@3sln/trove 0.0.12 → 0.0.13

package/packages/core/src/vfs.js

@@ -119,16 +119,15 @@ export class Vfs {
     this.uploads = new UploadManager({
       storageFor: (cid) => this.storageFor(cid),
       sessions: uploadSessions,
-      // What a collection encrypts and the key for it. Only the CollectionService knows,
-      // and only it is allowed to hand the key out — see collections/index.js.
-      encryptionFor: async (cid) => {
-        if (!this.collections?.encryptionFor) return null;
-        const encryption = await this.collections.encryptionFor(cid);
-        if (!encryption?.enabled) return null;
-        const key = await this.collections.dataKeyFor(cid);
-        if (!key) return null;
-        return { encryption, dataKeyHex: toHex(key) };
-      },
+      // ONE implementation of "does this item get sealed, and with what" — the same method
+      // `writeFile` uses, so a collection with per-item rules answers identically whichever
+      // way the bytes arrive, and both paths fail CLOSED when the key is missing.
+      sealingFor: (cid, name, contentType) => this.#sealingFor(cid, name, contentType),
+      // The key a fingerprint names, so an upload seals its later parts with the key it
+      // decided on rather than with whatever became current meanwhile. Only the
+      // CollectionService knows it, and only it is allowed to hand it out.
+      keyFor: async (cid, fingerprint) =>
+        (this.collections?.dataKeyFor ? this.collections.dataKeyFor(cid, fingerprint) : null),
       maxBytes: maxUploadBytes,
       partSize: uploadPartSize,
     });
@@ -177,7 +176,12 @@ export class Vfs {
     if (!shouldEncrypt(encryption, { name, contentType })) return null;
     const key = await this.collections.dataKeyFor(collectionId);
     if (!key) throw TroveError.internal('This collection is encrypted but its key is unavailable');
-    return { key, fingerprint: fromHex(encryption.fingerprint), chunkSize: encryption.chunkSize || DEFAULT_CHUNK_SIZE };
+    // `DEFAULT_CHUNK_SIZE`, not `encryption.chunkSize`. A collection cannot choose one:
+    // `normalizeEncryption` emits exactly `{ enabled, fingerprint, rules }` and every
+    // writer of `c.encryption` goes through it, so the field was structurally always
+    // undefined and the `||` read as a knob that could be turned. The per-OBJECT chunk
+    // size is real and separate — the envelope writes it, and reads take it from there.
+    return { key, fingerprint: fromHex(encryption.fingerprint), chunkSize: DEFAULT_CHUNK_SIZE };
   }
 
   /** Resolve the storage backend for a collection. */
@@ -476,8 +480,11 @@ export class Vfs {
   async #note(kind, subject, title, err) {
     try {
       await this.issues?.raise({
+        // No `retryable`: `raise` builds a fixed field set and never reads one, and the
+        // route recomputes it from whether a handler is registered for `retry.op`. A field
+        // that is written, ignored and then contradicted is worse than no field.
         kind, subject, severity: 'warning', title,
-        detail: err?.message || String(err), retryable: false,
+        detail: err?.message || String(err),
       });
     } catch { /* the issue registry is itself best-effort here */ }
   }
@@ -536,25 +543,25 @@ export class Vfs {
 
   // --- download --------------------------------------------------------------
 
-  async getDownload(id, { expiresIn, download, ciphertext = false } = {}) {
+  /**
+   * May the download route hand this object straight to the store?
+   *
+   * A PREDICATE rather than a second download implementation. `getDownload` used to
+   * encode the presign-or-proxy rule here while `mintUrl` encoded it two hundred lines
+   * away, and they disagreed: mintUrl presigned whenever the store COULD and never asked
+   * whether the object was sealed, so on any encrypted collection with a presigning store
+   * every thumbnail, preview and externally-handed URL pointed at CIPHERTEXT. That
+   * incident report is server/test/mint-url-encryption.test.js.
+   *
+   * An encrypted object is never redirected to. A redirect hands the caller raw ciphertext
+   * and most callers of a download URL can do nothing with it — an `<img src>`, a `<video
+   * src>`, a signed URL given to an external service. Proxying is the answer that is always
+   * correct.
+   */
+  async canRedirect(id) {
     const node = await this.resolve(id);
-    const storage = await this.storageFor(node.collectionId);
-    // An encrypted object is not redirected to by default. A redirect hands the caller raw
-    // ciphertext, and most callers of a download URL cannot do anything with it — an <img
-    // src>, a <video src>, a signed URL given to an external service. Proxying is the
-    // answer that is always correct, so it is the default; a client that holds the key and
-    // knows it can decrypt asks for `ciphertext` and gets the direct path back.
-    if (node.encryption && !ciphertext) return { mode: 'proxy', node };
-    if (storage.capabilities.presignDownload) {
-      const url = await storage.presignGet(node.storageKey, {
-        expiresIn, responseContentType: node.contentType,
-        downloadName: download ? node.name : undefined,
-      });
-      // Named on the way out so a client that asked for ciphertext knows which key opens
-      // what it is about to receive.
-      return { mode: 'redirect', url, node, encryption: node.encryption || null };
-    }
-    return { mode: 'proxy', node };
+    if (node.encryption) return false;
+    return !!(await this.storageFor(node.collectionId)).capabilities?.presignDownload;
   }
 
   /**
@@ -576,8 +583,9 @@ export class Vfs {
     const node = await this.resolve(id);
     if (!node.storageKey) throw TroveError.notFound('File content');
     const storage = await this.storageFor(node.collectionId);
-    // An ENCRYPTED object is never presigned to the store — the same rule `getDownload`
-    // already follows, and the one place it was missing. A bucket URL serves CIPHERTEXT,
+    // An ENCRYPTED object is never presigned to the store. This is now the ONE place that
+    // rule is written — `getDownload` held a second copy and this was the copy that was
+    // missing the guard, which is how it shipped. A bucket URL serves CIPHERTEXT,
     // and everything a minted URL exists for (an <img src>, a <video src>, cache.add(), a
     // URL handed to an external service) fetches bytes with nowhere to run decryption. So
     // every thumbnail and preview in an encrypted collection on a presigning store pointed
@@ -611,8 +619,25 @@ export class Vfs {
     return { url: `${base}/api/items/download?${q}`, expiresAt: g.expiresAt, node, signed: 'trove' };
   }
 
-  async readStream(id, { range, signal } = {}) {
-    const node = await this.resolve(id);
+  async readStream(id, opts = {}) {
+    return this.readNode(await this.resolve(id), opts);
+  }
+
+  /**
+   * Read a node the caller has ALREADY resolved.
+   *
+   * The trash guard belongs to resolution, not to reading: `resolve` refuses a trashed
+   * item so a deleted file cannot answer a download-by-id, and that is the whole of the
+   * rule. Reading is mechanical — a storage key, an envelope, a key ring.
+   *
+   * Key rotation is the caller that needs the distinction. A trashed object keeps its
+   * bytes and is still sealed with whatever key sealed it, so the rotation must move it
+   * before that key can be retired; it reaches those nodes through `listSealed`, which
+   * spans the trash on purpose. Going around this and reading storage directly would put
+   * a second copy of the envelope/range/key-ring logic in the rotation, which is the one
+   * thing this file has spent the most comments arguing against.
+   */
+  async readNode(node, { range, signal } = {}) {
     if (!node.storageKey) throw TroveError.notFound('File content');
     const storage = await this.storageFor(node.collectionId);
     if (!node.encryption) return storage.get(node.storageKey, { range, signal });

package/packages/plugin-sdk/src/browser.js

@@ -42,6 +42,116 @@
   }
   const emit = (method, params) => port.postMessage({ __trove: 'event', method, params });
 
+  /**
+   * A file's bytes, addressable without holding them.
+   *
+   * `Blob` is already the browser's interface for exactly that — `slice()` is free,
+   * `stream()` is a reader, and everything that eats bytes eats a Blob — so a range reader
+   * wears the interface that exists rather than inventing a parallel vocabulary.
+   *
+   * THE SHARP EDGE, and it is sharp: a Blob SUBCLASS only overrides what JavaScript calls.
+   * Anything reading the blob's internal bytes — `URL.createObjectURL`, `new
+   * Response(blob)`, `fetch(url, {body})`, and structured clone through `postMessage` —
+   * bypasses every override here and sees the empty blob passed to `super()`. Two
+   * consequences the design is built around:
+   *
+   *   1. A RemoteBlob cannot be posted INTO this frame from the host; it would arrive as a
+   *      plain, empty Blob. It is constructed here, in the frame that uses it.
+   *   2. `local()` is the escape hatch for all of them. A realized Blob really does hold
+   *      its bytes, so it works with `createObjectURL` — which is the download-then-play
+   *      path for anything that cannot be streamed.
+   */
+  class RemoteBlob extends Blob {
+    constructor(id, { size = 0, type = '', etag = null, start = 0, end = null } = {}) {
+      super();
+      this.id = id;
+      this.type = type;
+      this.etag = etag;
+      // A window on the source. `size` is this window's length, which is what makes
+      // `slice()` of a slice behave the way a caller expects.
+      this._start = start;
+      this._end = end == null ? size : end;
+    }
+
+    get size() { return Math.max(0, this._end - this._start); }
+
+    /**
+     * A window on the same source. No bytes move and none need to exist yet.
+     *
+     * Negative indices count from the end, as `Blob.slice` does — which is what makes
+     * "the last 64 KiB" expressible, and reading the tail of a file is half of what a
+     * container parser does.
+     */
+    slice(begin = 0, finish = this.size, type = this.type) {
+      const len = this.size;
+      const from = begin < 0 ? Math.max(0, len + begin) : Math.min(begin, len);
+      const to = finish < 0 ? Math.max(0, len + finish) : Math.min(finish, len);
+      const win = new RemoteBlob(this.id, {
+        type, etag: this.etag,
+        start: this._start + from,
+        end: this._start + Math.max(from, to),
+      });
+      return win;
+    }
+
+    /**
+     * The bytes of this window.
+     *
+     * A `signal` is checked BEFORE the call and not during it: an in-flight request over
+     * the port cannot be recalled, so the honest granularity is per read. `chunks()` is
+     * where cancelling actually bites, because there the reads are small and there are
+     * many of them.
+     */
+    async bytes({ signal } = {}) {
+      if (signal && signal.aborted) throw new Error('Aborted');
+      const r = await call('files:bytes', { id: this.id, start: this._start, end: this._end });
+      // Every read refreshes the etag, because a file overwritten in place keeps its id
+      // and anything cached off these bytes has to notice.
+      if (r.etag) this.etag = r.etag;
+      return new Uint8Array(r.bytes);
+    }
+    async arrayBuffer() { return (await this.bytes()).buffer; }
+    async text() { return new TextDecoder().decode(await this.bytes()); }
+
+    /** One window at a time, so a caller can walk a large file without holding it. */
+    async *chunks({ size = 4 * 1024 * 1024, signal } = {}) {
+      for (let at = 0; at < this.size; at += size) {
+        yield this.slice(at, Math.min(at + size, this.size)).bytes({ signal });
+      }
+    }
+
+    stream() {
+      const iter = this.chunks();
+      return new ReadableStream({
+        async pull(controller) {
+          const { value, done } = await iter.next();
+          if (done) controller.close();
+          else controller.enqueue(value);
+        },
+      });
+    }
+
+    /**
+     * REALIZE the bytes into an ordinary Blob.
+     *
+     * The escape hatch named above, and the download half of "this book cannot be
+     * streamed, here is a Download button". `onProgress` fires once with `loaded: 0`
+     * BEFORE the first chunk, so a bar appears at 0% instead of jumping in partway.
+     */
+    async local({ onProgress, signal, chunkSize = 4 * 1024 * 1024 } = {}) {
+      const total = this.size;
+      const parts = [];
+      let loaded = 0;
+      if (onProgress) onProgress({ loaded: 0, total, ratio: 0 });
+      for await (const chunk of this.chunks({ size: chunkSize, signal })) {
+        parts.push(chunk);
+        loaded += chunk.length;
+        if (onProgress) onProgress({ loaded, total, ratio: total ? loaded / total : 0 });
+      }
+      return new Blob(parts, { type: this.type });
+    }
+  }
+
   // What this frame reports about itself on every heartbeat. Contributions are the
   // host's own manifest reading — all the plugin can usefully say is which of its
   // declared contributions it actually bound a handler to, plus whether it thinks
@@ -259,9 +369,54 @@
         list: (pathOrId, opts) => (requireCap('files'), call('files:list', Object.assign({ pathOrId }, opts))),
         stat: (id) => (requireCap('files'), call('files:stat', { id })),
         downloadUrl: (id) => (requireCap('files'), call('files:downloadUrl', { id })),
+
+        /**
+         * A file's bytes as a Blob you can slice, stream and realize — see RemoteBlob.
+         *
+         * `stat` first, because a Blob has to know its own size before `slice` means
+         * anything. One round trip, and every later read is a range.
+         */
+        async blob(id) {
+          requireCap('files');
+          const { node } = await call('files:stat', { id });
+          return new RemoteBlob(id, { size: node.size || 0, type: node.contentType || '', etag: node.etag || null });
+        },
+
+        /**
+         * A URL a media element can load by itself, for streaming.
+         *
+         * It is MINTED — it carries its own grant and expires — which is the one place a
+         * host URL deliberately reaches a plugin. `<audio src>` is the only way to play a
+         * progressive MP4 without a fragmenter: MSE refuses one, and a Blob has to be
+         * whole before it can become an object URL. Use `blob(id)` for the parsing (a
+         * container's chapters are a few kilobytes out of a few hundred megabytes) and
+         * this for the playing.
+         */
+        mediaUrl: (id, opts) => (requireCap('files'), call('files:mediaUrl', Object.assign({ id }, opts))),
+
+        /**
+         * Keeping a file, which is a DIFFERENT act from reading one.
+         *
+         * Ranging over a file stores nothing. `start(id)` is someone asking to have it
+         * offline, and from then on every chunk a read fetches is kept and the background
+         * filler skips it — so a book listened straight through downloads itself exactly
+         * once, and a book skipped around in fills its gaps.
+         */
+        offline: {
+          start: (id) => (requireCap('files'), call('files:offline:start', { id })),
+          status: (id) => (requireCap('files'), call('files:offline:status', { id })),
+          cancel: (id) => (requireCap('files'), call('files:offline:cancel', { id })),
+          remove: (id) => (requireCap('files'), call('files:offline:remove', { id })),
+        },
         // index(indexerId, nodeId, contribution) where contribution is
         // { semanticTexts?, tags?, metadata? }. Legacy (indexerId, nodeId, documents[], facet)
         // is still accepted when the 3rd arg is an array of documents.
+        //
+        // "Contribution" here is per-node ENRICHMENT — what an indexer says ABOUT a file,
+        // addressed by contributorId. It is a different noun from the `contributes` map in
+        // your manifest, which declares extension points addressed by URI. A plugin
+        // declares an `indexer` contribution (that sense) and it produces contributions
+        // (this sense).
         index: (indexerId, nodeId, contribution, facet) => {
           requireCap('indexer');
           var payload = Array.isArray(contribution) ? { documents: contribution, facet: facet } : (contribution || {});

package/packages/plugin-sdk/src/protocol.js

@@ -41,7 +41,19 @@ export const METHODS = {
   // its `commands` allowlist) to run someone else's. The direction disambiguates.
   command: { execute: 'command:execute' },
   resources: { list: 'resources:list', read: 'resources:read' },
-  files: { read: 'files:read', list: 'files:list', stat: 'files:stat', downloadUrl: 'files:downloadUrl', index: 'files:index' },
+  files: {
+    read: 'files:read', list: 'files:list', stat: 'files:stat', downloadUrl: 'files:downloadUrl',
+    index: 'files:index',
+    // Bytes by range — the only way a viewer gets binary content at all, since `read`
+    // answers text and a sandboxed frame cannot authenticate a bare download URL.
+    bytes: 'files:bytes',
+    // A minted URL for a media element. See pluginRpc.js for why this one host URL crosses.
+    mediaUrl: 'files:mediaUrl',
+    offline: {
+      start: 'files:offline:start', status: 'files:offline:status',
+      cancel: 'files:offline:cancel', remove: 'files:offline:remove',
+    },
+  },
   net: { fetch: 'net:fetch' },
   storage: { sql: 'storage:sql' },
   settings: { get: 'settings:get', set: 'settings:set', getSecret: 'settings:getSecret' },

package/packages/server/src/adapters/bun.js

@@ -9,7 +9,7 @@
 //   bun packages/server/src/adapters/bun.js
 
 import { readFileSync } from 'node:fs';
-import { createServer, configFromEnv, warnOnOpenAccess } from '../index.js';
+import { createServer, configFromEnv } from '../index.js';
 // This runtime HAS a filesystem, so it registers the filesystem driver. Imported from
 // storage/filesystem.js rather than the package barrel: that import is what pulls in
 // node:fs, and the Workers adapter deliberately never makes it — so there, Filesystem is
@@ -49,7 +49,6 @@ const staticAssets = WEB_DIST && createStaticAssets({
 
 const hasWeb = !!WEB_DIST;
 const envConfig = configFromEnv();
-warnOnOpenAccess(envConfig);
 const { handle, close } = await createServer({
   ...envConfig,
   storageDrivers: [filesystemDriver()],

package/packages/server/src/adapters/node.js

@@ -11,7 +11,7 @@ import http from 'node:http';
 import fs, { readFileSync } from 'node:fs';
 import fsp from 'node:fs/promises';
 import { Readable } from 'node:stream';
-import { createServer, configFromEnv, warnOnOpenAccess } from '../index.js';
+import { createServer, configFromEnv } from '../index.js';
 // This runtime HAS a filesystem, so it registers the filesystem driver. Imported from
 // storage/filesystem.js rather than the package barrel: that import is what pulls in
 // node:fs, and the Workers adapter deliberately never makes it — so there, Filesystem is
@@ -84,7 +84,6 @@ async function writeWebResponse(res, webRes) {
 
 const hasWeb = !!WEB_DIST;
 const envConfig = configFromEnv();
-warnOnOpenAccess(envConfig);
 const { handle, close } = await createServer({
   ...envConfig,
   storageDrivers: [filesystemDriver()],

package/packages/server/src/engine/index.js

@@ -49,7 +49,7 @@ export function createDriveEngine(config = {}, lifecycleState = { closing: false
 export const BACKBONE = [
   'storage', 'sqlite', 'metadata', 'kv', 'tasks', 'issues', 'notifications',
   'sidecar', 'collections', 'identity', 'auth', 'search', 'vfs', 'plugins',
-  'apiKeys', 'capabilities', 'rotation', 'lifecycle',
+  'apiKeys', 'capabilities', 'rotation', 'lifecycle', 'storageCheck', 'rateLimiter',
 ];
 
 /** The shape `beginScan` has always returned, so no caller has to change. */

package/packages/server/src/engine/providers/access.js

@@ -23,15 +23,6 @@
 import { Provider } from '@3sln/ngin';
 import { TroveError } from '@3sln/trove/core';
 
-/**
- * The one place that decides whether this deployment enforces ACLs at all.
- *
- * From configuration, never from whether a service is present — those agree when
- * everything is wired correctly and diverge exactly when it is not, and the
- * second stops enforcing at the worst possible moment.
- */
-const enforcing = (config) => config?.collections !== false;
-
 /** Conversations are optional; a drive without them says so rather than crashing. */
 function requireSidecar(sidecar) {
   if (!sidecar) throw TroveError.unsupported('Conversations are not enabled on this server');
@@ -120,7 +111,10 @@ function nodeHandle(vfs, sidecar, node, held) {
   // much its content as its bytes are.
   if (permits('read')) {
     handle.read = (opts) => vfs.readStream(node.id, opts);
-    handle.download = (opts) => vfs.getDownload(node.id, opts);
+    // Two calls, deliberately: "may we redirect" and "mint the URL". `mintUrl` is where
+    // the expiry clamp and the encrypted-never-presigns rule live, so a download URL and
+    // an <img src> URL are produced by the same code rather than by two that agreed once.
+    handle.canRedirect = () => vfs.canRedirect(node.id);
     // Minting a URL that carries its own grant is an exercise of `read` — you are
     // delegating the read you hold, to something that cannot present credentials. So it
     // hangs off the read handle like everything else, and a caller without `read`
@@ -206,14 +200,13 @@ function collectionHandle(vfs, collectionId, held) {
  * never runs — when the node is missing or the capability is not held.
  */
 export class NodeAccessProvider extends Provider {
-  static deps = ['vfs', 'sidecar', 'collections', 'config', 'signedUrls'];
+  static deps = ['vfs', 'sidecar', 'collections', 'signedUrls'];
 
-  constructor({ vfs, sidecar, collections, config, signedUrls }) {
+  constructor({ vfs, sidecar, collections, signedUrls }) {
     super();
     this.vfs = vfs;
     this.sidecar = sidecar;
     this.collections = collections;
-    this.config = config;
     this.signedUrls = signedUrls;
   }
 
@@ -256,9 +249,6 @@ export class NodeAccessProvider extends Provider {
       return nodeHandle(vfs, sidecar, node, new Set(['read']));
     }
 
-    const config = await this.config.obtain();
-    if (!enforcing(config)) return nodeHandle(vfs, sidecar, node, requested(capability));
-
     // A key IS the grant, scoped to the node's own collection. Checked before the ACL
     // and never alongside it: a request bearing a key is the key's request, and falling
     // back to whatever principal happens to be attached would let a weak key borrow a
@@ -290,20 +280,17 @@ export class NodeAccessProvider extends Provider {
  * usage, starting an upload.
  */
 export class CollectionAccessProvider extends Provider {
-  static deps = ['vfs', 'collections', 'config'];
+  static deps = ['vfs', 'collections'];
 
-  constructor({ vfs, collections, config }) {
+  constructor({ vfs, collections }) {
     super();
     this.vfs = vfs;
     this.collections = collections;
-    this.config = config;
   }
 
   async obtain({ principal, grant = null, id = 'default', capability = 'read' } = {}) {
     assertCapability(capability);
     const vfs = await this.vfs.obtain();
-    const config = await this.config.obtain();
-    if (!enforcing(config)) return collectionHandle(vfs, id, requested(capability));
 
     // Same rule as the node path: a key's grant decides, alone, and refuses rather than
     // narrowing. This is the check that keeps a key scoped to `photos` out of `invoices`.
@@ -333,13 +320,12 @@ export class CollectionAccessProvider extends Provider {
  * grant was thrown away in every one. Here the session IS the handle.
  */
 export class UploadAccessProvider extends Provider {
-  static deps = ['vfs', 'collections', 'config'];
+  static deps = ['vfs', 'collections'];
 
-  constructor({ vfs, collections, config }) {
+  constructor({ vfs, collections }) {
     super();
     this.vfs = vfs;
     this.collections = collections;
-    this.config = config;
   }
 
   async obtain({ principal, grant = null, id } = {}) {
@@ -348,16 +334,13 @@ export class UploadAccessProvider extends Provider {
     // Resolving first is what makes the check possible at all: only the session knows
     // which collection the bytes are destined for.
     const session = await vfs.uploadStatus(id);
-    const config = await this.config.obtain();
-    if (enforcing(config)) {
-      // Re-checked on EVERY request of the upload, keys included — the point of this
-      // provider. A key revoked between `POST /api/uploads` and `complete` stops the
-      // upload, which it would not if the grant were only checked when it began.
-      if (grant) grantedCapabilities(grant, session.collectionId, 'write');
-      else {
-        const collections = await this.collections.obtain();
-        await collections.assert(principal, session.collectionId, 'write');
-      }
+    // Re-checked on EVERY request of the upload, keys included — the point of this
+    // provider. A key revoked between `POST /api/uploads` and `complete` stops the
+    // upload, which it would not if the grant were only checked when it began.
+    if (grant) grantedCapabilities(grant, session.collectionId, 'write');
+    else {
+      const collections = await this.collections.obtain();
+      await collections.assert(principal, session.collectionId, 'write');
     }
     return {
       id,

package/packages/server/src/engine/providers/core.js

@@ -21,7 +21,7 @@
 // means the same thing it always did.
 
 import {
-  StorageBackend, MemoryStorage, S3Storage,
+  StorageBackend, MemoryStorage,
   StorageDriverRegistry, portableDrivers,
   MetadataStore, MemoryStore, SqliteStore,
   SearchService, EmbeddingProvider, LocalHashEmbedding, HttpEmbedding,
@@ -44,6 +44,8 @@ import {
   Vfs, TroveError,
   resolveAuthDiscovery,
   SignedUrls, resolveUrlSecret,
+  diagnoseStorage, STORAGE_ISSUE_CODES,
+  RateLimiter, MemoryRateStore, KvRateStore, DEFAULT_RATE_LIMITS,
 } from '@3sln/trove/core';
 import { Provider } from '@3sln/ngin';
 import { need } from '../lazy.js';
@@ -171,6 +173,33 @@ export function coreProviders(config, lifecycleState) {
     // reads it has to say so.
     config: Provider.fromSingleton(config),
 
+    /**
+     * What one caller may cost, per class of work.
+     *
+     * A provider so the route table can lease it like anything else, and so the store is a
+     * decision made once from configuration rather than at each call site. Null when
+     * limiting is switched off, which is the one case a caller has to handle — and it does
+     * so by not asking, since `Router.handle` only enforces for routes that named a class.
+     */
+    rateLimiter: Provider.fromLazySingleton(
+      async (deps) => {
+        // ON unless switched off, including for a library caller who built a config by
+        // hand rather than through `configFromEnv`. A limit that only exists when somebody
+        // remembers to ask for it is not a limit.
+        const rl = config.rateLimit ?? { enabled: true, store: 'memory', limits: DEFAULT_RATE_LIMITS };
+        if (!rl.enabled) return null;
+        // KV counters are shared across instances and cost a read and a write per limited
+        // request; memory counters are free and exact on ONE long-lived process. See
+        // rateLimit.js — the choice is a property of the deployment, not of the code.
+        const store = rl.store === 'kv'
+          ? new KvRateStore({ kv: (await need(deps, ['kv'])).kv })
+          : new MemoryRateStore();
+        return new RateLimiter({ store, limits: rl.limits || DEFAULT_RATE_LIMITS });
+      },
+      null,
+      { deps: ['kv'] },
+    ),
+
     // Shutdown, likewise. Long work has to be able to ask whether the server is
     // going down, and closing over a `let` made that invisible.
     lifecycle: Provider.fromSingleton({
@@ -198,12 +227,83 @@ export function coreProviders(config, lifecycleState) {
       beginReindex: (opts) => lifecycleState.background.beginReindex(opts),
     }),
 
-    // The storage self-check, late-bound for the same reason: it needs `collections` and
-    // `issues` from this container, so it is assembled in createServer and reached back
-    // into rather than built here.
-    storageCheck: Provider.fromSingleton({
-      run: (opts) => lifecycleState.storageCheck(opts),
-    }),
+    /**
+     * The storage self-check.
+     *
+     * The failure this exists for: a bucket with no CORS policy serves the SERVER fine and
+     * serves the browser nothing, so the drive looks healthy and every file opens to a
+     * spinner. See core/storage/diagnose.js for why the check has to be a real preflight.
+     *
+     * `origin` is the browser origin to check the policy against, and there is no guessing
+     * it: a policy may legitimately name one origin, so checking the wrong one would invent
+     * a problem. A request supplies its own; a cron firing has only `config.publicUrl`, and
+     * without either the CORS half is skipped rather than assumed.
+     *
+     * A PROVIDER, not a seam stamped onto `lifecycleState` after construction. The stated
+     * reason for that shape was "it needs `collections` and `issues` from this container",
+     * which is exactly what `fromLazySingleton` with deps is for — and unlike
+     * `backgroundWork`, whose comment names a real circularity (dispatching needs the
+     * engine that owns the container), there is none here.
+     */
+    storageCheck: Provider.fromLazySingleton(
+      async (deps) => {
+        const { collections, issues, config: cfg } = await need(deps, ['collections', 'issues', 'config']);
+        const KIND = 'storage';
+        return {
+          async run({ origin = null } = {}) {
+            // `all()`, not `list(null)`: this has no user, and asking what the anonymous
+            // principal may read means checking nothing at all on a drive that is not public.
+            const list = await collections.all().catch(() => []);
+            const results = [];
+            for (const c of list) {
+              let findings;
+              try {
+                const storage = await collections.storageFor(c.id);
+                findings = await diagnoseStorage({
+                  storage, origin, driver: c.store?.driver || null, fetchImpl: cfg.fetch,
+                });
+              } catch (err) {
+                // Failing to BUILD the store is itself the most severe version of
+                // unreachable — an unknown driver, or a config missing a required field,
+                // never gets far enough to be asked whether it can be read.
+                findings = [{
+                  code: 'storage-unreachable',
+                  severity: 'error',
+                  title: 'This collection\u2019s store could not be opened',
+                  detail: err?.message || String(err),
+                }];
+              }
+              const found = new Set(findings.map((f) => f.code));
+              for (const f of findings) {
+                await issues.raise({
+                  kind: KIND,
+                  subject: `${c.id}:${f.code}`,
+                  title: `${c.name || c.id}: ${f.title}`,
+                  detail: f.detail,
+                  remedy: f.remedy || null,
+                  severity: f.severity,
+                  collectionId: c.id,
+                  // Re-running the check IS the fix verification, so Retry rechecks against
+                  // the same origin the finding was made for. Checking a different one
+                  // would report a pass for a policy the affected browser still cannot use.
+                  retry: { op: 'storage-check', origin },
+                });
+              }
+              // Whatever is no longer true stops being listed. Without this, fixing the
+              // bucket leaves the warning up, and a problem list that outlives its problems
+              // is one people learn to scroll past.
+              for (const code of STORAGE_ISSUE_CODES) {
+                if (!found.has(code)) await issues.clear(KIND, `${c.id}:${code}`);
+              }
+              results.push({ collectionId: c.id, name: c.name || c.id, findings });
+            }
+            return { checked: results.length, corsChecked: !!origin, results };
+          },
+        };
+      },
+      null,
+      { deps: ['collections', 'issues', 'config'] },
+    ),
 
     storage: Provider.fromLazySingleton(
       () => resolve(config.storage ?? config.vfs?.storage, StorageBackend, (cfg) => buildStorage(cfg, config)),
@@ -525,13 +625,11 @@ export function coreProviders(config, lifecycleState) {
           indexers: r.indexerRuntime
             ? new PluginIndexers({ vfs: r.vfs, runtime: r.indexerRuntime, packages: r.packageStore })
             : null,
-          // Who may install a plugin. With no ACL layer configured there is no admin
-          // list to consult and any authenticated caller qualifies — decided from
-          // config, not from whether `collections` happens to be here, so a graph that
-          // failed to build cannot silently promote everyone.
-          isAdmin: (principal) => (config.collections === false
-            ? !!principal
-            : r.collections.isAdmin(principal)),
+          // Who may install a plugin. There is no "any authenticated caller qualifies"
+          // fallback: the arm that provided one required `collections: false`, which this
+          // provider refuses above and `configFromEnv` refuses again, so it could only ever
+          // have fired for a direct-container caller — where it handed out an open drive.
+          isAdmin: (principal) => r.collections.isAdmin(principal),
           maxPackageBytes: config.maxUploadBytes ?? undefined,
           strict: config.enforcePluginCaps === true,
         });