@ddd-ts-kit/http 0.7.0 → 0.9.0

package/README.md

@@ -87,7 +87,7 @@ const routes = controllerRoutes([PlaceOrderController], { resolve: application.r
 | `Controller(spec)` | the decorator of a controller: `group`, `method`, `path` (after the prefix of the group), `operationId` (the class name without `Controller` by default), `summary`, `description`, `tags`, `params`, `query`, `headers`, `body`, `response: { status, description?, body? }`, `errors`, `guards`, `deprecated` |
 | `RouteGroup({ parent, prefix, tags, guards, errors })` | names a set of routes on an empty class; a child inherits from its `parent` and adds |
 | `Guard` | the interface `{ documents?, check(request: GuardRequest) }`, and the decorator of a guard class that takes dependencies |
-| `Authenticated`, `Public`, `HasRole(...roles)` | the guards the package ships, over the `Actor` of the request: 401 to the anonymous caller, 403 without one of the roles; `Public` lets everybody in and stands alone |
+| `Authenticated`, `Public`, `HasRole(...roles)`, `HasScope(...scopes)`, `TenantMember` | the guards the package ships, over the `Actor` and the `Session` of the request: 401 to the anonymous caller, 403 without one of the roles, without every scope named (`Session.scopes`, typed by the `SessionScopes` of the project) or outside the tenant of the request; `Public` lets everybody in and stands alone. A refusal of a guard is reported to `onGuardRefusal` |
 | `RequestMapper<Request, Message>`, `Serializer<Result, Body>` | the interfaces of the two optional translators (`map`, `serialize`), and the decorators that declare them |
 | `HttpRequest<{ params, query, headers, body }>` | the request as `handle`, a mapper or a guard names it, with `actor` and `context` |
 | `controllerRoutes(controllers, { resolve, security, guards })` | the `Route` of each controller, given as a class (built by `resolve`) or as an instance; `security` names the schemes of the application (`['bearer']` by default); `guards: 'skip'` is for the spec of a controller alone |
@@ -176,6 +176,16 @@ const options: ExecuteOptions = {
 };
 ```
 
+`onGuardRefusal(refusal)` is told, and awaited, every request a guard refused before its
+controller (`HasRole`, `HasScope`, `TenantMember`, a guard of the project, and a tenant the caller
+does not belong to): its operation, its problem and its execution context. Those refusals reach
+no use case, so the authorization hook of `@ddd-ts-kit/auth` never sees them;
+`auditGuardRefusals(trail, { clock, ids })` of `@ddd-ts-kit/audit` writes each one to the audit
+trail as a denied decision (an anonymous caller's excepted). Only a refusal is reported, a
+`DomainError` such as `UnauthorizedError` or `ForbiddenError`: a guard that fails with another
+error is a fault, answered 500 and not reported. A refusal of a handler is not reported there,
+and a hook that fails does not change the answer.
+
 `around(route, respond)` wraps the whole handling of a request, from authentication to the
 answer, refusals included, and is told the route that was matched (`method`, `path` as
 declared, `operationId`). It is where a tracer names a request `POST /orders/:id/lines` instead
@@ -194,7 +204,7 @@ as `context.execution`:
 | `correlationId` | the incoming `x-correlation-id` when well formed (letters, digits, `._:-`, at most 128), else the request id; echoed in the `x-correlation-id` response header, on problems too, and given to `onError` |
 | `origin` | `http` |
 | `actor`, `session` | from what `resolvePrincipal` answered, read structurally: a `Session` gives both, an `Actor` gives the actor, anything else is the anonymous actor |
-| `tenantId` | the tenant of the actor |
+| `tenantId` | the tenant `resolveTenant` names, once the caller is known to belong to it; the tenant of the actor otherwise |
 | `locale` | the locale of the session, else the preferred language of `Accept-Language` |
 | `deadline` | arrival plus `requestTimeoutMs`, when the option is set |
 
@@ -219,6 +229,36 @@ option that says when a request arrived, the system clock by default.
 Use cases still receive the actor explicitly: `new PlaceOrder(context.execution.actor, body)`,
 or `actorOf(context.principal)` of `@ddd-ts-kit/auth`, which reads the same actor.
 
+### The tenant of a request
+
+A multi-tenant application says where a request names its tenant with `resolveTenant`:
+
+```ts
+import { firstTenantOf, tenantFromClaim, tenantFromSubdomain } from '@ddd-ts-kit/http';
+
+const options: ExecuteOptions = {
+  resolveTenant: firstTenantOf(tenantFromSubdomain('app.example.com'), tenantFromClaim()),
+  // or tenantFromHeader('x-tenant-id'), tenantFromPath('tenantId')
+};
+```
+
+| Resolver | Names |
+|---|---|
+| `tenantFromSubdomain(baseDomain)` | the one label left of the base domain in `Host` (`acme.app.example.com`); behind a proxy, have it pass the original host |
+| `tenantFromHeader(name?)` | the value of a header, `x-tenant-id` by default |
+| `tenantFromPath(parameter?)` | a path parameter, `tenantId` by default |
+| `tenantFromClaim()` | the tenant of the credential, `Actor.tenantId` |
+| `firstTenantOf(...resolvers)` | the first that names one |
+
+The pipeline then checks the membership itself, before any guard or handler: an authenticated
+caller that does not belong to the tenant named (its `tenantId`, or its `tenants` attribute for an
+actor of several tenants) is answered 403, so a header or a subdomain chosen by a client never
+opens another tenant's data. An anonymous caller keeps the tenant it addressed, for the public
+routes of a tenant. The guard `TenantMember` puts a group of routes behind a tenant: 401 to the
+anonymous caller, 403 to a request in no tenant or of another tenant. Platform staff do not pass
+it: they reach tenants through an elevation of the kernel (`acrossTenants`), behind guards of their
+own.
+
 ## In the composition root
 
 The package binds and resolves nothing: routes are a plain list and `ExecuteOptions` a plain
@@ -494,9 +534,72 @@ one document at a time: `/docs` lists their pages); one document is served as
 `openApiDocsRoutes` serves it. A generated project reads the documents from
 `openapi.documents` of `ddd-ts-kit.config.json`, through `src/platform/http/openapi-documents.ts`.
 
+## Uploads and files
+
+A controller that receives a file declares it, and the declaration is the contract: the field,
+the most it may weigh and the media types it may be, which the OpenAPI document states
+(`multipart/form-data`, `x-max-bytes`, `x-media-types`, the 413, 415 and 422 refusals).
+
+```ts
+@Controller({
+  group: AppointmentRoutes,
+  method: 'POST',
+  path: '/:appointmentId/document',
+  summary: 'Attach a document to an appointment',
+  params,
+  body, // the text fields, sent before the file
+  upload: { field: 'document', maxBytes: 10_000_000, mediaTypes: ['application/pdf', 'image/*'] },
+  response: { status: 201, body: attached },
+})
+export class AttachDocumentController {
+  constructor(private readonly commands: CommandBus) {}
+
+  async handle({ params, upload, actor }: HttpRequest<{ params: Params; upload: IncomingFile }>) {
+    return this.commands.execute(new AttachDocument(actor, params.appointmentId, upload));
+  }
+}
+```
+
+The routes are mounted with an upload reader, `multipartUploads()` of `@ddd-ts-kit/http/uploads`
+(on busboy, an optional peer: `npm i busboy`):
+
+```ts
+import { multipartUploads } from '@ddd-ts-kit/http/uploads';
+
+mountExpress(app, routes, { ...options, uploads: multipartUploads() });
+```
+
+The file reaches `handle` while it still streams, never held whole: the command wraps it in a
+`FileUpload` of the kernel, which `fileUploadsMiddleware` of the command bus stages before the
+transaction opens. On its way the content is
+counted, and refused with `FILE_TOO_LARGE` (413) beyond `maxBytes`; its first bytes must prove
+the media type the client declared and that type must be accepted, or it is refused with
+`UNSUPPORTED_MEDIA_TYPE` (415), before a byte reaches the storage. A request announcing a body
+far larger than the file allowed is refused before it is read; a form without the file, 422.
+Text fields sent after the file are not read. `fileName` is shown back to people, never used as
+a key: the key is generated on the server.
+
+For a large file, the client uploads straight to the storage instead: a command signs an upload
+link (`FileStaging.uploadUrl`) and records the grant it answers on the aggregate, the client
+sends the file to the link, and a second command confirms from that grant
+(`FileStaging.confirm(pending)`, which checks the size and the media type on what arrived). A
+client that drops the connection part-way fails the file stream, so a handler waiting on it
+rejects instead of waiting forever.
+
+`signedFileRoutes(storage, { prefix: '/files' })` answers the signed links of a storage the
+application serves itself, the local directory of development or the memory of the tests:
+`GET /files?token=` downloads (as an attachment, `nosniff`, `no-store`), `PUT /files?token=`
+uploads, refused with 413 beyond the size the link was signed for. They are public, the token being the grant, and are not part of the contract. With
+Express, mount them before `express.json()`: that parser reads a JSON body first. An object
+store answers its own links and needs no route.
+
+A handler may answer a stream (`Readable`) as its body: it is piped to the response, with its
+own `content-type`.
+
 ## Limits
 
 - A body the framework itself refuses (malformed JSON, payload too large) is answered by the
   framework's own error handler, before the pipeline runs.
-- Routes are JSON first. A handler may answer a string or bytes by setting its own
-  `content-type` header; streaming is out of scope.
+- Routes are JSON first. A handler may answer a string, bytes or a stream by setting its own
+  `content-type` header. A request body streams only as a declared upload or a raw body
+  (`rawBody`): server-sent events and WebSockets are written natively in the framework.

package/dist/controller/controller-request.d.ts

@@ -1,5 +1,7 @@
 import type { Actor } from '@ddd-ts-kit/kernel';
 import type { HandlerInput } from '../route/handler-input.js';
+import type { IncomingFile } from '../route/incoming-file.js';
+import type { UploadSpec } from '../route/upload-spec.js';
 import type { ControllerSpec } from './controller-spec.js';
 /**
  * What `handle` receives for a given declaration: each part has the type its schema produces,
@@ -7,5 +9,9 @@ import type { ControllerSpec } from './controller-spec.js';
  */
 export type ControllerRequest<Spec extends ControllerSpec = ControllerSpec> = HandlerInput<Spec> & {
     readonly actor: Actor;
-};
+} & (Spec extends {
+    readonly upload: UploadSpec;
+} ? {
+    readonly upload: IncomingFile;
+} : unknown);
 //# sourceMappingURL=controller-request.d.ts.map

package/dist/controller/controller-request.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"controller-request.d.ts","sourceRoot":"","sources":["../../src/controller/controller-request.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D;;;GAGG;AACH,MAAM,MAAM,iBAAiB,CAAC,IAAI,SAAS,cAAc,GAAG,cAAc,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG;IACjG,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;CACvB,CAAC"}
+{"version":3,"file":"controller-request.d.ts","sourceRoot":"","sources":["../../src/controller/controller-request.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D;;;GAGG;AACH,MAAM,MAAM,iBAAiB,CAAC,IAAI,SAAS,cAAc,GAAG,cAAc,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG;IACjG,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;CACvB,GAAG,CAAC,IAAI,SAAS;IAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAA;CAAE,GAAG,OAAO,CAAC,CAAC"}

package/dist/controller/controller-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"controller-routes.d.ts","sourceRoot":"","sources":["../../src/controller/controller-routes.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAO9E;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,SAAS,CAAC,eAAe,GAAG,gBAAgB,CAAC,EAAE,EAC5D,OAAO,GAAE,uBAA4B,GACpC,SAAS,KAAK,EAAE,CAMlB"}
+{"version":3,"file":"controller-routes.d.ts","sourceRoot":"","sources":["../../src/controller/controller-routes.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAQ9E;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,SAAS,CAAC,eAAe,GAAG,gBAAgB,CAAC,EAAE,EAC5D,OAAO,GAAE,uBAA4B,GACpC,SAAS,KAAK,EAAE,CAMlB"}

package/dist/controller/controller-routes.js

@@ -1,4 +1,6 @@
+import { DomainError } from '@ddd-ts-kit/kernel';
 import { assertUniqueRoutes } from '../route/assert-unique-routes.js';
+import { guardRefusals } from './guard-refusals.js';
 import { resolvedController } from './resolved-controller.js';
 const DEFAULT_SECURITY = ['bearer'];
 /**
@@ -23,19 +25,36 @@ function routeOf(resolved, options) {
         ...(declared.tags.length === 0 ? {} : { tags: declared.tags }),
         ...(declared.groups.length === 0 ? {} : { groups: declared.groups }),
         ...requestOf(spec),
+        ...(spec.upload === undefined ? {} : { upload: spec.upload }),
         responses: { [status]: { description: description ?? defaultDescription(body), ...bodyOf(body) } },
         errors: [...new Set([...declared.errors, ...resolved.guards.flatMap((guard) => guard.documents?.errors ?? [])])],
         security: securityOf(resolved.guards, options.security ?? DEFAULT_SECURITY),
         ...(spec.deprecated === true ? { deprecated: true } : {}),
         async handle(input) {
-            for (const guard of guards) {
-                await guard.check(guardRequest(identity, input));
-            }
+            await passedGuards(guards, guardRequest(identity, input));
             const answer = await controller.handle({ ...input, actor: input.context.execution.actor });
             return body === undefined ? { status } : { status, body: answer };
         },
     };
 }
+/**
+ * Every guard, in order. A refusal one throws (a `DomainError`: `UnauthorizedError`,
+ * `ForbiddenError` or one of the project) is marked as a refusal at the edge before it goes on to
+ * the pipeline; a fault (a lookup that failed) is not, and is never audited as a decision.
+ */
+async function passedGuards(guards, request) {
+    try {
+        for (const guard of guards) {
+            await guard.check(request);
+        }
+    }
+    catch (error) {
+        if (error instanceof DomainError) {
+            guardRefusals.mark(error);
+        }
+        throw error;
+    }
+}
 function requestOf(parts) {
     const declared = Object.entries({
         params: parts.params,

package/dist/controller/controller-routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"controller-routes.js","sourceRoot":"","sources":["../../src/controller/controller-routes.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAUtE,OAAO,EAAE,kBAAkB,EAA2B,MAAM,0BAA0B,CAAC;AAEvF,MAAM,gBAAgB,GAAG,CAAC,QAAQ,CAAC,CAAC;AAEpC;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,WAA4D,EAC5D,OAAO,GAA4B,EAAE;IAErC,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAExG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAE3B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,OAAO,CAAC,QAA4B,EAAE,OAAgC;IAC7E,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC;IAChD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;IAChE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;IACpD,MAAM,QAAQ,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC;IAEjG,OAAO;QACL,GAAG,QAAQ;QACX,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;QAC5E,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC9D,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpE,GAAG,SAAS,CAAC,IAAI,CAAC;QAClB,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,WAAW,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE;QAClG,MAAM,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAChH,QAAQ,EAAE,UAAU,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,IAAI,gBAAgB,CAAC;QAC3E,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,KAAK,CAAC,MAAM,CAAC,KAAiB;YAC5B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,MAAM,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;YACnD,CAAC;YAED,MAAM,MAAM,GAAY,MAAM,UAAU,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC;YAEpG,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QACpE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,KAAqB;IACtC,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC;QAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,KAAK,CAAC,IAAI;KACjB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;IAEhD,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;AAChF,CAAC;AAED,SAAS,MAAM,CAAC,IAAiC;IAC/C,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;AAC5C,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAiC;IAC3D,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC;AACtD,CAAC;AAED,SAAS,UAAU,CAAC,MAAwB,EAAE,OAA0B;IACtE,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC,EAAE,CAAC;QAC7D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC;IAEzE,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,YAAY,CACnB,QAA+D,EAC/D,KAAiB;IAEjB,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC1B,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC;IAE7C,OAAO;QACL,GAAG,QAAQ;QACX,MAAM,EAAE,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE;QAC5F,OAAO,EAAE,OAAO,CAAC,UAAU,IAAI,EAAE;QACjC,KAAK;QACL,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;QAC7C,OAAO;KACR,CAAC;AACJ,CAAC"}
+{"version":3,"file":"controller-routes.js","sourceRoot":"","sources":["../../src/controller/controller-routes.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAStE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,EAAE,kBAAkB,EAA2B,MAAM,0BAA0B,CAAC;AAEvF,MAAM,gBAAgB,GAAG,CAAC,QAAQ,CAAC,CAAC;AAEpC;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,WAA4D,EAC5D,OAAO,GAA4B,EAAE;IAErC,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAExG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAE3B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,OAAO,CAAC,QAA4B,EAAE,OAAgC;IAC7E,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC;IAChD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;IAChE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;IACpD,MAAM,QAAQ,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC;IAEjG,OAAO;QACL,GAAG,QAAQ;QACX,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;QAC5E,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC9D,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpE,GAAG,SAAS,CAAC,IAAI,CAAC;QAClB,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;QAC7D,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,WAAW,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE;QAClG,MAAM,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAChH,QAAQ,EAAE,UAAU,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,IAAI,gBAAgB,CAAC;QAC3E,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,KAAK,CAAC,MAAM,CAAC,KAAiB;YAC5B,MAAM,YAAY,CAAC,MAAM,EAAE,YAAY,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;YAE1D,MAAM,MAAM,GAAY,MAAM,UAAU,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC;YAEpG,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QACpE,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,YAAY,CAAC,MAAwB,EAAE,OAAqB;IACzE,IAAI,CAAC;QACH,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;YACjC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;QAED,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,KAAqB;IACtC,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC;QAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,KAAK,CAAC,IAAI;KACjB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;IAEhD,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;AAChF,CAAC;AAED,SAAS,MAAM,CAAC,IAAiC;IAC/C,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;AAC5C,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAiC;IAC3D,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC;AACtD,CAAC;AAED,SAAS,UAAU,CAAC,MAAwB,EAAE,OAA0B;IACtE,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC,EAAE,CAAC;QAC7D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC;IAEzE,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,YAAY,CACnB,QAA+D,EAC/D,KAAiB;IAEjB,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC1B,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC;IAE7C,OAAO;QACL,GAAG,QAAQ;QACX,MAAM,EAAE,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE;QAC5F,OAAO,EAAE,OAAO,CAAC,UAAU,IAAI,EAAE;QACjC,KAAK;QACL,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;QAC7C,OAAO;KACR,CAAC;AACJ,CAAC"}

package/dist/controller/controller-spec.d.ts

@@ -1,5 +1,6 @@
 import type { Schema } from '@ddd-ts-kit/validation';
 import type { HttpMethod } from '../route/http-method.js';
+import type { UploadSpec } from '../route/upload-spec.js';
 import type { ControllerResponse } from './controller-response.js';
 import type { GuardReference } from './guard-reference.js';
 import type { RouteGroupClass } from './route-group-class.js';
@@ -20,6 +21,12 @@ export interface ControllerSpec {
     readonly query?: Schema<unknown>;
     readonly headers?: Schema<unknown>;
     readonly body?: Schema<unknown>;
+    /**
+     * A file received as `multipart/form-data`, its field, size and media types stated here and in
+     * the contract; `handle` then reads `upload`, and `body` describes the text fields. Send the
+     * text fields before the file: what follows it is not read.
+     */
+    readonly upload?: UploadSpec;
     readonly response: ControllerResponse;
     /** Domain error codes the route may answer, added to those of its group and of its guards. */
     readonly errors?: readonly string[];

package/dist/controller/controller-spec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"controller-spec.d.ts","sourceRoot":"","sources":["../../src/controller/controller-spec.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAE9D,oFAAoF;AACpF,MAAM,WAAW,cAAc;IAC7B,uFAAuF;IACvF,QAAQ,CAAC,KAAK,CAAC,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,yGAAyG;IACzG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,0EAA0E;IAC1E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,sCAAsC;IACtC,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAClC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IACjC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IACnC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,8FAA8F;IAC9F,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,qHAAqH;IACrH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;IAC5C,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;CAC/B"}
+{"version":3,"file":"controller-spec.d.ts","sourceRoot":"","sources":["../../src/controller/controller-spec.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAE9D,oFAAoF;AACpF,MAAM,WAAW,cAAc;IAC7B,uFAAuF;IACvF,QAAQ,CAAC,KAAK,CAAC,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,yGAAyG;IACzG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,0EAA0E;IAC1E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,sCAAsC;IACtC,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAClC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IACjC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IACnC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,8FAA8F;IAC9F,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,qHAAqH;IACrH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;IAC5C,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;CAC/B"}

package/dist/controller/guard-refusals.d.ts

@@ -0,0 +1,9 @@
+/**
+ * The errors a guard threw to refuse a request, told apart from the refusals of a handler so
+ * that the pipeline can report them as refusals at the edge (`onGuardRefusal`).
+ */
+export declare const guardRefusals: {
+    mark(error: unknown): void;
+    has(error: unknown): boolean;
+};
+//# sourceMappingURL=guard-refusals.d.ts.map

package/dist/controller/guard-refusals.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard-refusals.d.ts","sourceRoot":"","sources":["../../src/controller/guard-refusals.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,eAAO,MAAM,aAAa;IACxB,IAAI,QAAQ,OAAO,GAAG,IAAI;IAK1B,GAAG,QAAQ,OAAO,GAAG,OAAO;CAG7B,CAAC"}

package/dist/controller/guard-refusals.js

@@ -0,0 +1,16 @@
+const refused = new WeakSet();
+/**
+ * The errors a guard threw to refuse a request, told apart from the refusals of a handler so
+ * that the pipeline can report them as refusals at the edge (`onGuardRefusal`).
+ */
+export const guardRefusals = {
+    mark(error) {
+        if (typeof error === 'object' && error !== null) {
+            refused.add(error);
+        }
+    },
+    has(error) {
+        return typeof error === 'object' && error !== null && refused.has(error);
+    },
+};
+//# sourceMappingURL=guard-refusals.js.map

package/dist/controller/guard-refusals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard-refusals.js","sourceRoot":"","sources":["../../src/controller/guard-refusals.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,GAAG,IAAI,OAAO,EAAU,CAAC;AAEtC;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,IAAI,CAAC,KAAc;QACjB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAChD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,GAAG,CAAC,KAAc;QAChB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3E,CAAC;CACF,CAAC"}

package/dist/controller/guards/has-scope.d.ts

@@ -0,0 +1,10 @@
+import { type SessionScope } from '@ddd-ts-kit/kernel';
+import type { Guard } from '../guard.js';
+/**
+ * Lets through a request whose session was granted every scope named (`Session.scopes`, the
+ * `scope` claim of the token): 401 to the anonymous caller, 403 when one is missing. A scope
+ * limits the client that presents the credential (a mobile application, an integration); what
+ * the actor may do stays a permission of the use case.
+ */
+export declare function HasScope(...scopes: readonly SessionScope[]): Guard;
+//# sourceMappingURL=has-scope.d.ts.map

package/dist/controller/guards/has-scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"has-scope.d.ts","sourceRoot":"","sources":["../../../src/controller/guards/has-scope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAyB,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAI9E,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEzC;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,GAAG,MAAM,EAAE,SAAS,YAAY,EAAE,GAAG,KAAK,CAiBlE"}

package/dist/controller/guards/has-scope.js

@@ -0,0 +1,27 @@
+import { hasScope, isAnonymous } from '@ddd-ts-kit/kernel';
+import { DeclarationError } from '@ddd-ts-kit/kernel/declarations';
+import { ForbiddenError } from '../../error/forbidden-error.js';
+import { UnauthorizedError } from '../../error/unauthorized-error.js';
+/**
+ * Lets through a request whose session was granted every scope named (`Session.scopes`, the
+ * `scope` claim of the token): 401 to the anonymous caller, 403 when one is missing. A scope
+ * limits the client that presents the credential (a mobile application, an integration); what
+ * the actor may do stays a permission of the use case.
+ */
+export function HasScope(...scopes) {
+    if (scopes.length === 0) {
+        throw new DeclarationError('HasScope() names no scope: name at least one, or use Authenticated.');
+    }
+    return {
+        documents: { errors: ['UNAUTHORIZED', 'FORBIDDEN'] },
+        check({ actor, session }) {
+            if (isAnonymous(actor)) {
+                throw new UnauthorizedError('Authentication is required');
+            }
+            if (!scopes.every((scope) => hasScope(session, scope))) {
+                throw new ForbiddenError('A scope this route requires was not granted');
+            }
+        },
+    };
+}
+//# sourceMappingURL=has-scope.js.map

package/dist/controller/guards/has-scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"has-scope.js","sourceRoot":"","sources":["../../../src/controller/guards/has-scope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAqB,MAAM,oBAAoB,CAAC;AAC9E,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAGtE;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,GAAG,MAA+B;IACzD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,gBAAgB,CAAC,qEAAqE,CAAC,CAAC;IACpG,CAAC;IAED,OAAO;QACL,SAAS,EAAE,EAAE,MAAM,EAAE,CAAC,cAAc,EAAE,WAAW,CAAC,EAAE;QACpD,KAAK,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE;YACtB,IAAI,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAI,iBAAiB,CAAC,4BAA4B,CAAC,CAAC;YAC5D,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;gBACvD,MAAM,IAAI,cAAc,CAAC,6CAA6C,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/controller/guards/tenant-member.d.ts

@@ -0,0 +1,9 @@
+import type { Guard } from '../guard.js';
+/**
+ * Lets through a caller that belongs to the tenant of the request: 401 to the anonymous caller,
+ * 403 to a request that names no tenant or to a caller of another tenant. The routes of tenant
+ * data stand behind it; the routes of platform staff stand behind a guard of their own, and
+ * reach tenants through an elevation, never through this one.
+ */
+export declare const TenantMember: Guard;
+//# sourceMappingURL=tenant-member.d.ts.map

package/dist/controller/guards/tenant-member.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-member.d.ts","sourceRoot":"","sources":["../../../src/controller/guards/tenant-member.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEzC;;;;;GAKG;AACH,eAAO,MAAM,YAAY,EAAE,KAa1B,CAAC"}

package/dist/controller/guards/tenant-member.js

@@ -0,0 +1,22 @@
+import { isAnonymous, isTenantMember } from '@ddd-ts-kit/kernel';
+import { ForbiddenError } from '../../error/forbidden-error.js';
+import { UnauthorizedError } from '../../error/unauthorized-error.js';
+/**
+ * Lets through a caller that belongs to the tenant of the request: 401 to the anonymous caller,
+ * 403 to a request that names no tenant or to a caller of another tenant. The routes of tenant
+ * data stand behind it; the routes of platform staff stand behind a guard of their own, and
+ * reach tenants through an elevation, never through this one.
+ */
+export const TenantMember = {
+    documents: { errors: ['UNAUTHORIZED', 'FORBIDDEN'] },
+    check({ actor, context }) {
+        if (isAnonymous(actor)) {
+            throw new UnauthorizedError('Authentication is required');
+        }
+        const { tenantId } = context.execution;
+        if (tenantId === undefined || !isTenantMember(actor, tenantId)) {
+            throw new ForbiddenError('This route serves the members of a tenant');
+        }
+    },
+};
+//# sourceMappingURL=tenant-member.js.map

package/dist/controller/guards/tenant-member.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-member.js","sourceRoot":"","sources":["../../../src/controller/guards/tenant-member.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAGtE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,YAAY,GAAU;IACjC,SAAS,EAAE,EAAE,MAAM,EAAE,CAAC,cAAc,EAAE,WAAW,CAAC,EAAE;IACpD,KAAK,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE;QACtB,IAAI,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,iBAAiB,CAAC,4BAA4B,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC;QAEvC,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,cAAc,CAAC,2CAA2C,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;CACF,CAAC"}

package/dist/controller/http-request.d.ts

@@ -6,22 +6,28 @@ interface Parts {
     readonly query?: unknown;
     readonly headers?: unknown;
     readonly body?: unknown;
+    readonly upload?: unknown;
 }
 type Part<Given, Name extends keyof Parts, Default> = Given extends {
     readonly [K in Name]: infer T;
 } ? T : Default;
 /**
  * The request as a controller, a mapper or a guard of the project names it: the parts it reads,
- * typed by hand, `HttpRequest<{ params: CancelAppointmentParams; body: CancelAppointmentBody }>`.
+ * typed by hand, `HttpRequest<{ params: CancelAppointmentParams; body: CancelAppointmentBody }>`, and
+ * `upload: IncomingFile` for a controller that declares an upload.
  * The decorator of the controller checks that its schemas produce those types.
  */
-export interface HttpRequest<Given extends Parts = Parts> {
+export type HttpRequest<Given extends Parts = Parts> = {
     readonly params: Part<Given, 'params', Record<string, string>>;
     readonly query: Part<Given, 'query', Record<string, unknown>>;
     readonly headers: Part<Given, 'headers', RawHeaders>;
     readonly body: Part<Given, 'body', unknown>;
     readonly actor: Actor;
     readonly context: RequestContext;
-}
+} & (Given extends {
+    readonly upload: infer File;
+} ? {
+    readonly upload: File;
+} : unknown);
 export {};
 //# sourceMappingURL=http-request.d.ts.map

package/dist/controller/http-request.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-request.d.ts","sourceRoot":"","sources":["../../src/controller/http-request.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAElE,UAAU,KAAK;IACb,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,KAAK,IAAI,CAAC,KAAK,EAAE,IAAI,SAAS,MAAM,KAAK,EAAE,OAAO,IAAI,KAAK,SAAS;IAAE,QAAQ,EAAE,CAAC,IAAI,IAAI,GAAG,MAAM,CAAC;CAAE,GAAG,CAAC,GAAG,OAAO,CAAC;AAEpH;;;;GAIG;AACH,MAAM,WAAW,WAAW,CAAC,KAAK,SAAS,KAAK,GAAG,KAAK;IACtD,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/D,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC9D,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IACrD,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5C,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;CAClC"}
+{"version":3,"file":"http-request.d.ts","sourceRoot":"","sources":["../../src/controller/http-request.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAElE,UAAU,KAAK;IACb,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,KAAK,IAAI,CAAC,KAAK,EAAE,IAAI,SAAS,MAAM,KAAK,EAAE,OAAO,IAAI,KAAK,SAAS;IAAE,QAAQ,EAAE,CAAC,IAAI,IAAI,GAAG,MAAM,CAAC;CAAE,GAAG,CAAC,GAAG,OAAO,CAAC;AAEpH;;;;;GAKG;AACH,MAAM,MAAM,WAAW,CAAC,KAAK,SAAS,KAAK,GAAG,KAAK,IAAI;IACrD,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/D,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC9D,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IACrD,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5C,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;CAClC,GAAG,CAAC,KAAK,SAAS;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,IAAI,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAA;CAAE,GAAG,OAAO,CAAC,CAAC"}

package/dist/error/default-error-mapping.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"default-error-mapping.d.ts","sourceRoot":"","sources":["../../src/error/default-error-mapping.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,eAAO,MAAM,qBAAqB,EAAE,YAOnC,CAAC"}
+{"version":3,"file":"default-error-mapping.d.ts","sourceRoot":"","sources":["../../src/error/default-error-mapping.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,eAAO,MAAM,qBAAqB,EAAE,YAUnC,CAAC"}

package/dist/error/default-error-mapping.js

@@ -5,5 +5,8 @@ export const DEFAULT_ERROR_MAPPING = {
     INVARIANT_VIOLATION: 422,
     UNAUTHORIZED: 401,
     FORBIDDEN: 403,
+    FILE_NOT_FOUND: 404,
+    FILE_TOO_LARGE: 413,
+    UNSUPPORTED_MEDIA_TYPE: 415,
 };
 //# sourceMappingURL=default-error-mapping.js.map

package/dist/error/default-error-mapping.js.map

@@ -1 +1 @@
-{"version":3,"file":"default-error-mapping.js","sourceRoot":"","sources":["../../src/error/default-error-mapping.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,qBAAqB,GAAiB;IACjD,iBAAiB,EAAE,GAAG;IACtB,SAAS,EAAE,GAAG;IACd,QAAQ,EAAE,GAAG;IACb,mBAAmB,EAAE,GAAG;IACxB,YAAY,EAAE,GAAG;IACjB,SAAS,EAAE,GAAG;CACf,CAAC"}
+{"version":3,"file":"default-error-mapping.js","sourceRoot":"","sources":["../../src/error/default-error-mapping.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,qBAAqB,GAAiB;IACjD,iBAAiB,EAAE,GAAG;IACtB,SAAS,EAAE,GAAG;IACd,QAAQ,EAAE,GAAG;IACb,mBAAmB,EAAE,GAAG;IACxB,YAAY,EAAE,GAAG;IACjB,SAAS,EAAE,GAAG;IACd,cAAc,EAAE,GAAG;IACnB,cAAc,EAAE,GAAG;IACnB,sBAAsB,EAAE,GAAG;CAC5B,CAAC"}

package/dist/express/mount-express.d.ts

@@ -5,6 +5,8 @@ export type ExpressMountOptions = ExecuteOptions;
 /**
  * Registers the routes on an Express 5 application or router. A JSON body parser
  * (`express.json()`) must be installed before, otherwise bodies reach validation as `undefined`.
+ * An upload and a raw body are read from the request stream, which that parser leaves alone
+ * unless the request is JSON. A body that is a stream is piped to the response.
  */
 export declare function mountExpress(target: IRouter, routes: readonly Route[], options?: ExpressMountOptions): void;
 //# sourceMappingURL=mount-express.d.ts.map

package/dist/express/mount-express.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mount-express.d.ts","sourceRoot":"","sources":["../../src/express/mount-express.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAqB,MAAM,SAAS,CAAC;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAKrE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAE/C,MAAM,MAAM,mBAAmB,GAAG,cAAc,CAAC;AAMjD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,KAAK,EAAE,EAAE,OAAO,GAAE,mBAAwB,GAAG,IAAI,CAQ/G"}
+{"version":3,"file":"mount-express.d.ts","sourceRoot":"","sources":["../../src/express/mount-express.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAqB,MAAM,SAAS,CAAC;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAKrE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAE/C,MAAM,MAAM,mBAAmB,GAAG,cAAc,CAAC;AAMjD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,KAAK,EAAE,EAAE,OAAO,GAAE,mBAAwB,GAAG,IAAI,CAQ/G"}

package/dist/express/mount-express.js

@@ -1,9 +1,13 @@
+import { Readable } from 'node:stream';
+import { pipeline } from 'node:stream/promises';
 import { executeRoute } from '../pipeline/execute-route.js';
 import { serializeBody } from '../pipeline/serialize-body.js';
 import { assertUniqueRoutes } from '../route/assert-unique-routes.js';
 /**
  * Registers the routes on an Express 5 application or router. A JSON body parser
  * (`express.json()`) must be installed before, otherwise bodies reach validation as `undefined`.
+ * An upload and a raw body are read from the request stream, which that parser leaves alone
+ * unless the request is JSON. A body that is a stream is piped to the response.
  */
 export function mountExpress(target, routes, options = {}) {
     assertUniqueRoutes(routes);
@@ -27,11 +31,15 @@ function handlerOf(route, options) {
     return async (request, response) => {
         const { params, query, headers } = request;
         const body = request.body;
-        const result = await executeRoute(route, { params, query, headers, body, raw: request }, options);
+        const result = await executeRoute(route, { params, query, headers, body, raw: request, stream: request }, options);
         response.status(result.status);
         for (const [name, value] of Object.entries(result.headers)) {
             response.setHeader(name, value);
         }
+        if (result.body instanceof Readable) {
+            await pipeline(result.body, response).catch(() => response.destroy());
+            return;
+        }
         response.end(serializeBody(result));
     };
 }

package/dist/express/mount-express.js.map

@@ -1 +1 @@
-{"version":3,"file":"mount-express.js","sourceRoot":"","sources":["../../src/express/mount-express.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAUtE;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,MAAe,EAAE,MAAwB,EAAE,OAAO,GAAwB,EAAE;IACvG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAE3B,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAErC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,MAAe;IAClC,OAAO;QACL,GAAG,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC;QACjD,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;QACnD,GAAG,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC;QACjD,KAAK,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC;QACrD,MAAM,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC;QACvD,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;QACnD,OAAO,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;KAC1D,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,KAAY,EAAE,OAA4B;IAC3D,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;QACjC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QAC3C,MAAM,IAAI,GAAY,OAAO,CAAC,IAAI,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;QAElG,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAE/B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3D,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAClC,CAAC;QAED,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;IACtC,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"mount-express.js","sourceRoot":"","sources":["../../src/express/mount-express.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAGhD,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAUtE;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,MAAe,EAAE,MAAwB,EAAE,OAAO,GAAwB,EAAE;IACvG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAE3B,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAErC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,MAAe;IAClC,OAAO;QACL,GAAG,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC;QACjD,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;QACnD,GAAG,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC;QACjD,KAAK,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC;QACrD,MAAM,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC;QACvD,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;QACnD,OAAO,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;KAC1D,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,KAAY,EAAE,OAA4B;IAC3D,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;QACjC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QAC3C,MAAM,IAAI,GAAY,OAAO,CAAC,IAAI,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;QAEnH,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAE/B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3D,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAClC,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,YAAY,QAAQ,EAAE,CAAC;YACpC,MAAM,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;YAEtE,OAAO;QACT,CAAC;QAED,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;IACtC,CAAC,CAAC;AACJ,CAAC"}

package/dist/fastify/mount-fastify.d.ts

@@ -1,6 +1,10 @@
 import type { FastifyInstance } from 'fastify';
 import type { Route } from '../route/route.js';
 import type { FastifyMountOptions } from './fastify-mount-options.js';
-/** Registers the routes on a Fastify 5 instance. Validation stays in the shared pipeline. */
+/**
+ * Registers the routes on a Fastify 5 instance. Validation stays in the shared pipeline. The
+ * routes that read their body as a stream (an upload, a raw body) are registered in a context of
+ * their own, where no body parser runs: the rest of the instance keeps its parsers.
+ */
 export declare function mountFastify(instance: FastifyInstance, routes: readonly Route[], options?: FastifyMountOptions): void;
 //# sourceMappingURL=mount-fastify.d.ts.map

package/dist/fastify/mount-fastify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mount-fastify.d.ts","sourceRoot":"","sources":["../../src/fastify/mount-fastify.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAI/C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEtE,6FAA6F;AAC7F,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,eAAe,EACzB,MAAM,EAAE,SAAS,KAAK,EAAE,EACxB,OAAO,GAAE,mBAAwB,GAChC,IAAI,CAeN"}
+{"version":3,"file":"mount-fastify.d.ts","sourceRoot":"","sources":["../../src/fastify/mount-fastify.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAI/C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEtE;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,eAAe,EACzB,MAAM,EAAE,SAAS,KAAK,EAAE,EACxB,OAAO,GAAE,mBAAwB,GAChC,IAAI,CAsBN"}

package/dist/fastify/mount-fastify.js

@@ -1,17 +1,40 @@
+import { Readable } from 'node:stream';
 import { executeRoute } from '../pipeline/execute-route.js';
 import { serializeBody } from '../pipeline/serialize-body.js';
 import { assertUniqueRoutes } from '../route/assert-unique-routes.js';
-/** Registers the routes on a Fastify 5 instance. Validation stays in the shared pipeline. */
+/**
+ * Registers the routes on a Fastify 5 instance. Validation stays in the shared pipeline. The
+ * routes that read their body as a stream (an upload, a raw body) are registered in a context of
+ * their own, where no body parser runs: the rest of the instance keeps its parsers.
+ */
 export function mountFastify(instance, routes, options = {}) {
     assertUniqueRoutes(routes);
+    const streamed = routes.filter(readsItsStream);
+    register(instance, routes.filter((route) => !readsItsStream(route)), options);
+    if (streamed.length > 0) {
+        void instance.register(async (unparsed) => {
+            unparsed.removeAllContentTypeParsers();
+            unparsed.addContentTypeParser('*', (_request, _payload, done) => {
+                done(null);
+            });
+            register(unparsed, streamed, options);
+        });
+    }
+}
+function readsItsStream(route) {
+    return route.upload !== undefined || route.rawBody === true;
+}
+function register(instance, routes, options) {
     for (const route of routes) {
         instance.route({
             method: route.method,
             url: route.path,
             handler: async (request, reply) => {
                 const { params, query, headers, body } = request;
-                const result = await executeRoute(route, { params, query, headers, body, raw: request }, options);
-                return reply.code(result.status).headers(result.headers).send(serializeBody(result));
+                const raw = { params, query, headers, body, raw: request, stream: request.raw };
+                const result = await executeRoute(route, raw, options);
+                const sent = result.body instanceof Readable ? result.body : serializeBody(result);
+                return reply.code(result.status).headers(result.headers).send(sent);
             },
         });
     }

package/dist/fastify/mount-fastify.js.map

@@ -1 +1 @@
-{"version":3,"file":"mount-fastify.js","sourceRoot":"","sources":["../../src/fastify/mount-fastify.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAItE,6FAA6F;AAC7F,MAAM,UAAU,YAAY,CAC1B,QAAyB,EACzB,MAAwB,EACxB,OAAO,GAAwB,EAAE;IAEjC,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAE3B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,QAAQ,CAAC,KAAK,CAAC;YACb,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,GAAG,EAAE,KAAK,CAAC,IAAI;YACf,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;gBAChC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;gBACjD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;gBAElG,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;YACvF,CAAC;SACF,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}
+{"version":3,"file":"mount-fastify.js","sourceRoot":"","sources":["../../src/fastify/mount-fastify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAItE;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAC1B,QAAyB,EACzB,MAAwB,EACxB,OAAO,GAAwB,EAAE;IAEjC,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAE3B,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAE/C,QAAQ,CACN,QAAQ,EACR,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,EAChD,OAAO,CACR,CAAC;IAEF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,KAAK,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE;YACxC,QAAQ,CAAC,2BAA2B,EAAE,CAAC;YAEvC,QAAQ,CAAC,oBAAoB,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;gBAC9D,IAAI,CAAC,IAAI,CAAC,CAAC;YACb,CAAC,CAAC,CAAC;YAEH,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAY;IAClC,OAAO,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC;AAC9D,CAAC;AAED,SAAS,QAAQ,CAAC,QAAyB,EAAE,MAAwB,EAAE,OAA4B;IACjG,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,QAAQ,CAAC,KAAK,CAAC;YACb,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,GAAG,EAAE,KAAK,CAAC,IAAI;YACf,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;gBAChC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;gBACjD,MAAM,GAAG,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;gBAChF,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;gBACvD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,YAAY,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;gBAEnF,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtE,CAAC;SACF,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/dist/files/signed-file-routes-options.d.ts

@@ -0,0 +1,5 @@
+export interface SignedFileRoutesOptions {
+    /** The path the links of the storage point at, the path of its `baseUrl`. Default `/files`. */
+    readonly prefix?: string;
+}
+//# sourceMappingURL=signed-file-routes-options.d.ts.map

package/dist/files/signed-file-routes-options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signed-file-routes-options.d.ts","sourceRoot":"","sources":["../../src/files/signed-file-routes-options.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,uBAAuB;IACtC,+FAA+F;IAC/F,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B"}