Skip to content
Oyster0.6.0
API reference

tenancy/cloudflare

Import

Section titled “Import”
Import
import * as api from "@fungi.computer/oyster/tenancy/cloudflare";

Exports

Section titled “Exports”
Kind Export Description
type alias RateLimitOptions Retry-After is an advisory response delay, not a configured quota or reset time.
type alias RegistryAdmission The registry owner’s atomic read of one host and one identity.
type alias AdmissionRecord One request’s atomic registry read, with the host and identity it named.
type alias TenantAdmission One atomic registry read for one request. Only durableObjectRegistry constructs it, so lower layers cannot mint authority.
type alias TenancyRegistryDO Native registry instance; its public shape exposes no runtime-private state.
type alias DomainRegistry A read-only registry that includes the provisioned-domain index.
type alias DurableReadonlyRegistry Read-only native registry, with one-read request admission.
type alias DurableRegistry Managed native registry includes the provisioned-domain index.
constant TenancyRegistryDO Re-export from a host Worker and bind a SQLite-backed Durable Object namespace.
function rateLimit() Delegate abuse admission to the configured native binding, using only its key API.
function durableObjectRegistry()
function admittedRegistry() Answer registry reads only from one request’s admission. Any other tenant, host, identity or member reads as absent, so every refusal stays closed.

RateLimitOptionstype alias

Section titled “RateLimitOptions”
Signature
type RateLimitOptions = Readonly<{
  retryAfterSeconds: number;
}>;

Retry-After is an advisory response delay, not a configured quota or reset time.

RegistryAdmissiontype alias

Section titled “RegistryAdmission”
Signature
type RegistryAdmission = Readonly<{
  tenant: Tenant;
  membership: Membership | null;
}>;

The registry owner’s atomic read of one host and one identity.

AdmissionRecordtype alias

Section titled “AdmissionRecord”
Signature
type AdmissionRecord = RegistryAdmission &
  Readonly<{
    host: string;
    identity: Identity;
  }>;

One request’s atomic registry read, with the host and identity it named.

TenantAdmissiontype alias

Section titled “TenantAdmission”
Signature
type TenantAdmission = AdmissionRecord & Brand<"TenantAdmission">;

One atomic registry read for one request. Only durableObjectRegistry constructs it, so lower layers cannot mint authority.

TenancyRegistryDOtype alias

Section titled “TenancyRegistryDO”
Signature
type TenancyRegistryDO = ManagedTenantRegistry &
  Required<Pick<ReadonlyTenantRegistry, "byDomain">> &
  Readonly<{
    admission: Promise<Readonly<{
      tenant: Tenant;
      membership: Membership | null;
    }> | null>;
  }> &
  Rpc.DurableObjectBranded;

Native registry instance; its public shape exposes no runtime-private state.

DomainRegistrytype alias

Section titled “DomainRegistry”
Signature
type DomainRegistry = ReadonlyTenantRegistry &
  Required<Pick<ReadonlyTenantRegistry, "byDomain">>;

A read-only registry that includes the provisioned-domain index.

DurableReadonlyRegistrytype alias

Section titled “DurableReadonlyRegistry”
Signature
type DurableReadonlyRegistry = DomainRegistry &
  Readonly<{
    admission: Promise<TenantAdmission | null>;
  }>;

Read-only native registry, with one-read request admission.

DurableRegistrytype alias

Section titled “DurableRegistry”
Signature
type DurableRegistry = ManagedTenantRegistry & DurableReadonlyRegistry;

Managed native registry includes the provisioned-domain index.

TenancyRegistryDOconstant

Section titled “TenancyRegistryDO”
Signature
TenancyRegistryDO: (ctx) => TenancyRegistryDO;

Re-export from a host Worker and bind a SQLite-backed Durable Object namespace.

Re-export from a host Worker and bind a SQLite-backed Durable Object namespace.

Parameters

Section titled “Parameters”
Parameter Type
ctx DurableObjectState

Returns

Section titled “Returns”

TenancyRegistryDO

rateLimit()function

Section titled “rateLimit()”
Signature
function rateLimit(binding, options): TenancyPolicy;

Delegate abuse admission to the configured native binding, using only its key API.

Parameters

Section titled “Parameters”
Parameter Type
binding Pick<RateLimit, "limit">
options RateLimitOptions

Returns

Section titled “Returns”

TenancyPolicy

durableObjectRegistry()function

Section titled “durableObjectRegistry()”

Call Signature

Section titled “Call Signature”
Signature
function durableObjectRegistry(binding, options): DurableReadonlyRegistry;

Explicitly expose only read methods when the host requests a read-only facade.

Parameters

Section titled “Parameters”
Parameter Type
binding Pick<DurableObjectNamespace<TenancyRegistryDO>, "getByName">
options { readonly: true; }
options.readonly true

Returns

Section titled “Returns”

DurableReadonlyRegistry

Call Signature

Section titled “Call Signature”
Signature
function durableObjectRegistry(binding, options?): DurableRegistry;

Use one namespace’s registry object as the tenant and owner mapping authority.

Parameters

Section titled “Parameters”
Parameter Type
binding Pick<DurableObjectNamespace<TenancyRegistryDO>, "getByName">
options? { readonly?: false; }
options.readonly? false

Returns

Section titled “Returns”

DurableRegistry

admittedRegistry()function

Section titled “admittedRegistry()”
Signature
function admittedRegistry(admission): DomainRegistry;

Answer registry reads only from one request’s admission. Any other tenant, host, identity or member reads as absent, so every refusal stays closed.

Parameters

Section titled “Parameters”
Parameter Type
admission TenantAdmission

Returns

Section titled “Returns”

DomainRegistry