@voyant-travel/hono 0.127.2 → 0.128.1

package/README.md

@@ -1,7 +1,8 @@
 # @voyant-travel/hono
 
-Hono transport adapter for Voyant. Provides `createApp()`, middleware, auth
-helpers, and plugin expansion for mounting Voyant modules behind a Hono app.
+Voyant's sole server API runtime implementation. Provides `createApp()`,
+middleware, auth helpers, and API bundle expansion for mounting Voyant modules
+behind a Hono app.
 
 ## Install
 
@@ -52,8 +53,8 @@ The middleware chain is: container → requestId → logger → errorBoundary
 | --- | --- |
 | `.` | Barrel re-exports |
 | `./app` | `createApp` factory |
-| `./module` | `HonoModule`, `HonoExtension` contracts |
-| `./bundle` | `HonoBundle`, `defineHonoBundle`, `expandHonoBundles` |
+| `./module` | `ApiModule`, `ApiExtension` contracts |
+| `./bundle` | `ApiBundle`, `defineApiBundle`, `expandApiBundles` |
 | `./middleware` | All middleware re-exports |
 | `./middleware/auth` | `requireAuth` session/API-key/JWT auth |
 | `./middleware/cors` | CORS configuration |

package/dist/anonymous-paths.d.ts

@@ -1,4 +1,4 @@
-import type { HonoExtension, HonoModule } from "./module.js";
+import type { ApiExtension, ApiModule } from "./module.js";
 /**
  * Assemble the anonymous-access allow-list (ADR-0008) from module/extension
  * `anonymous` declarations, unioned with any explicit `publicPaths` the
@@ -11,4 +11,4 @@ import type { HonoExtension, HonoModule } from "./module.js";
  * deterministic, snapshot-auditable result; the global list is what `requireAuth`
  * matches to skip auth (and stamp `actor: "customer"`).
  */
-export declare function assembleAnonymousPaths(modules: readonly HonoModule[], extensions: readonly HonoExtension[], explicit?: readonly string[]): string[];
+export declare function assembleAnonymousPaths(modules: readonly ApiModule[], extensions: readonly ApiExtension[], explicit?: readonly string[]): string[];

package/dist/anonymous-paths.js

@@ -31,7 +31,7 @@ export function assembleAnonymousPaths(modules, extensions, explicit = []) {
     // at `/v1/{name}`, matching the mount in `app.ts`. Parameterized/wildcard paths
     // are skipped (the literal `matchesPublicPath` matcher can't match them) and
     // must be declared via `anonymous` if ever needed.
-    // biome-ignore lint/suspicious/noExplicitAny: Hono sub-apps have varied env generics -- owner: hono; mirrors the HonoModule.webhookRoutes suppression.
+    // biome-ignore lint/suspicious/noExplicitAny: Hono sub-apps have varied env generics -- owner: hono; mirrors the ApiModule.webhookRoutes suppression.
     const addWebhooks = (name, routes) => {
         if (!routes)
             return;

package/dist/app.js

@@ -5,7 +5,7 @@ import { createContainer, createEventBus, createQueryRunner, } from "@voyant-tra
 import { createLinkServiceFactory } from "@voyant-travel/db/links";
 import { assembleAnonymousPaths } from "./anonymous-paths.js";
 import { containerToServiceResolver, makeFrameworkLogger, wireWorkflowRuntime, } from "./app-workflows.js";
-import { expandHonoBundles, isLazyHonoBundle, } from "./bundle.js";
+import { expandApiBundles, isLazyApiBundle, } from "./bundle.js";
 import { mountLazyRoutePaths, mountLazyRoutesAt } from "./lazy-routes.js";
 import { mountAuthForwarding } from "./lib/auth-forward.js";
 import { createPathDbSelector } from "./lib/db-selector.js";
@@ -19,7 +19,6 @@ import { cors } from "./middleware/cors.js";
 import { db } from "./middleware/db.js";
 import { handleApiError, requestId } from "./middleware/error-boundary.js";
 import { logger } from "./middleware/logger.js";
-import { metrics } from "./middleware/metrics.js";
 import { publicResponseCache } from "./middleware/public-cache.js";
 import { rateLimit, resolveRateLimitStore, } from "./middleware/rate-limit.js";
 import { requireActor } from "./middleware/require-actor.js";
@@ -80,14 +79,14 @@ export function mountApp(config) {
             throw new Error(`Duplicate bundle name: "${plugin.name}"`);
         }
         pluginNames.add(plugin.name);
-        if (isLazyHonoBundle(plugin))
+        if (isLazyApiBundle(plugin))
             lazyPlugins.push(plugin);
         else
             eagerPlugins.push(plugin);
     }
     // Expand eager plugins into their constituent modules/extensions before
     // mounting. Lazy plugins keep only their static metadata in the eager closure.
-    const expanded = eagerPlugins.length > 0 ? expandHonoBundles(eagerPlugins) : null;
+    const expanded = eagerPlugins.length > 0 ? expandApiBundles(eagerPlugins) : null;
     const allModules = [...(config.modules ?? []), ...(expanded?.modules ?? [])];
     const allExtensions = [...(config.extensions ?? []), ...(expanded?.extensions ?? [])];
     const linkDefinitions = [...(config.linkDefinitions ?? []), ...(expanded?.links ?? [])];
@@ -252,7 +251,7 @@ export function mountApp(config) {
         const pending = bundles.filter((bundle) => !expandedLazyBundleNames.has(bundle.name));
         if (pending.length === 0)
             return;
-        const lazyExpanded = expandHonoBundles(pending);
+        const lazyExpanded = expandApiBundles(pending);
         for (const bundle of pending)
             expandedLazyBundleNames.add(bundle.name);
         allModules.push(...lazyExpanded.modules);
@@ -372,11 +371,6 @@ export function mountApp(config) {
     app.use("*", requestId);
     // Structured logger
     app.use("*", logger(config.logger));
-    // Per-request metrics → Analytics Engine (no-op without the binding).
-    // Mounted before the cache middleware so cache hits are measured too.
-    if (config.metrics !== false) {
-        app.use("*", metrics());
-    }
     // CORS (allowlist via env CORS_ALLOWLIST)
     app.use("*", cors());
     if (config.securityHeaders !== false) {
@@ -604,7 +598,7 @@ export function mountApp(config) {
     }
     function buildBundleRouteApp(bundle) {
         const pluginRoutes = new OpenAPIHono();
-        const bundleExpanded = expandHonoBundles([bundle]);
+        const bundleExpanded = expandApiBundles([bundle]);
         for (const mod of bundleExpanded.modules)
             mountModuleRoutesInto(pluginRoutes, mod);
         for (const ext of bundleExpanded.extensions)

package/dist/bundle.d.ts

@@ -1,27 +1,27 @@
 import type { BootstrapHandler, EventFilterDescriptor, LinkDefinition, Subscriber, WorkflowDescriptor } from "@voyant-travel/core";
-import type { HonoExtension, HonoModule } from "./module.js";
+import type { ApiExtension, ApiModule } from "./module.js";
 /**
- * Hono-flavoured bundle contribution surface.
+ * Reusable server API contribution surface.
  *
- * `@voyant-travel/hono` is the default HTTP transport adapter for Voyant. The
- * `HonoBundle` describes reusable packages that contribute {@link HonoModule}
- * / {@link HonoExtension} wrappers that can carry HTTP routes.
+ * `@voyant-travel/hono` is Voyant's sole server API runtime implementation.
+ * `ApiBundle` describes packages that contribute {@link ApiModule} /
+ * {@link ApiExtension} wrappers carrying HTTP routes.
  *
  * Registered via `createApp({ plugins: [...] })` — the app factory expands
  * each bundle into the underlying modules, extensions, subscribers, and link
  * definitions before mounting them.
  */
-export interface HonoBundle {
+export interface ApiBundle {
     /** Unique bundle identifier (e.g. "payload-cms", "bokun"). */
     name: string;
     /** Optional version tag for diagnostics. */
     version?: string;
     /** Optional lazy runtime bootstrap executed once per app/isolate. */
     bootstrap?: BootstrapHandler;
-    /** Hono modules (module + routes) contributed by the plugin. */
-    modules?: HonoModule[];
-    /** Hono extensions (extension + routes) contributed by the plugin. */
-    extensions?: HonoExtension[];
+    /** API modules (module + routes) contributed by the plugin. */
+    modules?: ApiModule[];
+    /** API extensions (extension + routes) contributed by the plugin. */
+    extensions?: ApiExtension[];
     /** Event subscribers wired to the caller's event bus, when provided. */
     subscribers?: Subscriber[];
     /** Link definitions contributed by the plugin. */
@@ -49,15 +49,15 @@ export interface HonoBundle {
      */
     eventFilters?: readonly EventFilterDescriptor[];
 }
-declare const LAZY_HONO_BUNDLE: unique symbol;
+declare const LAZY_API_BUNDLE: unique symbol;
 /**
  * Lazy bundle declaration. The bundle's heavy runtime graph is imported only
  * when a declared route matcher is hit, unless `loadOnBootstrap` asks the app
  * to load it during request/headless bootstrap. `name` and `anonymous` remain
  * eager metadata so duplicate checks and auth allow-lists stay fail-closed.
  */
-export interface LazyHonoBundle {
-    readonly [LAZY_HONO_BUNDLE]: true;
+export interface LazyApiBundle {
+    readonly [LAZY_API_BUNDLE]: true;
     /** Unique bundle identifier matching the loaded bundle's `name`. */
     name: string;
     /** Optional version tag for diagnostics. */
@@ -94,27 +94,27 @@ export interface LazyHonoBundle {
      */
     loadOnBootstrap?: boolean;
     /** Loads and constructs the real bundle. Memoized by `mountApp`. */
-    load: () => Promise<HonoBundle>;
+    load: () => Promise<ApiBundle>;
 }
-export type HonoBundleInput = HonoBundle | LazyHonoBundle;
+export type ApiBundleInput = ApiBundle | LazyApiBundle;
 /**
  * Identity helper — returns the bundle unchanged, purely for IDE inference.
  */
-export declare function defineHonoBundle<P extends HonoBundle>(bundle: P): P;
-export declare function defineLazyHonoBundle<P extends Omit<LazyHonoBundle, typeof LAZY_HONO_BUNDLE>>(bundle: P): P & LazyHonoBundle;
-export declare function isLazyHonoBundle(bundle: HonoBundleInput): bundle is LazyHonoBundle;
-export interface ExpandedHonoBundles {
-    modules: HonoModule[];
-    extensions: HonoExtension[];
+export declare function defineApiBundle<P extends ApiBundle>(bundle: P): P;
+export declare function defineLazyApiBundle<P extends Omit<LazyApiBundle, typeof LAZY_API_BUNDLE>>(bundle: P): P & LazyApiBundle;
+export declare function isLazyApiBundle(bundle: ApiBundleInput): bundle is LazyApiBundle;
+export interface ExpandedApiBundles {
+    modules: ApiModule[];
+    extensions: ApiExtension[];
     subscribers: Subscriber[];
     links: LinkDefinition[];
     /** Absolute anonymous-access paths declared by bundles (ADR-0008). */
     anonymousPaths: string[];
 }
 /**
- * Flatten a list of {@link HonoBundle} values into their constituent pieces.
+ * Flatten a list of {@link ApiBundle} values into their constituent pieces.
  *
  * Throws if two bundles declare the same `name`.
  */
-export declare function expandHonoBundles(bundles: ReadonlyArray<HonoBundle>): ExpandedHonoBundles;
+export declare function expandApiBundles(bundles: ReadonlyArray<ApiBundle>): ExpandedApiBundles;
 export {};

package/dist/bundle.js

@@ -1,22 +1,22 @@
-const LAZY_HONO_BUNDLE = Symbol.for("voyant.hono.lazyBundle");
+const LAZY_API_BUNDLE = Symbol.for("voyant.api.lazyBundle");
 /**
  * Identity helper — returns the bundle unchanged, purely for IDE inference.
  */
-export function defineHonoBundle(bundle) {
+export function defineApiBundle(bundle) {
     return bundle;
 }
-export function defineLazyHonoBundle(bundle) {
-    return { ...bundle, [LAZY_HONO_BUNDLE]: true };
+export function defineLazyApiBundle(bundle) {
+    return { ...bundle, [LAZY_API_BUNDLE]: true };
 }
-export function isLazyHonoBundle(bundle) {
-    return bundle[LAZY_HONO_BUNDLE] === true;
+export function isLazyApiBundle(bundle) {
+    return bundle[LAZY_API_BUNDLE] === true;
 }
 /**
- * Flatten a list of {@link HonoBundle} values into their constituent pieces.
+ * Flatten a list of {@link ApiBundle} values into their constituent pieces.
  *
  * Throws if two bundles declare the same `name`.
  */
-export function expandHonoBundles(bundles) {
+export function expandApiBundles(bundles) {
     const seen = new Set();
     const modules = [];
     const extensions = [];

package/dist/composition.d.ts

@@ -1,4 +1,4 @@
-import type { HonoExtension, HonoModule } from "./module.js";
+import type { ApiExtension, ApiModule } from "./module.js";
 /**
  * Manifest-driven runtime composition.
  *
@@ -30,8 +30,8 @@ export interface CompositionContext<TCapabilities> {
     capabilities: TCapabilities;
     options: Record<string, unknown>;
 }
-export type ModuleFactory<TCapabilities> = (ctx: CompositionContext<TCapabilities>) => HonoModule | HonoModule[];
-export type ExtensionFactory<TCapabilities> = (ctx: CompositionContext<TCapabilities>) => HonoExtension;
+export type ModuleFactory<TCapabilities> = (ctx: CompositionContext<TCapabilities>) => ApiModule | ApiModule[];
+export type ExtensionFactory<TCapabilities> = (ctx: CompositionContext<TCapabilities>) => ApiExtension;
 /**
  * Maps manifest specifiers to the factory that builds the runtime unit. Keys
  * MUST match the `voyant.config.ts` `modules` / `extensions` specifiers.
@@ -41,8 +41,8 @@ export interface CompositionRegistry<TCapabilities> {
     extensions?: Record<string, ExtensionFactory<TCapabilities>>;
 }
 export interface ComposedApp {
-    modules: HonoModule[];
-    extensions: HonoExtension[];
+    modules: ApiModule[];
+    extensions: ApiExtension[];
 }
 /**
  * Derive the `createApp({ modules, extensions })` arrays from a manifest by

package/dist/index.d.ts

@@ -3,17 +3,17 @@ export { assembleAnonymousPaths } from "./anonymous-paths.js";
 export { mountApp } from "./app.js";
 export type { SessionAuthContext } from "./auth/index.js";
 export { constantTimeEqual, extractBearerToken, generateNumericCode, randomBytesHex, requireUserId, sha256Base64Url, sha256Hex, unsignCookie, verifySession, } from "./auth/index.js";
-export type { ExpandedHonoBundles, HonoBundle, HonoBundleInput, LazyHonoBundle, } from "./bundle.js";
-export { defineHonoBundle, defineLazyHonoBundle, expandHonoBundles, isLazyHonoBundle, } from "./bundle.js";
+export type { ApiBundle, ApiBundleInput, ExpandedApiBundles, LazyApiBundle, } from "./bundle.js";
+export { defineApiBundle, defineLazyApiBundle, expandApiBundles, isLazyApiBundle, } from "./bundle.js";
 export { type CreateAppConfig, createApp } from "./create-app.js";
 export type { AuthenticatedDocumentDownloadResolver, AuthenticatedDocumentDownloadResolverOptions, DocumentDownloadEnvelope, DocumentDownloadResolution, DocumentDownloadResolver, DocumentDownloadResolverResult, StoredDocumentReference, } from "./document-download.js";
 export { createAuthenticatedDocumentDownloadResolver, encodeStorageKeyPath, resolveStoredDocumentDownload, } from "./document-download.js";
 export { type AsyncMethodProvider, lazyProvider } from "./lazy-provider.js";
-export { createLazyRouteHandler, type LazyHonoRoutes, type LazyRoutesLoader, mountLazyRoutePaths, mountLazyRoutesAt, } from "./lazy-routes.js";
+export { createLazyRouteHandler, type LazyApiRoutes, type LazyRoutesLoader, mountLazyRoutePaths, mountLazyRoutesAt, } from "./lazy-routes.js";
 export { createPathDbSelector, type PathDbSelectorOptions } from "./lib/db-selector.js";
 export type { RateLimitStore } from "./middleware/index.js";
 export { clientIpKey, consoleLoggerProvider, cors, createMemoryRateLimitStore, createRedisRateLimitStore, DEFAULT_IDEMPOTENCY_TTL_MS, db, enforceRateLimit, errorBoundary, handleApiError, type IdempotencyKeyOptions, idempotencyKey, isStaffRbacEnforced, LIVE_LIMITS, logger, purgeExpiredIdempotencyKeys, rateLimit, requestId, requireActor, requireAuth, requirePermission, } from "./middleware/index.js";
-export type { HonoExtension, HonoModule } from "./module.js";
+export type { ApiExtension, ApiModule } from "./module.js";
 export type { ErrorEvent, Reporter } from "./observability/index.js";
 export { consoleReporter, getRequestId, noopReporter, runWithRequestId, safeCaptureException, } from "./observability/index.js";
 export { stampOpenApiRegistryApiId } from "./openapi-ownership.js";

package/dist/index.js

@@ -1,7 +1,7 @@
 export { assembleAnonymousPaths } from "./anonymous-paths.js";
 export { mountApp } from "./app.js";
 export { constantTimeEqual, extractBearerToken, generateNumericCode, randomBytesHex, requireUserId, sha256Base64Url, sha256Hex, unsignCookie, verifySession, } from "./auth/index.js";
-export { defineHonoBundle, defineLazyHonoBundle, expandHonoBundles, isLazyHonoBundle, } from "./bundle.js";
+export { defineApiBundle, defineLazyApiBundle, expandApiBundles, isLazyApiBundle, } from "./bundle.js";
 export { createApp } from "./create-app.js";
 export { createAuthenticatedDocumentDownloadResolver, encodeStorageKeyPath, resolveStoredDocumentDownload, } from "./document-download.js";
 export { lazyProvider } from "./lazy-provider.js";

package/dist/lazy-routes.d.ts

@@ -38,7 +38,7 @@ export type LazyRoutesLoader = () => Promise<AnyHono>;
  * matchers the framework installs up front (no bundle import until a request
  * matches).
  */
-export interface LazyHonoRoutes {
+export interface LazyApiRoutes {
     paths: readonly string[];
     load: LazyRoutesLoader;
 }

package/dist/middleware/index.d.ts

@@ -5,9 +5,8 @@ export { db } from "./db.js";
 export { errorBoundary, type HandleApiErrorOptions, handleApiError, requestId, } from "./error-boundary.js";
 export { DEFAULT_IDEMPOTENCY_TTL_MS, type IdempotencyKeyOptions, idempotencyKey, purgeExpiredIdempotencyKeys, } from "./idempotency-key.js";
 export { consoleLoggerProvider, logger } from "./logger.js";
-export { type AnalyticsEngineDatasetLike, DB_METRICS_CONTEXT_KEY, type MetricsMiddlewareOptions, metrics, type RequestDbMetrics, withQueryCounting, } from "./metrics.js";
 export { type PublicCacheOptions, publicResponseCache, resetPublicCacheStateForTests, } from "./public-cache.js";
-export { type CloudflareRateLimiterBinding, clientIpKey, createCloudflareRateLimitStore, createKvRateLimitStore, createMemoryRateLimitStore, createRedisRateLimitStore, enforceRateLimit, LIVE_LIMITS, type RateLimitConfig, type RateLimitPolicy, type RateLimitRequestContext, type RateLimitResult, type RateLimitRule, type RateLimitStore, type RedisRateLimitStoreOptions, rateLimit, resolveRateLimitStore, } from "./rate-limit.js";
+export { clientIpKey, createMemoryRateLimitStore, createRedisRateLimitStore, enforceRateLimit, LIVE_LIMITS, type RateLimitConfig, type RateLimitPolicy, type RateLimitRequestContext, type RateLimitResult, type RateLimitRule, type RateLimitStore, type RedisRateLimitStoreOptions, rateLimit, resolveRateLimitStore, } from "./rate-limit.js";
 export { isStaffRbacEnforced, requireActor } from "./require-actor.js";
 export { requirePermission } from "./require-permission.js";
 export { type SecurityHeadersOptions, securityHeaders } from "./security-headers.js";

package/dist/middleware/index.js

@@ -5,9 +5,8 @@ export { db } from "./db.js";
 export { errorBoundary, handleApiError, requestId, } from "./error-boundary.js";
 export { DEFAULT_IDEMPOTENCY_TTL_MS, idempotencyKey, purgeExpiredIdempotencyKeys, } from "./idempotency-key.js";
 export { consoleLoggerProvider, logger } from "./logger.js";
-export { DB_METRICS_CONTEXT_KEY, metrics, withQueryCounting, } from "./metrics.js";
 export { publicResponseCache, resetPublicCacheStateForTests, } from "./public-cache.js";
-export { clientIpKey, createCloudflareRateLimitStore, createKvRateLimitStore, createMemoryRateLimitStore, createRedisRateLimitStore, enforceRateLimit, LIVE_LIMITS, rateLimit, resolveRateLimitStore, } from "./rate-limit.js";
+export { clientIpKey, createMemoryRateLimitStore, createRedisRateLimitStore, enforceRateLimit, LIVE_LIMITS, rateLimit, resolveRateLimitStore, } from "./rate-limit.js";
 export { isStaffRbacEnforced, requireActor } from "./require-actor.js";
 export { requirePermission } from "./require-permission.js";
 export { securityHeaders } from "./security-headers.js";

package/dist/middleware/metrics.d.ts

@@ -1,10 +1,5 @@
 import type { MiddlewareHandler } from "hono";
-import type { VoyantVariables } from "../types.js";
-/**
- * Structural shape of a Workers Analytics Engine dataset binding —
- * declared locally so `@voyant-travel/hono` needs no `@cloudflare/workers-types`
- * dependency.
- */
+/** Structural sink contract for request metrics. */
 export interface AnalyticsEngineDatasetLike {
     writeDataPoint(point: {
         blobs?: string[];
@@ -18,19 +13,11 @@ export interface RequestDbMetrics {
 }
 export declare const DB_METRICS_CONTEXT_KEY = "__voyantDbMetrics";
 export interface MetricsMiddlewareOptions {
-    /**
-     * Resolve the Analytics Engine dataset from bindings. Defaults to
-     * `env.METRICS`. Returning undefined makes the middleware a no-op for
-     * that request (deployments without the binding pay ~nothing).
-     */
-    dataset?: (env: unknown) => AnalyticsEngineDatasetLike | undefined;
+    /** Resolve the metrics sink for a request. Returning undefined is a no-op. */
+    dataset: (env: unknown) => AnalyticsEngineDatasetLike | undefined;
 }
 /**
- * Per-request metrics → Workers Analytics Engine (RFC voyant#1687 Phase
- * 3.4, the in-worker half — the platform dispatcher's DISPATCH_METRICS
- * dataset already records hostname/plan/cache/duration per dispatch;
- * this adds what only the worker can see: the matched route pattern,
- * the db query count, and in-worker cache hits).
+ * Per-request metrics for an explicitly supplied deployment sink.
  *
  * One data point per request:
  * - blobs:   [method, routePattern, surface, cacheStatus]
@@ -40,8 +27,10 @@ export interface MetricsMiddlewareOptions {
  * `writeDataPoint` is fire-and-forget and never throws into the
  * request; a missing binding short-circuits before timing overhead.
  */
-export declare function metrics(options?: MetricsMiddlewareOptions): MiddlewareHandler<{
-    Variables: Pick<VoyantVariables, typeof DB_METRICS_CONTEXT_KEY>;
+export declare function metrics(options: MetricsMiddlewareOptions): MiddlewareHandler<{
+    Variables: {
+        [DB_METRICS_CONTEXT_KEY]?: RequestDbMetrics;
+    };
 }>;
 /**
  * Wrap a drizzle client so top-level query-initiating calls increment

package/dist/middleware/metrics.js

@@ -9,11 +9,7 @@ function surfaceOf(path) {
     return "other";
 }
 /**
- * Per-request metrics → Workers Analytics Engine (RFC voyant#1687 Phase
- * 3.4, the in-worker half — the platform dispatcher's DISPATCH_METRICS
- * dataset already records hostname/plan/cache/duration per dispatch;
- * this adds what only the worker can see: the matched route pattern,
- * the db query count, and in-worker cache hits).
+ * Per-request metrics for an explicitly supplied deployment sink.
  *
  * One data point per request:
  * - blobs:   [method, routePattern, surface, cacheStatus]
@@ -23,9 +19,8 @@ function surfaceOf(path) {
  * `writeDataPoint` is fire-and-forget and never throws into the
  * request; a missing binding short-circuits before timing overhead.
  */
-export function metrics(options = {}) {
-    const resolveDataset = options.dataset ??
-        ((env) => env?.METRICS);
+export function metrics(options) {
+    const resolveDataset = options.dataset;
     return async (c, next) => {
         const dataset = resolveDataset(c.env);
         if (!dataset || typeof dataset.writeDataPoint !== "function") {

package/dist/middleware/rate-limit.d.ts

@@ -1,4 +1,3 @@
-import type { KVStore } from "@voyant-travel/utils/cache";
 import { type LazyRedisClient } from "@voyant-travel/utils/redis-client";
 import type { MiddlewareHandler } from "hono";
 /**
@@ -6,11 +5,9 @@ import type { MiddlewareHandler } from "hono";
  *
  * The limiter is split into two halves:
  *
- * - a {@link RateLimitStore} — the counting backend. Three implementations
- *   ship with the framework: the Cloudflare native Rate Limiting binding
- *   (truly distributed, limits configured in wrangler), a KV-backed
- *   fixed-window counter (best-effort — see {@link createKvRateLimitStore}),
- *   and an in-memory Map for Node/dev/tests (per-isolate).
+ * - a {@link RateLimitStore} — the counting backend. Composition injects the
+ *   selected provider; an in-memory Map remains the zero-configuration
+ *   fallback for Node/dev/tests.
  * - the enforcement surface — the {@link rateLimit} Hono middleware and the
  *   imperative {@link enforceRateLimit} helper that route packages
  *   (storefront, bookings, …) call directly inside handlers.
@@ -73,9 +70,8 @@ export interface RateLimitPolicy {
 export interface RateLimitConfig {
     /**
      * Explicit store, or a function-of-bindings for stores built from env
-     * bindings (Workers env is only available per request). When omitted —
-     * or when the function returns `undefined` — resolution falls through
-     * to `c.env.RATE_LIMITER` (CF binding) → `c.env.RATE_LIMIT` (KV) →
+     * bindings. When omitted — or when the function returns `undefined` —
+     * resolution falls through to the injected `RATE_LIMIT_STORE`, then
      * in-memory.
      */
     store?: RateLimitStore | ((env: unknown) => RateLimitStore | undefined);
@@ -92,21 +88,6 @@ export interface RateLimitRule {
     max: number;
     windowSeconds: number;
 }
-/**
- * The Cloudflare native Rate Limiting binding shape (wrangler
- * `[[ratelimits]]`). The binding's `limit`/`period` are fixed in wrangler
- * config — the policy's `max`/`windowSeconds` are advisory for headers
- * only. One shared binding works across policies because the bucket is
- * part of the key; deployments wanting different limits per policy bind
- * one ratelimiter per policy and pass it via `policy.store`.
- */
-export interface CloudflareRateLimiterBinding {
-    limit(opts: {
-        key: string;
-    }): Promise<{
-        success: boolean;
-    }>;
-}
 /**
  * Minimal structural view of a Hono context — enough for key derivation,
  * store resolution, and response headers — so route packages can call
@@ -142,30 +123,6 @@ export declare function clientIpKey(c: {
 export declare function createMemoryRateLimitStore(options?: {
     maxEntries?: number;
 }): RateLimitStore;
-/**
- * KV-backed fixed-window store.
- *
- * **Best-effort by construction**: KV is eventually consistent and the
- * counter is a non-atomic read-modify-write, so concurrent requests
- * across PoPs undercount — a determined attacker gets somewhat more than
- * `max` through before the window converges. With per-client keys this
- * is still a real brake on brute force and write floods; deployments
- * needing exact distributed limits should bind the Cloudflare Rate
- * Limiting binding (`RATE_LIMITER`) instead.
- *
- * Stored keys are `lim:<bucket>:<clientKey>:<windowKey>` (the window
- * suffix is appended here) with a TTL of `max(60, windowSeconds * 2)` —
- * KV's TTL floor is 60s.
- */
-export declare function createKvRateLimitStore(kv: KVStore): RateLimitStore;
-/**
- * Adapter for the Cloudflare native Rate Limiting binding. Truly
- * distributed and atomic; the actual limit/period are fixed in wrangler
- * config, so the policy's `max`/`windowSeconds` only inform the
- * `Retry-After` hint. `remaining` is never reported (the binding does
- * not expose it).
- */
-export declare function createCloudflareRateLimitStore(binding: CloudflareRateLimiterBinding): RateLimitStore;
 export interface RedisRateLimitStoreOptions {
     client?: LazyRedisClient;
 }
@@ -174,8 +131,8 @@ export declare function createRedisRateLimitStore(redisUrl: string, options?: Re
 export declare function resetRateLimitWarningsForTests(): void;
 /**
  * Resolve the best available store from the environment:
- * `c.env.RATE_LIMITER` (CF Rate Limiting binding) → `c.env.RATE_LIMIT`
- * (KV) → in-memory fallback. **Fails open into the memory store** —
+ * Injected `c.env.RATE_LIMIT_STORE` → in-memory fallback. **Fails open into
+ * the memory store** —
  * rate limiting must never break Node/headless deployments that bind
  * neither — but warns once per isolate outside dev/test so a
  * production deploy without a distributed backend is visible in logs.

package/dist/middleware/rate-limit.js

@@ -67,58 +67,6 @@ export function createMemoryRateLimitStore(options) {
         },
     };
 }
-/**
- * KV-backed fixed-window store.
- *
- * **Best-effort by construction**: KV is eventually consistent and the
- * counter is a non-atomic read-modify-write, so concurrent requests
- * across PoPs undercount — a determined attacker gets somewhat more than
- * `max` through before the window converges. With per-client keys this
- * is still a real brake on brute force and write floods; deployments
- * needing exact distributed limits should bind the Cloudflare Rate
- * Limiting binding (`RATE_LIMITER`) instead.
- *
- * Stored keys are `lim:<bucket>:<clientKey>:<windowKey>` (the window
- * suffix is appended here) with a TTL of `max(60, windowSeconds * 2)` —
- * KV's TTL floor is 60s.
- */
-export function createKvRateLimitStore(kv) {
-    return {
-        async limit(key, { max, windowSeconds }) {
-            const nowSeconds = Math.floor(Date.now() / 1000);
-            const windowKey = Math.floor(nowSeconds / windowSeconds);
-            const storageKey = `${key}:${windowKey}`;
-            const raw = await kv.get(storageKey);
-            const current = raw ? Number(raw) || 0 : 0;
-            const next = current + 1;
-            await kv.put(storageKey, String(next), {
-                expirationTtl: Math.max(60, windowSeconds * 2),
-            });
-            return {
-                allowed: next <= max,
-                remaining: Math.max(0, max - next),
-                retryAfterSeconds: Math.max(1, windowSeconds - (nowSeconds % windowSeconds)),
-            };
-        },
-    };
-}
-/**
- * Adapter for the Cloudflare native Rate Limiting binding. Truly
- * distributed and atomic; the actual limit/period are fixed in wrangler
- * config, so the policy's `max`/`windowSeconds` only inform the
- * `Retry-After` hint. `remaining` is never reported (the binding does
- * not expose it).
- */
-export function createCloudflareRateLimitStore(binding) {
-    return {
-        async limit(key, { windowSeconds }) {
-            const { success } = await binding.limit({ key });
-            return success
-                ? { allowed: true }
-                : { allowed: false, retryAfterSeconds: Math.max(1, windowSeconds) };
-        },
-    };
-}
 export function createRedisRateLimitStore(redisUrl, options = {}) {
     const lazyClient = options.client ?? createLazyRedisClient(redisUrl);
     return {
@@ -140,9 +88,7 @@ export function createRedisRateLimitStore(redisUrl, options = {}) {
     };
 }
 // ---- Store resolution ----
-const bindingStoreCache = new WeakMap();
 const explicitStoreCache = new WeakMap();
-const kvStoreCache = new WeakMap();
 const sharedMemoryStore = createMemoryRateLimitStore();
 let warnedNoDistributedStore = false;
 function isDevLikeEnv() {
@@ -156,23 +102,14 @@ export function resetRateLimitWarningsForTests() {
 }
 /**
  * Resolve the best available store from the environment:
- * `c.env.RATE_LIMITER` (CF Rate Limiting binding) → `c.env.RATE_LIMIT`
- * (KV) → in-memory fallback. **Fails open into the memory store** —
+ * Injected `c.env.RATE_LIMIT_STORE` → in-memory fallback. **Fails open into
+ * the memory store** —
  * rate limiting must never break Node/headless deployments that bind
  * neither — but warns once per isolate outside dev/test so a
  * production deploy without a distributed backend is visible in logs.
  */
 export function resolveRateLimitStore(c, memoryFallback = sharedMemoryStore) {
     const env = (c.env ?? {});
-    const binding = env.RATE_LIMITER;
-    if (binding && typeof binding.limit === "function") {
-        let store = bindingStoreCache.get(binding);
-        if (!store) {
-            store = createCloudflareRateLimitStore(binding);
-            bindingStoreCache.set(binding, store);
-        }
-        return store;
-    }
     const explicit = env.RATE_LIMIT_STORE;
     if (explicit && typeof explicit.limit === "function") {
         let store = explicitStoreCache.get(explicit);
@@ -182,19 +119,10 @@ export function resolveRateLimitStore(c, memoryFallback = sharedMemoryStore) {
         }
         return store;
     }
-    const kv = env.RATE_LIMIT;
-    if (kv && typeof kv.get === "function" && typeof kv.put === "function") {
-        let store = kvStoreCache.get(kv);
-        if (!store) {
-            store = createKvRateLimitStore(kv);
-            kvStoreCache.set(kv, store);
-        }
-        return store;
-    }
     if (!warnedNoDistributedStore && !isDevLikeEnv()) {
         warnedNoDistributedStore = true;
         console.warn("[voyant] rate-limit: no distributed store available (inject RATE_LIMIT_STORE " +
-            "or a KV-compatible RATE_LIMIT fallback). " +
+            "). " +
             "Falling back to a per-isolate in-memory limiter — limits apply " +
             "per instance, not fleet-wide.");
     }

package/dist/module.d.ts

@@ -1,7 +1,7 @@
 import type { Extension, Module } from "@voyant-travel/core";
 import type { Hono } from "hono";
-import type { LazyHonoRoutes, LazyRoutesLoader } from "./lazy-routes.js";
-export interface HonoModule {
+import type { LazyApiRoutes, LazyRoutesLoader } from "./lazy-routes.js";
+export interface ApiModule {
     module: Module;
     /** Staff-facing routes — mounted at `/v1/admin/{module.name}`. */
     adminRoutes?: Hono<any>;
@@ -35,7 +35,7 @@ export interface HonoModule {
      * returns ABSOLUTE routes; the framework mounts + caches them with the request
      * context bridged in. Context-preserving replacement for `mountLazyRouteApp`.
      */
-    lazyRoutes?: LazyHonoRoutes;
+    lazyRoutes?: LazyApiRoutes;
     /**
      * Optional override for the public mount path relative to `/v1/public`.
      *
@@ -69,7 +69,7 @@ export interface HonoModule {
      */
     transactionalPaths?: readonly string[];
 }
-export interface HonoExtension {
+export interface ApiExtension {
     extension: Extension;
     /** Staff-facing routes — mounted at `/v1/admin/{extension.module}`. */
     adminRoutes?: Hono<any>;
@@ -77,15 +77,15 @@ export interface HonoExtension {
     publicRoutes?: Hono<any>;
     /**
      * Inbound webhook routes — mounted at `/v1/{extension.module}`, concrete paths
-     * auto-added to the anonymous allow-list (ADR-0008). See `HonoModule.webhookRoutes`.
+     * auto-added to the anonymous allow-list (ADR-0008). See `ApiModule.webhookRoutes`.
      */
     webhookRoutes?: Hono<any>;
-    /** Lazy variant of `adminRoutes` — mounted at `/v1/admin/{extension.module}` (see HonoModule). */
+    /** Lazy variant of `adminRoutes` — mounted at `/v1/admin/{extension.module}` (see ApiModule). */
     lazyAdminRoutes?: LazyRoutesLoader;
     /** Lazy variant of `publicRoutes` — mounted at `/v1/public/{publicPath ?? extension.module}`. */
     lazyPublicRoutes?: LazyRoutesLoader;
-    /** Deployment-local lazy family at explicit absolute paths (see HonoModule). */
-    lazyRoutes?: LazyHonoRoutes;
+    /** Deployment-local lazy family at explicit absolute paths (see ApiModule). */
+    lazyRoutes?: LazyApiRoutes;
     /**
      * Optional override for the public mount path relative to `/v1/public`.
      *
@@ -95,13 +95,13 @@ export interface HonoExtension {
     publicPath?: string;
     /**
      * Declares which of this extension's PUBLIC routes are reachable without a
-     * session (ADR-0008). Same semantics as {@link HonoModule.anonymous}, relative
+     * session (ADR-0008). Same semantics as {@link ApiModule.anonymous}, relative
      * to the extension's public mount.
      */
     anonymous?: boolean | readonly string[];
     /**
      * Absolute transactional path prefixes — same semantics as
-     * {@link HonoModule.transactionalPaths}.
+     * {@link ApiModule.transactionalPaths}.
      */
     transactionalPaths?: readonly string[];
 }

package/dist/types.d.ts

@@ -7,8 +7,8 @@ import type { NeonHttpDatabase } from "drizzle-orm/neon-http";
 import type { NeonDatabase as NeonWsDatabase } from "drizzle-orm/neon-serverless";
 import type { PostgresJsDatabase } from "drizzle-orm/postgres-js";
 import type { Handler, Hono } from "hono";
-import type { HonoBundleInput } from "./bundle.js";
-import type { HonoExtension, HonoModule } from "./module.js";
+import type { ApiBundleInput } from "./bundle.js";
+import type { ApiExtension, ApiModule } from "./module.js";
 import type { Reporter } from "./observability/reporter.js";
 export interface VoyantExecutionContext {
     waitUntil?: (promise: Promise<unknown>) => void;
@@ -24,17 +24,9 @@ export interface VoyantBindings {
     APP_URL?: string;
     DASH_BASE_URL?: string;
     API_BASE_URL?: string;
-    RATE_LIMIT?: KVStore;
     RATE_LIMIT_STORE?: import("./middleware/rate-limit.js").RateLimitStore;
     CACHE?: KVStore;
     SHARED_STATE?: KVStore;
-    RATE_LIMITER?: import("./middleware/rate-limit.js").CloudflareRateLimiterBinding;
-    /**
-     * Workers Analytics Engine dataset receiving per-request metrics
-     * (see the `metrics` middleware). Optional — without it the
-     * middleware is a no-op.
-     */
-    METRICS?: import("./middleware/metrics.js").AnalyticsEngineDatasetLike;
 }
 export type VoyantDb = PostgresJsDatabase | NeonHttpDatabase | NeonWsDatabase;
 export type VoyantQueryRuntime = QueryRunner;
@@ -55,8 +47,6 @@ export type VoyantVariables = CoreVoyantVariables & {
     query?: VoyantQueryRuntime;
     /** Optional workflow driver surfaced to HTTP routes after lazy app bootstrap. */
     workflowDriver?: import("@voyant-travel/workflows/driver").WorkflowDriver;
-    /** Per-request db metrics counter populated by the metrics middleware. */
-    __voyantDbMetrics?: import("./middleware/metrics.js").RequestDbMetrics;
 };
 /** Handler contract for application-authored Hono API routes. */
 export type VoyantRouteHandler<TBindings extends VoyantBindings = VoyantBindings> = Handler<{
@@ -193,9 +183,9 @@ export interface VoyantAppConfig<TBindings extends VoyantBindings = VoyantBindin
      * together with `dbTransactional`.
      */
     dbTransactionalPaths?: string[];
-    modules?: HonoModule[];
-    extensions?: HonoExtension[];
-    plugins?: HonoBundleInput[];
+    modules?: ApiModule[];
+    extensions?: ApiExtension[];
+    plugins?: ApiBundleInput[];
     eventBus?: EventBus;
     /**
      * Link definitions activated against each request's resolved database.
@@ -260,13 +250,6 @@ export interface VoyantAppConfig<TBindings extends VoyantBindings = VoyantBindin
      * `insertOutboxEvents(tx, ...)`. Default off.
      */
     outbox?: boolean;
-    /**
-     * Per-request metrics to the `env.METRICS` Analytics Engine dataset
-     * (method, route pattern, surface, cache status, duration, status,
-     * db query count). Enabled by default and inert without the binding;
-     * set `false` to disable entirely.
-     */
-    metrics?: boolean;
     /**
      * Default request body limit enforced before route handlers parse
      * JSON/form data. Content-type-aware: JSON bodies are capped at 10 MiB

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voyant-travel/hono",
-  "version": "0.127.2",
+  "version": "0.128.1",
   "license": "Apache-2.0",
   "type": "module",
   "exports": {
@@ -130,18 +130,17 @@
     "drizzle-orm": "^0.45.2",
     "hono": "^4.12.27",
     "zod": "^4.4.3",
-    "@voyant-travel/core": "^0.124.0",
-    "@voyant-travel/db": "^0.114.7",
+    "@voyant-travel/core": "^0.125.0",
+    "@voyant-travel/db": "^0.114.9",
     "@voyant-travel/types": "^0.109.2",
     "@voyant-travel/utils": "^0.107.1",
-    "@voyant-travel/workflows": "^0.121.0"
+    "@voyant-travel/workflows": "^0.122.2"
   },
   "devDependencies": {
-    "@cloudflare/workers-types": "^4.20260702.1",
     "typescript": "^6.0.3",
     "vitest": "^4.1.9",
     "@voyant-travel/voyant-typescript-config": "^0.1.0",
-    "@voyant-travel/workflows-orchestrator": "^0.121.0"
+    "@voyant-travel/workflows-orchestrator": "^0.122.2"
   },
   "files": [
     "dist"