@3sln/trove 0.0.3 → 0.0.5

package/packages/core/src/storage/drivers.js

@@ -0,0 +1,74 @@
+// The drivers this package ships, as registrable descriptors.
+//
+// Split by what a runtime can actually run, and that split is the point:
+//
+//   `portableDrivers()` — memory and S3. Both are fetch-and-arithmetic, so they work
+//   identically on Node, Bun, Deno and Cloudflare Workers.
+//
+//   `filesystemDriver()` — lives in filesystem.js and is imported from there, NOT from
+//   this module or the package barrel. That import is what pulls in node:fs, so a Workers
+//   entry point that never mentions it never gets it: the driver is absent from the form
+//   AND absent from the bundle. Re-exporting it here would defeat both.
+//
+// A deployment's driver set is therefore decided by its entry point, which is the only
+// place that knows what it is running on.
+
+import { MemoryStorage } from './memory.js';
+import { S3Storage } from './s3.js';
+
+/** Anything with a `fetch` can run these. */
+export function portableDrivers() {
+  return [
+    {
+      key: 's3',
+      label: 'S3-compatible',
+      description: 'AWS S3, Cloudflare R2, MinIO, Backblaze B2 — anything speaking the S3 API.',
+      fields: [
+        { name: 'bucket', label: 'Bucket', required: true, placeholder: 'my-bucket' },
+        {
+          name: 'region',
+          label: 'Region',
+          placeholder: 'auto',
+          help: 'R2 uses "auto". AWS wants the bucket’s real region.',
+        },
+        {
+          name: 'endpoint',
+          label: 'Endpoint',
+          placeholder: 'https://<account>.r2.cloudflarestorage.com',
+          help: 'Leave blank for AWS S3.',
+        },
+        { name: 'prefix', label: 'Prefix', help: 'Share one bucket between collections.' },
+        // Marked secret so they are never read back out of a collection record: the
+        // record lives in the KV store and is otherwise safe to show an admin.
+        { name: 'accessKeyId', label: 'Access key id', required: true, secret: true },
+        { name: 'secretAccessKey', label: 'Secret access key', type: 'password', required: true, secret: true },
+        {
+          name: 'forcePathStyle',
+          label: 'Path-style addressing',
+          type: 'boolean',
+          help: 'MinIO and most self-hosted endpoints need this.',
+        },
+      ],
+      // S3Storage takes the config flat; the old switch passed `cfg.s3`, which meant a
+      // collection record had to nest its own settings one level deeper than every
+      // other driver for no reason a user could see.
+      create: (cfg) => new S3Storage({
+        bucket: cfg.bucket,
+        region: cfg.region || 'auto',
+        endpoint: cfg.endpoint || undefined,
+        accessKeyId: cfg.accessKeyId,
+        secretAccessKey: cfg.secretAccessKey,
+        sessionToken: cfg.sessionToken,
+        forcePathStyle: cfg.forcePathStyle === true || cfg.forcePathStyle === 'true',
+        ...(cfg.s3 || {}),
+      }),
+    },
+    {
+      key: 'memory',
+      label: 'Memory',
+      description: 'Nothing is kept. For demos and tests — a restart empties it.',
+      fields: [],
+      create: () => new MemoryStorage(),
+    },
+  ];
+}

package/packages/core/src/storage/filesystem.js

@@ -281,3 +281,25 @@ export class FilesystemStorage extends StorageBackend {
 function etagOfStat(stat) {
   return `"${stat.size.toString(16)}-${Math.floor(stat.mtimeMs).toString(16)}"`;
 }
+
+/**
+ * This driver as a registrable descriptor.
+ *
+ * Deliberately exported from HERE and not from the package barrel or drivers.js. Importing
+ * it is what pulls node:fs into a bundle, so a Workers entry point that never mentions it
+ * gets neither the form option nor the module — which is also why `core/index.js` no
+ * longer re-exports FilesystemStorage. A Workers build previously needed nodejs_compat
+ * purely because the barrel dragged this file in whether or not it could ever be used.
+ */
+export function filesystemDriver() {
+  return {
+    key: 'filesystem',
+    label: 'Filesystem / NAS',
+    description: 'A directory on this machine, or a mounted network share.',
+    fields: [
+      { name: 'root', label: 'Root directory', required: true, placeholder: './data/team' },
+      { name: 'prefix', label: 'Prefix', help: 'Share one directory between collections.' },
+    ],
+    create: (cfg) => new FilesystemStorage({ root: cfg.root }),
+  };
+}

package/packages/core/src/storage/registry.js

@@ -0,0 +1,129 @@
+// Which kinds of backing store this deployment can have.
+//
+// A collection IS a store config — `{ driver: 's3', bucket: … }` — and something has to
+// turn that into a StorageBackend. That something used to be a three-case `switch` in the
+// server, which had two problems beyond being closed:
+//
+//   Its `default:` arm returned MemoryStorage. So `driver: 'flesystem'` — a typo — built a
+//   store that accepted writes and lost them on restart. A misconfiguration that looks
+//   like it worked is worse than one that refuses to start.
+//
+//   The UI could not know what the server supported, so it hardcoded its own list and
+//   offered Filesystem / NAS on Cloudflare Workers, where there is no filesystem to
+//   point at. A form offering a choice the runtime cannot honour is a form that produces
+//   a broken collection.
+//
+// A registry fixes both by making the set of drivers DATA. Each one declares a globally
+// unique key, a label, and the fields it needs — so the server answers "what can I be
+// configured with" and the client renders that answer instead of guessing. Availability
+// is not a flag on a driver, it is whether the driver was registered at all: an entry
+// point registers what its runtime can actually run, so Filesystem is absent on Workers
+// rather than present-and-refused, and the module is not in the bundle either.
+//
+// The config lives in the collection record; the implementation does not. A driver can be
+// written and registered entirely outside this package.
+
+import { TroveError } from '../errors.js';
+import { StorageBackend } from './interface.js';
+
+/**
+ * One field a driver needs in order to be configured.
+ *
+ * This is what the UI renders and what a deploy script validates against, so it says how
+ * to ASK rather than how to store: `secret` is the interesting one, because a store config
+ * lives in the KV store and a field marked secret should never be echoed back to a client
+ * once written.
+ *
+ * @typedef {object} DriverField
+ * @property {string} name       key in the store config
+ * @property {string} label      what to call it in a form
+ * @property {'text'|'password'|'number'|'boolean'} [type]
+ * @property {boolean} [required]
+ * @property {boolean} [secret]  never returned once stored
+ * @property {string} [placeholder]
+ * @property {string} [help]     one line under the field
+ */
+
+export class StorageDriverRegistry {
+  constructor(drivers = []) {
+    this._drivers = new Map();
+    for (const d of drivers) this.register(d);
+  }
+
+  /**
+   * @param {object} driver
+   * @param {string} driver.key           globally unique, and what goes in `store.driver`
+   * @param {string} driver.label         for a form
+   * @param {string} [driver.description] one line about what it is
+   * @param {DriverField[]} [driver.fields]
+   * @param {(config: object) => StorageBackend} driver.create
+   */
+  register(driver) {
+    const key = String(driver?.key ?? '').trim();
+    if (!key) throw TroveError.invalid('A storage driver needs a key');
+    if (typeof driver.create !== 'function') {
+      throw TroveError.invalid(`Storage driver "${key}" needs a create(config) function`);
+    }
+    // Refused rather than overwritten. Two drivers claiming one key means one of them is
+    // silently not the one being used, and which one depends on registration order.
+    if (this._drivers.has(key)) {
+      throw TroveError.invalid(`A storage driver is already registered as "${key}"`);
+    }
+    this._drivers.set(key, {
+      key,
+      label: driver.label || key,
+      description: driver.description || '',
+      fields: (driver.fields || []).map((f) => ({
+        name: f.name,
+        label: f.label || f.name,
+        type: f.type || 'text',
+        required: !!f.required,
+        secret: !!f.secret,
+        placeholder: f.placeholder || '',
+        help: f.help || '',
+      })),
+      create: driver.create,
+    });
+    return this;
+  }
+
+  has(key) {
+    return this._drivers.has(key);
+  }
+
+  keys() {
+    return [...this._drivers.keys()];
+  }
+
+  /** What a client needs to render a form. No `create`, because that is not data. */
+  describe() {
+    return [...this._drivers.values()].map(({ create, ...rest }) => rest);
+  }
+
+  /**
+   * Build the backend a store config names.
+   *
+   * An unknown driver throws, and says what IS available. This is the arm that used to
+   * return an in-memory store.
+   */
+  build(config) {
+    const key = config?.driver;
+    if (!key) throw TroveError.invalid('A store config needs a driver');
+    const driver = this._drivers.get(key);
+    if (!driver) {
+      throw TroveError.invalid(
+        `Unknown storage driver "${key}" — this deployment has: ${this.keys().join(', ') || 'none'}`,
+      );
+    }
+    for (const f of driver.fields) {
+      if (f.required && (config[f.name] == null || config[f.name] === '')) {
+        throw TroveError.invalid(`Storage driver "${key}" requires "${f.name}"`);
+      }
+    }
+    const backend = driver.create(config);
+    if (!(backend instanceof StorageBackend)) {
+      throw TroveError.invalid(`Storage driver "${key}" did not return a StorageBackend`);
+    }
+    return backend;
+  }
+}

package/packages/server/src/adapters/bun.js

@@ -10,6 +10,11 @@
 
 import { readFileSync } from 'node:fs';
 import { createServer, configFromEnv, warnOnOpenAccess } from '../index.js';
+// This runtime HAS a filesystem, so it registers the filesystem driver. Imported from
+// storage/filesystem.js rather than the package barrel: that import is what pulls in
+// node:fs, and the Workers adapter deliberately never makes it — so there, Filesystem is
+// absent from the collection form and absent from the bundle.
+import { filesystemDriver } from '@3sln/trove/core/storage/filesystem.js';
 import { findWebDist } from './webDist.js';
 import { createStaticAssets } from './staticAssets.js';
 
@@ -47,6 +52,7 @@ const envConfig = configFromEnv();
 warnOnOpenAccess(envConfig);
 const { handle, close } = await createServer({
   ...envConfig,
+  storageDrivers: [filesystemDriver()],
   assets: hasWeb ? staticAssets : undefined,
 });
 

package/packages/server/src/adapters/node.js

@@ -12,6 +12,11 @@ import fs, { readFileSync } from 'node:fs';
 import fsp from 'node:fs/promises';
 import { Readable } from 'node:stream';
 import { createServer, configFromEnv, warnOnOpenAccess } from '../index.js';
+// This runtime HAS a filesystem, so it registers the filesystem driver. Imported from
+// storage/filesystem.js rather than the package barrel: that import is what pulls in
+// node:fs, and the Workers adapter deliberately never makes it — so there, Filesystem is
+// absent from the collection form and absent from the bundle.
+import { filesystemDriver } from '@3sln/trove/core/storage/filesystem.js';
 import { findWebDist } from './webDist.js';
 import { createStaticAssets } from './staticAssets.js';
 
@@ -82,6 +87,7 @@ const envConfig = configFromEnv();
 warnOnOpenAccess(envConfig);
 const { handle, close } = await createServer({
   ...envConfig,
+  storageDrivers: [filesystemDriver()],
   assets: hasWeb ? staticAssets : undefined,
 });
 

package/packages/server/src/adapters/worker-tasks.js

@@ -149,12 +149,14 @@ export function createTaskHost(getServer) {
  * gets the truth without knowing where it lives.
  */
 export class RemoteTasks extends TaskRegistry {
+  /** @param {() => object} stub resolves the Durable Object stub — see remoteBackground
+   *  for why this is a function and not the stub itself. */
   constructor(stub) {
     super();
     this.stub = stub;
   }
   async #rpc(path, payload) {
-    const res = await this.stub.fetch(`https://trove.tasks${path}`, {
+    const res = await this.stub().fetch(`https://trove.tasks${path}`, {
       method: 'POST',
       headers: { 'content-type': 'application/json' },
       body: JSON.stringify(payload || {}),
@@ -181,8 +183,16 @@ export function remoteBackground(namespace) {
   // One instance for the whole drive, by name. Tasks are few and long, so there is no
   // throughput argument for sharding — and one instance is what makes GET /api/tasks a
   // complete answer rather than a per-shard sample.
-  const stub = namespace.get(namespace.idFromName('trove-tasks'));
-  const begin = (payload) => stub
+  //
+  // Resolved per call, never held. A stub belongs to the I/O context of the request that
+  // created it, and the server that owns this one is cached at module scope for the life
+  // of the isolate — so the stub outlived its request and every later use threw. The
+  // first request worked and the second did not, which reads like a fluke and is not:
+  // GET /api/tasks was broken for the entire life of every isolate after its first
+  // request. `idFromName` is a pure hash, so re-deriving it costs nothing and always
+  // names the same object.
+  const stub = () => namespace.get(namespace.idFromName('trove-tasks'));
+  const begin = (payload) => stub()
     .fetch('https://trove.tasks/begin', {
       method: 'POST',
       headers: { 'content-type': 'application/json' },
@@ -195,7 +205,7 @@ export function remoteBackground(namespace) {
       beginScan: (collectionId, { reason } = {}) => begin({ kind: 'scan', collectionId, reason }),
       beginReindex: ({ reason } = {}) => begin({ kind: 'index', reason }),
     },
-    maintain: (budgetMs) => stub
+    maintain: (budgetMs) => stub()
       .fetch('https://trove.tasks/maintain', {
         method: 'POST',
         headers: { 'content-type': 'application/json' },

package/packages/server/src/adapters/worker.js

@@ -53,7 +53,13 @@ async function getServer(env, buildVfs, { delegate = true } = {}) {
     config.metadata = { driver: 'sqlite' };
   }
   // Cloudflare Vectorize binding → first-class vector store (no REST creds needed).
-  if (env.VECTORIZE) {
+  //
+  // An explicit TROVE_VECTOR wins. The binding used to be taken unconditionally, which
+  // left no way to opt out: `wrangler dev` against a real Vectorize index is the only
+  // shape a local run could have, and setting TROVE_VECTOR=memory in .dev.vars did
+  // nothing. Naming a store and being given a different one is the kind of override that
+  // should never be silent.
+  if (env.VECTORIZE && (!env.TROVE_VECTOR || env.TROVE_VECTOR === 'vectorize')) {
     config.vectorStore = { driver: 'vectorize', binding: env.VECTORIZE };
   }
   // Cloudflare Workers AI binding → LLM-assisted search transformer (human text →

package/packages/server/src/engine/index.js

@@ -49,7 +49,7 @@ export function createDriveEngine(config = {}, lifecycleState = { closing: false
 export const BACKBONE = [
   'storage', 'sqlite', 'metadata', 'kv', 'tasks', 'issues', 'notifications',
   'sidecar', 'collections', 'identity', 'auth', 'search', 'vfs', 'plugins',
-  'lifecycle',
+  'apiKeys', 'capabilities', 'lifecycle',
 ];
 
 /** The shape `beginScan` has always returned, so no caller has to change. */

package/packages/server/src/engine/providers/access.js

@@ -76,6 +76,27 @@ const intersect = (held, asked) => new Set([...asked].filter((c) => held.has(c))
  * @param {object} node   already resolved by `stat`
  * @param {string|symbol} granted the capability that was asserted
  */
+/**
+ * Authorize from an API key grant rather than from a principal.
+ *
+ * The same shape as the signature path below it, and for the same reason: a grant is
+ * authority that arrived with the request, so there is nobody to look up in an ACL.
+ *
+ * REFUSED, not narrowed. If the route asked for `write` and the key holds `read`, this
+ * throws — because handing back a read handle to a route that asked for write means the
+ * route believes it has write and acts accordingly. The signature path learned this the
+ * hard way (see its comment); the rule is the same here.
+ */
+function grantedCapabilities(grant, collectionId, capability) {
+  const held = grant.capabilitiesFor(collectionId);
+  if (!held.has(capability)) {
+    throw TroveError.forbidden(
+      `This API key does not hold "${capability}" on this collection`,
+    );
+  }
+  return intersect(held, requested(capability));
+}
+
 function nodeHandle(vfs, sidecar, node, held) {
   const permits = (capability) => held.has(capability);
   const granted = held === ALL ? 'system' : [...held].sort().join(',');
@@ -204,7 +225,7 @@ export class NodeAccessProvider extends Provider {
   // cannot see — restoring and permanently deleting are the only operations on items
   // that are no longer part of the drive. It widens WHAT IS VISIBLE, never what is
   // permitted: the capability is asserted exactly the same way afterwards.
-  async obtain({ principal, id, collectionId, trashed = false, capability = 'read', signature = null } = {}) {
+  async obtain({ principal, grant = null, id, collectionId, trashed = false, capability = 'read', signature = null } = {}) {
     if (!id) throw TroveError.invalid('A node id is required');
     assertCapability(capability);
     const vfs = await this.vfs.obtain();
@@ -238,6 +259,15 @@ export class NodeAccessProvider extends Provider {
     const config = await this.config.obtain();
     if (!enforcing(config)) return nodeHandle(vfs, sidecar, node, requested(capability));
 
+    // A key IS the grant, scoped to the node's own collection. Checked before the ACL
+    // and never alongside it: a request bearing a key is the key's request, and falling
+    // back to whatever principal happens to be attached would let a weak key borrow a
+    // strong session — the confused deputy, arrived at by being helpful.
+    if (grant) {
+      return nodeHandle(vfs, sidecar, node,
+        grantedCapabilities(grant, node.collectionId, capability));
+    }
+
     // `assert` throws when the capability is not held. Nothing here decides from
     // presence: if the service is missing this raises, it does not allow.
     const collections = await this.collections.obtain();
@@ -269,12 +299,18 @@ export class CollectionAccessProvider extends Provider {
     this.config = config;
   }
 
-  async obtain({ principal, id = 'default', capability = 'read' } = {}) {
+  async obtain({ principal, grant = null, id = 'default', capability = 'read' } = {}) {
     assertCapability(capability);
     const vfs = await this.vfs.obtain();
     const config = await this.config.obtain();
     if (!enforcing(config)) return collectionHandle(vfs, id, requested(capability));
 
+    // Same rule as the node path: a key's grant decides, alone, and refuses rather than
+    // narrowing. This is the check that keeps a key scoped to `photos` out of `invoices`.
+    if (grant) {
+      return collectionHandle(vfs, id, grantedCapabilities(grant, id, capability));
+    }
+
     const collections = await this.collections.obtain();
     const collection = await collections.assert(principal, id, capability);
     return collectionHandle(vfs, id,
@@ -306,7 +342,7 @@ export class UploadAccessProvider extends Provider {
     this.config = config;
   }
 
-  async obtain({ principal, id } = {}) {
+  async obtain({ principal, grant = null, id } = {}) {
     if (!id) throw TroveError.invalid('An upload id is required');
     const vfs = await this.vfs.obtain();
     // Resolving first is what makes the check possible at all: only the session knows
@@ -314,8 +350,14 @@ export class UploadAccessProvider extends Provider {
     const session = await vfs.uploadStatus(id);
     const config = await this.config.obtain();
     if (enforcing(config)) {
-      const collections = await this.collections.obtain();
-      await collections.assert(principal, session.collectionId, 'write');
+      // Re-checked on EVERY request of the upload, keys included — the point of this
+      // provider. A key revoked between `POST /api/uploads` and `complete` stops the
+      // upload, which it would not if the grant were only checked when it began.
+      if (grant) grantedCapabilities(grant, session.collectionId, 'write');
+      else {
+        const collections = await this.collections.obtain();
+        await collections.assert(principal, session.collectionId, 'write');
+      }
     }
     return {
       id,

package/packages/server/src/engine/providers/core.js

@@ -21,7 +21,8 @@
 // means the same thing it always did.
 
 import {
-  StorageBackend, MemoryStorage, FilesystemStorage, S3Storage,
+  StorageBackend, MemoryStorage, S3Storage,
+  StorageDriverRegistry, portableDrivers,
   MetadataStore, MemoryStore, SqliteStore,
   SearchService, EmbeddingProvider, LocalHashEmbedding, HttpEmbedding,
   SearchTransformer, ParsingSearchTransformer, WorkersAiSearchTransformer,
@@ -32,7 +33,8 @@ import {
   cloudflareAccess,
   KeyValueStore, MemoryKV, SqliteKV,
   SqliteProvider, LocalSqliteProvider,
-  SidecarService, NotificationCenter, WebPushService,
+  SidecarService, NotificationCenter, WebPushService, WebPushChannel, NotificationChannel,
+  ApiKeyService, CapabilityProvider, ApiKeyCapabilityProvider,
   CollectionService,
   PluginService, PackageStore, StoragePackageStore, SqlitePluginInstallStore,
   IndexerRuntime, InProcessIndexerRuntime, PluginIndexers,
@@ -49,12 +51,37 @@ import { need } from '../lazy.js';
 const resolve = (value, BaseClass, build) =>
   (value instanceof BaseClass ? value : build(value || {}));
 
-export function buildStorage(cfg) {
-  switch (cfg.driver) {
-    case 's3': return new S3Storage(cfg.s3);
-    case 'filesystem': return new FilesystemStorage({ root: cfg.root });
-    case 'memory': default: return new MemoryStorage();
-  }
+/**
+ * The drivers this deployment can build, as a registry.
+ *
+ * `config.storageDrivers` either IS a registry or is a list of drivers to add to the
+ * portable ones — so a deployment adds Filesystem (Node/Bun), or a driver written
+ * entirely outside this package, by naming it at the entry point. What is not registered
+ * is not offered and cannot be built.
+ */
+export function storageRegistry(config = {}) {
+  if (config.storageRegistry instanceof StorageDriverRegistry) return config.storageRegistry;
+  if (config.storageDrivers instanceof StorageDriverRegistry) return config.storageDrivers;
+  const registry = new StorageDriverRegistry(portableDrivers());
+  for (const d of config.storageDrivers || []) registry.register(d);
+  return registry;
+}
+
+/**
+ * Build a backend from a store config.
+ *
+ * The `default:` arm this replaces returned MemoryStorage, so a typo'd driver produced a
+ * store that took writes and lost them at the next restart. Unknown drivers now throw and
+ * say what is available.
+ */
+export function buildStorage(cfg, config = {}) {
+  // ABSENT is not the same as WRONG, and conflating them is what the old `default:` arm
+  // did. No storage configured at all is the zero-config path — `createServer()` with
+  // nothing, which is ephemeral by definition — so it gets memory. A driver that was
+  // NAMED and is not registered is a mistake, and throws: that is the case where a typo
+  // used to buy you a store that took writes and lost them.
+  if (!cfg?.driver) return new MemoryStorage();
+  return storageRegistry(config).build(cfg);
 }
 
 function buildIdentity(cfg) {
@@ -141,8 +168,15 @@ export function coreProviders(config, lifecycleState) {
       beginReindex: (opts) => lifecycleState.background.beginReindex(opts),
     }),
 
+    // The storage self-check, late-bound for the same reason: it needs `collections` and
+    // `issues` from this container, so it is assembled in createServer and reached back
+    // into rather than built here.
+    storageCheck: Provider.fromSingleton({
+      run: (opts) => lifecycleState.storageCheck(opts),
+    }),
+
     storage: Provider.fromLazySingleton(
-      () => resolve(config.storage ?? config.vfs?.storage, StorageBackend, buildStorage),
+      () => resolve(config.storage ?? config.vfs?.storage, StorageBackend, (cfg) => buildStorage(cfg, config)),
     ),
 
     // One shared SQLite provider (a keyed pool) for metadata, kv, and per-plugin
@@ -285,17 +319,68 @@ export function coreProviders(config, lifecycleState) {
         })
         : null))),
 
-    notifications: Provider.fromLazySingleton(
+    // How notifications actually reach people. A list, because there is no reason for
+    // it to be one: a drive can push to browsers and mail a digest and post into a chat
+    // workspace, and none of those knows about the others. Web push is the default and
+    // only when VAPID is configured, so a drive that sets nothing gets an inbox and no
+    // delivery — which is what it got before.
+    //
+    // `config.notificationChannels` replaces the list wholesale rather than adding to
+    // it, so a caller who wants email INSTEAD of push says so by saying so.
+    notificationChannels: Provider.fromLazySingleton(
       async (deps) => {
         const { kv, push } = await need(deps, ['kv', 'push']);
-        const center = new NotificationCenter({ kv, push, flushIntervalMs: config.mentionFlushMs ?? 30_000 });
+        if (config.notificationChannels) {
+          return config.notificationChannels.filter(Boolean).map((c) => {
+            if (!(c instanceof NotificationChannel)) {
+              throw TroveError.invalid('Every notificationChannels entry must be a NotificationChannel');
+            }
+            return c;
+          });
+        }
+        return push ? [new WebPushChannel({ kv, service: push })] : [];
+      },
+      null,
+      { deps: ['kv', 'push'] },
+    ),
+
+    // The API key store. Keys grant capabilities and no identity — see core/apiKeys.js.
+    apiKeys: Provider.fromLazySingleton(
+      async (deps) => {
+        const { kv } = await need(deps, ['kv']);
+        return resolve(config.apiKeys, ApiKeyService, () => new ApiKeyService({ kv }));
+      },
+      null,
+      { deps: ['kv'] },
+    ),
+
+    // How a credential becomes a capability grant. The counterpart to `identity`, and
+    // separate from it on purpose: some credentials answer "what may this do" without
+    // answering "who is this". Swap it to authorize from something else — a client
+    // certificate, a signed webhook, a service mesh header.
+    capabilities: Provider.fromLazySingleton(
+      async (deps) => {
+        const { apiKeys } = await need(deps, ['apiKeys']);
+        return resolve(config.capabilities, CapabilityProvider,
+          () => new ApiKeyCapabilityProvider({ apiKeys }));
+      },
+      null,
+      { deps: ['apiKeys'] },
+    ),
+
+    notifications: Provider.fromLazySingleton(
+      async (deps) => {
+        const { kv, notificationChannels } = await need(deps, ['kv', 'notificationChannels']);
+        const center = new NotificationCenter({
+          kv, channels: notificationChannels, flushIntervalMs: config.mentionFlushMs ?? 30_000,
+        });
         if (config.startFlusher !== false) center.start();
         return center;
       },
       // Stopping the flusher used to be a line in close() that had to remember this
       // existed. Now it is attached to the thing it stops.
       (center) => center.stop(),
-      { deps: ['kv', 'push'] },
+      { deps: ['kv', 'notificationChannels'] },
     ),
 
     sidecar: Provider.fromLazySingleton(
@@ -313,15 +398,23 @@ export function coreProviders(config, lifecycleState) {
     ),
 
     // The ownership + permission boundary; each collection is a store config.
-    // `config.collections === false` disables it (single open storage, no ACLs),
-    // and the resource is then null — a provider is allowed to provide nothing.
+    // There is no "off" any more. Every collection-scoped endpoint names its collection
+    // in the path, so a drive with no collection layer has nothing to answer with — and
+    // the ACL check standing down because the service is absent was the failure mode this
+    // graph was rebuilt to make impossible. Refused here as well as in configFromEnv, so
+    // there is one answer whichever way the config arrived.
     collections: Provider.fromLazySingleton(
       async (deps) => {
-        if (config.collections === false) return null;
+        if (config.collections === false) {
+          throw TroveError.invalid(
+            'collections: false is no longer supported — endpoints are scoped to a named '
+            + 'collection. Create one collection and use it.',
+          );
+        }
         const { kv, storage } = await need(deps, ['kv', 'storage']);
         return resolve(config.collections, CollectionService, () => new CollectionService({
           kv,
-          storageFactory: (storeConfig) => buildStorage(storeConfig),
+          storageFactory: (storeConfig) => buildStorage(storeConfig, config),
           admins: config.admins || [],
           creatorRoles: config.creatorRoles || [],
           defaultOpen: config.defaultOpen !== false,