@velajs/cloudflare 1.10.1 → 1.22.0

package/dist/index.js

@@ -1,48 +1,49 @@
-import { CRON_METADATA, ConfigurableModuleBuilder, Controller, Get, Inject, Injectable, InjectionToken, Module, PipelineRunner, Req, VelaApplication, VelaFactory, bootstrap, buildEntrypointExecutionContext, createParamDecorator, defineConfigurableModule, defineMetadata, getMetadata, registerEntrypointKind, runInEntrypointScope, shouldFilterCatch } from "@velajs/vela";
+import { C as roomToDurableId, _ as resolveCloudflareRoot, a as durableObjectLive, c as liveInvalidateToRoom, d as WsServerHolder, f as DoPitrUnavailableError, g as __decorate, h as readDoPitrBookmark, i as durableObjectCursorLog, m as isDoPitrUnavailable, n as isValidExpiry, p as armDoPitr, r as DoCursorLog, t as isCanonicalBoundedText, v as assertCloudflareEnvironment, x as durableObjectRoomName, y as registerCloudflareEnvironment } from "./nonce-validation-LE0vFk-7.js";
+import { getConnInfo } from "hono/cloudflare-workers";
+import { CRON_METADATA, ConfigurableModuleBuilder, Controller, Get, Inject, Injectable, InjectionToken, Module, PipelineRunner, Req, VelaFactory, buildEntrypointExecutionContext, createParamDecorator, defineMetadata, defineProvider, getMetadata, getTrustedRequestIdentity, registerEntrypointKind, runInEntrypointScope, shouldFilterCatch } from "@velajs/vela";
 import { ComponentManager } from "@velajs/vela/internal";
-import { ConnectedSocket, MessageBody, SubscribeMessage, WS_GATEWAY_METADATA, WS_SERVER, WebSocketGateway, WebSocketServer, WsDispatcher, WsException, WsServerImpl, local } from "@velajs/vela/websocket";
-import { LIVE_CURSOR_LOG, LIVE_DRIVER, readPersistedLiveSubscriptions } from "@velajs/vela/live";
-import { joinStoragePath, signUrl, verifySignedUrl } from "@velajs/vela/storage";
-import { DurableObject } from "cloudflare:workers";
-//#region src/binding-ref.ts
-var BindingRef = class {
-	bindingName;
-	_value;
-	constructor(bindingName) {
-		this.bindingName = bindingName;
-	}
-	get value() {
-		if (this._value === void 0) throw new Error(`Cloudflare binding '${this.bindingName}' not initialized. Ensure createCloudflareApp() is used and a request has been made.`);
-		return this._value;
-	}
-	/** @internal — called by createCloudflareApp middleware */
-	_initialize(value) {
-		this._value = value;
-	}
-};
-//#endregion
-//#region src/websocket/room-id.ts
-/** Hibernation tag marking a socket's hub room (set at accept; immutable after). */
-function roomTag(roomId) {
-	return `room:${roomId}`;
+import { ConnectedSocket, DEFAULT_WS_MAX_FRAME_BYTES, MessageBody, SubscribeMessage, WS_GATEWAY_METADATA, WS_SERVER, WebSocketGateway, WebSocketServer, WsDispatcher, WsException, assertBroadcastCommandFits, authenticateWebSocketUpgrade, resolveGatewayRoomId, resolveGatewayRoomParam, resolveMaxFrameBytes } from "@velajs/vela/websocket";
+import { STORAGE_SIGNED_URL_PURPOSE, joinStoragePath, signUrl, verifySignedUrl } from "@velajs/vela/storage";
+//#region src/websocket/websocket-routing.ts
+const MAX_IDENTITY_FIELD_BYTES = 2048;
+const encoder = new TextEncoder();
+function isIdentityField(value) {
+	return typeof value === "string" && value.length > 0 && !value.includes("\r") && !value.includes("\n") && encoder.encode(value).byteLength <= MAX_IDENTITY_FIELD_BYTES;
 }
-/** Hibernation tag addressing one connection directly. */
-function connTag(connId) {
-	return `conn:${connId}`;
+/** `null` means an identity was present but violated the transport contract. */
+function accessIdentity(c) {
+	const value = getTrustedRequestIdentity(c.req.raw);
+	if (!value) return void 0;
+	const { principal, tenantId, expiresAtMs } = value;
+	if (!isIdentityField(principal.issuer) || !isIdentityField(principal.subject) || !isIdentityField(tenantId) || typeof expiresAtMs !== "number" || !Number.isSafeInteger(expiresAtMs) || expiresAtMs <= 0) return null;
+	return {
+		principal,
+		tenantId,
+		expiresAtMs
+	};
 }
-/** One Durable Object instance per room, addressed by name. */
-function roomToDurableId(ns, roomId) {
-	return ns.idFromName(roomId);
+/** `null` means two independently verified identities disagree. */
+function combineIdentities(requestIdentity, upgradeIdentity) {
+	if (!requestIdentity && !upgradeIdentity) return void 0;
+	if (!requestIdentity) return upgradeIdentity;
+	if (!upgradeIdentity) return requestIdentity;
+	if (requestIdentity.principal.issuer !== upgradeIdentity.principal.issuer || requestIdentity.principal.subject !== upgradeIdentity.principal.subject || requestIdentity.principal.principalType !== upgradeIdentity.principal.principalType || requestIdentity.tenantId !== upgradeIdentity.tenantId) return null;
+	return {
+		principal: { ...upgradeIdentity.principal },
+		tenantId: upgradeIdentity.tenantId,
+		expiresAtMs: Math.min(requestIdentity.expiresAtMs, upgradeIdentity.expiresAtMs)
+	};
 }
-//#endregion
-//#region src/websocket/websocket-routing.ts
 /** Read `@WebSocketGateway({ path, binding })` off a resolved instance (CF-hosted gateways only). */
 function collectWsGatewayRoutes(instance) {
 	const options = getMetadata(WS_GATEWAY_METADATA, instance.constructor);
 	if (!options?.path || !options?.binding) return [];
+	resolveGatewayRoomParam(options);
+	resolveMaxFrameBytes(options);
 	return [{
 		path: options.path,
-		binding: options.binding
+		binding: options.binding,
+		options: { ...options }
 	}];
 }
 /**
@@ -54,21 +55,65 @@ function collectWsGatewayRoutes(instance) {
 function registerWebSocketRoutes(hono, routes) {
 	for (const route of routes) hono.get(route.path, async (c) => {
 		if (c.req.header("upgrade")?.toLowerCase() !== "websocket") return c.text("Expected WebSocket upgrade", 426);
-		const ns = c.env[route.binding];
-		if (!ns) return c.text(`Durable Object binding '${route.binding}' is not configured`, 500);
-		const roomId = c.req.param("id") ?? route.path;
-		const stub = ns.get(roomToDurableId(ns, roomId));
 		const headers = new Headers(c.req.raw.headers);
 		headers.delete("x-vela-room");
 		headers.delete("x-vela-path");
 		headers.delete("x-vela-user");
-		headers.set("x-vela-room", roomId);
-		headers.set("x-vela-path", route.path);
-		const userId = c.get("userId");
-		if (userId) headers.set("x-vela-user", String(userId));
-		return stub.fetch(new Request(c.req.raw, { headers }));
+		headers.delete("x-vela-expires-at");
+		headers.delete("x-vela-expires-at-ms");
+		headers.delete("x-vela-issuer");
+		headers.delete("x-vela-subject");
+		headers.delete("x-vela-principal-type");
+		headers.delete("x-vela-tenant");
+		const sanitizedRequest = new Request(c.req.raw, { headers });
+		let roomId;
+		try {
+			roomId = resolveGatewayRoomId(route.options, (name) => c.req.param(name));
+		} catch {
+			return c.text("Invalid WebSocket room", 400);
+		}
+		const upgrade = await authenticateWebSocketUpgrade(route.options, sanitizedRequest, roomId);
+		if (upgrade === false) return c.text("WebSocket upgrade forbidden", 403);
+		const requestIdentity = accessIdentity(c);
+		if (requestIdentity === null) return c.text("Invalid WebSocket identity", 403);
+		const identity = combineIdentities(requestIdentity, upgrade.identity);
+		if (identity === null) return c.text("Conflicting WebSocket identities", 403);
+		if (identity && identity.expiresAtMs <= Date.now()) return c.text("WebSocket identity expired", 403);
+		const forwardHeaders = new Headers(upgrade.request.headers);
+		forwardHeaders.set("x-vela-room", roomId);
+		forwardHeaders.set("x-vela-path", route.path);
+		if (identity) {
+			forwardHeaders.set("x-vela-user", identity.principal.subject);
+			forwardHeaders.set("x-vela-issuer", identity.principal.issuer);
+			forwardHeaders.set("x-vela-subject", identity.principal.subject);
+			forwardHeaders.set("x-vela-principal-type", identity.principal.principalType);
+			forwardHeaders.set("x-vela-tenant", identity.tenantId);
+			forwardHeaders.set("x-vela-expires-at-ms", String(identity.expiresAtMs));
+		}
+		return forwardToRoom(c.env, route.binding, route.path, roomId, new Request(upgrade.request, { headers: forwardHeaders }));
 	});
 }
+/**
+* Gateway metadata contains a runtime binding name, so the native type is
+* erased. Validate only the operations consumed here and their observable
+* results; never assert that an arbitrary value implements a native namespace.
+*/
+async function forwardToRoom(env, binding, path, room, request) {
+	if (typeof env !== "object" || env === null) throw new Error("Worker environment is missing");
+	const namespace = Reflect.get(env, binding);
+	if (typeof namespace !== "object" || namespace === null) return new Response(`Durable Object binding '${binding}' is not configured`, { status: 500 });
+	const idFromName = Reflect.get(namespace, "idFromName");
+	const get = Reflect.get(namespace, "get");
+	if (typeof idFromName !== "function" || typeof get !== "function") throw new Error("Invalid Durable Object namespace");
+	const id = Reflect.apply(idFromName, namespace, [durableObjectRoomName(path, room)]);
+	const stub = Reflect.apply(get, namespace, [id]);
+	if (typeof stub !== "object" || stub === null) throw new Error("Invalid Durable Object stub");
+	const fetch = Reflect.get(stub, "fetch");
+	if (typeof fetch !== "function") throw new Error("Durable Object stub has no fetch operation");
+	const response = await Reflect.apply(fetch, stub, [request]);
+	if (!(response instanceof Response)) throw new Error("Durable Object returned an invalid response");
+	return response;
+}
 //#endregion
 //#region src/cloudflare-application.ts
 registerEntrypointKind({
@@ -77,9 +122,15 @@ registerEntrypointKind({
 	level: "method"
 });
 function invoke(instance, methodName, args) {
-	const method = instance[methodName];
+	const method = Reflect.get(instance, methodName);
 	if (typeof method !== "function") throw new Error(`Method '${methodName}' is not a function on ${instance.constructor.name}`);
-	return method.apply(instance, args);
+	return Reflect.apply(method, instance, args);
+}
+function entrypointString(meta, property) {
+	if (typeof meta !== "object" || meta === null) throw new Error("Invalid entrypoint metadata.");
+	const value = Reflect.get(meta, property);
+	if (typeof value !== "string") throw new Error(`Invalid entrypoint metadata: ${property} must be a string.`);
+	return value;
 }
 /**
 * Wraps VelaApplication with Cloudflare-specific handlers:
@@ -92,7 +143,7 @@ function invoke(instance, methodName, args) {
 *
 * @example
 * ```ts
-* const app = await createCloudflareApp(AppModule);
+* const app = await createCloudflareApp(AppModule, { env, envToken: ENV });
 * export default {
 *   fetch: app.fetch,
 *   scheduled: app.scheduled.bind(app),
@@ -103,7 +154,7 @@ function invoke(instance, methodName, args) {
 * @example
 * ```ts
 * // Serve OpenAPI docs alongside your routes
-* const app = await createCloudflareApp(AppModule);
+* const app = await createCloudflareApp(AppModule, { env, envToken: ENV });
 * const document = createOpenApiDocument(AppModule);
 * app.mountOpenApi({ document, ui: 'scalar' });
 * // GET /openapi.json -> JSON document
@@ -112,30 +163,35 @@ function invoke(instance, methodName, args) {
 */
 var CloudflareApplication = class {
 	app;
+	env;
 	wsGatewayRoutes = [];
-	constructor(app) {
+	constructor(app, env) {
 		this.app = app;
+		this.env = env;
+		this.get = app.get.bind(app);
 	}
-	get fetch() {
-		return this.app.fetch;
-	}
+	fetch = async (request, env, ctx) => {
+		assertCloudflareEnvironment(this.env, env);
+		return this.app.fetch(request, env, ctx);
+	};
 	getHonoApp() {
 		return this.app.getHonoApp();
 	}
 	/**
 	* Resolve a provider from the application's DI container (delegates to
 	* `VelaApplication.get`). Handy for grabbing a service — e.g. an auth service —
-	* to use inside `createCloudflareApp({ middleware: [...] })` request middleware,
+	* to use inside `createCloudflareApp({ middleware: env => [...] })` request middleware,
 	* which runs outside the DI request pipeline.
 	*
 	* @example
 	* ```ts
-	* const app = await createCloudflareApp(AppModule);
-	* const auth = app.get<BetterAuthService>(BetterAuthService);
+	* const app = await createCloudflareApp(AppModule, { env, envToken: ENV });
+	* const auth = app.get(BetterAuthService);
 	* ```
 	*/
-	get(token) {
-		return this.app.get(token);
+	get;
+	get entrypoints() {
+		return this.app.entrypoints;
 	}
 	/**
 	* Serve a pre-built OpenAPI document (and optionally a Scalar UI) on the
@@ -148,7 +204,7 @@ var CloudflareApplication = class {
 	* ```ts
 	* import { createOpenApiDocument } from '@velajs/vela';
 	*
-	* const app = await createCloudflareApp(AppModule);
+	* const app = await createCloudflareApp(AppModule, { env, envToken: ENV });
 	* const document = createOpenApiDocument(AppModule, {
 	*   info: { title: 'My API', version: '1.0.0' },
 	* });
@@ -184,12 +240,13 @@ var CloudflareApplication = class {
 	* request-scoped child (request-scoped providers rebuild per tick).
 	*/
 	async scheduled(event, env, ctx) {
+		assertCloudflareEnvironment(this.env, env);
 		const handlers = [...this.app.entrypoints.ofKind("cf:scheduled").map((ep) => ({
 			ep,
-			cron: ep.meta.cron
+			cron: entrypointString(ep.meta, "cron")
 		})), ...this.app.entrypoints.ofKind("cf:vela-cron").map((ep) => ({
 			ep,
-			cron: ep.meta.expression
+			cron: entrypointString(ep.meta, "expression")
 		}))].filter((h) => h.cron === event.cron);
 		await Promise.all(handlers.map(({ ep }) => this.dispatchEntrypoint(ep, [
 			event,
@@ -207,10 +264,12 @@ var CloudflareApplication = class {
 	*/
 	async dispatchEntrypoint(ep, args) {
 		const targetClass = ep.token;
+		if (typeof targetClass !== "function") throw new Error("Entrypoint token must be a class.");
 		const methodName = String(ep.methodName);
 		const context = buildEntrypointExecutionContext(ep.kind, targetClass, methodName, args[0]);
 		await runInEntrypointScope(this.app.getContainer(), async (scope) => {
 			const instance = scope.resolve(ep.token);
+			if (typeof instance !== "object" || instance === null) throw new Error("Entrypoint must resolve to an object.");
 			const guards = ComponentManager.resolveGuards(ComponentManager.getScopedComponents("guard", targetClass, methodName), scope);
 			const interceptors = ComponentManager.resolveInterceptors(ComponentManager.getScopedComponents("interceptor", targetClass, methodName), scope);
 			const filters = ComponentManager.resolveFilters([...ComponentManager.getScopedComponents("filter", targetClass, methodName)].reverse(), scope);
@@ -238,7 +297,8 @@ var CloudflareApplication = class {
 	* child (request-scoped providers rebuild per batch — no boot-time captives).
 	*/
 	async queue(batch, env, ctx) {
-		const handlers = this.app.entrypoints.ofKind("cf:queue").filter((ep) => ep.meta.queueName === batch.queue);
+		assertCloudflareEnvironment(this.env, env);
+		const handlers = this.app.entrypoints.ofKind("cf:queue").filter((ep) => entrypointString(ep.meta, "queueName") === batch.queue);
 		await Promise.all(handlers.map((ep) => this.dispatchEntrypoint(ep, [
 			batch,
 			env,
@@ -250,668 +310,144 @@ var CloudflareApplication = class {
 	}
 };
 //#endregion
-//#region src/env-ref.ts
-const ENV_SENTINEL = "__cf_env__";
-/**
-* Holds the entire Cloudflare Worker `env` record (bindings + vars/secrets),
-* not a single binding. Subclasses {@link BindingRef} so createCloudflareApp's
-* binding-init middleware collects and initializes it through the same path;
-* the factory special-cases it to pass the full `env` instead of one binding.
-*/
-var EnvRef = class extends BindingRef {
-	constructor() {
-		super(ENV_SENTINEL);
-	}
-};
-//#endregion
-//#region src/websocket/cf-ws-client.ts
-const MAX_ATTACHMENT_BYTES = 16384;
-const encoder = new TextEncoder();
-const EMPTY = {
-	connId: "",
-	path: "",
-	rooms: [],
-	data: {}
-};
-/**
-* Core `WsClient` over a native Cloudflare `WebSocket` inside a Durable Object.
-* Per-connection state lives in the hibernation attachment (survives eviction),
-* so a fresh `CfWsClient` is reconstructed per message with no in-memory state.
-*/
-var CfWsClient = class {
-	ctx;
-	ws;
-	attachment;
-	constructor(ctx, ws) {
-		this.ctx = ctx;
-		this.ws = ws;
-		const raw = ws.deserializeAttachment();
-		this.attachment = raw ?? {
-			...EMPTY,
-			data: {}
-		};
-	}
-	get id() {
-		return this.attachment.connId;
-	}
-	/** The gateway route path this socket connected on (used to route messages). */
-	get path() {
-		return this.attachment.path;
-	}
-	get rooms() {
-		return new Set(this.attachment.rooms);
-	}
-	get data() {
-		return this.attachment.data;
-	}
-	set data(value) {
-		this.attachment.data = value;
-	}
-	get raw() {
-		return this.ws;
-	}
-	send(event, data, id) {
-		this.ws.send(JSON.stringify(id !== void 0 ? {
-			id,
-			event,
-			data
-		} : {
-			event,
-			data
-		}));
-	}
-	sendRaw(payload) {
-		this.ws.send(payload);
-	}
-	join(room) {
-		if (!this.attachment.rooms.includes(room)) {
-			this.attachment.rooms.push(room);
-			this.persist();
-		}
-	}
-	leave(room) {
-		const next = this.attachment.rooms.filter((r) => r !== room);
-		if (next.length !== this.attachment.rooms.length) {
-			this.attachment.rooms = next;
-			this.persist();
-		}
-	}
-	/** Persist `data`/room mutations to the hibernation attachment. */
-	commit() {
-		this.persist();
-	}
-	close(code, reason) {
-		this.ws.close(code, reason);
-	}
-	persist() {
-		const serialized = JSON.stringify(this.attachment);
-		if (encoder.encode(serialized).length > MAX_ATTACHMENT_BYTES) throw new Error("WebSocket attachment exceeds the 16 KiB Cloudflare limit. Store large per-connection state in Durable Object storage keyed by connId instead.");
-		this.ws.serializeAttachment(this.attachment);
-	}
-};
-//#endregion
-//#region src/websocket/do-live.ts
-const DEFAULT_ROOM = "default";
-const DEFAULT_MAX_LOG_ROWS = 4096;
-/**
-* The durable `CursorLog`: an append-only tag-invalidation log in the DO's
-* SQLite (`__vela_live_log`, AUTOINCREMENT seq = cursor) plus an epoch UUID in
-* `__vela_live_meta`. Because the cursor survives hibernation AND trims (it is
-* read from `sqlite_sequence`, lunora's `ctx-db-cdc.ts` trick), a reconnecting
-* client whose gap the log still covers gets a tiny `resume` instead of a
-* re-run — the real-resume half of the live protocol.
-*
-* Constructed un-initialized at module-composition time (the same app module
-* bootstraps in the Worker AND in each DO); `initDoLive` wires the SQLite
-* handle inside the DO. In the Worker isolate it stays un-initialized — and is
-* never consulted there, because `durableObjectLive()` routes every
-* invalidation to the room DO's log (one log scope per room, exactly the
-* protocol's model).
-*/
-var DoCursorLog = class {
-	maxRows;
-	sql;
-	epoch;
-	constructor(maxRows = DEFAULT_MAX_LOG_ROWS) {
-		this.maxRows = maxRows;
-	}
-	/** @internal — called by `initDoLive` with the DO's `ctx.storage.sql`. */
-	_initialize(sql) {
-		this.sql = sql;
-		sql.exec("CREATE TABLE IF NOT EXISTS __vela_live_log (seq INTEGER PRIMARY KEY AUTOINCREMENT, ts REAL NOT NULL, tags TEXT NOT NULL)");
-		sql.exec("CREATE TABLE IF NOT EXISTS __vela_live_meta (k TEXT PRIMARY KEY, v TEXT NOT NULL)");
-		const row = sql.exec("SELECT v FROM __vela_live_meta WHERE k = 'epoch'").toArray()[0];
-		if (row && typeof row.v === "string") this.epoch = row.v;
-		else {
-			this.epoch = crypto.randomUUID();
-			sql.exec("INSERT INTO __vela_live_meta (k, v) VALUES ('epoch', ?)", this.epoch);
-		}
-	}
-	append(tags) {
-		const sql = this.assertReady();
-		sql.exec("INSERT INTO __vela_live_log (ts, tags) VALUES (?, ?)", Date.now(), JSON.stringify(tags));
-		const stamp = this.current();
-		if (stamp.cursor > this.maxRows) sql.exec("DELETE FROM __vela_live_log WHERE seq <= ?", stamp.cursor - this.maxRows);
-		return stamp;
-	}
-	current() {
-		const sql = this.assertReady();
-		let cursor = 0;
-		try {
-			const row = sql.exec("SELECT seq FROM sqlite_sequence WHERE name = '__vela_live_log'").toArray()[0];
-			cursor = typeof row?.seq === "number" ? row.seq : Number(row?.seq ?? 0);
-		} catch {
-			cursor = 0;
-		}
-		return {
-			cursor,
-			epoch: this.epoch
-		};
-	}
-	evaluateResume(sinceCursor, sinceEpoch, subscriptionTags) {
-		const sql = this.assertReady();
-		const { cursor, epoch } = this.current();
-		if (sinceEpoch !== epoch) return "snapshot";
-		if (sinceCursor > cursor) return "snapshot";
-		if (sinceCursor === cursor) return "resume";
-		const minRow = sql.exec("SELECT MIN(seq) AS m FROM __vela_live_log").toArray()[0];
-		const min = minRow?.m == null ? void 0 : Number(minRow.m);
-		if (min === void 0 || min > sinceCursor + 1) return "snapshot";
-		const subTags = new Set(subscriptionTags);
-		for (const row of sql.exec("SELECT tags FROM __vela_live_log WHERE seq > ?", sinceCursor).toArray()) {
-			let tags;
-			try {
-				tags = JSON.parse(String(row.tags));
-			} catch {
-				return "snapshot";
-			}
-			if (Array.isArray(tags) && tags.some((tag) => subTags.has(tag))) return "rerun";
-		}
-		return "resume";
-	}
-	assertReady() {
-		if (!this.sql) throw new Error("DoCursorLog is not initialized. It only runs inside a SQLite-backed Durable Object (wrangler: new_sqlite_classes) — Worker-side invalidations must go through durableObjectLive(), which routes them to the room DO's log.");
-		return this.sql;
-	}
-};
-/**
-* The Cloudflare `LiveDriver`. Dual-mode, because the SAME app module
-* bootstraps in both isolates:
-*
-* - **Worker** (HTTP mutations, queue consumers, crons): route the command to
-*   the room's Durable Object over the `invalidate` RPC — the same canonical
-*   `roomToDurableId` mapping the upgrade route and `broadcastToRoom` use —
-*   and return THAT log scope's commit stamp (what `Vela-Commit-Cursor`
-*   must carry).
-* - **DO** (writes issued from inside the object): apply to the local engine.
-*/
-function durableObjectLive(options) {
-	let sink;
-	let env;
-	let localMode = false;
-	return {
-		kind: "durable-object",
-		bind(boundSink) {
-			sink = boundSink;
-		},
-		_initializeEnv(capturedEnv) {
-			env = capturedEnv;
-		},
-		_setLocalMode() {
-			localMode = true;
-		},
-		dispatch(cmd) {
-			if (localMode) return sink?.applyInvalidation(cmd);
-			const namespace = env?.[options.binding];
-			if (!namespace) throw new Error(`durableObjectLive: binding '${options.binding}' is not available. In a Worker, createCloudflareApp() captures env on the first request; check the wrangler binding name.`);
-			const room = cmd.room ?? options.defaultRoom ?? DEFAULT_ROOM;
-			return namespace.get(roomToDurableId(namespace, room)).invalidate({
-				...cmd,
-				room
-			});
-		}
-	};
-}
-const isCfLiveDriver = (value) => typeof value === "object" && value !== null && typeof value._setLocalMode === "function" && typeof value._initializeEnv === "function";
-/** Worker-side wiring, called from `cloudflareAdapter`'s first-request middleware. */
-function initializeWorkerLive(container, env) {
-	let driver;
-	try {
-		driver = container.resolve(LIVE_DRIVER);
-	} catch {
-		return;
-	}
-	if (isCfLiveDriver(driver)) driver._initializeEnv(env);
-}
-/**
-* DO-side wiring, called from `buildDoRuntime`: initialize the SQLite cursor
-* log, flip the driver to local mode, and replay every hibernation-persisted
-* subscription into the (fresh) engine so an eviction is invisible to
-* subscribers. Returns the engine for the `invalidate` RPC, or undefined when
-* the app doesn't use LiveModule.
-*/
-function initDoLive(app, container, ctx) {
-	const entry = app.entrypoints.ofKind("live")[0];
-	if (!entry) return void 0;
-	const engine = entry.meta.engine;
-	try {
-		const log = container.resolve(LIVE_CURSOR_LOG);
-		if (log instanceof DoCursorLog) {
-			const sql = ctx.storage?.sql;
-			if (!sql) throw new Error("DoCursorLog requires a SQLite-backed Durable Object: add this class to wrangler's `migrations[].new_sqlite_classes`. Falling back is not possible — either enable SQLite or drop the `log: durableObjectCursorLog()` option (snapshot-on-reconnect semantics).");
-			log._initialize(sql);
-		}
-	} catch (err) {
-		if (err instanceof Error && err.message.includes("new_sqlite_classes")) throw err;
-	}
-	try {
-		const driver = container.resolve(LIVE_DRIVER);
-		if (isCfLiveDriver(driver)) driver._setLocalMode();
-	} catch {}
-	for (const ws of ctx.getWebSockets()) {
-		const client = new CfWsClient(ctx, ws);
-		for (const record of readPersistedLiveSubscriptions(client)) engine.restoreSubscription(client.path, client, record);
-	}
-	return engine;
-}
-/** Ergonomic alias: the log option for `LiveModule.forRoot` on Cloudflare. */
-function durableObjectCursorLog(maxRows) {
-	return new DoCursorLog(maxRows);
-}
-/**
-* Invalidate live tags in a room from a Worker (controller / cron / queue
-* consumer) — the live sibling of `broadcastToRoom`. Returns the room log
-* scope's commit stamp for `Vela-Commit-Cursor` stamping.
-*/
-async function liveInvalidateToRoom(ns, room, tags) {
-	return ns.get(roomToDurableId(ns, room)).invalidate({
-		room,
-		tags
-	});
-}
-//#endregion
 //#region src/cloudflare-factory.ts
-function collectBindingRefs(container) {
-	const refs = [];
-	for (const value of container.getUseValues()) if (value instanceof BindingRef) refs.push(value);
-	return refs;
-}
-/**
-* Create a Cloudflare Workers application.
-*
-* Sets up a one-time Hono middleware that captures `c.env` on the first
-* request and initializes all configured binding refs. Optional
-* {@link CreateCloudflareAppOptions} are forwarded to the underlying
-* `VelaFactory.create` so consumers don't have to wrap the resulting
-* application in an outer Hono just to set a `globalPrefix` or attach
-* extra request middleware.
-*
-* @example
-* ```ts
-* // Minimal — backwards compatible
-* const app = await createCloudflareApp(AppModule);
-* export default app; // has .fetch, .scheduled, .queue
-* ```
-*
-* @example
-* ```ts
-* // With a global prefix and outer middleware
-* const app = await createCloudflareApp(AppModule, {
-*   globalPrefix: '/v1',
-*   middleware: [
-*     async (c, next) => {
-*       c.set('tenantId', c.req.header('x-tenant-id') ?? 'public');
-*       await next();
-*     },
-*   ],
-* });
-* ```
-*/
-/**
-* The Cloudflare platform binding as a vela {@link RuntimeAdapter}: a one-time
-* request middleware captures `c.env` on the first request and initializes
-* every `BindingRef`/`EnvRef` (collected at `onBootstrap`, before any request
-* can arrive). Adapter `requestMiddleware` is prepended to the global chain by
-* `VelaFactory.create`, so user middleware can safely read binding refs.
-*
-* Exposed so consumers composing `VelaFactory.create` themselves can opt in:
-*
-* ```ts
-* const app = await VelaFactory.create(AppModule, { adapters: [cloudflareAdapter()] });
-* ```
-*/
-function cloudflareAdapter() {
-	let initialized = false;
-	let refs = [];
-	let liveContainer;
+/** Bind an application to one environment before provider factories and lifecycle hooks. */
+function cloudflareAdapter(options) {
 	return {
 		name: "cloudflare",
-		requestMiddleware: [async (c, next) => {
-			if (!initialized) {
-				initialized = true;
-				const env = c.env ?? {};
-				for (const ref of refs) if (ref instanceof EnvRef) ref._initialize(env);
-				else ref._initialize(env[ref.bindingName]);
-				if (liveContainer) initializeWorkerLive(liveContainer, env);
-			}
+		requestMiddleware: [async (context, next) => {
+			assertCloudflareEnvironment(options.env, context.env);
 			await next();
 		}],
-		onBootstrap: ({ container }) => {
-			liveContainer = container;
-			refs = collectBindingRefs(container);
+		invocationTransport: ({ app }) => (request) => Promise.resolve(app.fetch(request, options.env)),
+		getClientIp: (c) => getConnInfo(c).remote.address ?? null,
+		configureContainer: (container) => {
+			registerCloudflareEnvironment(container, {
+				token: options.envToken,
+				env: options.env
+			});
 		}
 	};
 }
-async function createCloudflareApp(rootModule, options = {}) {
-	const velaApp = await VelaFactory.create(rootModule, {
+/** Build an application for one native Workers environment. Call inside a platform event. */
+async function createCloudflareApp(rootModule, options) {
+	const velaApp = await VelaFactory.create(resolveCloudflareRoot(rootModule, options.env), {
 		globalPrefix: options.globalPrefix,
-		middleware: options.middleware,
-		adapters: [cloudflareAdapter()]
+		security: options.security,
+		middleware: options.middleware?.(options.env),
+		adapters: [cloudflareAdapter(options)]
 	});
-	const cfApp = new CloudflareApplication(velaApp);
-	cfApp.scanInstances(velaApp.getInstances());
-	registerWebSocketRoutes(cfApp.getHonoApp(), cfApp.getWsGatewayRoutes());
-	return cfApp;
-}
-//#endregion
-//#region src/tokens.ts
-const KV_BINDING_REF = new InjectionToken("CF_KV_BINDING_REF");
-const D1_BINDING_REF = new InjectionToken("CF_D1_BINDING_REF");
-const R2_BINDING_REF = new InjectionToken("CF_R2_BINDING_REF");
-const QUEUE_BINDING_REF = new InjectionToken("CF_QUEUE_BINDING_REF");
-const DO_BINDING_REF = new InjectionToken("CF_DO_BINDING_REF");
-const AI_BINDING_REF = new InjectionToken("CF_AI_BINDING_REF");
-const VECTORIZE_BINDING_REF = new InjectionToken("CF_VECTORIZE_BINDING_REF");
-const HYPERDRIVE_BINDING_REF = new InjectionToken("CF_HYPERDRIVE_BINDING_REF");
-const ENV_REF = new InjectionToken("CF_ENV_REF");
-//#endregion
-//#region \0@oxc-project+runtime@0.139.0/helpers/esm/decorateMetadata.js
-function __decorateMetadata(k, v) {
-	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+	const app = new CloudflareApplication(velaApp, options.env);
+	app.scanInstances(velaApp.getInstances());
+	registerWebSocketRoutes(app.getHonoApp(), app.getWsGatewayRoutes());
+	return app;
 }
-//#endregion
-//#region \0@oxc-project+runtime@0.139.0/helpers/esm/decorateParam.js
-function __decorateParam(paramIndex, decorator) {
-	return function(target, key) {
-		decorator(target, key, paramIndex);
+/**
+* Worker entrypoint with one bootstrap per environment identity. Weak keys let
+* obsolete environments and secrets be collected. Concurrent cold events share
+* construction; failed construction is evicted so the next event can retry.
+*/
+function createCloudflareWorker(rootModule, options) {
+	const applications = /* @__PURE__ */ new WeakMap();
+	const application = (env) => {
+		const existing = applications.get(env);
+		if (existing) return existing;
+		const pending = createCloudflareApp(rootModule, {
+			...options,
+			env
+		});
+		applications.set(env, pending);
+		pending.catch(() => {
+			if (applications.get(env) === pending) applications.delete(env);
+		});
+		return pending;
+	};
+	return {
+		async fetch(request, env, ctx) {
+			return (await application(env)).fetch(request, env, ctx);
+		},
+		async scheduled(event, env, ctx) {
+			return (await application(env)).scheduled(event, env, ctx);
+		},
+		async queue(batch, env, ctx) {
+			return (await application(env)).queue(batch, env, ctx);
+		}
 	};
 }
 //#endregion
-//#region \0@oxc-project+runtime@0.139.0/helpers/esm/decorate.js
-function __decorate(decorators, target, key, desc) {
-	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-	if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-	return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
+//#region src/storage/storage.tokens.ts
+const STORAGE_OPTIONS = new InjectionToken("STORAGE_OPTIONS");
 //#endregion
-//#region src/services/kv.service.ts
-let KVService = class KVService {
-	ref;
-	constructor(ref) {
-		this.ref = ref;
-	}
-	get namespace() {
-		return this.ref.value;
-	}
+//#region src/storage/storage-key-claim.ts
+/** R2-compatible object-key claim bound. Keeps decode work predictably small. */
+const MAX_STORAGE_KEY_BYTES = 1024;
+const BASE64URL_RE = /^[A-Za-z0-9_-]+$/;
+const ROOT_TOKEN_PATTERNS = {
+	date: "\\d{4}-\\d{2}-\\d{2}",
+	year: "\\d{4}",
+	month: "(?:0[1-9]|1[0-2])",
+	day: "(?:0[1-9]|[12]\\d|3[01])",
+	uuid: "[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}"
 };
-KVService = __decorate([
-	Injectable(),
-	__decorateParam(0, Inject(KV_BINDING_REF)),
-	__decorateMetadata("design:paramtypes", [Object])
-], KVService);
-//#endregion
-//#region src/modules/create-binding-module.ts
-function createBindingModule(opts) {
-	const className = `${opts.name}Module`;
-	const moduleClass = { [className]: class {} }[className];
-	return defineConfigurableModule({
-		module: moduleClass,
-		methodName: "forRoot",
-		keyFrom: ({ binding }) => binding,
-		providers: ({ binding }) => [{
-			provide: opts.bindingRefToken,
-			useValue: new BindingRef(binding)
-		}, opts.serviceClass],
-		exports: [opts.serviceClass, opts.bindingRefToken]
-	});
+/** Encode an object key as an opaque, canonical base64url query claim. */
+function encodeStorageKeyClaim(key) {
+	const bytes = new TextEncoder().encode(key);
+	if (bytes.byteLength === 0 || bytes.byteLength > 1024) throw new Error(`Storage key must be 1–${MAX_STORAGE_KEY_BYTES} UTF-8 bytes`);
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
-//#endregion
-//#region src/modules/kv.module.ts
-const KVModule = createBindingModule({
-	name: "KV",
-	serviceClass: KVService,
-	bindingRefToken: KV_BINDING_REF
-});
-//#endregion
-//#region src/services/d1.service.ts
-let D1Service = class D1Service {
-	ref;
-	constructor(ref) {
-		this.ref = ref;
-	}
-	get database() {
-		return this.ref.value;
-	}
-};
-D1Service = __decorate([
-	Injectable(),
-	__decorateParam(0, Inject(D1_BINDING_REF)),
-	__decorateMetadata("design:paramtypes", [Object])
-], D1Service);
-//#endregion
-//#region src/modules/d1.module.ts
-const D1Module = createBindingModule({
-	name: "D1",
-	serviceClass: D1Service,
-	bindingRefToken: D1_BINDING_REF
-});
-//#endregion
-//#region src/services/r2.service.ts
-let R2Service = class R2Service {
-	ref;
-	constructor(ref) {
-		this.ref = ref;
-	}
-	get bucket() {
-		return this.ref.value;
-	}
-};
-R2Service = __decorate([
-	Injectable(),
-	__decorateParam(0, Inject(R2_BINDING_REF)),
-	__decorateMetadata("design:paramtypes", [Object])
-], R2Service);
-//#endregion
-//#region src/modules/r2.module.ts
-const R2Module = createBindingModule({
-	name: "R2",
-	serviceClass: R2Service,
-	bindingRefToken: R2_BINDING_REF
-});
-//#endregion
-//#region src/services/queue.service.ts
-let QueueService = class QueueService {
-	ref;
-	constructor(ref) {
-		this.ref = ref;
-	}
-	get queue() {
-		return this.ref.value;
-	}
-};
-QueueService = __decorate([
-	Injectable(),
-	__decorateParam(0, Inject(QUEUE_BINDING_REF)),
-	__decorateMetadata("design:paramtypes", [Object])
-], QueueService);
-//#endregion
-//#region src/modules/queue.module.ts
-const QueueModule = createBindingModule({
-	name: "Queue",
-	serviceClass: QueueService,
-	bindingRefToken: QUEUE_BINDING_REF
-});
-//#endregion
-//#region src/services/durable-object.service.ts
-let DurableObjectService = class DurableObjectService {
-	ref;
-	constructor(ref) {
-		this.ref = ref;
-	}
-	get namespace() {
-		return this.ref.value;
-	}
-};
-DurableObjectService = __decorate([
-	Injectable(),
-	__decorateParam(0, Inject(DO_BINDING_REF)),
-	__decorateMetadata("design:paramtypes", [Object])
-], DurableObjectService);
-//#endregion
-//#region src/modules/durable-object.module.ts
-const DurableObjectModule = createBindingModule({
-	name: "DurableObject",
-	serviceClass: DurableObjectService,
-	bindingRefToken: DO_BINDING_REF
-});
-//#endregion
-//#region src/services/ai.service.ts
-let AIService = class AIService {
-	ref;
-	constructor(ref) {
-		this.ref = ref;
-	}
-	get binding() {
-		return this.ref.value;
-	}
-};
-AIService = __decorate([
-	Injectable(),
-	__decorateParam(0, Inject(AI_BINDING_REF)),
-	__decorateMetadata("design:paramtypes", [Object])
-], AIService);
-//#endregion
-//#region src/modules/ai.module.ts
-const AIModule = createBindingModule({
-	name: "AI",
-	serviceClass: AIService,
-	bindingRefToken: AI_BINDING_REF
-});
-//#endregion
-//#region src/services/vectorize.service.ts
-let VectorizeService = class VectorizeService {
-	ref;
-	constructor(ref) {
-		this.ref = ref;
-	}
-	get index() {
-		return this.ref.value;
-	}
-};
-VectorizeService = __decorate([
-	Injectable(),
-	__decorateParam(0, Inject(VECTORIZE_BINDING_REF)),
-	__decorateMetadata("design:paramtypes", [Object])
-], VectorizeService);
-//#endregion
-//#region src/modules/vectorize.module.ts
-const VectorizeModule = createBindingModule({
-	name: "Vectorize",
-	serviceClass: VectorizeService,
-	bindingRefToken: VECTORIZE_BINDING_REF
-});
-//#endregion
-//#region src/services/hyperdrive.service.ts
-let HyperdriveService = class HyperdriveService {
-	ref;
-	constructor(ref) {
-		this.ref = ref;
-	}
-	get binding() {
-		return this.ref.value;
-	}
-	get connectionString() {
-		return this.binding.connectionString;
-	}
-	get host() {
-		return this.binding.host;
-	}
-	get port() {
-		return this.binding.port;
-	}
-	get user() {
-		return this.binding.user;
-	}
-	get password() {
-		return this.binding.password;
-	}
-	get database() {
-		return this.binding.database;
-	}
-};
-HyperdriveService = __decorate([
-	Injectable(),
-	__decorateParam(0, Inject(HYPERDRIVE_BINDING_REF)),
-	__decorateMetadata("design:paramtypes", [Object])
-], HyperdriveService);
-//#endregion
-//#region src/modules/hyperdrive.module.ts
-const HyperdriveModule = createBindingModule({
-	name: "Hyperdrive",
-	serviceClass: HyperdriveService,
-	bindingRefToken: HYPERDRIVE_BINDING_REF
-});
-//#endregion
-//#region src/services/env.service.ts
-let EnvService = class EnvService {
-	ref;
-	constructor(ref) {
-		this.ref = ref;
-	}
-	/** The full env record. Throws if read before the first request. */
-	get env() {
-		return this.ref.value;
-	}
-	/** Read a single env entry (binding, var, or secret) by name. */
-	get(key) {
-		return this.ref.value[key];
+/** Decode exactly one canonical base64url layer. Malformed/non-UTF-8 claims return undefined. */
+function decodeStorageKeyClaim(claim) {
+	try {
+		if (claim.length === 0 || claim.length > Math.ceil(4096 / 3) || !BASE64URL_RE.test(claim) || claim.length % 4 === 1) return;
+		const base64 = claim.replace(/-/g, "+").replace(/_/g, "/");
+		const padded = base64 + "=".repeat((4 - base64.length % 4) % 4);
+		const binary = atob(padded);
+		const bytes = new Uint8Array(new ArrayBuffer(binary.length));
+		for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+		if (bytes.byteLength === 0 || bytes.byteLength > 1024) return void 0;
+		const decoded = new TextDecoder("utf-8", {
+			fatal: true,
+			ignoreBOM: false
+		}).decode(bytes);
+		return encodeStorageKeyClaim(decoded) === claim ? decoded : void 0;
+	} catch {
+		return;
 	}
-};
-EnvService = __decorate([
-	Injectable(),
-	__decorateParam(0, Inject(ENV_REF)),
-	__decorateMetadata("design:paramtypes", [Object])
-], EnvService);
-//#endregion
-//#region src/modules/env.module.ts
-/**
-* Provides {@link EnvService} GLOBALLY so any module's provider factories can
-* `inject: [EnvService]`. Register once on the root module:
-*
-* ```ts
-* @Module({ imports: [EnvModule.forRoot(), AuthModule.forRootAsync({ ... })] })
-* class AppModule {}
-* ```
-*
-* The {@link EnvRef} it provides is collected and initialized by
-* createCloudflareApp's binding-init middleware on the first request (the
-* factory passes it the full `env`, not a single binding).
-*/
-var EnvModule = class EnvModule {
-	static forRoot() {
-		const ref = new EnvRef();
-		return {
-			module: EnvModule,
-			global: true,
-			providers: [{
-				provide: ENV_REF,
-				useValue: ref
-			}, EnvService],
-			exports: [EnvService, ENV_REF]
-		};
+}
+function isDotSegment(segment) {
+	let decoded = segment;
+	for (let i = 0; i < 2; i++) {
+		if (decoded === "" || decoded === "." || decoded === "..") return true;
+		try {
+			const next = decodeURIComponent(decoded);
+			if (next === decoded) break;
+			decoded = next;
+		} catch {
+			break;
+		}
 	}
-};
+	return decoded === "" || decoded === "." || decoded === "..";
+}
+function rootSegmentPattern(segment) {
+	let pattern = "";
+	let cursor = 0;
+	for (const match of segment.matchAll(/\{(date|year|month|day|uuid)\}/g)) {
+		pattern += segment.slice(cursor, match.index).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+		pattern += ROOT_TOKEN_PATTERNS[match[1]];
+		cursor = match.index + match[0].length;
+	}
+	pattern += segment.slice(cursor).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+	return pattern;
+}
+/** Assert a canonical key is beneath a static or templated configured root. */
+function isStorageKeyWithinRoot(key, root) {
+	const segments = (root ?? "").split(/[/\\]+/).filter((segment) => !isDotSegment(segment));
+	if (segments.length === 0) return key.length > 0;
+	const rootPattern = segments.map(rootSegmentPattern).join("/");
+	return new RegExp(`^(?:${rootPattern})(?:/|$)`).test(key);
+}
 //#endregion
 //#region src/storage/r2-storage.driver.ts
 /** Base path of the StorageController presign-proxy route. */
@@ -955,9 +491,19 @@ var R2StorageDriver = class {
 	}
 	async getPresignedUrl(path, method, expiresIn) {
 		if (!this.config.secret) throw new Error("A signing secret is required for presigned URLs (set APP_SECRET).");
-		if (!Number.isFinite(expiresIn) || expiresIn <= 0) throw new Error(`Invalid presigned URL expiry: ${expiresIn}s (must be a positive number).`);
+		if (!Number.isSafeInteger(expiresIn) || expiresIn <= 0) throw new Error(`Invalid presigned URL expiry: ${expiresIn}s (must be a positive safe integer).`);
+		const claim = encodeStorageKeyClaim(path);
+		const routePath = `${STORAGE_ROUTE_BASE}/${encodeURIComponent(this.config.disk)}`;
+		const query = new URLSearchParams({
+			key: claim,
+			method
+		});
 		return {
-			url: await signUrl(`${`${STORAGE_ROUTE_BASE}/${this.config.disk}/${path}`}?method=${method}`, this.config.secret, { expiresIn }),
+			url: await signUrl(`${routePath}?${query}`, this.config.secret, {
+				expiresIn,
+				method,
+				purpose: STORAGE_SIGNED_URL_PURPOSE
+			}),
 			method,
 			expiresIn,
 			expiresAt: new Date(Date.now() + expiresIn * 1e3)
@@ -965,16 +511,23 @@ var R2StorageDriver = class {
 	}
 };
 //#endregion
-//#region src/storage/storage.tokens.ts
-const STORAGE_OPTIONS = new InjectionToken("STORAGE_OPTIONS");
+//#region \0@oxc-project+runtime@0.150.0/helpers/esm/decorateMetadata.js
+function __decorateMetadata(k, v) {
+	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+//#endregion
+//#region \0@oxc-project+runtime@0.150.0/helpers/esm/decorateParam.js
+function __decorateParam(paramIndex, decorator) {
+	return function(target, key) {
+		decorator(target, key, paramIndex);
+	};
+}
 //#endregion
 //#region src/storage/storage-manager.service.ts
 let StorageManagerService = class StorageManagerService {
 	options;
-	env;
-	constructor(options, env) {
+	constructor(options) {
 		this.options = options;
-		this.env = env;
 	}
 	hasDisk(disk) {
 		return this.options.disks.some((d) => d.disk === disk);
@@ -985,53 +538,59 @@ let StorageManagerService = class StorageManagerService {
 		return config;
 	}
 	getDriver(disk) {
-		const config = this.getDiskConfig(disk);
-		const bucket = this.env.get(config.binding);
-		if (!bucket) throw new Error(`R2 binding "${config.binding}" for disk "${disk}" was not found in env.`);
 		return new R2StorageDriver({
 			disk,
-			bucket,
-			secret: this.env.get("APP_SECRET")
+			bucket: this.getDiskConfig(disk).bucket,
+			secret: this.options.secret
 		});
 	}
 };
 StorageManagerService = __decorate([
 	Injectable(),
 	__decorateParam(0, Inject(STORAGE_OPTIONS)),
-	__decorateParam(1, Inject(EnvService)),
-	__decorateMetadata("design:paramtypes", [Object, typeof EnvService === "undefined" ? Object : EnvService])
+	__decorateMetadata("design:paramtypes", [Object])
 ], StorageManagerService);
 //#endregion
 //#region src/storage/storage.controller.ts
 let StorageController = class StorageController {
 	manager;
-	env;
-	constructor(manager, env) {
+	options;
+	constructor(manager, options) {
 		this.manager = manager;
-		this.env = env;
+		this.options = options;
 	}
 	async download(c) {
-		const secret = this.env.get("APP_SECRET");
+		const secret = this.options.secret;
 		if (!secret) return new Response("Storage signing is not configured", { status: 500 });
+		if (!await verifySignedUrl(c.req.url, secret, {
+			method: c.req.method,
+			purpose: STORAGE_SIGNED_URL_PURPOSE
+		})) return new Response("Invalid or expired URL", { status: 403 });
+		const url = new URL(c.req.url);
+		if (url.searchParams.get("method") !== "GET") return new Response("URL is not scoped for reads", { status: 403 });
 		const disk = c.req.param("disk");
 		if (!disk || !this.manager.hasDisk(disk)) return new Response("Unknown disk", { status: 404 });
-		if (!await verifySignedUrl(c.req.url, secret)) return new Response("Invalid or expired URL", { status: 403 });
-		const url = new URL(c.req.url);
-		if ((url.searchParams.get("method") ?? "GET") !== "GET") return new Response("URL is not scoped for reads", { status: 403 });
-		const { pathname } = url;
-		const prefix = `/storage/${disk}/`;
-		const idx = pathname.indexOf(prefix);
-		const fullPath = idx >= 0 ? decodeURIComponent(pathname.slice(idx + prefix.length)) : "";
+		const claim = url.searchParams.get("key");
+		const decoded = claim ? decodeStorageKeyClaim(claim) : void 0;
+		if (!decoded) return new Response("Malformed storage key claim", { status: 400 });
+		const fullPath = joinStoragePath(void 0, decoded);
+		if (fullPath !== decoded) return new Response("Invalid storage key", { status: 403 });
+		if (!isStorageKeyWithinRoot(fullPath, this.manager.getDiskConfig(disk).root)) return new Response("Storage key is outside the configured root", { status: 403 });
 		try {
 			const result = await this.manager.getDriver(disk).download(fullPath);
-			return new Response(result.toStream(), { headers: { "content-type": result.contentType } });
+			const filename = fullPath.split("/").at(-1) || "download";
+			return new Response(result.toStream(), { headers: {
+				"content-type": result.contentType || "application/octet-stream",
+				"content-disposition": `attachment; filename*=UTF-8''${encodeURIComponent(filename)}`,
+				"x-content-type-options": "nosniff"
+			} });
 		} catch {
 			return new Response("Not found", { status: 404 });
 		}
 	}
 };
 __decorate([
-	Get("/:disk/*"),
+	Get("/:disk"),
 	__decorateParam(0, Req()),
 	__decorateMetadata("design:type", Function),
 	__decorateMetadata("design:paramtypes", [Object]),
@@ -1040,8 +599,8 @@ __decorate([
 StorageController = __decorate([
 	Controller("storage"),
 	__decorateParam(0, Inject(StorageManagerService)),
-	__decorateParam(1, Inject(EnvService)),
-	__decorateMetadata("design:paramtypes", [typeof StorageManagerService === "undefined" ? Object : StorageManagerService, typeof EnvService === "undefined" ? Object : EnvService])
+	__decorateParam(1, Inject(STORAGE_OPTIONS)),
+	__decorateMetadata("design:paramtypes", [typeof StorageManagerService === "undefined" ? Object : StorageManagerService, Object])
 ], StorageController);
 //#endregion
 //#region src/storage/storage.service.ts
@@ -1087,7 +646,7 @@ let StorageService = class StorageService {
 	validateExpiry(expiresIn) {
 		const cfg = this.options.presignedUrl ?? DEFAULT_PRESIGN;
 		const value = expiresIn ?? cfg.defaultExpiry;
-		if (!Number.isFinite(value) || value < 1 || value > cfg.maxExpiry) throw new Error(`Presigned URL expiry ${value}s is out of range (1–${cfg.maxExpiry}s).`);
+		if (!Number.isSafeInteger(value) || value < 1 || value > cfg.maxExpiry) throw new Error(`Presigned URL expiry ${value}s is out of range (1–${cfg.maxExpiry}s).`);
 		return value;
 	}
 };
@@ -1105,7 +664,6 @@ const { ConfigurableModuleClass } = new ConfigurableModuleBuilder({
 }).build();
 let StorageModule = class StorageModule extends ConfigurableModuleClass {};
 StorageModule = __decorate([Module({
-	imports: [EnvModule.forRoot()],
 	providers: [StorageManagerService, StorageService],
 	controllers: [StorageController],
 	exports: [
@@ -1116,13 +674,19 @@ StorageModule = __decorate([Module({
 })], StorageModule);
 //#endregion
 //#region src/services/kv-cache.store.ts
-let KVCacheStore = class KVCacheStore {
-	kv;
-	constructor(kv) {
-		this.kv = kv;
-	}
-	get ns() {
-		return this.kv.namespace;
+/**
+* Cloudflare KV-backed {@link CacheStore}. Values are JSON-encoded. Intended as
+* the slow tier under a `TieredCacheStore` (memory L1 → KV L2), but usable
+* standalone from a typed environment factory: `new KVCacheStore(env.CACHE)`.
+* Reads return unknown JSON; validate values at the consuming boundary.
+*
+* Note: Cloudflare KV requires `expirationTtl >= 60s`, so sub-minute TTLs are
+* clamped up. Keep short TTLs on the memory tier; use KV for longer-lived entries.
+*/
+var KVCacheStore = class {
+	ns;
+	constructor(ns) {
+		this.ns = ns;
 	}
 	async get(key) {
 		const value = await this.ns.get(key, "json");
@@ -1144,11 +708,6 @@ let KVCacheStore = class KVCacheStore {
 		} while (cursor);
 	}
 };
-KVCacheStore = __decorate([
-	Injectable(),
-	__decorateParam(0, Inject(KVService)),
-	__decorateMetadata("design:paramtypes", [typeof KVService === "undefined" ? Object : KVService])
-], KVCacheStore);
 //#endregion
 //#region src/services/flagship-flag.driver.ts
 /**
@@ -1161,16 +720,12 @@ KVCacheStore = __decorate([
 * dev-proxy tunnel dropping) propagates — `@velajs/feature-flags`'s service owns
 * the never-throw guarantee.
 *
-* The binding only exists per request in a Worker, so pass a lazy accessor when
-* wiring from a bootstrap factory (mirroring how {@link EnvService} reads are
-* deferred); a resolved binding may be passed directly in tests.
+* Build the driver inside a provider factory with the native environment:
 *
 * ```ts
 * FeatureFlagsModule.forRootAsync({
-*   inject: [EnvService],
-*   useFactory: (env: EnvService) => ({
-*     drivers: [flagshipFlagDriver(() => env.get<FlagshipBinding>('FLAGS')!)],
-*   }),
+*   inject: [ENV],
+*   useFactory: (env: WorkerEnv) => ({ drivers: [flagshipFlagDriver(env.FLAGS)] }),
 * });
 * ```
 *
@@ -1204,18 +759,36 @@ function flagshipFlagDriver(binding, options) {
 }
 //#endregion
 //#region src/services/kv-flag.driver.ts
-let KvFlagDriver = class KvFlagDriver {
-	kv;
+/**
+* Cloudflare KV-backed {@link FeatureFlagDriver}. Flags are stored as JSON
+* values under an optional key prefix and read with `get(key, 'json')`. Reads
+* are type-checked against the requested type: a missing key or a value of the
+* wrong JSON type returns the caller's `fallback`. KV has no targeting, so the
+* evaluation context is ignored.
+*
+* The driver stays honest — it does **not** swallow errors. A KV failure (or a
+* `SyntaxError` from a malformed stored value) propagates; the never-throw
+* guarantee lives in `@velajs/feature-flags`'s service layer.
+*
+* Placed like {@link KVCacheStore}: construct it in a wiring factory over a
+* resolved {@link KVNamespace}.
+*
+* ```ts
+* FeatureFlagsModule.forRootAsync({
+*   inject: [ENV],
+*   useFactory: (env: WorkerEnv) => ({ drivers: [new KvFlagDriver(env.CACHE, { prefix: 'flag:' })] }),
+* });
+* ```
+*/
+var KvFlagDriver = class {
+	ns;
 	name;
 	prefix;
-	constructor(kv, options = {}) {
-		this.kv = kv;
+	constructor(ns, options = {}) {
+		this.ns = ns;
 		this.name = options.name ?? "kv";
 		this.prefix = options.prefix ?? "";
 	}
-	get ns() {
-		return this.kv.namespace;
-	}
 	getBoolean(key, fallback, _ctx) {
 		return this.read(key, fallback, (v) => typeof v === "boolean");
 	}
@@ -1239,11 +812,6 @@ let KvFlagDriver = class KvFlagDriver {
 		return matches(value) ? value : fallback;
 	}
 };
-KvFlagDriver = __decorate([
-	Injectable(),
-	__decorateParam(0, Inject(KVService)),
-	__decorateMetadata("design:paramtypes", [typeof KVService === "undefined" ? Object : KVService, Object])
-], KvFlagDriver);
 /** Convenience factory for {@link KvFlagDriver}. */
 function kvFlagDriver(kv, options) {
 	return new KvFlagDriver(kv, options);
@@ -1259,7 +827,7 @@ function kvFlagDriver(kv, options) {
 * @example
 * ```ts
 * @Get()
-* handle(@Env() env: CloudflareEnv) { ... }
+* handle(@Env() env: WorkerEnv) { ... }
 *
 * @Get()
 * handle(@Env('MY_KV') kv: KVNamespace) { ... }
@@ -1267,8 +835,8 @@ function kvFlagDriver(kv, options) {
 */
 const Env = createParamDecorator((bindingName, ctx) => {
 	const env = ctx.getContext().env;
-	if (!env) return void 0;
-	return bindingName ? env[bindingName] : env;
+	if (typeof env !== "object" || env === null) return void 0;
+	return bindingName ? Reflect.get(env, bindingName) : env;
 });
 //#endregion
 //#region src/decorators/scheduled.ts
@@ -1338,262 +906,6 @@ function QueueConsumer(queueName) {
 	};
 }
 //#endregion
-//#region src/websocket/cf-room-registry.ts
-/**
-* Core `RoomRegistry` backed by a Durable Object's hibernatable sockets. Room
-* membership lives in tags (hub room, set at accept) + the attachment (dynamic
-* `join()`), never in DO instance fields — so it survives hibernation with zero
-* rehydration.
-*/
-var CfRoomRegistry = class {
-	ctx;
-	constructor(ctx) {
-		this.ctx = ctx;
-	}
-	register(_client) {}
-	leaveAll(_client) {}
-	join(client, room) {
-		return client.join(room);
-	}
-	leave(client, room) {
-		return client.leave(room);
-	}
-	localIdsInRoom(room) {
-		return this.socketsForRoom(room).map((ws) => this.attachmentOf(ws).connId);
-	}
-	deliverLocal(cmd) {
-		const excludeIds = new Set(cmd.exceptIds ?? []);
-		const excludeRooms = cmd.exceptRooms ?? [];
-		const targets = cmd.rooms.length === 0 ? this.ctx.getWebSockets() : this.collectRooms(cmd.rooms);
-		const seen = /* @__PURE__ */ new Set();
-		for (const ws of targets) {
-			const att = this.attachmentOf(ws);
-			if (seen.has(att.connId)) continue;
-			seen.add(att.connId);
-			if (excludeIds.has(att.connId)) continue;
-			if (excludeRooms.some((r) => att.rooms.includes(r))) continue;
-			ws.send(cmd.frame);
-		}
-	}
-	collectRooms(rooms) {
-		const set = /* @__PURE__ */ new Set();
-		for (const room of rooms) for (const ws of this.socketsForRoom(room)) set.add(ws);
-		return [...set];
-	}
-	socketsForRoom(room) {
-		return this.ctx.getWebSockets().filter((ws) => this.attachmentOf(ws).rooms.includes(room));
-	}
-	attachmentOf(ws) {
-		return ws.deserializeAttachment() ?? {
-			connId: "",
-			path: "",
-			rooms: [],
-			data: {}
-		};
-	}
-	/** Reconstruct a `WsClient` for a raw socket (e.g. inside gateway lifecycle scans). */
-	clientFor(ws) {
-		return new CfWsClient(this.ctx, ws);
-	}
-};
-//#endregion
-//#region src/websocket/ws-server-holder.ts
-let WsServerHolder = class WsServerHolder {
-	target;
-	setTarget(server) {
-		this.target = server;
-	}
-	get resolved() {
-		if (!this.target) throw new Error("WebSocket server is only available inside a WebSocket Durable Object. To push from a Worker HTTP handler, use broadcastToRoom(namespace, room, ...).");
-		return this.target;
-	}
-	emit(event, data) {
-		return this.resolved.emit(event, data);
-	}
-	to(room) {
-		return this.resolved.to(room);
-	}
-	in(room) {
-		return this.resolved.in(room);
-	}
-	except(room) {
-		return this.resolved.except(room);
-	}
-};
-WsServerHolder = __decorate([Injectable()], WsServerHolder);
-//#endregion
-//#region src/websocket/do-bootstrap.ts
-/**
-* Slim DI bootstrap for the Durable Object isolate: wires the container and runs
-* `OnModuleInit`/`OnApplicationBootstrap` (so `WsDispatcher` discovers gateways)
-* WITHOUT building the Hono app/routes the DO never serves. Cloudflare binding
-* refs are initialized straight from the DO's `env`, and the ctx-backed server
-* is bound before bootstrap lifecycle so gateway `afterInit`/handlers see it.
-*/
-async function buildDoRuntime(rootModule, ctx, env) {
-	const { container, routeManager, loader } = await bootstrap(rootModule);
-	for (const value of container.getUseValues()) if (value instanceof EnvRef) value._initialize(env);
-	else if (value instanceof BindingRef) value._initialize(env[value.bindingName]);
-	const registry = new CfRoomRegistry(ctx);
-	const driver = local();
-	driver.bind(registry);
-	const server = new WsServerImpl(driver);
-	try {
-		const holder = container.resolve(WS_SERVER);
-		if (holder instanceof WsServerHolder) holder.setTarget(server);
-	} catch {}
-	const app = new VelaApplication(container, routeManager);
-	app.setInstances(await loader.resolveAllInstances());
-	await app.callOnModuleInit();
-	await app.callOnApplicationBootstrap();
-	const wsEntrypoints = app.entrypoints.ofKind("websocket");
-	const live = initDoLive(app, container, ctx);
-	return {
-		dispatcher: wsEntrypoints[0]?.meta.dispatcher ?? app.get(WsDispatcher),
-		registry,
-		server,
-		gatewayPaths: wsEntrypoints.map((ep) => ep.meta.path),
-		live,
-		close: (signal) => app.close(signal)
-	};
-}
-//#endregion
-//#region src/websocket/do-websocket-host.ts
-/**
-* The socket lifecycle inside a WebSocket Durable Object, decoupled from the
-* `cloudflare:workers` base class so it is unit-testable with fakes. The thin
-* `VelaWebSocketDurableObject` shell forwards its hibernation callbacks here.
-*/
-var DoWebSocketHost = class {
-	ctx;
-	dispatcher;
-	registry;
-	gatewayPaths;
-	constructor(ctx, dispatcher, registry, gatewayPaths = []) {
-		this.ctx = ctx;
-		this.dispatcher = dispatcher;
-		this.registry = registry;
-		this.gatewayPaths = gatewayPaths;
-	}
-	/** The single registered gateway's path — a fallback when the Worker didn't forward `x-vela-path`. */
-	defaultPath() {
-		return this.gatewayPaths[0];
-	}
-	/**
-	* Accept a hibernatable socket: tag it with its hub room + connection id,
-	* persist the attachment, then fire `OnGatewayConnection` WITHOUT blocking the
-	* 101 response (the caller returns it immediately).
-	*/
-	accept(ws, path, roomId, userId) {
-		const connId = crypto.randomUUID();
-		this.ctx.acceptWebSocket(ws, [roomTag(roomId), connTag(connId)]);
-		const attachment = {
-			connId,
-			userId,
-			path,
-			rooms: [roomId],
-			data: userId ? { userId } : {}
-		};
-		ws.serializeAttachment(attachment);
-		Promise.resolve(this.dispatcher.handleOpen(path, new CfWsClient(this.ctx, ws))).catch((err) => console.warn("[vela] websocket handleConnection failed:", err));
-	}
-	async onMessage(ws, message) {
-		const client = new CfWsClient(this.ctx, ws);
-		await this.dispatcher.dispatchMessage(client.path, client, message);
-	}
-	async onClose(ws, code, reason) {
-		const client = new CfWsClient(this.ctx, ws);
-		await this.dispatcher.handleClose(client.path, client, code, reason);
-		try {
-			if (code === 1e3 || code >= 3e3 && code <= 4999) ws.close(code, reason);
-			else ws.close();
-		} catch {}
-	}
-	async onError(ws, err) {
-		const client = new CfWsClient(this.ctx, ws);
-		await this.dispatcher.handleError(client.path, client, err);
-	}
-	/** Deliver a broadcast command to this DO's local sockets (RPC entry point). */
-	broadcast(cmd) {
-		this.registry.deliverLocal(cmd);
-	}
-};
-//#endregion
-//#region src/websocket/websocket.durable-object.ts
-const PING = "{\"event\":\"ping\"}";
-const PONG = "{\"event\":\"pong\"}";
-/**
-* Base class for the WebSocket Durable Object. The user exports a named subclass
-* (matching their `wrangler.toml` `class_name`) built from their `AppModule`:
-*
-* ```ts
-* export class ChatRoom extends VelaWebSocketDurableObject(AppModule) {}
-* ```
-*
-* It owns the raw hibernation socket lifecycle (Hono's `upgradeWebSocket` cannot
-* bridge DO hibernation) and forwards every event into the runtime-agnostic
-* `WsDispatcher` via {@link DoWebSocketHost}.
-*/
-function VelaWebSocketDurableObject(rootModule) {
-	return class VelaWsDurableObject extends DurableObject {
-		host;
-		liveEngine;
-		ready;
-		constructor(ctx, env) {
-			super(ctx, env);
-			try {
-				ctx.setWebSocketAutoResponse(new WebSocketRequestResponsePair(PING, PONG));
-			} catch {}
-			this.ready = ctx.blockConcurrencyWhile(async () => {
-				const runtime = await buildDoRuntime(rootModule, ctx, env);
-				this.host = new DoWebSocketHost(ctx, runtime.dispatcher, runtime.registry, runtime.gatewayPaths);
-				this.liveEngine = runtime.live;
-			});
-		}
-		async fetch(request) {
-			await this.ready;
-			if (request.headers.get("upgrade")?.toLowerCase() !== "websocket") return new Response("Expected WebSocket upgrade", { status: 426 });
-			const { 0: client, 1: server } = new WebSocketPair();
-			const url = new URL(request.url);
-			const roomId = request.headers.get("x-vela-room") ?? this.ctx.id.name ?? url.pathname;
-			const path = request.headers.get("x-vela-path") ?? this.host.defaultPath() ?? url.pathname;
-			const userId = request.headers.get("x-vela-user") || void 0;
-			this.host.accept(server, path, roomId, userId);
-			return new Response(null, {
-				status: 101,
-				webSocket: client
-			});
-		}
-		async webSocketMessage(ws, message) {
-			await this.ready;
-			await this.host.onMessage(ws, message);
-		}
-		async webSocketClose(ws, code, reason) {
-			await this.ready;
-			await this.host.onClose(ws, code, reason);
-		}
-		async webSocketError(ws, error) {
-			await this.ready;
-			await this.host.onError(ws, error);
-		}
-		/** DO RPC — server-initiated broadcast forwarded from a Worker (see `broadcastToRoom`). */
-		async broadcast(cmd) {
-			await this.ready;
-			this.host.broadcast(cmd);
-		}
-		/**
-		* DO RPC — live tag invalidation forwarded from a Worker (durableObjectLive /
-		* liveInvalidateToRoom). Appends to THIS log scope's cursor log and returns
-		* the commit stamp (what `Vela-Commit-Cursor` carries); the subscription
-		* refreshes fan out asynchronously.
-		*/
-		async invalidate(cmd) {
-			await this.ready;
-			return this.liveEngine?.applyInvalidation(cmd);
-		}
-	};
-}
-//#endregion
 //#region src/websocket/cloudflare-websocket.module.ts
 /**
 * Cloudflare counterpart to the core `WebSocketModule.forRoot()`. Import this in
@@ -1604,12 +916,10 @@ function VelaWebSocketDurableObject(rootModule) {
 */
 var CloudflareWebSocketModule = class CloudflareWebSocketModule {
 	static forRoot() {
+		const providers = [defineProvider(WS_SERVER, { useClass: WsServerHolder }), WsDispatcher];
 		return {
 			module: CloudflareWebSocketModule,
-			providers: [{
-				provide: WS_SERVER,
-				useClass: WsServerHolder
-			}, WsDispatcher],
+			providers,
 			exports: [WS_SERVER, WsDispatcher]
 		};
 	}
@@ -1624,11 +934,11 @@ var CloudflareWebSocketModule = class CloudflareWebSocketModule {
 *
 * @example
 * ```ts
-* // In a controller — ns from DurableObjectService.namespace
-* await broadcastToRoom(ns, `org:${id}`, 'order.created', order);
+* // In a controller — ns from the typed Worker environment
+* await broadcastToRoom(ns, '/orgs/:orgId/ws', `org:${id}`, 'order.created', order);
 * ```
 */
-async function broadcastToRoom(ns, room, event, data, options) {
+async function broadcastToRoom(ns, gatewayPath, room, event, data, options) {
 	const cmd = {
 		rooms: [room],
 		exceptIds: options?.exceptIds,
@@ -1637,9 +947,77 @@ async function broadcastToRoom(ns, room, event, data, options) {
 			data
 		})
 	};
-	await ns.get(roomToDurableId(ns, room)).broadcast(cmd);
+	const maxFrameBytes = resolveMaxFrameBytes({ maxFrameBytes: options?.maxFrameBytes ?? DEFAULT_WS_MAX_FRAME_BYTES });
+	assertBroadcastCommandFits(cmd, maxFrameBytes);
+	await ns.get(roomToDurableId(ns, gatewayPath, room)).broadcast(cmd);
+}
+//#endregion
+//#region src/rate-limit/cloudflare-rate-limit.store.ts
+/**
+* Adapt a Cloudflare Workers Rate Limiting binding to Vela's throttler store.
+*
+* The platform binding makes the allow/deny decision. It does not expose exact
+* counters or reset timestamps, so this adapter intentionally omits `remaining`.
+*/
+function cloudflareRateLimitStore(binding, options) {
+	if (!binding || typeof binding !== "function" && typeof binding.limit !== "function") throw new TypeError("A Cloudflare Rate Limiting binding is required");
+	if (!Number.isSafeInteger(options.limit) || options.limit <= 0 || options.limit >= Number.MAX_SAFE_INTEGER) throw new RangeError("Rate limit must be a positive safe integer");
+	if (options.periodSeconds !== 10 && options.periodSeconds !== 60) throw new RangeError("Cloudflare rate-limit periods must be 10 or 60 seconds");
+	const maxKeyBytes = options.maxKeyBytes ?? 1024;
+	if (!Number.isSafeInteger(maxKeyBytes) || maxKeyBytes <= 0 || maxKeyBytes > 4096) throw new RangeError("maxKeyBytes must be between 1 and 4096");
+	const ttlMs = options.periodSeconds * 1e3;
+	const encoder = new TextEncoder();
+	const resolveBinding = typeof binding === "function" ? binding : () => binding;
+	return {
+		async increment(key, requestedTtlMs) {
+			if (requestedTtlMs !== ttlMs) throw new Error(`Cloudflare binding period mismatch: expected ${ttlMs}ms, received ${requestedTtlMs}ms`);
+			if (typeof key !== "string" || key.length === 0 || /[\u0000-\u001f\u007f]/.test(key) || encoder.encode(key).byteLength > maxKeyBytes) throw new Error("Refusing an invalid or oversized rate-limit key");
+			const currentBinding = resolveBinding();
+			if (!currentBinding || typeof currentBinding.limit !== "function") throw new Error("Cloudflare Rate Limiting binding is unavailable");
+			const decision = await currentBinding.limit({ key });
+			if (!decision || typeof decision.success !== "boolean") throw new Error("Cloudflare rate-limit binding returned an invalid decision");
+			return {
+				count: decision.success ? 0 : options.limit + 1,
+				ttlMs,
+				allowed: decision.success,
+				enforcedLimit: options.limit
+			};
+		},
+		reset() {
+			throw new Error("Cloudflare Rate Limiting bindings do not support counter reset");
+		}
+	};
+}
+//#endregion
+//#region src/nonce/durable-object-nonce.store.ts
+const APP_NAMESPACE_PREFIX = "vela:nonce:v1:";
+const MAX_APP_NAMESPACE_BYTES = 128;
+/**
+* Strict, cross-isolate {@link NonceStore} backed by one SQLite Durable Object
+* per explicit application namespace.
+*
+* Invalid input, an unavailable/malformed binding, RPC failure, or a malformed
+* RPC result all deny the claim (`false`). Only the literal boolean `true` from
+* the Durable Object is accepted.
+*/
+function durableObjectNonceStore(options) {
+	if (!options || typeof options !== "object") throw new TypeError("Durable Object nonce-store options are required");
+	if (!isCanonicalBoundedText(options.appNamespace, MAX_APP_NAMESPACE_BYTES)) throw new TypeError(`appNamespace must be canonical, non-empty, and at most ${MAX_APP_NAMESPACE_BYTES} UTF-8 bytes`);
+	if (typeof options.binding !== "function") throw new TypeError("A lazy Durable Object namespace binding resolver is required");
+	const objectName = `${APP_NAMESPACE_PREFIX}${options.appNamespace}`;
+	return { async claim(nonce, expEpochSeconds) {
+		const now = Math.floor(Date.now() / 1e3);
+		if (!isCanonicalBoundedText(nonce, 512) || !isValidExpiry(expEpochSeconds, now)) return false;
+		try {
+			const namespace = await options.binding();
+			const id = namespace.idFromName(objectName);
+			return await namespace.get(id).claim(nonce, expEpochSeconds) === true;
+		} catch {
+			return false;
+		}
+	} };
 }
 //#endregion
-export { AIModule, AIService, CloudflareApplication, CloudflareWebSocketModule, ConnectedSocket, D1Module, D1Service, DoCursorLog, DurableObjectModule, DurableObjectService, Env, EnvModule, EnvService, FlagshipFlagDriver, HyperdriveModule, HyperdriveService, KVCacheStore, KVModule, KVService, KvFlagDriver, MessageBody, QueueConsumer, QueueModule, QueueService, R2Module, R2Service, R2StorageDriver, STORAGE_OPTIONS, Scheduled, StorageController, StorageManagerService, StorageModule, StorageService, SubscribeMessage, VectorizeModule, VectorizeService, VelaWebSocketDurableObject, WebSocketGateway, WebSocketServer, WsException, broadcastToRoom, cloudflareAdapter, createCloudflareApp, durableObjectCursorLog, durableObjectLive, flagshipFlagDriver, kvFlagDriver, liveInvalidateToRoom };
+export { CloudflareApplication, CloudflareWebSocketModule, ConnectedSocket, DoCursorLog, DoPitrUnavailableError, Env, FlagshipFlagDriver, KVCacheStore, KvFlagDriver, MessageBody, QueueConsumer, R2StorageDriver, STORAGE_OPTIONS, Scheduled, StorageController, StorageManagerService, StorageModule, StorageService, SubscribeMessage, WebSocketGateway, WebSocketServer, WsException, armDoPitr, broadcastToRoom, cloudflareAdapter, cloudflareRateLimitStore, createCloudflareApp, createCloudflareWorker, durableObjectCursorLog, durableObjectLive, durableObjectNonceStore, durableObjectRoomName, flagshipFlagDriver, isDoPitrUnavailable, kvFlagDriver, liveInvalidateToRoom, readDoPitrBookmark };
 
 //# sourceMappingURL=index.js.map