@bkazemi/verily 0.7.0 → 0.8.1

package/dist/browser/mark.d.ts

@@ -1,9 +1,5 @@
-/**
- * How sure the mark is: `current` for a verification that holds, `inactive` for one that
- * does not, and `pending` for one nobody has confirmed yet, which claims nothing and is
- * drawn in the surrounding text colour.
- */
-export type MarkTone = 'current' | 'inactive' | 'pending';
+import { type MarkTone } from '../marks.js';
+export type { MarkTone };
 /**
  * The check draws itself in from its left end once the verification holds: when a pill's
  * mark first becomes `current`, and each time the dialog opens on a current one.

package/dist/browser/mark.js

@@ -1,8 +1,4 @@
-const tones = {
-    current: ['#D3444C', '#149766'],
-    inactive: ['#149766', '#D3444C'],
-    pending: ['currentColor', 'currentColor'],
-};
+import { tones, verification } from '../marks.js';
 /**
  * The check draws itself in from its left end once the verification holds: when a pill's
  * mark first becomes `current`, and each time the dialog opens on a current one.
@@ -24,20 +20,18 @@ export function paintMark(svg, tone) {
 export function verificationMark(tone = 'current') {
     const namespace = 'http://www.w3.org/2000/svg';
     const svg = document.createElementNS(namespace, 'svg');
-    svg.setAttribute('viewBox', '-4 -4 264 264');
+    svg.setAttribute('viewBox', verification.viewBox);
     svg.setAttribute('fill', 'none');
     svg.setAttribute('aria-hidden', 'true');
     svg.setAttribute('focusable', 'false');
     for (const layer of [0, 1]) {
         const path = document.createElementNS(namespace, 'path');
-        path.setAttribute('d', 'M40 36 128 220 216 36');
+        path.setAttribute('d', verification.path);
         path.setAttribute('stroke-width', '32');
         path.setAttribute('stroke-linejoin', 'miter');
-        if (layer === 1) {
-            path.setAttribute('pathLength', '176');
-            path.setAttribute('stroke-dasharray', '108 176');
-            path.setAttribute('stroke-dashoffset', '-54');
-        }
+        if (layer === 1)
+            for (const [name, value] of Object.entries(verification.check))
+                path.setAttribute(name, value);
         svg.append(path);
     }
     paintMark(svg, tone);

package/dist/browser/provider-mark.d.ts

@@ -1,6 +1,6 @@
 /**
- * The mark for a provider, or nothing where there is none. Returning nothing rather than
- * the provider's name keeps this to one job: a caller that also writes the name would
- * otherwise print it twice, and only the caller knows where the name belongs.
+ * The mark for a provider as an element, or nothing where there is none. Returning nothing
+ * rather than the provider's name keeps this to one job: a caller that also writes the
+ * name would otherwise print it twice, and only the caller knows where the name belongs.
  */
 export declare function providerMark(provider: string, method?: string): SVGSVGElement | undefined;

package/dist/browser/provider-mark.js

@@ -1,101 +1,26 @@
+import { markOf, pathAttributes } from '../marks.js';
 const namespace = 'http://www.w3.org/2000/svg';
-function mark() {
+/**
+ * The mark for a provider as an element, or nothing where there is none. Returning nothing
+ * rather than the provider's name keeps this to one job: a caller that also writes the
+ * name would otherwise print it twice, and only the caller knows where the name belongs.
+ */
+export function providerMark(provider, method) {
+    const mark = markOf(provider, method);
+    if (!mark)
+        return undefined;
     const svg = document.createElementNS(namespace, 'svg');
-    svg.setAttribute('viewBox', '0 0 16 16');
+    svg.setAttribute('viewBox', mark.viewBox);
     svg.setAttribute('class', 'provider');
     svg.setAttribute('aria-hidden', 'true');
     svg.setAttribute('focusable', 'false');
-    return svg;
-}
-/** GitHub mark from Primer Octicons (MIT); license in docs/licenses/octicons.txt. */
-function github() {
-    const svg = mark();
-    const path = document.createElementNS(namespace, 'path');
-    svg.setAttribute('fill', 'currentColor');
-    path.setAttribute('d', 'M6.766 11.328c-2.063-.25-3.516-1.734-3.516-3.656 0-.781.281-1.625.75-2.188-.203-.515-.172-1.609.063-2.062.625-.078 1.468.25 1.968.703.594-.187 1.219-.281 1.985-.281.765 0 1.39.094 1.953.265.484-.437 1.344-.765 1.969-.687.218.422.25 1.515.046 2.047.5.593.766 1.39.766 2.203 0 1.922-1.453 3.375-3.547 3.64.531.344.89 1.094.89 1.954v1.625c0 .468.391.734.86.547C13.781 14.359 16 11.53 16 8.03 16 3.61 12.406 0 7.984 0 3.563 0 0 3.61 0 8.031a7.88 7.88 0 0 0 5.172 7.422c.422.156.828-.125.828-.547v-1.25c-.219.094-.5.156-.75.156-1.031 0-1.64-.562-2.078-1.609-.172-.422-.36-.672-.719-.719-.187-.015-.25-.093-.25-.187 0-.188.313-.328.625-.328.453 0 .844.281 1.25.86.313.452.64.655 1.031.655s.641-.14 1-.5c.266-.265.47-.5.657-.656');
-    svg.append(path);
-    return svg;
-}
-/**
- * Discord mark from Simple Icons (CC0); notice in docs/licenses/simple-icons.txt. The mark
- * itself is Discord's trademark, used here only to say an account is a Discord account.
- */
-function discord() {
-    const svg = mark();
-    const path = document.createElementNS(namespace, 'path');
-    svg.setAttribute('viewBox', '0 0 24 24');
-    svg.setAttribute('fill', 'currentColor');
-    path.setAttribute('d', 'M20.317 4.3698a19.7913 19.7913 0 00-4.8851-1.5152.0741.0741 0 00-.0785.0371c-.211.3753-.4447.8648-.6083 1.2495-1.8447-.2762-3.68-.2762-5.4868 0-.1636-.3933-.4058-.8742-.6177-1.2495a.077.077 0 00-.0785-.037 19.7363 19.7363 0 00-4.8852 1.515.0699.0699 0 00-.0321.0277C.5334 9.0458-.319 13.5799.0992 18.0578a.0824.0824 0 00.0312.0561c2.0528 1.5076 4.0413 2.4228 5.9929 3.0294a.0777.0777 0 00.0842-.0276c.4616-.6304.8731-1.2952 1.226-1.9942a.076.076 0 00-.0416-.1057c-.6528-.2476-1.2743-.5495-1.8722-.8923a.077.077 0 01-.0076-.1277c.1258-.0943.2517-.1923.3718-.2914a.0743.0743 0 01.0776-.0105c3.9278 1.7933 8.18 1.7933 12.0614 0a.0739.0739 0 01.0785.0095c.1202.099.246.1981.3728.2924a.077.077 0 01-.0066.1276 12.2986 12.2986 0 01-1.873.8914.0766.0766 0 00-.0407.1067c.3604.698.7719 1.3628 1.225 1.9932a.076.076 0 00.0842.0286c1.961-.6067 3.9495-1.5219 6.0023-3.0294a.077.077 0 00.0313-.0552c.5004-5.177-.8382-9.6739-3.5485-13.6604a.061.061 0 00-.0312-.0286zM8.02 15.3312c-1.1825 0-2.1569-1.0857-2.1569-2.419 0-1.3332.9555-2.4189 2.157-2.4189 1.2108 0 2.1757 1.0952 2.1568 2.419 0 1.3332-.9555 2.4189-2.1569 2.4189zm7.9748 0c-1.1825 0-2.1569-1.0857-2.1569-2.419 0-1.3332.9554-2.4189 2.1569-2.4189 1.2108 0 2.1757 1.0952 2.1568 2.419 0 1.3332-.946 2.4189-2.1568 2.4189Z');
-    svg.append(path);
-    return svg;
-}
-/** YouTube mark from Simple Icons (CC0); notice in docs/licenses/simple-icons.txt. */
-function youtube() {
-    const svg = mark();
-    const path = document.createElementNS(namespace, 'path');
-    svg.setAttribute('viewBox', '0 0 24 24');
-    svg.setAttribute('fill', 'currentColor');
-    path.setAttribute('d', 'M23.498 6.186a3.016 3.016 0 0 0-2.122-2.136C19.505 3.545 12 3.545 12 3.545s-7.505 0-9.377.505A3.017 3.017 0 0 0 .502 6.186C0 8.07 0 12 0 12s0 3.93.502 5.814a3.016 3.016 0 0 0 2.122 2.136c1.871.505 9.376.505 9.376.505s7.505 0 9.377-.505a3.015 3.015 0 0 0 2.122-2.136C24 15.93 24 12 24 12s0-3.93-.502-5.814zM9.545 15.568V8.432L15.818 12l-6.273 3.568z');
-    svg.append(path);
-    return svg;
-}
-/**
- * A key, drawn here rather than taken from anywhere. It is not the OpenPGP logo: that mark
- * is somebody's to license and this repository does not ship artwork it cannot account for.
- * A key is also the truer picture, since what was proved is control of one, not membership
- * of an organisation.
- */
-function key() {
-    return lines([
-        'M7.4 8.6a3.3 3.3 0 1 0-4.7 4.7 3.3 3.3 0 0 0 4.7-4.7Z',
-        'M7.4 8.6 14 2',
-        'M11.2 4.8l1.6 1.6',
-        'M9.4 6.6l1.6 1.6',
-    ]);
-}
-/** A globe, drawn here like the key, for a page or a domain on the open web. */
-function globe() {
-    return lines([
-        'M8 1.5a6.5 6.5 0 1 0 0 13 6.5 6.5 0 0 0 0-13Z',
-        'M1.5 8h13',
-        'M8 1.5C6.1 3.3 5.1 5.5 5.1 8s1 4.7 2.9 6.5',
-        'M8 1.5c1.9 1.8 2.9 4 2.9 6.5s-1 4.7-2.9 6.5',
-    ]);
-}
-/** An envelope, drawn here like the key, for a mailbox that read a code sent to it. */
-function envelope() {
-    return lines(['M2 3.5h12v9H2z', 'M2.4 4l5.6 4.6L13.6 4']);
-}
-/** A mark drawn as rounded strokes in the text colour. */
-function lines(paths) {
-    const svg = mark();
-    svg.setAttribute('fill', 'none');
-    for (const d of paths) {
+    svg.setAttribute('fill', mark.stroke ? 'none' : 'currentColor');
+    for (const d of mark.paths) {
         const path = document.createElementNS(namespace, 'path');
         path.setAttribute('d', d);
-        path.setAttribute('stroke', 'currentColor');
-        path.setAttribute('stroke-width', '1.6');
-        path.setAttribute('stroke-linecap', 'round');
-        path.setAttribute('stroke-linejoin', 'round');
+        for (const [name, value] of pathAttributes(mark))
+            path.setAttribute(name, value);
         svg.append(path);
     }
     return svg;
 }
-/**
- * The mark for a provider, or nothing where there is none. Returning nothing rather than
- * the provider's name keeps this to one job: a caller that also writes the name would
- * otherwise print it twice, and only the caller knows where the name belongs.
- */
-export function providerMark(provider, method) {
-    const marks = {
-        github,
-        discord,
-        youtube,
-        openpgp: key,
-        email: envelope,
-    };
-    // A site names its own link-back providers, so those fall back on the method's mark,
-    // which a domain shown by its DNS or by a file shares.
-    return (marks[provider]?.() ??
-        (['backlink', 'dns', 'wellknown'].includes(method ?? '') ? globe() : undefined));
-}

package/dist/instance/auth.d.ts

@@ -0,0 +1,14 @@
+import type { Store } from './store.js';
+export declare class OwnerAuth {
+    private readonly storage;
+    private readonly ownerKey;
+    constructor(storage: Store, ownerKey: string);
+    private token;
+    authenticated(request: Request): Promise<boolean>;
+    /** Which owner session a request belongs to, by the hash its record is stored under. */
+    session(request: Request): Promise<string | undefined>;
+    login(key: string): Promise<string | undefined>;
+    logout(request: Request): Promise<string>;
+    allow(bucket: 'login', limit: number, windowMs: number): Promise<boolean>;
+    prune(): Promise<void>;
+}

package/dist/instance/auth.js

@@ -0,0 +1,80 @@
+import { timingSafeEqual } from 'node:crypto';
+import { expired } from '../core/index.js';
+import { hash, secret } from '../server/service.js';
+const sessionMs = 8 * 3600000;
+// Use a normal host-only cookie name. Secure, HttpOnly, SameSite and Path=/
+// provide the relevant protections while avoiding __Host-prefix rejection by
+// browsers or privacy extensions on workers.dev.
+const cookieName = 'verily_owner';
+export class OwnerAuth {
+    storage;
+    ownerKey;
+    constructor(storage, ownerKey) {
+        this.storage = storage;
+        this.ownerKey = ownerKey;
+        if (!/^[A-Za-z0-9_-]{43,}$/.test(ownerKey))
+            throw new Error('OWNER_KEY must be a randomly generated base64url secret of at least 32 bytes');
+    }
+    token(request) {
+        return request.headers
+            .get('cookie')
+            ?.split(';')
+            .map((part) => part.trim())
+            .find((part) => part.startsWith(`${cookieName}=`))
+            ?.slice(cookieName.length + 1);
+    }
+    async authenticated(request) {
+        return (await this.session(request)) !== undefined;
+    }
+    /** Which owner session a request belongs to, by the hash its record is stored under. */
+    async session(request) {
+        const token = this.token(request);
+        if (!token)
+            return undefined;
+        const session = await this.storage.get(`owner/session/${hash(token)}`);
+        return !!session && session.expiresAt > Date.now() && session.keyHash === hash(this.ownerKey)
+            ? hash(token)
+            : undefined;
+    }
+    async login(key) {
+        if (!timingSafeEqual(Buffer.from(hash(key)), Buffer.from(hash(this.ownerKey))))
+            return;
+        const token = secret();
+        await this.storage.delete('owner/rate/v2/login');
+        await this.storage.put(`owner/session/${hash(token)}`, {
+            expiresAt: Date.now() + sessionMs,
+            keyHash: hash(this.ownerKey),
+        });
+        return `${cookieName}=${token}; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=${sessionMs / 1000}`;
+    }
+    async logout(request) {
+        const token = this.token(request);
+        if (token)
+            await this.storage.delete(`owner/session/${hash(token)}`);
+        return `${cookieName}=; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=0`;
+    }
+    async allow(bucket, limit, windowMs) {
+        return this.storage.transaction(async (tx) => {
+            const key = `owner/rate/v2/${bucket}`;
+            const previous = await tx.get(key);
+            const next = previous && previous.until > Date.now()
+                ? previous
+                : { count: 0, until: Date.now() + windowMs };
+            if (next.count >= limit)
+                return false;
+            next.count++;
+            await tx.put(key, next);
+            return true;
+        });
+    }
+    async prune() {
+        // One counter for every POST, from before requests were limited per session and client.
+        await this.storage.delete('owner/rate/v2/mutation');
+        await this.storage.transaction(async (tx) => {
+            for (const [key, session] of await tx.list('owner/session/')) {
+                if (expired(session, Date.now()) || session.keyHash !== hash(this.ownerKey))
+                    await tx.delete(key);
+            }
+        });
+    }
+}

package/dist/instance/bin.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/instance/bin.js

@@ -0,0 +1,36 @@
+#!/usr/bin/env node
+import { serve } from './serve.js';
+import { init } from './init.js';
+const usage = `Usage:
+  verily serve                    Run an instance on Node, from the environment.
+  verily init cloudflare [dir]    Write a Cloudflare project into dir.`;
+/** Writes the starter, then says what to do with it. */
+async function start(directory) {
+    await init(directory);
+    console.log(`Wrote a Cloudflare project to ${directory}
+
+Next, in that directory:
+  1. npm install
+  2. Fill in account_id and the vars in wrangler.jsonc.
+  3. npx wrangler secret put OWNER_KEY
+  4. npm run deploy`);
+}
+const [command, target, directory] = process.argv.slice(2);
+try {
+    if (command === 'serve') {
+        const { server } = await serve(process.env);
+        const { address, port } = server.address();
+        console.log(`Verily instance for ${process.env.PUBLIC_ORIGIN} listening on ${address}:${port}`);
+    }
+    else if (command === 'init' && target === 'cloudflare') {
+        await start(directory ?? '.');
+    }
+    else {
+        console.error(usage);
+        process.exit(command === undefined || command === '--help' || command === '-h' ? 0 : 2);
+    }
+}
+catch (error) {
+    console.error(error instanceof Error ? error.message : error);
+    process.exit(1);
+}

package/dist/instance/cloudflare.d.ts

@@ -0,0 +1,57 @@
+import type { Storage } from '../core/index.js';
+import { type Instance } from './index.js';
+import { type InstanceEnv } from './env.js';
+import { type Store } from './store.js';
+/**
+ * The parts of Cloudflare's own types this file uses, written out here so the package
+ * needs none of Cloudflare's to be installed. A Durable Object's real storage, state and
+ * namespace each fit the one below.
+ */
+interface ObjectKeyValue {
+    get<T>(key: string): Promise<T | undefined>;
+    put<T>(key: string, value: T): Promise<void>;
+    delete(key: string): Promise<boolean>;
+    list<T>(options: {
+        prefix: string;
+    }): Promise<Map<string, T>>;
+}
+export interface ObjectStorage extends ObjectKeyValue {
+    transaction<T>(work: (tx: ObjectKeyValue) => Promise<T>): Promise<T>;
+    getAlarm(): Promise<number | null>;
+    setAlarm(time: number): Promise<void>;
+}
+export interface ObjectState {
+    storage: ObjectStorage;
+    blockConcurrencyWhile<T>(work: () => Promise<T>): Promise<T>;
+}
+interface ObjectNamespace {
+    idFromName(name: string): unknown;
+    get(id: never): {
+        fetch(url: string, init: RequestInit): Promise<Response>;
+    };
+}
+/** The instance's settings, as vars and secrets, and the binding of the object that runs it. */
+export interface Env extends InstanceEnv {
+    VERILY: ObjectNamespace;
+}
+/** A Durable Object's storage as an instance store. It is SQLite-backed, not Workers KV. */
+export declare function cloudflareStore(storage: ObjectStorage): Store;
+/** The library's record storage on a Durable Object, for a Worker that embeds the backend. */
+export declare class CloudflareStorage implements Storage {
+    private readonly records;
+    constructor(storage: ObjectStorage);
+    transaction: Storage['transaction'];
+}
+/** The Worker: turns away what needs no storage, and passes the rest to the one object. */
+declare const _default: {
+    fetch(request: Request, env: Env): Promise<Response>;
+};
+export default _default;
+/** The instance on a Durable Object: its storage, an hourly alarm, and settings from `env`. */
+export declare class VerilyStore {
+    private readonly ctx;
+    protected readonly instance: Instance;
+    constructor(ctx: ObjectState, env: Env);
+    alarm(): Promise<void>;
+    fetch(request: Request): Promise<Response>;
+}

package/dist/instance/cloudflare.js

@@ -0,0 +1,71 @@
+import { admit, createInstance } from './index.js';
+import { fromEnv } from './env.js';
+import { html } from './page.js';
+import { recordStorage } from './store.js';
+/** Values are copied on the way in and out, so a caller never shares one with storage. */
+const keyValue = (storage) => ({
+    get: async (key) => structuredClone(await storage.get(key)),
+    put: (key, value) => storage.put(key, structuredClone(value)),
+    delete: async (key) => {
+        await storage.delete(key);
+    },
+    list: async (prefix) => [...(await storage.list({ prefix })).entries()].map(([key, value]) => [key, structuredClone(value)]),
+});
+/** A Durable Object's storage as an instance store. It is SQLite-backed, not Workers KV. */
+export function cloudflareStore(storage) {
+    return {
+        ...keyValue(storage),
+        transaction: (work) => storage.transaction((tx) => work(keyValue(tx))),
+    };
+}
+/** The library's record storage on a Durable Object, for a Worker that embeds the backend. */
+export class CloudflareStorage {
+    records;
+    constructor(storage) {
+        this.records = recordStorage(cloudflareStore(storage));
+    }
+    transaction = (work) => this.records.transaction(work);
+}
+const hour = 3600000;
+/** The Worker: turns away what needs no storage, and passes the rest to the one object. */
+export default {
+    async fetch(request, env) {
+        // Turned away here, a request never wakes the object.
+        const admitted = await admit(request, env.PUBLIC_ORIGIN);
+        if (admitted instanceof Response)
+            return admitted;
+        try {
+            // One installation, with an identity that survives deployments and hostname changes.
+            return await env.VERILY.get(env.VERILY.idFromName('site-owner')).fetch(admitted.url, {
+                method: admitted.method,
+                headers: Object.fromEntries(admitted.headers),
+                body: admitted.method === 'POST' ? await admitted.arrayBuffer() : undefined,
+                redirect: 'manual',
+            });
+        }
+        catch {
+            return html('Temporarily unavailable', '', 503);
+        }
+    },
+};
+/** The instance on a Durable Object: its storage, an hourly alarm, and settings from `env`. */
+export class VerilyStore {
+    ctx;
+    instance;
+    constructor(ctx, env) {
+        this.ctx = ctx;
+        this.instance = createInstance({ ...fromEnv(env), store: cloudflareStore(ctx.storage) });
+        ctx.blockConcurrencyWhile(async () => {
+            if ((await ctx.storage.getAlarm()) === null)
+                await ctx.storage.setAlarm(Date.now() + hour);
+        });
+    }
+    async alarm() {
+        // Schedule first so transient cleanup failures never permanently stop maintenance.
+        await this.ctx.storage.setAlarm(Date.now() + hour);
+        await this.instance.upkeep();
+    }
+    fetch(request) {
+        return this.instance.handle(request, request.headers.get('cf-connecting-ip'));
+    }
+}

package/dist/instance/env.d.ts

@@ -0,0 +1,51 @@
+import type { LocalKind } from '../core/index.js';
+import type { InstanceOptions } from './index.js';
+/** The settings an instance reads, under the same names on every host. */
+export interface InstanceEnv {
+    /** The origin the instance is served from. HTTPS, with no trailing slash. */
+    PUBLIC_ORIGIN: string;
+    SITE_NAME: string;
+    /** What the owner links: one of their accounts, a page, or the site. Defaults to account. */
+    OWNER_KIND?: LocalKind;
+    OWNER_LABEL: string;
+    OWNER_REFERENCE: string;
+    OWNER_PROFILE_URL: string;
+    /** The secret the owner signs in with: at least 32 random bytes, base64url. */
+    OWNER_KEY: string;
+    REPORT_URL: string;
+    /** GitHub sign-in is offered only when both are set. */
+    GITHUB_CLIENT_ID?: string;
+    GITHUB_CLIENT_SECRET?: string;
+    /** Discord sign-in is offered only when both are set. */
+    DISCORD_CLIENT_ID?: string;
+    DISCORD_CLIENT_SECRET?: string;
+    /** YouTube sign-in is offered only when both are set. */
+    GOOGLE_CLIENT_ID?: string;
+    GOOGLE_CLIENT_SECRET?: string;
+    /**
+     * Email is offered only when both are set: a Resend API key, and the sender its codes
+     * come from, as `Name <address>` or an address on a domain verified with Resend.
+     */
+    RESEND_API_KEY?: string;
+    EMAIL_FROM?: string;
+    /** How many codes may be mailed in a day, where the mail allowance is not the default. */
+    EMAIL_DAILY_LIMIT?: string | number;
+    /**
+     * Public records are signed unless this is `off`. The key is `SIGNING_KEY` where one is
+     * set, armored. Otherwise one is made on first use and kept in the store.
+     */
+    SIGNING?: string;
+    SIGNING_KEY?: string;
+    /**
+     * The sites that send their users here instead of hosting Verily, as a JSON list of
+     * `{ id, name, origin, authorizeUrl, returnUrl }`. Each needs its key in
+     * `SITE_<ID>_KEY`, such as `SITE_PARTNER_KEY`.
+     */
+    SITES?: string | unknown[];
+    [key: `SITE_${string}_KEY`]: string | undefined;
+}
+/**
+ * An instance's options from its settings. Every host builds them here, so two hosts given
+ * the same settings offer the same methods and behave the same. The host adds the store.
+ */
+export declare function fromEnv(env: InstanceEnv): Omit<InstanceOptions, 'store'>;

package/dist/instance/env.js

@@ -0,0 +1,84 @@
+import { discordProvider, dnsProvider, emailProvider, githubLinkProvider, githubProvider, pgpProvider, resendSender, youtubeProvider, } from '../server/index.js';
+import { registry } from './sites.js';
+/** The configured count of mailed messages a day, if it is a count at all. */
+function dailyMail(configured) {
+    const count = Number(configured);
+    return Number.isSafeInteger(count) && count > 0 ? count : undefined;
+}
+/**
+ * An instance's options from its settings. Every host builds them here, so two hosts given
+ * the same settings offer the same methods and behave the same. The host adds the store.
+ */
+export function fromEnv(env) {
+    for (const name of [
+        'PUBLIC_ORIGIN',
+        'SITE_NAME',
+        'OWNER_LABEL',
+        'OWNER_REFERENCE',
+        'OWNER_PROFILE_URL',
+        'OWNER_KEY',
+        'REPORT_URL',
+    ])
+        if (!env[name])
+            throw new Error(`${name} must be set`);
+    return {
+        origin: env.PUBLIC_ORIGIN,
+        siteName: env.SITE_NAME,
+        owner: {
+            // A site with no user accounts must not have its subject described as one.
+            kind: env.OWNER_KIND || undefined,
+            label: env.OWNER_LABEL,
+            reference: env.OWNER_REFERENCE,
+            profileUrl: env.OWNER_PROFILE_URL,
+        },
+        ownerKey: env.OWNER_KEY,
+        reportUrl: env.REPORT_URL,
+        // The same methods on every host, so only ones every host can run safely. The file
+        // method and a web key directory read a host the holder names, and a Cloudflare Worker
+        // cannot check where that resolves, so neither is offered.
+        providers: [
+            // Two ways of showing one GitHub account. Whichever is used first is the record's
+            // main method, and the other is listed beneath it once used.
+            ...(env.GITHUB_CLIENT_ID && env.GITHUB_CLIENT_SECRET
+                ? [
+                    githubProvider({
+                        clientId: env.GITHUB_CLIENT_ID,
+                        clientSecret: env.GITHUB_CLIENT_SECRET,
+                    }),
+                ]
+                : []),
+            githubLinkProvider(),
+            // A domain shown by a record in its DNS, which is one fetch to a fixed resolver.
+            dnsProvider(),
+            // A key needs no registration and no secret. An address on a key is shown only when
+            // the keyserver confirms it.
+            pgpProvider(),
+            ...(env.DISCORD_CLIENT_ID && env.DISCORD_CLIENT_SECRET
+                ? [
+                    discordProvider({
+                        clientId: env.DISCORD_CLIENT_ID,
+                        clientSecret: env.DISCORD_CLIENT_SECRET,
+                    }),
+                ]
+                : []),
+            ...(env.GOOGLE_CLIENT_ID && env.GOOGLE_CLIENT_SECRET
+                ? [
+                    youtubeProvider({
+                        clientId: env.GOOGLE_CLIENT_ID,
+                        clientSecret: env.GOOGLE_CLIENT_SECRET,
+                    }),
+                ]
+                : []),
+            ...(env.RESEND_API_KEY && env.EMAIL_FROM
+                ? [
+                    emailProvider({
+                        send: resendSender({ apiKey: env.RESEND_API_KEY, from: env.EMAIL_FROM }),
+                    }),
+                ]
+                : []),
+        ],
+        sites: registry(env.SITES, env),
+        signingKey: env.SIGNING === 'off' ? false : env.SIGNING_KEY || undefined,
+        mailPerDay: dailyMail(env.EMAIL_DAILY_LIMIT),
+    };
+}