devflare 1.0.0-next.7 → 1.0.0-next.71

package/dist/bridge/client.d.ts

@@ -1,5 +1,6 @@
+export { resolveBridgeWebSocketConstructor } from './websocket-constructor.js';
 export interface BridgeClientOptions {
-    /** Bridge WebSocket URL (default: ws://localhost:8686) */
+    /** Bridge WebSocket URL (default: ws://localhost:8787) */
     url?: string;
     /** Auto-reconnect on disconnect */
     autoReconnect?: boolean;
@@ -17,22 +18,38 @@ export interface ActiveStream {
     controller: ReadableStreamDefaultController<Uint8Array>;
     buffer: Uint8Array[];
     creditRemaining: number;
+    /** Resolver for a pending pull waiting on bytes or end */
+    pendingPull: {
+        resolve: () => void;
+        reject: (error: Error) => void;
+    } | null;
+    /** Stream ended (from server) — signal pull to flush and close */
+    ended: boolean;
+    /** Stream was cancelled locally or aborted */
+    closed: boolean;
 }
 export interface ActiveWsProxy {
     clientWs: WebSocket;
     onMessage: (data: Uint8Array | string) => void;
     onClose: (code?: number, reason?: string) => void;
 }
+export interface PendingWsOpen {
+    resolve: () => void;
+    reject: (error: Error) => void;
+}
 export declare class BridgeClient {
     private ws;
+    private codec;
+    private adapter;
     private url;
     private autoReconnect;
     private reconnectDelay;
     private connectTimeout;
-    private pendingCalls;
     private activeStreams;
     private wsProxies;
+    private pendingWsOpens;
     private outgoingStreams;
+    private eventListeners;
     private connectPromise;
     private isConnected;
     constructor(options?: BridgeClientOptions);
@@ -42,14 +59,43 @@ export declare class BridgeClient {
     getHttpUrl(): string;
     /** Connect to the bridge */
     connect(): Promise<void>;
-    /** Disconnect from the bridge */
+    private openConnectionWithPackageFallback;
+    private openConnection;
+    /** Disconnect from the bridge and tear down all pending state */
     disconnect(): void;
+    /** Alias for disconnect() */
+    close(): void;
     /** Check if connected */
     get connected(): boolean;
     private handleDisconnect;
+    /** Reject/close all pending streams and ws proxies (codec owns RPC pending). */
+    private cleanupPending;
     /** Call an RPC method */
     call(method: string, params: unknown[], timeoutMs?: number): Promise<unknown>;
-    /** Create a proxied WebSocket to a Durable Object */
+    /**
+     * Subscribe to bridge `event` notifications for a topic.
+     *
+     * Pass `'*'` to receive every event regardless of topic. Returns an
+     * unsubscribe function; calling it removes this listener. Subscriptions
+     * survive auto-reconnect and are only dropped on an explicit disconnect().
+     *
+     * NOTE: no gateway currently emits `event` frames, so listeners will not
+     * fire until an event producer is wired on the gateway side. The subscriber
+     * surface is provided so consumers can register ahead of that work.
+     */
+    on(topic: string, cb: (data: unknown) => void): () => void;
+    /**
+     * Create a proxied WebSocket to a Durable Object via the in-process bridge
+     * relay (`ws.open` control frame → gateway `stub.fetch()` pump → `WsData`
+     * frames).
+     *
+     * DEPRECATED for DO connect(): this relay pumps the DO's WebSocket in-process,
+     * which does NOT trigger workerd's hibernation dispatch — so a DO that uses
+     * `ctx.acceptWebSocket()` never sees `webSocketMessage`/`webSocketClose` and
+     * cross-socket `ctx.getWebSockets()` broadcasts never cross. `connect()` now
+     * uses `openDoWebSocket()` (a real pass-through) instead. This method is
+     * retained for the `ws-relay` wire capability and backward compatibility.
+     */
     createWsProxy(binding: string, id: string, url: string, headers?: [string, string][]): Promise<{
         wid: number;
         send: (data: Uint8Array | string) => void;
@@ -57,14 +103,51 @@ export declare class BridgeClient {
         onMessage: (handler: (data: Uint8Array | string) => void) => void;
         onClose: (handler: (code?: number, reason?: string) => void) => void;
     }>;
+    /**
+     * Open a REAL WebSocket to the gateway's DO pass-through endpoint
+     * (`/_devflare/do-ws`), which forwards the upgrade to the target Durable
+     * Object and passes through its `101` response.
+     *
+     * This is the ONLY way a bridged DO WebSocket triggers the runtime's
+     * hibernation dispatch under miniflare: the gateway returns the DO's client
+     * socket for a genuine inbound connection, so workerd pumps it and invokes
+     * `webSocketMessage`/`webSocketClose` and delivers `ctx.getWebSockets()`
+     * broadcasts. The legacy in-process relay (`createWsProxy` + gateway
+     * `stub.fetch()` pump) never fires hibernation, so two sockets to the same
+     * `getByName(id)` could not see each other's messages. Here they share ONE DO
+     * instance and broadcast across each other, exactly as on real Cloudflare.
+     *
+     * Unlike `createWsProxy`, this does not multiplex over the bridge socket: it
+     * is a standalone connection (see `openDurableObjectWebSocket`) with its own
+     * lifecycle, so it is unaffected by the bridge client's disconnect/reconnect
+     * bookkeeping. It also does not require the bridge socket to be connected.
+     *
+     * @param binding - DO namespace binding name (e.g. `DOC_ROOM`).
+     * @param idHex - Already-resolved Durable Object id, hex form.
+     * @param targetUrl - The DO fetch URL the caller passed to `stub.connect(url)`.
+     * @param headers - Optional upgrade headers (auth/cookies) forwarded to the DO.
+     * @returns A minimal proxy surface (send/close/onMessage/onClose) over the socket.
+     * @throws When the pass-through socket fails to open (bad binding/id, or the
+     *   DO rejected the upgrade).
+     */
+    openDoWebSocket(binding: string, idHex: string, targetUrl: string, headers?: [string, string][]): Promise<{
+        wid: number;
+        send: (data: Uint8Array | string) => void;
+        close: (code?: number, reason?: string) => void;
+        onMessage: (handler: (data: Uint8Array | string) => void) => void;
+        onClose: (handler: (code?: number, reason?: string) => void) => void;
+    }>;
     /** Create a readable stream that pulls from the bridge */
     createReadableStream(sid: number): ReadableStream<Uint8Array>;
-    private handleMessage;
     private handleJsonMessage;
-    private handleBinaryMessage;
-    private handleRpcOk;
-    private handleRpcErr;
+    /**
+     * Receive a v2 binary frame. Frame format is byte-identical to the legacy
+     * v1 frames for kinds 1 (StreamChunk) and 2 (WsData); v2 owns kind 3
+     * (BodyChunk) which the codec handles internally before reaching here.
+     */
+    private handleV2BinaryFrame;
     private handleEvent;
+    private dispatchEvent;
     private handleStreamPull;
     private pumpStream;
     private handleStreamChunk;
@@ -72,8 +155,10 @@ export declare class BridgeClient {
     private handleStreamAbort;
     private handleWsData;
     private handleWsClose;
+    private handleWsOpened;
     private ensureConnected;
     private send;
+    private sendBinary;
 }
 /** Get or create the default bridge client */
 export declare function getClient(options?: BridgeClientOptions): BridgeClient;

package/dist/bridge/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/bridge/client.ts"],"names":[],"mappings":"AAmCA,MAAM,WAAW,mBAAmB;IACnC,0DAA0D;IAC1D,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,mCAAmC;IACnC,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,4BAA4B;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,+BAA+B;IAC/B,cAAc,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,WAAW;IAC3B,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAA;IACjC,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAA;IAC9B,OAAO,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,CAAA;CACtC;AAED,MAAM,WAAW,YAAY;IAC5B,UAAU,EAAE,+BAA+B,CAAC,UAAU,CAAC,CAAA;IACvD,MAAM,EAAE,UAAU,EAAE,CAAA;IACpB,eAAe,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,aAAa;IAC7B,QAAQ,EAAE,SAAS,CAAA;IACnB,SAAS,EAAE,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,KAAK,IAAI,CAAA;IAC9C,OAAO,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;CACjD;AAMD,qBAAa,YAAY;IACxB,OAAO,CAAC,EAAE,CAAyB;IACnC,OAAO,CAAC,GAAG,CAAQ;IACnB,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,cAAc,CAAQ;IAC9B,OAAO,CAAC,cAAc,CAAQ;IAE9B,OAAO,CAAC,YAAY,CAAiC;IACrD,OAAO,CAAC,aAAa,CAAkC;IACvD,OAAO,CAAC,SAAS,CAAmC;IACpD,OAAO,CAAC,eAAe,CAA+B;IAEtD,OAAO,CAAC,cAAc,CAA6B;IACnD,OAAO,CAAC,WAAW,CAAQ;IAE3B,YAAY,OAAO,GAAE,mBAAwB,EAK5C;IAED,4BAA4B;IAC5B,MAAM,IAAI,MAAM,CAEf;IAED,6CAA6C;IAC7C,UAAU,IAAI,MAAM,CAGnB;IAMD,4BAA4B;IACtB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CA0C7B;IAED,iCAAiC;IACjC,UAAU,IAAI,IAAI,CAYjB;IAED,yBAAyB;IACzB,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED,OAAO,CAAC,gBAAgB;IA6BxB,yBAAyB;IACnB,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,SAAS,SAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CA8BjF;IAMD,qDAAqD;IAC/C,aAAa,CAClB,OAAO,EAAE,MAAM,EACf,EAAE,EAAE,MAAM,EACV,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,GAC1B,OAAO,CAAC;QACV,GAAG,EAAE,MAAM,CAAA;QACX,IAAI,EAAE,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,KAAK,IAAI,CAAA;QACzC,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;QAC/C,SAAS,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,KAAK,IAAI,KAAK,IAAI,CAAA;QACjE,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,KAAK,IAAI,CAAA;KACpE,CAAC,CA6CD;IAMD,0DAA0D;IAC1D,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CAAC,UAAU,CAAC,CAyC5D;IAMD,OAAO,CAAC,aAAa;IAQrB,OAAO,CAAC,iBAAiB;IAmCzB,OAAO,CAAC,mBAAmB;IAiB3B,OAAO,CAAC,WAAW;IAYnB,OAAO,CAAC,YAAY;IAapB,OAAO,CAAC,WAAW;IAInB,OAAO,CAAC,gBAAgB;YAQV,UAAU;IAyCxB,OAAO,CAAC,iBAAiB;IAOzB,OAAO,CAAC,eAAe;IAYvB,OAAO,CAAC,iBAAiB;IAQzB,OAAO,CAAC,YAAY;IAYpB,OAAO,CAAC,aAAa;YAYP,eAAe;IAM7B,OAAO,CAAC,IAAI;CAMZ;AAQD,8CAA8C;AAC9C,wBAAgB,SAAS,CAAC,OAAO,CAAC,EAAE,mBAAmB,GAAG,YAAY,CAKrE;AAED,6CAA6C;AAC7C,wBAAgB,WAAW,IAAI,IAAI,CAGlC"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/bridge/client.ts"],"names":[],"mappings":"AA6CA,OAAO,EAAE,iCAAiC,EAAE,MAAM,yBAAyB,CAAA;AAkC3E,MAAM,WAAW,mBAAmB;IACnC,0DAA0D;IAC1D,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,mCAAmC;IACnC,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,4BAA4B;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,+BAA+B;IAC/B,cAAc,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,WAAW;IAC3B,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAA;IACjC,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAA;IAC9B,OAAO,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,CAAA;CACtC;AAED,MAAM,WAAW,YAAY;IAC5B,UAAU,EAAE,+BAA+B,CAAC,UAAU,CAAC,CAAA;IACvD,MAAM,EAAE,UAAU,EAAE,CAAA;IACpB,eAAe,EAAE,MAAM,CAAA;IACvB,0DAA0D;IAC1D,WAAW,EAAE;QACZ,OAAO,EAAE,MAAM,IAAI,CAAA;QACnB,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAA;KAC9B,GAAG,IAAI,CAAA;IACR,kEAAkE;IAClE,KAAK,EAAE,OAAO,CAAA;IACd,8CAA8C;IAC9C,MAAM,EAAE,OAAO,CAAA;CACf;AAED,MAAM,WAAW,aAAa;IAC7B,QAAQ,EAAE,SAAS,CAAA;IACnB,SAAS,EAAE,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,KAAK,IAAI,CAAA;IAC9C,OAAO,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;CACjD;AAED,MAAM,WAAW,aAAa;IAC7B,OAAO,EAAE,MAAM,IAAI,CAAA;IACnB,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAA;CAC9B;AAMD,qBAAa,YAAY;IACxB,OAAO,CAAC,EAAE,CAAyB;IACnC,OAAO,CAAC,KAAK,CAAgC;IAC7C,OAAO,CAAC,OAAO,CAA+B;IAC9C,OAAO,CAAC,GAAG,CAAQ;IACnB,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,cAAc,CAAQ;IAC9B,OAAO,CAAC,cAAc,CAAQ;IAE9B,OAAO,CAAC,aAAa,CAAkC;IACvD,OAAO,CAAC,SAAS,CAAmC;IACpD,OAAO,CAAC,cAAc,CAAmC;IACzD,OAAO,CAAC,eAAe,CAA+B;IACtD,OAAO,CAAC,cAAc,CAAkD;IAExE,OAAO,CAAC,cAAc,CAA6B;IACnD,OAAO,CAAC,WAAW,CAAQ;IAE3B,YAAY,OAAO,GAAE,mBAAwB,EAK5C;IAED,4BAA4B;IAC5B,MAAM,IAAI,MAAM,CAEf;IAED,6CAA6C;IAC7C,UAAU,IAAI,MAAM,CAGnB;IAMD,4BAA4B;IACtB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAmB7B;YAEa,iCAAiC;IAK/C,OAAO,CAAC,cAAc;IA4FtB,iEAAiE;IACjE,UAAU,IAAI,IAAI,CAgBjB;IAED,6BAA6B;IAC7B,KAAK,IAAI,IAAI,CAEZ;IAED,yBAAyB;IACzB,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED,OAAO,CAAC,gBAAgB;IAmBxB,gFAAgF;IAChF,OAAO,CAAC,cAAc;IAwCtB,yBAAyB;IACnB,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,SAAS,SAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CA0CjF;IAMD;;;;;;;;;;OAUG;IACH,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,GAAG,MAAM,IAAI,CAazD;IAMD;;;;;;;;;;;OAWG;IACG,aAAa,CAClB,OAAO,EAAE,MAAM,EACf,EAAE,EAAE,MAAM,EACV,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,GAC1B,OAAO,CAAC;QACV,GAAG,EAAE,MAAM,CAAA;QACX,IAAI,EAAE,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,KAAK,IAAI,CAAA;QACzC,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;QAC/C,SAAS,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,KAAK,IAAI,KAAK,IAAI,CAAA;QACjE,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,KAAK,IAAI,CAAA;KACpE,CAAC,CAqDD;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACG,eAAe,CACpB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,GAC1B,OAAO,CAAC;QACV,GAAG,EAAE,MAAM,CAAA;QACX,IAAI,EAAE,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,KAAK,IAAI,CAAA;QACzC,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;QAC/C,SAAS,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,KAAK,IAAI,KAAK,IAAI,CAAA;QACjE,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,KAAK,IAAI,CAAA;KACpE,CAAC,CAED;IAMD,0DAA0D;IAC1D,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CAAC,UAAU,CAAC,CAqE5D;IASD,OAAO,CAAC,iBAAiB;IA6BzB;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;IAW3B,OAAO,CAAC,WAAW;IASnB,OAAO,CAAC,aAAa;IAgBrB,OAAO,CAAC,gBAAgB;YAQV,UAAU;IAmCxB,OAAO,CAAC,iBAAiB;IAYzB,OAAO,CAAC,eAAe;IAYvB,OAAO,CAAC,iBAAiB;IAmBzB,OAAO,CAAC,YAAY;IAUpB,OAAO,CAAC,aAAa;IAQrB,OAAO,CAAC,cAAc;YAWR,eAAe;IAM7B,OAAO,CAAC,IAAI;IAQZ,OAAO,CAAC,UAAU;CAOlB;AAQD,8CAA8C;AAC9C,wBAAgB,SAAS,CAAC,OAAO,CAAC,EAAE,mBAAmB,GAAG,YAAY,CAKrE;AAED,6CAA6C;AAC7C,wBAAgB,WAAW,IAAI,IAAI,CAGlC"}

package/dist/bridge/do-rpc-dispatch.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Dispatch a single Durable Object RPC method call to its stub.
+ *
+ * A DO that `extends DurableObject` (from `cloudflare:workers`) exposes its
+ * methods as native RPC on the stub, so the method is invoked DIRECTLY as
+ * `stub[method](...args)` — exactly as on real Cloudflare. This is the ONLY
+ * correct path for a DO that ALSO defines its own `fetch()`: routing the call
+ * through `fetch()` would hand devflare's internal `_rpc` probe to the user
+ * handler, which may reject it (e.g. a websocket-only `fetch()` returning 426),
+ * yielding a non-JSON body that then fails to parse.
+ *
+ * The fetch `_rpc` convention is kept only as a fallback for DOs that are not
+ * RPC-enabled (see `callDurableObjectRpcViaFetch`).
+ *
+ * @param stub - The resolved Durable Object stub to dispatch against.
+ * @param methodName - The RPC method name requested by the client proxy.
+ * @param args - The already-deserialized positional arguments for the method.
+ * @returns The method's return value (or the `_rpc` fallback's result).
+ * @throws Re-throws any genuine error from the method; only a workerd
+ *   "does not support RPC" signal is swallowed to trigger the fetch fallback.
+ */
+export declare function callDurableObjectRpc(stub: DurableObjectStub, methodName: string, args: unknown[]): Promise<unknown>;
+//# sourceMappingURL=do-rpc-dispatch.d.ts.map

package/dist/bridge/do-rpc-dispatch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"do-rpc-dispatch.d.ts","sourceRoot":"","sources":["../../src/bridge/do-rpc-dispatch.ts"],"names":[],"mappings":"AASA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,oBAAoB,CACzC,IAAI,EAAE,iBAAiB,EACvB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,OAAO,EAAE,GACb,OAAO,CAAC,OAAO,CAAC,CAelB"}

package/dist/bridge/do-websocket-connect.d.ts

@@ -0,0 +1,33 @@
+/**
+ * The minimal proxy surface over a DO pass-through socket, matching the shape
+ * consumed by the DO Socket facade in `proxy.ts` `connect()`.
+ */
+export interface DoWebSocketProxy {
+    /** Synthetic id for parity with the legacy relay proxy (not on the wire). */
+    wid: number;
+    /** Send a frame to the DO (binary for bytes, text for strings). */
+    send: (data: Uint8Array | string) => void;
+    /** Close the socket. */
+    close: (code?: number, reason?: string) => void;
+    /** Attach the inbound-frame handler; buffered frames flush immediately. */
+    onMessage: (handler: (data: Uint8Array | string) => void) => void;
+    /** Attach the close handler; a buffered close fires immediately. */
+    onClose: (handler: (code?: number, reason?: string) => void) => void;
+}
+/**
+ * Open a real pass-through WebSocket to a Durable Object through the gateway's
+ * `/_devflare/do-ws` endpoint. Unlike the legacy relay, this is a standalone
+ * connection with its own lifecycle, so it is unaffected by the bridge client's
+ * `disconnect()`/reconnect bookkeeping.
+ *
+ * @param bridgeUrl - The bridge/gateway base URL (e.g. `ws://127.0.0.1:8787`).
+ * @param binding - DO namespace binding name (e.g. `DOC_ROOM`).
+ * @param idHex - Already-resolved Durable Object id, hex form.
+ * @param targetUrl - The DO fetch URL the caller passed to `stub.connect(url)`.
+ * @param headers - Optional upgrade headers (auth/cookies) forwarded to the DO.
+ * @returns A proxy surface (send/close/onMessage/onClose) over the socket.
+ * @throws When the pass-through socket fails to open (bad binding/id, or the DO
+ *   rejected the upgrade).
+ */
+export declare function openDurableObjectWebSocket(bridgeUrl: string, binding: string, idHex: string, targetUrl: string, headers?: [string, string][]): Promise<DoWebSocketProxy>;
+//# sourceMappingURL=do-websocket-connect.d.ts.map

package/dist/bridge/do-websocket-connect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"do-websocket-connect.d.ts","sourceRoot":"","sources":["../../src/bridge/do-websocket-connect.ts"],"names":[],"mappings":"AAqEA;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAChC,6EAA6E;IAC7E,GAAG,EAAE,MAAM,CAAA;IACX,mEAAmE;IACnE,IAAI,EAAE,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,KAAK,IAAI,CAAA;IACzC,wBAAwB;IACxB,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;IAC/C,2EAA2E;IAC3E,SAAS,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,KAAK,IAAI,KAAK,IAAI,CAAA;IACjE,oEAAoE;IACpE,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,KAAK,IAAI,CAAA;CACpE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,0BAA0B,CAC/C,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,GAC1B,OAAO,CAAC,gBAAgB,CAAC,CAyE3B"}

package/dist/bridge/gateway-runtime.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Shared gateway helpers (base64, R2 serializers, email) and the RPC method
+ * dispatcher. Designed to be embedded verbatim at the top level of a worker
+ * module. All symbols are declared with `function`/`const` so they are
+ * hoisted in both embedding sites.
+ */
+export declare const GATEWAY_RUNTIME_JS = "\nconst RAW_EMAIL = 'EmailMessage::raw'\n\n// Inline body cap for proxied DO/service-fetch responses. Matches\n// HTTP_TRANSFER_THRESHOLD in wire.ts (512 KB). A larger body would exceed\n// workerd's ~1 MB WebSocket message limit once base64-encoded into the rpc.ok\n// frame, so it is rejected with a clear error rather than silently truncated.\nconst HTTP_TRANSFER_THRESHOLD = 512 * 1024\n\nfunction arrayBufferToBase64(buffer) {\n\tconst bytes = new Uint8Array(buffer)\n\tlet binary = ''\n\tfor (let i = 0; i < bytes.byteLength; i++) binary += String.fromCharCode(bytes[i])\n\treturn btoa(binary)\n}\n\nfunction base64ToArrayBuffer(base64) {\n\tconst binary = atob(base64)\n\tconst bytes = new Uint8Array(binary.length)\n\tfor (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i)\n\treturn bytes.buffer\n}\n\n// Binary WsData frame codec (10-byte header: kind:u8, id:u32 LE, seq:u32 LE,\n// flags:u8 + payload). MUST match wire.ts encodeBinaryFrame/decodeBinaryFrame so\n// the bridge client and this gateway agree on the WS-data wire format\n// (BinaryKind.WsData = 2, BinaryFlags.TEXT = 2).\nfunction encodeWsDataFrame(wid, flags, payload) {\n\tconst frame = new Uint8Array(10 + payload.byteLength)\n\tconst view = new DataView(frame.buffer)\n\tview.setUint8(0, 2)\n\tview.setUint32(1, wid, true)\n\tview.setUint32(5, 0, true)\n\tview.setUint8(9, flags)\n\tframe.set(payload, 10)\n\treturn frame\n}\n\nfunction decodeWsDataFrame(buffer) {\n\tconst bytes = new Uint8Array(buffer)\n\tif (bytes.byteLength < 10) return null\n\tconst view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength)\n\treturn {\n\t\tkind: view.getUint8(0),\n\t\tid: view.getUint32(1, true),\n\t\tflags: view.getUint8(9),\n\t\tpayload: bytes.subarray(10)\n\t}\n}\n\nfunction serializeR2Object(obj) {\n\tif (!obj) return null\n\treturn {\n\t\t__type: 'R2Object',\n\t\tkey: obj.key,\n\t\tversion: obj.version,\n\t\tsize: obj.size,\n\t\tetag: obj.etag,\n\t\thttpEtag: obj.httpEtag,\n\t\tchecksums: obj.checksums,\n\t\tuploaded: obj.uploaded?.toISOString(),\n\t\thttpMetadata: obj.httpMetadata,\n\t\tcustomMetadata: obj.customMetadata,\n\t\trange: obj.range,\n\t\tstorageClass: obj.storageClass\n\t}\n}\n\nfunction serializeR2ObjectBody(obj, bodyData) {\n\tif (!obj) return null\n\treturn {\n\t\t__type: 'R2ObjectBody',\n\t\tkey: obj.key,\n\t\tversion: obj.version,\n\t\tsize: obj.size,\n\t\tetag: obj.etag,\n\t\thttpEtag: obj.httpEtag,\n\t\tchecksums: obj.checksums,\n\t\tuploaded: obj.uploaded?.toISOString(),\n\t\thttpMetadata: obj.httpMetadata,\n\t\tcustomMetadata: obj.customMetadata,\n\t\trange: obj.range,\n\t\tstorageClass: obj.storageClass,\n\t\tbodyData\n\t}\n}\n\nfunction serializeR2Objects(result) {\n\tif (!result) return null\n\treturn {\n\t\tobjects: result.objects.map(serializeR2Object),\n\t\ttruncated: result.truncated,\n\t\tcursor: result.cursor,\n\t\tdelimitedPrefixes: result.delimitedPrefixes\n\t}\n}\n\n// Read each Set-Cookie value separately. entries()/forEach() combine multiple\n// Set-Cookie headers into one comma-joined value (Fetch sort-and-combine), which\n// corrupts cookies. getSetCookie() keeps them apart on a compat date\n// >= 2023-08-01; older workerd predates it but still exposes getAll('set-cookie').\n// MUST match readSetCookieValues in v2/value-serialization.ts.\nfunction readSetCookieValues(headers) {\n\tif (typeof headers.getSetCookie === 'function') {\n\t\tconst values = headers.getSetCookie()\n\t\treturn Array.isArray(values) ? values : null\n\t}\n\tif (typeof headers.getAll === 'function') {\n\t\ttry {\n\t\t\tconst values = headers.getAll('set-cookie')\n\t\t\treturn Array.isArray(values) ? values : null\n\t\t} catch (error) {\n\t\t\treturn null\n\t\t}\n\t}\n\treturn null\n}\n\n// Flatten headers to [name, value] pairs without collapsing multiple Set-Cookie\n// into one. Each cookie becomes its own pair so the client's new Headers(pairs)\n// re-appends them individually. Falls back to the combined value when the\n// runtime can split neither. MUST match serializeHeaders in v2/value-serialization.ts.\nfunction serializeHeaders(headers) {\n\tconst setCookies = readSetCookieValues(headers)\n\tconst pairs = []\n\theaders.forEach((value, key) => {\n\t\tif (setCookies !== null && key.toLowerCase() === 'set-cookie') return\n\t\tpairs.push([key, value])\n\t})\n\tif (setCookies) {\n\t\tfor (const cookie of setCookies) pairs.push(['set-cookie', cookie])\n\t}\n\treturn pairs\n}\n\nasync function serializeResponse(response) {\n\tlet body = null\n\tif (response.body) {\n\t\tconst bytes = await response.arrayBuffer()\n\t\tif (bytes.byteLength > HTTP_TRANSFER_THRESHOLD) {\n\t\t\tthrow new Error(\n\t\t\t\t'[devflare][bridge] Response body (' + bytes.byteLength + ' bytes) exceeds the '\n\t\t\t\t+ HTTP_TRANSFER_THRESHOLD + '-byte inline limit. DO and service-binding fetch responses '\n\t\t\t\t+ 'are delivered inline over the bridge WebSocket and cannot be streamed locally; keep '\n\t\t\t\t+ 'proxied response bodies under the limit (large R2 objects are exempt \u2014 read them through '\n\t\t\t\t+ 'the R2 binding, which uses the HTTP transfer side-channel).'\n\t\t\t)\n\t\t}\n\t\tif (bytes.byteLength > 0) {\n\t\t\tbody = { type: 'bytes', data: arrayBufferToBase64(bytes) }\n\t\t}\n\t}\n\treturn {\n\t\tstatus: response.status,\n\t\tstatusText: response.statusText,\n\t\theaders: serializeHeaders(response.headers),\n\t\tbody\n\t}\n}\n\nfunction deserializeRequest(serializedReq) {\n\treturn new Request(serializedReq.url, {\n\t\tmethod: serializedReq.method,\n\t\theaders: serializedReq.headers,\n\t\tbody: serializedReq.body?.type === 'bytes'\n\t\t\t? base64ToArrayBuffer(serializedReq.body.data)\n\t\t\t: undefined,\n\t\tredirect: serializedReq.redirect\n\t})\n}\n\nfunction createEmailMessageRaw(raw) {\n\tif (typeof raw === 'string' || raw instanceof ReadableStream) {\n\t\treturn raw\n\t}\n\tif (raw instanceof ArrayBuffer || raw instanceof Uint8Array) {\n\t\treturn new Response(raw).body\n\t}\n\tthrow new Error('Unsupported EmailMessage raw payload')\n}\n\nfunction isDurableObjectNamespace(binding) {\n\treturn !!binding\n\t\t&& typeof binding.idFromName === 'function'\n\t\t&& typeof binding.idFromString === 'function'\n\t\t&& typeof binding.newUniqueId === 'function'\n}\n\n/**\n * Resolve a (possibly jurisdiction-scoped) DurableObjectNamespace.\n * Forwards the jurisdiction faithfully when the binding supports it\n * (real Cloudflare), and degrades to the plain binding otherwise\n * (miniflare/workerd local emulation, which does not pin jurisdictions).\n */\nfunction resolveDoNamespace(binding, jurisdiction) {\n\tif (jurisdiction && typeof binding.jurisdiction === 'function') {\n\t\treturn binding.jurisdiction(jurisdiction)\n\t}\n\treturn binding\n}\n\n// Dispatch a single Durable Object RPC method call to its stub.\n//\n// A DO that extends DurableObject (from cloudflare:workers) exposes its methods\n// as native RPC on the stub, so the method is invoked DIRECTLY as\n// stub[method](...args) \u2014 exactly as on real Cloudflare. This is the ONLY\n// correct path for a DO that ALSO defines its own fetch(): routing the call\n// through fetch() would hand devflare's internal _rpc probe to the user handler,\n// which may reject it (e.g. a websocket-only fetch() returning 426) and yield a\n// non-JSON body that then fails to parse (the reported crash).\n//\n// The fetch _rpc convention is kept only as a fallback for DOs that are not\n// RPC-enabled: the stub proxies every property as callable, so such a DO only\n// reveals itself when the native call throws \"does not support RPC\".\nasync function callDurableObjectRpc(stub, methodName, args) {\n\tif (typeof stub[methodName] === 'function') {\n\t\ttry {\n\t\t\treturn await stub[methodName](...args)\n\t\t} catch (error) {\n\t\t\tif (!isDurableObjectRpcUnsupported(error)) throw error\n\t\t}\n\t}\n\tconst response = await stub.fetch(new Request('http://do/_rpc', {\n\t\tmethod: 'POST',\n\t\theaders: { 'Content-Type': 'application/json' },\n\t\tbody: JSON.stringify({ method: methodName, params: args })\n\t}))\n\tconst result = await response.json()\n\tif (!result.ok) throw new Error(result.error?.message || 'RPC failed')\n\treturn result.result\n}\n\nfunction isDurableObjectRpcUnsupported(error) {\n\tconst message = error && error.message ? String(error.message) : String(error)\n\treturn message.indexOf('does not support RPC') !== -1\n}\n\n/**\n * Execute an RPC method against the gateway's bindings.\n *\n * Method format: \"binding.operation\". Operations must be namespaced by\n * binding kind (e.g. \"kv.get\", \"r2.head\", \"d1.stmt.first\", \"do.fetch\",\n * \"service.fetch\", \"queue.send\", \"email.send\", \"ai.run\"). Bare verbs and the legacy\n * \"stmt.*\" / \"stub.*\" sub-prefixes were removed in B3-final and now throw.\n * Method vocabulary must stay in sync with the canonical server in\n * src/bridge/server.ts.\n */\nasync function executeRpcMethod(method, params, env, _ctx) {\n\tconst parts = method.split('.')\n\tif (parts.length < 2) throw new Error('Invalid method format: ' + method)\n\n\tconst bindingName = parts[0]\n\tconst operation = parts.slice(1).join('.')\n\tconst binding = env[bindingName]\n\n\tif (!binding) throw new Error('Binding not found: ' + bindingName)\n\n\tconst isNamespaced =\n\t\toperation.indexOf('kv.') === 0 ||\n\t\toperation.indexOf('r2.') === 0 ||\n\t\toperation.indexOf('d1.') === 0 ||\n\t\toperation.indexOf('do.') === 0 ||\n\t\toperation.indexOf('service.') === 0 ||\n\t\toperation.indexOf('queue.') === 0 ||\n\t\toperation.indexOf('email.') === 0 ||\n\t\toperation.indexOf('ai.') === 0 ||\n\t\toperation.indexOf('workflow.') === 0 ||\n\t\toperation.indexOf('var.') === 0\n\tif (!isNamespaced) {\n\t\tthrow new Error(createUnsupportedBridgeOperationErrorMessage(bindingName, operation))\n\t}\n\n\t// KV\n\tif (operation === 'kv.get') return binding.get(params[0], params[1])\n\tif (operation === 'kv.put') return binding.put(params[0], params[1], params[2])\n\tif (operation === 'kv.delete') return binding.delete(params[0])\n\tif (operation === 'kv.list') return binding.list(params[0])\n\tif (operation === 'kv.getWithMetadata') return binding.getWithMetadata(params[0], params[1])\n\n\t// DO get (returns DOStub reference)\n\tif (operation === 'do.get') {\n\t\treturn { __type: 'DOStub', binding: bindingName, id: params[0] }\n\t}\n\n\t// R2\n\tif (operation === 'r2.head') return serializeR2Object(await binding.head(params[0]))\n\tif (operation === 'r2.get') {\n\t\tconst obj = await binding.get(params[0], params[1])\n\t\tif (!obj) return null\n\t\tconst body = await obj.arrayBuffer()\n\t\treturn serializeR2ObjectBody(obj, arrayBufferToBase64(body))\n\t}\n\tif (operation === 'r2.put') {\n\t\tlet value = params[1]\n\t\tif (value && typeof value === 'object') {\n\t\t\tif (value.__type === 'ArrayBuffer' || value.__type === 'Uint8Array') {\n\t\t\t\tvalue = base64ToArrayBuffer(value.data)\n\t\t\t}\n\t\t}\n\t\treturn serializeR2Object(await binding.put(params[0], value, params[2]))\n\t}\n\tif (operation === 'r2.delete') return binding.delete(params[0])\n\tif (operation === 'r2.list') return serializeR2Objects(await binding.list(params[0]))\n\n\t// D1\n\tif (operation === 'd1.exec') return binding.exec(params[0])\n\tif (operation === 'd1.batch') {\n\t\tconst statements = params[0].map((s) => binding.prepare(s.sql).bind(...(s.bindings || [])))\n\t\treturn binding.batch(statements)\n\t}\n\tif (operation.indexOf('d1.stmt.') === 0) {\n\t\tconst mode = operation.split('.')[2]\n\t\tconst [sql, ...rest] = params\n\t\tlet bindings = rest\n\t\tlet extraParam\n\t\tif (mode === 'first' || mode === 'raw') {\n\t\t\textraParam = rest[rest.length - 1]\n\t\t\tbindings = rest.slice(0, -1)\n\t\t}\n\t\tlet stmt = binding.prepare(sql)\n\t\tif (bindings.length > 0) stmt = stmt.bind(...bindings)\n\t\tif (mode === 'first') {\n\t\t\tif (typeof extraParam === 'string' && extraParam.length > 0) return stmt.first(extraParam)\n\t\t\treturn stmt.first()\n\t\t}\n\t\tif (mode === 'all') return stmt.all()\n\t\tif (mode === 'run') return stmt.run()\n\t\tif (mode === 'raw') return stmt.raw(extraParam)\n\t\tthrow new Error('Unknown stmt mode: ' + mode)\n\t}\n\n\t// Durable Objects\n\tif (operation === 'do.idFromName') {\n\t\tconst ns = resolveDoNamespace(binding, params[1])\n\t\tconst id = ns.idFromName(params[0])\n\t\treturn { __type: 'DOId', hex: id.toString() }\n\t}\n\tif (operation === 'do.idFromString') {\n\t\tconst id = binding.idFromString(params[0])\n\t\treturn { __type: 'DOId', hex: id.toString() }\n\t}\n\tif (operation === 'do.newUniqueId') {\n\t\tconst ns = resolveDoNamespace(binding, params[1])\n\t\tconst id = ns.newUniqueId(params[0])\n\t\treturn { __type: 'DOId', hex: id.toString() }\n\t}\n\tif (operation === 'do.fetch') {\n\t\tconst [, serializedId, serializedReq] = params\n\t\tconst id = binding.idFromString(serializedId.hex)\n\t\tconst stub = binding.get(id)\n\t\tconst response = await stub.fetch(new Request(serializedReq.url, {\n\t\t\tmethod: serializedReq.method,\n\t\t\theaders: serializedReq.headers,\n\t\t\tbody: serializedReq.body?.type === 'bytes'\n\t\t\t\t? base64ToArrayBuffer(serializedReq.body.data)\n\t\t\t\t: undefined\n\t\t}))\n\t\treturn serializeResponse(response)\n\t}\n\tif (operation === 'do.rpc') {\n\t\tconst [, serializedId, methodName, args] = params\n\t\tconst id = binding.idFromString(serializedId.hex)\n\t\tconst stub = binding.get(id)\n\t\treturn callDurableObjectRpc(stub, methodName, Array.isArray(args) ? args : [])\n\t}\n\n\t// Service Bindings\n\tif (operation === 'service.fetch') {\n\t\tif (!binding || typeof binding.fetch !== 'function') {\n\t\t\tthrow new Error('Service binding ' + bindingName + ' does not support fetch()')\n\t\t}\n\t\tconst response = await binding.fetch(deserializeRequest(params[0]))\n\t\treturn serializeResponse(response)\n\t}\n\tif (operation === 'service.rpc') {\n\t\tconst methodName = params[0]\n\t\tif (typeof methodName !== 'string') {\n\t\t\tthrow new Error('Service binding ' + bindingName + ' RPC method name must be a string')\n\t\t}\n\t\tconst args = Array.isArray(params[1]) ? params[1] : []\n\t\tconst method = binding && binding[methodName]\n\t\tif (typeof method !== 'function') {\n\t\t\tthrow new Error('Service binding ' + bindingName + ' does not support ' + methodName + '()')\n\t\t}\n\t\treturn method.apply(binding, args)\n\t}\n\n\t// Queues\n\tif (operation === 'queue.send') return binding.send(params[0], params[1])\n\tif (operation === 'queue.sendBatch') return binding.sendBatch(params[0], params[1])\n\n\t// Send Email\n\tif (operation === 'email.send') {\n\t\tif (binding && typeof binding.send === 'function') {\n\t\t\tconst message = params[0]\n\t\t\tif (message && typeof message === 'object' && 'from' in message && 'to' in message && 'raw' in message) {\n\t\t\t\treturn binding.send({\n\t\t\t\t\tfrom: message.from,\n\t\t\t\t\tto: message.to,\n\t\t\t\t\t[RAW_EMAIL]: createEmailMessageRaw(message.raw)\n\t\t\t\t})\n\t\t\t}\n\t\t\treturn binding.send(message)\n\t\t}\n\t\treturn { ok: true, simulated: true }\n\t}\n\n\t// Workflows\n\tif (operation === 'workflow.create') {\n\t\treturn serializeWorkflowInstance(await binding.create(params[0]))\n\t}\n\tif (operation === 'workflow.get') {\n\t\treturn serializeWorkflowInstance(await binding.get(params[0]))\n\t}\n\tif (operation === 'workflow.status') {\n\t\treturn (await binding.get(params[0])).status()\n\t}\n\tif (operation === 'workflow.pause') {\n\t\treturn (await binding.get(params[0])).pause()\n\t}\n\tif (operation === 'workflow.resume') {\n\t\treturn (await binding.get(params[0])).resume()\n\t}\n\tif (operation === 'workflow.terminate') {\n\t\treturn (await binding.get(params[0])).terminate()\n\t}\n\tif (operation === 'workflow.restart') {\n\t\treturn (await binding.get(params[0])).restart()\n\t}\n\tif (operation === 'workflow.sendEvent') {\n\t\treturn (await binding.get(params[0])).sendEvent(params[1])\n\t}\n\n\t// AI / generic run()\n\tif (operation === 'ai.run') {\n\t\tif (typeof binding.run !== 'function') {\n\t\t\tthrow new Error('Binding ' + bindingName + ' does not support run(): ' + method)\n\t\t}\n\t\treturn binding.run(params[0], params[1])\n\t}\n\n\tthrow new Error('Unknown operation: ' + method)\n}\n\nfunction createUnsupportedBridgeOperationErrorMessage(bindingName, operation) {\n\tconst base = \"[devflare][bridge] Unsupported bridge operation '\" + operation + \"' for binding '\" + bindingName + \"'.\"\n\tif (operation === 'fetch') {\n\t\treturn base + ' Devflare could not dispatch fetch() for this binding through the local bridge. '\n\t\t\t+ 'Expected Cloudflare API: env.' + bindingName + '.fetch(request). '\n\t\t\t+ 'If this came from SvelteKit platform.env, make sure the binding is declared as a service binding; '\n\t\t\t+ 'this is a Devflare local bridge issue when service bindings fall back to a bare fetch operation.'\n\t}\n\tif (operation === 'toString') {\n\t\treturn base + ' A platform.env value was coerced to a string through the bridge. '\n\t\t\t+ 'For SvelteKit local dev, declared vars should be plain string values and missing env names should read as undefined.'\n\t}\n\treturn base + ' Bare verbs and the legacy stmt.*/stub.* sub-prefixes are not supported; '\n\t\t+ 'use the namespaced form (e.g. kv.get, r2.put, d1.stmt.first, do.fetch, service.fetch).'\n}\n\nfunction serializeWorkflowInstance(instance) {\n\treturn {\n\t\t__type: 'WorkflowInstance',\n\t\tid: instance.id\n\t}\n}\n\n// ---------------------------------------------------------------------------\n// WebSocket bridge (shared with src/bridge/server.ts in shape)\n// ---------------------------------------------------------------------------\n// NOTE: wsProxies is intentionally created per handleBridgeWebSocket call so\n// state never leaks across connections or across gateway-script regenerations.\n\nasync function handleBridgeRpcCall(msg, ws, env, ctx) {\n\ttry {\n\t\tconst result = await executeRpcMethod(msg.method, msg.params, env, ctx)\n\t\tws.send(JSON.stringify({ t: 'rpc.ok', id: msg.id, result }))\n\t} catch (error) {\n\t\tws.send(JSON.stringify({\n\t\t\tt: 'rpc.err',\n\t\t\tid: msg.id,\n\t\t\terror: {\n\t\t\t\tcode: error?.code || 'INTERNAL_ERROR',\n\t\t\t\tmessage: error?.message || String(error)\n\t\t\t}\n\t\t}))\n\t}\n}\n\nasync function handleBridgeWsOpen(msg, ws, env, wsProxies) {\n\ttry {\n\t\tconst binding = env[msg.target.binding]\n\t\tconst id = binding.idFromString(msg.target.id)\n\t\tconst stub = binding.get(id)\n\n\t\tconst headers = new Headers(msg.target.headers || [])\n\t\theaders.set('Upgrade', 'websocket')\n\n\t\tconst response = await stub.fetch(new Request(msg.target.url, { method: 'GET', headers }))\n\t\tconst doWs = response.webSocket\n\n\t\tif (!doWs) {\n\t\t\tws.send(JSON.stringify({\n\t\t\t\tt: 'rpc.err',\n\t\t\t\tid: 'ws_' + msg.wid,\n\t\t\t\terror: { code: 'WS_FAILED', message: 'No WebSocket returned' }\n\t\t\t}))\n\t\t\treturn\n\t\t}\n\n\t\tdoWs.accept()\n\t\twsProxies.set(msg.wid, { doWs })\n\n\t\tdoWs.addEventListener('message', (event) => {\n\t\t\tconst isText = typeof event.data === 'string'\n\t\t\tconst payload = isText\n\t\t\t\t? new TextEncoder().encode(event.data)\n\t\t\t\t: new Uint8Array(event.data)\n\t\t\tconst flags = isText ? 2 : 0\n\t\t\tws.send(encodeWsDataFrame(msg.wid, flags, payload))\n\t\t})\n\n\t\tdoWs.addEventListener('close', (event) => {\n\t\t\tws.send(JSON.stringify({ t: 'ws.close', wid: msg.wid, code: event.code, reason: event.reason }))\n\t\t\twsProxies.delete(msg.wid)\n\t\t})\n\n\t\tws.send(JSON.stringify({ t: 'ws.opened', wid: msg.wid }))\n\t} catch (error) {\n\t\tws.send(JSON.stringify({\n\t\t\tt: 'rpc.err',\n\t\t\tid: 'ws_' + msg.wid,\n\t\t\terror: { code: 'WS_FAILED', message: error.message }\n\t\t}))\n\t}\n}\n\nfunction handleBridgeWsClose(msg, wsProxies) {\n\tconst proxy = wsProxies.get(msg.wid)\n\tif (proxy) {\n\t\tproxy.doWs.close(msg.code, msg.reason)\n\t\twsProxies.delete(msg.wid)\n\t}\n}\n\n// Relay an inbound binary WsData frame (client -> DO). Mirrors server.ts\n// handleBinaryMessage: decode the frame, look up the proxy by ws id, and forward\n// the payload to the DO socket honoring the TEXT flag.\nfunction handleBridgeBinaryMessage(buffer, wsProxies) {\n\tconst frame = decodeWsDataFrame(buffer)\n\tif (!frame || frame.kind !== 2) return\n\tconst proxy = wsProxies.get(frame.id)\n\tif (!proxy) return\n\tif ((frame.flags & 2) !== 0) {\n\t\tproxy.doWs.send(new TextDecoder().decode(frame.payload))\n\t} else {\n\t\tproxy.doWs.send(frame.payload)\n\t}\n}\n\nasync function handleBridgeJsonMessage(data, ws, env, ctx, wsProxies) {\n\tconst msg = JSON.parse(data)\n\tswitch (msg.t) {\n\t\tcase 'hello':\n\t\t\t// v2 handshake \u2014 acknowledge with welcome echoing the negotiated\n\t\t\t// capability intersection. The gateway advertises only what it\n\t\t\t// implements end-to-end: 'ws-relay' (binary WsData relay to/from DO\n\t\t\t// sockets) and 'http-transfer' (the R2 transfer HTTP side-channel).\n\t\t\t// 'streams' is intentionally NOT advertised \u2014 large DO/service-fetch\n\t\t\t// responses are inlined, not streamed, in this gateway.\n\t\t\tws.send(JSON.stringify({\n\t\t\t\tt: 'welcome',\n\t\t\t\tprotocolVersion: 2,\n\t\t\t\tcapabilities: ['ws-relay', 'http-transfer']\n\t\t\t\t\t.filter((c) => Array.isArray(msg.capabilities) && msg.capabilities.includes(c))\n\t\t\t\t\t.sort()\n\t\t\t}))\n\t\t\tbreak\n\t\tcase 'rpc.call':\n\t\t\tawait handleBridgeRpcCall(msg, ws, env, ctx)\n\t\t\tbreak\n\t\tcase 'ws.open':\n\t\t\tawait handleBridgeWsOpen(msg, ws, env, wsProxies)\n\t\t\tbreak\n\t\tcase 'ws.close':\n\t\t\thandleBridgeWsClose(msg, wsProxies)\n\t\t\tbreak\n\t}\n}\n\n// Pass-through DO WebSocket upgrade (bridge client -> gateway -> DO).\n//\n// The bridge client's openDoWebSocket() opens a REAL loopback WebSocket to this\n// endpoint (/_devflare/do-ws?binding&id&u) instead of tunneling frames over the\n// bridge socket. We resolve the DO by id and RETURN the DO's 101 response\n// verbatim (webSocket included), so miniflare wires the inbound connection to\n// the DO's client socket. That genuine inbound connection is what makes workerd\n// dispatch the DO's hibernation handlers (webSocketMessage/webSocketClose) and\n// deliver ctx.getWebSockets() broadcasts. Pumping the DO socket in-process (the\n// legacy handleBridgeWsOpen path) never triggers hibernation, so two sockets to\n// one getByName(id) could not see each other's messages. This mirrors the\n// browser WS_ROUTES pass-through (handleDoWebSocket) and real Cloudflare.\n//\n// NOTE: the devflare/test gateway (src/test/simple-context-gateway-script.ts)\n// keeps a byte-equivalent copy of this handler because it is a separately-bundled\n// Worker template that cannot import this runtime \u2014 keep the two in sync.\nasync function handleBridgeDoWebSocket(request, env, url) {\n\ttry {\n\t\tconst bindingName = url.searchParams.get('binding')\n\t\tconst idHex = url.searchParams.get('id')\n\t\tconst targetUrl = url.searchParams.get('u') || url.toString()\n\n\t\tconst binding = env[bindingName]\n\t\tif (!binding || typeof binding.idFromString !== 'function') {\n\t\t\treturn new Response('Durable Object binding not found: ' + bindingName, { status: 500 })\n\t\t}\n\t\tif (!idHex) {\n\t\t\treturn new Response('Missing Durable Object id', { status: 400 })\n\t\t}\n\n\t\tconst stub = binding.get(binding.idFromString(idHex))\n\t\t// Forward the real upgrade request (its headers carry any auth/cookies the\n\t\t// caller passed to connect()) and pass the DO's 101 response straight back.\n\t\treturn stub.fetch(new Request(targetUrl, { method: 'GET', headers: request.headers }))\n\t} catch (error) {\n\t\treturn new Response('Error opening DO WebSocket: ' + (error?.message || String(error)), {\n\t\t\tstatus: 500\n\t\t})\n\t}\n}\n\nfunction handleBridgeWebSocket(request, env, ctx) {\n\tconst { 0: client, 1: server } = new WebSocketPair()\n\tserver.accept()\n\n\t// Per-connection state: recreated for every bridge client so reloads and\n\t// concurrent clients never share WS proxy entries.\n\tconst wsProxies = new Map()\n\n\tserver.addEventListener('message', async (event) => {\n\t\ttry {\n\t\t\tif (typeof event.data === 'string') {\n\t\t\t\tawait handleBridgeJsonMessage(event.data, server, env, ctx, wsProxies)\n\t\t\t} else {\n\t\t\t\thandleBridgeBinaryMessage(event.data, wsProxies)\n\t\t\t}\n\t\t} catch (error) {\n\t\t\tconsole.error('[Gateway] Error:', error)\n\t\t}\n\t})\n\n\tserver.addEventListener('close', () => {\n\t\tfor (const proxy of wsProxies.values()) {\n\t\t\t// Best-effort cleanup: the DO-side WS may already be closed or in an\n\t\t\t// invalid state; any throw here would abort sibling closes. Surface\n\t\t\t// the swallowed error when DEVFLARE_DEBUG_BRIDGE is enabled.\n\t\t\ttry { proxy.doWs.close() } catch (error) {\n\t\t\t\tif (globalThis.DEVFLARE_DEBUG_BRIDGE) {\n\t\t\t\t\tconsole.warn('[devflare:bridge] proxy.doWs.close() failed', error)\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\twsProxies.clear()\n\t})\n\n\treturn new Response(null, { status: 101, webSocket: client })\n}\n\n// ---------------------------------------------------------------------------\n// HTTP transfer for R2 bodies (shared with src/bridge/server.ts in shape)\n// ---------------------------------------------------------------------------\n\nasync function handleHttpTransfer(request, env, url) {\n\tconst transferIdEncoded = url.pathname.split('/').pop()\n\tconst transferId = decodeURIComponent(transferIdEncoded || '')\n\tconst [binding, ...keyParts] = transferId.split(':')\n\tconst key = keyParts.join(':')\n\tconst bucket = env[binding]\n\n\tif (!bucket) return new Response('Bucket not found: ' + binding, { status: 404 })\n\n\tif (request.method === 'PUT' || request.method === 'POST') {\n\t\tconst result = await bucket.put(key, request.body)\n\t\treturn new Response(JSON.stringify(serializeR2Object(result)), {\n\t\t\theaders: { 'Content-Type': 'application/json' }\n\t\t})\n\t}\n\n\tif (request.method === 'GET') {\n\t\tconst object = await bucket.get(key)\n\t\tif (!object) return new Response('Not found', { status: 404 })\n\t\treturn new Response(object.body, {\n\t\t\theaders: {\n\t\t\t\t'Content-Type': object.httpMetadata?.contentType || 'application/octet-stream',\n\t\t\t\t'Content-Length': String(object.size)\n\t\t\t}\n\t\t})\n\t}\n\n\treturn new Response('Method not allowed', { status: 405 })\n}\n";
+//# sourceMappingURL=gateway-runtime.d.ts.map

package/dist/bridge/gateway-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-runtime.d.ts","sourceRoot":"","sources":["../../src/bridge/gateway-runtime.ts"],"names":[],"mappings":"AAcA;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,6wzBA6rB9B,CAAA"}

package/dist/bridge/index.d.ts

@@ -1,7 +1,7 @@
-export { type JsonMsg, type RpcCall, type RpcOk, type RpcErr, type StreamPull, type StreamOpen, type StreamEnd, type StreamAbort, type WsOpen, type WsOpened, type WsClose, type EventMsg, type HttpTransfer, type DecodedBinaryFrame, BinaryKind, BinaryFlags, BINARY_HEADER_SIZE, encodeBinaryFrame, decodeBinaryFrame, isFin, isText, parseJsonMsg, stringifyJsonMsg, nextRpcId, nextStreamId, nextWsId, resetIdCounters, DEFAULT_CHUNK_SIZE, HTTP_TRANSFER_THRESHOLD, DEFAULT_BRIDGE_PORT, DEFAULT_HTTP_PORT } from './protocol';
-export { type SerializedRequest, type SerializedResponse, type BodyRef, serializeRequest, deserializeRequest, serializeResponse, deserializeResponse, serializeValue, deserializeValue, serializeDOId } from './serialization';
-export { type BridgeClientOptions, type PendingCall, BridgeClient, getClient } from './client';
-export { type EnvProxyOptions, type BindingHints, createEnvProxy, bridgeEnv, env, initEnv, setBindingHints } from './proxy';
-export { startMiniflare, startMiniflareFromConfig, getMiniflare, stopMiniflare, type MiniflareInstance, type MiniflareOptions } from './miniflare';
-export { default as gateway } from './server';
+export { type JsonMsg, type RpcCall, type RpcOk, type RpcErr, type StreamPull, type StreamOpen, type StreamEnd, type StreamAbort, type WsOpen, type WsOpened, type WsClose, type EventMsg, type HttpTransfer, type DecodedBinaryFrame, BinaryKind, BinaryFlags, BINARY_HEADER_SIZE, encodeBinaryFrame, decodeBinaryFrame, isFin, isText, parseJsonMsg, stringifyJsonMsg, nextRpcId, nextStreamId, nextWsId, resetIdCounters, DEFAULT_CHUNK_SIZE, HTTP_TRANSFER_THRESHOLD, DEFAULT_BRIDGE_PORT, DEFAULT_HTTP_PORT } from './v2/wire.js';
+export { type SerializedRequest, type SerializedResponse, type BodyRef, serializeRequest, deserializeRequest, serializeResponse, deserializeResponse, serializeValue, deserializeValue, serializeDOId } from './v2/value-serialization.js';
+export { type BridgeClientOptions, type PendingCall, BridgeClient, getClient } from './client.js';
+export { type EnvProxyOptions, type BindingHints, createEnvProxy, bridgeEnv, initEnv, setBindingHints } from './proxy.js';
+export { startMiniflare, startMiniflareFromConfig, getMiniflare, stopMiniflare, type MiniflareInstance, type MiniflareOptions } from './miniflare.js';
+export { default as gateway } from './server.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/bridge/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/bridge/index.ts"],"names":[],"mappings":"AAKA,OAAO,EACN,KAAK,OAAO,EACZ,KAAK,OAAO,EACZ,KAAK,KAAK,EACV,KAAK,MAAM,EACX,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,MAAM,EACX,KAAK,QAAQ,EACb,KAAK,OAAO,EACZ,KAAK,QAAQ,EACb,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,UAAU,EACV,WAAW,EACX,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,EACL,MAAM,EACN,YAAY,EACZ,gBAAgB,EAChB,SAAS,EACT,YAAY,EACZ,QAAQ,EACR,eAAe,EACf,kBAAkB,EAClB,uBAAuB,EACvB,mBAAmB,EACnB,iBAAiB,EACjB,MAAM,YAAY,CAAA;AAGnB,OAAO,EACN,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,OAAO,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,EACjB,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,MAAM,iBAAiB,CAAA;AAGxB,OAAO,EACN,KAAK,mBAAmB,EACxB,KAAK,WAAW,EAChB,YAAY,EACZ,SAAS,EACT,MAAM,UAAU,CAAA;AAGjB,OAAO,EACN,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,cAAc,EACd,SAAS,EACT,GAAG,EACH,OAAO,EACP,eAAe,EACf,MAAM,SAAS,CAAA;AAGhB,OAAO,EACN,cAAc,EACd,wBAAwB,EACxB,YAAY,EACZ,aAAa,EACb,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,MAAM,aAAa,CAAA;AAGpB,OAAO,EAAE,OAAO,IAAI,OAAO,EAAE,MAAM,UAAU,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/bridge/index.ts"],"names":[],"mappings":"AAKA,OAAO,EACN,KAAK,OAAO,EACZ,KAAK,OAAO,EACZ,KAAK,KAAK,EACV,KAAK,MAAM,EACX,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,MAAM,EACX,KAAK,QAAQ,EACb,KAAK,OAAO,EACZ,KAAK,QAAQ,EACb,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,UAAU,EACV,WAAW,EACX,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,EACL,MAAM,EACN,YAAY,EACZ,gBAAgB,EAChB,SAAS,EACT,YAAY,EACZ,QAAQ,EACR,eAAe,EACf,kBAAkB,EAClB,uBAAuB,EACvB,mBAAmB,EACnB,iBAAiB,EACjB,MAAM,WAAW,CAAA;AAGlB,OAAO,EACN,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,OAAO,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,EACjB,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,MAAM,0BAA0B,CAAA;AAGjC,OAAO,EACN,KAAK,mBAAmB,EACxB,KAAK,WAAW,EAChB,YAAY,EACZ,SAAS,EACT,MAAM,UAAU,CAAA;AAGjB,OAAO,EACN,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,cAAc,EACd,SAAS,EACT,OAAO,EACP,eAAe,EACf,MAAM,SAAS,CAAA;AAGhB,OAAO,EACN,cAAc,EACd,wBAAwB,EACxB,YAAY,EACZ,aAAa,EACb,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,MAAM,aAAa,CAAA;AAGpB,OAAO,EAAE,OAAO,IAAI,OAAO,EAAE,MAAM,UAAU,CAAA"}

package/dist/bridge/log.d.ts

@@ -0,0 +1,5 @@
+export declare const bridgeLog: {
+    warn(message: string, error?: unknown): void;
+    debug(message: string, error?: unknown): void;
+};
+//# sourceMappingURL=log.d.ts.map

package/dist/bridge/log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"log.d.ts","sourceRoot":"","sources":["../../src/bridge/log.ts"],"names":[],"mappings":"AAkBA,eAAO,MAAM,SAAS;IACrB,IAAI,UAAU,MAAM,UAAU,OAAO,GAAG,IAAI;IAI5C,KAAK,UAAU,MAAM,UAAU,OAAO,GAAG,IAAI;CAI7C,CAAA"}

package/dist/bridge/miniflare-gateway.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Local presign context for a running Miniflare instance: the HTTP origin the
+ * gateway listens on plus the per-boot HMAC secret it validates presigned R2
+ * URLs with. Feed these to `presignR2Put`/`presignR2Get` (as
+ * `DEVFLARE_R2_PRESIGN_ORIGIN`/`DEVFLARE_R2_PRESIGN_SECRET` env values) to
+ * mint URLs this instance accepts.
+ */
+export interface R2PresignContext {
+    /** Gateway HTTP origin, e.g. `http://127.0.0.1:8787`. */
+    origin: string;
+    /** Per-boot HMAC signing secret shared with the gateway worker. */
+    secret: string;
+}
+/** Binding-map shapes accepted by Miniflare options (array or name → id record). */
+type NamedBindings = string[] | Record<string, string> | undefined;
+/** Whether a Miniflare binding map actually declares at least one binding. */
+export declare function hasNamedBindings(bindings: NamedBindings): boolean;
+/**
+ * Generates a lightweight HTTP-only gateway worker script for
+ * `startMiniflare()` usage (tests, scripts, programmatic access).
+ *
+ * The RPC dispatch logic is shared with `dev-server/gateway-script.ts` via
+ * `GATEWAY_RUNTIME_JS`, and the local presigned-R2 endpoint via
+ * `R2_PRESIGN_RUNTIME_JS`. This gateway exposes the dispatcher over a plain
+ * HTTP endpoint (`POST /_devflare/rpc`). The full WebSocket bridge with
+ * streaming and WebSocket proxying lives in `./server.ts` / the dev-server
+ * gateway.
+ */
+export declare function generateGatewayScript(): string;
+/**
+ * Ensure a per-boot R2 presign secret is present in the worker bindings when
+ * R2 buckets are configured, so the embedded gateway endpoint can validate
+ * presigned URLs. Respects a caller-provided secret; returns a `null` context
+ * (and the options untouched) when the instance has no R2 buckets.
+ */
+export declare function resolveR2PresignSetup<TOptions extends {
+    r2Buckets?: NamedBindings;
+    port?: number;
+    bindings?: Record<string, unknown>;
+}>(options: TOptions): {
+    options: TOptions;
+    r2Presign: R2PresignContext | null;
+};
+export {};
+//# sourceMappingURL=miniflare-gateway.d.ts.map

package/dist/bridge/miniflare-gateway.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"miniflare-gateway.d.ts","sourceRoot":"","sources":["../../src/bridge/miniflare-gateway.ts"],"names":[],"mappings":"AAWA;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAChC,yDAAyD;IACzD,MAAM,EAAE,MAAM,CAAA;IACd,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAA;CACd;AAED,oFAAoF;AACpF,KAAK,aAAa,GAAG,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAA;AAElE,8EAA8E;AAC9E,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,aAAa,GAAG,OAAO,CAUjE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,CA2C9C;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACpC,QAAQ,SAAS;IAChB,SAAS,CAAC,EAAE,aAAa,CAAA;IACzB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAClC,EACA,OAAO,EAAE,QAAQ,GAAG;IAAE,OAAO,EAAE,QAAQ,CAAC;IAAC,SAAS,EAAE,gBAAgB,GAAG,IAAI,CAAA;CAAE,CAuB9E"}

package/dist/bridge/miniflare.d.ts

@@ -1,8 +1,16 @@
 import type { Miniflare as MiniflareType } from 'miniflare';
-import { type DevflareConfig } from '../config';
+import { type DevflareConfig } from '../config/index.js';
+import { type LocalSecretWrappedBindingConfig } from '../secrets/local-secrets.js';
+import { type R2PresignContext } from './miniflare-gateway.js';
+export type { R2PresignContext } from './miniflare-gateway.js';
 export interface MiniflareInstance {
     /** Ready promise - resolves when Miniflare is ready */
     ready: Promise<void>;
+    /**
+     * Local R2 presign context. Present when the instance was started with R2
+     * buckets; `null` otherwise.
+     */
+    r2Presign: R2PresignContext | null;
     /** Dispose the Miniflare instance */
     dispose(): Promise<void>;
     /** Get bindings directly from Miniflare */
@@ -20,6 +28,7 @@ export interface MiniflareInstance {
     /** The underlying Miniflare instance */
     _mf: MiniflareType;
 }
+export declare function isIgnorableMiniflareDisposeError(error: unknown): boolean;
 export interface MiniflareOptions {
     /** Devflare config to derive bindings from */
     config?: DevflareConfig;
@@ -44,13 +53,94 @@ export interface MiniflareOptions {
     d1Databases?: string[] | Record<string, string>;
     /** Queue bindings */
     queues?: string[];
+    /** Rate Limiting bindings */
+    rateLimits?: Record<string, {
+        simple: {
+            limit: number;
+            period: 10 | 60;
+        };
+    }>;
+    /** Version Metadata binding name */
+    versionMetadata?: string;
+    /** Worker Loader bindings */
+    workerLoaders?: Record<string, Record<string, never>>;
+    /** mTLS Certificate bindings */
+    mtlsCertificates?: Record<string, {
+        certificate_id: string;
+        remote?: boolean;
+    }>;
+    /** Dispatch Namespace bindings */
+    dispatchNamespaces?: Record<string, {
+        namespace: string;
+    }>;
+    /** Workflow bindings */
+    workflows?: Record<string, {
+        name: string;
+        className: string;
+        scriptName?: string;
+        stepLimit?: number;
+    }>;
+    /** Pipeline bindings */
+    pipelines?: Record<string, string | {
+        pipeline: string;
+    }>;
+    /** Images binding */
+    images?: {
+        binding: string;
+    };
+    /** Media Transformations binding */
+    media?: {
+        binding: string;
+    };
+    /** Analytics Engine dataset bindings */
+    analyticsEngine?: Record<string, {
+        dataset: string;
+    }>;
+    /** Tail consumer service names (cross-Worker tail delivery) */
+    tailConsumers?: string[];
+    /** Streaming tail consumer service names (cross-Worker streaming tail delivery) */
+    streamingTailConsumers?: string[];
+    /** Artifacts bindings */
+    artifacts?: Record<string, {
+        namespace: string;
+    }>;
+    /** Secrets Store bindings */
+    secretsStore?: Record<string, {
+        store_id: string;
+        secret_name: string;
+    }>;
+    /** Send Email bindings */
+    sendEmail?: Record<string, {
+        destinationAddress?: string;
+        allowedDestinationAddresses?: string[];
+        allowedSenderAddresses?: string[];
+        remote?: boolean;
+    }>;
     /** Environment variables */
-    bindings?: Record<string, string>;
+    bindings?: Record<string, unknown>;
+    /** Service bindings */
+    serviceBindings?: Record<string, {
+        name: string;
+        entrypoint?: string;
+    }>;
+    /** Wrapped bindings to expose object-shaped local binding shims */
+    wrappedBindings?: LocalSecretWrappedBindingConfig['wrappedBindings'];
+    /** Additional module workers needed by wrapped bindings */
+    auxiliaryWorkers?: LocalSecretWrappedBindingConfig['workers'];
+    /** Node-side binding shims merged into `getBindings()` results */
+    nodeBindingOverrides?: Record<string, unknown>;
+    /** Project root used to load `.dev.vars`/`.env*` for config-based Miniflare */
+    cwd?: string;
+    /** Config file path used as the anchor for `.dev.vars`/`.env*` */
+    configPath?: string;
+    /** Cloudflare environment name used for local dev var file selection */
+    environment?: string;
     /** Compatibility date */
     compatibilityDate?: string;
     /** Compatibility flags */
     compatibilityFlags?: string[];
 }
+export declare function createMiniflareInstanceHandle(mf: MiniflareType, primaryWorkerName?: string, nodeBindingOverrides?: Record<string, unknown>, r2Presign?: R2PresignContext | null): MiniflareInstance;
 /**
  * Start a Miniflare instance with the given configuration
  */

package/dist/bridge/miniflare.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"miniflare.d.ts","sourceRoot":"","sources":["../../src/bridge/miniflare.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,WAAW,CAAA;AAC3D,OAAO,EAAsB,KAAK,cAAc,EAA6B,MAAM,WAAW,CAAA;AAM9F,MAAM,WAAW,iBAAiB;IACjC,uDAAuD;IACvD,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;IACpB,qCAAqC;IACrC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IACxB,2CAA2C;IAC3C,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IAC/C,kDAAkD;IAClD,cAAc,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAA;IAC/C,+CAA+C;IAC/C,WAAW,EAAE,aAAa,CAAC,aAAa,CAAC,CAAA;IACzC,iDAAiD;IACjD,aAAa,EAAE,aAAa,CAAC,eAAe,CAAC,CAAA;IAC7C,qDAAqD;IACrD,yBAAyB,EAAE,aAAa,CAAC,2BAA2B,CAAC,CAAA;IACrE,2CAA2C;IAC3C,aAAa,EAAE,aAAa,CAAC,eAAe,CAAC,CAAA;IAC7C,wCAAwC;IACxC,GAAG,EAAE,aAAa,CAAA;CAClB;AAED,MAAM,WAAW,gBAAgB;IAChC,8CAA8C;IAC9C,MAAM,CAAC,EAAE,cAAc,CAAA;IACvB,2CAA2C;IAC3C,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,2BAA2B;IAC3B,OAAO,CAAC,EAAE,OAAO,GAAG,MAAM,CAAA;IAC1B,gDAAgD;IAChD,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,6BAA6B;IAC7B,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,yCAAyC;IACzC,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC3E,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChD,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC7C,yEAAyE;IACzE,WAAW,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/C,qBAAqB;IACrB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,4BAA4B;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACjC,yBAAyB;IACzB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,0BAA0B;IAC1B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAA;CAC7B;AAwLD;;GAEG;AACH,wBAAsB,cAAc,CAAC,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA+F/F;AAMD;;GAEG;AACH,wBAAsB,wBAAwB,CAC7C,MAAM,EAAE,cAAc,EACtB,OAAO,GAAE,OAAO,CAAC,gBAAgB,CAAM,GACrC,OAAO,CAAC,iBAAiB,CAAC,CA+B5B;AAQD;;GAEG;AACH,wBAAsB,YAAY,CAAC,OAAO,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAKzF;AAED;;GAEG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAKnD"}
+{"version":3,"file":"miniflare.d.ts","sourceRoot":"","sources":["../../src/bridge/miniflare.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,WAAW,CAAA;AAC3D,OAAO,EACN,KAAK,cAAc,EAcnB,MAAM,WAAW,CAAA;AAOlB,OAAO,EACN,KAAK,+BAA+B,EAGpC,MAAM,0BAA0B,CAAA;AAGjC,OAAO,EACN,KAAK,gBAAgB,EAIrB,MAAM,qBAAqB,CAAA;AAE5B,YAAY,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAM3D,MAAM,WAAW,iBAAiB;IACjC,uDAAuD;IACvD,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;IACpB;;;OAGG;IACH,SAAS,EAAE,gBAAgB,GAAG,IAAI,CAAA;IAClC,qCAAqC;IACrC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IACxB,2CAA2C;IAC3C,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IAC/C,kDAAkD;IAClD,cAAc,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAA;IAC/C,+CAA+C;IAC/C,WAAW,EAAE,aAAa,CAAC,aAAa,CAAC,CAAA;IACzC,iDAAiD;IACjD,aAAa,EAAE,aAAa,CAAC,eAAe,CAAC,CAAA;IAC7C,qDAAqD;IACrD,yBAAyB,EAAE,aAAa,CAAC,2BAA2B,CAAC,CAAA;IACrE,2CAA2C;IAC3C,aAAa,EAAE,aAAa,CAAC,eAAe,CAAC,CAAA;IAC7C,wCAAwC;IACxC,GAAG,EAAE,aAAa,CAAA;CAClB;AAED,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAOxE;AAED,MAAM,WAAW,gBAAgB;IAChC,8CAA8C;IAC9C,MAAM,CAAC,EAAE,cAAc,CAAA;IACvB,2CAA2C;IAC3C,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,2BAA2B;IAC3B,OAAO,CAAC,EAAE,OAAO,GAAG,MAAM,CAAA;IAC1B,gDAAgD;IAChD,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,6BAA6B;IAC7B,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,yCAAyC;IACzC,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC3E,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChD,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC7C,yEAAyE;IACzE,WAAW,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/C,qBAAqB;IACrB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,6BAA6B;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,EAAE,GAAG,EAAE,CAAA;SAAE,CAAA;KAAE,CAAC,CAAA;IAC3E,oCAAoC;IACpC,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,6BAA6B;IAC7B,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAA;IACrD,gCAAgC;IAChC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;IAC/E,kCAAkC;IAClC,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC1D,wBAAwB;IACxB,SAAS,CAAC,EAAE,MAAM,CACjB,MAAM,EACN;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAC5E,CAAA;IACD,wBAAwB;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACzD,qBAAqB;IACrB,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;IAC5B,oCAAoC;IACpC,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;IAC3B,wCAAwC;IACxC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACrD,+DAA+D;IAC/D,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,mFAAmF;IACnF,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAA;IACjC,yBAAyB;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACjD,6BAA6B;IAC7B,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACxE,0BAA0B;IAC1B,SAAS,CAAC,EAAE,MAAM,CACjB,MAAM,EACN;QACC,kBAAkB,CAAC,EAAE,MAAM,CAAA;QAC3B,2BAA2B,CAAC,EAAE,MAAM,EAAE,CAAA;QACtC,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAA;QACjC,MAAM,CAAC,EAAE,OAAO,CAAA;KAChB,CACD,CAAA;IACD,4BAA4B;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAClC,uBAAuB;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACvE,mEAAmE;IACnE,eAAe,CAAC,EAAE,+BAA+B,CAAC,iBAAiB,CAAC,CAAA;IACpE,2DAA2D;IAC3D,gBAAgB,CAAC,EAAE,+BAA+B,CAAC,SAAS,CAAC,CAAA;IAC7D,kEAAkE;IAClE,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC9C,+EAA+E;IAC/E,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,kEAAkE;IAClE,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,wEAAwE;IACxE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,yBAAyB;IACzB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,0BAA0B;IAC1B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAA;CAC7B;AAicD,wBAAgB,6BAA6B,CAC5C,EAAE,EAAE,aAAa,EACjB,iBAAiB,CAAC,EAAE,MAAM,EAC1B,oBAAoB,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,EAClD,SAAS,GAAE,gBAAgB,GAAG,IAAW,GACvC,iBAAiB,CAuCnB;AAMD;;GAEG;AACH,wBAAsB,cAAc,CAAC,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAa/F;AAMD;;GAEG;AACH,wBAAsB,wBAAwB,CAC7C,MAAM,EAAE,cAAc,EACtB,OAAO,GAAE,OAAO,CAAC,gBAAgB,CAAM,GACrC,OAAO,CAAC,iBAAiB,CAAC,CAmO5B;AAQD;;GAEG;AACH,wBAAsB,YAAY,CAAC,OAAO,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAKzF;AAED;;GAEG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAKnD"}

package/dist/bridge/proxy.d.ts

@@ -1,15 +1,18 @@
-import { type BridgeClient } from './client';
+import { type BridgeClient } from './client.js';
 export interface EnvProxyOptions {
     /** Bridge client to use (uses default if not provided) */
     client?: BridgeClient;
     /** Lazily connect on first access */
     lazy?: boolean;
+    /** Return undefined for names that are not present in binding hints */
+    strict?: boolean;
     /** Transform results before returning (e.g., for transport decoding) */
     transformResult?: (result: unknown) => unknown;
 }
 /** Binding type hints for better proxy creation */
+export type BindingHint = 'kv' | 'r2' | 'd1' | 'do' | 'queue' | 'ai' | 'service' | 'sendEmail' | 'workflow' | 'secret' | 'var';
 export interface BindingHints {
-    [key: string]: 'kv' | 'r2' | 'd1' | 'do' | 'queue' | 'ai' | 'service' | 'secret' | 'var';
+    [key: string]: BindingHint;
 }
 /**
  * Create an env proxy that routes all binding access through the bridge
@@ -18,12 +21,14 @@ export declare function createEnvProxy(options?: EnvProxyOptions & {
     hints?: BindingHints;
 }): Record<string, unknown>;
 /**
- * Get the global env proxy for bridge RPC
+ * Get the global env proxy for bridge RPC.
  *
- * Note: This is distinct from the published `import { env } from 'devflare'`
- * proxy, which provides unified request/test/bridge-aware access.
- * Use `bridgeEnv` for standalone internal bridge usage and `env` from the
- * main package within request handlers and normal test flows.
+ * @internal
+ * Internal bridge surface — not part of the documented public API. Prefer
+ * `import { env } from 'devflare'`, which transparently picks the right
+ * source (request context, test context, or bridge) for the current
+ * environment. `bridgeEnv` is retained as an internal escape hatch for the
+ * bridge implementation itself and may change without a major version bump.
  *
  * @example
  * ```ts
@@ -32,10 +37,6 @@ export declare function createEnvProxy(options?: EnvProxyOptions & {
  * ```
  */
 export declare const bridgeEnv: Record<string, unknown>;
-/**
- * @deprecated Use `bridgeEnv` instead to avoid confusion with runtime `env`
- */
-export declare const env: Record<string, unknown>;
 /**
  * Initialize the env proxy with specific options
  */

package/dist/bridge/proxy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../../src/bridge/proxy.ts"],"names":[],"mappings":"AAMA,OAAO,EAAa,KAAK,YAAY,EAAE,MAAM,UAAU,CAAA;AAYvD,MAAM,WAAW,eAAe;IAC/B,0DAA0D;IAC1D,MAAM,CAAC,EAAE,YAAY,CAAA;IACrB,qCAAqC;IACrC,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,wEAAwE;IACxE,eAAe,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,OAAO,CAAA;CAC9C;AA0aD,mDAAmD;AACnD,MAAM,WAAW,YAAY;IAC5B,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,OAAO,GAAG,IAAI,GAAG,SAAS,GAAG,QAAQ,GAAG,KAAK,CAAA;CACxF;AAKD;;GAEG;AACH,wBAAgB,cAAc,CAAC,OAAO,GAAE,eAAe,GAAG;IAAE,KAAK,CAAC,EAAE,YAAY,CAAA;CAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAsEhH;AAqED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAO5C,CAAA;AAEF;;GAEG;AACH,eAAO,MAAM,GAAG,yBAAY,CAAA;AAE5B;;GAEG;AACH,wBAAgB,OAAO,CAAC,OAAO,GAAE,eAAoB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAG9E;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI,CAIzD"}
+{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../../src/bridge/proxy.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,KAAK,YAAY,EAAa,MAAM,UAAU,CAAA;AAavD,MAAM,WAAW,eAAe;IAC/B,0DAA0D;IAC1D,MAAM,CAAC,EAAE,YAAY,CAAA;IACrB,qCAAqC;IACrC,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,uEAAuE;IACvE,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,wEAAwE;IACxE,eAAe,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,OAAO,CAAA;CAC9C;AAooBD,mDAAmD;AACnD,MAAM,MAAM,WAAW,GACpB,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,OAAO,GACP,IAAI,GACJ,SAAS,GACT,WAAW,GACX,UAAU,GACV,QAAQ,GACR,KAAK,CAAA;AAER,MAAM,WAAW,YAAY;IAC5B,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW,CAAA;CAC1B;AAKD;;GAEG;AACH,wBAAgB,cAAc,CAC7B,OAAO,GAAE,eAAe,GAAG;IAAE,KAAK,CAAC,EAAE,YAAY,CAAA;CAAO,GACtD,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAoFzB;AAwFD;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAO5C,CAAA;AAEF;;GAEG;AACH,wBAAgB,OAAO,CAAC,OAAO,GAAE,eAAoB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAG9E;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI,CAIzD"}