@riloservices/base 0.0.0-stage → 0.1.0

package/dist/index.mjs

@@ -0,0 +1,121 @@
+import { n as RiloFilesError, r as RiloKeyError, t as resolveTarget } from "./key-B7koHuaE.mjs";
+import { MongoClient } from "mongodb";
+// src/files.ts
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** One part of a path through `encodeURIComponent`, plus the `!'()*` it leaves as they are. */
+function encodeSegment(segment) {
+	return encodeURIComponent(segment).replace(/[!'()*]/g, (character) => `%${character.charCodeAt(0).toString(16).toUpperCase()}`);
+}
+/** A file path as it goes in a URL: each part encoded, the slashes between them kept. */
+function encodePath(path) {
+	return path.split("/").map(encodeSegment).join("/");
+}
+/** The Files API's `error` body, as a `RiloFilesError`. Anything that isn't one still gets a status. */
+async function toError(response) {
+	let error = {};
+	try {
+		const body = await response.json();
+		if (isRecord(body) && isRecord(body.error)) error = body.error;
+	} catch {}
+	const { code, message, details, fields } = error;
+	return new RiloFilesError({
+		status: response.status,
+		code: typeof code === "string" ? code : `http_${response.status}`,
+		message: typeof message === "string" ? message : `The Files API answered with status ${response.status}.`,
+		details: isRecord(details) ? details : null,
+		fields: isRecord(fields) ? fields : null
+	});
+}
+/**
+* The Files API client. `filesKey` is the `rdbf_…` part of the app key: it is the only secret that
+* is ever sent, and only in the `Authorization` header.
+*/
+function createFiles(baseUrl, filesKey) {
+	async function call(method, path, body) {
+		const headers = {
+			authorization: `Bearer ${filesKey}`,
+			accept: "application/json"
+		};
+		if (body !== void 0) headers["content-type"] = "application/json";
+		const response = await fetch(`${baseUrl}${path}`, {
+			method,
+			headers,
+			body: body === void 0 ? void 0 : JSON.stringify(body)
+		});
+		if (!response.ok) throw await toError(response);
+		if (response.status === 204) return void 0;
+		return response.json();
+	}
+	function bucket(name) {
+		const root = `/v1/buckets/${encodeURIComponent(name)}`;
+		async function makeLinks(target, options) {
+			const body = options?.expiresInSeconds === void 0 ? target : {
+				...target,
+				expiresInSeconds: options.expiresInSeconds
+			};
+			return (await call("POST", `${root}/links`, body)).links;
+		}
+		return {
+			createUpload: async (body) => await call("POST", `${root}/uploads`, body),
+			cancelUpload: async (uploadId) => {
+				await call("DELETE", `/v1/uploads/${encodeURIComponent(uploadId)}`);
+			},
+			link: async (path, options) => {
+				const [link] = await makeLinks({ path }, options);
+				if (link === void 0) throw new Error("The Files API answered without a link.");
+				return link;
+			},
+			links: (paths, options) => makeLinks({ paths }, options),
+			list: async (query = {}) => {
+				const params = new URLSearchParams();
+				if (query.prefix !== void 0) params.set("prefix", query.prefix);
+				if (query.delimiter !== void 0) params.set("delimiter", query.delimiter);
+				if (query.cursor !== void 0) params.set("cursor", query.cursor);
+				if (query.limit !== void 0) params.set("limit", String(query.limit));
+				const search = params.size === 0 ? "" : `?${params.toString()}`;
+				return await call("GET", `${root}/files${search}`);
+			},
+			get: async (path) => await call("GET", `${root}/files/${encodePath(path)}`),
+			delete: async (path) => {
+				await call("DELETE", `${root}/files/${encodePath(path)}`);
+			}
+		};
+	}
+	return {
+		buckets: async () => await call("GET", "/v1/buckets"),
+		bucket
+	};
+}
+// src/index.ts
+const FILES_NEED_KEY = "Files needs your app key (RILO_KEY). A rilodb:// link holds only the database part.";
+/**
+* Turns an app key, or a `rilodb://` link, into everything an app needs. The app key (`rilo_…`)
+* works for databases and Files. A `rilodb://` link works for databases only, and brings its own
+* address and default database. Throws a `RiloKeyError` when the input is missing or is neither;
+* the message says what was given and never repeats it. Nothing connects until `db()` is first used.
+*/
+function createClient(keyOrLink, options = {}) {
+	const target = resolveTarget(keyOrLink, options);
+	const files = target.files === null ? null : createFiles(target.files.url, target.files.key);
+	let mongo;
+	return {
+		db(name) {
+			const database = name ?? options.database ?? target.database ?? void 0;
+			if (database === void 0 || database === "") throw new TypeError("Say which database to open: db(\"name\"), or give createClient a `database` option.");
+			mongo ??= new MongoClient(target.connectLink, options.appName === void 0 ? void 0 : { appName: options.appName });
+			return mongo.db(`${database}_${target.spaceId}`);
+		},
+		get files() {
+			if (files === null) throw new RiloKeyError(FILES_NEED_KEY);
+			return files;
+		},
+		async close() {
+			const open = mongo;
+			mongo = void 0;
+			await open?.close();
+		}
+	};
+}
+export { RiloFilesError, RiloKeyError, createClient };

package/dist/key-B7koHuaE.mjs

@@ -0,0 +1,272 @@
+// src/errors.ts
+/** The key or link is missing or isn't an app key or a `rilodb://` link. The message never repeats it. */
+var RiloKeyError = class extends Error {
+	name = "RiloKeyError";
+};
+/** What the Files API answers when a call fails: its `error` body, plus the HTTP status. */
+var RiloFilesError = class extends Error {
+	name = "RiloFilesError";
+	/** The HTTP status. */
+	status;
+	/** A stable name for the error, like `read_only_key`. Decide what to do from this. */
+	code;
+	/** Extra data for some codes, like `maxFileSize` on `file_too_large`. */
+	details;
+	/** On `validation_failed`: each field that needs fixing, with what to fix. */
+	fields;
+	constructor(init) {
+		super(init.message);
+		this.status = init.status;
+		this.code = init.code;
+		this.details = init.details ?? null;
+		this.fields = init.fields ?? null;
+	}
+};
+// ../shared/src/connect.ts
+/**
+* The fixed options of every link, in this order. `directConnection` keeps the driver talking only
+* to the Gateway; DocumentDB has no retryable writes; logins live in `admin`; `maxPoolSize=10`
+* fits 4 app instances in the Seed limit of 50, with 2 monitoring connections each (decision Q3).
+*/
+const CONNECT_OPTIONS = {
+	tls: true,
+	directConnection: true,
+	retryWrites: false,
+	authSource: "admin",
+	maxPoolSize: 10
+};
+// ../shared/src/logins.ts
+/**
+* The rule for a password the person chooses (step 11): 16 to 64 letters, digits, `-` and `_`.
+* These are the characters a `mongodb://` link carries without encoding. Rilo's own suggestion is
+* 24 random bytes in base64url (32 characters), which always passes.
+*/
+const LOGIN_PASSWORD = {
+	min: 16,
+	max: 64,
+	pattern: /^[A-Za-z0-9_-]+$/
+};
+// ../shared/src/regions.ts
+const REGION_CODES = ["in", "au"];
+const SPACE_ID_PATTERN = new RegExp(`^[bcdfghjkmnpqrstvwxz23456789]{8}$`);
+function isSpaceId(value) {
+	return SPACE_ID_PATTERN.test(value);
+}
+// ../shared/src/app-keys.ts
+/** Every app key starts with this, so people, scanners and the Files service recognise one. */
+const APP_KEY_PREFIX = "rilo_";
+/** The environment variable an app keeps its key in. */
+const APP_KEY_ENV_VAR = "RILO_KEY";
+/**
+* An app key's name is also its login's and its files key's name, so it follows both rules:
+* lowercase letters, digits and single hyphens, starting with a letter, 3 to 32 characters.
+*/
+const APP_KEY_NAME = {
+	min: 3,
+	max: 32,
+	pattern: /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/
+};
+/** The files secret: 32 random bytes in base64url, 43 characters. */
+const FILES_SECRET = /^[A-Za-z0-9_-]{43}$/;
+const IDENTITY = /^rilo_([a-z]+)_([a-z0-9]+)$/;
+/** What is wrong with an app key name, in plain words, or null. Nothing is trimmed or lowered. */
+function appKeyNameProblem(name) {
+	if (name === "") return "Enter a name for the key.";
+	if (name.trim() !== name) return "Remove the spaces at the start or end of the name.";
+	if (/\s/.test(name)) return "Use hyphens instead of spaces, like web-app.";
+	if (/[A-Z]/.test(name)) return "Use lowercase letters only, like web-app.";
+	if (!/^[a-z0-9-]+$/.test(name)) return "Use only lowercase letters, digits and hyphens.";
+	if (!/^[a-z]/.test(name)) return "Start the name with a letter.";
+	if (name.includes("--")) return "Use single hyphens, never two in a row.";
+	if (name.endsWith("-")) return "End the name with a letter or digit, not a hyphen.";
+	if (name.length < APP_KEY_NAME.min) return `Use at least ${APP_KEY_NAME.min} characters.`;
+	if (name.length > APP_KEY_NAME.max) return `Use ${APP_KEY_NAME.max} characters or fewer.`;
+	return null;
+}
+function isDatabaseSecret(value) {
+	return LOGIN_PASSWORD.pattern.test(value) && value.length >= LOGIN_PASSWORD.min && value.length <= LOGIN_PASSWORD.max;
+}
+function isRegion(value) {
+	return REGION_CODES.includes(value);
+}
+/**
+* The parts of an app key, or null when the text isn't exactly one. Strict: anything else, even
+* with the right prefix, is refused. It says nothing about whether the key is real.
+*/
+function parseAppKey(key) {
+	if (!key.startsWith("rilo_")) return null;
+	const pieces = key.split(".");
+	if (pieces.length !== 4) return null;
+	const [identity = "", name = "", databaseSecret = "", filesSecret = ""] = pieces;
+	const match = IDENTITY.exec(identity);
+	const region = match?.[1];
+	const spaceId = match?.[2];
+	if (region === void 0 || spaceId === void 0) return null;
+	if (!isRegion(region) || !isSpaceId(spaceId)) return null;
+	if (appKeyNameProblem(name) !== null) return null;
+	if (!isDatabaseSecret(databaseSecret) || !FILES_SECRET.test(filesSecret)) return null;
+	return {
+		region,
+		spaceId,
+		name,
+		databaseSecret,
+		filesSecret
+	};
+}
+/** The port every Space's databases answer on in production; a `rilodb://` link leaves it out. */
+const RILODB_DEFAULT_PORT = 27017;
+/** The `mongodb://` link MongoDB drivers and tools need, with the password in it. */
+function mongoLink(link) {
+	const options = Object.entries(CONNECT_OPTIONS).map(([key, value]) => `${key}=${value}`);
+	if (link.tlsCAFile) options.push(`tlsCAFile=${encodeURIComponent(link.tlsCAFile)}`);
+	const path = link.databaseRealName ? encodeURIComponent(link.databaseRealName) : "";
+	return `mongodb://${`${encodeURIComponent(link.loginRealName)}:${encodeURIComponent(link.password)}`}@${link.host}:${link.port}/${path}?${options.join("&")}`;
+}
+/** Everything an app needs from its key: the same values the Connect card shows. */
+function appKeyValues(parts, addresses, database) {
+	const loginRealName = `${parts.name}_${parts.spaceId}`;
+	const host = `${parts.spaceId}.${parts.region}.${addresses.spacesDomain}`;
+	return {
+		loginRealName,
+		filesKey: `rdbf_${parts.spaceId}_${parts.filesSecret}`,
+		host,
+		filesUrl: addresses.filesUrl,
+		connectLink: mongoLink({
+			loginRealName,
+			password: parts.databaseSecret,
+			host,
+			port: addresses.port,
+			databaseRealName: database ? `${database}_${parts.spaceId}` : null,
+			tlsCAFile: addresses.tlsCAFile
+		}),
+		rilodbLink: formatRilodbLink(parts, addresses, database)
+	};
+}
+/** A database name, as `DATABASE_NAME` in names.ts (repeated here to stay free of dependencies). */
+const DATABASE_NAME = /^[a-z][a-z0-9_-]{0,39}$/;
+const RESERVED_DATABASES = [
+	"admin",
+	"local",
+	"config"
+];
+/** The `rilodb://` link of a key, naming `database` when one is given. */
+function formatRilodbLink(parts, addresses, database) {
+	const port = addresses.port === 27017 ? "" : `:${addresses.port}`;
+	const host = `${parts.spaceId}.${parts.region}.${addresses.spacesDomain}${port}`;
+	const path = database ? encodeURIComponent(database) : "";
+	return `rilodb://${parts.name}:${parts.databaseSecret}@${host}/${path}`;
+}
+/** The parts of a `rilodb://` link, or null when the text isn't exactly one. Strict, like keys. */
+function parseRilodbLink(link) {
+	if (!link.startsWith(`rilodb://`)) return null;
+	let url;
+	try {
+		url = new URL(link);
+	} catch {
+		return null;
+	}
+	if (url.search !== "" || url.hash !== "") return null;
+	const name = decodeURIComponent(url.username);
+	const databaseSecret = decodeURIComponent(url.password);
+	if (appKeyNameProblem(name) !== null || !isDatabaseSecret(databaseSecret)) return null;
+	const [spaceId = "", region = "", ...domain] = url.hostname.split(".");
+	if (!isSpaceId(spaceId) || !isRegion(region) || domain.length < 2) return null;
+	const port = url.port === "" ? RILODB_DEFAULT_PORT : Number(url.port);
+	const path = decodeURIComponent(url.pathname.replace(/^\//, ""));
+	if (path !== "" && (!DATABASE_NAME.test(path) || RESERVED_DATABASES.includes(path))) return null;
+	return {
+		region,
+		spaceId,
+		name,
+		databaseSecret,
+		spacesDomain: domain.join("."),
+		port,
+		database: path === "" ? null : path
+	};
+}
+/** The `mongodb://` link a driver needs for a `rilodb://` link's parts. */
+function mongoLinkOfRilodb(parts, options = {}) {
+	return mongoLink({
+		loginRealName: `${parts.name}_${parts.spaceId}`,
+		password: parts.databaseSecret,
+		host: `${parts.spaceId}.${parts.region}.${parts.spacesDomain}`,
+		port: parts.port,
+		databaseRealName: parts.database ? `${parts.database}_${parts.spaceId}` : null,
+		tlsCAFile: options.tlsCAFile
+	});
+}
+const MISSING = `No app key was given. Set ${APP_KEY_ENV_VAR} to your app key from the App keys page of your Space, on your server, and pass it in.`;
+const MISSING_EITHER = `${MISSING} A rilodb:// link works too, for databases only.`;
+const FILES_KEY = `That is a files key (it starts with rdbf_), not an app key. Use the app key, which starts with ${APP_KEY_PREFIX}. It works for databases and Files.`;
+const MONGO_LINK = `That is a mongodb:// connect link, not an app key. Use the app key, which starts with ${APP_KEY_PREFIX}. It works for databases and Files. MongoDB drivers and tools use the mongodb:// link; this client reads the app key.`;
+const MONGO_LINK_EITHER = `That is a mongodb:// connect link, not an app key or a rilodb:// link. Use the app key, which starts with ${APP_KEY_PREFIX}, or the rilodb:// link. MongoDB drivers and tools use the mongodb:// link; this client reads the app key or the rilodb:// link.`;
+const RILODB_LINK = `That is a rilodb:// link, not an app key. This needs the app key (${APP_KEY_ENV_VAR}), which starts with ${APP_KEY_PREFIX}. A rilodb:// link holds only the database part.`;
+const MALFORMED = `That is not a valid app key. An app key starts with ${APP_KEY_PREFIX} and has four parts separated by dots. Copy the whole key again from the App keys page. A lost key can't be shown again, so reset it there.`;
+const MALFORMED_EITHER = `That is not a valid app key or rilodb:// link. An app key starts with ${APP_KEY_PREFIX} and has four parts separated by dots. Copy the whole key again from the App keys page. A lost key can't be shown again, so reset it there.`;
+const MALFORMED_RILODB_LINK = `That is not a valid rilodb:// link. It looks like rilodb://<key name>:<database secret>@<space>.<region>.<domain>/<database>. Copy the whole link again, or use your app key (${APP_KEY_ENV_VAR}). A lost key can't be shown again, so reset it on the App keys page.`;
+const isRilodbLink = (text) => /^rilodb:\/\//i.test(text);
+const isMongoLink = (text) => /^mongodb(\+srv)?:\/\//i.test(text);
+/** `parseRilodbLink`, with the one way it can still throw (a bad `%` escape) turned into null. */
+function readRilodbLink(text) {
+	try {
+		return parseRilodbLink(text);
+	} catch {
+		return null;
+	}
+}
+/**
+* The text of a key, trimmed, or a `RiloKeyError` that says what was given instead. `orLink` words
+* the refusals for a place that takes a `rilodb://` link too. No message repeats any of the input.
+*/
+function keyText(key, orLink) {
+	if (key === void 0 || key === null || typeof key === "string" && key.trim() === "") throw new RiloKeyError(orLink ? MISSING_EITHER : MISSING);
+	if (typeof key !== "string") throw new RiloKeyError(orLink ? MALFORMED_EITHER : MALFORMED);
+	const text = key.trim();
+	if (text.startsWith("rdbf_")) throw new RiloKeyError(FILES_KEY);
+	if (isMongoLink(text)) throw new RiloKeyError(orLink ? MONGO_LINK_EITHER : MONGO_LINK);
+	if (isRilodbLink(text)) throw new RiloKeyError(RILODB_LINK);
+	return text;
+}
+function resolveAppKey(text, orLink, options, database) {
+	const parts = parseAppKey(text);
+	if (parts === null) throw new RiloKeyError(orLink ? MALFORMED_EITHER : MALFORMED);
+	const spacesDomain = options.spacesDomain ?? "db.services.rilo.studio";
+	const filesUrl = (options.filesUrl ?? `https://files.${parts.region}.${spacesDomain}`).replace(/\/+$/, "");
+	return {
+		parts,
+		values: appKeyValues(parts, {
+			spacesDomain,
+			port: options.port ?? 27017,
+			filesUrl,
+			tlsCAFile: options.tlsCAFile
+		}, database)
+	};
+}
+/**
+* What an app key or a `rilodb://` link says, or a `RiloKeyError`. A link brings its own address
+* (`spacesDomain` and `port` come from it); only `tlsCAFile` still applies. The error says what was
+* given and what to give, and never contains any part of the input.
+*/
+function resolveTarget(input, options = {}) {
+	if (typeof input === "string" && isRilodbLink(input.trim())) {
+		const link = readRilodbLink(input.trim());
+		if (link === null) throw new RiloKeyError(MALFORMED_RILODB_LINK);
+		return {
+			connectLink: mongoLinkOfRilodb(link, { tlsCAFile: options.tlsCAFile }),
+			spaceId: link.spaceId,
+			database: link.database,
+			files: null
+		};
+	}
+	const { parts, values } = resolveAppKey(keyText(input, true), true, options);
+	return {
+		connectLink: values.connectLink,
+		spaceId: parts.spaceId,
+		database: null,
+		files: {
+			url: values.filesUrl,
+			key: values.filesKey
+		}
+	};
+}
+export { RiloFilesError as n, RiloKeyError as r, resolveTarget as t };

package/dist/key-DPXUxbGX.cjs

@@ -0,0 +1,289 @@
+// src/errors.ts
+/** The key or link is missing or isn't an app key or a `rilodb://` link. The message never repeats it. */
+var RiloKeyError = class extends Error {
+	name = "RiloKeyError";
+};
+/** What the Files API answers when a call fails: its `error` body, plus the HTTP status. */
+var RiloFilesError = class extends Error {
+	name = "RiloFilesError";
+	/** The HTTP status. */
+	status;
+	/** A stable name for the error, like `read_only_key`. Decide what to do from this. */
+	code;
+	/** Extra data for some codes, like `maxFileSize` on `file_too_large`. */
+	details;
+	/** On `validation_failed`: each field that needs fixing, with what to fix. */
+	fields;
+	constructor(init) {
+		super(init.message);
+		this.status = init.status;
+		this.code = init.code;
+		this.details = init.details ?? null;
+		this.fields = init.fields ?? null;
+	}
+};
+// ../shared/src/connect.ts
+/**
+* The fixed options of every link, in this order. `directConnection` keeps the driver talking only
+* to the Gateway; DocumentDB has no retryable writes; logins live in `admin`; `maxPoolSize=10`
+* fits 4 app instances in the Seed limit of 50, with 2 monitoring connections each (decision Q3).
+*/
+const CONNECT_OPTIONS = {
+	tls: true,
+	directConnection: true,
+	retryWrites: false,
+	authSource: "admin",
+	maxPoolSize: 10
+};
+// ../shared/src/logins.ts
+/**
+* The rule for a password the person chooses (step 11): 16 to 64 letters, digits, `-` and `_`.
+* These are the characters a `mongodb://` link carries without encoding. Rilo's own suggestion is
+* 24 random bytes in base64url (32 characters), which always passes.
+*/
+const LOGIN_PASSWORD = {
+	min: 16,
+	max: 64,
+	pattern: /^[A-Za-z0-9_-]+$/
+};
+// ../shared/src/regions.ts
+const REGION_CODES = ["in", "au"];
+const SPACE_ID_PATTERN = new RegExp(`^[bcdfghjkmnpqrstvwxz23456789]{8}$`);
+function isSpaceId(value) {
+	return SPACE_ID_PATTERN.test(value);
+}
+// ../shared/src/app-keys.ts
+/** Every app key starts with this, so people, scanners and the Files service recognise one. */
+const APP_KEY_PREFIX = "rilo_";
+/** The environment variable an app keeps its key in. */
+const APP_KEY_ENV_VAR = "RILO_KEY";
+/**
+* An app key's name is also its login's and its files key's name, so it follows both rules:
+* lowercase letters, digits and single hyphens, starting with a letter, 3 to 32 characters.
+*/
+const APP_KEY_NAME = {
+	min: 3,
+	max: 32,
+	pattern: /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/
+};
+/** The files secret: 32 random bytes in base64url, 43 characters. */
+const FILES_SECRET = /^[A-Za-z0-9_-]{43}$/;
+const IDENTITY = /^rilo_([a-z]+)_([a-z0-9]+)$/;
+/** What is wrong with an app key name, in plain words, or null. Nothing is trimmed or lowered. */
+function appKeyNameProblem(name) {
+	if (name === "") return "Enter a name for the key.";
+	if (name.trim() !== name) return "Remove the spaces at the start or end of the name.";
+	if (/\s/.test(name)) return "Use hyphens instead of spaces, like web-app.";
+	if (/[A-Z]/.test(name)) return "Use lowercase letters only, like web-app.";
+	if (!/^[a-z0-9-]+$/.test(name)) return "Use only lowercase letters, digits and hyphens.";
+	if (!/^[a-z]/.test(name)) return "Start the name with a letter.";
+	if (name.includes("--")) return "Use single hyphens, never two in a row.";
+	if (name.endsWith("-")) return "End the name with a letter or digit, not a hyphen.";
+	if (name.length < APP_KEY_NAME.min) return `Use at least ${APP_KEY_NAME.min} characters.`;
+	if (name.length > APP_KEY_NAME.max) return `Use ${APP_KEY_NAME.max} characters or fewer.`;
+	return null;
+}
+function isDatabaseSecret(value) {
+	return LOGIN_PASSWORD.pattern.test(value) && value.length >= LOGIN_PASSWORD.min && value.length <= LOGIN_PASSWORD.max;
+}
+function isRegion(value) {
+	return REGION_CODES.includes(value);
+}
+/**
+* The parts of an app key, or null when the text isn't exactly one. Strict: anything else, even
+* with the right prefix, is refused. It says nothing about whether the key is real.
+*/
+function parseAppKey(key) {
+	if (!key.startsWith("rilo_")) return null;
+	const pieces = key.split(".");
+	if (pieces.length !== 4) return null;
+	const [identity = "", name = "", databaseSecret = "", filesSecret = ""] = pieces;
+	const match = IDENTITY.exec(identity);
+	const region = match?.[1];
+	const spaceId = match?.[2];
+	if (region === void 0 || spaceId === void 0) return null;
+	if (!isRegion(region) || !isSpaceId(spaceId)) return null;
+	if (appKeyNameProblem(name) !== null) return null;
+	if (!isDatabaseSecret(databaseSecret) || !FILES_SECRET.test(filesSecret)) return null;
+	return {
+		region,
+		spaceId,
+		name,
+		databaseSecret,
+		filesSecret
+	};
+}
+/** The port every Space's databases answer on in production; a `rilodb://` link leaves it out. */
+const RILODB_DEFAULT_PORT = 27017;
+/** The `mongodb://` link MongoDB drivers and tools need, with the password in it. */
+function mongoLink(link) {
+	const options = Object.entries(CONNECT_OPTIONS).map(([key, value]) => `${key}=${value}`);
+	if (link.tlsCAFile) options.push(`tlsCAFile=${encodeURIComponent(link.tlsCAFile)}`);
+	const path = link.databaseRealName ? encodeURIComponent(link.databaseRealName) : "";
+	return `mongodb://${`${encodeURIComponent(link.loginRealName)}:${encodeURIComponent(link.password)}`}@${link.host}:${link.port}/${path}?${options.join("&")}`;
+}
+/** Everything an app needs from its key: the same values the Connect card shows. */
+function appKeyValues(parts, addresses, database) {
+	const loginRealName = `${parts.name}_${parts.spaceId}`;
+	const host = `${parts.spaceId}.${parts.region}.${addresses.spacesDomain}`;
+	return {
+		loginRealName,
+		filesKey: `rdbf_${parts.spaceId}_${parts.filesSecret}`,
+		host,
+		filesUrl: addresses.filesUrl,
+		connectLink: mongoLink({
+			loginRealName,
+			password: parts.databaseSecret,
+			host,
+			port: addresses.port,
+			databaseRealName: database ? `${database}_${parts.spaceId}` : null,
+			tlsCAFile: addresses.tlsCAFile
+		}),
+		rilodbLink: formatRilodbLink(parts, addresses, database)
+	};
+}
+/** A database name, as `DATABASE_NAME` in names.ts (repeated here to stay free of dependencies). */
+const DATABASE_NAME = /^[a-z][a-z0-9_-]{0,39}$/;
+const RESERVED_DATABASES = [
+	"admin",
+	"local",
+	"config"
+];
+/** The `rilodb://` link of a key, naming `database` when one is given. */
+function formatRilodbLink(parts, addresses, database) {
+	const port = addresses.port === 27017 ? "" : `:${addresses.port}`;
+	const host = `${parts.spaceId}.${parts.region}.${addresses.spacesDomain}${port}`;
+	const path = database ? encodeURIComponent(database) : "";
+	return `rilodb://${parts.name}:${parts.databaseSecret}@${host}/${path}`;
+}
+/** The parts of a `rilodb://` link, or null when the text isn't exactly one. Strict, like keys. */
+function parseRilodbLink(link) {
+	if (!link.startsWith(`rilodb://`)) return null;
+	let url;
+	try {
+		url = new URL(link);
+	} catch {
+		return null;
+	}
+	if (url.search !== "" || url.hash !== "") return null;
+	const name = decodeURIComponent(url.username);
+	const databaseSecret = decodeURIComponent(url.password);
+	if (appKeyNameProblem(name) !== null || !isDatabaseSecret(databaseSecret)) return null;
+	const [spaceId = "", region = "", ...domain] = url.hostname.split(".");
+	if (!isSpaceId(spaceId) || !isRegion(region) || domain.length < 2) return null;
+	const port = url.port === "" ? RILODB_DEFAULT_PORT : Number(url.port);
+	const path = decodeURIComponent(url.pathname.replace(/^\//, ""));
+	if (path !== "" && (!DATABASE_NAME.test(path) || RESERVED_DATABASES.includes(path))) return null;
+	return {
+		region,
+		spaceId,
+		name,
+		databaseSecret,
+		spacesDomain: domain.join("."),
+		port,
+		database: path === "" ? null : path
+	};
+}
+/** The `mongodb://` link a driver needs for a `rilodb://` link's parts. */
+function mongoLinkOfRilodb(parts, options = {}) {
+	return mongoLink({
+		loginRealName: `${parts.name}_${parts.spaceId}`,
+		password: parts.databaseSecret,
+		host: `${parts.spaceId}.${parts.region}.${parts.spacesDomain}`,
+		port: parts.port,
+		databaseRealName: parts.database ? `${parts.database}_${parts.spaceId}` : null,
+		tlsCAFile: options.tlsCAFile
+	});
+}
+const MISSING = `No app key was given. Set ${APP_KEY_ENV_VAR} to your app key from the App keys page of your Space, on your server, and pass it in.`;
+const MISSING_EITHER = `${MISSING} A rilodb:// link works too, for databases only.`;
+const FILES_KEY = `That is a files key (it starts with rdbf_), not an app key. Use the app key, which starts with ${APP_KEY_PREFIX}. It works for databases and Files.`;
+const MONGO_LINK = `That is a mongodb:// connect link, not an app key. Use the app key, which starts with ${APP_KEY_PREFIX}. It works for databases and Files. MongoDB drivers and tools use the mongodb:// link; this client reads the app key.`;
+const MONGO_LINK_EITHER = `That is a mongodb:// connect link, not an app key or a rilodb:// link. Use the app key, which starts with ${APP_KEY_PREFIX}, or the rilodb:// link. MongoDB drivers and tools use the mongodb:// link; this client reads the app key or the rilodb:// link.`;
+const RILODB_LINK = `That is a rilodb:// link, not an app key. This needs the app key (${APP_KEY_ENV_VAR}), which starts with ${APP_KEY_PREFIX}. A rilodb:// link holds only the database part.`;
+const MALFORMED = `That is not a valid app key. An app key starts with ${APP_KEY_PREFIX} and has four parts separated by dots. Copy the whole key again from the App keys page. A lost key can't be shown again, so reset it there.`;
+const MALFORMED_EITHER = `That is not a valid app key or rilodb:// link. An app key starts with ${APP_KEY_PREFIX} and has four parts separated by dots. Copy the whole key again from the App keys page. A lost key can't be shown again, so reset it there.`;
+const MALFORMED_RILODB_LINK = `That is not a valid rilodb:// link. It looks like rilodb://<key name>:<database secret>@<space>.<region>.<domain>/<database>. Copy the whole link again, or use your app key (${APP_KEY_ENV_VAR}). A lost key can't be shown again, so reset it on the App keys page.`;
+const isRilodbLink = (text) => /^rilodb:\/\//i.test(text);
+const isMongoLink = (text) => /^mongodb(\+srv)?:\/\//i.test(text);
+/** `parseRilodbLink`, with the one way it can still throw (a bad `%` escape) turned into null. */
+function readRilodbLink(text) {
+	try {
+		return parseRilodbLink(text);
+	} catch {
+		return null;
+	}
+}
+/**
+* The text of a key, trimmed, or a `RiloKeyError` that says what was given instead. `orLink` words
+* the refusals for a place that takes a `rilodb://` link too. No message repeats any of the input.
+*/
+function keyText(key, orLink) {
+	if (key === void 0 || key === null || typeof key === "string" && key.trim() === "") throw new RiloKeyError(orLink ? MISSING_EITHER : MISSING);
+	if (typeof key !== "string") throw new RiloKeyError(orLink ? MALFORMED_EITHER : MALFORMED);
+	const text = key.trim();
+	if (text.startsWith("rdbf_")) throw new RiloKeyError(FILES_KEY);
+	if (isMongoLink(text)) throw new RiloKeyError(orLink ? MONGO_LINK_EITHER : MONGO_LINK);
+	if (isRilodbLink(text)) throw new RiloKeyError(RILODB_LINK);
+	return text;
+}
+function resolveAppKey(text, orLink, options, database) {
+	const parts = parseAppKey(text);
+	if (parts === null) throw new RiloKeyError(orLink ? MALFORMED_EITHER : MALFORMED);
+	const spacesDomain = options.spacesDomain ?? "db.services.rilo.studio";
+	const filesUrl = (options.filesUrl ?? `https://files.${parts.region}.${spacesDomain}`).replace(/\/+$/, "");
+	return {
+		parts,
+		values: appKeyValues(parts, {
+			spacesDomain,
+			port: options.port ?? 27017,
+			filesUrl,
+			tlsCAFile: options.tlsCAFile
+		}, database)
+	};
+}
+/**
+* What an app key or a `rilodb://` link says, or a `RiloKeyError`. A link brings its own address
+* (`spacesDomain` and `port` come from it); only `tlsCAFile` still applies. The error says what was
+* given and what to give, and never contains any part of the input.
+*/
+function resolveTarget(input, options = {}) {
+	if (typeof input === "string" && isRilodbLink(input.trim())) {
+		const link = readRilodbLink(input.trim());
+		if (link === null) throw new RiloKeyError(MALFORMED_RILODB_LINK);
+		return {
+			connectLink: mongoLinkOfRilodb(link, { tlsCAFile: options.tlsCAFile }),
+			spaceId: link.spaceId,
+			database: link.database,
+			files: null
+		};
+	}
+	const { parts, values } = resolveAppKey(keyText(input, true), true, options);
+	return {
+		connectLink: values.connectLink,
+		spaceId: parts.spaceId,
+		database: null,
+		files: {
+			url: values.filesUrl,
+			key: values.filesKey
+		}
+	};
+}
+Object.defineProperty(exports, "RiloFilesError", {
+	enumerable: true,
+	get: function() {
+		return RiloFilesError;
+	}
+});
+Object.defineProperty(exports, "RiloKeyError", {
+	enumerable: true,
+	get: function() {
+		return RiloKeyError;
+	}
+});
+Object.defineProperty(exports, "resolveTarget", {
+	enumerable: true,
+	get: function() {
+		return resolveTarget;
+	}
+});