Struct Cloudflare 

pub struct Cloudflare { /* private fields */ }

The Workers runtime. Binding names are static; .mailer()/.captcha() take adapter instances (cratefield-adapter-resend, cratefield-adapter-turnstile).

Clone, like the native runtime’s Native, so a venture can hand one instance to Harness::builder().runtime(..) and keep the same one to serve with. Two separately-built instances are the shape of a silent bug: Harness::build validates every module’s requires() against the ports of the instance it was given, and the one that actually serves is the other.

Implementations

impl Cloudflare

pub fn new() -> Self

pub fn db(self, binding: &'static str) -> Self

pub fn kv(self, binding: &'static str) -> Self

pub fn blob(self, binding: &'static str) -> Self

The R2 bucket binding backing the Blob port.

pub fn blob_presign( self, account_id: &'static str, access_key_id: &'static str, secret_access_key: &'static str, bucket: &'static str, ) -> Self

Presigned R2 URLs on the Blob port (issue #622): a GET a browser can fetch directly from R2, skipping the Worker, and a PUT it can upload to — both through R2’s S3-compatible API, which the binding alone cannot reach.

Each argument names a Worker var or secret — the account id (the R2 endpoint’s subdomain), an R2 API token’s access key id and secret access key, and the bucket (the endpoint’s first path segment) — read from the request’s Env (secrets first, then vars). The Env exists only per request, so the values cannot be resolved at compose time. Scope the R2 token to the one bucket this port serves: a token that reaches every bucket in the account reads every tenant’s media.

Without this call, or with any value missing or empty at request time, presigning stays off and both presign methods answer BlobError::Unsupported.

pub fn vector_index(self, binding: &'static str) -> Self

The Vectorize index binding backing the VectorIndex port (issue #561): nearest-neighbour search, one namespace per tenant. A deployment without the binding leaves the port unwired.

pub fn rate_limiter(self, binding: &'static str) -> Self

pub fn actors(self, binding: &'static str) -> Self

The Durable Object namespace binding backing the Actor port (issue #583): per-key serialized state with transactional storage and an alarm. The venture declares the #[durable_object] class and forwards it to ActorDriver; this names the binding that class is bound under (ACTORS in the example). The object is addressed by <kind>:<key>, so every call for one key lands on the same object, which the runtime then serializes.

The binding is resolved per event in ports(), where the harness secret the frames are signed with is read from the same Env.

pub fn d1_rate_limiter( self, binding: &'static str, policy: impl Fn(&str) -> Option<Limit> + Send + Sync + 'static, ) -> Self

The RateLimiter port over D1 (issue #538): a fixed window per key, one atomic upsert per request (D1RateLimiter), so the budget can vary per key — the Workers Rate Limiting binding above is one limit per namespace. The policy maps a key to its Limit; None means unlimited, allowed without a D1 round trip. Encode the plan in the key (plan:pro:ip:203.0.113.7) and match on the prefix.

Fills the same port slot as rate_limiter; where both are wired, this one wins. The counters table ships as RATE_LIMIT_COUNTERS_SQL: add it to the venture’s migrations/ directory.

pub fn mailer(self, mailer: impl Mailer + 'static) -> Self

pub fn mailer_arc(self, mailer: Arc<dyn Mailer>) -> Self

pub fn push(self, push: impl Push + 'static) -> Self

The Push port. Like mailer, the adapter is built from the venture’s secrets (cratefield-adapter-apns from an APNs .p8) and passed in, not resolved from a Worker binding.

pub fn push_arc(self, push: Arc<dyn Push>) -> Self

pub fn payments(self, payments: impl Payments + 'static) -> Self

The Payments port. Like mailer, the adapter is built from the venture’s secrets (cratefield-adapter-stripe from the Stripe keys) and passed in, not resolved from a Worker binding.

pub fn payments_arc(self, payments: Arc<dyn Payments>) -> Self

pub fn tracker(self, tracker: impl Tracker + 'static) -> Self

The Tracker port. Like mailer and payments, the adapter is built by the venture and passed in, not resolved from a Worker binding.

Unlike those adapters, it holds no credential: which tracker to file into and under whose token are tenant data, supplied per call by the module that files — see cratefield_core::Tracker for why that differs from the Resend/Stripe shape.

pub fn tracker_arc(self, tracker: Arc<dyn Tracker>) -> Self

tracker for an already-shared adapter.

pub fn text_model(self, text_model: impl TextModel + 'static) -> Self

The TextModel port (issue #429): an adapter over the venture’s vendor of choice for each ModelTier, or one RoutingTextModel over both tiers. Passed in, not resolved from a Worker binding — there is no vendor-neutral binding to sniff out of the environment.

pub fn text_model_arc(self, text_model: Arc<dyn TextModel>) -> Self

pub fn classifier(self, classifier: impl Classifier + 'static) -> Self

The Classifier port (issue #456): a typed, calibrated decision — “which of these is it, and how sure are you” — passed in like text_model. An adapter over the Workers AI env.AI binding is still built by the venture and handed here, so there is no new binding name to learn.

pub fn classifier_arc(self, classifier: Arc<dyn Classifier>) -> Self

classifier for an already-shared adapter.

pub fn custom_hostnames( self, custom_hostnames: impl CustomHostnames + 'static, ) -> Self

The CustomHostnames port (issue #590): a customer’s own hostname served by a venture, passed in like mailer. The Cloudflare for SaaS adapter is cratefield-adapter-cloudflare-saas, portable over the HttpClient port, so this is the same wiring on either runtime.

pub fn custom_hostnames_arc( self, custom_hostnames: Arc<dyn CustomHostnames>, ) -> Self

custom_hostnames for an already-shared adapter.

pub fn captcha(self, captcha: impl Captcha + 'static) -> Self

pub fn auth(self, auth: impl Auth + 'static) -> Self

Wires who a request’s credentials speak for (issue #153).

Without one the deployment cannot identify a caller, and a module that declares Port::Auth is refused composition rather than mounted and left guessing.

pub fn auth_arc(self, auth: Arc<dyn Auth>) -> Self

pub fn auth_from_env(self) -> Self

Assembles the Auth port from AUTH_ISSUER and AUTH_CLIENT_ID (issue #153), the way push_from_env assembles push.

The port is provided either way. The Env exists per request on Workers, so a runtime cannot know at compose time whether the issuer is set, and refusing to provide the port would make every such deployment fail to boot — including the ones whose tables are all public. With the variables unset the port is a cratefield_core::Unconfigured, which answers 503 to a request that presents a credential and leaves an anonymous one anonymous.

pub fn captcha_arc(self, captcha: Arc<dyn Captcha>) -> Self

pub fn ports(&self, env: &Env, defer: Arc<dyn Defer>) -> Ports

Resolves the per-request Ports from the actual bindings and the event’s wait_until context. Absent optional bindings leave the port None (logged once per isolate); a missing HARNESS_SECRET leaves Signer unset the same way.

Trait Implementations

impl Clone for Cloudflare

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Default for Cloudflare

fn default() -> Self

Returns the “default value” for a type.

impl Runtime for Cloudflare

fn provides(&self) -> Vec<Port>

The static set used by Harness::build. Signer is included: its presence is validated at ports() time (and by fz doctor).

fn effectively_configured(&self, port: Port) -> bool

Harness::build gate (issue #133): a Turnstile adapter that is not hostname-bound, or left fail-open, cannot verify a production HumanForm route — the port is present but not usable, so report it as not effectively configured. Adapters that do not report (binding() == None) count as effective when present: presence is all the runtime can know about them.