, size), so upload and
+ * quota logic can be exercised identically in every environment.
+ *
+ * @param env - The platform env (`platform.env` in SvelteKit, `env` in a
+ * Worker handler). Used to detect the local dev context and to read
+ * production credentials/bucket mapping.
+ * @param binding - The R2 binding name from `bindings.r2` (e.g. `'BUCKET'`).
+ * @param key - Object key to upload to. Percent-encoding is handled internally.
+ * @param options - Expiry, enforcement (content type / length / max size) and
+ * production credential overrides.
+ * @returns The presigned request: `url` to PUT to, `headers` the client must
+ * send, and `expiresAt`.
+ * @throws {Error} in production when credentials or the bucket mapping are missing.
+ * @throws {TypeError | RangeError} on invalid inputs.
+ *
+ * @example
+ * ```ts
+ * // Server (SvelteKit endpoint) — reserve quota first, then presign:
+ * const { url, headers } = await presignR2Put(platform.env, 'BUCKET', `media/${id}.png`, {
+ *   expiresIn: 600,
+ *   contentType: file.type,
+ *   contentLength: file.size
+ * })
+ *
+ * // Browser — upload directly to storage:
+ * await fetch(url, { method: 'PUT', body: file, headers })
+ *
+ * // Server — finalize: confirm the object before committing quota:
+ * const head = await platform.env.BUCKET.head(`media/${id}.png`)
+ * ```
+ */
+export declare function presignR2Put(env: Record<string, unknown>, binding: string, key: string, options?: R2PresignPutOptions): Promise<PresignedR2Request>;
+/**
+ * Presign a direct-from-R2 `GET` URL (also valid for `HEAD`) so a browser can
+ * download an object without routing the bytes through the Worker.
+ *
+ * Same dev/prod symmetry as {@link presignR2Put}. Note that browser reads
+ * from real R2 additionally require CORS rules on the bucket itself.
+ *
+ * @param env - The platform env (see {@link presignR2Put}).
+ * @param binding - The R2 binding name from `bindings.r2`.
+ * @param key - Object key to read.
+ * @param options - Expiry and production credential overrides.
+ * @returns The presigned request; `headers` is always empty for GET.
+ * @throws {Error} in production when credentials or the bucket mapping are missing.
+ * @throws {TypeError | RangeError} on invalid inputs.
+ */
+export declare function presignR2Get(env: Record<string, unknown>, binding: string, key: string, options?: R2PresignGetOptions): Promise<PresignedR2Request>;
+//# sourceMappingURL=r2-presign.d.ts.map

package/dist/runtime/r2-presign.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"r2-presign.d.ts","sourceRoot":"","sources":["../../src/runtime/r2-presign.ts"],"names":[],"mappings":"AAuBA,iFAAiF;AACjF,eAAO,MAAM,4BAA4B,6BAA6B,CAAA;AAKtE,sFAAsF;AACtF,eAAO,MAAM,qBAAqB,+BAA+B,CAAA;AACjE,eAAO,MAAM,qBAAqB,+BAA+B,CAAA;AAEjE,yFAAyF;AACzF,eAAO,MAAM,cAAc,wBAAwB,CAAA;AAEnD,wEAAwE;AACxE,eAAO,MAAM,iBAAiB,kBAAkB,CAAA;AAChD,eAAO,MAAM,oBAAoB,qBAAqB,CAAA;AACtD,eAAO,MAAM,wBAAwB,yBAAyB,CAAA;AAY9D;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACpC,+DAA+D;IAC/D,SAAS,EAAE,MAAM,CAAA;IACjB,+BAA+B;IAC/B,WAAW,EAAE,MAAM,CAAA;IACnB,8EAA8E;IAC9E,eAAe,EAAE,MAAM,CAAA;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACpC;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAElB;;;;OAIG;IACH,WAAW,CAAC,EAAE,oBAAoB,CAAA;IAElC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IAEnB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAoB,SAAQ,oBAAoB;IAChE;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IAEpB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IAEtB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;CACrB;AAED;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG,oBAAoB,CAAA;AAEtD;;GAEG;AACH,MAAM,WAAW,kBAAkB;IAClC,2EAA2E;IAC3E,GAAG,EAAE,MAAM,CAAA;IACX,mFAAmF;IACnF,MAAM,EAAE,KAAK,GAAG,KAAK,CAAA;IACrB;;;;;OAKG;IACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B,2CAA2C;IAC3C,SAAS,EAAE,IAAI,CAAA;IACf,sCAAsC;IACtC,GAAG,EAAE,MAAM,CAAA;IACX,6EAA6E;IAC7E,IAAI,EAAE,OAAO,GAAG,QAAQ,CAAA;CACxB;AAqYD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAsB,YAAY,CACjC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,mBAAwB,GAC/B,OAAO,CAAC,kBAAkB,CAAC,CA0B7B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,YAAY,CACjC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,mBAAwB,GAC/B,OAAO,CAAC,kBAAkB,CAAC,CAe7B"}

package/dist/runtime/router/index.d.ts

@@ -0,0 +1,7 @@
+import { type FetchEvent } from '../context.js';
+import { type ResolveFetch } from '../middleware.js';
+import type { RouteMatchResult, RouteModuleDefinition } from './types.js';
+export declare function matchFetchRoute(routes: readonly RouteModuleDefinition[], input: Request | URL | string): RouteMatchResult | null;
+export declare function invokeRouteModules<TEvent extends FetchEvent>(routes: readonly RouteModuleDefinition[], event: TEvent): Promise<Response>;
+export declare function createRouteResolve<TEvent extends FetchEvent>(routes: readonly RouteModuleDefinition[], initialEvent: TEvent): ResolveFetch<TEvent>;
+//# sourceMappingURL=index.d.ts.map

package/dist/runtime/router/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/runtime/router/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,KAAK,UAAU,EAAyC,MAAM,YAAY,CAAA;AACnF,OAAO,EAAE,KAAK,YAAY,EAAqB,MAAM,eAAe,CAAA;AACpE,OAAO,KAAK,EAAE,gBAAgB,EAAE,qBAAqB,EAAgB,MAAM,SAAS,CAAA;AAsGpF,wBAAgB,eAAe,CAC9B,MAAM,EAAE,SAAS,qBAAqB,EAAE,EACxC,KAAK,EAAE,OAAO,GAAG,GAAG,GAAG,MAAM,GAC3B,gBAAgB,GAAG,IAAI,CAczB;AAED,wBAAsB,kBAAkB,CAAC,MAAM,SAAS,UAAU,EACjE,MAAM,EAAE,SAAS,qBAAqB,EAAE,EACxC,KAAK,EAAE,MAAM,GACX,OAAO,CAAC,QAAQ,CAAC,CAYnB;AAED,wBAAgB,kBAAkB,CAAC,MAAM,SAAS,UAAU,EAC3D,MAAM,EAAE,SAAS,qBAAqB,EAAE,EACxC,YAAY,EAAE,MAAM,GAClB,YAAY,CAAC,MAAM,CAAC,CAItB"}

package/dist/runtime/router/types.d.ts

@@ -0,0 +1,24 @@
+export type RouteSegment = {
+    readonly type: 'static';
+    readonly value: string;
+} | {
+    readonly type: 'param';
+    readonly name: string;
+} | {
+    readonly type: 'rest';
+    readonly name: string;
+} | {
+    readonly type: 'optional-rest';
+    readonly name: string;
+};
+export interface RouteModuleDefinition {
+    readonly filePath: string;
+    readonly routePath: string;
+    readonly segments: readonly RouteSegment[];
+    readonly module: Record<string, unknown>;
+}
+export interface RouteMatchResult {
+    readonly route: RouteModuleDefinition;
+    readonly params: Record<string, string>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/runtime/router/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/runtime/router/types.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,YAAY,GACrB;IACA,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACrB,GACD;IACA,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACpB,GACD;IACA,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACpB,GACD;IACA,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAA;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACpB,CAAA;AAEJ,MAAM,WAAW,qBAAqB;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,QAAQ,EAAE,SAAS,YAAY,EAAE,CAAA;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACxC;AAED,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAA;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACvC"}

package/dist/runtime/validation.d.ts

@@ -1,10 +1,16 @@
 /**
- * Error thrown when accessing context properties outside of request handler
+ * Error thrown when accessing context properties outside an active handler trail
  */
 export declare class ContextAccessError extends Error {
     readonly contextName: string;
     readonly propertyName: string;
-    constructor(contextName: string, propertyName: string);
+    constructor(contextName: string, propertyName: string, message?: string);
+    /**
+     * Builds a `ContextAccessError` for the "no active handler trail" failure mode
+     * (no AsyncLocalStorage store), with guidance toward the most common causes.
+     * Pass `message` to override the default `nodejs_compat`-mentioning guidance.
+     */
+    static contextUnavailable(message?: string): ContextAccessError;
 }
 /**
  * Creates a proxy that validates context is available before access
@@ -15,7 +21,7 @@ export declare class ContextAccessError extends Error {
  *
  * @example
  * ```ts
- * import { getContextOrNull } from './context'
+ * import { getContextOrNull } from './context.js'
  *
  * export const env = createContextProxy(
  *   () => getContextOrNull()?.env,
@@ -33,5 +39,13 @@ export declare class ContextAccessError extends Error {
  * const db = env.DB // ❌ ContextAccessError with guidance
  * ```
  */
-export declare function createContextProxy<T extends object>(getter: () => T | undefined, name: string): T;
+export interface CreateContextProxyOptions {
+    /**
+     * When `false`, the proxy throws a `TypeError` on `set` / `deleteProperty`
+     * (read-only semantics) and reports descriptors as non-writable. Defaults
+     * to `true` (mutable; mutations forwarded to the underlying object).
+     */
+    mutable?: boolean;
+}
+export declare function createContextProxy<T extends object>(getter: () => T | null | undefined, name: string, options?: CreateContextProxyOptions): T;
 //# sourceMappingURL=validation.d.ts.map

package/dist/runtime/validation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../src/runtime/validation.ts"],"names":[],"mappings":"AAOA;;GAEG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAC5C,SAAgB,WAAW,EAAE,MAAM,CAAA;IACnC,SAAgB,YAAY,EAAE,MAAM,CAAA;IAEpC,YAAY,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAYpD;CACD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,SAAS,MAAM,EAClD,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,EAC3B,IAAI,EAAE,MAAM,GACV,CAAC,CA2CH"}
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../src/runtime/validation.ts"],"names":[],"mappings":"AAQA;;GAEG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAC5C,SAAgB,WAAW,EAAE,MAAM,CAAA;IACnC,SAAgB,YAAY,EAAE,MAAM,CAAA;IAEpC,YAAY,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAatE;IAED;;;;OAIG;IACH,MAAM,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,kBAAkB,CAa9D;CACD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,WAAW,yBAAyB;IACzC;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;CACjB;AAED,wBAAgB,kBAAkB,CAAC,CAAC,SAAS,MAAM,EAClD,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,GAAG,SAAS,EAClC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,yBAA8B,GACrC,CAAC,CAsEH"}

package/dist/secrets/local-secrets.d.ts

@@ -0,0 +1,46 @@
+import { type DevflareConfig } from '../config/index.js';
+export declare const LOCAL_SECRETS_PATH: string;
+export interface LocalSecretReference {
+    cwd: string;
+    storeId: string;
+    name: string;
+}
+export interface LocalSecretWrite extends LocalSecretReference {
+    value: string;
+}
+export interface LocalSecretListOptions {
+    cwd: string;
+    storeId?: string;
+}
+export interface LocalSecretListItem {
+    storeId: string;
+    name: string;
+    hasValue: boolean;
+    updatedAt: string;
+}
+export interface LocalSecretWrappedBindingConfig {
+    localBindingNames: string[];
+    wrappedBindings: Record<string, {
+        scriptName: string;
+        bindings: {
+            value: string;
+        };
+    }>;
+    workers: Array<{
+        name: string;
+        modules: true;
+        script: string;
+    }>;
+}
+export interface LocalSecretsStoreSecretBinding {
+    get(): Promise<string>;
+}
+export declare function writeLocalSecret({ cwd, storeId, name, value }: LocalSecretWrite): void;
+export declare function readLocalSecret({ cwd, storeId, name }: LocalSecretReference): string | undefined;
+export declare function deleteLocalSecret({ cwd, storeId, name }: LocalSecretReference): boolean;
+export declare function listLocalSecrets({ cwd, storeId }: LocalSecretListOptions): LocalSecretListItem[];
+export declare function resolveLocalSecretValuesForBindings(config: Pick<DevflareConfig, 'bindings' | 'secretsStoreId'>, cwd: string): Record<string, string>;
+export declare function buildLocalSecretWrappedBindingConfig(config: Pick<DevflareConfig, 'bindings' | 'secretsStoreId'>, cwd: string): LocalSecretWrappedBindingConfig;
+export declare function buildLocalSecretNodeBindings(config: Pick<DevflareConfig, 'bindings' | 'secretsStoreId'>, cwd: string): Record<string, LocalSecretsStoreSecretBinding>;
+export declare function seedMiniflareLocalSecrets(miniflare: unknown, config: Pick<DevflareConfig, 'bindings' | 'secretsStoreId'>, cwd: string): Promise<void>;
+//# sourceMappingURL=local-secrets.d.ts.map

package/dist/secrets/local-secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-secrets.d.ts","sourceRoot":"","sources":["../../src/secrets/local-secrets.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,cAAc,EAAgC,MAAM,WAAW,CAAA;AAE7E,eAAO,MAAM,kBAAkB,QAA0C,CAAA;AAYzE,MAAM,WAAW,oBAAoB;IACpC,GAAG,EAAE,MAAM,CAAA;IACX,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;CACZ;AAED,MAAM,WAAW,gBAAiB,SAAQ,oBAAoB;IAC7D,KAAK,EAAE,MAAM,CAAA;CACb;AAED,MAAM,WAAW,sBAAsB;IACtC,GAAG,EAAE,MAAM,CAAA;IACX,OAAO,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,mBAAmB;IACnC,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,OAAO,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CACjB;AAeD,MAAM,WAAW,+BAA+B;IAC/C,iBAAiB,EAAE,MAAM,EAAE,CAAA;IAC3B,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE;YAAE,KAAK,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC,CAAA;IACpF,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,IAAI,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAC/D;AAED,MAAM,WAAW,8BAA8B;IAC9C,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;CACtB;AA2DD,wBAAgB,gBAAgB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,gBAAgB,GAAG,IAAI,CAQtF;AAED,wBAAgB,eAAe,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,oBAAoB,GAAG,MAAM,GAAG,SAAS,CAEhG;AAED,wBAAgB,iBAAiB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,oBAAoB,GAAG,OAAO,CAavF;AAED,wBAAgB,gBAAgB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,sBAAsB,GAAG,mBAAmB,EAAE,CAYhG;AAED,wBAAgB,mCAAmC,CAClD,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,UAAU,GAAG,gBAAgB,CAAC,EAC3D,GAAG,EAAE,MAAM,GACT,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAiBxB;AAYD,wBAAgB,oCAAoC,CACnD,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,UAAU,GAAG,gBAAgB,CAAC,EAC3D,GAAG,EAAE,MAAM,GACT,+BAA+B,CAwBjC;AAED,wBAAgB,4BAA4B,CAC3C,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,UAAU,GAAG,gBAAgB,CAAC,EAC3D,GAAG,EAAE,MAAM,GACT,MAAM,CAAC,MAAM,EAAE,8BAA8B,CAAC,CAahD;AA6BD,wBAAsB,yBAAyB,CAC9C,SAAS,EAAE,OAAO,EAClB,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,UAAU,GAAG,gBAAgB,CAAC,EAC3D,GAAG,EAAE,MAAM,GACT,OAAO,CAAC,IAAI,CAAC,CAWf"}

package/dist/shims/local-hyperdrive.d.ts

@@ -0,0 +1,12 @@
+export declare const HYPERDRIVE_CONNECT_MESSAGE: string;
+/**
+ * Creates a Hyperdrive binding around a local database connection string.
+ *
+ * The connection fields are real and usable with any Node database client. The
+ * Cloudflare `connect()` raw socket is intentionally not implemented — it would
+ * require faithfully reproducing `cloudflare:sockets` semantics (TLS, startTls(),
+ * half-open, SocketInfo) over node:net, which is exactly the kind of fake that
+ * fails silently. It throws a clear, actionable error instead.
+ */
+export declare function createLocalHyperdrive(connectionString: string): Hyperdrive;
+//# sourceMappingURL=local-hyperdrive.d.ts.map

package/dist/shims/local-hyperdrive.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-hyperdrive.d.ts","sourceRoot":"","sources":["../../src/shims/local-hyperdrive.ts"],"names":[],"mappings":"AAYA,eAAO,MAAM,0BAA0B,QAIiD,CAAA;AAUxF;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,gBAAgB,EAAE,MAAM,GAAG,UAAU,CAc1E"}

package/dist/shims/local-media-bindings.d.ts

@@ -0,0 +1,19 @@
+import type { DevflareConfig } from '../config/index.js';
+export declare function createLocalImagesBinding(): ImagesBinding;
+export declare function createLocalMediaBinding(): MediaBinding;
+export interface LocalBindingShimServiceConfig {
+    localBindingNames: string[];
+    serviceBindings: Record<string, {
+        name: string;
+        entrypoint: string;
+    }>;
+    workers: Array<{
+        name: string;
+        modules: true;
+        script: string;
+        compatibilityDate: string;
+        compatibilityFlags?: string[];
+    }>;
+}
+export declare function buildLocalBindingShimServiceConfig(config: Pick<DevflareConfig, 'bindings' | 'compatibilityDate' | 'compatibilityFlags'>): LocalBindingShimServiceConfig;
+//# sourceMappingURL=local-media-bindings.d.ts.map

package/dist/shims/local-media-bindings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-media-bindings.d.ts","sourceRoot":"","sources":["../../src/shims/local-media-bindings.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AA+F/C,wBAAgB,wBAAwB,IAAI,aAAa,CAgBxD;AAuCD,wBAAgB,uBAAuB,IAAI,YAAY,CAMtD;AAED,MAAM,WAAW,6BAA6B;IAC7C,iBAAiB,EAAE,MAAM,EAAE,CAAA;IAC3B,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACrE,OAAO,EAAE,KAAK,CAAC;QACd,IAAI,EAAE,MAAM,CAAA;QACZ,OAAO,EAAE,IAAI,CAAA;QACb,MAAM,EAAE,MAAM,CAAA;QACd,iBAAiB,EAAE,MAAM,CAAA;QACzB,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAA;KAC7B,CAAC,CAAA;CACF;AA8MD,wBAAgB,kCAAkC,CACjD,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,UAAU,GAAG,mBAAmB,GAAG,oBAAoB,CAAC,GACnF,6BAA6B,CAkC/B"}

package/dist/shims/local-worker-loader.d.ts

@@ -0,0 +1,3 @@
+export declare function createLocalWorkerLoaderBinding(): WorkerLoader;
+export declare function disposeLocalWorkerLoaderBindings(): Promise<void>;
+//# sourceMappingURL=local-worker-loader.d.ts.map

package/dist/shims/local-worker-loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-worker-loader.d.ts","sourceRoot":"","sources":["../../src/shims/local-worker-loader.ts"],"names":[],"mappings":"AAkFA,wBAAgB,8BAA8B,IAAI,YAAY,CAY7D;AAED,wBAAsB,gCAAgC,IAAI,OAAO,CAAC,IAAI,CAAC,CAStE"}

package/dist/sveltekit/index.d.ts

@@ -1,2 +1,2 @@
-export { handle, createDevflarePlatform, createHandle, resetPlatform, resetConfigCache, isDevflareDev, getBridgePort, type Platform, type DevflarePlatformOptions, type CreateHandleOptions } from './platform';
+export { handle, createDevflarePlatform, createHandle, resetPlatform, resetConfigCache, isDevflareDev, getBridgePort, type Platform, type DevflarePlatformOptions, type CreateHandleOptions } from './platform.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/sveltekit/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sveltekit/index.ts"],"names":[],"mappings":"AAMA,OAAO,EAEN,MAAM,EAGN,sBAAsB,EACtB,YAAY,EAGZ,aAAa,EACb,gBAAgB,EAChB,aAAa,EACb,aAAa,EAGb,KAAK,QAAQ,EACb,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,EACxB,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sveltekit/index.ts"],"names":[],"mappings":"AAMA,OAAO,EAEN,MAAM,EAEN,sBAAsB,EACtB,YAAY,EAEZ,aAAa,EACb,gBAAgB,EAChB,aAAa,EACb,aAAa,EAEb,KAAK,QAAQ,EACb,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,EACxB,MAAM,YAAY,CAAA"}