@velajs/cloudflare 1.29.0 → 1.30.0

package/dist/index.js

@@ -1,1276 +1,21 @@
-import { C as durableObjectRoomName, T as roomToDurableId, a as armDoPitr, b as assertCloudflareEnvironment, c as __decorate, d as durableObjectLive, h as warnWorkerLocalLive, i as DoPitrUnavailableError, l as DoCursorLog, m as liveInvalidateToRoom, n as isValidExpiry, o as isDoPitrUnavailable, r as WsServerHolder, s as readDoPitrBookmark, t as isCanonicalBoundedText, u as durableObjectCursorLog, x as registerCloudflareEnvironment } from "./nonce-validation-Dy8z05A9.js";
-import { getConnInfo } from "hono/cloudflare-workers";
-import { ConfigurableModuleBuilder, Controller, Get, Inject, Injectable, InjectionToken, Module, PipelineRunner, Req, SCHEDULE_INVOCATION_SEED, Scope, VelaFactory, buildEntrypointExecutionContext, cronDialectAmbiguity, defineMetadata, defineProvider, getEntrypointModuleId, getMetadata, getTrustedRequestIdentity, invokeScheduledJob, parseCronMetadata, parseIntervalMetadata, registerEntrypointKind, resolveEntrypoint, resolveErrorReporter, resolveScopedComponentsAsync, runInEntrypointScope, scheduledJobComponents, shouldFilterCatch } from "@velajs/vela";
-import { ConnectedSocket, DEFAULT_WS_MAX_FRAME_BYTES, MessageBody, SubscribeMessage, WS_GATEWAY_METADATA, WS_SERVER, WebSocketGateway, WebSocketServer, WsDispatcher, WsException, assertBroadcastCommandFits, createWebSocketUpgradeGate, readWsEntrypointMeta, resolveGatewayRoomId, resolveGatewayRoomParam, resolveMaxFrameBytes } from "@velajs/vela/websocket";
-import { STORAGE_SIGNED_URL_PURPOSE, joinStoragePath, signUrl, verifySignedUrl } from "@velajs/vela/storage";
-//#region src/websocket/websocket-routing.ts
-const MAX_IDENTITY_FIELD_BYTES = 2048;
-const encoder = new TextEncoder();
-function isIdentityField(value) {
-	return typeof value === "string" && value.length > 0 && !value.includes("\r") && !value.includes("\n") && encoder.encode(value).byteLength <= MAX_IDENTITY_FIELD_BYTES;
-}
-/** `null` means an identity was present but violated the transport contract. */
-function accessIdentity(c) {
-	const value = getTrustedRequestIdentity(c.req.raw);
-	if (!value) return void 0;
-	const { principal, tenantId, expiresAtMs } = value;
-	if (!isIdentityField(principal.issuer) || !isIdentityField(principal.subject) || !isIdentityField(tenantId) || typeof expiresAtMs !== "number" || !Number.isSafeInteger(expiresAtMs) || expiresAtMs <= 0) return null;
-	return {
-		principal,
-		tenantId,
-		expiresAtMs
-	};
-}
-/** `null` means two independently verified identities disagree. */
-function combineIdentities(requestIdentity, upgradeIdentity) {
-	if (!requestIdentity && !upgradeIdentity) return void 0;
-	if (!requestIdentity) return upgradeIdentity;
-	if (!upgradeIdentity) return requestIdentity;
-	if (requestIdentity.principal.issuer !== upgradeIdentity.principal.issuer || requestIdentity.principal.subject !== upgradeIdentity.principal.subject || requestIdentity.principal.principalType !== upgradeIdentity.principal.principalType || requestIdentity.tenantId !== upgradeIdentity.tenantId) return null;
-	return {
-		principal: { ...upgradeIdentity.principal },
-		tenantId: upgradeIdentity.tenantId,
-		expiresAtMs: Math.min(requestIdentity.expiresAtMs, upgradeIdentity.expiresAtMs)
-	};
-}
-/** An instance's constructor is the class token its module registered. */
-function isClass(value) {
-	return typeof value === "function";
-}
-/**
-* Read `@WebSocketGateway({ path, binding })` off a resolved instance (CF-hosted
-* gateways only). The application container names the module that declares the
-* gateway when exactly one module registers it.
-*/
-function collectWsGatewayRoutes(instance, container) {
-	const options = getMetadata(WS_GATEWAY_METADATA, instance.constructor);
-	if (!options?.path || !options?.binding) return [];
-	resolveGatewayRoomParam(options);
-	resolveMaxFrameBytes(options);
-	const gateway = instance.constructor;
-	const owners = isClass(gateway) ? container.getOwnerModuleIds(gateway) : [];
-	return [{
-		path: options.path,
-		binding: options.binding,
-		options: { ...options },
-		...owners.length === 1 ? { moduleId: owners[0] } : {}
-	}];
-}
-/**
-* Registers the upgrade routes on the Worker's Hono app. Each route validates
-* the `Upgrade` header, authenticates through the gateway's authenticator
-* (resolved once from `container`, the application's DI container), resolves
-* the room's Durable Object, and forwards the raw request — injecting
-* spoof-safe `x-vela-*` headers the DO reads. The DO returns the `101` with the
-* client socket.
-*/
-function registerWebSocketRoutes(hono, routes, container) {
-	for (const route of routes) {
-		const authenticate = createWebSocketUpgradeGate(container, route);
-		hono.get(route.path, async (c) => {
-			if (c.req.header("upgrade")?.toLowerCase() !== "websocket") return c.text("Expected WebSocket upgrade", 426);
-			const headers = new Headers(c.req.raw.headers);
-			headers.delete("x-vela-room");
-			headers.delete("x-vela-path");
-			headers.delete("x-vela-user");
-			headers.delete("x-vela-expires-at");
-			headers.delete("x-vela-expires-at-ms");
-			headers.delete("x-vela-issuer");
-			headers.delete("x-vela-subject");
-			headers.delete("x-vela-principal-type");
-			headers.delete("x-vela-tenant");
-			const sanitizedRequest = new Request(c.req.raw, { headers });
-			let roomId;
-			try {
-				roomId = resolveGatewayRoomId(route.options, (name) => c.req.param(name));
-			} catch {
-				return c.text("Invalid WebSocket room", 400);
-			}
-			const upgrade = await authenticate(sanitizedRequest, roomId);
-			if (upgrade === false) return c.text("WebSocket upgrade forbidden", 403);
-			const requestIdentity = accessIdentity(c);
-			if (requestIdentity === null) return c.text("Invalid WebSocket identity", 403);
-			const identity = combineIdentities(requestIdentity, upgrade.identity);
-			if (identity === null) return c.text("Conflicting WebSocket identities", 403);
-			if (identity && identity.expiresAtMs <= Date.now()) return c.text("WebSocket identity expired", 403);
-			const forwardHeaders = new Headers(upgrade.request.headers);
-			forwardHeaders.set("x-vela-room", roomId);
-			forwardHeaders.set("x-vela-path", route.path);
-			if (identity) {
-				forwardHeaders.set("x-vela-user", identity.principal.subject);
-				forwardHeaders.set("x-vela-issuer", identity.principal.issuer);
-				forwardHeaders.set("x-vela-subject", identity.principal.subject);
-				forwardHeaders.set("x-vela-principal-type", identity.principal.principalType);
-				forwardHeaders.set("x-vela-tenant", identity.tenantId);
-				forwardHeaders.set("x-vela-expires-at-ms", String(identity.expiresAtMs));
-			}
-			return forwardToRoom(c.env, route.binding, route.path, roomId, new Request(upgrade.request, { headers: forwardHeaders }));
-		});
-	}
-}
-/**
-* Gateway metadata contains a runtime binding name, so the native type is
-* erased. Validate only the operations consumed here and their observable
-* results; never assert that an arbitrary value implements a native namespace.
-*/
-async function forwardToRoom(env, binding, path, room, request) {
-	if (typeof env !== "object" || env === null) throw new Error("Worker environment is missing");
-	const namespace = Reflect.get(env, binding);
-	if (typeof namespace !== "object" || namespace === null) return new Response(`Durable Object binding '${binding}' is not configured`, { status: 500 });
-	const idFromName = Reflect.get(namespace, "idFromName");
-	const get = Reflect.get(namespace, "get");
-	if (typeof idFromName !== "function" || typeof get !== "function") throw new Error("Invalid Durable Object namespace");
-	const id = Reflect.apply(idFromName, namespace, [durableObjectRoomName(path, room)]);
-	const stub = Reflect.apply(get, namespace, [id]);
-	if (typeof stub !== "object" || stub === null) throw new Error("Invalid Durable Object stub");
-	const fetch = Reflect.get(stub, "fetch");
-	if (typeof fetch !== "function") throw new Error("Durable Object stub has no fetch operation");
-	const response = await Reflect.apply(fetch, stub, [request]);
-	if (!(response instanceof Response)) throw new Error("Durable Object returned an invalid response");
-	return response;
-}
-//#endregion
-//#region src/scheduled-event.ts
-/**
-* Request-scoped Cloudflare view of the scheduled trigger, seeded into each
-* `@Cron` job's invocation scope by the Cloudflare adapter. Inject it where a
-* job needs platform controls such as `noRetry()`; the job's argument stays
-* the portable `ScheduleInvocation`. It resolves only inside a scheduled
-* invocation; resolving it anywhere else throws. A cron job fired on demand
-* (Studio's run-now) receives a synthetic event: `cron` is the job's
-* expression and `noRetry()` does nothing.
-*
-* The token provides itself as request-scoped in every container, so a class
-* that injects it is request-scoped wherever the graph boots (a Worker, a
-* Durable Object, the CLI or a testing module) and is built only for an
-* invocation, never at bootstrap.
-*
-* @example
-* ```ts
-* @Injectable({ scope: Scope.REQUEST })
-* class Reports {
-*   constructor(@Inject(CLOUDFLARE_SCHEDULED_EVENT) private readonly trigger: CloudflareScheduledEvent) {}
-*
-*   @Cron('0 3 * * *', { dialect: 'cloudflare' })
-*   async nightly(tick: CronInvocation) {
-*     if (!(await this.upstreamAvailable(tick.signal))) this.trigger.noRetry();
-*   }
-* }
-* ```
-*/
-const CLOUDFLARE_SCHEDULED_EVENT = new InjectionToken("@velajs/cloudflare:scheduled-event", {
-	scope: Scope.REQUEST,
-	factory: () => {
-		throw new Error("CLOUDFLARE_SCHEDULED_EVENT can only be resolved inside a scheduled invocation: the Cloudflare adapter seeds it into each @Cron job scope for a cron trigger.");
-	}
-});
-/** @internal Freeze the injected view; `noRetry` keeps the native receiver. */
-function cloudflareScheduledEvent(event, scheduledTime) {
-	return Object.freeze({
-		cron: event.cron,
-		scheduledTime,
-		noRetry: () => {
-			event.noRetry?.();
-		}
-	});
-}
-/**
-* Seeds a cron job fired outside a trigger (Studio's run-now) the way a
-* trigger would: a synthetic event whose `cron` is the invocation's
-* expression, with its `scheduledTime` and a `noRetry()` that does nothing.
-* Interval jobs never run from Workers triggers, so they get no event.
-*/
-const seedScheduledEvent = (scope, invocation) => {
-	if (invocation.kind !== "cron") return;
-	scope.setRequestInstance(CLOUDFLARE_SCHEDULED_EVENT, cloudflareScheduledEvent({ cron: invocation.expression }, invocation.scheduledTime));
-};
-/**
-* @internal Provide `SCHEDULE_INVOCATION_SEED`, so jobs fired on demand get a
-* synthetic event. Each trigger seeds the real event into its jobs' scopes.
-*/
-function registerScheduledEventSeed(container) {
-	container.register(defineProvider(SCHEDULE_INVOCATION_SEED, { useValue: seedScheduledEvent }));
-	container.markGlobalToken(SCHEDULE_INVOCATION_SEED);
-}
-//#endregion
-//#region src/cloudflare-application.ts
-function invoke(instance, methodName, args) {
-	const method = Reflect.get(instance, methodName);
-	if (typeof method !== "function") throw new Error(`Method '${String(methodName)}' is not a function on ${instance.constructor.name}`);
-	return Reflect.apply(method, instance, args);
-}
-function entrypointString(meta, property) {
-	if (typeof meta !== "object" || meta === null) throw new Error("Invalid entrypoint metadata.");
-	const value = Reflect.get(meta, property);
-	if (typeof value !== "string") throw new Error(`Invalid entrypoint metadata: ${property} must be a string.`);
-	return value;
-}
-/**
-* `QueueModule`'s native consumer reports each failure of a batch once itself
-* (processor failures where they ran, transport failures on settlement), so
-* its rejection is not reported again here.
-*/
-const SELF_REPORTING_KINDS = /* @__PURE__ */ new Set(["cf:queue:module"]);
-const warnedRawJobs = /* @__PURE__ */ new Set();
-/** The logical queue of a Vela job envelope, without importing the queue subsystem. */
-function envelopeQueue(body) {
-	if (typeof body !== "object" || body === null) return void 0;
-	const queue = Reflect.get(body, "queue");
-	if (typeof queue !== "string" || typeof Reflect.get(body, "id") !== "string" || typeof Reflect.get(body, "name") !== "string" || !("data" in body)) return;
-	return queue;
-}
-/** Wait for every matching handler, even when one fails before its siblings. */
-async function settleEntrypoints(work) {
-	const errors = (await Promise.allSettled(work)).flatMap((outcome) => outcome.status === "rejected" ? [outcome.reason] : []);
-	if (errors.length === 1) throw errors[0];
-	if (errors.length > 1) throw new AggregateError(errors, "Multiple entrypoint handlers failed.");
-}
-/**
-* Wraps VelaApplication with Cloudflare-specific handlers:
-* - `fetch` — HTTP request handler (from Hono)
-* - `scheduled` — Cron trigger handler (runs the `@Cron()` jobs whose
-*                 expression is the trigger's exact string)
-* - `queue` — Queue consumer handler (`@QueueConsumer()` by physical queue,
-*             then `QueueModule`'s native consumer)
-* - `mountOpenApi` — Serve an OpenAPI document (and optional Scalar UI) on
-*                    the underlying Hono app
-*
-* @example
-* ```ts
-* const app = await createCloudflareApp(AppModule, { env });
-* export default {
-*   fetch: app.fetch,
-*   scheduled: app.scheduled.bind(app),
-*   queue: app.queue.bind(app),
-* };
-* ```
-*
-* @example
-* ```ts
-* // Serve OpenAPI docs alongside your routes
-* const app = await createCloudflareApp(AppModule, { env });
-* const document = createOpenApiDocument(AppModule);
-* app.mountOpenApi({ document, ui: 'scalar' });
-* // GET /openapi.json -> JSON document
-* // GET /scalar       -> Scalar UI (loads from CDN)
-* ```
-*/
-var CloudflareApplication = class {
-	env;
-	#wsGatewayRoutes = [];
-	#app;
-	/** Scheduled triggers in flight; close() aborts their signals and awaits them. */
-	#scheduled = /* @__PURE__ */ new Map();
-	constructor(app, env) {
-		this.env = env;
-		this.#app = app;
-		this.get = app.get.bind(app);
-	}
-	fetch = async (request, env, ctx) => {
-		assertCloudflareEnvironment(this.env, env);
-		return this.#app.fetch(request, env, ctx);
-	};
-	getHonoApp() {
-		return this.#app.getHonoApp();
-	}
-	/**
-	* Resolve a provider from the application's DI container (delegates to
-	* `VelaApplication.get`). Handy for grabbing a service — e.g. an auth service —
-	* to use inside `createCloudflareApp({ middleware: env => [...] })` request middleware,
-	* which runs outside the DI request pipeline.
-	*
-	* @example
-	* ```ts
-	* const app = await createCloudflareApp(AppModule, { env });
-	* const auth = app.get(BetterAuthService);
-	* ```
-	*/
-	get;
-	get entrypoints() {
-		return this.#app.entrypoints;
-	}
-	/**
-	* Serve a pre-built OpenAPI document (and optionally a Scalar UI) on the
-	* underlying Hono app. Delegates verbatim to `VelaApplication.mountOpenApi`,
-	* so the JSON endpoint defaults to `/openapi.json` and the Scalar UI (when
-	* opted in) defaults to `/scalar`. Edge-safe — the UI HTML loads Scalar from
-	* a CDN at runtime, nothing is bundled server-side.
-	*
-	* @example
-	* ```ts
-	* import { createOpenApiDocument } from '@velajs/vela';
-	*
-	* const app = await createCloudflareApp(AppModule, { env });
-	* const document = createOpenApiDocument(AppModule, {
-	*   info: { title: 'My API', version: '1.0.0' },
-	* });
-	* app.mountOpenApi({ document, ui: 'scalar' });
-	* // GET /openapi.json -> { openapi: '3.1.0', ... }
-	* // GET /scalar       -> Scalar UI HTML
-	* ```
-	*/
-	mountOpenApi(options) {
-		this.#app.mountOpenApi(options);
-		return this;
-	}
-	/**
-	* @internal Upgrade routes come from validated gateway entrypoints, including
-	* request-scoped gateways without a bootstrap instance. Retain the instance
-	* scan for legacy applications that only declare forwarding metadata.
-	*/
-	scanInstances(instances) {
-		const routes = /* @__PURE__ */ new Map();
-		for (const ep of this.#app.entrypoints.ofKind("websocket")) {
-			if (typeof ep.meta !== "object" || ep.meta === null || !("dispatcher" in ep.meta)) continue;
-			const meta = readWsEntrypointMeta(ep.meta);
-			if (meta.options.binding) routes.set(meta.path, {
-				path: meta.path,
-				binding: meta.options.binding,
-				options: { ...meta.options },
-				moduleId: meta.moduleId
-			});
-		}
-		const container = this.#app.getContainer();
-		for (const instance of instances) {
-			if (!instance || typeof instance !== "object") continue;
-			for (const route of collectWsGatewayRoutes(instance, container)) if (!routes.has(route.path)) routes.set(route.path, route);
-		}
-		this.#wsGatewayRoutes.splice(0, this.#wsGatewayRoutes.length, ...routes.values());
-	}
-	/** @internal — upgrade routes discovered from the application's gateways. */
-	getWsGatewayRoutes() {
-		return [...this.#wsGatewayRoutes];
-	}
-	/**
-	* Handle a Cloudflare cron trigger. Runs every core `@Cron()` job whose
-	* expression is exactly `event.cron` (the trigger string is compared as
-	* delivered, never re-evaluated) through `invokeScheduledJob`, the dispatch
-	* primitive every runtime shares. Each job receives only its
-	* `ScheduleInvocation`, runs in a fresh invocation scope seeded with
-	* {@link CLOUDFLARE_SCHEDULED_EVENT}, and honors signed `ScheduleModule`
-	* dispatch. The trigger settles after every matching job and its managed
-	* work (`EXECUTION_LIFETIME.waitUntil`/`defer`) settle; failures reject it.
-	*/
-	async scheduled(event, env, _ctx) {
-		assertCloudflareEnvironment(this.env, env);
-		const jobs = this.#app.entrypoints.ofKind("schedule:cron", parseCronMetadata).filter((entry) => entry.meta.expression === event.cron);
-		if (jobs.length === 0) return;
-		const controller = new AbortController();
-		const scheduledTime = event.scheduledTime ?? Date.now();
-		const invocation = Object.freeze({
-			kind: "cron",
-			expression: event.cron,
-			scheduledTime,
-			signal: controller.signal
-		});
-		const trigger = cloudflareScheduledEvent(event, scheduledTime);
-		const container = this.#app.getContainer();
-		const running = settleEntrypoints(jobs.map((entry) => invokeScheduledJob(container, entry, invocation, { seed: (scope) => scope.setRequestInstance(CLOUDFLARE_SCHEDULED_EVENT, trigger) })));
-		this.#scheduled.set(running, controller);
-		try {
-			await running;
-		} finally {
-			this.#scheduled.delete(running);
-		}
-	}
-	/**
-	* Run one queue consumer inside a fresh request scope, through the shared
-	* guard → interceptor pipeline (components declared with
-	* `@UseGuards`/`@UseInterceptors`/`@UseFilters` on the consumer class or
-	* method). HTTP-global components deliberately do NOT apply — an HTTP auth
-	* guard has no business rejecting a queue batch. Unclaimed errors are
-	* reported once (`QueueModule`'s consumer reports its own) and rethrow so
-	* the platform's retry semantics stay intact.
-	*/
-	async dispatchEntrypoint(ep, payload, env, platformContext) {
-		const targetClass = ep.token;
-		if (typeof targetClass !== "function") throw new Error("Entrypoint token must be a class.");
-		if (ep.methodName === void 0) throw new Error("Entrypoint must declare a handler method.");
-		const methodName = ep.methodName;
-		const reportContext = {
-			edge: "queue",
-			source: `${targetClass.name}.${String(methodName)}`
-		};
-		let reported;
-		let delegated;
-		try {
-			await runInEntrypointScope(this.#app.getContainer(), async (scope, lifetime) => {
-				const moduleId = getEntrypointModuleId(scope, ep);
-				const context = buildEntrypointExecutionContext(ep.kind, targetClass, methodName, payload, moduleId, scope);
-				const invocationContext = { waitUntil(promise) {
-					lifetime.waitUntil(promise);
-					platformContext.waitUntil(promise);
-				} };
-				let filters = [];
-				try {
-					filters = (await resolveScopedComponentsAsync("filter", targetClass, methodName, scope, moduleId)).toReversed();
-					const guards = await resolveScopedComponentsAsync("guard", targetClass, methodName, scope, moduleId);
-					const interceptors = await resolveScopedComponentsAsync("interceptor", targetClass, methodName, scope, moduleId);
-					await PipelineRunner.run({
-						context,
-						guards,
-						interceptors,
-						resolveArgs: async () => [
-							payload,
-							env,
-							invocationContext
-						],
-						invoke: async (args) => {
-							const instance = await resolveEntrypoint(scope, ep);
-							if (typeof instance !== "object" || instance === null) throw new Error("Entrypoint must resolve to an object.");
-							try {
-								return await invoke(instance, methodName, args);
-							} catch (error) {
-								if (SELF_REPORTING_KINDS.has(ep.kind)) delegated = { error };
-								throw error;
-							}
-						}
-					});
-				} catch (error) {
-					if (delegated?.error !== error) resolveErrorReporter(scope).report(error, reportContext);
-					for (const filter of filters) if (shouldFilterCatch(filter, error)) {
-						await filter.catch(error, context);
-						return;
-					}
-					reported = { error };
-					throw error;
-				}
-			});
-		} catch (error) {
-			if (!reported || reported.error !== error) {
-				const completionError = reported && error instanceof AggregateError && error.errors[0] === reported.error ? error.errors[1] : error;
-				resolveErrorReporter(this.#app.getContainer()).report(completionError, reportContext);
-			}
-			throw error;
-		}
-	}
-	/**
-	* Handle Cloudflare Queue consumer events. `@QueueConsumer()` handlers read
-	* from `app.entrypoints` claim a batch by its physical queue name and
-	* receive it whole. A batch no handler claims goes to `QueueModule`'s native
-	* consumer (`cloudflareQueues()` from `@velajs/cloudflare/queues`), which
-	* routes each job by its logical queue. Each dispatch runs inside a fresh
-	* request-scoped child (request-scoped providers rebuild per batch — no
-	* boot-time captives). A batch nothing claims rejects: resolving would let
-	* Cloudflare acknowledge every message implicitly.
-	*/
-	async queue(batch, env, ctx) {
-		assertCloudflareEnvironment(this.env, env);
-		const raw = this.#app.entrypoints.ofKind("cf:queue").filter((ep) => entrypointString(ep.meta, "queueName") === batch.queue);
-		if (raw.length > 0) this.warnRawJobs(batch);
-		const handlers = raw.length > 0 ? raw : this.#app.entrypoints.ofKind("cf:queue:module");
-		if (handlers.length === 0) throw new Error(`No consumer claims queue '${batch.queue}'. Add @QueueConsumer('${batch.queue}') to a provider, or deliver it through QueueModule.forRoot({ driver: cloudflareQueues() }) with a QueueModule.registerQueue() for each queue it carries. The batch is rejected unacknowledged, so Cloudflare retries it and then routes it to the configured dead-letter queue.`);
-		await settleEntrypoints(handlers.map((ep) => this.dispatchEntrypoint(ep, batch, env, ctx)));
-	}
-	/**
-	* A raw `@QueueConsumer` owns its physical queue's batches and must not carry
-	* jobs of a queue registered with `QueueModule`: those reach their
-	* `@Processor` only if the raw handler dispatches them itself, while
-	* `cloudflareQueues()` delivers registered queues. Warn once per physical and
-	* logical queue (unless diagnostics are silent); the raw consumer still
-	* receives and settles the batch.
-	*/
-	warnRawJobs(batch) {
-		if (this.#app.getContainer().getDiagnostics() === "silent") return;
-		const registered = new Set(this.#app.entrypoints.ofKind("queue:registration").map((entry) => typeof entry.meta === "object" && entry.meta !== null ? Reflect.get(entry.meta, "name") : void 0));
-		if (registered.size === 0) return;
-		for (const message of batch.messages) {
-			const queue = envelopeQueue(typeof message === "object" && message !== null ? Reflect.get(message, "body") : void 0);
-			if (queue === void 0 || !registered.has(queue)) continue;
-			const warning = `[vela] @QueueConsumer('${batch.queue}') received jobs of registered queue '${queue}'. The raw consumer owns '${batch.queue}' and must not carry jobs of registered queues: they reach @Processor('${queue}') only if the raw handler dispatches them itself. Deliver '${queue}' through cloudflareQueues() instead: send it to a physical queue that no @QueueConsumer claims.`;
-			if (warnedRawJobs.has(warning)) continue;
-			warnedRawJobs.add(warning);
-			console.warn(warning);
-		}
-	}
-	/**
-	* Abort the signals of scheduled jobs still running, wait for them and their
-	* managed work to settle, then close the application.
-	*/
-	async close(signal) {
-		for (const controller of this.#scheduled.values()) controller.abort();
-		await Promise.allSettled(this.#scheduled.keys());
-		return this.#app.close(signal);
-	}
-};
-//#endregion
-//#region src/schedule-diagnostics.ts
-const reported = /* @__PURE__ */ new Set();
-/** `'throw'` fails the caller, `'log'` warns once per message in this isolate. */
-function reportScheduleDiagnostic(container, message) {
-	const mode = container.getDiagnostics();
-	if (mode === "silent") return;
-	if (mode === "throw") throw new Error(message);
-	if (reported.has(message)) return;
-	reported.add(message);
-	console.warn(message);
-}
-function jobName(entry) {
-	return `${typeof entry.token === "function" ? entry.token.name : String(entry.token)}.${entry.meta.methodName}`;
-}
-/**
-* Guards, interceptors and filters declared for a job never run on its
-* trigger, and a direct job that declares guards is refused on every trigger.
-*/
-function reportComponents(container, label, entry) {
-	const decorators = scheduledJobComponents(container, entry);
-	if (decorators.length === 0) return;
-	reportScheduleDiagnostic(container, `[vela] ${label} declares ${decorators.length > 1 ? `${decorators.slice(0, -1).join(", ")} and ${decorators.at(-1)}` : decorators.join("")}, which do not run for scheduled jobs: a direct job runs no guards, interceptors or filters${decorators.includes("@UseGuards") ? ", and one that declares guards refuses to run" : ""}. Use signed ScheduleModule dispatch and declare them on the signed route to run the job through the request pipeline.`);
-}
-/**
-* Report schedule declarations a Workers cron trigger cannot honor as written:
-* a dialect-ambiguous `@Cron`, `dialect: 'unix'`, `timeZone: 'local'`,
-* `@Interval` jobs, and guards, interceptors or filters declared for a job
-* (a direct job that declares guards is refused when it fires).
-* The container's diagnostics policy applies: `'throw'` fails bootstrap and the
-* default `'log'` warns once per declaration, so the first event of a Worker
-* (which bootstraps the application) never fails because of these checks.
-* `vela deploy check` rejects the cron declarations, `@Interval` jobs and
-* guarded direct jobs before deployment (`ambiguous-cron-dialect`,
-* `incompatible-cron-options`, `unsupported-interval`, `scheduled-job-guards`).
-*/
-function reportCloudflareScheduleDiagnostics(container, entrypoints) {
-	for (const entry of entrypoints.ofKind("schedule:cron", parseCronMetadata)) {
-		const cron = `@Cron('${entry.meta.expression}') on ${jobName(entry)}`;
-		const ambiguity = cronDialectAmbiguity(entry.meta);
-		if (ambiguity) reportScheduleDiagnostic(container, `[vela] ${cron} declares no dialect, and ${ambiguity}. Workers deliver the trigger with Cloudflare semantics while Node reads it with Vela's unix dialect; declare { dialect: 'cloudflare' } so it fires on the same days on every runtime.`);
-		if (entry.meta.dialect === "unix") reportScheduleDiagnostic(container, `[vela] ${cron} declares dialect 'unix', but Cloudflare delivers its trigger with Cloudflare cron semantics (weekdays 1 = Sunday through 7 = Saturday). Declare { dialect: 'cloudflare' } and write the expression for Cloudflare.`);
-		if (entry.meta.timeZone === "local") reportScheduleDiagnostic(container, `[vela] ${cron} declares timeZone 'local', but Cloudflare cron triggers run in UTC. Remove timeZone or set it to 'UTC'.`);
-		reportComponents(container, cron, entry);
-	}
-	for (const entry of entrypoints.ofKind("schedule:interval", parseIntervalMetadata)) reportScheduleDiagnostic(container, `[vela] @Interval(${entry.meta.ms}) on ${jobName(entry)} never runs on Workers: cron triggers drive only @Cron jobs. Replace it with a @Cron job and a Wrangler trigger, or run it under ScheduleNodeModule on Node.`);
-}
-//#endregion
-//#region src/cloudflare-factory.ts
-function readStrings(meta, property) {
-	const value = typeof meta === "object" && meta !== null ? Reflect.get(meta, property) : void 0;
-	if (typeof value === "string") return [value];
-	if (Array.isArray(value) && value.every((item) => typeof item === "string")) return value;
-	throw new TypeError(`Invalid queue consumer metadata: ${property}.`);
-}
-/**
-* `@QueueConsumer` handlers own their physical queue. A `QueueModule`
-* registration that pins the same physical queue with `consumer` would never
-* see its batches, so bootstrap rejects the overlap.
-*/
-function assertQueueConsumerOwnership(entrypoints) {
-	const pinned = new Set(entrypoints.ofKind("cf:queue:module").flatMap((entry) => readStrings(entry.meta, "consumers")));
-	for (const entry of entrypoints.ofKind("cf:queue")) {
-		const [queue] = readStrings(entry.meta, "queueName");
-		if (queue !== void 0 && pinned.has(queue)) throw new Error(`Ambiguous consumer ownership for queue '${queue}': @QueueConsumer('${queue}') and a QueueModule.registerQueue({ consumer: '${queue}' }) both claim it. Keep one owner.`);
-	}
-}
-/**
-* Bind an application to one environment: seeded as the global ENV before
-* provider factories and lifecycle hooks, and asserted on every request. The
-* adapter also supplies the `InternalDispatcher` transport, so signed queue and
-* schedule dispatch re-enter this application's routes, and reports schedule
-* declarations a cron trigger cannot honor through the diagnostics policy.
-*/
-function cloudflareAdapter(options) {
-	const { env } = options;
-	return {
-		name: "cloudflare",
-		requestMiddleware: [async (context, next) => {
-			assertCloudflareEnvironment(env, context.env);
-			await next();
-		}],
-		invocationTransport: ({ app }) => (request) => Promise.resolve(app.fetch(request, env)),
-		getClientIp: (c) => getConnInfo(c).remote.address ?? null,
-		configureContainer: (container) => {
-			registerCloudflareEnvironment(container, env);
-			registerScheduledEventSeed(container);
-		},
-		onBootstrap: async ({ app, container }) => {
-			assertQueueConsumerOwnership(app.entrypoints);
-			reportCloudflareScheduleDiagnostics(container, app.entrypoints);
-			await warnWorkerLocalLive(container);
-		}
-	};
-}
-/**
-* Build an application for one native Workers environment. Call inside a platform event.
-* The root is static: a module class or a `DynamicModule` declared at module scope.
-* Read bindings in providers (`@InjectEnv()`) and module factories
-* (`forRootAsync({ inject: [ENV], useFactory })`), which run for each application.
-*/
-async function createCloudflareApp(rootModule, options) {
-	const velaApp = await VelaFactory.create(rootModule, {
-		globalPrefix: options.globalPrefix,
-		security: options.security,
-		middleware: options.middleware?.(options.env),
-		adapters: [cloudflareAdapter(options), ...options.adapters ?? []]
-	});
-	const app = new CloudflareApplication(velaApp, options.env);
-	app.scanInstances(velaApp.getInstances());
-	registerWebSocketRoutes(app.getHonoApp(), app.getWsGatewayRoutes(), velaApp.getContainer());
-	return app;
-}
-/**
-* Worker entrypoint with one bootstrap per environment identity. Concurrent cold
-* events share construction; failed construction is evicted so the next event
-* can retry. Weak keys stop this cache from retaining a replaced environment.
-*/
-function createCloudflareWorker(rootModule, options = {}) {
-	const applications = /* @__PURE__ */ new WeakMap();
-	const application = (env) => {
-		const existing = applications.get(env);
-		if (existing) return existing;
-		const pending = createCloudflareApp(rootModule, {
-			...options,
-			env
-		});
-		applications.set(env, pending);
-		pending.catch(() => {
-			if (applications.get(env) === pending) applications.delete(env);
-		});
-		return pending;
-	};
-	return {
-		async fetch(request, env, ctx) {
-			return (await application(env)).fetch(request, env, ctx);
-		},
-		async scheduled(event, env, ctx) {
-			return (await application(env)).scheduled(event, env, ctx);
-		},
-		async queue(batch, env, ctx) {
-			return (await application(env)).queue(batch, env, ctx);
-		}
-	};
-}
-//#endregion
-//#region src/storage/storage.tokens.ts
-const STORAGE_OPTIONS = new InjectionToken("STORAGE_OPTIONS");
-//#endregion
-//#region src/storage/storage-key-claim.ts
-/** R2-compatible object-key claim bound. Keeps decode work predictably small. */
-const MAX_STORAGE_KEY_BYTES = 1024;
-const BASE64URL_RE = /^[A-Za-z0-9_-]+$/;
-const ROOT_TOKEN_PATTERNS = {
-	date: "\\d{4}-\\d{2}-\\d{2}",
-	year: "\\d{4}",
-	month: "(?:0[1-9]|1[0-2])",
-	day: "(?:0[1-9]|[12]\\d|3[01])",
-	uuid: "[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}"
-};
-/** Encode an object key as an opaque, canonical base64url query claim. */
-function encodeStorageKeyClaim(key) {
-	const bytes = new TextEncoder().encode(key);
-	if (bytes.byteLength === 0 || bytes.byteLength > 1024) throw new Error(`Storage key must be 1–${MAX_STORAGE_KEY_BYTES} UTF-8 bytes`);
-	let binary = "";
-	for (const byte of bytes) binary += String.fromCharCode(byte);
-	return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-/** Decode exactly one canonical base64url layer. Malformed/non-UTF-8 claims return undefined. */
-function decodeStorageKeyClaim(claim) {
-	try {
-		if (claim.length === 0 || claim.length > Math.ceil(4096 / 3) || !BASE64URL_RE.test(claim) || claim.length % 4 === 1) return;
-		const base64 = claim.replace(/-/g, "+").replace(/_/g, "/");
-		const padded = base64 + "=".repeat((4 - base64.length % 4) % 4);
-		const binary = atob(padded);
-		const bytes = new Uint8Array(new ArrayBuffer(binary.length));
-		for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
-		if (bytes.byteLength === 0 || bytes.byteLength > 1024) return void 0;
-		const decoded = new TextDecoder("utf-8", {
-			fatal: true,
-			ignoreBOM: false
-		}).decode(bytes);
-		return encodeStorageKeyClaim(decoded) === claim ? decoded : void 0;
-	} catch {
-		return;
-	}
-}
-function isDotSegment(segment) {
-	let decoded = segment;
-	for (let i = 0; i < 2; i++) {
-		if (decoded === "" || decoded === "." || decoded === "..") return true;
-		try {
-			const next = decodeURIComponent(decoded);
-			if (next === decoded) break;
-			decoded = next;
-		} catch {
-			break;
-		}
-	}
-	return decoded === "" || decoded === "." || decoded === "..";
-}
-function rootSegmentPattern(segment) {
-	let pattern = "";
-	let cursor = 0;
-	for (const match of segment.matchAll(/\{(date|year|month|day|uuid)\}/g)) {
-		pattern += segment.slice(cursor, match.index).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-		pattern += ROOT_TOKEN_PATTERNS[match[1]];
-		cursor = match.index + match[0].length;
-	}
-	pattern += segment.slice(cursor).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-	return pattern;
-}
-/** Assert a canonical key is beneath a static or templated configured root. */
-function isStorageKeyWithinRoot(key, root) {
-	const segments = (root ?? "").split(/[/\\]+/).filter((segment) => !isDotSegment(segment));
-	if (segments.length === 0) return key.length > 0;
-	const rootPattern = segments.map(rootSegmentPattern).join("/");
-	return new RegExp(`^(?:${rootPattern})(?:/|$)`).test(key);
-}
-//#endregion
-//#region src/storage/r2-storage.driver.ts
-/** Base path of the StorageController presign-proxy route. */
-const STORAGE_ROUTE_BASE = "/storage";
-/** {@link StorageDriver} over a Cloudflare R2 bucket. */
-var R2StorageDriver = class {
-	config;
-	constructor(config) {
-		this.config = config;
-	}
-	async upload(body, path, options) {
-		await this.config.bucket.put(path, body, {
-			httpMetadata: options.mimeType ? { contentType: options.mimeType } : void 0,
-			customMetadata: options.metadata
-		});
-		return {
-			path,
-			disk: this.config.disk,
-			size: options.size,
-			mimeType: options.mimeType ?? "application/octet-stream",
-			uploadedAt: /* @__PURE__ */ new Date()
-		};
-	}
-	async download(path) {
-		const obj = await this.config.bucket.get(path);
-		if (!obj) throw new Error(`Storage object not found at "${path}".`);
-		return {
-			toStream: () => obj.body,
-			toArrayBuffer: () => obj.arrayBuffer(),
-			toText: () => obj.text(),
-			contentType: obj.httpMetadata?.contentType ?? "application/octet-stream",
-			size: obj.size,
-			metadata: obj.customMetadata
-		};
-	}
-	async delete(path) {
-		await this.config.bucket.delete(path);
-	}
-	async exists(path) {
-		return await this.config.bucket.head(path) !== null;
-	}
-	async getPresignedUrl(path, method, expiresIn) {
-		if (!this.config.secret) throw new Error("A signing secret is required for presigned URLs (set APP_SECRET).");
-		if (!Number.isSafeInteger(expiresIn) || expiresIn <= 0) throw new Error(`Invalid presigned URL expiry: ${expiresIn}s (must be a positive safe integer).`);
-		const claim = encodeStorageKeyClaim(path);
-		const routePath = `${STORAGE_ROUTE_BASE}/${encodeURIComponent(this.config.disk)}`;
-		const query = new URLSearchParams({
-			key: claim,
-			method
-		});
-		return {
-			url: await signUrl(`${routePath}?${query}`, this.config.secret, {
-				expiresIn,
-				method,
-				purpose: STORAGE_SIGNED_URL_PURPOSE
-			}),
-			method,
-			expiresIn,
-			expiresAt: new Date(Date.now() + expiresIn * 1e3)
-		};
-	}
-};
-//#endregion
-//#region \0@oxc-project+runtime@0.150.0/helpers/esm/decorateMetadata.js
-function __decorateMetadata(k, v) {
-	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-//#endregion
-//#region \0@oxc-project+runtime@0.150.0/helpers/esm/decorateParam.js
-function __decorateParam(paramIndex, decorator) {
-	return function(target, key) {
-		decorator(target, key, paramIndex);
-	};
-}
-//#endregion
-//#region src/storage/storage-manager.service.ts
-let StorageManagerService = class StorageManagerService {
-	options;
-	constructor(options) {
-		this.options = options;
-	}
-	hasDisk(disk) {
-		return this.options.disks.some((d) => d.disk === disk);
-	}
-	getDiskConfig(disk) {
-		const config = this.options.disks.find((d) => d.disk === disk);
-		if (!config) throw new Error(`Storage disk "${disk}" is not configured.`);
-		return config;
-	}
-	getDriver(disk) {
-		return new R2StorageDriver({
-			disk,
-			bucket: this.getDiskConfig(disk).bucket,
-			secret: this.options.secret
-		});
-	}
-};
-StorageManagerService = __decorate([
-	Injectable(),
-	__decorateParam(0, Inject(STORAGE_OPTIONS)),
-	__decorateMetadata("design:paramtypes", [Object])
-], StorageManagerService);
-//#endregion
-//#region src/storage/storage.controller.ts
-let StorageController = class StorageController {
-	manager;
-	options;
-	constructor(manager, options) {
-		this.manager = manager;
-		this.options = options;
-	}
-	async download(c) {
-		const secret = this.options.secret;
-		if (!secret) return new Response("Storage signing is not configured", { status: 500 });
-		if (!await verifySignedUrl(c.req.url, secret, {
-			method: c.req.method,
-			purpose: STORAGE_SIGNED_URL_PURPOSE
-		})) return new Response("Invalid or expired URL", { status: 403 });
-		const url = new URL(c.req.url);
-		if (url.searchParams.get("method") !== "GET") return new Response("URL is not scoped for reads", { status: 403 });
-		const disk = c.req.param("disk");
-		if (!disk || !this.manager.hasDisk(disk)) return new Response("Unknown disk", { status: 404 });
-		const claim = url.searchParams.get("key");
-		const decoded = claim ? decodeStorageKeyClaim(claim) : void 0;
-		if (!decoded) return new Response("Malformed storage key claim", { status: 400 });
-		const fullPath = joinStoragePath(void 0, decoded);
-		if (fullPath !== decoded) return new Response("Invalid storage key", { status: 403 });
-		if (!isStorageKeyWithinRoot(fullPath, this.manager.getDiskConfig(disk).root)) return new Response("Storage key is outside the configured root", { status: 403 });
-		try {
-			const result = await this.manager.getDriver(disk).download(fullPath);
-			const filename = fullPath.split("/").at(-1) || "download";
-			return new Response(result.toStream(), { headers: {
-				"content-type": result.contentType || "application/octet-stream",
-				"content-disposition": `attachment; filename*=UTF-8''${encodeURIComponent(filename)}`,
-				"x-content-type-options": "nosniff"
-			} });
-		} catch {
-			return new Response("Not found", { status: 404 });
-		}
-	}
-};
-__decorate([
-	Get("/:disk"),
-	__decorateParam(0, Req()),
-	__decorateMetadata("design:type", Function),
-	__decorateMetadata("design:paramtypes", [Object]),
-	__decorateMetadata("design:returntype", Promise)
-], StorageController.prototype, "download", null);
-StorageController = __decorate([
-	Controller("storage"),
-	__decorateParam(0, Inject(StorageManagerService)),
-	__decorateParam(1, Inject(STORAGE_OPTIONS)),
-	__decorateMetadata("design:paramtypes", [typeof StorageManagerService === "undefined" ? Object : StorageManagerService, Object])
-], StorageController);
-//#endregion
-//#region src/storage/storage.service.ts
-const DEFAULT_PRESIGN = {
-	defaultExpiry: 3600,
-	maxExpiry: 86400
-};
-let StorageService = class StorageService {
-	options;
-	manager;
-	constructor(options, manager) {
-		this.options = options;
-		this.manager = manager;
-	}
-	put(relativePath, body, options = {}, disk) {
-		const name = this.resolveDisk(disk);
-		return this.manager.getDriver(name).upload(body, this.fullPath(relativePath, name), options);
-	}
-	get(relativePath, disk) {
-		const name = this.resolveDisk(disk);
-		return this.manager.getDriver(name).download(this.fullPath(relativePath, name));
-	}
-	delete(relativePath, disk) {
-		const name = this.resolveDisk(disk);
-		return this.manager.getDriver(name).delete(this.fullPath(relativePath, name));
-	}
-	exists(relativePath, disk) {
-		const name = this.resolveDisk(disk);
-		return this.manager.getDriver(name).exists(this.fullPath(relativePath, name));
-	}
-	url(relativePath, method = "GET", expiresIn, disk) {
-		const name = this.resolveDisk(disk);
-		return this.manager.getDriver(name).getPresignedUrl(this.fullPath(relativePath, name), method, this.validateExpiry(expiresIn));
-	}
-	resolveDisk(disk) {
-		const name = disk ?? this.options.defaultDisk;
-		if (!this.manager.hasDisk(name)) throw new Error(`Storage disk "${name}" is not configured.`);
-		return name;
-	}
-	fullPath(relativePath, disk) {
-		return joinStoragePath(this.manager.getDiskConfig(disk).root, relativePath);
-	}
-	validateExpiry(expiresIn) {
-		const cfg = this.options.presignedUrl ?? DEFAULT_PRESIGN;
-		const value = expiresIn ?? cfg.defaultExpiry;
-		if (!Number.isSafeInteger(value) || value < 1 || value > cfg.maxExpiry) throw new Error(`Presigned URL expiry ${value}s is out of range (1–${cfg.maxExpiry}s).`);
-		return value;
-	}
-};
-StorageService = __decorate([
-	Injectable(),
-	__decorateParam(0, Inject(STORAGE_OPTIONS)),
-	__decorateParam(1, Inject(StorageManagerService)),
-	__decorateMetadata("design:paramtypes", [Object, typeof StorageManagerService === "undefined" ? Object : StorageManagerService])
-], StorageService);
-//#endregion
-//#region src/storage/storage.module.ts
-const { ConfigurableModuleClass } = new ConfigurableModuleBuilder({
-	moduleName: "Storage",
-	optionsInjectionToken: STORAGE_OPTIONS
-}).build();
-let StorageModule = class StorageModule extends ConfigurableModuleClass {};
-StorageModule = __decorate([Module({
-	providers: [StorageManagerService, StorageService],
-	controllers: [StorageController],
-	exports: [
-		StorageService,
-		StorageManagerService,
-		STORAGE_OPTIONS
-	]
-})], StorageModule);
-//#endregion
-//#region src/services/kv-cache.store.ts
-/**
-* Native KV JSON value store. Metadata retains logical expiry even when KV's
-* physical retention rounds up to its 60-second minimum. Legacy values without
-* metadata remain readable, but cannot safely backfill another tier.
-*/
-var KVCacheStore = class {
-	ns;
-	constructor(ns) {
-		this.ns = ns;
-	}
-	async get(key) {
-		return (await this.getEntry(key))?.value;
-	}
-	async getEntry(key) {
-		const { value, metadata } = await this.ns.getWithMetadata(key, "json");
-		if (value === null) return void 0;
-		if (typeof metadata === "object" && metadata !== null && "velaCacheExpiresAt" in metadata) {
-			const expiresAt = metadata.velaCacheExpiresAt;
-			if (typeof expiresAt !== "number" || !Number.isFinite(expiresAt) || expiresAt <= Date.now()) return void 0;
-			return {
-				value,
-				expiresAt
-			};
-		}
-		return { value };
-	}
-	async set(key, value, ttl) {
-		if (ttl !== void 0 && (!Number.isFinite(ttl) || ttl < 0)) throw new TypeError("Cache TTL must be finite and nonnegative.");
-		if (ttl !== void 0) return this.setEntry(key, {
-			value,
-			expiresAt: Date.now() + ttl * 1e3
-		});
-		await this.ns.put(key, JSON.stringify(value));
-	}
-	async setEntry(key, entry) {
-		if (!Number.isFinite(entry.expiresAt)) throw new TypeError("Cache expiry must be finite.");
-		const remaining = (entry.expiresAt - Date.now()) / 1e3;
-		if (remaining <= 0) return this.del(key);
-		await this.ns.put(key, JSON.stringify(entry.value), {
-			expirationTtl: Math.max(60, Math.ceil(remaining)),
-			metadata: { velaCacheExpiresAt: entry.expiresAt }
-		});
-	}
-	async del(key) {
-		await this.ns.delete(key);
-	}
-	/** Namespace-wide, best effort. Use a dedicated value namespace; never use for scoped invalidation. */
-	async clear() {
-		let cursor;
-		do {
-			const list = await this.ns.list(cursor ? { cursor } : void 0);
-			await Promise.all(list.keys.map((entry) => this.ns.delete(entry.name)));
-			cursor = list.list_complete ? void 0 : list.cursor;
-		} while (cursor);
-	}
-};
-/**
-* Optional, eventually consistent generation store. Use a dedicated KV namespace
-* without TTL/lifecycle cleanup. Never delete/reset generations while entries can
-* survive. Concurrent writes and cached/negative reads prevent strong invalidation;
-* this is unsuitable for strict read-after-write or authorization revocation.
-*/
-var KVCacheInvalidationStore = class {
-	ns;
-	constructor(ns) {
-		this.ns = ns;
-	}
-	async getVersion(key) {
-		const value = await this.ns.get(key, "json");
-		if (value === null) return "initial";
-		if (typeof value !== "string" || value.length === 0 || value.length > 2048) throw new TypeError("Invalid cache generation.");
-		return value;
-	}
-	async invalidate(key) {
-		await this.ns.put(key, JSON.stringify(crypto.randomUUID()));
-	}
-};
-//#endregion
-//#region src/services/flagship-flag.driver.ts
-/**
-* {@link FeatureFlagDriver} backed by a Cloudflare Flagship binding.
-*
-* A thin, honest wrapper: each contract method maps 1:1 onto the binding's
-* corresponding value method, forwarding the caller's `fallback` (the binding's
-* `defaultValue`) and evaluation context. The binding resolves the fallback on
-* evaluation errors; anything the binding *rejects* with (e.g. a `remote: true`
-* dev-proxy tunnel dropping) propagates — `@velajs/feature-flags`'s service owns
-* the never-throw guarantee.
-*
-* Build the driver inside a provider factory with the native environment:
-*
-* ```ts
-* FeatureFlagsModule.forRootAsync({
-*   inject: [ENV],
-*   useFactory: (env: WorkerEnv) => ({ drivers: [flagshipFlagDriver(env.FLAGS)] }),
-* });
-* ```
-*
-* Evaluation ergonomics (the 1:1 binding-method mapping) are ported from the
-* Stratal feature-flags service (MIT, © Temitayo Fadojutimi), reshaped as a
-* bare driver.
-*/
-var FlagshipFlagDriver = class {
-	name;
-	resolve;
-	constructor(binding, options = {}) {
-		this.resolve = typeof binding === "function" ? binding : () => binding;
-		this.name = options.name ?? "flagship";
-	}
-	getBoolean(key, fallback, ctx) {
-		return this.resolve().getBooleanValue(key, fallback, ctx);
-	}
-	getString(key, fallback, ctx) {
-		return this.resolve().getStringValue(key, fallback, ctx);
-	}
-	getNumber(key, fallback, ctx) {
-		return this.resolve().getNumberValue(key, fallback, ctx);
-	}
-	getObject(key, fallback, ctx) {
-		return this.resolve().getObjectValue(key, fallback, ctx);
-	}
-};
-/** Convenience factory for {@link FlagshipFlagDriver}. */
-function flagshipFlagDriver(binding, options) {
-	return new FlagshipFlagDriver(binding, options);
-}
-//#endregion
-//#region src/services/kv-flag.driver.ts
-/**
-* Cloudflare KV-backed {@link FeatureFlagDriver}. Flags are stored as JSON
-* values under an optional key prefix and read with `get(key, 'json')`. Reads
-* are type-checked against the requested type: a missing key or a value of the
-* wrong JSON type returns the caller's `fallback`. KV has no targeting, so the
-* evaluation context is ignored.
-*
-* The driver stays honest — it does **not** swallow errors. A KV failure (or a
-* `SyntaxError` from a malformed stored value) propagates; the never-throw
-* guarantee lives in `@velajs/feature-flags`'s service layer.
-*
-* Placed like {@link KVCacheStore}: construct it in a wiring factory over a
-* resolved {@link KVNamespace}.
-*
-* ```ts
-* FeatureFlagsModule.forRootAsync({
-*   inject: [ENV],
-*   useFactory: (env: WorkerEnv) => ({ drivers: [new KvFlagDriver(env.CACHE, { prefix: 'flag:' })] }),
-* });
-* ```
-*/
-var KvFlagDriver = class {
-	ns;
-	name;
-	prefix;
-	constructor(ns, options = {}) {
-		this.ns = ns;
-		this.name = options.name ?? "kv";
-		this.prefix = options.prefix ?? "";
-	}
-	getBoolean(key, fallback, _ctx) {
-		return this.read(key, fallback, (v) => typeof v === "boolean");
-	}
-	getString(key, fallback, _ctx) {
-		return this.read(key, fallback, (v) => typeof v === "string");
-	}
-	getNumber(key, fallback, _ctx) {
-		return this.read(key, fallback, (v) => typeof v === "number");
-	}
-	getObject(key, fallback, _ctx) {
-		return this.read(key, fallback, (v) => typeof v === "object" && v !== null);
-	}
-	/**
-	* Reads and JSON-parses the (prefixed) key, returning the parsed value only
-	* when `matches` accepts its type; otherwise the caller's fallback. A missing
-	* key reads as `null` → fallback. Read/parse errors are left to propagate.
-	*/
-	async read(key, fallback, matches) {
-		const value = await this.ns.get(this.prefix + key, "json");
-		if (value === null || value === void 0) return fallback;
-		return matches(value) ? value : fallback;
-	}
-};
-/** Convenience factory for {@link KvFlagDriver}. */
-function kvFlagDriver(kv, options) {
-	return new KvFlagDriver(kv, options);
-}
-//#endregion
-//#region src/decorators/queue-consumer.ts
-const QUEUE_CONSUMER_METADATA_KEY = "cloudflare:queue-consumer";
-registerEntrypointKind({
-	kind: "cf:queue",
-	metaKey: QUEUE_CONSUMER_METADATA_KEY,
-	level: "method"
-});
-/**
-* Marks a method as a queue consumer handler.
-*
-* @example
-* ```ts
-* @Injectable()
-* class WorkerService {
-*   @QueueConsumer('email-queue')
-*   async processEmails(batch: MessageBatch) {
-*     for (const msg of batch.messages) {
-*       console.log('Processing:', msg.body);
-*       msg.ack();
-*     }
-*   }
-* }
-* ```
-*/
-function QueueConsumer(queueName) {
-	return (target, propertyKey, _descriptor) => {
-		const existing = getMetadata(QUEUE_CONSUMER_METADATA_KEY, target.constructor) ?? [];
-		existing.push({
-			queueName,
-			methodName: String(propertyKey)
-		});
-		defineMetadata(QUEUE_CONSUMER_METADATA_KEY, existing, target.constructor);
-	};
-}
-//#endregion
-//#region src/websocket/cloudflare-websocket.module.ts
-/**
-* Cloudflare counterpart to the core `WebSocketModule.forRoot()`. Import this in
-* your `AppModule` instead: it provides the gateway dispatcher plus a late-bound
-* `WS_SERVER` (`WsServerHolder`) that the WebSocket Durable Object wires to a
-* ctx-backed server per instance. `useClass` ensures a fresh holder per DI
-* container so colocated DO instances never share a server.
-*/
-var CloudflareWebSocketModule = class CloudflareWebSocketModule {
-	static forRoot() {
-		const providers = [defineProvider(WS_SERVER, { useClass: WsServerHolder }), WsDispatcher];
-		return {
-			module: CloudflareWebSocketModule,
-			providers,
-			exports: [WS_SERVER, WsDispatcher]
-		};
-	}
-};
-//#endregion
-//#region src/websocket/broadcast.ts
-/**
-* Push to a room from a Worker HTTP handler / cron / queue consumer (server-
-* initiated emit). Resolves the room's Durable Object and calls its `broadcast`
-* RPC method — the same canonical room→DO mapping the upgrade route uses, so it
-* always reaches the DO holding those sockets.
-*
-* @example
-* ```ts
-* // In a controller — ns from the typed Worker environment
-* await broadcastToRoom(ns, '/orgs/:orgId/ws', `org:${id}`, 'order.created', order);
-* ```
-*/
-async function broadcastToRoom(ns, gatewayPath, room, event, data, options) {
-	const cmd = {
-		rooms: [room],
-		exceptIds: options?.exceptIds,
-		frame: JSON.stringify({
-			event,
-			data
-		})
-	};
-	const maxFrameBytes = resolveMaxFrameBytes({ maxFrameBytes: options?.maxFrameBytes ?? DEFAULT_WS_MAX_FRAME_BYTES });
-	assertBroadcastCommandFits(cmd, maxFrameBytes);
-	await ns.get(roomToDurableId(ns, gatewayPath, room)).broadcast(cmd);
-}
-//#endregion
-//#region src/rate-limit/cloudflare-rate-limit.store.ts
-/**
-* Adapt a Cloudflare Workers Rate Limiting binding to Vela's throttler store.
-*
-* The platform binding makes the allow/deny decision. It does not expose exact
-* counters or reset timestamps, so this adapter intentionally omits `remaining`.
-*/
-function cloudflareRateLimitStore(binding, options) {
-	if (!binding || typeof binding !== "function" && typeof binding.limit !== "function") throw new TypeError("A Cloudflare Rate Limiting binding is required");
-	if (!Number.isSafeInteger(options.limit) || options.limit <= 0 || options.limit >= Number.MAX_SAFE_INTEGER) throw new RangeError("Rate limit must be a positive safe integer");
-	if (options.periodSeconds !== 10 && options.periodSeconds !== 60) throw new RangeError("Cloudflare rate-limit periods must be 10 or 60 seconds");
-	const maxKeyBytes = options.maxKeyBytes ?? 1024;
-	if (!Number.isSafeInteger(maxKeyBytes) || maxKeyBytes <= 0 || maxKeyBytes > 4096) throw new RangeError("maxKeyBytes must be between 1 and 4096");
-	const ttlMs = options.periodSeconds * 1e3;
-	const encoder = new TextEncoder();
-	const resolveBinding = typeof binding === "function" ? binding : () => binding;
-	return {
-		async increment(key, requestedTtlMs) {
-			if (requestedTtlMs !== ttlMs) throw new Error(`Cloudflare binding period mismatch: expected ${ttlMs}ms, received ${requestedTtlMs}ms`);
-			if (typeof key !== "string" || key.length === 0 || /[\u0000-\u001f\u007f]/.test(key) || encoder.encode(key).byteLength > maxKeyBytes) throw new Error("Refusing an invalid or oversized rate-limit key");
-			const currentBinding = resolveBinding();
-			if (!currentBinding || typeof currentBinding.limit !== "function") throw new Error("Cloudflare Rate Limiting binding is unavailable");
-			const decision = await currentBinding.limit({ key });
-			if (!decision || typeof decision.success !== "boolean") throw new Error("Cloudflare rate-limit binding returned an invalid decision");
-			return {
-				count: decision.success ? 0 : options.limit + 1,
-				ttlMs,
-				allowed: decision.success,
-				enforcedLimit: options.limit
-			};
-		},
-		reset() {
-			throw new Error("Cloudflare Rate Limiting bindings do not support counter reset");
-		}
-	};
-}
-//#endregion
-//#region src/nonce/durable-object-nonce.store.ts
-const APP_NAMESPACE_PREFIX = "vela:nonce:v1:";
-const MAX_APP_NAMESPACE_BYTES = 128;
-/**
-* Strict, cross-isolate {@link NonceStore} backed by one SQLite Durable Object
-* per explicit application namespace.
-*
-* Invalid input, an unavailable/malformed binding, RPC failure, or a malformed
-* RPC result all deny the claim (`false`). Only the literal boolean `true` from
-* the Durable Object is accepted.
-*/
-function durableObjectNonceStore(options) {
-	if (!options || typeof options !== "object") throw new TypeError("Durable Object nonce-store options are required");
-	if (!isCanonicalBoundedText(options.appNamespace, MAX_APP_NAMESPACE_BYTES)) throw new TypeError(`appNamespace must be canonical, non-empty, and at most ${MAX_APP_NAMESPACE_BYTES} UTF-8 bytes`);
-	if (typeof options.binding !== "function") throw new TypeError("A lazy Durable Object namespace binding resolver is required");
-	const objectName = `${APP_NAMESPACE_PREFIX}${options.appNamespace}`;
-	return { async claim(nonce, expEpochSeconds) {
-		const now = Math.floor(Date.now() / 1e3);
-		if (!isCanonicalBoundedText(nonce, 512) || !isValidExpiry(expEpochSeconds, now)) return false;
-		try {
-			const namespace = await options.binding();
-			const id = namespace.idFromName(objectName);
-			return await namespace.get(id).claim(nonce, expEpochSeconds) === true;
-		} catch {
-			return false;
-		}
-	} };
-}
-//#endregion
-export { CLOUDFLARE_SCHEDULED_EVENT, CloudflareApplication, CloudflareWebSocketModule, ConnectedSocket, DoCursorLog, DoPitrUnavailableError, FlagshipFlagDriver, KVCacheInvalidationStore, KVCacheStore, KvFlagDriver, MessageBody, QueueConsumer, R2StorageDriver, STORAGE_OPTIONS, StorageController, StorageManagerService, StorageModule, StorageService, SubscribeMessage, WebSocketGateway, WebSocketServer, WsException, armDoPitr, broadcastToRoom, cloudflareAdapter, cloudflareRateLimitStore, createCloudflareApp, createCloudflareWorker, durableObjectCursorLog, durableObjectLive, durableObjectNonceStore, durableObjectRoomName, flagshipFlagDriver, isDoPitrUnavailable, kvFlagDriver, liveInvalidateToRoom, readDoPitrBookmark };
-
-//# sourceMappingURL=index.js.map
+import { durableObjectRoomName } from "./websocket/room-id.js";
+import { CLOUDFLARE_SCHEDULED_EVENT } from "./scheduled-event.js";
+import { CloudflareApplication } from "./cloudflare-application.js";
+import { DoCursorLog, durableObjectCursorLog, durableObjectLive, liveInvalidateToRoom } from "./websocket/do-live.js";
+import { cloudflareAdapter, createCloudflareApp, createCloudflareWorker } from "./cloudflare-factory.js";
+import { STORAGE_OPTIONS } from "./storage/storage.tokens.js";
+import { R2StorageDriver } from "./storage/r2-storage.driver.js";
+import { StorageManagerService } from "./storage/storage-manager.service.js";
+import { StorageController } from "./storage/storage.controller.js";
+import { StorageService } from "./storage/storage.service.js";
+import { StorageModule } from "./storage/storage.module.js";
+import { KVCacheInvalidationStore, KVCacheStore } from "./services/kv-cache.store.js";
+import { FlagshipFlagDriver, flagshipFlagDriver } from "./services/flagship-flag.driver.js";
+import { KvFlagDriver, kvFlagDriver } from "./services/kv-flag.driver.js";
+import { QueueConsumer } from "./decorators/queue-consumer.js";
+import { DoPitrUnavailableError, armDoPitr, isDoPitrUnavailable, readDoPitrBookmark } from "./websocket/do-pitr.js";
+import { CloudflareWebSocketModule } from "./websocket/cloudflare-websocket.module.js";
+import { broadcastToRoom } from "./websocket/broadcast.js";
+import { cloudflareRateLimitStore } from "./rate-limit/cloudflare-rate-limit.store.js";
+import { durableObjectNonceStore } from "./nonce/durable-object-nonce.store.js";
+export { CLOUDFLARE_SCHEDULED_EVENT, CloudflareApplication, CloudflareWebSocketModule, DoCursorLog, DoPitrUnavailableError, FlagshipFlagDriver, KVCacheInvalidationStore, KVCacheStore, KvFlagDriver, QueueConsumer, R2StorageDriver, STORAGE_OPTIONS, StorageController, StorageManagerService, StorageModule, StorageService, armDoPitr, broadcastToRoom, cloudflareAdapter, cloudflareRateLimitStore, createCloudflareApp, createCloudflareWorker, durableObjectCursorLog, durableObjectLive, durableObjectNonceStore, durableObjectRoomName, flagshipFlagDriver, isDoPitrUnavailable, kvFlagDriver, liveInvalidateToRoom, readDoPitrBookmark };