@ddd-ts-kit/kernel 0.7.0 → 0.9.0

package/README.md

@@ -552,8 +552,13 @@ The authenticated session of an actor, as plain data.
 | `authenticationStrength?` | `{ mfa?, assuranceLevel? }` |
 | `impersonatedBy?` | id of the support actor acting as `actor`; `logFieldsOf` carries it to every log line |
 | `locale?`, `timeZone?`, `client?` | BCP 47 tag, IANA zone, `{ ip?, userAgent? }` as opaque strings |
+| `scopes?` | what the credential allows whoever presents it (the OAuth 2.0 `scope`): a limit on the client, never what the actor may do |
 | `extensions` | the fields of the project |
 
+`hasScope(session, scope)` reads the scopes; a project names its scope vocabulary once by
+declaration merging of `SessionScopes` (`interface SessionScopes { readonly 'invoices:read': true }`),
+and `SessionScope`, the type a guard takes, is then that vocabulary instead of any string.
+
 `isExpired(session, clock.now())`, `isImpersonated(session)`, `anonymousSession()`,
 `systemSession(name, issuedAt?)`, and `isSession(value)`, the structural guard a boundary uses on
 what it received as a principal.
@@ -561,8 +566,8 @@ what it received as a principal.
 ### ExecutionContext and ExecutionScope
 
 What every unit of work carries, whatever started it: `correlationId`, `causationId?`, `actor`,
-`session?`, `tenantId?`, `locale?`, `deadline?`, `scheduledAt?` (for a scheduled job, the instant it
-was due), `origin` (`http`, `event`, `schedule`, `cli`, or a string of the project) and `extensions`. `executionContext(init)` builds one and takes the tenant
+`session?`, `tenantId?`, `elevation?` (platform staff reading over tenants, see "Tenancy"),
+`locale?`, `deadline?`, `scheduledAt?` (for a scheduled job, the instant it was due), `origin` (`http`, `event`, `schedule`, `cli`, or a string of the project) and `extensions`. `executionContext(init)` builds one and takes the tenant
 of the actor; `withActor(context, actor)` is the same work seen as another actor.
 
 `ExecutionScope` (`current()`, `require()`, `run(context, work)`) gives the context of the work
@@ -584,11 +589,13 @@ tenant scoping and outgoing headers.
 
 A consumed event opens its own context: `executionContextOfEvent(event, { consumer })` has
 origin `event`, the correlation of the event (its id when it names none), the event as
-`causationId` and `systemActor(consumer)` as actor; `inEventScope(scope, { consumer }, handler)`
+`causationId`, `systemActor(consumer)` as actor and the `tenantId` of the event, so the
+consumer reads and writes in that tenant only; `inEventScope(scope, { consumer }, handler)`
 wraps a handler with it. The standard envelope carries no actor, so that no personal data
 travels by default: a project whose envelopes name one passes `actorOf`. On the way out,
-`scopedPublisher(publisher, scope)` stamps the correlation of the work in progress on every
-event published without one, so everything one stimulus causes is found again across processes.
+`scopedPublisher(publisher, scope)` stamps the correlation and the tenant of the work in
+progress on every event published without them, so everything one stimulus causes is found
+again across processes and stays in its tenant.
 
 `ActorContext` stays, unchanged. `ScopedActorContext` implements it on top of a scope: the
 current actor is the actor of the current execution context, so the two cannot disagree.
@@ -701,7 +708,8 @@ const hit: Quote | undefined = await cache.get(quoteKey('EUR-USD'));
 ```
 
 The key carries the type of its value. `InMemoryCache(clock, { maxEntries? })` expires by the
-`Clock` and is bounded.
+`Clock` and is bounded. `tenantCacheKey<Quote>(scope, 'quote', pair)` is the same key confined to
+the tenant of the work in progress: what one tenant cached is never served to another.
 
 ### Lock
 
@@ -727,6 +735,75 @@ the guard of an invariant: what must not happen twice is refused by a database c
 `Clock`: the fake, and enough for a single instance. The adapter between processes is in
 `@ddd-ts-kit/redis`. `acquiring(attempt, waitMs, waiting)` is the retry loop an adapter shares.
 
+### FileStorage, StoredFile, FileScanner
+
+```ts
+// The command wraps what the controller received: the bus stages it before the transaction opens.
+this.document = new FileUpload(received, 'appointment-documents');
+
+// The handler, inside the unit of work:
+const { file, fileName } = command.document;                     // a StoredFile, staged and scanned
+appointment.attachDocument(unwrap(AttachedDocument.create(file, fileName, now)), now);
+await appointments.save(appointment);
+await staging.promoteOnCommit(file.key);                         // moved to its key with the commit
+```
+
+`FileStorage` holds the content of files, never the database: `put` (a stream in, measured and
+hashed, refused with `FILE_TOO_LARGE` beyond `maxBytes`, leaving nothing), `get` (a stream out),
+`stat`, `delete`, `copy`, `move`, `list(prefix)`, and short signed links, `signedDownloadUrl` and
+`signedUploadUrl` (at most `MAX_SIGNED_URL_SECONDS`, one hour). No method takes or returns a
+whole file. A key is checked by `isFileKey` (segments of letters, digits, `.`, `-` and `_`, none
+starting with a dot) before anything is touched, and `FileKeys` generates it on the server:
+`TenantFileKeys(ids, clock, scope)` writes `tenants/<tenant>/<area>/<year>/<month>/<id>`, the
+tenant segment only when the work in progress names one (the tenant id as it is: the kernel
+refuses any other than letters, digits, `-` and `_`, so two tenants never share a prefix). The links of
+`signedUploadUrl` carry a `maxBytes`, which the storages the application serves enforce.
+
+`StoredFile` is what an aggregate keeps: `key`, `size`, `mediaType`, `checksum` (`sha256:<hex>`),
+never the provider. `FileScanner` is the hook of an antivirus or a content check, called on the
+staged file before it is accepted; `AcceptEveryFileScanner` is the one of a project that has
+none yet. `FileError` carries the refusals: `FILE_TOO_LARGE`, `UNSUPPORTED_MEDIA_TYPE`,
+`FILE_NOT_FOUND`, `INVALID_FILE_KEY`, `FILE_REJECTED`, `INVALID_FILE_URL_EXPIRY`.
+
+A write to the storage is not rolled back with a transaction. `FileStaging(storage, scanner,
+reporter)` gives the order that keeps both consistent, each step once:
+
+- `stage(key, content, options)` writes under `staging/<key>` and scans; a refused file is
+  removed (`FILE_REJECTED`). A file from a client travels in its command as a `FileUpload`
+  (the `ReceivedFile` and the area of its key), staged by `fileUploadsMiddleware(desk)`, a bus
+  middleware placed after the permission and before the unit of work, so no transaction waits
+  on an upload. `upload.file` is the staged `StoredFile`.
+- `promoteOnCommit(key)` moves the file to its key as the last step of the unit of work
+  (`atCommit`, a `CommitStep` of `apply` and `undo`): a promotion that fails rolls the command
+  back, and a transaction that rolls back after it returns the file to `staging/`. A committed
+  row never points into `staging/`.
+- `deleteAfterCommit(key)` deletes, once committed, a file the aggregate no longer references
+  (`afterCommit`, at most once: a failure or a crash leaves an unreferenced file, reported).
+- `purge(olderThan)` removes the staged files older than the instant, all orphans; the job
+  `PurgeStagedFiles` runs it (the platform registers it as `files.purge-staged`, every hour,
+  for files staged a day ago or more).
+
+For a large file the client uploads straight to the storage: `uploadUrl(key, { expiresInSeconds,
+mediaType, accepted, maxBytes })` answers the `link` for the client and the `pending` grant
+(`PendingUpload`: key, size cap, media types) that the command records on the aggregate;
+`confirm(pending)`, called by a command that reads the grant back from the aggregate, never
+from the client, checks what arrived against the cap and on its bytes (`contentMatches`), scans
+it, and answers the `StoredFile`. No final key may start with `staging/` (`assertFinalKey`).
+
+`FileInspection` is the pass-through every connector streams through: it counts, hashes, and
+with an expectation holds back the first bytes until they prove the declared media type
+(`acceptsMediaType`, `contentMatches`: a PDF starts with `%PDF-`, office documents are zip
+archives, text is UTF-8 without control characters, SVG and unknown binary formats never
+match).
+
+Connectors: `InMemoryFileStorage` for the tests (`keys()` lists what it holds) and
+`LocalFileStorage({ directory, baseUrl, secret })` for development, both `ServedFileStorage`:
+their signed links point at the application, which answers them with `signedFileRoutes` of
+`@ddd-ts-kit/http`. The object store connector is `@ddd-ts-kit/s3`. Each passes
+`fileStorageContract` of `@ddd-ts-kit/testing/contracts`. Background import and export (row by
+row validation, an error report, resumption) needs a job queue the kit does not have yet: the
+ports are ready for it, see `docs/concepts/file-storage.md`.
+
 ### JobScheduler
 
 ```ts
@@ -748,9 +825,10 @@ instead of rejecting: only an unknown name rejects (`UnknownJobError`), and a na
 twice throws (`DuplicateJobError`).
 
 A run happens inside `ExecutionScope`, in the context `executionContextOfJob(name, { correlationId,
-scheduledAt, deadline? })` builds: origin `schedule`, `systemActor(name)`, a correlation of its
+scheduledAt, deadline?, tenantId? })` builds: origin `schedule`, `systemActor(name)`, a correlation of its
 own, and `scheduledAt`, the instant the run was due, which `ExecutionContext` carries for this
-origin.
+origin. A job is `global` by default and runs in no tenant; `tenancy: 'per-tenant'` makes the
+scheduler run it once per tenant of a `TenantDirectory`, each run in that tenant.
 
 `parseJobSchedule(schedule)` validates a schedule and answers the form occurrences are
 computed from (`InvalidJobScheduleError`, code `INVALID_JOB_SCHEDULE`, otherwise);
@@ -770,12 +848,36 @@ if (!decision.allowed) {
 
 A sliding window: at any instant, at most `limit` allowed calls in the `windowMs` before it. A
 `RateLimitDecision` is `{ allowed, remaining, retryAfterMs }`; a refused call is not counted.
-The key is whatever is limited: a client, a tenant, a route and an address together.
+The key is whatever is limited: a client, a tenant, a route and an address together. In a
+multi-tenant project, `tenantKey(scope, 'password-reset', accountId)` confines it to the tenant of
+the work in progress (`tenant:<id>:password-reset:<account>`) and refuses work that names none.
 
 `InMemoryRateLimiter(clock)` counts inside one process; the adapter shared by several instances
 is in `@ddd-ts-kit/redis`. `rateLimitDecisionOf(counted, limit)` turns what an adapter counted
 into the decision.
 
+### Tenancy
+
+The tenant of the work is `ExecutionContext.tenantId`, set at the boundary and read by
+infrastructure only, like the rest of the context. The kernel holds what every strategy shares;
+the isolation itself (tenant column, row-level security, schema or database per tenant) is in the
+persistence packages, and the whole picture in
+[Multitenancy](../../docs/concepts/multitenancy.md).
+
+| Concept | What it does |
+|---|---|
+| `isTenantId(value)`, `assertTenantId(id)`, `InvalidTenantIdError` | the one grammar of a tenant id (letters, digits, `_`, `-`, at most 63): `executionContext`, `executionContextOfEvent`, `acrossTenants`, `InMemoryTenantDirectory`, `tenantScopeOf`, `tenantReachOf` and the row-level security settings refuse any other, so that no tenant id can be read as a wildcard, a list or a key separator |
+| `tenantScopeOf(scope)` | the one tenant a write names; `NoCurrentTenantError` for work that names none |
+| `tenantReachOf(scope)` | what a read may see: `{ kind: 'tenant', tenantId }`, or `{ kind: 'elevated', tenants }` under an elevation |
+| `tenantsOf(actor)`, `isTenantMember(actor, tenantId)` | the tenants an actor belongs to: its `tenantId` and its `tenants` attribute |
+| `acrossTenants({ scope, trail, clock, ids }, { reason, tenants }, work)` | platform staff reading over tenants: refused without a reason or a tenant, recorded in the `AuditTrail` (action `tenancy:elevate`) before the work runs; writes still name one tenant |
+| `tenantKey(scope, ...segments)`, `tenantCacheKey(scope, ...segments)` | keys of rate limits, locks and caches confined to the tenant: `tenant:<id>:<segments>`, each segment percent-encoded, so that two lists of segments never give one key |
+| `TenantDirectory`, `InMemoryTenantDirectory` | the tenants that exist, for per-tenant jobs, provisioning and migrations |
+| `TENANT_SETTINGS`, `tenantSettingValues(context)`, `TENANT_ISOLATION_POLICIES`, `tenantPolicyExpressions(column)` | what the row-level security of the persistence packages shares: the three settings of a transaction (`ddd_ts_kit.tenant_id`, and for an elevation only `ddd_ts_kit.reach` and `ddd_ts_kit.every_tenant`), their values for the work in progress, the names of the four policies (one per command) and their `read` and `write` expressions |
+
+An elevation is never implied by a role: the platform decides the permission to elevate (a use
+case or a guard), then calls `acrossTenants`. A trail that fails to record it refuses it.
+
 ### Page and PageRequest
 
 One shape for every search, in two variants:

package/dist/application/audit/tenant-scope-of.d.ts

@@ -1,5 +1,8 @@
 import type { ExecutionScope } from '../ports/execution-scope.js';
 import type { TenantScoped } from './tenant-scoped.js';
-/** For a repository adapter scoping a statement: the tenant of the work in progress. */
+/**
+ * For a repository adapter scoping a statement: the tenant of the work in progress, checked
+ * against the grammar of `isTenantId` again however the context was built.
+ */
 export declare function tenantScopeOf(scope: ExecutionScope): TenantScoped;
 //# sourceMappingURL=tenant-scope-of.d.ts.map

package/dist/application/audit/tenant-scope-of.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tenant-scope-of.d.ts","sourceRoot":"","sources":["../../../src/application/audit/tenant-scope-of.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAElE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,wFAAwF;AACxF,wBAAgB,aAAa,CAAC,KAAK,EAAE,cAAc,GAAG,YAAY,CAQjE"}
+{"version":3,"file":"tenant-scope-of.d.ts","sourceRoot":"","sources":["../../../src/application/audit/tenant-scope-of.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAGlE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,cAAc,GAAG,YAAY,CAQjE"}

package/dist/application/audit/tenant-scope-of.js

@@ -1,10 +1,14 @@
+import { assertTenantId } from '../tenancy/assert-tenant-id.js';
 import { NoCurrentTenantError } from './no-current-tenant-error.js';
-/** For a repository adapter scoping a statement: the tenant of the work in progress. */
+/**
+ * For a repository adapter scoping a statement: the tenant of the work in progress, checked
+ * against the grammar of `isTenantId` again however the context was built.
+ */
 export function tenantScopeOf(scope) {
     const { tenantId } = scope.require();
     if (tenantId === undefined) {
         throw new NoCurrentTenantError();
     }
-    return { tenantId };
+    return { tenantId: assertTenantId(tenantId) };
 }
 //# sourceMappingURL=tenant-scope-of.js.map

package/dist/application/audit/tenant-scope-of.js.map

@@ -1 +1 @@
-{"version":3,"file":"tenant-scope-of.js","sourceRoot":"","sources":["../../../src/application/audit/tenant-scope-of.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAGpE,wFAAwF;AACxF,MAAM,UAAU,aAAa,CAAC,KAAqB;IACjD,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;IAErC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,oBAAoB,EAAE,CAAC;IACnC,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,CAAC;AACtB,CAAC"}
+{"version":3,"file":"tenant-scope-of.js","sourceRoot":"","sources":["../../../src/application/audit/tenant-scope-of.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAGpE;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,KAAqB;IACjD,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;IAErC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,oBAAoB,EAAE,CAAC;IACnC,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;AAChD,CAAC"}

package/dist/application/cache/tenant-cache-key.d.ts

@@ -0,0 +1,5 @@
+import type { ExecutionScope } from '../ports/execution-scope.js';
+import { type CacheKey } from './cache-key.js';
+/** `cacheKey` confined to the tenant of the work in progress: what one tenant cached is never served to another. */
+export declare function tenantCacheKey<T>(scope: ExecutionScope, ...segments: readonly string[]): CacheKey<T>;
+//# sourceMappingURL=tenant-cache-key.d.ts.map

package/dist/application/cache/tenant-cache-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-cache-key.d.ts","sourceRoot":"","sources":["../../../src/application/cache/tenant-cache-key.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAElE,OAAO,EAAE,KAAK,QAAQ,EAAY,MAAM,gBAAgB,CAAC;AAEzD,oHAAoH;AACpH,wBAAgB,cAAc,CAAC,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAEpG"}

package/dist/application/cache/tenant-cache-key.js

@@ -0,0 +1,7 @@
+import { tenantKey } from '../tenancy/tenant-key.js';
+import { cacheKey } from './cache-key.js';
+/** `cacheKey` confined to the tenant of the work in progress: what one tenant cached is never served to another. */
+export function tenantCacheKey(scope, ...segments) {
+    return cacheKey(tenantKey(scope, ...segments));
+}
+//# sourceMappingURL=tenant-cache-key.js.map

package/dist/application/cache/tenant-cache-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-cache-key.js","sourceRoot":"","sources":["../../../src/application/cache/tenant-cache-key.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACrD,OAAO,EAAiB,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAEzD,oHAAoH;AACpH,MAAM,UAAU,cAAc,CAAI,KAAqB,EAAE,GAAG,QAA2B;IACrF,OAAO,QAAQ,CAAI,SAAS,CAAC,KAAK,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC;AACpD,CAAC"}

package/dist/application/events/execution-context-of-event.d.ts

@@ -3,7 +3,8 @@ import type { EventExecutionOptions } from './event-execution-options.js';
 import type { IntegrationEvent } from './integration-event.js';
 /**
  * The execution context of a consumed event: origin `event`, the correlation of the event (its
- * own id when it names none, which starts a new chain), and the event as the direct cause.
+ * own id when it names none, which starts a new chain), the event as the direct cause, and the
+ * tenant the event belongs to, so the consumer reads and writes in that tenant only.
  */
 export declare function executionContextOfEvent(event: IntegrationEvent, options: EventExecutionOptions): ExecutionContext;
 //# sourceMappingURL=execution-context-of-event.d.ts.map

package/dist/application/events/execution-context-of-event.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"execution-context-of-event.d.ts","sourceRoot":"","sources":["../../../src/application/events/execution-context-of-event.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,gBAAgB,EAAoB,MAAM,mCAAmC,CAAC;AAC5F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE/D;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,qBAAqB,GAAG,gBAAgB,CAOjH"}
+{"version":3,"file":"execution-context-of-event.d.ts","sourceRoot":"","sources":["../../../src/application/events/execution-context-of-event.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,gBAAgB,EAAoB,MAAM,mCAAmC,CAAC;AAC5F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE/D;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,qBAAqB,GAAG,gBAAgB,CAQjH"}

package/dist/application/events/execution-context-of-event.js

@@ -2,7 +2,8 @@ import { systemActor } from '../actor/system-actor.js';
 import { executionContext } from '../execution/execution-context.js';
 /**
  * The execution context of a consumed event: origin `event`, the correlation of the event (its
- * own id when it names none, which starts a new chain), and the event as the direct cause.
+ * own id when it names none, which starts a new chain), the event as the direct cause, and the
+ * tenant the event belongs to, so the consumer reads and writes in that tenant only.
  */
 export function executionContextOfEvent(event, options) {
     return executionContext({
@@ -10,6 +11,7 @@ export function executionContextOfEvent(event, options) {
         causationId: event.id,
         actor: options.actorOf?.(event) ?? systemActor(options.consumer),
         origin: 'event',
+        ...(event.tenantId === undefined ? {} : { tenantId: event.tenantId }),
     });
 }
 //# sourceMappingURL=execution-context-of-event.js.map

package/dist/application/events/execution-context-of-event.js.map

@@ -1 +1 @@
-{"version":3,"file":"execution-context-of-event.js","sourceRoot":"","sources":["../../../src/application/events/execution-context-of-event.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAyB,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAI5F;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAuB,EAAE,OAA8B;IAC7F,OAAO,gBAAgB,CAAC;QACtB,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,EAAE;QAC9C,WAAW,EAAE,KAAK,CAAC,EAAE;QACrB,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC;QAChE,MAAM,EAAE,OAAO;KAChB,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"execution-context-of-event.js","sourceRoot":"","sources":["../../../src/application/events/execution-context-of-event.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAyB,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAI5F;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAuB,EAAE,OAA8B;IAC7F,OAAO,gBAAgB,CAAC;QACtB,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,EAAE;QAC9C,WAAW,EAAE,KAAK,CAAC,EAAE;QACrB,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC;QAChE,MAAM,EAAE,OAAO;QACf,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;KACtE,CAAC,CAAC;AACL,CAAC"}

package/dist/application/events/integration-event.d.ts

@@ -13,5 +13,11 @@ export interface IntegrationEvent<Payload = unknown> {
     /** W3C traceparent captured at publication so consumers continue the same trace. */
     readonly traceparent?: string;
     readonly correlationId?: string;
+    /**
+     * The tenant the fact belongs to, stamped from the work that published it. A consumer handles
+     * the event in that tenant's scope, so its reads and writes stay in the tenant. Absent for a
+     * fact of no tenant (the platform's own).
+     */
+    readonly tenantId?: string;
 }
 //# sourceMappingURL=integration-event.d.ts.map

package/dist/application/events/integration-event.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"integration-event.d.ts","sourceRoot":"","sources":["../../../src/application/events/integration-event.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,WAAW,gBAAgB,CAAC,OAAO,GAAG,OAAO;IACjD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,mDAAmD;IACnD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oFAAoF;IACpF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,oFAAoF;IACpF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC"}
+{"version":3,"file":"integration-event.d.ts","sourceRoot":"","sources":["../../../src/application/events/integration-event.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,WAAW,gBAAgB,CAAC,OAAO,GAAG,OAAO;IACjD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,mDAAmD;IACnD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oFAAoF;IACpF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,oFAAoF;IACpF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B"}

package/dist/application/events/scoped-publisher.d.ts

@@ -2,9 +2,10 @@ import type { ExecutionScope } from '../ports/execution-scope.js';
 import type { IntegrationEventPublisher } from '../ports/integration-event-publisher.js';
 /**
  * Decorates a publisher: an event published without `correlationId` takes the one of the work
- * in progress, so everything one stimulus causes can be found again. An event that names its
- * correlation keeps it, and outside of any execution context nothing is stamped. The name of
- * the transport (`messagingSystem`) is passed on.
+ * in progress, so everything one stimulus causes can be found again, and one without `tenantId`
+ * the tenant of that work, so its consumers run in the same tenant. What an event names is
+ * kept, and outside of any execution context nothing is stamped. The name of the transport
+ * (`messagingSystem`) is passed on.
  */
 export declare function scopedPublisher(publisher: IntegrationEventPublisher, scope: ExecutionScope): IntegrationEventPublisher;
 //# sourceMappingURL=scoped-publisher.d.ts.map

package/dist/application/events/scoped-publisher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scoped-publisher.d.ts","sourceRoot":"","sources":["../../../src/application/events/scoped-publisher.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AAIzF;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,yBAAyB,EACpC,KAAK,EAAE,cAAc,GACpB,yBAAyB,CAO3B"}
+{"version":3,"file":"scoped-publisher.d.ts","sourceRoot":"","sources":["../../../src/application/events/scoped-publisher.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AAIzF;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,yBAAyB,EACpC,KAAK,EAAE,cAAc,GACpB,yBAAyB,CAO3B"}

package/dist/application/events/scoped-publisher.js

@@ -1,9 +1,10 @@
 import { messagingSystemOf } from './messaging-system-of.js';
 /**
  * Decorates a publisher: an event published without `correlationId` takes the one of the work
- * in progress, so everything one stimulus causes can be found again. An event that names its
- * correlation keeps it, and outside of any execution context nothing is stamped. The name of
- * the transport (`messagingSystem`) is passed on.
+ * in progress, so everything one stimulus causes can be found again, and one without `tenantId`
+ * the tenant of that work, so its consumers run in the same tenant. What an event names is
+ * kept, and outside of any execution context nothing is stamped. The name of the transport
+ * (`messagingSystem`) is passed on.
  */
 export function scopedPublisher(publisher, scope) {
     const messagingSystem = messagingSystemOf(publisher);
@@ -13,9 +14,14 @@ export function scopedPublisher(publisher, scope) {
     };
 }
 function correlated(event, context) {
-    if (event.correlationId !== undefined || context === undefined) {
+    if (context === undefined) {
         return event;
     }
-    return { ...event, correlationId: context.correlationId };
+    const { correlationId, tenantId } = context;
+    return {
+        ...event,
+        ...(event.correlationId === undefined ? { correlationId } : {}),
+        ...(event.tenantId === undefined && tenantId !== undefined ? { tenantId } : {}),
+    };
 }
 //# sourceMappingURL=scoped-publisher.js.map

package/dist/application/events/scoped-publisher.js.map

@@ -1 +1 @@
-{"version":3,"file":"scoped-publisher.js","sourceRoot":"","sources":["../../../src/application/events/scoped-publisher.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,SAAoC,EACpC,KAAqB;IAErB,MAAM,eAAe,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAErD,OAAO;QACL,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACjG,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC;KAC9D,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAAuB,EAAE,OAAqC;IAChF,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC/D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,EAAE,GAAG,KAAK,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;AAC5D,CAAC"}
+{"version":3,"file":"scoped-publisher.js","sourceRoot":"","sources":["../../../src/application/events/scoped-publisher.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAC7B,SAAoC,EACpC,KAAqB;IAErB,MAAM,eAAe,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAErD,OAAO;QACL,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACjG,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC;KAC9D,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAAuB,EAAE,OAAqC;IAChF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IAE5C,OAAO;QACL,GAAG,KAAK;QACR,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChF,CAAC;AACJ,CAAC"}

package/dist/application/execution/execution-context.d.ts

@@ -1,5 +1,6 @@
 import type { Actor } from '../actor/actor.js';
 import type { Session } from '../session/session.js';
+import type { TenantElevation } from '../tenancy/tenant-elevation.js';
 import type { ExecutionContextExtensionValues } from './execution-context-extension-values.js';
 import type { ExecutionOrigin } from './execution-origin.js';
 /**
@@ -14,6 +15,8 @@ export interface ExecutionContext {
     readonly actor: Actor;
     readonly session?: Session;
     readonly tenantId?: string;
+    /** Platform staff reading over tenants, opened by `acrossTenants` and audited. Absent otherwise. */
+    readonly elevation?: TenantElevation;
     readonly locale?: string;
     /** The instant after which the result is useless to the caller. */
     readonly deadline?: Date;
@@ -23,6 +26,9 @@ export interface ExecutionContext {
     readonly extensions: ExecutionContextExtensionValues;
 }
 export type ExecutionContextInit = Omit<ExecutionContext, 'extensions' | 'tenantId'> & Partial<Pick<ExecutionContext, 'extensions' | 'tenantId'>>;
-/** Fills what can be derived: the tenant of the actor, no extension. */
+/**
+ * Fills what can be derived: the tenant of the actor, no extension. A tenant id outside the
+ * grammar of `isTenantId` is refused (`InvalidTenantIdError`), whatever named it.
+ */
 export declare function executionContext(init: ExecutionContextInit): ExecutionContext;
 //# sourceMappingURL=execution-context.d.ts.map

package/dist/application/execution/execution-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"execution-context.d.ts","sourceRoot":"","sources":["../../../src/application/execution/execution-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,yCAAyC,CAAC;AAC/F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE7D;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,8EAA8E;IAC9E,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,2EAA2E;IAC3E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,mEAAmE;IACnE,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC;IACzB,mGAAmG;IACnG,QAAQ,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,+BAA+B,CAAC;CACtD;AAED,MAAM,MAAM,oBAAoB,GAAG,IAAI,CAAC,gBAAgB,EAAE,YAAY,GAAG,UAAU,CAAC,GAClF,OAAO,CAAC,IAAI,CAAC,gBAAgB,EAAE,YAAY,GAAG,UAAU,CAAC,CAAC,CAAC;AAE7D,wEAAwE;AACxE,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,oBAAoB,GAAG,gBAAgB,CAQ7E"}
+{"version":3,"file":"execution-context.d.ts","sourceRoot":"","sources":["../../../src/application/execution/execution-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAErD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,yCAAyC,CAAC;AAC/F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE7D;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,8EAA8E;IAC9E,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,2EAA2E;IAC3E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,oGAAoG;IACpG,QAAQ,CAAC,SAAS,CAAC,EAAE,eAAe,CAAC;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,mEAAmE;IACnE,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC;IACzB,mGAAmG;IACnG,QAAQ,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,+BAA+B,CAAC;CACtD;AAED,MAAM,MAAM,oBAAoB,GAAG,IAAI,CAAC,gBAAgB,EAAE,YAAY,GAAG,UAAU,CAAC,GAClF,OAAO,CAAC,IAAI,CAAC,gBAAgB,EAAE,YAAY,GAAG,UAAU,CAAC,CAAC,CAAC;AAE7D;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,oBAAoB,GAAG,gBAAgB,CAS7E"}

package/dist/application/execution/execution-context.js

@@ -1,6 +1,11 @@
-/** Fills what can be derived: the tenant of the actor, no extension. */
+import { assertTenantId } from '../tenancy/assert-tenant-id.js';
+/**
+ * Fills what can be derived: the tenant of the actor, no extension. A tenant id outside the
+ * grammar of `isTenantId` is refused (`InvalidTenantIdError`), whatever named it.
+ */
 export function executionContext(init) {
-    const tenantId = init.tenantId ?? init.actor.tenantId;
+    const named = init.tenantId ?? init.actor.tenantId;
+    const tenantId = named === undefined ? undefined : assertTenantId(named);
     return Object.freeze({
         ...init,
         ...(tenantId === undefined ? {} : { tenantId }),

package/dist/application/execution/execution-context.js.map

@@ -1 +1 @@
-{"version":3,"file":"execution-context.js","sourceRoot":"","sources":["../../../src/application/execution/execution-context.ts"],"names":[],"mappings":"AA6BA,wEAAwE;AACxE,MAAM,UAAU,gBAAgB,CAAC,IAA0B;IACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;IAEtD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,GAAG,IAAI;QACP,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;QAC/C,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;KACjD,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"execution-context.js","sourceRoot":"","sources":["../../../src/application/execution/execution-context.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AA+BhE;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAA0B;IACzD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;IACnD,MAAM,QAAQ,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAEzE,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,GAAG,IAAI;QACP,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;QAC/C,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;KACjD,CAAC,CAAC;AACL,CAAC"}

package/dist/application/execution/log-fields-of.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"log-fields-of.d.ts","sourceRoot":"","sources":["../../../src/application/execution/log-fields-of.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,iGAAiG;AACjG,wBAAgB,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,SAAS,CAShE"}
+{"version":3,"file":"log-fields-of.d.ts","sourceRoot":"","sources":["../../../src/application/execution/log-fields-of.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,iGAAiG;AACjG,wBAAgB,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,SAAS,CAUhE"}

package/dist/application/execution/log-fields-of.js

@@ -6,6 +6,7 @@ export function logFieldsOf(context) {
         actorId: context.actor.id,
         ...(context.causationId === undefined ? {} : { causationId: context.causationId }),
         ...(context.tenantId === undefined ? {} : { tenantId: context.tenantId }),
+        ...(context.elevation === undefined ? {} : { elevation: context.elevation.reason }),
         ...(context.session?.impersonatedBy === undefined ? {} : { impersonatedBy: context.session.impersonatedBy }),
     };
 }

package/dist/application/execution/log-fields-of.js.map

@@ -1 +1 @@
-{"version":3,"file":"log-fields-of.js","sourceRoot":"","sources":["../../../src/application/execution/log-fields-of.ts"],"names":[],"mappings":"AAGA,iGAAiG;AACjG,MAAM,UAAU,WAAW,CAAC,OAAyB;IACnD,OAAO;QACL,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE;QACzB,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;QAClF,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;QACzE,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;KAC7G,CAAC;AACJ,CAAC"}
+{"version":3,"file":"log-fields-of.js","sourceRoot":"","sources":["../../../src/application/execution/log-fields-of.ts"],"names":[],"mappings":"AAGA,iGAAiG;AACjG,MAAM,UAAU,WAAW,CAAC,OAAyB;IACnD,OAAO;QACL,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE;QACzB,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;QAClF,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;QACzE,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;QACnF,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;KAC7G,CAAC;AACJ,CAAC"}

package/dist/application/files/accepts-media-type.d.ts

@@ -0,0 +1,3 @@
+/** Whether a declared media type is in the accepted list, which may hold `type/*`. */
+export declare function acceptsMediaType(accepted: readonly string[], declared: string): boolean;
+//# sourceMappingURL=accepts-media-type.d.ts.map

package/dist/application/files/accepts-media-type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"accepts-media-type.d.ts","sourceRoot":"","sources":["../../../src/application/files/accepts-media-type.ts"],"names":[],"mappings":"AAEA,sFAAsF;AACtF,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CASvF"}

package/dist/application/files/accepts-media-type.js

@@ -0,0 +1,11 @@
+import { mediaTypeOf } from './media-type-of.js';
+/** Whether a declared media type is in the accepted list, which may hold `type/*`. */
+export function acceptsMediaType(accepted, declared) {
+    const essence = mediaTypeOf(declared);
+    const [type] = essence.split('/');
+    return accepted.some((entry) => {
+        const allowed = mediaTypeOf(entry);
+        return allowed === essence || allowed === `${type ?? ''}/*`;
+    });
+}
+//# sourceMappingURL=accepts-media-type.js.map

package/dist/application/files/accepts-media-type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"accepts-media-type.js","sourceRoot":"","sources":["../../../src/application/files/accepts-media-type.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEjD,sFAAsF;AACtF,MAAM,UAAU,gBAAgB,CAAC,QAA2B,EAAE,QAAgB;IAC5E,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAElC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;QAC7B,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QAEnC,OAAO,OAAO,KAAK,OAAO,IAAI,OAAO,KAAK,GAAG,IAAI,IAAI,EAAE,IAAI,CAAC;IAC9D,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/application/files/assert-expiry.d.ts

@@ -0,0 +1,3 @@
+/** For a connector: the lifetime of a signed link, refused when it is not a whole number of seconds up to the maximum. */
+export declare function assertExpiry(seconds: number): number;
+//# sourceMappingURL=assert-expiry.d.ts.map

package/dist/application/files/assert-expiry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assert-expiry.d.ts","sourceRoot":"","sources":["../../../src/application/files/assert-expiry.ts"],"names":[],"mappings":"AAGA,0HAA0H;AAC1H,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAMpD"}

package/dist/application/files/assert-expiry.js

@@ -0,0 +1,10 @@
+import { FileError } from './file-error.js';
+import { MAX_SIGNED_URL_SECONDS } from './max-signed-url-seconds.js';
+/** For a connector: the lifetime of a signed link, refused when it is not a whole number of seconds up to the maximum. */
+export function assertExpiry(seconds) {
+    if (!Number.isInteger(seconds) || seconds < 1 || seconds > MAX_SIGNED_URL_SECONDS) {
+        throw FileError.invalidExpiry(seconds);
+    }
+    return seconds;
+}
+//# sourceMappingURL=assert-expiry.js.map

package/dist/application/files/assert-expiry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assert-expiry.js","sourceRoot":"","sources":["../../../src/application/files/assert-expiry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAErE,0HAA0H;AAC1H,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,IAAI,OAAO,GAAG,sBAAsB,EAAE,CAAC;QAClF,MAAM,SAAS,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IACzC,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/application/files/assert-file-key.d.ts

@@ -0,0 +1,3 @@
+/** For a connector: refuses a key `isFileKey` refuses, before anything is touched. */
+export declare function assertFileKey(key: string): string;
+//# sourceMappingURL=assert-file-key.d.ts.map

package/dist/application/files/assert-file-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assert-file-key.d.ts","sourceRoot":"","sources":["../../../src/application/files/assert-file-key.ts"],"names":[],"mappings":"AAGA,sFAAsF;AACtF,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAMjD"}

package/dist/application/files/assert-file-key.js

@@ -0,0 +1,10 @@
+import { FileError } from './file-error.js';
+import { isFileKey } from './is-file-key.js';
+/** For a connector: refuses a key `isFileKey` refuses, before anything is touched. */
+export function assertFileKey(key) {
+    if (!isFileKey(key)) {
+        throw FileError.invalidKey(key);
+    }
+    return key;
+}
+//# sourceMappingURL=assert-file-key.js.map

package/dist/application/files/assert-file-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assert-file-key.js","sourceRoot":"","sources":["../../../src/application/files/assert-file-key.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE7C,sFAAsF;AACtF,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/application/files/assert-final-key.d.ts

@@ -0,0 +1,3 @@
+/** Refuses a key the storages refuse, and one under `staging/`, which the purge would take for a staged file. */
+export declare function assertFinalKey(key: string): string;
+//# sourceMappingURL=assert-final-key.d.ts.map

package/dist/application/files/assert-final-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assert-final-key.d.ts","sourceRoot":"","sources":["../../../src/application/files/assert-final-key.ts"],"names":[],"mappings":"AAIA,iHAAiH;AACjH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAMlD"}

package/dist/application/files/assert-final-key.js

@@ -0,0 +1,11 @@
+import { assertFileKey } from './assert-file-key.js';
+import { FileError } from './file-error.js';
+import { STAGING_PREFIX } from './staged-key-of.js';
+/** Refuses a key the storages refuse, and one under `staging/`, which the purge would take for a staged file. */
+export function assertFinalKey(key) {
+    if (assertFileKey(key).startsWith(STAGING_PREFIX)) {
+        throw FileError.invalidKey(key);
+    }
+    return key;
+}
+//# sourceMappingURL=assert-final-key.js.map

package/dist/application/files/assert-final-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assert-final-key.js","sourceRoot":"","sources":["../../../src/application/files/assert-final-key.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEpD,iHAAiH;AACjH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QAClD,MAAM,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/application/files/content-disposition.d.ts

@@ -0,0 +1,3 @@
+/** `attachment`, with the name when there is one, kept to characters that cannot break the header, and its UTF-8 form. */
+export declare function contentDisposition(fileName?: string): string;
+//# sourceMappingURL=content-disposition.d.ts.map

package/dist/application/files/content-disposition.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-disposition.d.ts","sourceRoot":"","sources":["../../../src/application/files/content-disposition.ts"],"names":[],"mappings":"AAAA,0HAA0H;AAC1H,wBAAgB,kBAAkB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAQ5D"}

package/dist/application/files/content-disposition.js

@@ -0,0 +1,9 @@
+/** `attachment`, with the name when there is one, kept to characters that cannot break the header, and its UTF-8 form. */
+export function contentDisposition(fileName) {
+    if (fileName === undefined) {
+        return 'attachment';
+    }
+    const plain = fileName.replace(/[^A-Za-z0-9._ -]/g, '_');
+    return `attachment; filename="${plain}"; filename*=UTF-8''${encodeURIComponent(fileName)}`;
+}
+//# sourceMappingURL=content-disposition.js.map

package/dist/application/files/content-disposition.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-disposition.js","sourceRoot":"","sources":["../../../src/application/files/content-disposition.ts"],"names":[],"mappings":"AAAA,0HAA0H;AAC1H,MAAM,UAAU,kBAAkB,CAAC,QAAiB;IAClD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC;IAEzD,OAAO,yBAAyB,KAAK,uBAAuB,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC7F,CAAC"}

package/dist/application/files/content-expectation.d.ts

@@ -0,0 +1,6 @@
+/** What an incoming content must be: one of the accepted media types, the one it declares, verified on its bytes. */
+export interface ContentExpectation {
+    readonly mediaType: string;
+    readonly accepted: readonly string[];
+}
+//# sourceMappingURL=content-expectation.d.ts.map

package/dist/application/files/content-expectation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-expectation.d.ts","sourceRoot":"","sources":["../../../src/application/files/content-expectation.ts"],"names":[],"mappings":"AAAA,qHAAqH;AACrH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC"}

package/dist/application/files/content-expectation.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=content-expectation.js.map

package/dist/application/files/content-expectation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-expectation.js","sourceRoot":"","sources":["../../../src/application/files/content-expectation.ts"],"names":[],"mappings":""}