browser-broker 0.1.0

package/dist/src/service/storage-seed.js

@@ -0,0 +1,239 @@
+import { BrokerError } from "../errors.js";
+/**
+ * `storage_seed` on `browser_claim` (row #65, `SCHEMA.md` §3.2) — the
+ * validation, and the shape the driver is handed.
+ *
+ * ── What this argument is for ───────────────────────────────────────────
+ *
+ * **Measured: 40 calls across 25 sessions, all one shape** — fetch a token
+ * from an interface, write it into storage before the page loads, then
+ * navigate. Every one of them reached for an execute-arbitrary-code verb this
+ * design does not implement, because *seeding storage before the first load is
+ * not something a page can do to itself*: the page that would run the code
+ * does not exist until the load that needs the value already in place.
+ *
+ * That verb was not merely reached for. **Sampled, it was found being used to
+ * enumerate other callers' tabs, to read local credential files and to make
+ * authenticated outbound requests** (§9.4). This argument covers the narrow,
+ * legitimate need in that measurement — a token in storage before first load —
+ * and grants none of the rest of that reach, deliberately.
+ *
+ * ── The safety property is structural, and that is the whole claim ──────
+ *
+ * **Nothing in this argument is ever passed to an evaluator.** A validated
+ * entry is a storage area, an origin, a key and a **string**, and the service
+ * hands those to the automation layer's own storage-writing interface, which
+ * takes a key and a string. **There is no position in that call in which a
+ * caller's bytes could be read as a program** — not because the values are
+ * inspected for anything program-shaped, which would be a filter and would
+ * eventually be wrong, but because the only sink they reach does not have an
+ * interpreting position in it.
+ *
+ * **What that does and does not amount to, stated honestly.** It means this
+ * argument cannot be turned into a channel for running caller-supplied code.
+ * It does **not** mean a seeded value is harmless: a token written into an
+ * origin's storage is a credential in a browser, and on the signed-in browser
+ * that browser is shared (§1.2). What bounds that is the refusal list below
+ * and the ledger row, not this paragraph.
+ *
+ * ── The one thing the type system does not carry ────────────────────────
+ *
+ * {@link validateStorageSeed} takes `unknown`, because the value arrives from
+ * a caller across a surface and a cast at that boundary would make every
+ * declaration in this file decorative. Downstream of it the entries are
+ * {@link StorageSeedEntry}, and the driver seam declares that type — so the
+ * validation is not something a later caller can route around by constructing
+ * the object itself.
+ */
+/**
+ * A refusal from this argument.
+ *
+ * **Deliberately not the service layer's `CallRefusal`**, for the reason
+ * `pages.ts` gives at length about its own refusals: that taxonomy is a closed
+ * table of codes whose discipline is "add the row with the guard, never
+ * before it", and these guards are wired to a surface by the row that owns
+ * that table. What is carried now is the part that must not be lost in the
+ * meantime — the §7 rule name, which is what the ledger is grepped by and what
+ * §8's parity assertion counts over.
+ */
+export class StorageSeedRefusal extends BrokerError {
+    /** §3.14's "any details" — the numbers a caller branches on after the rule. */
+    detail;
+    constructor(rule, message, detail = {}) {
+        super(rule, message);
+        this.name = 'StorageSeedRefusal';
+        this.detail = detail;
+    }
+}
+/**
+ * The storage areas on offer.
+ *
+ * **An allowlist, and cookies are refused by not being on it** — the same
+ * shape `pages.ts` uses for navigation schemes and for the same reason: a
+ * denylist would permit every area nobody thought of. Both of these are
+ * per-origin key-value stores of strings, which is what makes them expressible
+ * through an interface that has no interpreting position.
+ */
+export const SEED_AREAS = ['local', 'session'];
+/**
+ * The origin schemes a seed entry may name.
+ *
+ * Ordinary web traffic only, and **the same rule and the same reason as
+ * navigation** (§3.2, §3.7). A local-file origin turns a lease into
+ * filesystem reach — which is one of the three things the sampled
+ * arbitrary-code usage was actually doing, so it is refused here rather than
+ * being left to the navigation that happens afterwards.
+ *
+ * Note there is no `about:blank` here although navigation permits it: a blank
+ * page has no origin to write storage into, so an entry naming one is not a
+ * narrower request but an incoherent one.
+ */
+export const SEED_ORIGIN_SCHEMES = ['http:', 'https:'];
+/**
+ * At most this many entries.
+ *
+ * **A bound is what makes this a seeding argument rather than a payload
+ * channel.** The measured shape is one or two tokens; sixteen is generous
+ * against that measurement rather than derived from a limit anything imposes.
+ */
+export const MAX_SEED_ENTRIES = 16;
+/**
+ * At most this many bytes in one value, measured as bytes rather than as
+ * characters.
+ *
+ * Characters would be the wrong unit for a bound whose purpose is to cap what
+ * can be carried: a string of astral-plane characters is twice the bytes of a
+ * string of the same length in Latin letters, so a character bound is a byte
+ * bound that varies by alphabet.
+ */
+export const MAX_SEED_VALUE_BYTES = 4096;
+/**
+ * The ledger's view of a seed. **Structurally cannot carry a value.**
+ *
+ * Deliberately not `entries.map((entry) => ({ ...entry }))` with a delete —
+ * the point is that the returned objects are built field by field from the
+ * three fields that may be recorded, so a value cannot arrive by being
+ * carried along.
+ */
+export function seedRecord(entries) {
+    return entries.map((entry) => ({ origin: entry.origin, area: entry.area, key: entry.key }));
+}
+/**
+ * Validate the argument, or refuse it.
+ *
+ * Returns the entries the driver will write. **An absent argument is not an
+ * error** — it is the ordinary case, and it returns an empty list rather than
+ * undefined so every caller downstream has one shape to handle.
+ *
+ * ── Why this runs before the claim row is written ───────────────────────
+ *
+ * A refused seed must leave no lease behind. It is an argument on the claim,
+ * so a claim whose seed is refused is a claim that did not happen — and the
+ * caller is not charged capacity for it, does not hold a key, and has nothing
+ * to release. `decideClaim` therefore calls this before its first insert,
+ * which is the same position the unknown-browser refusal occupies and for the
+ * same reason (§2.2).
+ */
+export function validateStorageSeed(seed) {
+    if (seed === undefined || seed === null) {
+        return [];
+    }
+    if (!Array.isArray(seed)) {
+        throw new StorageSeedRefusal('claim.seed_shape', 'A storage seed is a list of entries, each naming an origin, an area, a key and a string value.', { received: typeof seed });
+    }
+    if (seed.length > MAX_SEED_ENTRIES) {
+        throw new StorageSeedRefusal('claim.seed_bounded', `A storage seed carries at most ${String(MAX_SEED_ENTRIES)} entries and this one carries ${String(seed.length)}. The bound is what keeps this a way to seed a token rather than a way to move a payload.`, { entries: seed.length, maximum: MAX_SEED_ENTRIES });
+    }
+    return seed.map((entry, index) => validateEntry(entry, index));
+}
+/** One entry, with the position named so a refusal says which one. */
+function validateEntry(entry, index) {
+    if (typeof entry !== 'object' || entry === null || Array.isArray(entry)) {
+        throw new StorageSeedRefusal('claim.seed_shape', `Storage seed entry ${String(index)} is not an entry. Each names an origin, an area, a key and a string value.`, { index });
+    }
+    const candidate = entry;
+    return {
+        origin: validateOrigin(candidate.origin, index),
+        area: validateArea(candidate.area, index),
+        key: validateKey(candidate.key, index),
+        value: validateValue(candidate.value, index),
+    };
+}
+/**
+ * The origin refusal — **ordinary web traffic, and nothing else.**
+ *
+ * The local-file case is named in the sentence rather than matched in the
+ * condition, exactly as `pages.ts` does it: matching it would suggest the
+ * other schemes are fine, and the allowlist is what actually decides.
+ */
+function validateOrigin(origin, index) {
+    if (typeof origin !== 'string' || origin.trim() === '') {
+        throw new StorageSeedRefusal('claim.seed_origin_allowed', `Storage seed entry ${String(index)} needs an origin: ordinary web traffic, as a scheme and host.`, { index, allowedSchemes: [...SEED_ORIGIN_SCHEMES] });
+    }
+    let parsed;
+    try {
+        parsed = new URL(origin.trim());
+    }
+    catch {
+        throw new StorageSeedRefusal('claim.seed_origin_allowed', `Storage seed entry ${String(index)} does not name an origin this service can write into. Use ordinary web traffic (${SEED_ORIGIN_SCHEMES.join(', ')}).`, { index, origin: origin.trim(), allowedSchemes: [...SEED_ORIGIN_SCHEMES] });
+    }
+    if (!SEED_ORIGIN_SCHEMES.includes(parsed.protocol)) {
+        throw new StorageSeedRefusal('claim.seed_origin_allowed', `Storage seed entry ${String(index)} names an origin using "${parsed.protocol}", which this service does not write storage into. Ordinary web traffic (${SEED_ORIGIN_SCHEMES.join(', ')}) only — a local-file origin in particular would turn a browser lease into reach into this machine's filesystem.`, { index, scheme: parsed.protocol, allowedSchemes: [...SEED_ORIGIN_SCHEMES] });
+    }
+    // The origin, not the address: a path, a query or a fragment is not part of
+    // what a storage area is keyed by, and keeping one would record a
+    // distinction the browser does not make.
+    return parsed.origin;
+}
+/**
+ * The area refusal — **and this is where cookies are refused, by name.**
+ *
+ * §3.2 is explicit that a cookie is not an area on offer: *a cookie is a
+ * credential the browser sends automatically to everything matching its
+ * domain, and the read side is already limited to names and flags (§3.9), so
+ * seeding one is credential injection on a shared profile*, which §3.13
+ * refuses by name.
+ *
+ * **It is refused by not being on the allowlist**, in the same shape as every
+ * other allowlist here. It is nevertheless named in the sentence, because a
+ * caller that asked for cookies asked for something specific and being told
+ * *why* it is not on offer is what stops the next attempt being an ingenious
+ * workaround rather than a different approach.
+ */
+function validateArea(area, index) {
+    if (typeof area === 'string' && SEED_AREAS.includes(area)) {
+        return area;
+    }
+    const named = typeof area === 'string' ? JSON.stringify(area) : 'nothing';
+    const cookieNote = typeof area === 'string' && area.toLowerCase().startsWith('cookie')
+        ? ' Cookies in particular are not on offer and this is deliberate: a cookie is a credential the browser sends automatically to everything matching its domain, so seeding one is credential injection on a profile other callers share.'
+        : '';
+    throw new StorageSeedRefusal('claim.seed_area_allowed', `Storage seed entry ${String(index)} names ${named} as its storage area. The areas on offer are ${SEED_AREAS.join(' and ')}.${cookieNote}`, { index, area: typeof area === 'string' ? area : null, allowedAreas: [...SEED_AREAS] });
+}
+function validateKey(key, index) {
+    if (typeof key !== 'string' || key === '') {
+        throw new StorageSeedRefusal('claim.seed_shape', `Storage seed entry ${String(index)} needs a key, and a key is a non-empty string.`, { index });
+    }
+    return key;
+}
+/**
+ * The value refusal — **a string, and the size bound.**
+ *
+ * The string rule is the one whose reason is worth keeping in front of
+ * whoever relaxes it: *the only thing that could carry a structure is
+ * something that gets interpreted, and interpretation is the thing being
+ * refused.* A caller that wants to seed an object serialises it itself, and
+ * what arrives here is text either way — the difference is that the service
+ * never does the deserialising, so there is no step of this operation that
+ * takes a caller's bytes and builds something out of them.
+ */
+function validateValue(value, index) {
+    if (typeof value !== 'string') {
+        throw new StorageSeedRefusal('claim.seed_value_string', `Storage seed entry ${String(index)} has a ${typeof value} value. A seeded value is a string and is stored verbatim — the only thing that could carry a structure is something that gets interpreted, and interpretation is what this argument exists to avoid. Serialise it yourself and seed the text.`, { index, received: typeof value });
+    }
+    const bytes = Buffer.byteLength(value, 'utf8');
+    if (bytes > MAX_SEED_VALUE_BYTES) {
+        throw new StorageSeedRefusal('claim.seed_bounded', `Storage seed entry ${String(index)} carries ${String(bytes)} bytes and the limit is ${String(MAX_SEED_VALUE_BYTES)}. The bound is what keeps this a way to seed a token rather than a way to move a payload.`, { index, bytes, maximum: MAX_SEED_VALUE_BYTES });
+    }
+    return value;
+}

package/dist/src/service/tabs.js

@@ -0,0 +1,123 @@
+import { randomUUID } from 'node:crypto';
+/**
+ * Tab lifecycle: the identifier mapping, and the two writes that bring a tab
+ * into being (row #21).
+ *
+ * ── The one rule this file exists to keep ───────────────────────────────
+ *
+ * **The driver's name for a tab is never returned to a caller on any
+ * surface.** `SCHEMA.md` §1.4 puts the consequence plainly: exposing it
+ * "hands callers a second, non-opaque way to name a tab, which is the
+ * addressing bug arriving through a different door". Callers hold
+ * `tabs.id` — a value carrying no information about any other tab, so there
+ * is no index arithmetic to get wrong and the whole class of
+ * landed-on-the-wrong-tab bugs is deleted rather than guarded.
+ *
+ * So this module is the **only** place the two namespaces meet, and the
+ * direction is one-way by construction: {@link recordTabOpened} takes the
+ * driver's name *in* and nothing here hands one back. **Nothing this module
+ * returns carries a driver name** — `reserveTab` answers with the opaque
+ * identifier and `recordTabOpened` answers with nothing. That is the
+ * structural half.
+ *
+ * The conventional half, said rather than implied: nothing stops a future
+ * module selecting `driver_tab_id` out of the store itself and putting it in
+ * a response. The column is right there and SQL is not type-checked. What
+ * makes that visible is that it would have to be written — a fresh query,
+ * naming the column, in a file that is not this one — rather than falling out
+ * of reusing a shape that already carries it.
+ *
+ * ── This module does not reconcile against a browser, and that is a fact ─
+ * ── about the design rather than an omission to be quietly filled in ─────
+ *
+ * There is a strong pull toward putting reconciliation here, because this is
+ * where tab rows live. Resist it, and know what is already true before
+ * adding anything:
+ *
+ * **Reclaiming capacity from callers that died is the reason a lease is safe
+ * to grant at all**, and that mechanism is `arbitration.ts`, not this file.
+ * Its `sweep()` runs as step 1 of **every** arbitration call, expires every
+ * lapsed claim across the whole store, and collects the tabs they held.
+ * `updateSweptTabs` is exported from there so that release and sweep cannot
+ * spell one rule twice — a hazard with a real precedent in this store, where
+ * two writers each moved a tab to `closing` and disagreed, violating the
+ * schema's own check on the ordinary path. The after-commit close is
+ * scheduled by `runArbitration`, outside the transaction, which is what keeps
+ * §2.4b (`arbitration.no_browser_io`) true.
+ *
+ * **If you came here to change how a dead lease's tabs are cleaned up, that
+ * is the file, not this one.** A second spelling of that rule placed here
+ * would be reached by nothing, and the tests around it would stay green while
+ * the running behaviour diverged.
+ *
+ * ── The half of row #21 this build does not implement ───────────────────
+ *
+ * `MILESTONES.md` #21 asks for reconciliation against a **live** browser:
+ * asking what it actually has open, closing a page no live lease owns, and
+ * closing a row a live lease believes it owns that is not there. **No path in
+ * `src/` calls `listTabs`**, so the service never asks that question. That
+ * gap is recorded on #21 itself and carries its own row.
+ *
+ * A design for it belongs in a shape that keeps §2.4b obvious rather than
+ * incidental: the deciding must be a pure function over what the browser said
+ * and what the store holds, the writing must take a database handle and no
+ * session, and the asking must sit visibly between them. A single function
+ * holding a driver and a database handle at once is the shape that ends up
+ * called from inside a transaction, because it is the only thing that looks
+ * like it does the whole job.
+ */
+/** How long a database timestamp is spelled everywhere in this store. */
+function now() {
+    return new Date().toISOString();
+}
+/**
+ * Reserve the row for a tab that is about to be opened, and return its opaque
+ * identifier.
+ *
+ * **The row is written before the browser is asked**, in state `opening` with
+ * no driver name — which is what §1.4's `CHECK ((state = 'opening') =
+ * (driver_tab_id IS NULL))` is describing. The order is not an
+ * implementation detail:
+ *
+ * - The identifier a caller will be given has to exist before anything can
+ *   fail, or a tab that opened and then lost its answer is a page in a
+ *   browser with no row naming it — a leak nothing can find, because the
+ *   administrative operation that clears leaked tabs (§4.3) selects on rows.
+ * - It is the half of the work that belongs in the arbitration transaction.
+ *   Opening the tab is browser work and belongs after the commit (§2.4b), so
+ *   the split has to fall exactly here.
+ *
+ * The consequence is a row that can sit in `opening` forever if the open
+ * never completes, and that is the honest outcome rather than a gap: a lease
+ * whose tab never opened is visible as a lease whose tab never opened.
+ */
+export function reserveTab(db, claimId, browserId) {
+    const tabId = randomUUID();
+    db.prepare(`INSERT INTO tabs (id, claim_id, browser_id, driver_tab_id, state)
+     VALUES (?, ?, ?, NULL, 'opening')`).run(tabId, claimId, browserId);
+    return tabId;
+}
+/**
+ * Record that a reserved tab actually opened, under the driver's name for it.
+ *
+ * **This is the moment the mapping comes into being**, and it is the only
+ * write that sets `driver_tab_id`. `opened_at` is stamped with when the tab
+ * opened rather than when anybody noticed, for the same reason §2.4a gives
+ * about expiry: the two are different facts and only one of them is about the
+ * tab.
+ */
+export function recordTabOpened(db, tabId, driverTabId) {
+    const changed = db
+        .prepare(`UPDATE tabs
+          SET driver_tab_id = ?, state = 'open', opened_at = ?, updated_at = ?
+        WHERE id = ? AND state = 'opening'`)
+        .run(driverTabId, now(), now(), tabId).changes;
+    if (changed !== 1) {
+        // Not a refusal a caller ever sees: reaching here means this module was
+        // asked to open a tab twice, or to open one that was already finished
+        // with. Throwing is right because the alternative is a second driver name
+        // silently overwriting the first, leaving a real page with no row —
+        // exactly the leak `reserveTab` is ordered the way it is to prevent.
+        throw new Error(`Tab ${tabId} was not awaiting an open, so the driver name could not be recorded against it.`);
+    }
+}

package/dist/src/store/budget.js

@@ -0,0 +1,99 @@
+import { StartupRefusal } from "../errors.js";
+import { BEGIN_STATEMENT } from "./transaction.js";
+/**
+ * Compare this process's tab budget against the store's, and refuse on a
+ * disagreement.
+ *
+ * **The read and the write are one transaction, and that is not tidiness.**
+ * Two processes opening an empty store within the same instant would
+ * otherwise both read nothing and both write, and the second write is what
+ * decides — so the value recorded would be whichever process happened to be
+ * slower, and a genuine disagreement between them would be silently resolved
+ * in favour of nobody in particular. Inside one immediate transaction the
+ * loser reads the winner's row and compares against it, which is the intended
+ * behaviour rather than a race.
+ *
+ * **This is not an arbitration path**, so it opens its own transaction rather
+ * than going through the arbitration runner: it runs once per spawn, before
+ * any operation exists to arbitrate, and there is nothing to sweep on behalf
+ * of. It uses the same immediate mode for the same reason — the read-then-
+ * write window above is exactly the shape §1.0a measures as failing when the
+ * transaction does not declare its intent to write.
+ *
+ * The transaction is issued here rather than through `immediate()` from
+ * `transaction.ts` only because that helper is asynchronous and a spawn's
+ * startup checks are a synchronous sequence; the mode is identical and the
+ * literal is imported from that module so the two cannot drift.
+ */
+export function agreeOnTabBudget(db, tabs) {
+    const recorded = readAndRecord(db, tabs);
+    if (recorded.stored !== tabs) {
+        throw new StartupRefusal('budget.agrees_with_store', `This process is configured for a tab budget of ${String(tabs)} and the store records ${String(recorded.stored)}. ` +
+            'Several processes arbitrate against this bound at the same moment, so two of them believing different numbers means each admits correctly against its own belief and the ceiling stops being one. ' +
+            'Neither number is adopted and neither is overwritten: set BROKER_TAB_BUDGET to ' +
+            `${String(recorded.stored)} in this process's environment, or start against a different store.`);
+    }
+    return { tabs, recorded: recorded.wrote };
+}
+/**
+ * Read the recorded budget, writing this process's value if there is none.
+ *
+ * Returns what the store holds **after** this transaction, which is the value
+ * the caller above compares against — so a process that arrives second
+ * compares against the first's number rather than against its own.
+ *
+ * The insert tolerates a row appearing between the read and the write. That
+ * cannot happen inside an immediate transaction on this store, and the clause
+ * is there because the cost of being wrong about that is a spawn that fails
+ * with a constraint error naming nothing a person can act on, while the cost
+ * of the clause is one keyword. The re-read afterwards is what makes the
+ * tolerance safe: whatever ends up in the row is what gets compared.
+ */
+function readAndRecord(db, tabs) {
+    db.prepare(BEGIN_STATEMENT).run();
+    try {
+        const before = db.prepare('SELECT tabs FROM tab_budget WHERE only_row = 1').get();
+        if (before !== undefined) {
+            db.prepare('COMMIT').run();
+            return { stored: before.tabs, wrote: false };
+        }
+        db.prepare('INSERT OR IGNORE INTO tab_budget (only_row, tabs) VALUES (1, ?)').run(tabs);
+        const after = db.prepare('SELECT tabs FROM tab_budget WHERE only_row = 1').get();
+        db.prepare('COMMIT').run();
+        return { stored: after.tabs, wrote: after.tabs === tabs };
+    }
+    catch (error) {
+        // ── Why the rollback is guarded and the original error is rethrown ────
+        //
+        // **Both success paths above have already issued their own `COMMIT`**, so
+        // for any failure at or after that point there is no transaction left to
+        // roll back, and the rollback statement itself throws `SQLITE_ERROR:
+        // cannot rollback - no transaction is active`. Left unguarded that error
+        // is the one the caller receives, and the failure that brought us into
+        // this catch is never reported at all.
+        //
+        // Measured: calling `prepareStore` with an environment lacking
+        // `tabBudget` surfaces "cannot rollback - no transaction is active",
+        // while a statement-level trace shows `ROLLBACK` is the only statement
+        // that throws — the actual cause being a `CHECK (tabs > 0)` violation
+        // from `schema/step-002-tab-budget.ts`, because `undefined` binds as
+        // NULL. `agreeOnTabBudget` runs on **every spawn**, so this sits on the
+        // startup path of every process.
+        //
+        // The rollback is still attempted, because the failure that lands here
+        // may well be one that left a transaction open, and leaving it open would
+        // hold a write lock every other process is waiting behind. It simply does
+        // so silently: a rollback that cannot happen has nothing to report, and
+        // the error worth reporting is already in hand.
+        // `tests/concurrency/worker-transaction-mode.mjs` carries the same
+        // reasoning at its own rollback.
+        try {
+            db.prepare('ROLLBACK').run();
+        }
+        catch {
+            // A transaction the engine already ended cannot be rolled back, and
+            // saying so would drown out the error that is actually worth reading.
+        }
+        throw error;
+    }
+}

package/dist/src/store/location.js

@@ -0,0 +1,42 @@
+import { refuseNetworkLocation } from "./network-path.js";
+/**
+ * Where the store file is.
+ *
+ * `store.location_from_environment_only` (`SCHEMA.md` §7.2): the location
+ * comes from the environment and is never read from the database. The reason
+ * is not a preference — **a value that is only readable after you have opened
+ * the file cannot tell you which file to open**, and a wrong value stored
+ * inside would be unfixable through the surface it broke (§6.1).
+ *
+ * That rule is held here structurally: this module imports the environment
+ * snapshot and the network-path refusal, and **nothing from `open.ts`**. It
+ * has no store client to read through, so there is no read path to police.
+ */
+/**
+ * Resolve the store location, refusing a network one.
+ *
+ * **The checks run against both the value as it was configured and the value
+ * after resolution, and the first of those is not redundant.**
+ *
+ * Resolving a path applies the host platform's own rules, and those rules
+ * disagree about what a share even is: on a platform whose separator is the
+ * forward slash, the two-backslash spelling is not a root at all — it is an
+ * ordinary relative filename that happens to contain backslashes, so resolving
+ * it prefixes the working directory and the share root is gone. A check that
+ * only ever saw the resolved value would therefore refuse a share on one
+ * platform and silently create a bizarrely-named local file on another, from
+ * identical configuration.
+ *
+ * **A location that was not configured is not checked in its configured
+ * form**, because there is no configured form to check — the resolved value is
+ * a path this build computed from the platform's own application-data
+ * location, and it is checked on its own account below.
+ */
+export function resolveStoreLocation(environment, checks) {
+    const location = environment.databasePath;
+    if (environment.configuredDatabasePath !== undefined) {
+        refuseNetworkLocation(environment.configuredDatabasePath, checks);
+    }
+    refuseNetworkLocation(location, checks);
+    return location;
+}