Release Version 1

.changeset/README.md

@@ -0,0 +1,8 @@
+# Changesets
+
+Hello and welcome! This folder has been automatically generated by `@changesets/cli`, a build tool that works
+with multi-package repos, or single-package repos to help you version and publish your code. You can
+find the full documentation for it [in our repository](https://github.com/changesets/changesets).
+
+We have a quick list of common questions to get you started engaging with this project in
+[our documentation](https://github.com/changesets/changesets/blob/main/docs/common-questions.md).

.changeset/bridge-do-websocket-fix.md

@@ -0,0 +1,24 @@
+---
+"devflare": patch
+---
+
+Fix the Durable Object WebSocket relay through the live dev gateway, and harden
+proxied-response limits:
+
+- **DO WebSocket `stub.connect()` was broken in both directions.** The live
+  gateway (`gateway-runtime.ts`) and the bridge client disagreed on the WS-data
+  wire format: the client sent/expected binary `WsData` frames while the gateway
+  only read string frames inbound and emitted a JSON `ws.data` envelope outbound,
+  so every payload was silently dropped. The gateway now speaks the same binary
+  `WsData` frame format as the client (matching `wire.ts`/`server.ts`) in both
+  directions, honoring the TEXT flag. Added an end-to-end integration test that
+  round-trips binary (both directions) and a text frame through the real gateway.
+- **Oversized proxied responses now throw a clear error** instead of being
+  silently truncated. DO and service-binding `fetch()` responses reached through
+  the bridge are delivered inline over the WebSocket and are capped at 512 KB
+  (workerd's ~1 MB message limit); a larger body now throws, with the boundary
+  documented in the Cloudflare support matrix. Large R2 objects remain exempt
+  (HTTP transfer side-channel).
+- The gateway handshake now advertises only the capabilities it actually
+  implements end-to-end (`ws-relay`, `http-transfer`); `streams` is no longer
+  advertised since proxied responses are inlined, not streamed.

.changeset/cf-binding-remote-preview-fields.md

@@ -0,0 +1,12 @@
+---
+"devflare": minor
+---
+
+Model the `remote` flag and preview/jurisdiction/migration fields on the core
+resource bindings. KV, D1, R2, queue producers, and service bindings now accept
+`remote?: boolean` (use the real remote resource during local dev), and KV
+(`previewId`), D1 (`previewDatabaseId`, `migrationsTable`, `migrationsDir`), and
+R2 (`previewBucketName`, `jurisdiction`) accept their preview/jurisdiction/
+migration fields — all compiled to the matching wrangler keys. R2 buckets and
+queue producers now accept an object form (`{ bucketName | queue, remote, … }`)
+in addition to the existing string shorthand, which keeps working unchanged.

.changeset/cf-cron-fetch-lint-secrets.md

@@ -0,0 +1,16 @@
+---
+"devflare": minor
+---
+
+Add build-time safety checks and cron validation. Cron expressions are now
+validated against Cloudflare's 5-field grammar (`src/config/cron.ts`) at
+config-parse time (a `.superRefine()` on `triggers.crons`) and in
+`cf.scheduled.trigger(cron)`, so a typo like `cf.scheduled.trigger('* * *')`
+fails with an actionable message instead of silently passing. The explicit
+2-arg fetch-handler style requirement is now also checked at dev-start / `build`
+time (`validateFetchHandlerStyle()` in the shared worker-load chokepoint),
+reusing the exact same resolver and style markers as the request-time check —
+zero false positives, with the runtime check kept as the backstop. Finally, a
+successful **production** deploy prints a one-line hint that runtime secrets are
+set via `wrangler secret put` / the dashboard (devflare never sends secret
+values to Cloudflare); the hint never fires on preview or dry-run deploys.

.changeset/cf-deploy-lifecycle.md

@@ -0,0 +1,11 @@
+---
+"devflare": minor
+---
+
+Add deploy-lifecycle parity. `devflare deploy --prod --percentage <n>` performs a
+gradual/canary rollout (uploads a new version with `wrangler versions upload`,
+then shifts `<n>%` of traffic to it via `wrangler versions deploy <id>@<n>`, with
+an optional `--version` to pin the version keeping the remainder) — production
+only, never shifting traffic on preview/dry-run. New `devflare tail` command
+streams a deployed worker's live logs over Cloudflare's tail API (`--format
+pretty|json`, clean teardown on exit).

.changeset/cf-local-dev-wiring.md

@@ -0,0 +1,11 @@
+---
+"devflare": minor
+---
+
+Wire deploy-modeled-only bindings into local development. Analytics Engine now
+binds in local dev (Miniflare's write-only no-op stub, so `writeDataPoint()` no
+longer throws), tail consumers are delivered locally when the consumer Worker is
+present in the same dev instance (the tail handler was already testable via
+`cf.tail.trigger()`), and the mTLS `remote` flag is forwarded to the local
+binding so deploy and local dev agree on the binding shape. Wired consistently
+across the dev server, the cross-process bridge, and the test context.

.changeset/cf-stale-claims.md

@@ -0,0 +1,10 @@
+---
+"devflare": patch
+---
+
+Correct stale offline-support classifications. Durable Objects and Service
+bindings are no longer mislabelled "no offline support" — they run fully locally
+under `createTestContext()` (Miniflare executes the DO class / resolves the
+service binding), classified honestly as offline-native with the caveat that
+there is no pure in-memory `createMockEnv()` mock for them. (Vectorize was
+reclassified to an offline fixture in the previous release.)

.changeset/cf-stream-vpc-flagship-bindings.md

@@ -0,0 +1,14 @@
+---
+"devflare": minor
+---
+
+Add first-class support for three more Cloudflare bindings: **Stream**
+(`bindings.stream`), **VPC** (`bindings.vpcServices` / `bindings.vpcNetworks`),
+and **Flagship** (`bindings.flagship`). Each is schema-validated, compiled to the
+matching wrangler keys (`stream`, `vpc_services`, `vpc_networks`, `flagship`),
+typed on the generated `env`, and documented in the support matrix. Stream runs
+locally through Miniflare with a deterministic pure mock (`createMockStreamBinding`)
+for hosted operations; Flagship has a configured-value pure mock
+(`createMockFlagshipBinding`) — its local Miniflare plugin returns call defaults,
+not evaluated flags; VPC services/networks are a remote boundary (Miniflare only
+proxies them) testable via a custom fake injected through `createMockEnv`.

.changeset/cf-test-dx.md

@@ -0,0 +1,13 @@
+---
+"devflare": minor
+---
+
+Close the test/offline DX gaps. New `createMockVectorize()` (in-memory vector
+store with cosine `query`, metadata filters, insert/upsert/delete/getByIds) and
+`createMockAnalyticsEngine()` (write-only recording stub) let you unit-test those
+bindings offline; Vectorize is reclassified to an offline fixture. New
+`cf.alarm.trigger()` fires a Durable Object `alarm()` handler in tests, the same
+way the runtime does. And `createOfflineBindings()` now auto-wires the KV/D1/R2/
+queues mocks when those bindings are declared without an explicit fixture, so
+`env.MY_KV` is bound offline instead of undefined (an explicit fixture still
+overrides).

.changeset/cf11-deployments-subcommand.md

@@ -0,0 +1,14 @@
+---
+"devflare": minor
+---
+
+Add a read-only `devflare productions deployments` subcommand that lists a
+Worker's full chronological deployment history (deployed-at, deployment id,
+strategy, per-version traffic split, source, triggered-by, and message) via the
+already-wired account API — the same read path `productions list` / `versions`
+use, with no new write surface. Previously only the latest deployment summary
+(`list`) and per-version timestamps (`versions`) were exposed.
+
+Also documents the deploy-only `observability`, `placement`, and `limits`
+top-level config keys in the Cloudflare support matrix (they were already
+modeled and compiled; only their support tier was undocumented).

.changeset/cf13-sendemail-offline-parity.md

@@ -0,0 +1,15 @@
+---
+"devflare": minor
+---
+
+Bring the `sendEmail` binding to full pure-offline test parity. `createOfflineEnv()`
+and `createMockEnv({ sendEmail })` now auto-wire a deterministic
+`createMockSendEmail()` — a recording SendEmail mock that captures every
+dispatched message into `.sentEmails` while enforcing the configured
+sender/destination allow-lists — so `env.MY_EMAIL.send(...)` is assertable in
+pure unit tests without Miniflare. `describeOfflineSupport('sendEmail')` is now
+classified `offline-native` (previously it fell through to a false
+`remote-boundary`). `createMockSendEmail` and the underlying
+`createLocalSendEmailBinding` are exported from `devflare/test`. This was the last
+mockable binding without offline auto-wiring; every binding family is now both
+auto-wired offline and classified in the support matrix.

.changeset/cf15-server-livereload-cf.md

@@ -0,0 +1,16 @@
+---
+"devflare": minor
+---
+
+Add two more local-dev `server` options, threaded into Miniflare's
+`CoreSharedOptions` alongside the existing `https`/`inspectorPort`/`upstream`:
+
+- `server.liveReload` — inject Miniflare's in-browser live-reload script so the
+  page auto-refreshes when the dev runtime reloads (complements Devflare's own
+  source watcher).
+- `server.cf` — override the local `request.cf` (`IncomingRequestCfProperties`):
+  `false` omits it, a string is a path to a JSON file, and an object injects
+  custom cf metadata (colo, country, TLS, bot management, …) for testing cf-aware
+  code under `devflare dev` without Cloudflare.
+
+Both are local-dev only with no deploy effect.

.changeset/cf17-streaming-tail-environment-fix.md

@@ -0,0 +1,13 @@
+---
+"devflare": patch
+---
+
+Fix `streamingTailConsumers` rejecting `environment` at config-parse time.
+Wrangler's `StreamingTailConsumer` accepts only `service` (`additionalProperties:
+false`) — unlike `tailConsumers`, it has no `environment` field. The object form
+previously modeled an optional `environment` (mirrored from `tailConsumers`),
+which devflare accepted and compiled into the Wrangler config, so a config that
+set it validated locally but failed at deploy. `environment` is now removed from
+the streaming-tail schema, input type, and compiler output, so it is rejected up
+front with a clear error — keeping local validation equivalent to a deploy-valid
+config. (The regular `tailConsumers` `environment` field is unchanged.)

.changeset/cf19-do-environment-subfield.md

@@ -0,0 +1,14 @@
+---
+"devflare": minor
+---
+
+Model the Durable Objects binding `environment` sub-field. A cross-worker DO
+binding (`scriptName` set) may now carry `environment` — the service-environment
+of the target script — which compiles to wrangler's
+`durable_objects.bindings[].environment`. Previously the field was unmodeled and,
+because the DO binding predicate is not strict, a user-supplied `environment` was
+silently dropped before deploy (validate-locally ≠ deploy-valid). It is now
+threaded through normalization and emitted for cross-worker DOs only (a local DO
+without `scriptName` drops it). This brings per-binding `environment` support in
+line with wrangler across every binding type that accepts it (service bindings,
+dispatch-namespace outbound, and now Durable Objects).

.changeset/cf21-service-environment-fold.md

@@ -0,0 +1,14 @@
+---
+"devflare": patch
+---
+
+Fix service bindings emitting an unsupported `environment` field. Wrangler's
+`services` config item is `additionalProperties: false` and addresses a target
+environment via the service **name** (`<worker_name>-<environment_name>`), not a
+separate `environment` field — so a config that set `environment` on a service
+binding compiled to a wrangler config that fails deploy validation. The
+ergonomic `environment` input is kept, but it is now **folded into the emitted
+`service` name** (`<service>-<environment>`) instead of emitted as a separate
+field, so local validation once again matches a deploy-valid config. (Local
+Miniflare wiring already used the base service name — environments are a deploy
+concept.)

.changeset/cf25-route-flags-and-dev-knobs.md

@@ -0,0 +1,19 @@
+---
+"devflare": minor
+---
+
+Fix route flags being emitted on the wrong route type, and add the remaining
+local-dev `server` knobs.
+
+- **Route `enabled` / `previews_enabled`** are valid only on a **custom-domain**
+  route — wrangler's `zone_id` / `zone_name` route shapes are
+  `additionalProperties: false` and reject them. Devflare now rejects them at
+  config-parse time on non-custom-domain routes (with a clear error) and emits
+  them only for custom-domain routes, so a config that validates locally is
+  deploy-valid (previously `{ pattern, zone_id, enabled: true }` parsed but
+  failed at deploy).
+- **`server.inspectorHost`**, **`server.verbose`**, and **`server.logRequests`**
+  are now accepted on the dev `server` config and threaded into Miniflare's
+  shared options — the remaining user-facing local-dev knobs alongside
+  `https`/`inspectorPort`/`upstream`/`liveReload`/`cf`. Local-dev only, no deploy
+  effect.

.changeset/cf28-server-public-url.md

@@ -0,0 +1,13 @@
+---
+"devflare": patch
+---
+
+Add the `server.publicUrl` local-dev knob.
+
+`publicUrl` is the public-facing URL the local dev runtime advertises for itself
+(served on Miniflare's `/core/public-url` loopback; otherwise the runtime entry
+URL) — set it when the dev runtime sits behind a reverse proxy, tunnel, or custom
+domain so the Worker reports the externally-visible origin. It maps to Miniflare's
+`publicUrl` and is the final user-facing `CoreSharedOptions` knob, a sibling of the
+already-wired `upstream`/`cf`/`liveReload`. Local-dev only — no deploy effect (no
+wrangler analogue).

.changeset/cf9-config-coverage-gaps.md

@@ -0,0 +1,31 @@
+---
+"devflare": minor
+---
+
+Close the remaining Cloudflare config-coverage gaps found by a fresh
+dependency-grounded re-investigation (wrangler 4.85.0 / miniflare 4.20260424.0 /
+workers-types 4.20260426.1). Each field mirrors an existing sibling and stays
+backward-compatible.
+
+Locally wired into dev/test Miniflare:
+- Queue producer `deliveryDelay` (→ `delivery_delay`).
+- Service binding `props` (object exposed to the target Worker via `ctx.props`).
+- `streamingTailConsumers` (→ `streaming_tail_consumers`, wired to Miniflare
+  `streamingTails`, a full twin of `tailConsumers`).
+- `server` config now also accepts `https` / `httpsKeyPath` / `httpsCertPath` /
+  `inspectorPort` / `upstream` (local HTTPS dev, custom inspector port, upstream).
+- Cache API contents now persist across dev-server restarts (`cachePersist`).
+- New dev/test-only `outboundService` option to route a Worker's outbound
+  `fetch()` to a named service for local cross-service testing.
+
+Compiled for deploy:
+- Queue consumer `visibilityTimeoutMs` (→ `visibility_timeout_ms`).
+- Top-level `complianceRegion` (`'public' | 'fedramp_high'`).
+- Top-level `workersDev` toggle (was hardcoded `true`; still defaults to `true`).
+- Custom-domain route `enabled` / `previewsEnabled`.
+- `sendEmail` binding `remote` flag — emitted for deploy; Miniflare has no local
+  `remote` for `send_email`, so it is a deploy-time directive (stripped locally,
+  same as mTLS).
+
+Legacy Worker `site` (static assets) is documented as passthrough-reachable via
+`wrangler.passthrough` (superseded by `assets`).

.changeset/ci-quality-gates.md

@@ -0,0 +1,10 @@
+---
+"devflare": patch
+---
+
+Fix default service-binding RPC worker discovery: `resolveServiceBindings` /
+`findDefaultServiceWorkerEntrypoint` now also resolve a package's root-level
+`worker.{ts,js}` (not only `src/worker.{ts,js}`), so a referenced worker that
+keeps its entrypoint at the package root exposes its default RPC surface in
+local tests and dev. (Also: internal quality gates — biome lint is now enforced
+on the published package and releases are gated on typecheck + unit tests.)

.changeset/cloudflare-deploy-policy-flags.md

@@ -0,0 +1,11 @@
+---
+"devflare": minor
+---
+
+Add three first-class top-level Cloudflare deploy-policy config options: `logpush`, `uploadSourceMaps`, and `keepVars` (all `boolean`).
+
+- `logpush` — send Trace Events from this Worker to Workers Logpush (does not create a Logpush job). Compiles to the Wrangler `logpush` key.
+- `uploadSourceMaps` — include source maps when uploading this Worker. Compiles to the Wrangler `upload_source_maps` key.
+- `keepVars` — keep dashboard-managed vars when Wrangler deploys this Worker (default `false`). Compiles to the Wrangler `keep_vars` key.
+
+All three are per-environment overridable like other deploy-surface scalars. They previously required `wrangler.passthrough`.

.changeset/cloudflare-matrix-accuracy.md

@@ -0,0 +1,22 @@
+---
+"devflare": patch
+---
+
+Make the Cloudflare support documentation accurate and surface offline-binding gaps:
+
+- Reconcile the docs-site support labels with the authoritative support matrix:
+  Hyperdrive, Browser Rendering, Worker Loaders, Images, Media Transformations,
+  and Analytics Engine are now marked **Limited** (each has a code-backed local
+  gap — e.g. Hyperdrive `connect()` and Worker Loaders `getDurableObjectClass()`
+  throw) instead of overstating them as Full.
+- Correct the matrix's Analytics Engine classification: it is **not** an inherent
+  remote-only boundary — it is simply not yet wired into the local Miniflare
+  worker (Miniflare's native plugin is a write-shape-only no-op).
+- Document that Static Assets (`assets`) and cross-worker Tail consumers
+  (`tailConsumers`) are compiled for deploy but not served/delivered locally, and
+  that Cron triggers' scheduled handlers are locally invokable via the test layer
+  (distinct from the wired `files.tail` handler surface).
+- `createOfflineEnv()` / `createOfflineBindings()` now report core storage
+  bindings (KV/D1/R2/Queues/Durable Objects/Services) that are present in config
+  but only available via `createTestContext()` as explicit `missingFixtures`
+  entries, instead of leaving `env.X` silently `undefined`.

.changeset/config.json

@@ -0,0 +1,11 @@
+{
+  "$schema": "https://unpkg.com/@changesets/config@3.1.4/schema.json",
+  "changelog": "@changesets/cli/changelog",
+  "commit": false,
+  "fixed": [],
+  "linked": [],
+  "access": "public",
+  "baseBranch": "next",
+  "updateInternalDependencies": "patch",
+  "ignore": []
+}

.changeset/deploy-secrets-guide.md

@@ -0,0 +1,9 @@
+---
+"devflare": patch
+---
+
+Clarify the Cloudflare permission-group display-name fallback warning: it now
+points maintainers at `refresh-permission-groups` (which regenerates the verified
+ids) instead of asking them to hand-edit the generated id map. Also adds a deploy
+& secrets maturity guide (auto-provisioning matrix, partial-deploy orphan
+behavior, secrets boundary, per-environment scoping, permission-group refresh).

.changeset/dev-server-host-port.md

@@ -0,0 +1,5 @@
+---
+"devflare": minor
+---
+
+Add `server` config option to set the `devflare dev` runtime instance host and port. Configure `server: { host, port }` in `devflare.config.ts` to control the address the local Miniflare runtime binds to. CLI flags (`--runtime-port`, `--runtime-host`) and environment variables (`DEVFLARE_RUNTIME_PORT`, `DEVFLARE_RUNTIME_HOST`) take precedence over the config value, which in turn overrides the `127.0.0.1:8787` default.

.changeset/docs-contract-honesty.md

@@ -0,0 +1,24 @@
+---
+"devflare": patch
+---
+
+Docs & contract-honesty fixes:
+
+- The README `devflare/config` row listed ~40 names that the lightweight config
+  entry never exported; it now lists the real surface (`defineConfig`, `env`,
+  `preview`, `ref`). The doc-integrity guard that should have caught this was
+  validating the wrong module (`src/config` instead of `src/config-entry`) — now
+  fixed, plus a new reverse guard asserts the exhaustively-listed entrypoints
+  document every public export, and a guard checks every README `/docs/` link
+  resolves to a real slug.
+- Document the previously-undocumented `vars` export (and the config error
+  classes) on the `devflare` row; note that `devflare/vite` re-exports Vite's
+  types (so type-checking it needs `vite` installed); fix two broken README
+  `/docs/` links; add `files.tail` to the full config examples.
+- Align `DEFAULT_BRIDGE_PORT`/`DEFAULT_HTTP_PORT` to the real dev runtime ports
+  (8787/8788) — the bare bridge-client auto-connect fallback pointed at a dead
+  8686 port.
+- Remove the contradictory orphan `event` control-message shape from the v2 aux
+  vocabulary before the wire surface freezes (the live consumer uses the
+  `EventMsg { topic, data }` shape); drop stale "to be implemented" comments from
+  the CLI dispatcher; clarify that `test:coverage` is unit-only.

.changeset/fix-typed-env-vars-proxy-assignability.md

@@ -0,0 +1,10 @@
+---
+"devflare": patch
+---
+
+Fix the typed `env` and `vars` runtime proxies so they are assignable to an
+augmented `DevflareEnv` / `DevflareVars`. The proxy factory inferred its type
+parameter from the internal getter (`Record<string, unknown>`) instead of the
+exported type, so any consumer that declared `vars` (giving `DevflareEnv` /
+`DevflareVars` required keys) hit a type error when importing `env` / `vars`
+from `devflare/runtime`. The proxies now carry their declared types explicitly.