@xyo-network/dapp-kit-cloudflare-r2 0.1.9

package/README.md

@@ -0,0 +1,39 @@
+# `@xyo-network/dapp-kit-cloudflare-r2`
+
+Cloudflare R2 specialization and qualification for dapp-kit deployments.
+
+The package combines the portable `@xyo-network/dapp-kit-s3` object store with:
+
+- explicit R2 account endpoint construction;
+- mandatory injected clients or explicit bucket-scoped credentials;
+- credential-free, hash-bound resource plans;
+- public custom-domain and browser CORS policy;
+- a destructive prefix-confined credentialed qualification gate; and
+- a read-only public URL/CORS audit.
+
+R2 resource plans intentionally admit only datalakes, projection stores, and
+checkpoint stores. They do not classify R2 as a secret store, challenge store,
+queue, rate limiter, or high-contention effect journal. The admitted per-key
+write rate is part of the plan instead of being hidden behind “S3 compatible.”
+
+```ts
+import { CloudflareR2ObjectStore } from '@xyo-network/dapp-kit-cloudflare-r2'
+
+const store = new CloudflareR2ObjectStore({
+  accountId,
+  bucket,
+  credentials: { accessKeyId, secretAccessKey },
+  maximumObjectBytes: 4 * 1024 * 1024,
+  prefix: 'my-dapp/public-projection',
+})
+
+// ...publish immutable generations and conditionally advance head.json...
+store.close()
+```
+
+Constructing a store is not qualification. Run `qualifyCloudflareR2` against
+the intended bucket using a `CloudflareR2ObjectStore` constructed with explicit
+credentials, and retain its result as `credentialed-cloudflare-r2` evidence.
+The API refuses to issue that evidence class for an injected client.
+`probeCloudflareR2Capabilities` is the lower-level fake/local gate and returns
+capabilities without claiming credentialed R2 evidence.

package/dist/node/cloudflareR2ObjectStore.d.ts

@@ -0,0 +1,33 @@
+import { S3Client } from '@aws-sdk/client-s3';
+import type { S3CommandClient } from '@xyo-network/dapp-kit-s3';
+import { S3ObjectStore } from '@xyo-network/dapp-kit-s3';
+export type CloudflareR2Jurisdiction = 'default' | 'eu';
+export interface CloudflareR2Credentials {
+    readonly accessKeyId: string;
+    readonly secretAccessKey: string;
+    readonly sessionToken?: string;
+}
+export interface CloudflareR2ObjectStoreOptions {
+    readonly accountId: string;
+    readonly bucket: string;
+    readonly client?: S3Client | S3CommandClient;
+    readonly credentials?: CloudflareR2Credentials;
+    readonly jurisdiction?: CloudflareR2Jurisdiction;
+    readonly maximumObjectBytes: number;
+    readonly prefix: string;
+}
+export declare function cloudflareR2S3Endpoint(accountIdValue: string, jurisdiction?: CloudflareR2Jurisdiction): string;
+export declare function cloudflareR2PublicObjectUrl(baseUrl: string, prefix: string, key: string): string;
+/**
+ * Cloudflare R2 specialization of the portable S3 store. Production
+ * construction requires explicit credentials; ambient AWS credential lookup
+ * is intentionally unavailable.
+ */
+export declare class CloudflareR2ObjectStore extends S3ObjectStore {
+    readonly credentialSource: 'explicit-credentials' | 'injected-client';
+    readonly endpoint: string;
+    private readonly ownedClient?;
+    constructor(options: CloudflareR2ObjectStoreOptions);
+    close(): void;
+}
+//# sourceMappingURL=cloudflareR2ObjectStore.d.ts.map

package/dist/node/cloudflareR2ObjectStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflareR2ObjectStore.d.ts","sourceRoot":"","sources":["../../src/cloudflareR2ObjectStore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAE7C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAA;AAC/D,OAAO,EAEL,aAAa,EACd,MAAM,0BAA0B,CAAA;AAEjC,MAAM,MAAM,wBAAwB,GAAG,SAAS,GAAG,IAAI,CAAA;AAEvD,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAC/B;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,GAAG,eAAe,CAAA;IAC5C,QAAQ,CAAC,WAAW,CAAC,EAAE,uBAAuB,CAAA;IAC9C,QAAQ,CAAC,YAAY,CAAC,EAAE,wBAAwB,CAAA;IAChD,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAA;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAcD,wBAAgB,sBAAsB,CACpC,cAAc,EAAE,MAAM,EACtB,YAAY,GAAE,wBAAoC,GACjD,MAAM,CAKR;AAUD,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAOhG;AAED;;;;GAIG;AACH,qBAAa,uBAAwB,SAAQ,aAAa;IACxD,QAAQ,CAAC,gBAAgB,EAAE,sBAAsB,GAAG,iBAAiB,CAAA;IACrE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IAEzB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAU;gBAE3B,OAAO,EAAE,8BAA8B;IA6BnD,KAAK,IAAI,IAAI;CAGd"}

package/dist/node/cloudflareR2ResourcePlan.d.ts

@@ -0,0 +1,133 @@
+import { z } from 'zod';
+export declare const CloudflareR2AdapterId: "network.xyo.dapp.adapter.cloudflare-r2-s3";
+export declare const CloudflareR2AdapterVersion: "0.1.8";
+export declare const CloudflareR2ResourcePlanSchema: "network.xyo.dapp.cloudflare-r2.resource.plan";
+export declare const CloudflareR2ResourcePlanHashAlgorithm: "jcs-sha256-v1";
+export declare const CloudflareR2ResourcePlanDomainSeparator: "xyo-dapp-kit-cloudflare-r2:resource-plan:v1\n";
+export declare const CloudflareR2ResourceClassZod: z.ZodEnum<{
+    datalake: "datalake";
+    "projection-store": "projection-store";
+    "checkpoint-store": "checkpoint-store";
+}>;
+export type CloudflareR2ResourceClass = z.infer<typeof CloudflareR2ResourceClassZod>;
+export declare const CloudflareR2CredentialModeZod: z.ZodEnum<{
+    "static-s3": "static-s3";
+    "temporary-s3": "temporary-s3";
+}>;
+export type CloudflareR2CredentialMode = z.infer<typeof CloudflareR2CredentialModeZod>;
+export declare const CloudflareR2ResourceAccessZod: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    mode: z.ZodLiteral<"private">;
+}, z.core.$strict>, z.ZodObject<{
+    mode: z.ZodLiteral<"public-custom-domain">;
+    baseUrl: z.ZodString;
+    cors: z.ZodObject<{
+        allowedOrigins: z.ZodArray<z.ZodString>;
+        allowedMethods: z.ZodArray<z.ZodEnum<{
+            GET: "GET";
+            HEAD: "HEAD";
+        }>>;
+        exposeEtag: z.ZodLiteral<true>;
+    }, z.core.$strict>;
+}, z.core.$strict>], "mode">;
+export type CloudflareR2ResourceAccess = z.infer<typeof CloudflareR2ResourceAccessZod>;
+export declare const CloudflareR2ResourcePlanPreimageZod: z.ZodObject<{
+    schema: z.ZodLiteral<"network.xyo.dapp.cloudflare-r2.resource.plan">;
+    schemaVersion: z.ZodLiteral<1>;
+    hashAlgorithm: z.ZodLiteral<"jcs-sha256-v1">;
+    adapter: z.ZodObject<{
+        adapterId: z.ZodLiteral<"network.xyo.dapp.adapter.cloudflare-r2-s3">;
+        adapterVersion: z.ZodLiteral<"0.1.8">;
+        family: z.ZodLiteral<"s3-compatible">;
+        provider: z.ZodLiteral<"cloudflare-r2">;
+    }, z.core.$strict>;
+    policy: z.ZodObject<{
+        policyId: z.ZodString;
+        policyVersion: z.ZodString;
+        reviewedOn: z.ZodString;
+        validUntil: z.ZodString;
+    }, z.core.$strict>;
+    resourceId: z.ZodString;
+    resourceClass: z.ZodEnum<{
+        datalake: "datalake";
+        "projection-store": "projection-store";
+        "checkpoint-store": "checkpoint-store";
+    }>;
+    access: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        mode: z.ZodLiteral<"private">;
+    }, z.core.$strict>, z.ZodObject<{
+        mode: z.ZodLiteral<"public-custom-domain">;
+        baseUrl: z.ZodString;
+        cors: z.ZodObject<{
+            allowedOrigins: z.ZodArray<z.ZodString>;
+            allowedMethods: z.ZodArray<z.ZodEnum<{
+                GET: "GET";
+                HEAD: "HEAD";
+            }>>;
+            exposeEtag: z.ZodLiteral<true>;
+        }, z.core.$strict>;
+    }, z.core.$strict>], "mode">;
+    credentialMode: z.ZodEnum<{
+        "static-s3": "static-s3";
+        "temporary-s3": "temporary-s3";
+    }>;
+    maximumObjectBytes: z.ZodNumber;
+    guarantees: z.ZodObject<{
+        conditionalPut: z.ZodLiteral<true>;
+        globalReadAfterWrite: z.ZodLiteral<true>;
+        maximumWritesPerSecondPerKey: z.ZodLiteral<1>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type CloudflareR2ResourcePlanPreimage = z.infer<typeof CloudflareR2ResourcePlanPreimageZod>;
+export declare const CloudflareR2ResourcePlanZod: z.ZodObject<{
+    schema: z.ZodLiteral<"network.xyo.dapp.cloudflare-r2.resource.plan">;
+    schemaVersion: z.ZodLiteral<1>;
+    hashAlgorithm: z.ZodLiteral<"jcs-sha256-v1">;
+    adapter: z.ZodObject<{
+        adapterId: z.ZodLiteral<"network.xyo.dapp.adapter.cloudflare-r2-s3">;
+        adapterVersion: z.ZodLiteral<"0.1.8">;
+        family: z.ZodLiteral<"s3-compatible">;
+        provider: z.ZodLiteral<"cloudflare-r2">;
+    }, z.core.$strict>;
+    policy: z.ZodObject<{
+        policyId: z.ZodString;
+        policyVersion: z.ZodString;
+        reviewedOn: z.ZodString;
+        validUntil: z.ZodString;
+    }, z.core.$strict>;
+    resourceId: z.ZodString;
+    resourceClass: z.ZodEnum<{
+        datalake: "datalake";
+        "projection-store": "projection-store";
+        "checkpoint-store": "checkpoint-store";
+    }>;
+    access: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        mode: z.ZodLiteral<"private">;
+    }, z.core.$strict>, z.ZodObject<{
+        mode: z.ZodLiteral<"public-custom-domain">;
+        baseUrl: z.ZodString;
+        cors: z.ZodObject<{
+            allowedOrigins: z.ZodArray<z.ZodString>;
+            allowedMethods: z.ZodArray<z.ZodEnum<{
+                GET: "GET";
+                HEAD: "HEAD";
+            }>>;
+            exposeEtag: z.ZodLiteral<true>;
+        }, z.core.$strict>;
+    }, z.core.$strict>], "mode">;
+    credentialMode: z.ZodEnum<{
+        "static-s3": "static-s3";
+        "temporary-s3": "temporary-s3";
+    }>;
+    maximumObjectBytes: z.ZodNumber;
+    guarantees: z.ZodObject<{
+        conditionalPut: z.ZodLiteral<true>;
+        globalReadAfterWrite: z.ZodLiteral<true>;
+        maximumWritesPerSecondPerKey: z.ZodLiteral<1>;
+    }, z.core.$strict>;
+    resourcePlanId: z.ZodString;
+}, z.core.$strict>;
+export type CloudflareR2ResourcePlan = z.infer<typeof CloudflareR2ResourcePlanZod>;
+export declare function hashCloudflareR2ResourcePlan(value: unknown): string;
+export declare function createCloudflareR2ResourcePlan(value: unknown): CloudflareR2ResourcePlan;
+export declare function verifyCloudflareR2ResourcePlan(value: unknown): CloudflareR2ResourcePlan;
+//# sourceMappingURL=cloudflareR2ResourcePlan.d.ts.map

package/dist/node/cloudflareR2ResourcePlan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflareR2ResourcePlan.d.ts","sourceRoot":"","sources":["../../src/cloudflareR2ResourcePlan.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,eAAO,MAAM,qBAAqB,EAAG,2CAAoD,CAAA;AACzF,eAAO,MAAM,0BAA0B,EAAG,OAAgB,CAAA;AAC1D,eAAO,MAAM,8BAA8B,EAAG,8CAAuD,CAAA;AACrG,eAAO,MAAM,qCAAqC,iBAA4B,CAAA;AAC9E,eAAO,MAAM,uCAAuC,EAAG,+CAAwD,CAAA;AAE/G,eAAO,MAAM,4BAA4B;;;;EAIvC,CAAA;AACF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAA;AAEpF,eAAO,MAAM,6BAA6B;;;EAAwC,CAAA;AAClF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAA;AAqBtF,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;4BAWxC,CAAA;AACF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAA;AAItF,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAkE9C,CAAA;AAEF,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAA;AAElG,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAA8E,CAAA;AACtH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAA;AAkBlF,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAKnE;AAED,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,OAAO,GAAG,wBAAwB,CAMvF;AAED,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,OAAO,GAAG,wBAAwB,CAQvF"}

package/dist/node/index.d.ts

@@ -0,0 +1,4 @@
+export * from './cloudflareR2ObjectStore.ts';
+export * from './cloudflareR2ResourcePlan.ts';
+export * from './qualifyCloudflareR2.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/node/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,8BAA8B,CAAA;AAC5C,cAAc,+BAA+B,CAAA;AAC7C,cAAc,0BAA0B,CAAA"}

package/dist/node/index.mjs

@@ -0,0 +1,373 @@
+// src/cloudflareR2ObjectStore.ts
+import { S3Client } from "@aws-sdk/client-s3";
+import { normalizeObjectStoreKey } from "@xyo-network/dapp-kit";
+import {
+  createS3SdkObjectStoreTransport,
+  S3ObjectStore
+} from "@xyo-network/dapp-kit-s3";
+var AccountIdPattern = /^[0-9a-f]{32}$/u;
+function accountId(value) {
+  if (!AccountIdPattern.test(value)) throw new TypeError("Cloudflare account ID must be 32 lowercase hexadecimal characters");
+  return value;
+}
+function secret(value, name) {
+  if (value.trim() === "") throw new TypeError(`${name} must be non-empty`);
+  return value;
+}
+function cloudflareR2S3Endpoint(accountIdValue, jurisdiction = "default") {
+  const prefix = accountId(accountIdValue);
+  return jurisdiction === "eu" ? `https://${prefix}.eu.r2.cloudflarestorage.com` : `https://${prefix}.r2.cloudflarestorage.com`;
+}
+function publicBaseUrl(value) {
+  const url = new URL(value);
+  if (url.protocol !== "https:" || url.origin !== value) {
+    throw new TypeError("Cloudflare R2 public base URL must be an HTTPS origin without credentials, query, or fragment");
+  }
+  return url;
+}
+function cloudflareR2PublicObjectUrl(baseUrl, prefix, key) {
+  const base = publicBaseUrl(baseUrl);
+  const pathname = [
+    normalizeObjectStoreKey(prefix, true),
+    normalizeObjectStoreKey(key)
+  ].filter((value) => value !== "").flatMap((value) => value.split("/")).map((segment) => encodeURIComponent(segment)).join("/");
+  return new URL(pathname, `${base.toString().replace(/\/+$/u, "")}/`).toString();
+}
+var CloudflareR2ObjectStore = class extends S3ObjectStore {
+  credentialSource;
+  endpoint;
+  ownedClient;
+  constructor(options) {
+    if (options.client === void 0 === (options.credentials === void 0)) {
+      throw new TypeError("provide exactly one of Cloudflare R2 credentials or an injected S3 client");
+    }
+    const endpoint = cloudflareR2S3Endpoint(options.accountId, options.jurisdiction);
+    const credentials = options.credentials;
+    const ownedClient = credentials === void 0 ? void 0 : new S3Client({
+      credentials: {
+        accessKeyId: secret(credentials.accessKeyId, "Cloudflare R2 access key ID"),
+        secretAccessKey: secret(credentials.secretAccessKey, "Cloudflare R2 secret access key"),
+        ...credentials.sessionToken !== void 0 && { sessionToken: secret(credentials.sessionToken, "Cloudflare R2 session token") }
+      },
+      endpoint,
+      region: "auto"
+    });
+    const client = options.client ?? ownedClient;
+    if (client === void 0) throw new TypeError("Cloudflare R2 client construction failed");
+    super({
+      maximumObjectBytes: options.maximumObjectBytes,
+      prefix: options.prefix,
+      transport: createS3SdkObjectStoreTransport({ bucket: options.bucket, client })
+    });
+    this.endpoint = endpoint;
+    this.credentialSource = credentials === void 0 ? "injected-client" : "explicit-credentials";
+    this.ownedClient = ownedClient;
+  }
+  close() {
+    this.ownedClient?.destroy();
+  }
+};
+
+// src/cloudflareR2ResourcePlan.ts
+import { createHash } from "node:crypto";
+import {
+  canonicalizeIJson,
+  DappDocumentHashAlgorithm,
+  HashZod,
+  IdentifierZod,
+  SemanticVersionZod
+} from "@xyo-network/dapp-kit";
+import { z } from "zod";
+var CloudflareR2AdapterId = "network.xyo.dapp.adapter.cloudflare-r2-s3";
+var CloudflareR2AdapterVersion = "0.1.8";
+var CloudflareR2ResourcePlanSchema = "network.xyo.dapp.cloudflare-r2.resource.plan";
+var CloudflareR2ResourcePlanHashAlgorithm = DappDocumentHashAlgorithm;
+var CloudflareR2ResourcePlanDomainSeparator = "xyo-dapp-kit-cloudflare-r2:resource-plan:v1\n";
+var CloudflareR2ResourceClassZod = z.enum([
+  "datalake",
+  "projection-store",
+  "checkpoint-store"
+]);
+var CloudflareR2CredentialModeZod = z.enum(["static-s3", "temporary-s3"]);
+var OriginZod = z.string().refine((value) => {
+  if (value === "*") return true;
+  try {
+    const url = new URL(value);
+    return url.origin === value && ["http:", "https:"].includes(url.protocol);
+  } catch {
+    return false;
+  }
+}, "CORS origin must be * or an HTTP(S) origin");
+var HttpsOriginZod = z.string().refine((value) => {
+  try {
+    const url = new URL(value);
+    return url.protocol === "https:" && url.origin === value;
+  } catch {
+    return false;
+  }
+}, "public base URL must be an HTTPS origin");
+var CloudflareR2ResourceAccessZod = z.discriminatedUnion("mode", [
+  z.strictObject({ mode: z.literal("private") }),
+  z.strictObject({
+    mode: z.literal("public-custom-domain"),
+    baseUrl: HttpsOriginZod,
+    cors: z.strictObject({
+      allowedOrigins: z.array(OriginZod).min(1),
+      allowedMethods: z.array(z.enum(["GET", "HEAD"])).min(1),
+      exposeEtag: z.literal(true)
+    })
+  })
+]);
+var IsoDatePattern = /^\d{4}-\d{2}-\d{2}$/u;
+var CloudflareR2ResourcePlanPreimageZod = z.strictObject({
+  schema: z.literal(CloudflareR2ResourcePlanSchema),
+  schemaVersion: z.literal(1),
+  hashAlgorithm: z.literal(CloudflareR2ResourcePlanHashAlgorithm),
+  adapter: z.strictObject({
+    adapterId: z.literal(CloudflareR2AdapterId),
+    adapterVersion: z.literal(CloudflareR2AdapterVersion),
+    family: z.literal("s3-compatible"),
+    provider: z.literal("cloudflare-r2")
+  }),
+  policy: z.strictObject({
+    policyId: IdentifierZod,
+    policyVersion: SemanticVersionZod,
+    reviewedOn: z.string().regex(IsoDatePattern),
+    validUntil: z.string().regex(IsoDatePattern)
+  }),
+  resourceId: IdentifierZod,
+  resourceClass: CloudflareR2ResourceClassZod,
+  access: CloudflareR2ResourceAccessZod,
+  credentialMode: CloudflareR2CredentialModeZod,
+  maximumObjectBytes: z.number().int().positive(),
+  guarantees: z.strictObject({
+    conditionalPut: z.literal(true),
+    globalReadAfterWrite: z.literal(true),
+    maximumWritesPerSecondPerKey: z.literal(1)
+  })
+}).superRefine((plan, context) => {
+  if (plan.policy.reviewedOn > plan.policy.validUntil) {
+    context.addIssue({
+      code: "custom",
+      message: "R2 resource policy validity cannot end before its review date",
+      path: ["policy", "validUntil"]
+    });
+  }
+  if (plan.resourceClass === "checkpoint-store" && plan.access.mode !== "private") {
+    context.addIssue({
+      code: "custom",
+      message: "R2 checkpoint storage must remain private",
+      path: ["access"]
+    });
+  }
+  if (plan.access.mode === "public-custom-domain") {
+    if (new Set(plan.access.cors.allowedOrigins).size !== plan.access.cors.allowedOrigins.length) {
+      context.addIssue({
+        code: "custom",
+        message: "public R2 CORS origins must be unique",
+        path: ["access", "cors", "allowedOrigins"]
+      });
+    }
+    if (new Set(plan.access.cors.allowedMethods).size !== plan.access.cors.allowedMethods.length) {
+      context.addIssue({
+        code: "custom",
+        message: "public R2 CORS methods must be unique",
+        path: ["access", "cors", "allowedMethods"]
+      });
+    }
+    for (const method of ["GET", "HEAD"]) {
+      if (!plan.access.cors.allowedMethods.includes(method)) {
+        context.addIssue({
+          code: "custom",
+          message: `public R2 access requires CORS ${method}`,
+          path: ["access", "cors", "allowedMethods"]
+        });
+      }
+    }
+  }
+});
+var CloudflareR2ResourcePlanZod = CloudflareR2ResourcePlanPreimageZod.safeExtend({ resourcePlanId: HashZod });
+function normalized(value) {
+  const preimage = CloudflareR2ResourcePlanPreimageZod.parse(value);
+  if (preimage.access.mode === "private") return preimage;
+  return CloudflareR2ResourcePlanPreimageZod.parse({
+    ...preimage,
+    access: {
+      ...preimage.access,
+      cors: {
+        ...preimage.access.cors,
+        allowedMethods: [...preimage.access.cors.allowedMethods].sort(),
+        allowedOrigins: [...preimage.access.cors.allowedOrigins].sort()
+      }
+    }
+  });
+}
+function hashCloudflareR2ResourcePlan(value) {
+  const preimage = normalized(value);
+  return createHash("sha256").update(`${CloudflareR2ResourcePlanDomainSeparator}${canonicalizeIJson(preimage)}`, "utf8").digest("hex");
+}
+function createCloudflareR2ResourcePlan(value) {
+  const preimage = normalized(value);
+  return CloudflareR2ResourcePlanZod.parse({
+    ...preimage,
+    resourcePlanId: hashCloudflareR2ResourcePlan(preimage)
+  });
+}
+function verifyCloudflareR2ResourcePlan(value) {
+  const plan = CloudflareR2ResourcePlanZod.parse(value);
+  const { resourcePlanId, ...unresolvedPreimage } = plan;
+  const preimage = normalized(unresolvedPreimage);
+  if (hashCloudflareR2ResourcePlan(preimage) !== resourcePlanId) {
+    throw new TypeError("Cloudflare R2 resource plan ID does not match its canonical preimage");
+  }
+  return CloudflareR2ResourcePlanZod.parse({ ...preimage, resourcePlanId });
+}
+
+// src/qualifyCloudflareR2.ts
+import {
+  IdentifierZod as IdentifierZod2,
+  normalizeObjectStoreKey as normalizeObjectStoreKey2,
+  ObjectStorePreconditionCode,
+  ObjectStorePreconditionError
+} from "@xyo-network/dapp-kit";
+import { z as z2 } from "zod";
+var CloudflareR2QualificationEvidenceSchema = "network.xyo.dapp.cloudflare-r2.qualification";
+var IsoDateTimeZod = z2.iso.datetime({ offset: true });
+var CloudflareR2QualificationEvidenceZod = z2.strictObject({
+  schema: z2.literal(CloudflareR2QualificationEvidenceSchema),
+  schemaVersion: z2.literal(1),
+  adapterId: z2.literal(CloudflareR2AdapterId),
+  adapterVersion: z2.literal(CloudflareR2AdapterVersion),
+  evidenceClass: z2.literal("credentialed-cloudflare-r2"),
+  observedAt: IsoDateTimeZod,
+  probeId: IdentifierZod2,
+  resourcePlanId: z2.string().regex(/^[0-9a-f]{64}$/u),
+  capabilities: z2.strictObject({
+    conditionalCreate: z2.literal(true),
+    conditionalReplace: z2.literal(true),
+    deleteVisibility: z2.literal(true),
+    listVisibility: z2.literal(true),
+    readAfterWrite: z2.literal(true)
+  })
+});
+function equalBytes(left, right) {
+  return left?.byteLength === right.byteLength && left.every((value, index) => value === right[index]);
+}
+function expectedPrecondition(error, code) {
+  return error instanceof ObjectStorePreconditionError && error.code === code;
+}
+async function probeCloudflareR2Capabilities(options) {
+  const probeId = IdentifierZod2.parse(options.probeId);
+  const key = normalizeObjectStoreKey2(`qualification/${probeId}/cas.json`);
+  const firstBody = new TextEncoder().encode('{"revision":1}');
+  const secondBody = new TextEncoder().encode('{"revision":2}');
+  try {
+    const first = await options.store.put(key, firstBody, {
+      contentType: "application/json",
+      ifNotExists: true
+    });
+    if (first.etag === void 0) throw new Error("Cloudflare R2 qualification requires an ETag");
+    if (!equalBytes(await options.store.get(key), firstBody)) throw new Error("Cloudflare R2 failed read-after-write");
+    try {
+      await options.store.put(key, firstBody, { ifNotExists: true });
+      throw new Error("Cloudflare R2 admitted a duplicate conditional create");
+    } catch (error) {
+      if (!expectedPrecondition(error, ObjectStorePreconditionCode.ifNotExistsFailed)) throw error;
+    }
+    const second = await options.store.put(key, secondBody, { ifMatch: first.etag });
+    if (second.etag === void 0) throw new Error("Cloudflare R2 conditional replace returned no ETag");
+    try {
+      await options.store.put(key, firstBody, { ifMatch: first.etag });
+      throw new Error("Cloudflare R2 admitted a stale conditional replace");
+    } catch (error) {
+      if (!expectedPrecondition(error, ObjectStorePreconditionCode.ifMatchFailed)) throw error;
+    }
+    if (!(await options.store.list("qualification")).includes(key)) throw new Error("Cloudflare R2 listing omitted the probe");
+    await options.store.delete(key);
+    if (await options.store.get(key) !== void 0) throw new Error("Cloudflare R2 delete was not immediately visible");
+    return {
+      conditionalCreate: true,
+      conditionalReplace: true,
+      deleteVisibility: true,
+      listVisibility: true,
+      readAfterWrite: true
+    };
+  } finally {
+    await options.store.delete(key);
+  }
+}
+async function qualifyCloudflareR2(options) {
+  if (!(options.store instanceof CloudflareR2ObjectStore) || options.store.credentialSource !== "explicit-credentials") {
+    throw new TypeError("credentialed Cloudflare R2 qualification requires an explicitly credentialed R2 object store");
+  }
+  const plan = verifyCloudflareR2ResourcePlan(options.plan);
+  const observedAt = IsoDateTimeZod.parse(options.observedAt);
+  const observedOn = observedAt.slice(0, 10);
+  if (observedOn < plan.policy.reviewedOn || observedOn > plan.policy.validUntil) {
+    throw new TypeError("Cloudflare R2 resource policy is not valid at the qualification time");
+  }
+  const capabilities = await probeCloudflareR2Capabilities({
+    probeId: options.probeId,
+    store: options.store
+  });
+  return CloudflareR2QualificationEvidenceZod.parse({
+    schema: CloudflareR2QualificationEvidenceSchema,
+    schemaVersion: 1,
+    adapterId: CloudflareR2AdapterId,
+    adapterVersion: CloudflareR2AdapterVersion,
+    evidenceClass: "credentialed-cloudflare-r2",
+    observedAt,
+    probeId: options.probeId,
+    resourcePlanId: plan.resourcePlanId,
+    capabilities
+  });
+}
+async function auditCloudflareR2PublicRead(options) {
+  const plan = verifyCloudflareR2ResourcePlan(options.plan);
+  if (plan.access.mode !== "public-custom-domain") throw new TypeError("R2 public-read audit requires a public resource plan");
+  const url = cloudflareR2PublicObjectUrl(plan.access.baseUrl, "", options.key);
+  const plannedOrigins = plan.access.cors.allowedOrigins;
+  const issues = [];
+  if (!plannedOrigins.includes("*") && !plannedOrigins.includes(options.origin)) {
+    issues.push("requesting origin is not admitted by the R2 resource plan");
+  }
+  const response = await (options.fetchImpl ?? fetch)(url, {
+    headers: { Origin: options.origin },
+    method: "HEAD"
+  });
+  if (!response.ok) issues.push(`public object returned HTTP ${response.status}`);
+  const allowedOrigin = response.headers.get("access-control-allow-origin");
+  if (allowedOrigin !== "*" && allowedOrigin !== options.origin) issues.push("public object did not admit the requesting origin");
+  const exposed = (response.headers.get("access-control-expose-headers") ?? "").split(",").map((value) => value.trim().toLowerCase());
+  if (!exposed.includes("etag")) issues.push("public object did not expose ETag through CORS");
+  if (response.headers.get("etag") === null) issues.push("public object returned no ETag");
+  return {
+    issues,
+    success: issues.length === 0,
+    url
+  };
+}
+export {
+  CloudflareR2AdapterId,
+  CloudflareR2AdapterVersion,
+  CloudflareR2CredentialModeZod,
+  CloudflareR2ObjectStore,
+  CloudflareR2QualificationEvidenceSchema,
+  CloudflareR2QualificationEvidenceZod,
+  CloudflareR2ResourceAccessZod,
+  CloudflareR2ResourceClassZod,
+  CloudflareR2ResourcePlanDomainSeparator,
+  CloudflareR2ResourcePlanHashAlgorithm,
+  CloudflareR2ResourcePlanPreimageZod,
+  CloudflareR2ResourcePlanSchema,
+  CloudflareR2ResourcePlanZod,
+  auditCloudflareR2PublicRead,
+  cloudflareR2PublicObjectUrl,
+  cloudflareR2S3Endpoint,
+  createCloudflareR2ResourcePlan,
+  hashCloudflareR2ResourcePlan,
+  probeCloudflareR2Capabilities,
+  qualifyCloudflareR2,
+  verifyCloudflareR2ResourcePlan
+};
+//# sourceMappingURL=index.mjs.map

package/dist/node/index.mjs.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/cloudflareR2ObjectStore.ts", "../../src/cloudflareR2ResourcePlan.ts", "../../src/qualifyCloudflareR2.ts"],
+  "sourcesContent": ["import { S3Client } from '@aws-sdk/client-s3'\nimport { normalizeObjectStoreKey } from '@xyo-network/dapp-kit'\nimport type { S3CommandClient } from '@xyo-network/dapp-kit-s3'\nimport {\n  createS3SdkObjectStoreTransport,\n  S3ObjectStore,\n} from '@xyo-network/dapp-kit-s3'\n\nexport type CloudflareR2Jurisdiction = 'default' | 'eu'\n\nexport interface CloudflareR2Credentials {\n  readonly accessKeyId: string\n  readonly secretAccessKey: string\n  readonly sessionToken?: string\n}\n\nexport interface CloudflareR2ObjectStoreOptions {\n  readonly accountId: string\n  readonly bucket: string\n  readonly client?: S3Client | S3CommandClient\n  readonly credentials?: CloudflareR2Credentials\n  readonly jurisdiction?: CloudflareR2Jurisdiction\n  readonly maximumObjectBytes: number\n  readonly prefix: string\n}\n\nconst AccountIdPattern = /^[0-9a-f]{32}$/u\n\nfunction accountId(value: string): string {\n  if (!AccountIdPattern.test(value)) throw new TypeError('Cloudflare account ID must be 32 lowercase hexadecimal characters')\n  return value\n}\n\nfunction secret(value: string, name: string): string {\n  if (value.trim() === '') throw new TypeError(`${name} must be non-empty`)\n  return value\n}\n\nexport function cloudflareR2S3Endpoint(\n  accountIdValue: string,\n  jurisdiction: CloudflareR2Jurisdiction = 'default',\n): string {\n  const prefix = accountId(accountIdValue)\n  return jurisdiction === 'eu'\n    ? `https://${prefix}.eu.r2.cloudflarestorage.com`\n    : `https://${prefix}.r2.cloudflarestorage.com`\n}\n\nfunction publicBaseUrl(value: string): URL {\n  const url = new URL(value)\n  if (url.protocol !== 'https:' || url.origin !== value) {\n    throw new TypeError('Cloudflare R2 public base URL must be an HTTPS origin without credentials, query, or fragment')\n  }\n  return url\n}\n\nexport function cloudflareR2PublicObjectUrl(baseUrl: string, prefix: string, key: string): string {\n  const base = publicBaseUrl(baseUrl)\n  const pathname = [\n    normalizeObjectStoreKey(prefix, true),\n    normalizeObjectStoreKey(key),\n  ].filter(value => value !== '').flatMap(value => value.split('/')).map(segment => encodeURIComponent(segment)).join('/')\n  return new URL(pathname, `${base.toString().replace(/\\/+$/u, '')}/`).toString()\n}\n\n/**\n * Cloudflare R2 specialization of the portable S3 store. Production\n * construction requires explicit credentials; ambient AWS credential lookup\n * is intentionally unavailable.\n */\nexport class CloudflareR2ObjectStore extends S3ObjectStore {\n  readonly credentialSource: 'explicit-credentials' | 'injected-client'\n  readonly endpoint: string\n\n  private readonly ownedClient?: S3Client\n\n  constructor(options: CloudflareR2ObjectStoreOptions) {\n    if ((options.client === undefined) === (options.credentials === undefined)) {\n      throw new TypeError('provide exactly one of Cloudflare R2 credentials or an injected S3 client')\n    }\n    const endpoint = cloudflareR2S3Endpoint(options.accountId, options.jurisdiction)\n    const credentials = options.credentials\n    const ownedClient = credentials === undefined\n      ? undefined\n      : new S3Client({\n          credentials: {\n            accessKeyId: secret(credentials.accessKeyId, 'Cloudflare R2 access key ID'),\n            secretAccessKey: secret(credentials.secretAccessKey, 'Cloudflare R2 secret access key'),\n            ...(credentials.sessionToken !== undefined && { sessionToken: secret(credentials.sessionToken, 'Cloudflare R2 session token') }),\n          },\n          endpoint,\n          region: 'auto',\n        })\n    const client = options.client ?? ownedClient\n    if (client === undefined) throw new TypeError('Cloudflare R2 client construction failed')\n    super({\n      maximumObjectBytes: options.maximumObjectBytes,\n      prefix: options.prefix,\n      transport: createS3SdkObjectStoreTransport({ bucket: options.bucket, client }),\n    })\n    this.endpoint = endpoint\n    this.credentialSource = credentials === undefined ? 'injected-client' : 'explicit-credentials'\n    this.ownedClient = ownedClient\n  }\n\n  close(): void {\n    this.ownedClient?.destroy()\n  }\n}\n", "import { createHash } from 'node:crypto'\n\nimport {\n  canonicalizeIJson,\n  DappDocumentHashAlgorithm,\n  HashZod,\n  IdentifierZod,\n  SemanticVersionZod,\n} from '@xyo-network/dapp-kit'\nimport { z } from 'zod'\n\nexport const CloudflareR2AdapterId = 'network.xyo.dapp.adapter.cloudflare-r2-s3' as const\nexport const CloudflareR2AdapterVersion = '0.1.8' as const\nexport const CloudflareR2ResourcePlanSchema = 'network.xyo.dapp.cloudflare-r2.resource.plan' as const\nexport const CloudflareR2ResourcePlanHashAlgorithm = DappDocumentHashAlgorithm\nexport const CloudflareR2ResourcePlanDomainSeparator = 'xyo-dapp-kit-cloudflare-r2:resource-plan:v1\\n' as const\n\nexport const CloudflareR2ResourceClassZod = z.enum([\n  'datalake',\n  'projection-store',\n  'checkpoint-store',\n])\nexport type CloudflareR2ResourceClass = z.infer<typeof CloudflareR2ResourceClassZod>\n\nexport const CloudflareR2CredentialModeZod = z.enum(['static-s3', 'temporary-s3'])\nexport type CloudflareR2CredentialMode = z.infer<typeof CloudflareR2CredentialModeZod>\n\nconst OriginZod = z.string().refine((value) => {\n  if (value === '*') return true\n  try {\n    const url = new URL(value)\n    return url.origin === value && ['http:', 'https:'].includes(url.protocol)\n  } catch {\n    return false\n  }\n}, 'CORS origin must be * or an HTTP(S) origin')\n\nconst HttpsOriginZod = z.string().refine((value) => {\n  try {\n    const url = new URL(value)\n    return url.protocol === 'https:' && url.origin === value\n  } catch {\n    return false\n  }\n}, 'public base URL must be an HTTPS origin')\n\nexport const CloudflareR2ResourceAccessZod = z.discriminatedUnion('mode', [\n  z.strictObject({ mode: z.literal('private') }),\n  z.strictObject({\n    mode: z.literal('public-custom-domain'),\n    baseUrl: HttpsOriginZod,\n    cors: z.strictObject({\n      allowedOrigins: z.array(OriginZod).min(1),\n      allowedMethods: z.array(z.enum(['GET', 'HEAD'])).min(1),\n      exposeEtag: z.literal(true),\n    }),\n  }),\n])\nexport type CloudflareR2ResourceAccess = z.infer<typeof CloudflareR2ResourceAccessZod>\n\nconst IsoDatePattern = /^\\d{4}-\\d{2}-\\d{2}$/u\n\nexport const CloudflareR2ResourcePlanPreimageZod = z.strictObject({\n  schema: z.literal(CloudflareR2ResourcePlanSchema),\n  schemaVersion: z.literal(1),\n  hashAlgorithm: z.literal(CloudflareR2ResourcePlanHashAlgorithm),\n  adapter: z.strictObject({\n    adapterId: z.literal(CloudflareR2AdapterId),\n    adapterVersion: z.literal(CloudflareR2AdapterVersion),\n    family: z.literal('s3-compatible'),\n    provider: z.literal('cloudflare-r2'),\n  }),\n  policy: z.strictObject({\n    policyId: IdentifierZod,\n    policyVersion: SemanticVersionZod,\n    reviewedOn: z.string().regex(IsoDatePattern),\n    validUntil: z.string().regex(IsoDatePattern),\n  }),\n  resourceId: IdentifierZod,\n  resourceClass: CloudflareR2ResourceClassZod,\n  access: CloudflareR2ResourceAccessZod,\n  credentialMode: CloudflareR2CredentialModeZod,\n  maximumObjectBytes: z.number().int().positive(),\n  guarantees: z.strictObject({\n    conditionalPut: z.literal(true),\n    globalReadAfterWrite: z.literal(true),\n    maximumWritesPerSecondPerKey: z.literal(1),\n  }),\n}).superRefine((plan, context) => {\n  if (plan.policy.reviewedOn > plan.policy.validUntil) {\n    context.addIssue({\n      code: 'custom',\n      message: 'R2 resource policy validity cannot end before its review date',\n      path: ['policy', 'validUntil'],\n    })\n  }\n  if (plan.resourceClass === 'checkpoint-store' && plan.access.mode !== 'private') {\n    context.addIssue({\n      code: 'custom',\n      message: 'R2 checkpoint storage must remain private',\n      path: ['access'],\n    })\n  }\n  if (plan.access.mode === 'public-custom-domain') {\n    if (new Set(plan.access.cors.allowedOrigins).size !== plan.access.cors.allowedOrigins.length) {\n      context.addIssue({\n        code: 'custom',\n        message: 'public R2 CORS origins must be unique',\n        path: ['access', 'cors', 'allowedOrigins'],\n      })\n    }\n    if (new Set(plan.access.cors.allowedMethods).size !== plan.access.cors.allowedMethods.length) {\n      context.addIssue({\n        code: 'custom',\n        message: 'public R2 CORS methods must be unique',\n        path: ['access', 'cors', 'allowedMethods'],\n      })\n    }\n    for (const method of ['GET', 'HEAD'] as const) {\n      if (!plan.access.cors.allowedMethods.includes(method)) {\n        context.addIssue({\n          code: 'custom',\n          message: `public R2 access requires CORS ${method}`,\n          path: ['access', 'cors', 'allowedMethods'],\n        })\n      }\n    }\n  }\n})\n\nexport type CloudflareR2ResourcePlanPreimage = z.infer<typeof CloudflareR2ResourcePlanPreimageZod>\n\nexport const CloudflareR2ResourcePlanZod = CloudflareR2ResourcePlanPreimageZod.safeExtend({ resourcePlanId: HashZod })\nexport type CloudflareR2ResourcePlan = z.infer<typeof CloudflareR2ResourcePlanZod>\n\nfunction normalized(value: unknown): CloudflareR2ResourcePlanPreimage {\n  const preimage = CloudflareR2ResourcePlanPreimageZod.parse(value)\n  if (preimage.access.mode === 'private') return preimage\n  return CloudflareR2ResourcePlanPreimageZod.parse({\n    ...preimage,\n    access: {\n      ...preimage.access,\n      cors: {\n        ...preimage.access.cors,\n        allowedMethods: [...preimage.access.cors.allowedMethods].sort(),\n        allowedOrigins: [...preimage.access.cors.allowedOrigins].sort(),\n      },\n    },\n  })\n}\n\nexport function hashCloudflareR2ResourcePlan(value: unknown): string {\n  const preimage = normalized(value)\n  return createHash('sha256')\n    .update(`${CloudflareR2ResourcePlanDomainSeparator}${canonicalizeIJson(preimage)}`, 'utf8')\n    .digest('hex')\n}\n\nexport function createCloudflareR2ResourcePlan(value: unknown): CloudflareR2ResourcePlan {\n  const preimage = normalized(value)\n  return CloudflareR2ResourcePlanZod.parse({\n    ...preimage,\n    resourcePlanId: hashCloudflareR2ResourcePlan(preimage),\n  })\n}\n\nexport function verifyCloudflareR2ResourcePlan(value: unknown): CloudflareR2ResourcePlan {\n  const plan = CloudflareR2ResourcePlanZod.parse(value)\n  const { resourcePlanId, ...unresolvedPreimage } = plan\n  const preimage = normalized(unresolvedPreimage)\n  if (hashCloudflareR2ResourcePlan(preimage) !== resourcePlanId) {\n    throw new TypeError('Cloudflare R2 resource plan ID does not match its canonical preimage')\n  }\n  return CloudflareR2ResourcePlanZod.parse({ ...preimage, resourcePlanId })\n}\n", "import type { ObjectStoreWriter } from '@xyo-network/dapp-kit'\nimport {\n  IdentifierZod,\n  normalizeObjectStoreKey,\n  ObjectStorePreconditionCode,\n  ObjectStorePreconditionError,\n} from '@xyo-network/dapp-kit'\nimport { z } from 'zod'\n\nimport {\n  CloudflareR2ObjectStore,\n  cloudflareR2PublicObjectUrl,\n} from './cloudflareR2ObjectStore.ts'\nimport type { CloudflareR2ResourcePlan } from './cloudflareR2ResourcePlan.ts'\nimport {\n  CloudflareR2AdapterId,\n  CloudflareR2AdapterVersion,\n  verifyCloudflareR2ResourcePlan,\n} from './cloudflareR2ResourcePlan.ts'\n\nexport const CloudflareR2QualificationEvidenceSchema = 'network.xyo.dapp.cloudflare-r2.qualification' as const\n\nconst IsoDateTimeZod = z.iso.datetime({ offset: true })\n\nexport const CloudflareR2QualificationEvidenceZod = z.strictObject({\n  schema: z.literal(CloudflareR2QualificationEvidenceSchema),\n  schemaVersion: z.literal(1),\n  adapterId: z.literal(CloudflareR2AdapterId),\n  adapterVersion: z.literal(CloudflareR2AdapterVersion),\n  evidenceClass: z.literal('credentialed-cloudflare-r2'),\n  observedAt: IsoDateTimeZod,\n  probeId: IdentifierZod,\n  resourcePlanId: z.string().regex(/^[0-9a-f]{64}$/u),\n  capabilities: z.strictObject({\n    conditionalCreate: z.literal(true),\n    conditionalReplace: z.literal(true),\n    deleteVisibility: z.literal(true),\n    listVisibility: z.literal(true),\n    readAfterWrite: z.literal(true),\n  }),\n})\n\nexport type CloudflareR2QualificationEvidence = z.infer<typeof CloudflareR2QualificationEvidenceZod>\n\nexport interface QualifyCloudflareR2Options {\n  readonly observedAt: string\n  readonly plan: CloudflareR2ResourcePlan\n  readonly probeId: string\n  readonly store: CloudflareR2ObjectStore\n}\n\nexport interface ProbeCloudflareR2Options {\n  readonly probeId: string\n  readonly store: ObjectStoreWriter\n}\n\nexport interface CloudflareR2CapabilityProbeResult {\n  readonly conditionalCreate: true\n  readonly conditionalReplace: true\n  readonly deleteVisibility: true\n  readonly listVisibility: true\n  readonly readAfterWrite: true\n}\n\nfunction equalBytes(left: Uint8Array | undefined, right: Uint8Array): boolean {\n  return left?.byteLength === right.byteLength\n    && left.every((value, index) => value === right[index])\n}\n\nfunction expectedPrecondition(error: unknown, code: string): boolean {\n  return error instanceof ObjectStorePreconditionError && error.code === code\n}\n\n/** Exercises the destructive, prefix-confined capability matrix without assigning an evidence class. */\nexport async function probeCloudflareR2Capabilities(\n  options: ProbeCloudflareR2Options,\n): Promise<CloudflareR2CapabilityProbeResult> {\n  const probeId = IdentifierZod.parse(options.probeId)\n  const key = normalizeObjectStoreKey(`qualification/${probeId}/cas.json`)\n  const firstBody = new TextEncoder().encode('{\"revision\":1}')\n  const secondBody = new TextEncoder().encode('{\"revision\":2}')\n  try {\n    const first = await options.store.put(key, firstBody, {\n      contentType: 'application/json',\n      ifNotExists: true,\n    })\n    if (first.etag === undefined) throw new Error('Cloudflare R2 qualification requires an ETag')\n    if (!equalBytes(await options.store.get(key), firstBody)) throw new Error('Cloudflare R2 failed read-after-write')\n    try {\n      await options.store.put(key, firstBody, { ifNotExists: true })\n      throw new Error('Cloudflare R2 admitted a duplicate conditional create')\n    } catch (error) {\n      if (!expectedPrecondition(error, ObjectStorePreconditionCode.ifNotExistsFailed)) throw error\n    }\n    const second = await options.store.put(key, secondBody, { ifMatch: first.etag })\n    if (second.etag === undefined) throw new Error('Cloudflare R2 conditional replace returned no ETag')\n    try {\n      await options.store.put(key, firstBody, { ifMatch: first.etag })\n      throw new Error('Cloudflare R2 admitted a stale conditional replace')\n    } catch (error) {\n      if (!expectedPrecondition(error, ObjectStorePreconditionCode.ifMatchFailed)) throw error\n    }\n    if (!(await options.store.list('qualification')).includes(key)) throw new Error('Cloudflare R2 listing omitted the probe')\n    await options.store.delete(key)\n    if (await options.store.get(key) !== undefined) throw new Error('Cloudflare R2 delete was not immediately visible')\n    return {\n      conditionalCreate: true,\n      conditionalReplace: true,\n      deleteVisibility: true,\n      listVisibility: true,\n      readAfterWrite: true,\n    }\n  } finally {\n    await options.store.delete(key)\n  }\n}\n\n/** Runs the destructive credentialed gate against an explicitly credentialed R2 instance. */\nexport async function qualifyCloudflareR2(options: QualifyCloudflareR2Options): Promise<CloudflareR2QualificationEvidence> {\n  if (!(options.store instanceof CloudflareR2ObjectStore)\n    || options.store.credentialSource !== 'explicit-credentials') {\n    throw new TypeError('credentialed Cloudflare R2 qualification requires an explicitly credentialed R2 object store')\n  }\n  const plan = verifyCloudflareR2ResourcePlan(options.plan)\n  const observedAt = IsoDateTimeZod.parse(options.observedAt)\n  const observedOn = observedAt.slice(0, 10)\n  if (observedOn < plan.policy.reviewedOn || observedOn > plan.policy.validUntil) {\n    throw new TypeError('Cloudflare R2 resource policy is not valid at the qualification time')\n  }\n  const capabilities = await probeCloudflareR2Capabilities({\n    probeId: options.probeId,\n    store: options.store,\n  })\n  return CloudflareR2QualificationEvidenceZod.parse({\n    schema: CloudflareR2QualificationEvidenceSchema,\n    schemaVersion: 1,\n    adapterId: CloudflareR2AdapterId,\n    adapterVersion: CloudflareR2AdapterVersion,\n    evidenceClass: 'credentialed-cloudflare-r2',\n    observedAt,\n    probeId: options.probeId,\n    resourcePlanId: plan.resourcePlanId,\n    capabilities,\n  })\n}\n\nexport interface AuditCloudflareR2PublicReadOptions {\n  readonly fetchImpl?: typeof fetch\n  readonly key: string\n  readonly origin: string\n  readonly plan: CloudflareR2ResourcePlan\n}\n\nexport interface CloudflareR2PublicReadAudit {\n  readonly issues: readonly string[]\n  readonly success: boolean\n  readonly url: string\n}\n\n/** Read-only hosted audit for the public custom-domain and browser CORS boundary. */\nexport async function auditCloudflareR2PublicRead(\n  options: AuditCloudflareR2PublicReadOptions,\n): Promise<CloudflareR2PublicReadAudit> {\n  const plan = verifyCloudflareR2ResourcePlan(options.plan)\n  if (plan.access.mode !== 'public-custom-domain') throw new TypeError('R2 public-read audit requires a public resource plan')\n  const url = cloudflareR2PublicObjectUrl(plan.access.baseUrl, '', options.key)\n  const plannedOrigins = plan.access.cors.allowedOrigins\n  const issues: string[] = []\n  if (!plannedOrigins.includes('*') && !plannedOrigins.includes(options.origin)) {\n    issues.push('requesting origin is not admitted by the R2 resource plan')\n  }\n  const response = await (options.fetchImpl ?? fetch)(url, {\n    headers: { Origin: options.origin },\n    method: 'HEAD',\n  })\n  if (!response.ok) issues.push(`public object returned HTTP ${response.status}`)\n  const allowedOrigin = response.headers.get('access-control-allow-origin')\n  if (allowedOrigin !== '*' && allowedOrigin !== options.origin) issues.push('public object did not admit the requesting origin')\n  const exposed = (response.headers.get('access-control-expose-headers') ?? '')\n    .split(',').map(value => value.trim().toLowerCase())\n  if (!exposed.includes('etag')) issues.push('public object did not expose ETag through CORS')\n  if (response.headers.get('etag') === null) issues.push('public object returned no ETag')\n  return {\n    issues, success: issues.length === 0, url,\n  }\n}\n"],
+  "mappings": ";AAAA,SAAS,gBAAgB;AACzB,SAAS,+BAA+B;AAExC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAoBP,IAAM,mBAAmB;AAEzB,SAAS,UAAU,OAAuB;AACxC,MAAI,CAAC,iBAAiB,KAAK,KAAK,EAAG,OAAM,IAAI,UAAU,mEAAmE;AAC1H,SAAO;AACT;AAEA,SAAS,OAAO,OAAe,MAAsB;AACnD,MAAI,MAAM,KAAK,MAAM,GAAI,OAAM,IAAI,UAAU,GAAG,IAAI,oBAAoB;AACxE,SAAO;AACT;AAEO,SAAS,uBACd,gBACA,eAAyC,WACjC;AACR,QAAM,SAAS,UAAU,cAAc;AACvC,SAAO,iBAAiB,OACpB,WAAW,MAAM,iCACjB,WAAW,MAAM;AACvB;AAEA,SAAS,cAAc,OAAoB;AACzC,QAAM,MAAM,IAAI,IAAI,KAAK;AACzB,MAAI,IAAI,aAAa,YAAY,IAAI,WAAW,OAAO;AACrD,UAAM,IAAI,UAAU,+FAA+F;AAAA,EACrH;AACA,SAAO;AACT;AAEO,SAAS,4BAA4B,SAAiB,QAAgB,KAAqB;AAChG,QAAM,OAAO,cAAc,OAAO;AAClC,QAAM,WAAW;AAAA,IACf,wBAAwB,QAAQ,IAAI;AAAA,IACpC,wBAAwB,GAAG;AAAA,EAC7B,EAAE,OAAO,WAAS,UAAU,EAAE,EAAE,QAAQ,WAAS,MAAM,MAAM,GAAG,CAAC,EAAE,IAAI,aAAW,mBAAmB,OAAO,CAAC,EAAE,KAAK,GAAG;AACvH,SAAO,IAAI,IAAI,UAAU,GAAG,KAAK,SAAS,EAAE,QAAQ,SAAS,EAAE,CAAC,GAAG,EAAE,SAAS;AAChF;AAOO,IAAM,0BAAN,cAAsC,cAAc;AAAA,EAChD;AAAA,EACA;AAAA,EAEQ;AAAA,EAEjB,YAAY,SAAyC;AACnD,QAAK,QAAQ,WAAW,YAAgB,QAAQ,gBAAgB,SAAY;AAC1E,YAAM,IAAI,UAAU,2EAA2E;AAAA,IACjG;AACA,UAAM,WAAW,uBAAuB,QAAQ,WAAW,QAAQ,YAAY;AAC/E,UAAM,cAAc,QAAQ;AAC5B,UAAM,cAAc,gBAAgB,SAChC,SACA,IAAI,SAAS;AAAA,MACX,aAAa;AAAA,QACX,aAAa,OAAO,YAAY,aAAa,6BAA6B;AAAA,QAC1E,iBAAiB,OAAO,YAAY,iBAAiB,iCAAiC;AAAA,QACtF,GAAI,YAAY,iBAAiB,UAAa,EAAE,cAAc,OAAO,YAAY,cAAc,6BAA6B,EAAE;AAAA,MAChI;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,IACV,CAAC;AACL,UAAM,SAAS,QAAQ,UAAU;AACjC,QAAI,WAAW,OAAW,OAAM,IAAI,UAAU,0CAA0C;AACxF,UAAM;AAAA,MACJ,oBAAoB,QAAQ;AAAA,MAC5B,QAAQ,QAAQ;AAAA,MAChB,WAAW,gCAAgC,EAAE,QAAQ,QAAQ,QAAQ,OAAO,CAAC;AAAA,IAC/E,CAAC;AACD,SAAK,WAAW;AAChB,SAAK,mBAAmB,gBAAgB,SAAY,oBAAoB;AACxE,SAAK,cAAc;AAAA,EACrB;AAAA,EAEA,QAAc;AACZ,SAAK,aAAa,QAAQ;AAAA,EAC5B;AACF;;;AC5GA,SAAS,kBAAkB;AAE3B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,SAAS;AAEX,IAAM,wBAAwB;AAC9B,IAAM,6BAA6B;AACnC,IAAM,iCAAiC;AACvC,IAAM,wCAAwC;AAC9C,IAAM,0CAA0C;AAEhD,IAAM,+BAA+B,EAAE,KAAK;AAAA,EACjD;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,gCAAgC,EAAE,KAAK,CAAC,aAAa,cAAc,CAAC;AAGjF,IAAM,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC,UAAU;AAC7C,MAAI,UAAU,IAAK,QAAO;AAC1B,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,KAAK;AACzB,WAAO,IAAI,WAAW,SAAS,CAAC,SAAS,QAAQ,EAAE,SAAS,IAAI,QAAQ;AAAA,EAC1E,QAAQ;AACN,WAAO;AAAA,EACT;AACF,GAAG,4CAA4C;AAE/C,IAAM,iBAAiB,EAAE,OAAO,EAAE,OAAO,CAAC,UAAU;AAClD,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,KAAK;AACzB,WAAO,IAAI,aAAa,YAAY,IAAI,WAAW;AAAA,EACrD,QAAQ;AACN,WAAO;AAAA,EACT;AACF,GAAG,yCAAyC;AAErC,IAAM,gCAAgC,EAAE,mBAAmB,QAAQ;AAAA,EACxE,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,SAAS,EAAE,CAAC;AAAA,EAC7C,EAAE,aAAa;AAAA,IACb,MAAM,EAAE,QAAQ,sBAAsB;AAAA,IACtC,SAAS;AAAA,IACT,MAAM,EAAE,aAAa;AAAA,MACnB,gBAAgB,EAAE,MAAM,SAAS,EAAE,IAAI,CAAC;AAAA,MACxC,gBAAgB,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC;AAAA,MACtD,YAAY,EAAE,QAAQ,IAAI;AAAA,IAC5B,CAAC;AAAA,EACH,CAAC;AACH,CAAC;AAGD,IAAM,iBAAiB;AAEhB,IAAM,sCAAsC,EAAE,aAAa;AAAA,EAChE,QAAQ,EAAE,QAAQ,8BAA8B;AAAA,EAChD,eAAe,EAAE,QAAQ,CAAC;AAAA,EAC1B,eAAe,EAAE,QAAQ,qCAAqC;AAAA,EAC9D,SAAS,EAAE,aAAa;AAAA,IACtB,WAAW,EAAE,QAAQ,qBAAqB;AAAA,IAC1C,gBAAgB,EAAE,QAAQ,0BAA0B;AAAA,IACpD,QAAQ,EAAE,QAAQ,eAAe;AAAA,IACjC,UAAU,EAAE,QAAQ,eAAe;AAAA,EACrC,CAAC;AAAA,EACD,QAAQ,EAAE,aAAa;AAAA,IACrB,UAAU;AAAA,IACV,eAAe;AAAA,IACf,YAAY,EAAE,OAAO,EAAE,MAAM,cAAc;AAAA,IAC3C,YAAY,EAAE,OAAO,EAAE,MAAM,cAAc;AAAA,EAC7C,CAAC;AAAA,EACD,YAAY;AAAA,EACZ,eAAe;AAAA,EACf,QAAQ;AAAA,EACR,gBAAgB;AAAA,EAChB,oBAAoB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC9C,YAAY,EAAE,aAAa;AAAA,IACzB,gBAAgB,EAAE,QAAQ,IAAI;AAAA,IAC9B,sBAAsB,EAAE,QAAQ,IAAI;AAAA,IACpC,8BAA8B,EAAE,QAAQ,CAAC;AAAA,EAC3C,CAAC;AACH,CAAC,EAAE,YAAY,CAAC,MAAM,YAAY;AAChC,MAAI,KAAK,OAAO,aAAa,KAAK,OAAO,YAAY;AACnD,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,MACT,MAAM,CAAC,UAAU,YAAY;AAAA,IAC/B,CAAC;AAAA,EACH;AACA,MAAI,KAAK,kBAAkB,sBAAsB,KAAK,OAAO,SAAS,WAAW;AAC/E,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,MACT,MAAM,CAAC,QAAQ;AAAA,IACjB,CAAC;AAAA,EACH;AACA,MAAI,KAAK,OAAO,SAAS,wBAAwB;AAC/C,QAAI,IAAI,IAAI,KAAK,OAAO,KAAK,cAAc,EAAE,SAAS,KAAK,OAAO,KAAK,eAAe,QAAQ;AAC5F,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,SAAS;AAAA,QACT,MAAM,CAAC,UAAU,QAAQ,gBAAgB;AAAA,MAC3C,CAAC;AAAA,IACH;AACA,QAAI,IAAI,IAAI,KAAK,OAAO,KAAK,cAAc,EAAE,SAAS,KAAK,OAAO,KAAK,eAAe,QAAQ;AAC5F,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,SAAS;AAAA,QACT,MAAM,CAAC,UAAU,QAAQ,gBAAgB;AAAA,MAC3C,CAAC;AAAA,IACH;AACA,eAAW,UAAU,CAAC,OAAO,MAAM,GAAY;AAC7C,UAAI,CAAC,KAAK,OAAO,KAAK,eAAe,SAAS,MAAM,GAAG;AACrD,gBAAQ,SAAS;AAAA,UACf,MAAM;AAAA,UACN,SAAS,kCAAkC,MAAM;AAAA,UACjD,MAAM,CAAC,UAAU,QAAQ,gBAAgB;AAAA,QAC3C,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AACF,CAAC;AAIM,IAAM,8BAA8B,oCAAoC,WAAW,EAAE,gBAAgB,QAAQ,CAAC;AAGrH,SAAS,WAAW,OAAkD;AACpE,QAAM,WAAW,oCAAoC,MAAM,KAAK;AAChE,MAAI,SAAS,OAAO,SAAS,UAAW,QAAO;AAC/C,SAAO,oCAAoC,MAAM;AAAA,IAC/C,GAAG;AAAA,IACH,QAAQ;AAAA,MACN,GAAG,SAAS;AAAA,MACZ,MAAM;AAAA,QACJ,GAAG,SAAS,OAAO;AAAA,QACnB,gBAAgB,CAAC,GAAG,SAAS,OAAO,KAAK,cAAc,EAAE,KAAK;AAAA,QAC9D,gBAAgB,CAAC,GAAG,SAAS,OAAO,KAAK,cAAc,EAAE,KAAK;AAAA,MAChE;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAEO,SAAS,6BAA6B,OAAwB;AACnE,QAAM,WAAW,WAAW,KAAK;AACjC,SAAO,WAAW,QAAQ,EACvB,OAAO,GAAG,uCAAuC,GAAG,kBAAkB,QAAQ,CAAC,IAAI,MAAM,EACzF,OAAO,KAAK;AACjB;AAEO,SAAS,+BAA+B,OAA0C;AACvF,QAAM,WAAW,WAAW,KAAK;AACjC,SAAO,4BAA4B,MAAM;AAAA,IACvC,GAAG;AAAA,IACH,gBAAgB,6BAA6B,QAAQ;AAAA,EACvD,CAAC;AACH;AAEO,SAAS,+BAA+B,OAA0C;AACvF,QAAM,OAAO,4BAA4B,MAAM,KAAK;AACpD,QAAM,EAAE,gBAAgB,GAAG,mBAAmB,IAAI;AAClD,QAAM,WAAW,WAAW,kBAAkB;AAC9C,MAAI,6BAA6B,QAAQ,MAAM,gBAAgB;AAC7D,UAAM,IAAI,UAAU,sEAAsE;AAAA,EAC5F;AACA,SAAO,4BAA4B,MAAM,EAAE,GAAG,UAAU,eAAe,CAAC;AAC1E;;;AC7KA;AAAA,EACE,iBAAAA;AAAA,EACA,2BAAAC;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,KAAAC,UAAS;AAaX,IAAM,0CAA0C;AAEvD,IAAM,iBAAiBC,GAAE,IAAI,SAAS,EAAE,QAAQ,KAAK,CAAC;AAE/C,IAAM,uCAAuCA,GAAE,aAAa;AAAA,EACjE,QAAQA,GAAE,QAAQ,uCAAuC;AAAA,EACzD,eAAeA,GAAE,QAAQ,CAAC;AAAA,EAC1B,WAAWA,GAAE,QAAQ,qBAAqB;AAAA,EAC1C,gBAAgBA,GAAE,QAAQ,0BAA0B;AAAA,EACpD,eAAeA,GAAE,QAAQ,4BAA4B;AAAA,EACrD,YAAY;AAAA,EACZ,SAASC;AAAA,EACT,gBAAgBD,GAAE,OAAO,EAAE,MAAM,iBAAiB;AAAA,EAClD,cAAcA,GAAE,aAAa;AAAA,IAC3B,mBAAmBA,GAAE,QAAQ,IAAI;AAAA,IACjC,oBAAoBA,GAAE,QAAQ,IAAI;AAAA,IAClC,kBAAkBA,GAAE,QAAQ,IAAI;AAAA,IAChC,gBAAgBA,GAAE,QAAQ,IAAI;AAAA,IAC9B,gBAAgBA,GAAE,QAAQ,IAAI;AAAA,EAChC,CAAC;AACH,CAAC;AAwBD,SAAS,WAAW,MAA8B,OAA4B;AAC5E,SAAO,MAAM,eAAe,MAAM,cAC7B,KAAK,MAAM,CAAC,OAAO,UAAU,UAAU,MAAM,KAAK,CAAC;AAC1D;AAEA,SAAS,qBAAqB,OAAgB,MAAuB;AACnE,SAAO,iBAAiB,gCAAgC,MAAM,SAAS;AACzE;AAGA,eAAsB,8BACpB,SAC4C;AAC5C,QAAM,UAAUC,eAAc,MAAM,QAAQ,OAAO;AACnD,QAAM,MAAMC,yBAAwB,iBAAiB,OAAO,WAAW;AACvE,QAAM,YAAY,IAAI,YAAY,EAAE,OAAO,gBAAgB;AAC3D,QAAM,aAAa,IAAI,YAAY,EAAE,OAAO,gBAAgB;AAC5D,MAAI;AACF,UAAM,QAAQ,MAAM,QAAQ,MAAM,IAAI,KAAK,WAAW;AAAA,MACpD,aAAa;AAAA,MACb,aAAa;AAAA,IACf,CAAC;AACD,QAAI,MAAM,SAAS,OAAW,OAAM,IAAI,MAAM,8CAA8C;AAC5F,QAAI,CAAC,WAAW,MAAM,QAAQ,MAAM,IAAI,GAAG,GAAG,SAAS,EAAG,OAAM,IAAI,MAAM,uCAAuC;AACjH,QAAI;AACF,YAAM,QAAQ,MAAM,IAAI,KAAK,WAAW,EAAE,aAAa,KAAK,CAAC;AAC7D,YAAM,IAAI,MAAM,uDAAuD;AAAA,IACzE,SAAS,OAAO;AACd,UAAI,CAAC,qBAAqB,OAAO,4BAA4B,iBAAiB,EAAG,OAAM;AAAA,IACzF;AACA,UAAM,SAAS,MAAM,QAAQ,MAAM,IAAI,KAAK,YAAY,EAAE,SAAS,MAAM,KAAK,CAAC;AAC/E,QAAI,OAAO,SAAS,OAAW,OAAM,IAAI,MAAM,oDAAoD;AACnG,QAAI;AACF,YAAM,QAAQ,MAAM,IAAI,KAAK,WAAW,EAAE,SAAS,MAAM,KAAK,CAAC;AAC/D,YAAM,IAAI,MAAM,oDAAoD;AAAA,IACtE,SAAS,OAAO;AACd,UAAI,CAAC,qBAAqB,OAAO,4BAA4B,aAAa,EAAG,OAAM;AAAA,IACrF;AACA,QAAI,EAAE,MAAM,QAAQ,MAAM,KAAK,eAAe,GAAG,SAAS,GAAG,EAAG,OAAM,IAAI,MAAM,yCAAyC;AACzH,UAAM,QAAQ,MAAM,OAAO,GAAG;AAC9B,QAAI,MAAM,QAAQ,MAAM,IAAI,GAAG,MAAM,OAAW,OAAM,IAAI,MAAM,kDAAkD;AAClH,WAAO;AAAA,MACL,mBAAmB;AAAA,MACnB,oBAAoB;AAAA,MACpB,kBAAkB;AAAA,MAClB,gBAAgB;AAAA,MAChB,gBAAgB;AAAA,IAClB;AAAA,EACF,UAAE;AACA,UAAM,QAAQ,MAAM,OAAO,GAAG;AAAA,EAChC;AACF;AAGA,eAAsB,oBAAoB,SAAiF;AACzH,MAAI,EAAE,QAAQ,iBAAiB,4BAC1B,QAAQ,MAAM,qBAAqB,wBAAwB;AAC9D,UAAM,IAAI,UAAU,8FAA8F;AAAA,EACpH;AACA,QAAM,OAAO,+BAA+B,QAAQ,IAAI;AACxD,QAAM,aAAa,eAAe,MAAM,QAAQ,UAAU;AAC1D,QAAM,aAAa,WAAW,MAAM,GAAG,EAAE;AACzC,MAAI,aAAa,KAAK,OAAO,cAAc,aAAa,KAAK,OAAO,YAAY;AAC9E,UAAM,IAAI,UAAU,sEAAsE;AAAA,EAC5F;AACA,QAAM,eAAe,MAAM,8BAA8B;AAAA,IACvD,SAAS,QAAQ;AAAA,IACjB,OAAO,QAAQ;AAAA,EACjB,CAAC;AACD,SAAO,qCAAqC,MAAM;AAAA,IAChD,QAAQ;AAAA,IACR,eAAe;AAAA,IACf,WAAW;AAAA,IACX,gBAAgB;AAAA,IAChB,eAAe;AAAA,IACf;AAAA,IACA,SAAS,QAAQ;AAAA,IACjB,gBAAgB,KAAK;AAAA,IACrB;AAAA,EACF,CAAC;AACH;AAgBA,eAAsB,4BACpB,SACsC;AACtC,QAAM,OAAO,+BAA+B,QAAQ,IAAI;AACxD,MAAI,KAAK,OAAO,SAAS,uBAAwB,OAAM,IAAI,UAAU,sDAAsD;AAC3H,QAAM,MAAM,4BAA4B,KAAK,OAAO,SAAS,IAAI,QAAQ,GAAG;AAC5E,QAAM,iBAAiB,KAAK,OAAO,KAAK;AACxC,QAAM,SAAmB,CAAC;AAC1B,MAAI,CAAC,eAAe,SAAS,GAAG,KAAK,CAAC,eAAe,SAAS,QAAQ,MAAM,GAAG;AAC7E,WAAO,KAAK,2DAA2D;AAAA,EACzE;AACA,QAAM,WAAW,OAAO,QAAQ,aAAa,OAAO,KAAK;AAAA,IACvD,SAAS,EAAE,QAAQ,QAAQ,OAAO;AAAA,IAClC,QAAQ;AAAA,EACV,CAAC;AACD,MAAI,CAAC,SAAS,GAAI,QAAO,KAAK,+BAA+B,SAAS,MAAM,EAAE;AAC9E,QAAM,gBAAgB,SAAS,QAAQ,IAAI,6BAA6B;AACxE,MAAI,kBAAkB,OAAO,kBAAkB,QAAQ,OAAQ,QAAO,KAAK,mDAAmD;AAC9H,QAAM,WAAW,SAAS,QAAQ,IAAI,+BAA+B,KAAK,IACvE,MAAM,GAAG,EAAE,IAAI,WAAS,MAAM,KAAK,EAAE,YAAY,CAAC;AACrD,MAAI,CAAC,QAAQ,SAAS,MAAM,EAAG,QAAO,KAAK,gDAAgD;AAC3F,MAAI,SAAS,QAAQ,IAAI,MAAM,MAAM,KAAM,QAAO,KAAK,gCAAgC;AACvF,SAAO;AAAA,IACL;AAAA,IAAQ,SAAS,OAAO,WAAW;AAAA,IAAG;AAAA,EACxC;AACF;",
+  "names": ["IdentifierZod", "normalizeObjectStoreKey", "z", "z", "IdentifierZod", "normalizeObjectStoreKey"]
+}

package/dist/node/qualifyCloudflareR2.d.ts

@@ -0,0 +1,58 @@
+import type { ObjectStoreWriter } from '@xyo-network/dapp-kit';
+import { z } from 'zod';
+import { CloudflareR2ObjectStore } from './cloudflareR2ObjectStore.ts';
+import type { CloudflareR2ResourcePlan } from './cloudflareR2ResourcePlan.ts';
+export declare const CloudflareR2QualificationEvidenceSchema: "network.xyo.dapp.cloudflare-r2.qualification";
+export declare const CloudflareR2QualificationEvidenceZod: z.ZodObject<{
+    schema: z.ZodLiteral<"network.xyo.dapp.cloudflare-r2.qualification">;
+    schemaVersion: z.ZodLiteral<1>;
+    adapterId: z.ZodLiteral<"network.xyo.dapp.adapter.cloudflare-r2-s3">;
+    adapterVersion: z.ZodLiteral<"0.1.8">;
+    evidenceClass: z.ZodLiteral<"credentialed-cloudflare-r2">;
+    observedAt: z.ZodISODateTime;
+    probeId: z.ZodString;
+    resourcePlanId: z.ZodString;
+    capabilities: z.ZodObject<{
+        conditionalCreate: z.ZodLiteral<true>;
+        conditionalReplace: z.ZodLiteral<true>;
+        deleteVisibility: z.ZodLiteral<true>;
+        listVisibility: z.ZodLiteral<true>;
+        readAfterWrite: z.ZodLiteral<true>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type CloudflareR2QualificationEvidence = z.infer<typeof CloudflareR2QualificationEvidenceZod>;
+export interface QualifyCloudflareR2Options {
+    readonly observedAt: string;
+    readonly plan: CloudflareR2ResourcePlan;
+    readonly probeId: string;
+    readonly store: CloudflareR2ObjectStore;
+}
+export interface ProbeCloudflareR2Options {
+    readonly probeId: string;
+    readonly store: ObjectStoreWriter;
+}
+export interface CloudflareR2CapabilityProbeResult {
+    readonly conditionalCreate: true;
+    readonly conditionalReplace: true;
+    readonly deleteVisibility: true;
+    readonly listVisibility: true;
+    readonly readAfterWrite: true;
+}
+/** Exercises the destructive, prefix-confined capability matrix without assigning an evidence class. */
+export declare function probeCloudflareR2Capabilities(options: ProbeCloudflareR2Options): Promise<CloudflareR2CapabilityProbeResult>;
+/** Runs the destructive credentialed gate against an explicitly credentialed R2 instance. */
+export declare function qualifyCloudflareR2(options: QualifyCloudflareR2Options): Promise<CloudflareR2QualificationEvidence>;
+export interface AuditCloudflareR2PublicReadOptions {
+    readonly fetchImpl?: typeof fetch;
+    readonly key: string;
+    readonly origin: string;
+    readonly plan: CloudflareR2ResourcePlan;
+}
+export interface CloudflareR2PublicReadAudit {
+    readonly issues: readonly string[];
+    readonly success: boolean;
+    readonly url: string;
+}
+/** Read-only hosted audit for the public custom-domain and browser CORS boundary. */
+export declare function auditCloudflareR2PublicRead(options: AuditCloudflareR2PublicReadOptions): Promise<CloudflareR2PublicReadAudit>;
+//# sourceMappingURL=qualifyCloudflareR2.d.ts.map

package/dist/node/qualifyCloudflareR2.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"qualifyCloudflareR2.d.ts","sourceRoot":"","sources":["../../src/qualifyCloudflareR2.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AAO9D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,EACL,uBAAuB,EAExB,MAAM,8BAA8B,CAAA;AACrC,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAA;AAO7E,eAAO,MAAM,uCAAuC,EAAG,8CAAuD,CAAA;AAI9G,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;kBAgB/C,CAAA;AAEF,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAA;AAEpG,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAA;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,EAAE,uBAAuB,CAAA;CACxC;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAA;CAClC;AAED,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,iBAAiB,EAAE,IAAI,CAAA;IAChC,QAAQ,CAAC,kBAAkB,EAAE,IAAI,CAAA;IACjC,QAAQ,CAAC,gBAAgB,EAAE,IAAI,CAAA;IAC/B,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAA;IAC7B,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAA;CAC9B;AAWD,wGAAwG;AACxG,wBAAsB,6BAA6B,CACjD,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,iCAAiC,CAAC,CAuC5C;AAED,6FAA6F;AAC7F,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,0BAA0B,GAAG,OAAO,CAAC,iCAAiC,CAAC,CA0BzH;AAED,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAA;CACxC;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;IAClC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACrB;AAED,qFAAqF;AACrF,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,kCAAkC,GAC1C,OAAO,CAAC,2BAA2B,CAAC,CAuBtC"}

package/package.json

@@ -0,0 +1,68 @@
+{
+  "name": "@xyo-network/dapp-kit-cloudflare-r2",
+  "version": "0.1.9",
+  "description": "Cloudflare R2 resource adapters and qualification for headless XL1 dApps",
+  "keywords": [
+    "xyo",
+    "xl1",
+    "dapp",
+    "cloudflare",
+    "r2",
+    "typescript"
+  ],
+  "bugs": {
+    "url": "https://github.com/XYOracleNetwork/dapp-kit/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/XYOracleNetwork/dapp-kit.git",
+    "directory": "packages/dapp-kit-cloudflare-r2"
+  },
+  "license": "UNLICENSED",
+  "sideEffects": false,
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/node/index.d.ts",
+      "default": "./dist/node/index.mjs"
+    },
+    "./package.json": "./package.json",
+    "./README.md": "./README.md"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "dependencies": {
+    "@xyo-network/dapp-kit": "~0.1.9",
+    "@xyo-network/dapp-kit-s3": "~0.1.9"
+  },
+  "devDependencies": {
+    "@ariestools/toolchain": "~9.0.2",
+    "@ariestools/tsconfig": "~9.0.2",
+    "@aws-sdk/client-s3": "~3.1110.0",
+    "@noble/hashes": "~2.3.0",
+    "@types/node": "~26.2.0",
+    "eslint": "~10.8.1",
+    "eslint-import-resolver-typescript": "~4.4.5",
+    "typescript": "~6.0.3",
+    "vite": "~8.2.1",
+    "vitest": "~4.1.10",
+    "zod": "~4.4.3"
+  },
+  "peerDependencies": {
+    "@aws-sdk/client-s3": "^3.1110",
+    "@noble/hashes": "^2.3",
+    "zod": "^4.4"
+  },
+  "engines": {
+    "node": ">=24"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "test": "vitest run",
+    "test:ci": "vitest run"
+  }
+}