@velajs/cloudflare 1.10.1 → 1.22.0

package/dist/index.d.ts

@@ -1,29 +1,19 @@
-import { AsyncCacheStore, DynamicModule, InjectionToken, RuntimeAdapter, Type, VelaApplication } from "@velajs/vela";
-import { ConnectedSocket, MessageBody, OnGatewayConnection, OnGatewayDisconnect, OnGatewayInit, SubscribeMessage, WebSocketGateway, WebSocketServer, WsClient, WsDispatcher, WsException, WsMessage, WsResponse, WsServer } from "@velajs/vela/websocket";
-import { CommitStamp, CursorLog, LiveDriver, ResumeVerdict } from "@velajs/vela/live";
+import { a as DoPitrId, c as DoPitrUnavailableError, d as isDoPitrUnavailable, f as readDoPitrBookmark, i as DoPitrBookmarkRead, l as VelaDoPitrRpc, n as DoPitrArmOptions, o as DoPitrNamespace, p as CloudflareRoot, r as DoPitrArmResult, s as DoPitrStorage, t as VelaNonceDurableObject, u as armDoPitr } from "./nonce.durable-object-Df3_42Sy.js";
+import { AsyncCacheStore, DynamicModule, InjectionToken, NonceStore, RuntimeAdapter, ThrottlerStore, Type, VelaApplication, VelaMiddlewareHandler, VelaSecurityOptions } from "@velajs/vela";
+import { BroadcastCommand, ConnectedSocket, MessageBody, OnGatewayConnection, OnGatewayDisconnect, OnGatewayInit, SubscribeMessage, WebSocketGateway, WebSocketGatewayOptions, WebSocketServer, WsClient, WsDispatcher, WsException, WsMessage, WsResponse, WsServer } from "@velajs/vela/websocket";
 import { DownloadResult, PresignMethod, PresignedUrlResult, StorageBody, StorageDriver, UploadOptions, UploadResult } from "@velajs/vela/storage";
-import { DurableObject } from "cloudflare:workers";
-import { Context, Hono, MiddlewareHandler } from "hono";
+import { CommitStamp, CursorLog, InvalidationCommand, LiveDriver, LiveEngine, LiveInvalidationSink, ResumeVerdict } from "@velajs/vela/live";
+import { Context, ExecutionContext } from "hono";
 import { FeatureFlagDriver, FlagContext } from "@velajs/feature-flags";
+//#region src/websocket/room-id.d.ts
+/** Stable, collision-free Durable Object name for one gateway's room. */
+export declare function durableObjectRoomName(gatewayPath: string, roomId: string): string;
+//#endregion
 //#region src/websocket/websocket-routing.d.ts
 interface WsGatewayRoute {
   path: string;
   binding: string;
-}
-//#endregion
-//#region src/types.d.ts
-interface CloudflareEnv {
-  [key: string]: unknown;
-}
-interface ScheduledRegistration {
-  instance: unknown;
-  methodName: string;
-  cron: string;
-}
-interface QueueRegistration {
-  instance: unknown;
-  methodName: string;
-  queueName: string;
+  options: WebSocketGatewayOptions;
 }
 //#endregion
 //#region src/cloudflare-application.d.ts
@@ -46,7 +36,7 @@ type MountOpenApiOptions = Parameters<VelaApplication['mountOpenApi']>[0];
  *
  * @example
  * ```ts
- * const app = await createCloudflareApp(AppModule);
+ * const app = await createCloudflareApp(AppModule, { env, envToken: ENV });
  * export default {
  *   fetch: app.fetch,
  *   scheduled: app.scheduled.bind(app),
@@ -57,32 +47,34 @@ type MountOpenApiOptions = Parameters<VelaApplication['mountOpenApi']>[0];
  * @example
  * ```ts
  * // Serve OpenAPI docs alongside your routes
- * const app = await createCloudflareApp(AppModule);
+ * const app = await createCloudflareApp(AppModule, { env, envToken: ENV });
  * const document = createOpenApiDocument(AppModule);
  * app.mountOpenApi({ document, ui: 'scalar' });
  * // GET /openapi.json -> JSON document
  * // GET /scalar       -> Scalar UI (loads from CDN)
  * ```
  */
-declare class CloudflareApplication {
+export declare class CloudflareApplication<T extends object = object> {
   private app;
+  readonly env: T;
   private wsGatewayRoutes;
-  constructor(app: VelaApplication);
-  get fetch(): Hono['fetch'];
-  getHonoApp(): Hono;
+  constructor(app: VelaApplication, env: T);
+  readonly fetch: (request: Request, env: T, ctx?: ExecutionContext) => Promise<Response>;
+  getHonoApp(): ReturnType<VelaApplication['getHonoApp']>;
   /**
    * Resolve a provider from the application's DI container (delegates to
    * `VelaApplication.get`). Handy for grabbing a service — e.g. an auth service —
-   * to use inside `createCloudflareApp({ middleware: [...] })` request middleware,
+   * to use inside `createCloudflareApp({ middleware: env => [...] })` request middleware,
    * which runs outside the DI request pipeline.
    *
    * @example
    * ```ts
-   * const app = await createCloudflareApp(AppModule);
-   * const auth = app.get<BetterAuthService>(BetterAuthService);
+   * const app = await createCloudflareApp(AppModule, { env, envToken: ENV });
+   * const auth = app.get(BetterAuthService);
    * ```
    */
-  get<T>(token: Parameters<VelaApplication['get']>[0]): T;
+  readonly get: VelaApplication['get'];
+  get entrypoints(): VelaApplication['entrypoints'];
   /**
    * Serve a pre-built OpenAPI document (and optionally a Scalar UI) on the
    * underlying Hono app. Delegates verbatim to `VelaApplication.mountOpenApi`,
@@ -94,7 +86,7 @@ declare class CloudflareApplication {
    * ```ts
    * import { createOpenApiDocument } from '@velajs/vela';
    *
-   * const app = await createCloudflareApp(AppModule);
+   * const app = await createCloudflareApp(AppModule, { env, envToken: ENV });
    * const document = createOpenApiDocument(AppModule, {
    *   info: { title: 'My API', version: '1.0.0' },
    * });
@@ -122,7 +114,7 @@ declare class CloudflareApplication {
   scheduled(event: {
     cron: string;
     scheduledTime?: number;
-  }, env: CloudflareEnv, ctx: {
+  }, env: T, ctx: {
     waitUntil: (promise: Promise<unknown>) => void;
   }): Promise<void>;
   /**
@@ -142,165 +134,57 @@ declare class CloudflareApplication {
    */
   queue(batch: {
     queue: string;
-    messages: unknown[];
-  }, env: CloudflareEnv, ctx: {
+    messages: readonly unknown[];
+  }, env: T, ctx: {
     waitUntil: (promise: Promise<unknown>) => void;
   }): Promise<void>;
   close(signal?: string): Promise<void>;
 }
 //#endregion
 //#region src/cloudflare-factory.d.ts
-/**
- * Options for {@link createCloudflareApp}.
- *
- * Mirrors a tight subset of vela's `BootstrapOptions` — only the surface
- * that makes sense for a Workers consumer is re-exposed.
- */
-interface CreateCloudflareAppOptions {
-  /**
-   * Forwarded to `VelaFactory.create({ globalPrefix })`. Prepended to every
-   * route registered by `@Controller(...)` (and any other route emitter)
-   * inside the application, so a value of `'/v1'` turns `@Controller('/users')`
-   * into `/v1/users`.
-   *
-   * @example
-   * ```ts
-   * const app = await createCloudflareApp(AppModule, { globalPrefix: '/v1' });
-   * ```
-   */
+interface CloudflareWorkerOptions<T extends object> {
+  /** Global typed DI token for the platform's native environment. */
+  envToken: InjectionToken<T>;
   globalPrefix?: string;
-  /**
-   * Extra Hono middleware to register on the underlying Hono app. Runs
-   * AFTER the one-time binding-init middleware this adapter mounts
-   * internally, so any handler in `middleware` can safely read from
-   * `BindingRef` instances and Cloudflare env bindings.
-   *
-   * @example
-   * ```ts
-   * const app = await createCloudflareApp(AppModule, {
-   *   middleware: [
-   *     async (c, next) => {
-   *       c.set('requestId', crypto.randomUUID());
-   *       await next();
-   *     },
-   *   ],
-   * });
-   * ```
-   */
-  middleware?: MiddlewareHandler[];
-}
-/**
- * Create a Cloudflare Workers application.
- *
- * Sets up a one-time Hono middleware that captures `c.env` on the first
- * request and initializes all configured binding refs. Optional
- * {@link CreateCloudflareAppOptions} are forwarded to the underlying
- * `VelaFactory.create` so consumers don't have to wrap the resulting
- * application in an outer Hono just to set a `globalPrefix` or attach
- * extra request middleware.
- *
- * @example
- * ```ts
- * // Minimal — backwards compatible
- * const app = await createCloudflareApp(AppModule);
- * export default app; // has .fetch, .scheduled, .queue
- * ```
- *
- * @example
- * ```ts
- * // With a global prefix and outer middleware
- * const app = await createCloudflareApp(AppModule, {
- *   globalPrefix: '/v1',
- *   middleware: [
- *     async (c, next) => {
- *       c.set('tenantId', c.req.header('x-tenant-id') ?? 'public');
- *       await next();
- *     },
- *   ],
- * });
- * ```
- */
+  security?: VelaSecurityOptions;
+  /** Build request middleware from the same typed native environment as DI. */
+  middleware?: (env: NoInfer<T>) => VelaMiddlewareHandler[];
+}
+interface CreateCloudflareAppOptions<T extends object> extends CloudflareWorkerOptions<T> {
+  /** Supply the platform environment inside fetch/queue/scheduled or a DO constructor. */
+  env: NoInfer<T>;
+}
+/** Bind an application to one environment before provider factories and lifecycle hooks. */
+export declare function cloudflareAdapter<T extends object>(options: CreateCloudflareAppOptions<T>): RuntimeAdapter;
+/** Build an application for one native Workers environment. Call inside a platform event. */
+export declare function createCloudflareApp<T extends object>(rootModule: CloudflareRoot<NoInfer<T>>, options: CreateCloudflareAppOptions<T>): Promise<CloudflareApplication<T>>;
 /**
- * The Cloudflare platform binding as a vela {@link RuntimeAdapter}: a one-time
- * request middleware captures `c.env` on the first request and initializes
- * every `BindingRef`/`EnvRef` (collected at `onBootstrap`, before any request
- * can arrive). Adapter `requestMiddleware` is prepended to the global chain by
- * `VelaFactory.create`, so user middleware can safely read binding refs.
- *
- * Exposed so consumers composing `VelaFactory.create` themselves can opt in:
- *
- * ```ts
- * const app = await VelaFactory.create(AppModule, { adapters: [cloudflareAdapter()] });
- * ```
+ * Worker entrypoint with one bootstrap per environment identity. Weak keys let
+ * obsolete environments and secrets be collected. Concurrent cold events share
+ * construction; failed construction is evicted so the next event can retry.
  */
-declare function cloudflareAdapter(): RuntimeAdapter;
-declare function createCloudflareApp(rootModule: Type, options?: CreateCloudflareAppOptions): Promise<CloudflareApplication>;
-//#endregion
-//#region src/binding-ref.d.ts
-declare class BindingRef<T = unknown> {
-  readonly bindingName: string;
-  private _value;
-  constructor(bindingName: string);
-  get value(): T;
-  /** @internal — called by createCloudflareApp middleware */
-  _initialize(value: T): void;
-}
-//#endregion
-//#region src/modules/create-binding-module.d.ts
-interface BindingModuleStatic {
-  forRoot(options: {
-    binding: string;
-  }): DynamicModule;
-}
-//#endregion
-//#region src/modules/kv.module.d.ts
-declare const KVModule: BindingModuleStatic;
-//#endregion
-//#region src/modules/d1.module.d.ts
-declare const D1Module: BindingModuleStatic;
-//#endregion
-//#region src/modules/r2.module.d.ts
-declare const R2Module: BindingModuleStatic;
-//#endregion
-//#region src/modules/queue.module.d.ts
-declare const QueueModule: BindingModuleStatic;
-//#endregion
-//#region src/modules/durable-object.module.d.ts
-declare const DurableObjectModule: BindingModuleStatic;
-//#endregion
-//#region src/modules/ai.module.d.ts
-declare const AIModule: BindingModuleStatic;
-//#endregion
-//#region src/modules/vectorize.module.d.ts
-declare const VectorizeModule: BindingModuleStatic;
-//#endregion
-//#region src/modules/hyperdrive.module.d.ts
-declare const HyperdriveModule: BindingModuleStatic;
-//#endregion
-//#region src/modules/env.module.d.ts
-/**
- * Provides {@link EnvService} GLOBALLY so any module's provider factories can
- * `inject: [EnvService]`. Register once on the root module:
- *
- * ```ts
- * @Module({ imports: [EnvModule.forRoot(), AuthModule.forRootAsync({ ... })] })
- * class AppModule {}
- * ```
- *
- * The {@link EnvRef} it provides is collected and initialized by
- * createCloudflareApp's binding-init middleware on the first request (the
- * factory passes it the full `env`, not a single binding).
- */
-declare class EnvModule {
-  static forRoot(): DynamicModule;
-}
+export declare function createCloudflareWorker<T extends object>(rootModule: CloudflareRoot<NoInfer<T>>, options: CloudflareWorkerOptions<T>): {
+  fetch(request: Request, env: T, ctx: ExecutionContext): Promise<Response>;
+  scheduled(event: {
+    cron: string;
+    scheduledTime?: number;
+  }, env: T, ctx: {
+    waitUntil: (promise: Promise<unknown>) => void;
+  }): Promise<void>;
+  queue(batch: {
+    queue: string;
+    messages: readonly unknown[];
+  }, env: T, ctx: {
+    waitUntil: (promise: Promise<unknown>) => void;
+  }): Promise<void>;
+};
 //#endregion
 //#region src/storage/storage.types.d.ts
 /** A named storage disk backed by an R2 bucket binding. */
 interface DiskConfig {
   disk: string;
-  /** R2Bucket binding name from wrangler.toml. */
-  binding: string;
+  /** Native bucket supplied by a typed environment provider factory. */
+  bucket: R2Bucket;
   /** Optional root prefix; supports path-template tokens ({date}/{year}/…). */
   root?: string;
 }
@@ -309,6 +193,8 @@ interface PresignedUrlConfig {
   maxExpiry: number;
 }
 interface StorageModuleOptions {
+  /** HMAC secret used for signed downloads. */
+  secret?: string;
   disks: DiskConfig[];
   defaultDisk: string;
   presignedUrl?: PresignedUrlConfig;
@@ -318,50 +204,7 @@ interface StorageModuleOptions {
 declare const ConfigurableModuleClass: import("@velajs/vela").ConfigurableModuleClassType<StorageModuleOptions, "forRoot", "create", {
   isGlobal?: boolean;
 }>;
-declare class StorageModule extends ConfigurableModuleClass {}
-//#endregion
-//#region src/env-ref.d.ts
-/**
- * Holds the entire Cloudflare Worker `env` record (bindings + vars/secrets),
- * not a single binding. Subclasses {@link BindingRef} so createCloudflareApp's
- * binding-init middleware collects and initializes it through the same path;
- * the factory special-cases it to pass the full `env` instead of one binding.
- */
-declare class EnvRef extends BindingRef<Record<string, unknown>> {
-  constructor();
-}
-//#endregion
-//#region src/services/env.service.d.ts
-/**
- * Injectable access to the full Cloudflare Worker `env` (bindings + vars +
- * secrets).
- *
- * The per-binding services (`D1Service`, `KVService`, …) each expose a single
- * binding, and the `@Env()` param decorator only works inside a request-scoped
- * controller handler. `EnvService` fills the gap: it can be injected into
- * PROVIDER FACTORIES — e.g. `SomeModule.forRootAsync({ inject: [EnvService] })`
- * — so a factory can read secrets/origins without reaching for the request.
- *
- * Reads are lazy. `env` only exists per request, so a factory (which runs at
- * bootstrap) must capture the `EnvService` and read inside its callback:
- *
- * ```ts
- * AuthModule.forRootAsync({
- *   inject: [EnvService],
- *   useFactory: (env: EnvService) => buildAuth(() => env.get<string>('AUTH_SECRET')),
- * });
- * ```
- *
- * Reading eagerly at bootstrap (`env.get(...)` before any request) throws.
- */
-declare class EnvService {
-  private ref;
-  constructor(ref: EnvRef);
-  /** The full env record. Throws if read before the first request. */
-  get env(): Record<string, unknown>;
-  /** Read a single env entry (binding, var, or secret) by name. */
-  get<T = unknown>(key: string): T | undefined;
-}
+export declare class StorageModule extends ConfigurableModuleClass {}
 //#endregion
 //#region src/storage/r2-storage.driver.d.ts
 interface R2StorageDriverConfig {
@@ -371,7 +214,7 @@ interface R2StorageDriverConfig {
   secret?: string;
 }
 /** {@link StorageDriver} over a Cloudflare R2 bucket. */
-declare class R2StorageDriver implements StorageDriver {
+export declare class R2StorageDriver implements StorageDriver {
   private readonly config;
   constructor(config: R2StorageDriverConfig);
   upload(body: StorageBody, path: string, options: UploadOptions): Promise<UploadResult>;
@@ -382,15 +225,9 @@ declare class R2StorageDriver implements StorageDriver {
 }
 //#endregion
 //#region src/storage/storage-manager.service.d.ts
-/**
- * Resolves R2 buckets by binding NAME (via {@link EnvService}) so multiple disks
- * coexist without registering N R2Modules. Drivers are created per call — cheap,
- * and avoids caching a per-request env value on this singleton.
- */
-declare class StorageManagerService {
+export declare class StorageManagerService {
   private readonly options;
-  private readonly env;
-  constructor(options: StorageModuleOptions, env: EnvService);
+  constructor(options: StorageModuleOptions);
   hasDisk(disk: string): boolean;
   getDiskConfig(disk: string): DiskConfig;
   getDriver(disk: string): R2StorageDriver;
@@ -401,7 +238,7 @@ declare class StorageManagerService {
  * Multi-disk storage facade. Applies each disk's (templated) root, resolves the
  * driver, and validates presign expiry. Injectable anywhere via `StorageService`.
  */
-declare class StorageService {
+export declare class StorageService {
   private readonly options;
   private readonly manager;
   constructor(options: StorageModuleOptions, manager: StorageManagerService);
@@ -420,105 +257,39 @@ declare class StorageService {
  * Presign-proxy: serves objects for HMAC-signed URLs produced by
  * `StorageService.url()`. R2 has no native presign, so a signed URL points here;
  * this route verifies the signature (+expiry) before streaming the object.
- * The wildcard is the FULL object path (root already applied at sign time), so
- * it is passed straight to the driver.
+ * The FULL object key (root already applied at sign time) is carried as an
+ * opaque base64url query claim. The signature is verified before the claim is
+ * decoded exactly once and checked against the configured disk root.
  */
-declare class StorageController {
+export declare class StorageController {
   private readonly manager;
-  private readonly env;
-  constructor(manager: StorageManagerService, env: EnvService);
+  private readonly options;
+  constructor(manager: StorageManagerService, options: StorageModuleOptions);
   download(c: Context): Promise<Response>;
 }
 //#endregion
 //#region src/storage/storage.tokens.d.ts
-declare const STORAGE_OPTIONS: InjectionToken<StorageModuleOptions>;
-//#endregion
-//#region src/services/kv.service.d.ts
-/**
- * Wrapper around a Cloudflare KV namespace binding.
- * Use `kv.namespace.get(...)`, `kv.namespace.put(...)`, etc. — the namespace
- * is the standard @cloudflare/workers-types `KVNamespace`.
- */
-declare class KVService {
-  private ref;
-  constructor(ref: BindingRef<KVNamespace>);
-  get namespace(): KVNamespace;
-}
+export declare const STORAGE_OPTIONS: InjectionToken<StorageModuleOptions>;
 //#endregion
 //#region src/services/kv-cache.store.d.ts
 /**
  * Cloudflare KV-backed {@link CacheStore}. Values are JSON-encoded. Intended as
  * the slow tier under a `TieredCacheStore` (memory L1 → KV L2), but usable
- * standalone as `CacheModule.forRootAsync({ inject: [KVService], useFactory: (kv) => ({ store: new KVCacheStore(kv) }) })`.
+ * standalone from a typed environment factory: `new KVCacheStore(env.CACHE)`.
+ * Reads return unknown JSON; validate values at the consuming boundary.
  *
  * Note: Cloudflare KV requires `expirationTtl >= 60s`, so sub-minute TTLs are
  * clamped up. Keep short TTLs on the memory tier; use KV for longer-lived entries.
  */
-declare class KVCacheStore implements AsyncCacheStore {
-  private readonly kv;
-  constructor(kv: KVService);
-  private get ns();
-  get<T = unknown>(key: string): Promise<T | undefined>;
-  set<T = unknown>(key: string, value: T, ttl?: number): Promise<void>;
+export declare class KVCacheStore implements AsyncCacheStore {
+  private readonly ns;
+  constructor(ns: KVNamespace);
+  get(key: string): Promise<unknown>;
+  set(key: string, value: unknown, ttl?: number): Promise<void>;
   del(key: string): Promise<void>;
   clear(): Promise<void>;
 }
 //#endregion
-//#region src/services/d1.service.d.ts
-declare class D1Service {
-  private ref;
-  constructor(ref: BindingRef<D1Database>);
-  get database(): D1Database;
-}
-//#endregion
-//#region src/services/r2.service.d.ts
-declare class R2Service {
-  private ref;
-  constructor(ref: BindingRef<R2Bucket>);
-  get bucket(): R2Bucket;
-}
-//#endregion
-//#region src/services/queue.service.d.ts
-declare class QueueService<Body = unknown> {
-  private ref;
-  constructor(ref: BindingRef<Queue<Body>>);
-  get queue(): Queue<Body>;
-}
-//#endregion
-//#region src/services/durable-object.service.d.ts
-declare class DurableObjectService {
-  private ref;
-  constructor(ref: BindingRef<DurableObjectNamespace>);
-  get namespace(): DurableObjectNamespace;
-}
-//#endregion
-//#region src/services/ai.service.d.ts
-declare class AIService {
-  private ref;
-  constructor(ref: BindingRef<Ai>);
-  get binding(): Ai;
-}
-//#endregion
-//#region src/services/vectorize.service.d.ts
-declare class VectorizeService {
-  private ref;
-  constructor(ref: BindingRef<VectorizeIndex>);
-  get index(): VectorizeIndex;
-}
-//#endregion
-//#region src/services/hyperdrive.service.d.ts
-declare class HyperdriveService {
-  private ref;
-  constructor(ref: BindingRef<Hyperdrive>);
-  get binding(): Hyperdrive;
-  get connectionString(): string;
-  get host(): string;
-  get port(): number;
-  get user(): string;
-  get password(): string;
-  get database(): string;
-}
-//#endregion
 //#region src/services/flagship-flag.driver.d.ts
 /**
  * The subset of a Cloudflare **Flagship** binding this driver evaluates against
@@ -532,7 +303,7 @@ interface FlagshipBinding {
   getBooleanValue(key: string, defaultValue: boolean, context?: FlagContext): Promise<boolean>;
   getStringValue(key: string, defaultValue: string, context?: FlagContext): Promise<string>;
   getNumberValue(key: string, defaultValue: number, context?: FlagContext): Promise<number>;
-  getObjectValue<T extends object>(key: string, defaultValue: T, context?: FlagContext): Promise<T>;
+  getObjectValue(key: string, defaultValue: object, context?: FlagContext): Promise<unknown>;
 }
 interface FlagshipFlagDriverOptions {
   /** Driver name used for `use(name)` / default-driver selection. Default `"flagship"`. */
@@ -548,16 +319,12 @@ interface FlagshipFlagDriverOptions {
  * dev-proxy tunnel dropping) propagates — `@velajs/feature-flags`'s service owns
  * the never-throw guarantee.
  *
- * The binding only exists per request in a Worker, so pass a lazy accessor when
- * wiring from a bootstrap factory (mirroring how {@link EnvService} reads are
- * deferred); a resolved binding may be passed directly in tests.
+ * Build the driver inside a provider factory with the native environment:
  *
  * ```ts
  * FeatureFlagsModule.forRootAsync({
- *   inject: [EnvService],
- *   useFactory: (env: EnvService) => ({
- *     drivers: [flagshipFlagDriver(() => env.get<FlagshipBinding>('FLAGS')!)],
- *   }),
+ *   inject: [ENV],
+ *   useFactory: (env: WorkerEnv) => ({ drivers: [flagshipFlagDriver(env.FLAGS)] }),
  * });
  * ```
  *
@@ -565,17 +332,17 @@ interface FlagshipFlagDriverOptions {
  * Stratal feature-flags service (MIT, © Temitayo Fadojutimi), reshaped as a
  * bare driver.
  */
-declare class FlagshipFlagDriver implements FeatureFlagDriver {
+export declare class FlagshipFlagDriver implements FeatureFlagDriver {
   readonly name: string;
   private readonly resolve;
   constructor(binding: FlagshipBinding | (() => FlagshipBinding), options?: FlagshipFlagDriverOptions);
   getBoolean(key: string, fallback: boolean, ctx?: FlagContext): Promise<boolean>;
   getString(key: string, fallback: string, ctx?: FlagContext): Promise<string>;
   getNumber(key: string, fallback: number, ctx?: FlagContext): Promise<number>;
-  getObject<T extends object>(key: string, fallback: T, ctx?: FlagContext): Promise<T>;
+  getObject(key: string, fallback: object, ctx?: FlagContext): Promise<unknown>;
 }
 /** Convenience factory for {@link FlagshipFlagDriver}. */
-declare function flagshipFlagDriver(binding: FlagshipBinding | (() => FlagshipBinding), options?: FlagshipFlagDriverOptions): FlagshipFlagDriver;
+export declare function flagshipFlagDriver(binding: FlagshipBinding | (() => FlagshipBinding), options?: FlagshipFlagDriverOptions): FlagshipFlagDriver;
 //#endregion
 //#region src/services/kv-flag.driver.d.ts
 interface KvFlagDriverOptions {
@@ -596,25 +363,24 @@ interface KvFlagDriverOptions {
  * guarantee lives in `@velajs/feature-flags`'s service layer.
  *
  * Placed like {@link KVCacheStore}: construct it in a wiring factory over a
- * resolved {@link KVService}.
+ * resolved {@link KVNamespace}.
  *
  * ```ts
  * FeatureFlagsModule.forRootAsync({
- *   inject: [KVService],
- *   useFactory: (kv: KVService) => ({ drivers: [new KvFlagDriver(kv, { prefix: 'flag:' })] }),
+ *   inject: [ENV],
+ *   useFactory: (env: WorkerEnv) => ({ drivers: [new KvFlagDriver(env.CACHE, { prefix: 'flag:' })] }),
  * });
  * ```
  */
-declare class KvFlagDriver implements FeatureFlagDriver {
-  private readonly kv;
+export declare class KvFlagDriver implements FeatureFlagDriver {
+  private readonly ns;
   readonly name: string;
   private readonly prefix;
-  constructor(kv: KVService, options?: KvFlagDriverOptions);
-  private get ns();
+  constructor(ns: KVNamespace, options?: KvFlagDriverOptions);
   getBoolean(key: string, fallback: boolean, _ctx?: FlagContext): Promise<boolean>;
   getString(key: string, fallback: string, _ctx?: FlagContext): Promise<string>;
   getNumber(key: string, fallback: number, _ctx?: FlagContext): Promise<number>;
-  getObject<T extends object>(key: string, fallback: T, _ctx?: FlagContext): Promise<T>;
+  getObject(key: string, fallback: object, _ctx?: FlagContext): Promise<unknown>;
   /**
    * Reads and JSON-parses the (prefixed) key, returning the parsed value only
    * when `matches` accepts its type; otherwise the caller's fallback. A missing
@@ -623,7 +389,7 @@ declare class KvFlagDriver implements FeatureFlagDriver {
   private read;
 }
 /** Convenience factory for {@link KvFlagDriver}. */
-declare function kvFlagDriver(kv: KVService, options?: KvFlagDriverOptions): KvFlagDriver;
+export declare function kvFlagDriver(kv: KVNamespace, options?: KvFlagDriverOptions): KvFlagDriver;
 //#endregion
 //#region src/decorators/env.d.ts
 /**
@@ -635,13 +401,13 @@ declare function kvFlagDriver(kv: KVService, options?: KvFlagDriverOptions): KvF
  * @example
  * ```ts
  * @Get()
- * handle(@Env() env: CloudflareEnv) { ... }
+ * handle(@Env() env: WorkerEnv) { ... }
  *
  * @Get()
  * handle(@Env('MY_KV') kv: KVNamespace) { ... }
  * ```
  */
-declare const Env: (data?: string | undefined, ...pipes: import("@velajs/vela").PipeType[]) => ParameterDecorator;
+export declare const Env: (data?: string | undefined, ...pipes: import("@velajs/vela").PipeType[]) => ParameterDecorator;
 //#endregion
 //#region src/decorators/scheduled.d.ts
 interface ScheduledMetadata {
@@ -662,7 +428,7 @@ interface ScheduledMetadata {
  * }
  * ```
  */
-declare function Scheduled(cron: string): MethodDecorator;
+export declare function Scheduled(cron: string): MethodDecorator;
 //#endregion
 //#region src/decorators/queue-consumer.d.ts
 interface QueueConsumerMetadata {
@@ -686,22 +452,7 @@ interface QueueConsumerMetadata {
  * }
  * ```
  */
-declare function QueueConsumer(queueName: string): MethodDecorator;
-//#endregion
-//#region src/websocket/websocket.durable-object.d.ts
-/**
- * Base class for the WebSocket Durable Object. The user exports a named subclass
- * (matching their `wrangler.toml` `class_name`) built from their `AppModule`:
- *
- * ```ts
- * export class ChatRoom extends VelaWebSocketDurableObject(AppModule) {}
- * ```
- *
- * It owns the raw hibernation socket lifecycle (Hono's `upgradeWebSocket` cannot
- * bridge DO hibernation) and forwards every event into the runtime-agnostic
- * `WsDispatcher` via {@link DoWebSocketHost}.
- */
-declare function VelaWebSocketDurableObject(rootModule: Type): new (ctx: DurableObjectState, env: Record<string, unknown>) => DurableObject<Record<string, unknown>>;
+export declare function QueueConsumer(queueName: string): MethodDecorator;
 //#endregion
 //#region src/websocket/cloudflare-websocket.module.d.ts
 /**
@@ -711,11 +462,18 @@ declare function VelaWebSocketDurableObject(rootModule: Type): new (ctx: Durable
  * ctx-backed server per instance. `useClass` ensures a fresh holder per DI
  * container so colocated DO instances never share a server.
  */
-declare class CloudflareWebSocketModule {
+export declare class CloudflareWebSocketModule {
   static forRoot(): DynamicModule;
 }
 //#endregion
 //#region src/websocket/broadcast.d.ts
+interface WsBroadcastStub {
+  broadcast(cmd: BroadcastCommand): Promise<void>;
+}
+interface BroadcastNamespace {
+  idFromName(name: string): DurableObjectId;
+  get(id: DurableObjectId): WsBroadcastStub;
+}
 /**
  * Push to a room from a Worker HTTP handler / cron / queue consumer (server-
  * initiated emit). Resolves the room's Durable Object and calls its `broadcast`
@@ -724,12 +482,13 @@ declare class CloudflareWebSocketModule {
  *
  * @example
  * ```ts
- * // In a controller — ns from DurableObjectService.namespace
- * await broadcastToRoom(ns, `org:${id}`, 'order.created', order);
+ * // In a controller — ns from the typed Worker environment
+ * await broadcastToRoom(ns, '/orgs/:orgId/ws', `org:${id}`, 'order.created', order);
  * ```
  */
-declare function broadcastToRoom(ns: DurableObjectNamespace, room: string, event: string, data?: unknown, options?: {
+export declare function broadcastToRoom(ns: BroadcastNamespace, gatewayPath: string, room: string, event: string, data?: unknown, options?: {
   exceptIds?: string[];
+  maxFrameBytes?: number;
 }): Promise<void>;
 //#endregion
 //#region src/websocket/do-state.d.ts
@@ -756,7 +515,7 @@ interface SqlStorageLike {
  * invalidation to the room DO's log (one log scope per room, exactly the
  * protocol's model).
  */
-declare class DoCursorLog implements CursorLog {
+export declare class DoCursorLog implements CursorLog {
   private readonly maxRows;
   private sql?;
   private epoch?;
@@ -769,37 +528,95 @@ declare class DoCursorLog implements CursorLog {
   private assertReady;
 }
 interface DurableObjectLiveOptions {
-  /** The wrangler binding name of the WebSocket DO namespace (e.g. `'CHAT_ROOM'`). */
-  binding: string;
+  /** Native, RPC-typed namespace supplied by the application's environment. */
+  namespace: LiveNamespace;
+  /** Exact `@WebSocketGateway()` path sharing this room/log namespace. */
+  gatewayPath: string;
   /** Room used when an invalidation names none. Matches the client default. */
   defaultRoom?: string;
 }
-interface CfLiveDriver extends LiveDriver {
-  /** @internal — Worker isolate: capture `env` so the namespace binding resolves per dispatch. */
-  _initializeEnv(env: Record<string, unknown>): void;
-  /** @internal — DO isolate: deliver invalidations straight to this DO's engine. */
+interface LiveInvalidateStub {
+  invalidate(cmd: InvalidationCommand): Promise<CommitStamp | undefined>;
+}
+/** Only the native namespace operations required for live invalidation. */
+interface LiveNamespace {
+  idFromName(name: string): DurableObjectId;
+  get(id: DurableObjectId): LiveInvalidateStub;
+}
+/** One driver per application; construct from a LiveModule driver factory. */
+declare class CfLiveDriver implements LiveDriver {
+  private readonly options;
+  readonly kind = "durable-object";
+  private sink;
+  private localMode;
+  constructor(options: DurableObjectLiveOptions);
+  bind(sink: LiveInvalidationSink): void;
+  /** @internal — a DO dispatches to its own engine and SQLite log. */
   _setLocalMode(): void;
+  dispatch(cmd: InvalidationCommand): Promise<CommitStamp | undefined> | CommitStamp | undefined;
 }
-/**
- * The Cloudflare `LiveDriver`. Dual-mode, because the SAME app module
- * bootstraps in both isolates:
- *
- * - **Worker** (HTTP mutations, queue consumers, crons): route the command to
- *   the room's Durable Object over the `invalidate` RPC — the same canonical
- *   `roomToDurableId` mapping the upgrade route and `broadcastToRoom` use —
- *   and return THAT log scope's commit stamp (what `Vela-Commit-Cursor`
- *   must carry).
- * - **DO** (writes issued from inside the object): apply to the local engine.
- */
-declare function durableObjectLive(options: DurableObjectLiveOptions): CfLiveDriver;
+/** Use in LiveModule.forRootAsync: driver: () => durableObjectLive({ namespace: env.ROOMS, ... }). */
+export declare function durableObjectLive(options: DurableObjectLiveOptions): CfLiveDriver;
 /** Ergonomic alias: the log option for `LiveModule.forRoot` on Cloudflare. */
-declare function durableObjectCursorLog(maxRows?: number): DoCursorLog;
+export declare function durableObjectCursorLog(maxRows?: number): DoCursorLog;
 /**
  * Invalidate live tags in a room from a Worker (controller / cron / queue
  * consumer) — the live sibling of `broadcastToRoom`. Returns the room log
  * scope's commit stamp for `Vela-Commit-Cursor` stamping.
  */
-declare function liveInvalidateToRoom(ns: DurableObjectNamespace, room: string, tags: string[]): Promise<CommitStamp | undefined>;
+export declare function liveInvalidateToRoom(ns: LiveNamespace, gatewayPath: string, room: string, tags: string[]): Promise<CommitStamp | undefined>;
+//#endregion
+//#region src/rate-limit/cloudflare-rate-limit.store.d.ts
+/** The deliberately small surface exposed by a Workers Rate Limiting binding. */
+interface CloudflareRateLimitBinding {
+  limit(input: {
+    key: string;
+  }): Promise<{
+    success: boolean;
+  }>;
+}
+interface CloudflareRateLimitStoreOptions {
+  /** Must match the binding's configured `simple.limit`. */
+  limit: number;
+  /** Must match the binding's configured `simple.period`. */
+  periodSeconds: 10 | 60;
+  /** Bound attacker-influenced tracking keys before calling the platform. */
+  maxKeyBytes?: number;
+}
+/**
+ * Adapt a Cloudflare Workers Rate Limiting binding to Vela's throttler store.
+ *
+ * The platform binding makes the allow/deny decision. It does not expose exact
+ * counters or reset timestamps, so this adapter intentionally omits `remaining`.
+ */
+export declare function cloudflareRateLimitStore(binding: CloudflareRateLimitBinding | (() => CloudflareRateLimitBinding), options: CloudflareRateLimitStoreOptions): ThrottlerStore;
+//#endregion
+//#region src/nonce/durable-object-nonce.store.d.ts
+/** The generated Workers binding type for {@link VelaNonceDurableObject}. */
+type DurableObjectNonceNamespace = DurableObjectNamespace<VelaNonceDurableObject>;
+interface DurableObjectNonceStoreOptions {
+  /**
+   * Stable application/environment boundary (for example `billing-api:prod`).
+   * Claims are globally single-use inside this namespace and isolated from all
+   * other application namespaces. It must be non-empty, canonical, and at most
+   * 128 UTF-8 bytes.
+   */
+  appNamespace: string;
+  /**
+   * Resolve the Workers Durable Object namespace at claim time. The resolver is
+   * intentionally not cached so request-scoped env/binding references stay safe.
+   */
+  binding: () => DurableObjectNonceNamespace | Promise<DurableObjectNonceNamespace>;
+}
+/**
+ * Strict, cross-isolate {@link NonceStore} backed by one SQLite Durable Object
+ * per explicit application namespace.
+ *
+ * Invalid input, an unavailable/malformed binding, RPC failure, or a malformed
+ * RPC result all deny the claim (`false`). Only the literal boolean `true` from
+ * the Durable Object is accepted.
+ */
+export declare function durableObjectNonceStore(options: DurableObjectNonceStoreOptions): NonceStore;
 //#endregion
-export { AIModule, AIService, type CfLiveDriver, CloudflareApplication, type CloudflareEnv, CloudflareWebSocketModule, ConnectedSocket, type CreateCloudflareAppOptions, D1Module, D1Service, type DiskConfig, DoCursorLog, type DurableObjectLiveOptions, DurableObjectModule, DurableObjectService, Env, EnvModule, EnvService, type FlagshipBinding, FlagshipFlagDriver, type FlagshipFlagDriverOptions, HyperdriveModule, HyperdriveService, KVCacheStore, KVModule, KVService, KvFlagDriver, type KvFlagDriverOptions, MessageBody, type MountOpenApiOptions, type OnGatewayConnection, type OnGatewayDisconnect, type OnGatewayInit, type PresignedUrlConfig, QueueConsumer, type QueueConsumerMetadata, QueueModule, type QueueRegistration, QueueService, R2Module, R2Service, R2StorageDriver, STORAGE_OPTIONS, Scheduled, type ScheduledMetadata, type ScheduledRegistration, StorageController, StorageManagerService, StorageModule, type StorageModuleOptions, StorageService, SubscribeMessage, VectorizeModule, VectorizeService, VelaWebSocketDurableObject, WebSocketGateway, WebSocketServer, type WsClient, WsException, type WsGatewayRoute, type WsMessage, type WsResponse, type WsServer, broadcastToRoom, cloudflareAdapter, createCloudflareApp, durableObjectCursorLog, durableObjectLive, flagshipFlagDriver, kvFlagDriver, liveInvalidateToRoom };
+export { type BroadcastNamespace, type CfLiveDriver, type CloudflareRateLimitBinding, type CloudflareRateLimitStoreOptions, type CloudflareRoot, type CloudflareWorkerOptions, ConnectedSocket, type CreateCloudflareAppOptions, type DiskConfig, type DoPitrArmOptions, type DoPitrArmResult, type DoPitrBookmarkRead, type DoPitrId, type DoPitrNamespace, type DoPitrStorage, DoPitrUnavailableError, type DurableObjectLiveOptions, type DurableObjectNonceNamespace, type DurableObjectNonceStoreOptions, type FlagshipBinding, type FlagshipFlagDriverOptions, type KvFlagDriverOptions, type LiveNamespace, MessageBody, type MountOpenApiOptions, type OnGatewayConnection, type OnGatewayDisconnect, type OnGatewayInit, type PresignedUrlConfig, type QueueConsumerMetadata, type ScheduledMetadata, type StorageModuleOptions, SubscribeMessage, type VelaDoPitrRpc, WebSocketGateway, WebSocketServer, type WsClient, WsException, type WsGatewayRoute, type WsMessage, type WsResponse, type WsServer, armDoPitr, isDoPitrUnavailable, readDoPitrBookmark };
 //# sourceMappingURL=index.d.ts.map