direction: right

clients: "Organization clients" {
  wrangler: "Wrangler\nr2_buckets binding"
  s3: "AWS CLI · boto3 · S3 SDK\nSigV4 access key"
  browser: "Console\nbrowser + versions + lifecycle"
  worker: "Dynamic Worker isolate\nenv.MEDIA"
}

identity: "Identity service" {
  rbac: "Organization RBAC\nstorage.read · storage.write"
  keys: "SQLite\naccess-key metadata + scopes"
  derive: "HMAC-derived secret\nmaster key stays private"
}

control: "Control plane" {
  r2api: "Wrangler-compatible R2 API"
  validate: "Deployment validation\nbucket belongs to organization"
  artifact: "Immutable artifact\nbinding name + bucket only"
}

ingress: "HAProxy" {
  worker_host: "*.workers.ermahgerd.localhost"
  s3_host: "<namespace>.r2.ermahgerd.localhost"
}

runtime: "Shared Worker runtime" {
  dispatcher: "Trusted dispatcher"
  adapter: "R2 binding adapter\nbucket-scoped capability"
}

storage: "Dedicated storage workerd service" {
  s3api: "Barbara S3 + private binding API"
  catalogs: "Durable Object catalog\none namespace per organization"
  blobs: "Writable blob disk\nrandom internal object paths"
}

clients.browser -> identity.rbac: "session-authenticated key lifecycle"
clients.browser -> control.r2api: "session-authenticated objects, versions, and lifecycle"
clients.wrangler -> control.validate: "upload Worker version"
control.validate -> storage.s3api: "private bucket lookup\norganization header + service token"
control.validate -> control.artifact
clients.s3 -> ingress.s3_host
ingress.s3_host -> storage.s3api: "preserve signed Host + request"
storage.s3api -> identity.keys: "private access-key resolution"
identity.keys -> identity.derive
clients.worker -> runtime.adapter: "get · head · put · delete · list"
runtime.dispatcher -> control.artifact: "fetch trusted artifact"
runtime.dispatcher -> runtime.adapter: "mint organization + bucket props"
runtime.adapter -> storage.s3api: "private request\norganization + service token"
storage.s3api -> storage.catalogs
storage.catalogs -> storage.blobs

boundaries: "Security properties" {
  text: "Application code receives neither SigV4 credentials nor the storage service token.\nThe storage process alone can write blob and catalog state.\nS3 keys, console sessions, and Worker bindings converge on the same organization catalog."
}