@krizaka/storage 0.0.0-stage → 0.3.0

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -1,3 +1,26 @@
-# Temporary Holding Version
+# @krizaka/storage
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Files behind one port for every Krizaka product. The port is named by what it does (`ObjectStore`), the provider is a value the admin chooses. No vendor SDK (plain HTTP through an injected `fetch`), no environment variable, no wall clock.
+
+- **The port.** `put`, `get`, `head`, `delete`, `list(prefix)`, `signedUrl(key, ttl)` for a private zone, `publicUrl(key)` when a pull zone or CDN exists.
+- **Adapters.** `remoteStore` (an HTTP zone with the shape of Bunny Storage: `AccessKey` header, `PUT`/`GET`/`DELETE`, a directory listed by its path with a trailing slash, a pull zone with token-signed links), `bucketStore` (any S3-compatible service: Signature V4, presigned GET, `ListObjectsV2`, no SDK), `folderStore` (a folder, for development, tests and the Mac apps; a key never leaves the root), `memoryObjectStore`. All run `objectStoreContract` (`@krizaka/storage/testkit`).
+- **Rules every upload obeys** (`createStorage`): the size limit is passed in, the prefix must be declared in a `defineLayout` (an unknown prefix is refused), the bytes are checked by magic number (`sniffType`: png, jpeg, gif, webp, pdf, mp4, webm, svg), never by the extension, and a declared type that contradicts the bytes is refused. The stored name is content-hashed, `<name>.<sha10>.<ext>`, so a URL never changes content.
+- **The admin chooses** (`@krizaka/storage/settings`): `storage.provider` (`local`, `http`, `s3`), `storage.maxMegabytes`, `storage.signedUrlSeconds`, and the non-secret coordinates (`endpoint`, `region`, `bucket`, `zone`, `prefix`, `pullHostname`, `publicBaseUrl`). Keys stay in the environment; `storeFromSettings` takes them as parameters and refuses a provider chosen without what it needs, instead of falling back to another. An admin-typed S3 endpoint goes through `checkEndpoint` (https only, no credentials, no local or private address).
+- **Encryption at rest, the vault, regions and `where`.** `encryptedStore(inner, key)` (AES-256-GCM over any `ObjectStore`; the key is a parameter; the provider holds ciphertext; no link is handed out), `seal`/`open` (credentials in the database, `v1.` envelope), `COUNTRY_OF_REGION` (the one region table: an unlisted region is never a country; `residencyOfConfig` says « canada » only when the region and the endpoint agree, never for a Bunny-shaped zone), `where(kind, active, { fixed, devOnly })` and `storageNotice` (the sentence key of the info panel, from the configuration).
+- **Admin over environment** (`@krizaka/storage/resolve`). `resolveStorage(env, admin)` serves every kind of data (documents, avatars: pass each its own `DeploymentStorage`): the admin's `storage.*` wins, the environment gives the secrets and the fallback when the admin left `local`. If the environment says `none` and the admin turns keeping on, it throws `StorageError` `STORAGE_KEEPING_OFF` (call it when saving the setting to refuse early): keeping is turned on in the environment, never by a setting alone. `openResolved` builds the store, encrypted when a key is given.
+- **Signatures.** SigV4 is checked against AWS's published vectors. The token form of the HTTP zone's signed links (SHA-256 of key + path + expires, URL-safe base64) is the one Yomizaka and Orochia run against Bunny's pull zones; Bunny's documentation publishes no expected output for it.
+
+```ts
+import { createStorage, defineLayout, folderStore } from "@krizaka/storage";
+import { limitsOf, readStorageSettings, storeFromSettings } from "@krizaka/storage/settings";
+
+const settings = await readStorageSettings((key) => service.get(key, ctx));
+const storage = createStorage({
+  store: storeFromSettings(settings, { accessKeyId: env.MEDIA_STORAGE_ACCESS_KEY_ID, secretAccessKey: env.MEDIA_STORAGE_SECRET }, { fetch, clock }),
+  layout: defineLayout(["people/", "site/home/"]),
+  limits: () => readStorageSettings(read).then(limitsOf),
+});
+const { key, url } = await storage.upload({ prefix: "people/", name: "ana.jpg", bytes, allow: ["image/jpeg", "image/png"], declaredType: file.type });
+```
+
+Apache-2.0.

package/dist/chunk-C3LEYKGC.js

@@ -0,0 +1,149 @@
+import {
+  STORAGE_CODE,
+  StorageError,
+  assertKey
+} from "./chunk-W56662PQ.js";
+
+// src/encrypted-store.ts
+import { createCipheriv, createDecipheriv, randomBytes } from "crypto";
+
+// src/secret-key.ts
+var KEY_BYTES = 32;
+function parseSecretKey(base64, what) {
+  const key = Uint8Array.from(Buffer.from(base64, "base64"));
+  if (key.length !== KEY_BYTES) throw new StorageError(STORAGE_CODE.badSecretKey, `${what} must be ${KEY_BYTES} bytes in base64`);
+  return key;
+}
+
+// src/encrypted-store.ts
+var VERSION = 1;
+var IV_BYTES = 12;
+var TAG_BYTES = 16;
+var HEADER_BYTES = 1 + IV_BYTES + TAG_BYTES;
+var parseEncryptionKey = (base64) => parseSecretKey(base64, "The encryption key");
+function encryptedStore(inner, key) {
+  if (key.length !== 32) throw new StorageError(STORAGE_CODE.badSecretKey, "The encryption key must be 32 bytes");
+  const store = {
+    async put(k, bytes, meta) {
+      assertKey(k);
+      const iv = randomBytes(IV_BYTES);
+      const cipher = createCipheriv("aes-256-gcm", key, iv);
+      cipher.setAAD(Buffer.from(k));
+      const type = Buffer.from(meta.contentType);
+      const head = Buffer.alloc(2);
+      head.writeUInt16BE(type.length);
+      const body = Buffer.concat([cipher.update(Buffer.concat([head, type, bytes])), cipher.final()]);
+      await inner.put(k, Buffer.concat([Buffer.from([VERSION]), iv, cipher.getAuthTag(), body]), { contentType: "application/octet-stream" });
+    },
+    async get(k) {
+      assertKey(k);
+      const found = await inner.get(k);
+      if (!found) return null;
+      const raw = Buffer.from(found.bytes);
+      if (raw.length < HEADER_BYTES || raw[0] !== VERSION) throw new StorageError(STORAGE_CODE.unreadable, "Unreadable stored object");
+      try {
+        const decipher = createDecipheriv("aes-256-gcm", key, raw.subarray(1, 1 + IV_BYTES));
+        decipher.setAAD(Buffer.from(k));
+        decipher.setAuthTag(raw.subarray(1 + IV_BYTES, HEADER_BYTES));
+        const plain = Buffer.concat([decipher.update(raw.subarray(HEADER_BYTES)), decipher.final()]);
+        const typeLength = plain.readUInt16BE(0);
+        return { contentType: plain.subarray(2, 2 + typeLength).toString(), bytes: new Uint8Array(plain.subarray(2 + typeLength)) };
+      } catch {
+        throw new StorageError(STORAGE_CODE.unreadable, "The stored object failed its integrity check");
+      }
+    },
+    // The size of the plain file, read by opening it; `list` shows what the provider holds (ciphertext sizes).
+    async head(k) {
+      const found = await store.get(k);
+      return found ? { key: k, size: found.bytes.byteLength } : null;
+    },
+    delete: (k) => inner.delete(assertKey(k)),
+    list: (prefix) => inner.list(prefix),
+    signedUrl: async () => null,
+    publicUrl: () => null
+  };
+  return store;
+}
+
+// src/regions.ts
+var COUNTRY_OF_REGION = {
+  // DigitalOcean (App Platform `tor`, managed databases and Spaces `tor1`): Toronto.
+  tor: "CA",
+  tor1: "CA",
+  // AWS, Oracle and Azure Canadian regions.
+  "ca-central-1": "CA",
+  "ca-west-1": "CA",
+  "ca-central": "CA",
+  "ca-east": "CA",
+  "ca-toronto-1": "CA",
+  "ca-montreal-1": "CA",
+  "canada-central": "CA",
+  canadacentral: "CA",
+  canadaeast: "CA",
+  // OVHcloud Beauharnois (Québec).
+  bhs: "CA",
+  // Bunny Storage zones (`<region>.storage.bunnycdn.com`): none is Canadian.
+  ny: "US",
+  la: "US",
+  de: "DE",
+  uk: "GB",
+  sg: "SG",
+  se: "SE",
+  // DigitalOcean regions a product might use later.
+  nyc3: "US",
+  sfo3: "US",
+  ams3: "NL",
+  fra1: "DE",
+  lon1: "GB",
+  sgp1: "SG",
+  blr1: "IN",
+  syd1: "AU"
+};
+var countryOf = (region) => COUNTRY_OF_REGION[region.trim().toLowerCase()];
+var residencyOf = (region) => countryOf(region) === "CA" ? "canada" : "elsewhere";
+function residencyOfConfig(config) {
+  if (config.provider === "http") return "elsewhere";
+  const host = config.endpoint.replace(/^[a-z]+:\/\//i, "").split("/")[0]?.toLowerCase() ?? "";
+  const labels = host.split(".").filter((label) => countryOf(label) !== void 0);
+  if (labels.some((label) => countryOf(label) !== "CA")) return "elsewhere";
+  return residencyOf(config.region);
+}
+
+// src/where.ts
+var STORE_KIND = { none: "none", device: "device" };
+function describeStore(config, options) {
+  const owner = options.owner ?? "krizaka";
+  if (config.provider === "http") return { kind: options.httpKind ?? "http", endpoint: config.endpoint, region: null, residency: "elsewhere", encrypted: options.encrypted, owner, devOnly: true };
+  return { kind: "s3", endpoint: new URL(config.endpoint).host, region: config.region, residency: residencyOfConfig(config), encrypted: options.encrypted, owner, devOnly: false };
+}
+function where(kind, active, options = {}) {
+  const fixed = options.fixed?.[kind];
+  if (fixed) return fixed;
+  if (kind === STORE_KIND.none) return { ...active, kind, endpoint: null, region: null, residency: "unknown", encrypted: false, devOnly: false };
+  if (kind === STORE_KIND.device) return { kind, endpoint: null, region: null, residency: "device", encrypted: false, owner: "device", devOnly: false };
+  if (kind === active.kind) return active;
+  return { kind, endpoint: null, region: null, residency: "unknown", encrypted: false, owner: "krizaka", devOnly: options.devOnly?.includes(kind) ?? false };
+}
+function storageNotice(d) {
+  if (d.kind === STORE_KIND.none) return { key: "none", vars: {} };
+  if (d.kind === STORE_KIND.device) return { key: "device", vars: {} };
+  if (d.devOnly) return { key: "devOnly", vars: {} };
+  if (d.owner === "workspace") return { key: "workspace", vars: { endpoint: d.endpoint ?? "", region: d.region ?? "" } };
+  if (d.residency === "canada") return { key: d.encrypted ? "krizakaCanadaEncrypted" : "krizakaCanada", vars: {} };
+  return { key: "krizakaElsewhere", vars: { region: d.region ?? "" } };
+}
+
+export {
+  parseSecretKey,
+  parseEncryptionKey,
+  encryptedStore,
+  COUNTRY_OF_REGION,
+  countryOf,
+  residencyOf,
+  residencyOfConfig,
+  STORE_KIND,
+  describeStore,
+  where,
+  storageNotice
+};
+//# sourceMappingURL=chunk-C3LEYKGC.js.map

package/dist/chunk-C3LEYKGC.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/encrypted-store.ts","../src/secret-key.ts","../src/regions.ts","../src/where.ts"],"sourcesContent":["import { createCipheriv, createDecipheriv, randomBytes } from \"node:crypto\";\n\nimport { assertKey } from \"./keys\";\nimport { type ObjectStore, STORAGE_CODE, StorageError } from \"./port\";\nimport { parseSecretKey } from \"./secret-key\";\n\nconst VERSION = 1;\nconst IV_BYTES = 12;\nconst TAG_BYTES = 16;\nconst HEADER_BYTES = 1 + IV_BYTES + TAG_BYTES;\n\n/** The 32-byte AES key of the encryption at rest, from its base64 form (the owner's key, passed in as a parameter). */\nexport const parseEncryptionKey = (base64: string): Uint8Array => parseSecretKey(base64, \"The encryption key\");\n\n/**\n * Encryption at rest over any `ObjectStore` (AES-256-GCM, a fresh IV per object, the object's key as authenticated data, so a file\n * moved under another name does not open). Envelope: `1 | iv(12) | tag(16) | ciphertext(contentTypeLength(2) | contentType | bytes)`.\n * The key comes in as a parameter (from the settings or the environment, read by the product's edge); the provider only ever holds\n * ciphertext. A link to ciphertext is useless to a browser, so `signedUrl` and `publicUrl` answer `null`: the application decrypts and serves.\n * @throws StorageError `STORAGE_UNREADABLE` when an object is not an envelope or fails its integrity check\n */\nexport function encryptedStore(inner: ObjectStore, key: Uint8Array): ObjectStore {\n  if (key.length !== 32) throw new StorageError(STORAGE_CODE.badSecretKey, \"The encryption key must be 32 bytes\");\n  const store: ObjectStore = {\n    async put(k, bytes, meta) {\n      assertKey(k);\n      const iv = randomBytes(IV_BYTES);\n      const cipher = createCipheriv(\"aes-256-gcm\", key, iv);\n      cipher.setAAD(Buffer.from(k));\n      const type = Buffer.from(meta.contentType);\n      const head = Buffer.alloc(2);\n      head.writeUInt16BE(type.length);\n      const body = Buffer.concat([cipher.update(Buffer.concat([head, type, bytes])), cipher.final()]);\n      await inner.put(k, Buffer.concat([Buffer.from([VERSION]), iv, cipher.getAuthTag(), body]), { contentType: \"application/octet-stream\" });\n    },\n    async get(k) {\n      assertKey(k);\n      const found = await inner.get(k);\n      if (!found) return null;\n      const raw = Buffer.from(found.bytes);\n      if (raw.length < HEADER_BYTES || raw[0] !== VERSION) throw new StorageError(STORAGE_CODE.unreadable, \"Unreadable stored object\");\n      try {\n        const decipher = createDecipheriv(\"aes-256-gcm\", key, raw.subarray(1, 1 + IV_BYTES));\n        decipher.setAAD(Buffer.from(k));\n        decipher.setAuthTag(raw.subarray(1 + IV_BYTES, HEADER_BYTES));\n        const plain = Buffer.concat([decipher.update(raw.subarray(HEADER_BYTES)), decipher.final()]);\n        const typeLength = plain.readUInt16BE(0);\n        return { contentType: plain.subarray(2, 2 + typeLength).toString(), bytes: new Uint8Array(plain.subarray(2 + typeLength)) };\n      } catch {\n        throw new StorageError(STORAGE_CODE.unreadable, \"The stored object failed its integrity check\");\n      }\n    },\n    // The size of the plain file, read by opening it; `list` shows what the provider holds (ciphertext sizes).\n    async head(k) {\n      const found = await store.get(k);\n      return found ? { key: k, size: found.bytes.byteLength } : null;\n    },\n    delete: (k) => inner.delete(assertKey(k)),\n    list: (prefix) => inner.list(prefix),\n    signedUrl: async () => null,\n    publicUrl: () => null,\n  };\n  return store;\n}\n","import { STORAGE_CODE, StorageError } from \"./port\";\n\nconst KEY_BYTES = 32;\n\n/** A 32-byte key given in base64 (the form an environment variable or a secret manager holds). Anything else is refused: no weaker key is ever made up. */\nexport function parseSecretKey(base64: string, what: string): Uint8Array {\n  const key = Uint8Array.from(Buffer.from(base64, \"base64\"));\n  if (key.length !== KEY_BYTES) throw new StorageError(STORAGE_CODE.badSecretKey, `${what} must be ${KEY_BYTES} bytes in base64`);\n  return key;\n}\n","/**\n * The country of each provider region (data: a new region is a line here, one table for every product, ADR-010). A region not listed\n * is unknown: nothing claims a country for it, and the generated residency text never says « Canada » for it.\n */\nexport const COUNTRY_OF_REGION: Readonly<Record<string, string>> = {\n  // DigitalOcean (App Platform `tor`, managed databases and Spaces `tor1`): Toronto.\n  tor: \"CA\",\n  tor1: \"CA\",\n  // AWS, Oracle and Azure Canadian regions.\n  \"ca-central-1\": \"CA\",\n  \"ca-west-1\": \"CA\",\n  \"ca-central\": \"CA\",\n  \"ca-east\": \"CA\",\n  \"ca-toronto-1\": \"CA\",\n  \"ca-montreal-1\": \"CA\",\n  \"canada-central\": \"CA\",\n  canadacentral: \"CA\",\n  canadaeast: \"CA\",\n  // OVHcloud Beauharnois (Québec).\n  bhs: \"CA\",\n  // Bunny Storage zones (`<region>.storage.bunnycdn.com`): none is Canadian.\n  ny: \"US\",\n  la: \"US\",\n  de: \"DE\",\n  uk: \"GB\",\n  sg: \"SG\",\n  se: \"SE\",\n  // DigitalOcean regions a product might use later.\n  nyc3: \"US\",\n  sfo3: \"US\",\n  ams3: \"NL\",\n  fra1: \"DE\",\n  lon1: \"GB\",\n  sgp1: \"SG\",\n  blr1: \"IN\",\n  syd1: \"AU\",\n};\n\nexport type Residency = \"canada\" | \"elsewhere\";\n\n/** The ISO country of a provider region, or undefined when the region is not mapped. */\nexport const countryOf = (region: string): string | undefined => COUNTRY_OF_REGION[region.trim().toLowerCase()];\n\n/** Canada only when the table says so; an unmapped region is « elsewhere », never a guess in Canada's favour. */\nexport const residencyOf = (region: string): Residency => (countryOf(region) === \"CA\" ? \"canada\" : \"elsewhere\");\n\n/**\n * Residency of a configured store: the region AND the endpoint have to agree. A host that names a known region\n * (`nyc3.digitaloceanspaces.com`, `ny.storage.bunnycdn.com`) in another country than the region setting is the contradiction that\n * would let a text claim Canada falsely, so any known region label of the host that is not Canadian makes the answer « elsewhere ».\n * A Bunny-shaped zone (`http`) has no Canadian region, so it is never « canada ».\n */\nexport function residencyOfConfig(config: { provider: \"http\" | \"s3\"; endpoint: string; region: string }): Residency {\n  if (config.provider === \"http\") return \"elsewhere\";\n  const host = config.endpoint.replace(/^[a-z]+:\\/\\//i, \"\").split(\"/\")[0]?.toLowerCase() ?? \"\";\n  const labels = host.split(\".\").filter((label) => countryOf(label) !== undefined);\n  if (labels.some((label) => countryOf(label) !== \"CA\")) return \"elsewhere\";\n  return residencyOf(config.region);\n}\n","import { type Residency, residencyOfConfig } from \"./regions\";\n\n/** The two kinds every product shares; the others are the product's. */\nexport const STORE_KIND = { none: \"none\", device: \"device\" } as const;\n\n/** Whose store it is: Krizaka's (the deployment's), the workspace's own, or the person's device. */\nexport type StoreOwner = \"krizaka\" | \"workspace\" | \"device\";\n\n/** Where objects live, as the product says it: computed from the configuration, never typed. */\nexport interface StoreDescriptor {\n  /** The product's name for the store (`s3`, `bunny`, `database`, `none`, `device`…). */\n  kind: string;\n  endpoint: string | null;\n  region: string | null;\n  residency: Residency | \"unknown\" | \"device\";\n  encrypted: boolean;\n  owner: StoreOwner;\n  /** For fictional and development data only: the notice says so instead of claiming a place. */\n  devOnly: boolean;\n}\n\n/** The descriptor of a configured store, from its configuration alone (see `residencyOfConfig`: a Bunny-shaped zone is dev only and never Canadian). */\nexport function describeStore(config: { provider: \"http\" | \"s3\"; endpoint: string; region: string }, options: { encrypted: boolean; owner?: StoreOwner; httpKind?: string }): StoreDescriptor {\n  const owner = options.owner ?? \"krizaka\";\n  if (config.provider === \"http\") return { kind: options.httpKind ?? \"http\", endpoint: config.endpoint, region: null, residency: \"elsewhere\", encrypted: options.encrypted, owner, devOnly: true };\n  return { kind: \"s3\", endpoint: new URL(config.endpoint).host, region: config.region, residency: residencyOfConfig(config), encrypted: options.encrypted, owner, devOnly: false };\n}\n\nexport interface WhereOptions {\n  /** Stores that are not configurable but fixed places (Yomizaka's managed database in Toronto), by kind. */\n  fixed?: Readonly<Record<string, StoreDescriptor>>;\n  /** Kinds that exist only for development data. */\n  devOnly?: readonly string[];\n}\n\n/**\n * Where an object lives, from the store kind recorded with it and the store configured now. True at every moment, per object:\n * a fixed place says what it is; `none` and `device` say so; the active store answers for its own kind; any other kind (a store\n * no longer configured) says only its kind, with an unknown residency, so nothing is claimed that nothing proves.\n */\nexport function where(kind: string, active: StoreDescriptor, options: WhereOptions = {}): StoreDescriptor {\n  const fixed = options.fixed?.[kind];\n  if (fixed) return fixed;\n  if (kind === STORE_KIND.none) return { ...active, kind, endpoint: null, region: null, residency: \"unknown\", encrypted: false, devOnly: false };\n  if (kind === STORE_KIND.device) return { kind, endpoint: null, region: null, residency: \"device\", encrypted: false, owner: \"device\", devOnly: false };\n  if (kind === active.kind) return active;\n  return { kind, endpoint: null, region: null, residency: \"unknown\", encrypted: false, owner: \"krizaka\", devOnly: options.devOnly?.includes(kind) ?? false };\n}\n\nexport type NoticeKey = \"none\" | \"krizakaCanadaEncrypted\" | \"krizakaCanada\" | \"krizakaElsewhere\" | \"workspace\" | \"devOnly\" | \"device\";\n\n/** Which sentence says where this object lives (« Not kept », « Kept: Krizaka (Canada, encrypted) »…), with its variables; the product's messages hold the words. */\nexport function storageNotice(d: StoreDescriptor): { key: NoticeKey; vars: Record<string, string> } {\n  if (d.kind === STORE_KIND.none) return { key: \"none\", vars: {} };\n  if (d.kind === STORE_KIND.device) return { key: \"device\", vars: {} };\n  if (d.devOnly) return { key: \"devOnly\", vars: {} };\n  if (d.owner === \"workspace\") return { key: \"workspace\", vars: { endpoint: d.endpoint ?? \"\", region: d.region ?? \"\" } };\n  if (d.residency === \"canada\") return { key: d.encrypted ? \"krizakaCanadaEncrypted\" : \"krizakaCanada\", vars: {} };\n  return { key: \"krizakaElsewhere\", vars: { region: d.region ?? \"\" } };\n}\n"],"mappings":";;;;;;;AAAA,SAAS,gBAAgB,kBAAkB,mBAAmB;;;ACE9D,IAAM,YAAY;AAGX,SAAS,eAAe,QAAgB,MAA0B;AACvE,QAAM,MAAM,WAAW,KAAK,OAAO,KAAK,QAAQ,QAAQ,CAAC;AACzD,MAAI,IAAI,WAAW,UAAW,OAAM,IAAI,aAAa,aAAa,cAAc,GAAG,IAAI,YAAY,SAAS,kBAAkB;AAC9H,SAAO;AACT;;;ADHA,IAAM,UAAU;AAChB,IAAM,WAAW;AACjB,IAAM,YAAY;AAClB,IAAM,eAAe,IAAI,WAAW;AAG7B,IAAM,qBAAqB,CAAC,WAA+B,eAAe,QAAQ,oBAAoB;AAStG,SAAS,eAAe,OAAoB,KAA8B;AAC/E,MAAI,IAAI,WAAW,GAAI,OAAM,IAAI,aAAa,aAAa,cAAc,qCAAqC;AAC9G,QAAM,QAAqB;AAAA,IACzB,MAAM,IAAI,GAAG,OAAO,MAAM;AACxB,gBAAU,CAAC;AACX,YAAM,KAAK,YAAY,QAAQ;AAC/B,YAAM,SAAS,eAAe,eAAe,KAAK,EAAE;AACpD,aAAO,OAAO,OAAO,KAAK,CAAC,CAAC;AAC5B,YAAM,OAAO,OAAO,KAAK,KAAK,WAAW;AACzC,YAAM,OAAO,OAAO,MAAM,CAAC;AAC3B,WAAK,cAAc,KAAK,MAAM;AAC9B,YAAM,OAAO,OAAO,OAAO,CAAC,OAAO,OAAO,OAAO,OAAO,CAAC,MAAM,MAAM,KAAK,CAAC,CAAC,GAAG,OAAO,MAAM,CAAC,CAAC;AAC9F,YAAM,MAAM,IAAI,GAAG,OAAO,OAAO,CAAC,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,aAAa,2BAA2B,CAAC;AAAA,IACxI;AAAA,IACA,MAAM,IAAI,GAAG;AACX,gBAAU,CAAC;AACX,YAAM,QAAQ,MAAM,MAAM,IAAI,CAAC;AAC/B,UAAI,CAAC,MAAO,QAAO;AACnB,YAAM,MAAM,OAAO,KAAK,MAAM,KAAK;AACnC,UAAI,IAAI,SAAS,gBAAgB,IAAI,CAAC,MAAM,QAAS,OAAM,IAAI,aAAa,aAAa,YAAY,0BAA0B;AAC/H,UAAI;AACF,cAAM,WAAW,iBAAiB,eAAe,KAAK,IAAI,SAAS,GAAG,IAAI,QAAQ,CAAC;AACnF,iBAAS,OAAO,OAAO,KAAK,CAAC,CAAC;AAC9B,iBAAS,WAAW,IAAI,SAAS,IAAI,UAAU,YAAY,CAAC;AAC5D,cAAM,QAAQ,OAAO,OAAO,CAAC,SAAS,OAAO,IAAI,SAAS,YAAY,CAAC,GAAG,SAAS,MAAM,CAAC,CAAC;AAC3F,cAAM,aAAa,MAAM,aAAa,CAAC;AACvC,eAAO,EAAE,aAAa,MAAM,SAAS,GAAG,IAAI,UAAU,EAAE,SAAS,GAAG,OAAO,IAAI,WAAW,MAAM,SAAS,IAAI,UAAU,CAAC,EAAE;AAAA,MAC5H,QAAQ;AACN,cAAM,IAAI,aAAa,aAAa,YAAY,8CAA8C;AAAA,MAChG;AAAA,IACF;AAAA;AAAA,IAEA,MAAM,KAAK,GAAG;AACZ,YAAM,QAAQ,MAAM,MAAM,IAAI,CAAC;AAC/B,aAAO,QAAQ,EAAE,KAAK,GAAG,MAAM,MAAM,MAAM,WAAW,IAAI;AAAA,IAC5D;AAAA,IACA,QAAQ,CAAC,MAAM,MAAM,OAAO,UAAU,CAAC,CAAC;AAAA,IACxC,MAAM,CAAC,WAAW,MAAM,KAAK,MAAM;AAAA,IACnC,WAAW,YAAY;AAAA,IACvB,WAAW,MAAM;AAAA,EACnB;AACA,SAAO;AACT;;;AE3DO,IAAM,oBAAsD;AAAA;AAAA,EAEjE,KAAK;AAAA,EACL,MAAM;AAAA;AAAA,EAEN,gBAAgB;AAAA,EAChB,aAAa;AAAA,EACb,cAAc;AAAA,EACd,WAAW;AAAA,EACX,gBAAgB;AAAA,EAChB,iBAAiB;AAAA,EACjB,kBAAkB;AAAA,EAClB,eAAe;AAAA,EACf,YAAY;AAAA;AAAA,EAEZ,KAAK;AAAA;AAAA,EAEL,IAAI;AAAA,EACJ,IAAI;AAAA,EACJ,IAAI;AAAA,EACJ,IAAI;AAAA,EACJ,IAAI;AAAA,EACJ,IAAI;AAAA;AAAA,EAEJ,MAAM;AAAA,EACN,MAAM;AAAA,EACN,MAAM;AAAA,EACN,MAAM;AAAA,EACN,MAAM;AAAA,EACN,MAAM;AAAA,EACN,MAAM;AAAA,EACN,MAAM;AACR;AAKO,IAAM,YAAY,CAAC,WAAuC,kBAAkB,OAAO,KAAK,EAAE,YAAY,CAAC;AAGvG,IAAM,cAAc,CAAC,WAA+B,UAAU,MAAM,MAAM,OAAO,WAAW;AAQ5F,SAAS,kBAAkB,QAAkF;AAClH,MAAI,OAAO,aAAa,OAAQ,QAAO;AACvC,QAAM,OAAO,OAAO,SAAS,QAAQ,iBAAiB,EAAE,EAAE,MAAM,GAAG,EAAE,CAAC,GAAG,YAAY,KAAK;AAC1F,QAAM,SAAS,KAAK,MAAM,GAAG,EAAE,OAAO,CAAC,UAAU,UAAU,KAAK,MAAM,MAAS;AAC/E,MAAI,OAAO,KAAK,CAAC,UAAU,UAAU,KAAK,MAAM,IAAI,EAAG,QAAO;AAC9D,SAAO,YAAY,OAAO,MAAM;AAClC;;;ACvDO,IAAM,aAAa,EAAE,MAAM,QAAQ,QAAQ,SAAS;AAmBpD,SAAS,cAAc,QAAuE,SAAyF;AAC5L,QAAM,QAAQ,QAAQ,SAAS;AAC/B,MAAI,OAAO,aAAa,OAAQ,QAAO,EAAE,MAAM,QAAQ,YAAY,QAAQ,UAAU,OAAO,UAAU,QAAQ,MAAM,WAAW,aAAa,WAAW,QAAQ,WAAW,OAAO,SAAS,KAAK;AAC/L,SAAO,EAAE,MAAM,MAAM,UAAU,IAAI,IAAI,OAAO,QAAQ,EAAE,MAAM,QAAQ,OAAO,QAAQ,WAAW,kBAAkB,MAAM,GAAG,WAAW,QAAQ,WAAW,OAAO,SAAS,MAAM;AACjL;AAcO,SAAS,MAAM,MAAc,QAAyB,UAAwB,CAAC,GAAoB;AACxG,QAAM,QAAQ,QAAQ,QAAQ,IAAI;AAClC,MAAI,MAAO,QAAO;AAClB,MAAI,SAAS,WAAW,KAAM,QAAO,EAAE,GAAG,QAAQ,MAAM,UAAU,MAAM,QAAQ,MAAM,WAAW,WAAW,WAAW,OAAO,SAAS,MAAM;AAC7I,MAAI,SAAS,WAAW,OAAQ,QAAO,EAAE,MAAM,UAAU,MAAM,QAAQ,MAAM,WAAW,UAAU,WAAW,OAAO,OAAO,UAAU,SAAS,MAAM;AACpJ,MAAI,SAAS,OAAO,KAAM,QAAO;AACjC,SAAO,EAAE,MAAM,UAAU,MAAM,QAAQ,MAAM,WAAW,WAAW,WAAW,OAAO,OAAO,WAAW,SAAS,QAAQ,SAAS,SAAS,IAAI,KAAK,MAAM;AAC3J;AAKO,SAAS,cAAc,GAAsE;AAClG,MAAI,EAAE,SAAS,WAAW,KAAM,QAAO,EAAE,KAAK,QAAQ,MAAM,CAAC,EAAE;AAC/D,MAAI,EAAE,SAAS,WAAW,OAAQ,QAAO,EAAE,KAAK,UAAU,MAAM,CAAC,EAAE;AACnE,MAAI,EAAE,QAAS,QAAO,EAAE,KAAK,WAAW,MAAM,CAAC,EAAE;AACjD,MAAI,EAAE,UAAU,YAAa,QAAO,EAAE,KAAK,aAAa,MAAM,EAAE,UAAU,EAAE,YAAY,IAAI,QAAQ,EAAE,UAAU,GAAG,EAAE;AACrH,MAAI,EAAE,cAAc,SAAU,QAAO,EAAE,KAAK,EAAE,YAAY,2BAA2B,iBAAiB,MAAM,CAAC,EAAE;AAC/G,SAAO,EAAE,KAAK,oBAAoB,MAAM,EAAE,QAAQ,EAAE,UAAU,GAAG,EAAE;AACrE;","names":[]}