@dwk/remotestorage 0.1.0-beta.0

package/dist/discovery.js

@@ -0,0 +1,35 @@
+/**
+ * remoteStorage discovery (draft §10): the WebFinger link advertising a user's
+ * storage root and the OAuth endpoint a connecting app uses.
+ *
+ * A no-backend app is given only a user address (`user@host`); it discovers the
+ * storage root by querying WebFinger for that account and reading the
+ * remoteStorage link. This module builds that link as a plain
+ * [`@dwk/webfinger`](../webfinger) `Link` so a deployment can drop it into its
+ * existing WebFinger resource record rather than standing up a second endpoint.
+ * Pure data — no Workers runtime.
+ */
+/** The remoteStorage WebFinger link relation (draft §10). */
+export const REMOTESTORAGE_REL = "http://tools.ietf.org/id/draft-dejong-remotestorage";
+/** The remoteStorage draft version advertised in the link properties. */
+export const REMOTESTORAGE_VERSION = "draft-dejong-remotestorage-22";
+/**
+ * Build the WebFinger remoteStorage `Link` for one account. The `properties`
+ * carry the spec version, the OAuth authorization URL, and the capability flags
+ * remoteStorage clients read (`Bearer` auth, `Content-Range` support); a `null`
+ * property value means "advertised as absent", per RFC 7033.
+ */
+export function remoteStorageLink(config) {
+    return {
+        rel: REMOTESTORAGE_REL,
+        href: config.storageRoot,
+        properties: {
+            "http://remotestorage.io/spec/version": REMOTESTORAGE_VERSION,
+            "http://tools.ietf.org/html/rfc6749#section-4.2": config.authEndpoint,
+            "http://tools.ietf.org/html/rfc6750#section-2.3": "false",
+            "http://tools.ietf.org/html/rfc7233": "GET",
+            "http://remotestorage.io/spec/web-authoring": null,
+        },
+    };
+}
+//# sourceMappingURL=discovery.js.map

package/dist/discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../src/discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,6DAA6D;AAC7D,MAAM,CAAC,MAAM,iBAAiB,GAC5B,qDAAqD,CAAC;AAExD,yEAAyE;AACzE,MAAM,CAAC,MAAM,qBAAqB,GAAG,+BAA+B,CAAC;AAUrE;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAA+B;IAC/D,OAAO;QACL,GAAG,EAAE,iBAAiB;QACtB,IAAI,EAAE,MAAM,CAAC,WAAW;QACxB,UAAU,EAAE;YACV,sCAAsC,EAAE,qBAAqB;YAC7D,gDAAgD,EAAE,MAAM,CAAC,YAAY;YACrE,gDAAgD,EAAE,OAAO;YACzD,oCAAoC,EAAE,KAAK;YAC3C,4CAA4C,EAAE,IAAI;SACnD;KACF,CAAC;AACJ,CAAC"}

package/dist/encoding.d.ts

@@ -0,0 +1,11 @@
+/**
+ * base64url + UTF-8 helpers for the OAuth bearer-token decode path.
+ *
+ * Dependency-free and runtime-agnostic (`atob` / `btoa` / Web `TextDecoder`
+ * only) so the surrounding modules unit-test without a Workers runtime.
+ */
+/** Decode unpadded (or padded) base64url to bytes. */
+export declare function base64urlToBytes(segment: string): Uint8Array;
+/** Decode unpadded base64url to a UTF-8 string. */
+export declare function base64urlToText(segment: string): string;
+//# sourceMappingURL=encoding.d.ts.map

package/dist/encoding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encoding.d.ts","sourceRoot":"","sources":["../src/encoding.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,sDAAsD;AACtD,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU,CAQ5D;AAED,mDAAmD;AACnD,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEvD"}

package/dist/encoding.js

@@ -0,0 +1,21 @@
+/**
+ * base64url + UTF-8 helpers for the OAuth bearer-token decode path.
+ *
+ * Dependency-free and runtime-agnostic (`atob` / `btoa` / Web `TextDecoder`
+ * only) so the surrounding modules unit-test without a Workers runtime.
+ */
+/** Decode unpadded (or padded) base64url to bytes. */
+export function base64urlToBytes(segment) {
+    const b64 = segment.replace(/-/g, "+").replace(/_/g, "/");
+    const padded = b64.length % 4 === 0 ? b64 : b64 + "=".repeat(4 - (b64.length % 4));
+    const binary = atob(padded);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++)
+        bytes[i] = binary.charCodeAt(i);
+    return bytes;
+}
+/** Decode unpadded base64url to a UTF-8 string. */
+export function base64urlToText(segment) {
+    return new TextDecoder().decode(base64urlToBytes(segment));
+}
+//# sourceMappingURL=encoding.js.map

package/dist/encoding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encoding.js","sourceRoot":"","sources":["../src/encoding.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,sDAAsD;AACtD,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC1D,MAAM,MAAM,GACV,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACxE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;AAC7D,CAAC"}

package/dist/folder.d.ts

@@ -0,0 +1,78 @@
+/**
+ * Folder listings and folder ETags (draft §A), derived purely from the store's
+ * generic `list(prefix)` descendant projection.
+ *
+ * A remoteStorage folder is **virtual** — there is no stored folder object, only
+ * the documents beneath it — so a `GET <folder>/` listing and its ETag are
+ * computed on demand from the descendants. The contract that makes folder ETags
+ * useful is that a folder's ETag MUST change when **any** descendant changes; we
+ * guarantee that by deriving the ETag from a canonical signature over every
+ * descendant's `(key, etag)` pair, so any document add/remove/overwrite anywhere
+ * in the subtree perturbs it. This module is pure (it returns the signatures);
+ * the caller hashes them with {@link hashSignature} into opaque ETags.
+ */
+import type { ResourceMeta } from "@dwk/store";
+/** An immediate document child of a folder. */
+export interface FolderDocument {
+    /** The child's name (the path segment under the folder). */
+    readonly name: string;
+    /** The document's opaque ETag. */
+    readonly etag: string;
+    /** The recorded content type. */
+    readonly contentType: string;
+}
+/** An immediate subfolder child of a folder. */
+export interface FolderSubfolder {
+    /** The subfolder's name (without the trailing slash). */
+    readonly name: string;
+    /** Canonical signature over the subfolder's own descendants → its ETag. */
+    readonly signature: string;
+}
+/** The structured contents of one folder, ready to render and hash. */
+export interface FolderModel {
+    /** Canonical signature over every descendant → the folder's own ETag. */
+    readonly signature: string;
+    /** Immediate document children, sorted by name. */
+    readonly documents: readonly FolderDocument[];
+    /** Immediate subfolder children, sorted by name. */
+    readonly subfolders: readonly FolderSubfolder[];
+}
+/**
+ * Group the descendants returned by `store.list(prefix)` into the immediate
+ * children of the folder at `prefix` (which MUST end in `/`). A descendant whose
+ * remainder past the prefix has no `/` is an immediate document; otherwise it
+ * belongs to the subfolder named by its first remaining segment, and its
+ * `(key, etag)` pair folds into that subfolder's signature.
+ */
+export declare function buildFolderModel(prefix: string, entries: readonly ResourceMeta[]): FolderModel;
+/**
+ * Hash a folder signature into an opaque, quoted ETag. SHA-256 over the
+ * canonical signature means the ETag is stable for unchanged contents and
+ * changes whenever any descendant does. An empty folder hashes the empty string
+ * to a fixed ETag, so even an absent/empty folder answers with a usable
+ * validator.
+ */
+export declare function hashSignature(signature: string): Promise<string>;
+/** The folder-description media type and JSON-LD context (draft §A). */
+export declare const FOLDER_DESCRIPTION_TYPE = "application/ld+json";
+export declare const FOLDER_DESCRIPTION_CONTEXT = "http://remotestorage.io/spec/folder-description";
+/** A single entry in a rendered folder description's `items` map. */
+export type FolderItem = {
+    ETag: string;
+} | {
+    ETag: string;
+    "Content-Type": string;
+};
+/** A rendered folder description body (draft §A). */
+export interface FolderDescription {
+    readonly "@context": string;
+    readonly items: Record<string, FolderItem>;
+}
+/**
+ * Render a {@link FolderModel} into the folder-description body, hashing each
+ * subfolder's signature into its aggregate ETag. ETags are emitted unquoted in
+ * the JSON body (the wire ETag header keeps the quotes), matching the
+ * remoteStorage folder-description convention.
+ */
+export declare function renderFolderDescription(model: FolderModel): Promise<FolderDescription>;
+//# sourceMappingURL=folder.d.ts.map

package/dist/folder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"folder.d.ts","sourceRoot":"","sources":["../src/folder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,+CAA+C;AAC/C,MAAM,WAAW,cAAc;IAC7B,4DAA4D;IAC5D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kCAAkC;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,iCAAiC;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,gDAAgD;AAChD,MAAM,WAAW,eAAe;IAC9B,yDAAyD;IACzD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,2EAA2E;IAC3E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,uEAAuE;AACvE,MAAM,WAAW,WAAW;IAC1B,yEAAyE;IACzE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,mDAAmD;IACnD,QAAQ,CAAC,SAAS,EAAE,SAAS,cAAc,EAAE,CAAC;IAC9C,oDAAoD;IACpD,QAAQ,CAAC,UAAU,EAAE,SAAS,eAAe,EAAE,CAAC;CACjD;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,SAAS,YAAY,EAAE,GAC/B,WAAW,CAqCb;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAStE;AAED,wEAAwE;AACxE,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAC7D,eAAO,MAAM,0BAA0B,oDACY,CAAC;AAEpD,qEAAqE;AACrE,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7C,qDAAqD;AACrD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;CAC5C;AAED;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,WAAW,GACjB,OAAO,CAAC,iBAAiB,CAAC,CAc5B"}

package/dist/folder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"folder.js","sourceRoot":"","sources":["../src/folder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAgCH;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAc,EACd,OAAgC;IAEhC,MAAM,SAAS,GAAqB,EAAE,CAAC;IACvC,MAAM,cAAc,GAAG,IAAI,GAAG,EAAoB,CAAC;IACnD,MAAM,cAAc,GAAa,EAAE,CAAC;IAEpC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,SAAS;QAC5C,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,IAAI,KAAK,EAAE;YAAE,SAAS,CAAC,8CAA8C;QACzE,MAAM,IAAI,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QAC1C,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAE1B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACjB,SAAS,CAAC,IAAI,CAAC;gBACb,IAAI,EAAE,IAAI;gBACV,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,WAAW,EAAE,KAAK,CAAC,WAAW;aAC/B,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YAClC,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACvC,IAAI,KAAK;gBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;;gBACvB,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IAED,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3E,MAAM,UAAU,GAAsB,CAAC,GAAG,cAAc,CAAC,OAAO,EAAE,CAAC;SAChE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;SACtE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEpE,OAAO;QACL,SAAS,EAAE,cAAc,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;QAC3C,SAAS;QACT,UAAU;KACX,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAiB;IACnD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACvC,SAAS,EACT,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CACpC,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,IAAI;QAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC7D,OAAO,IAAI,GAAG,GAAG,CAAC;AACpB,CAAC;AAED,wEAAwE;AACxE,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;AAC7D,MAAM,CAAC,MAAM,0BAA0B,GACrC,iDAAiD,CAAC;AAapD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAkB;IAElB,MAAM,KAAK,GAA+B,EAAE,CAAC;IAC7C,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QAClC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG;YAChB,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YACvB,cAAc,EAAE,GAAG,CAAC,WAAW;SAChC,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACnC,KAAK,CAAC,GAAG,GAAG,CAAC,IAAI,GAAG,CAAC,GAAG;YACtB,IAAI,EAAE,OAAO,CAAC,MAAM,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;SAClD,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,0BAA0B,EAAE,KAAK,EAAE,CAAC;AAC3D,CAAC;AAED,wEAAwE;AACxE,SAAS,OAAO,CAAC,IAAY;IAC3B,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACxD,CAAC"}

package/dist/gc.d.ts

@@ -0,0 +1,23 @@
+/**
+ * The R2 garbage-collection cron handler.
+ *
+ * Each account's Durable Object forwards its orphaned blob keys (copy-on-write
+ * displacements and deletes) into a shared D1 table as it writes. This handler
+ * — wired to a Cloudflare cron trigger — reclaims those R2 objects once they are
+ * older than a safety window ≥ the maximum write duration, touching only D1 and
+ * R2 and never waking a Durable Object. The reclamation logic lives in
+ * `@dwk/store`; this is the thin endpoint wiring (identical in shape to
+ * `@dwk/solid-pod`'s GC, and able to share one `BLOBS`/`GC_DB` pair with it).
+ */
+import { type RemoteStorageConfig, type RemoteStorageGcEnv } from "./config";
+/** A `scheduled`-compatible cron handler for R2 blob garbage collection. */
+export type RemoteStorageGcHandler = (event: ScheduledController, env: RemoteStorageGcEnv, ctx: ExecutionContext) => Promise<void>;
+/**
+ * Create the cron handler that reclaims orphaned R2 blobs. Bind it to a
+ * `scheduled` trigger alongside the storage Worker; it shares the same `BLOBS`
+ * bucket and the `GC_DB` D1 database the DO forwards orphans into.
+ *
+ * Fails loudly when the required `BLOBS` / `GC_DB` bindings are missing.
+ */
+export declare function createRemoteStorageGc(config: RemoteStorageConfig): RemoteStorageGcHandler;
+//# sourceMappingURL=gc.d.ts.map

package/dist/gc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gc.d.ts","sourceRoot":"","sources":["../src/gc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACxB,MAAM,UAAU,CAAC;AAElB,4EAA4E;AAC5E,MAAM,MAAM,sBAAsB,GAAG,CACnC,KAAK,EAAE,mBAAmB,EAC1B,GAAG,EAAE,kBAAkB,EACvB,GAAG,EAAE,gBAAgB,KAClB,OAAO,CAAC,IAAI,CAAC,CAAC;AAEnB;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,mBAAmB,GAC1B,sBAAsB,CAaxB"}

package/dist/gc.js

@@ -0,0 +1,34 @@
+/**
+ * The R2 garbage-collection cron handler.
+ *
+ * Each account's Durable Object forwards its orphaned blob keys (copy-on-write
+ * displacements and deletes) into a shared D1 table as it writes. This handler
+ * — wired to a Cloudflare cron trigger — reclaims those R2 objects once they are
+ * older than a safety window ≥ the maximum write duration, touching only D1 and
+ * R2 and never waking a Durable Object. The reclamation logic lives in
+ * `@dwk/store`; this is the thin endpoint wiring (identical in shape to
+ * `@dwk/solid-pod`'s GC, and able to share one `BLOBS`/`GC_DB` pair with it).
+ */
+import { collectGarbage, ensureGcSchema } from "@dwk/store";
+import { resolveConfig, } from "./config";
+/**
+ * Create the cron handler that reclaims orphaned R2 blobs. Bind it to a
+ * `scheduled` trigger alongside the storage Worker; it shares the same `BLOBS`
+ * bucket and the `GC_DB` D1 database the DO forwards orphans into.
+ *
+ * Fails loudly when the required `BLOBS` / `GC_DB` bindings are missing.
+ */
+export function createRemoteStorageGc(config) {
+    const resolved = resolveConfig(config);
+    return async (_event, env, _ctx) => {
+        if (!env.BLOBS) {
+            throw new Error("@dwk/remotestorage: GC requires the `BLOBS` R2 binding");
+        }
+        if (!env.GC_DB) {
+            throw new Error("@dwk/remotestorage: GC requires the `GC_DB` D1 binding");
+        }
+        await ensureGcSchema(env.GC_DB);
+        await collectGarbage(env, { safetyWindowMs: resolved.gcSafetyWindowMs });
+    };
+}
+//# sourceMappingURL=gc.js.map

package/dist/gc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gc.js","sourceRoot":"","sources":["../src/gc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5D,OAAO,EACL,aAAa,GAGd,MAAM,UAAU,CAAC;AASlB;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAA2B;IAE3B,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAEvC,OAAO,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACjC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,cAAc,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,QAAQ,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAC3E,CAAC,CAAC;AACJ,CAAC"}

package/dist/handler.d.ts

@@ -0,0 +1,21 @@
+/**
+ * The stateless remoteStorage front door.
+ *
+ * It answers CORS preflights at the edge, authenticates the OAuth bearer token
+ * (`auth.ts`), and enforces the per-module read/write **scope** model
+ * (`scope.ts`) — including the public-`/public/`-document exception — before
+ * forwarding an already-authorized request to the per-account Durable Object,
+ * which owns all storage consistency. One Durable Object per account (keyed by
+ * the parsed account id); the handler is mountable under any path prefix because
+ * it routes purely on the request URL via {@link RemoteStorageConfig.parsePath}.
+ */
+import { type RemoteStorageConfig, type RemoteStorageEnv } from "./config";
+/** A `fetch`-compatible Worker handler. */
+export type RemoteStorageHandler = (request: Request, env: RemoteStorageEnv, ctx: ExecutionContext) => Promise<Response>;
+/**
+ * Create the stateless remoteStorage front-door handler. CORS and auth are
+ * enforced here; storage flows through the per-account
+ * {@link RemoteStorageObject} so it remains the single consistency authority.
+ */
+export declare function createRemoteStorage(config: RemoteStorageConfig): RemoteStorageHandler;
+//# sourceMappingURL=handler.d.ts.map

package/dist/handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../src/handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAKH,OAAO,EAGL,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EAEtB,MAAM,UAAU,CAAC;AAKlB,2CAA2C;AAC3C,MAAM,MAAM,oBAAoB,GAAG,CACjC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,gBAAgB,EACrB,GAAG,EAAE,gBAAgB,KAClB,OAAO,CAAC,QAAQ,CAAC,CAAC;AA8HvB;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,mBAAmB,GAC1B,oBAAoB,CA4DtB"}

package/dist/handler.js

@@ -0,0 +1,166 @@
+/**
+ * The stateless remoteStorage front door.
+ *
+ * It answers CORS preflights at the edge, authenticates the OAuth bearer token
+ * (`auth.ts`), and enforces the per-module read/write **scope** model
+ * (`scope.ts`) — including the public-`/public/`-document exception — before
+ * forwarding an already-authorized request to the per-account Durable Object,
+ * which owns all storage consistency. One Durable Object per account (keyed by
+ * the parsed account id); the handler is mountable under any path prefix because
+ * it routes purely on the request URL via {@link RemoteStorageConfig.parsePath}.
+ */
+import { hostFromUrl } from "@dwk/log";
+import { authenticate } from "./auth";
+import { INTERNAL_HEADERS, resolveConfig, } from "./config";
+import { ALLOWED_METHODS, preflightResponse, withCors } from "./cors";
+import { RemoteStorageLogEvent } from "./log";
+import { authorizeScopes, isPublicDocument } from "./scope";
+/** Client headers safe to forward verbatim to the Durable Object. */
+const FORWARDED_HEADERS = [
+    "content-type",
+    "content-length",
+    "if-match",
+    "if-none-match",
+];
+/** Methods the storage API serves; anything else is `405`. */
+const METHODS = new Set(["GET", "HEAD", "PUT", "DELETE"]);
+/** Fail loudly if a required Cloudflare binding is missing (no silent degradation). */
+function assertBindings(env) {
+    if (!env.STORAGE) {
+        throw new Error("@dwk/remotestorage: missing required Durable Object binding `STORAGE`");
+    }
+    if (!env.BLOBS) {
+        throw new Error("@dwk/remotestorage: missing required R2 binding `BLOBS`");
+    }
+}
+/** Build the internal DO request: clean account-relative URL + config header. */
+function internalRequest(request, storagePath, config) {
+    const headers = new Headers();
+    for (const name of FORWARDED_HEADERS) {
+        const value = request.headers.get(name);
+        if (value !== null)
+            headers.set(name, value);
+    }
+    headers.set(INTERNAL_HEADERS.config, JSON.stringify(config.maxInlineBytes !== undefined
+        ? { maxInlineBytes: config.maxInlineBytes }
+        : {}));
+    const url = new URL(request.url);
+    url.pathname = storagePath;
+    url.search = "";
+    const method = request.method.toUpperCase();
+    const hasBody = method !== "GET" && method !== "HEAD";
+    return new Request(url.toString(), {
+        method: request.method,
+        headers,
+        ...(hasBody ? { body: request.body } : {}),
+    });
+}
+/** Emit a structured event on both the logger and the metrics seam. */
+function emit(config, level, event, fields) {
+    config.logger[level](event, fields);
+    config.metrics.count(event, fields);
+}
+/** A `401` with the Bearer challenge and a machine-readable failure reason. */
+function unauthorized(reason) {
+    return new Response("Unauthorized", {
+        status: 401,
+        headers: {
+            "content-type": "text/plain; charset=utf-8",
+            "www-authenticate": `Bearer realm="remotestorage", error="invalid_token", error_description="${reason}"`,
+        },
+    });
+}
+/** A `403` for an authenticated request whose scopes do not cover the target. */
+function forbidden() {
+    return new Response("Forbidden", {
+        status: 403,
+        headers: { "content-type": "text/plain; charset=utf-8" },
+    });
+}
+/**
+ * Decide whether a request is authorized, given the auth result, the storage
+ * path, and whether the method writes. Returns `null` to allow, or the Response
+ * to return. The `/public/` document read is allowed even unauthenticated; every
+ * other access needs a scope covering the path's module (or `*`).
+ */
+function authorize(config, result, path, needWrite, method) {
+    const publicRead = !needWrite && isPublicDocument(path);
+    if (result.kind === "anonymous") {
+        if (publicRead)
+            return null;
+        emit(config, "warn", RemoteStorageLogEvent.AccessDenied, {
+            method,
+            status: 401,
+        });
+        return unauthorized("missing_token");
+    }
+    // Authenticated: a public-document read always succeeds; otherwise the token
+    // must carry a scope for the path's module at the required mode. (A `rejected`
+    // result never reaches here — the caller returns before authorizing.)
+    if (result.kind === "rejected")
+        return unauthorized(result.reason);
+    if (publicRead || authorizeScopes(result.auth.scopes, path, needWrite)) {
+        return null;
+    }
+    emit(config, "warn", RemoteStorageLogEvent.AccessDenied, {
+        method,
+        status: 403,
+    });
+    return forbidden();
+}
+/**
+ * Create the stateless remoteStorage front-door handler. CORS and auth are
+ * enforced here; storage flows through the per-account
+ * {@link RemoteStorageObject} so it remains the single consistency authority.
+ */
+export function createRemoteStorage(config) {
+    const resolved = resolveConfig(config);
+    return async (request, env, _ctx) => {
+        assertBindings(env);
+        const requestOrigin = request.headers.get("origin");
+        const method = request.method.toUpperCase();
+        // Preflight is answered at the edge — no auth, no store hit.
+        if (method === "OPTIONS")
+            return preflightResponse(requestOrigin);
+        const respond = (response) => withCors(response, requestOrigin);
+        if (!METHODS.has(method)) {
+            return respond(new Response("Method Not Allowed", {
+                status: 405,
+                headers: {
+                    "content-type": "text/plain; charset=utf-8",
+                    allow: ALLOWED_METHODS,
+                },
+            }));
+        }
+        const parsed = resolved.parsePath(new URL(request.url).pathname);
+        if (!parsed) {
+            return respond(new Response("Not Found", {
+                status: 404,
+                headers: { "content-type": "text/plain; charset=utf-8" },
+            }));
+        }
+        const result = await authenticate(request, resolved);
+        if (result.kind === "rejected") {
+            emit(resolved, "warn", RemoteStorageLogEvent.AuthRejected, {
+                reason: result.reason,
+            });
+            return respond(unauthorized(result.reason));
+        }
+        if (result.kind === "authenticated") {
+            emit(resolved, "info", RemoteStorageLogEvent.AuthAccepted, {
+                ...(result.auth.subject
+                    ? { subjectHost: hostFromUrl(result.auth.subject) }
+                    : {}),
+            });
+        }
+        const needWrite = method === "PUT" || method === "DELETE";
+        const denied = authorize(resolved, result, parsed.path, needWrite, method);
+        if (denied)
+            return respond(denied);
+        const forwarded = internalRequest(request, parsed.path, resolved);
+        const id = env.STORAGE.idFromName(parsed.account);
+        const response = await env.STORAGE.get(id).fetch(forwarded);
+        return respond(response);
+    };
+}
+//# sourceMappingURL=handler.js.map

package/dist/handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.js","sourceRoot":"","sources":["../src/handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,WAAW,EAAkB,MAAM,UAAU,CAAC;AAEvD,OAAO,EAAE,YAAY,EAAmB,MAAM,QAAQ,CAAC;AACvD,OAAO,EACL,gBAAgB,EAChB,aAAa,GAId,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,OAAO,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAS5D,qEAAqE;AACrE,MAAM,iBAAiB,GAAG;IACxB,cAAc;IACd,gBAAgB;IAChB,UAAU;IACV,eAAe;CACP,CAAC;AAEX,8DAA8D;AAC9D,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;AAE1D,uFAAuF;AACvF,SAAS,cAAc,CAAC,GAAqB;IAC3C,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,uEAAuE,CACxE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,SAAS,eAAe,CACtB,OAAgB,EAChB,WAAmB,EACnB,MAAsB;IAEtB,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,CAAC,GAAG,CACT,gBAAgB,CAAC,MAAM,EACvB,IAAI,CAAC,SAAS,CACZ,MAAM,CAAC,cAAc,KAAK,SAAS;QACjC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE;QAC3C,CAAC,CAAC,EAAE,CACP,CACF,CAAC;IAEF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,GAAG,CAAC,QAAQ,GAAG,WAAW,CAAC;IAC3B,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;IAEhB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAG,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,CAAC;IACtD,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;QACjC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO;QACP,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3C,CAAC,CAAC;AACL,CAAC;AAED,uEAAuE;AACvE,SAAS,IAAI,CACX,MAAsB,EACtB,KAAsB,EACtB,KAAa,EACb,MAAkB;IAElB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACpC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AACtC,CAAC;AAED,+EAA+E;AAC/E,SAAS,YAAY,CAAC,MAAc;IAClC,OAAO,IAAI,QAAQ,CAAC,cAAc,EAAE;QAClC,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACP,cAAc,EAAE,2BAA2B;YAC3C,kBAAkB,EAAE,2EAA2E,MAAM,GAAG;SACzG;KACF,CAAC,CAAC;AACL,CAAC;AAED,iFAAiF;AACjF,SAAS,SAAS;IAChB,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE;QAC/B,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE;KACzD,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAS,SAAS,CAChB,MAAsB,EACtB,MAAkB,EAClB,IAAY,EACZ,SAAkB,EAClB,MAAc;IAEd,MAAM,UAAU,GAAG,CAAC,SAAS,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAExD,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAChC,IAAI,UAAU;YAAE,OAAO,IAAI,CAAC;QAC5B,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,qBAAqB,CAAC,YAAY,EAAE;YACvD,MAAM;YACN,MAAM,EAAE,GAAG;SACZ,CAAC,CAAC;QACH,OAAO,YAAY,CAAC,eAAe,CAAC,CAAC;IACvC,CAAC;IAED,6EAA6E;IAC7E,+EAA+E;IAC/E,sEAAsE;IACtE,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACnE,IAAI,UAAU,IAAI,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;QACvE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,qBAAqB,CAAC,YAAY,EAAE;QACvD,MAAM;QACN,MAAM,EAAE,GAAG;KACZ,CAAC,CAAC;IACH,OAAO,SAAS,EAAE,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAA2B;IAE3B,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAEvC,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAClC,cAAc,CAAC,GAAG,CAAC,CAAC;QACpB,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAE5C,6DAA6D;QAC7D,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,iBAAiB,CAAC,aAAa,CAAC,CAAC;QAElE,MAAM,OAAO,GAAG,CAAC,QAAkB,EAAY,EAAE,CAC/C,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QAEpC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,OAAO,OAAO,CACZ,IAAI,QAAQ,CAAC,oBAAoB,EAAE;gBACjC,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE;oBACP,cAAc,EAAE,2BAA2B;oBAC3C,KAAK,EAAE,eAAe;iBACvB;aACF,CAAC,CACH,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;QACjE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,OAAO,CACZ,IAAI,QAAQ,CAAC,WAAW,EAAE;gBACxB,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE;aACzD,CAAC,CACH,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACrD,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/B,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,qBAAqB,CAAC,YAAY,EAAE;gBACzD,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB,CAAC,CAAC;YACH,OAAO,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YACpC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,qBAAqB,CAAC,YAAY,EAAE;gBACzD,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO;oBACrB,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;oBACnD,CAAC,CAAC,EAAE,CAAC;aACR,CAAC,CAAC;QACL,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,QAAQ,CAAC;QAC1D,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QAC3E,IAAI,MAAM;YAAE,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC;QAEnC,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAClE,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC5D,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3B,CAAC,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,33 @@
+/**
+ * `@dwk/remotestorage` — an Unhosted-style remoteStorage personal data vault.
+ *
+ * A per-user document vault that "no-backend" web apps read and write over a
+ * plain HTTP `GET`/`PUT`/`DELETE` API, scoped by OAuth 2.0 bearer tokens
+ * (draft-dejong-remotestorage). It is a *competing* personal-data protocol to
+ * Solid — simpler, document-oriented, no RDF — filed for completeness, **not**
+ * as a recommendation alongside `@dwk/solid-pod`.
+ *
+ * Its value here is that it rides on the **same backing store** the Pod uses:
+ * `@dwk/store` is a generic `key → { rdf | blob }` pointer map, so remoteStorage
+ * documents are just its blob tier, and the only library addition this package
+ * required is the generic `list(prefix)` projection (which `@dwk/solid-pod`
+ * could use for LDP container enumeration too). This package ships a thin
+ * per-account Durable Object that reuses `@dwk/store`; the divergent auth model
+ * (plain OAuth bearer + per-module `:r`/`:rw` scopes + a public `/public/` tree,
+ * not DPoP/WAC) and folder semantics live entirely here.
+ *
+ * @see spec/packages/remotestorage.md
+ * @packageDocumentation
+ */
+export { createRemoteStorage, type RemoteStorageHandler } from "./handler";
+export { createRemoteStorageGc, type RemoteStorageGcHandler } from "./gc";
+export { RemoteStorageObject } from "./storage";
+export { resolveConfig, defaultParsePath, type RemoteStorageConfig, type RemoteStorageEnv, type RemoteStorageGcEnv, type ResolvedConfig, type ParsedPath, } from "./config";
+export { authenticate, bearerToken, type RemoteStorageAuth, type AuthResult, type AuthFailureReason, } from "./auth";
+export { parseScopes, authorizeScopes, moduleForPath, isFolderPath, isPublicDocument, ROOT_MODULE, type RemoteStorageScope, type ScopeMode, } from "./scope";
+export { buildFolderModel, renderFolderDescription, hashSignature, FOLDER_DESCRIPTION_TYPE, FOLDER_DESCRIPTION_CONTEXT, type FolderModel, type FolderDocument, type FolderSubfolder, type FolderDescription, type FolderItem, } from "./folder";
+export { corsHeaders, preflightResponse, withCors, ALLOWED_METHODS, } from "./cors";
+export { remoteStorageLink, REMOTESTORAGE_REL, REMOTESTORAGE_VERSION, type RemoteStorageLinkConfig, } from "./discovery";
+export { RemoteStorageLogEvent } from "./log";
+export type { Logger, Metrics } from "@dwk/log";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,mBAAmB,EAAE,KAAK,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAC3E,OAAO,EAAE,qBAAqB,EAAE,KAAK,sBAAsB,EAAE,MAAM,MAAM,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAEhD,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,UAAU,GAChB,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,YAAY,EACZ,WAAW,EACX,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,iBAAiB,GACvB,MAAM,QAAQ,CAAC;AAEhB,OAAO,EACL,WAAW,EACX,eAAe,EACf,aAAa,EACb,YAAY,EACZ,gBAAgB,EAChB,WAAW,EACX,KAAK,kBAAkB,EACvB,KAAK,SAAS,GACf,MAAM,SAAS,CAAC;AAEjB,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,aAAa,EACb,uBAAuB,EACvB,0BAA0B,EAC1B,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,UAAU,GAChB,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,QAAQ,EACR,eAAe,GAChB,MAAM,QAAQ,CAAC;AAEhB,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,qBAAqB,EACrB,KAAK,uBAAuB,GAC7B,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,qBAAqB,EAAE,MAAM,OAAO,CAAC;AAC9C,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC"}

package/dist/index.js

@@ -0,0 +1,32 @@
+/**
+ * `@dwk/remotestorage` — an Unhosted-style remoteStorage personal data vault.
+ *
+ * A per-user document vault that "no-backend" web apps read and write over a
+ * plain HTTP `GET`/`PUT`/`DELETE` API, scoped by OAuth 2.0 bearer tokens
+ * (draft-dejong-remotestorage). It is a *competing* personal-data protocol to
+ * Solid — simpler, document-oriented, no RDF — filed for completeness, **not**
+ * as a recommendation alongside `@dwk/solid-pod`.
+ *
+ * Its value here is that it rides on the **same backing store** the Pod uses:
+ * `@dwk/store` is a generic `key → { rdf | blob }` pointer map, so remoteStorage
+ * documents are just its blob tier, and the only library addition this package
+ * required is the generic `list(prefix)` projection (which `@dwk/solid-pod`
+ * could use for LDP container enumeration too). This package ships a thin
+ * per-account Durable Object that reuses `@dwk/store`; the divergent auth model
+ * (plain OAuth bearer + per-module `:r`/`:rw` scopes + a public `/public/` tree,
+ * not DPoP/WAC) and folder semantics live entirely here.
+ *
+ * @see spec/packages/remotestorage.md
+ * @packageDocumentation
+ */
+export { createRemoteStorage } from "./handler";
+export { createRemoteStorageGc } from "./gc";
+export { RemoteStorageObject } from "./storage";
+export { resolveConfig, defaultParsePath, } from "./config";
+export { authenticate, bearerToken, } from "./auth";
+export { parseScopes, authorizeScopes, moduleForPath, isFolderPath, isPublicDocument, ROOT_MODULE, } from "./scope";
+export { buildFolderModel, renderFolderDescription, hashSignature, FOLDER_DESCRIPTION_TYPE, FOLDER_DESCRIPTION_CONTEXT, } from "./folder";
+export { corsHeaders, preflightResponse, withCors, ALLOWED_METHODS, } from "./cors";
+export { remoteStorageLink, REMOTESTORAGE_REL, REMOTESTORAGE_VERSION, } from "./discovery";
+export { RemoteStorageLogEvent } from "./log";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,mBAAmB,EAA6B,MAAM,WAAW,CAAC;AAC3E,OAAO,EAAE,qBAAqB,EAA+B,MAAM,MAAM,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAEhD,OAAO,EACL,aAAa,EACb,gBAAgB,GAMjB,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,YAAY,EACZ,WAAW,GAIZ,MAAM,QAAQ,CAAC;AAEhB,OAAO,EACL,WAAW,EACX,eAAe,EACf,aAAa,EACb,YAAY,EACZ,gBAAgB,EAChB,WAAW,GAGZ,MAAM,SAAS,CAAC;AAEjB,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,aAAa,EACb,uBAAuB,EACvB,0BAA0B,GAM3B,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,QAAQ,EACR,eAAe,GAChB,MAAM,QAAQ,CAAC;AAEhB,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,qBAAqB,GAEtB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,qBAAqB,EAAE,MAAM,OAAO,CAAC"}

package/dist/jwt.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Minimal JWT decode and JWKS-based signature verification for the built-in
+ * bearer-token verifier.
+ *
+ * remoteStorage uses **plain OAuth 2.0 bearer tokens** (no DPoP); a deployment
+ * that issues self-contained JWT access tokens can have this package verify them
+ * directly against the issuer's public JWKS. The module decodes the compact JWS,
+ * selects the key by `kid`/`kty`, and verifies with Web Crypto; claim policy
+ * (issuer/audience/expiry/`scope`) lives in `auth.ts`.
+ *
+ * Only asymmetric algorithms are accepted. `HS*` and `none` are refused: an
+ * access token must be signed by the issuer's private key, never a symmetric
+ * secret a resource server could not safely hold.
+ */
+/** Asymmetric JOSE algorithms accepted for issuer-signed access tokens. */
+export type JwtAlgorithm = "ES256" | "ES384" | "RS256" | "PS256";
+/** A decoded JWT: its header, claims, and the raw segments for verification. */
+export interface DecodedJwt {
+    readonly header: Record<string, unknown>;
+    readonly payload: Record<string, unknown>;
+    readonly signingInput: string;
+    readonly signature: Uint8Array;
+}
+/**
+ * Decode a compact JWS into its header, payload, and signature. Returns `null`
+ * for anything that is not three base64url segments with JSON header/payload.
+ */
+export declare function decodeJwt(token: string): DecodedJwt | null;
+/**
+ * Verify `decoded`'s signature against a JWKS. Selects the verification key by
+ * `kid` when the header carries one, otherwise tries every key compatible with
+ * the header `alg`. Returns `true` on the first key that verifies.
+ */
+export declare function verifyJwtSignature(decoded: DecodedJwt, jwks: readonly JsonWebKey[]): Promise<boolean>;
+//# sourceMappingURL=jwt.d.ts.map

package/dist/jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../src/jwt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,2EAA2E;AAC3E,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;AAqCjE,gFAAgF;AAChF,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;CAChC;AAMD;;;GAGG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAsB1D;AASD;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,UAAU,EACnB,IAAI,EAAE,SAAS,UAAU,EAAE,GAC1B,OAAO,CAAC,OAAO,CAAC,CA4ClB"}