@ddd-ts-kit/kernel 0.7.0 → 0.9.0

package/dist/application/files/signature-of.js

@@ -0,0 +1,28 @@
+/** The leading bytes of the binary formats the kit recognises, written as latin1 strings. */
+const SIGNATURES = [
+    { mediaType: 'application/pdf', parts: [[0, '%PDF-']] },
+    { mediaType: 'image/png', parts: [[0, '\x89PNG\r\n\x1a\n']] },
+    { mediaType: 'image/jpeg', parts: [[0, '\xff\xd8\xff']] },
+    { mediaType: 'image/gif', parts: [[0, 'GIF8']] },
+    {
+        mediaType: 'image/webp',
+        parts: [
+            [0, 'RIFF'],
+            [8, 'WEBP'],
+        ],
+    },
+    { mediaType: 'application/zip', parts: [[0, 'PK\x03\x04']] },
+    { mediaType: 'application/gzip', parts: [[0, '\x1f\x8b']] },
+];
+/** The binary format the first bytes of a content announce, or `undefined` when none is recognised. */
+export function signatureOf(head) {
+    return SIGNATURES.find((signature) => signature.parts.every(([offset, bytes]) => startsWith(head, offset, bytes)))
+        ?.mediaType;
+}
+function startsWith(head, offset, bytes) {
+    if (head.length < offset + bytes.length) {
+        return false;
+    }
+    return Array.from({ length: bytes.length }, (_, index) => index).every((index) => head[offset + index] === bytes.charCodeAt(index));
+}
+//# sourceMappingURL=signature-of.js.map

package/dist/application/files/signature-of.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signature-of.js","sourceRoot":"","sources":["../../../src/application/files/signature-of.ts"],"names":[],"mappings":"AAMA,6FAA6F;AAC7F,MAAM,UAAU,GAAyB;IACvC,EAAE,SAAS,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE;IACvD,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC,EAAE;IAC7D,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,EAAE;IACzD,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE;IAChD;QACE,SAAS,EAAE,YAAY;QACvB,KAAK,EAAE;YACL,CAAC,CAAC,EAAE,MAAM,CAAC;YACX,CAAC,CAAC,EAAE,MAAM,CAAC;SACZ;KACF;IACD,EAAE,SAAS,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,EAAE;IAC5D,EAAE,SAAS,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,EAAE;CAC5D,CAAC;AAEF,uGAAuG;AACvG,MAAM,UAAU,WAAW,CAAC,IAAgB;IAC1C,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QAChH,EAAE,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,UAAU,CAAC,IAAgB,EAAE,MAAc,EAAE,KAAa;IACjE,IAAI,IAAI,CAAC,MAAM,GAAG,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QACxC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,CACpE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,KAAK,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAC5D,CAAC;AACJ,CAAC"}

package/dist/application/files/signed-download.d.ts

@@ -0,0 +1,6 @@
+import type { FileContent } from './file-content.js';
+/** A download a signed link granted: the file, and the name to offer the browser when one was signed. */
+export interface SignedDownload extends FileContent {
+    readonly fileName?: string;
+}
+//# sourceMappingURL=signed-download.d.ts.map

package/dist/application/files/signed-download.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signed-download.d.ts","sourceRoot":"","sources":["../../../src/application/files/signed-download.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,yGAAyG;AACzG,MAAM,WAAW,cAAe,SAAQ,WAAW;IACjD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B"}

package/dist/application/files/signed-download.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=signed-download.js.map

package/dist/application/files/signed-download.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signed-download.js","sourceRoot":"","sources":["../../../src/application/files/signed-download.ts"],"names":[],"mappings":""}

package/dist/application/files/signed-upload.d.ts

@@ -0,0 +1,9 @@
+/** What a client needs to send a file straight to the storage: the request to make, and until when. */
+export interface SignedUpload {
+    readonly url: string;
+    readonly method: 'PUT';
+    /** To send as they are: the signature covers them. */
+    readonly headers: Readonly<Record<string, string>>;
+    readonly expiresAt: Date;
+}
+//# sourceMappingURL=signed-upload.d.ts.map

package/dist/application/files/signed-upload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signed-upload.d.ts","sourceRoot":"","sources":["../../../src/application/files/signed-upload.ts"],"names":[],"mappings":"AAAA,uGAAuG;AACvG,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC;IACvB,sDAAsD;IACtD,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACnD,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CAC1B"}

package/dist/application/files/signed-upload.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=signed-upload.js.map

package/dist/application/files/signed-upload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signed-upload.js","sourceRoot":"","sources":["../../../src/application/files/signed-upload.ts"],"names":[],"mappings":""}

package/dist/application/files/signed-url.d.ts

@@ -0,0 +1,6 @@
+/** A link that grants one action on one file until it expires, without any other credential. */
+export interface SignedUrl {
+    readonly url: string;
+    readonly expiresAt: Date;
+}
+//# sourceMappingURL=signed-url.d.ts.map

package/dist/application/files/signed-url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signed-url.d.ts","sourceRoot":"","sources":["../../../src/application/files/signed-url.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CAC1B"}

package/dist/application/files/signed-url.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=signed-url.js.map

package/dist/application/files/signed-url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signed-url.js","sourceRoot":"","sources":["../../../src/application/files/signed-url.ts"],"names":[],"mappings":""}

package/dist/application/files/staged-key-of.d.ts

@@ -0,0 +1,5 @@
+/** Where a file waits until the transaction that references it commits: nothing reads there, and no final key starts with it. */
+export declare const STAGING_PREFIX = "staging/";
+/** The staged key of a final key. */
+export declare function stagedKeyOf(key: string): string;
+//# sourceMappingURL=staged-key-of.d.ts.map

package/dist/application/files/staged-key-of.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"staged-key-of.d.ts","sourceRoot":"","sources":["../../../src/application/files/staged-key-of.ts"],"names":[],"mappings":"AAAA,iIAAiI;AACjI,eAAO,MAAM,cAAc,aAAa,CAAC;AAEzC,qCAAqC;AACrC,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE/C"}

package/dist/application/files/staged-key-of.js

@@ -0,0 +1,7 @@
+/** Where a file waits until the transaction that references it commits: nothing reads there, and no final key starts with it. */
+export const STAGING_PREFIX = 'staging/';
+/** The staged key of a final key. */
+export function stagedKeyOf(key) {
+    return `${STAGING_PREFIX}${key}`;
+}
+//# sourceMappingURL=staged-key-of.js.map

package/dist/application/files/staged-key-of.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"staged-key-of.js","sourceRoot":"","sources":["../../../src/application/files/staged-key-of.ts"],"names":[],"mappings":"AAAA,iIAAiI;AACjI,MAAM,CAAC,MAAM,cAAc,GAAG,UAAU,CAAC;AAEzC,qCAAqC;AACrC,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,OAAO,GAAG,cAAc,GAAG,GAAG,EAAE,CAAC;AACnC,CAAC"}

package/dist/application/files/stored-file.d.ts

@@ -0,0 +1,16 @@
+/**
+ * The reference to a file that an aggregate keeps, and all it keeps: the content lives in a
+ * `FileStorage`, never in the database. It names no provider, no bucket and no URL, so the
+ * connector can change without touching a row.
+ */
+export interface StoredFile {
+    /** Generated by the server (`FileKeys`), never taken from the user. */
+    readonly key: string;
+    /** In bytes. */
+    readonly size: number;
+    /** Verified on the content, not only on the name the client gave. */
+    readonly mediaType: string;
+    /** `sha256:<hex>` of the content, computed while it streamed. */
+    readonly checksum: string;
+}
+//# sourceMappingURL=stored-file.d.ts.map

package/dist/application/files/stored-file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stored-file.d.ts","sourceRoot":"","sources":["../../../src/application/files/stored-file.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,uEAAuE;IACvE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,gBAAgB;IAChB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,qEAAqE;IACrE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,iEAAiE;IACjE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B"}

package/dist/application/files/stored-file.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=stored-file.js.map

package/dist/application/files/stored-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stored-file.js","sourceRoot":"","sources":["../../../src/application/files/stored-file.ts"],"names":[],"mappings":""}

package/dist/application/files/upload-url-options.d.ts

@@ -0,0 +1,12 @@
+export interface UploadUrlOptions {
+    /** Short: at most `MAX_SIGNED_URL_SECONDS`. */
+    readonly expiresInSeconds: number;
+    /** The media type the client must send, as the `content-type` the signature covers. */
+    readonly mediaType: string;
+    /**
+     * In bytes. The storages the application serves refuse a larger upload; a presigned link of
+     * an object store cannot cap it, so `FileStaging.confirm` checks it again in every case.
+     */
+    readonly maxBytes: number;
+}
+//# sourceMappingURL=upload-url-options.d.ts.map

package/dist/application/files/upload-url-options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upload-url-options.d.ts","sourceRoot":"","sources":["../../../src/application/files/upload-url-options.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,gBAAgB;IAC/B,+CAA+C;IAC/C,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,uFAAuF;IACvF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B"}

package/dist/application/files/upload-url-options.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=upload-url-options.js.map

package/dist/application/files/upload-url-options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upload-url-options.js","sourceRoot":"","sources":["../../../src/application/files/upload-url-options.ts"],"names":[],"mappings":""}

package/dist/application/ports/file-keys.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Names the files: a key is always generated on the server, never built from what a user sent
+ * (a file name, a path), so a request can neither choose where it writes nor guess another key.
+ */
+export declare abstract class FileKeys {
+    /** A new key under `area`, a key prefix of the project such as `appointment-documents`. */
+    abstract next(area: string): string;
+}
+//# sourceMappingURL=file-keys.d.ts.map

package/dist/application/ports/file-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-keys.d.ts","sourceRoot":"","sources":["../../../src/application/ports/file-keys.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,8BAAsB,QAAQ;IAK5B,2FAA2F;IAC3F,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;CACrC"}

package/dist/application/ports/file-keys.js

@@ -0,0 +1,10 @@
+/**
+ * Names the files: a key is always generated on the server, never built from what a user sent
+ * (a file name, a path), so a request can neither choose where it writes nor guess another key.
+ */
+export class FileKeys {
+    static {
+        Object.defineProperty(this, 'tokenKey', { value: 'kernel.FileKeys' });
+    }
+}
+//# sourceMappingURL=file-keys.js.map

package/dist/application/ports/file-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-keys.js","sourceRoot":"","sources":["../../../src/application/ports/file-keys.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,OAAgB,QAAQ;IAC5B;QACE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACxE,CAAC;CAIF"}

package/dist/application/ports/file-scanner.d.ts

@@ -0,0 +1,13 @@
+import type { Readable } from 'node:stream';
+import type { ScanVerdict } from '../files/scan-verdict.js';
+import type { StoredFile } from '../files/stored-file.js';
+/**
+ * The check a file passes before it is accepted: an antivirus (ClamAV over its socket, a cloud
+ * scanning service), a parser that refuses a malformed document, a policy on archives. Called on
+ * the staged file, so a refused file is never visible. `open` reads the content again; a scanner
+ * that needs none of it does not call it.
+ */
+export declare abstract class FileScanner {
+    abstract scan(file: StoredFile, open: () => Promise<Readable>): Promise<ScanVerdict>;
+}
+//# sourceMappingURL=file-scanner.d.ts.map

package/dist/application/ports/file-scanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-scanner.d.ts","sourceRoot":"","sources":["../../../src/application/ports/file-scanner.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAE1D;;;;;GAKG;AACH,8BAAsB,WAAW;IAK/B,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CACtF"}

package/dist/application/ports/file-scanner.js

@@ -0,0 +1,12 @@
+/**
+ * The check a file passes before it is accepted: an antivirus (ClamAV over its socket, a cloud
+ * scanning service), a parser that refuses a malformed document, a policy on archives. Called on
+ * the staged file, so a refused file is never visible. `open` reads the content again; a scanner
+ * that needs none of it does not call it.
+ */
+export class FileScanner {
+    static {
+        Object.defineProperty(this, 'tokenKey', { value: 'kernel.FileScanner' });
+    }
+}
+//# sourceMappingURL=file-scanner.js.map

package/dist/application/ports/file-scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-scanner.js","sourceRoot":"","sources":["../../../src/application/ports/file-scanner.ts"],"names":[],"mappings":"AAIA;;;;;GAKG;AACH,MAAM,OAAgB,WAAW;IAC/B;QACE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;IAC3E,CAAC;CAGF"}

package/dist/application/ports/file-storage.d.ts

@@ -0,0 +1,40 @@
+import type { DownloadUrlOptions } from '../files/download-url-options.js';
+import type { FileContent } from '../files/file-content.js';
+import type { FileMetadata } from '../files/file-metadata.js';
+import type { FileSource } from '../files/file-source.js';
+import type { ListedFile } from '../files/listed-file.js';
+import type { PutOptions } from '../files/put-options.js';
+import type { SignedUpload } from '../files/signed-upload.js';
+import type { SignedUrl } from '../files/signed-url.js';
+import type { StoredFile } from '../files/stored-file.js';
+import type { UploadUrlOptions } from '../files/upload-url-options.js';
+/**
+ * Where the content of files lives: an object store, a directory, the memory of a test. Never
+ * the database, whose backups, replicas and memory are sized for rows. Content always streams in
+ * and out: no method takes or returns a whole file. A key that `isFileKey` refuses is refused
+ * with `INVALID_FILE_KEY` before anything is touched.
+ *
+ * A write is not part of a transaction: see `FileStaging` for the order that keeps the database
+ * and the storage consistent.
+ */
+export declare abstract class FileStorage {
+    /** Writes the content under the key, replacing what was there; rejects with `FILE_TOO_LARGE` beyond `maxBytes`, leaving nothing. */
+    abstract put(key: string, content: FileSource, options: PutOptions): Promise<StoredFile>;
+    /** The content as a stream, or `undefined` when nothing is stored under the key. */
+    abstract get(key: string): Promise<FileContent | undefined>;
+    /** What is known of the file without reading it, or `undefined`: how a caller asks whether it exists. */
+    abstract stat(key: string): Promise<FileMetadata | undefined>;
+    /** Removes the file; removing a file that is not there is not an error. */
+    abstract delete(key: string): Promise<void>;
+    /** Rejects with `FILE_NOT_FOUND` when nothing is stored under `from`. */
+    abstract copy(from: string, to: string): Promise<void>;
+    /** Rejects with `FILE_NOT_FOUND` when nothing is stored under `from`. */
+    abstract move(from: string, to: string): Promise<void>;
+    /** Every file whose key starts with the prefix, in no promised order. */
+    abstract list(prefix: string): AsyncIterable<ListedFile>;
+    /** A link that downloads the file until it expires. Signing does not check that the file exists. */
+    abstract signedDownloadUrl(key: string, options: DownloadUrlOptions): Promise<SignedUrl>;
+    /** A request that uploads one file under the key, straight to the storage, until it expires. */
+    abstract signedUploadUrl(key: string, options: UploadUrlOptions): Promise<SignedUpload>;
+}
+//# sourceMappingURL=file-storage.d.ts.map

package/dist/application/ports/file-storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-storage.d.ts","sourceRoot":"","sources":["../../../src/application/ports/file-storage.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAEvE;;;;;;;;GAQG;AACH,8BAAsB,WAAW;IAK/B,oIAAoI;IACpI,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAEzF,oFAAoF;IACpF,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAAC;IAE5D,yGAAyG;IACzG,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAC;IAE9D,2EAA2E;IAC3E,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5C,yEAAyE;IACzE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvD,yEAAyE;IACzE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvD,yEAAyE;IACzE,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;IAEzD,oGAAoG;IACpG,QAAQ,CAAC,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAEzF,gGAAgG;IAChG,QAAQ,CAAC,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;CACzF"}

package/dist/application/ports/file-storage.js

@@ -0,0 +1,15 @@
+/**
+ * Where the content of files lives: an object store, a directory, the memory of a test. Never
+ * the database, whose backups, replicas and memory are sized for rows. Content always streams in
+ * and out: no method takes or returns a whole file. A key that `isFileKey` refuses is refused
+ * with `INVALID_FILE_KEY` before anything is touched.
+ *
+ * A write is not part of a transaction: see `FileStaging` for the order that keeps the database
+ * and the storage consistent.
+ */
+export class FileStorage {
+    static {
+        Object.defineProperty(this, 'tokenKey', { value: 'kernel.FileStorage' });
+    }
+}
+//# sourceMappingURL=file-storage.js.map

package/dist/application/ports/file-storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-storage.js","sourceRoot":"","sources":["../../../src/application/ports/file-storage.ts"],"names":[],"mappings":"AAWA;;;;;;;;GAQG;AACH,MAAM,OAAgB,WAAW;IAC/B;QACE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;IAC3E,CAAC;CA4BF"}

package/dist/application/ports/served-file-storage.d.ts

@@ -0,0 +1,16 @@
+import type { FileSource } from '../files/file-source.js';
+import type { SignedDownload } from '../files/signed-download.js';
+import type { StoredFile } from '../files/stored-file.js';
+import { FileStorage } from './file-storage.js';
+/**
+ * A storage whose signed links point at the application itself, which must then answer them:
+ * the local directory of development and the memory of the tests. `signedFileRoutes` of
+ * `@ddd-ts-kit/http` mounts that answer. An object store answers its own links and is not one.
+ */
+export declare abstract class ServedFileStorage extends FileStorage {
+    /** The file a download link grants, or `undefined` for a link that is forged, expired or for another action. */
+    abstract openSigned(token: string): Promise<SignedDownload | undefined>;
+    /** Stores what an upload link grants, sent with the media type it was signed for; `undefined` when the link does not grant it. */
+    abstract acceptSigned(token: string, content: FileSource, mediaType: string): Promise<StoredFile | undefined>;
+}
+//# sourceMappingURL=served-file-storage.d.ts.map

package/dist/application/ports/served-file-storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"served-file-storage.d.ts","sourceRoot":"","sources":["../../../src/application/ports/served-file-storage.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD;;;;GAIG;AACH,8BAAsB,iBAAkB,SAAQ,WAAW;IAKzD,gHAAgH;IAChH,QAAQ,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAExE,kIAAkI;IAClI,QAAQ,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;CAC/G"}

package/dist/application/ports/served-file-storage.js

@@ -0,0 +1,12 @@
+import { FileStorage } from './file-storage.js';
+/**
+ * A storage whose signed links point at the application itself, which must then answer them:
+ * the local directory of development and the memory of the tests. `signedFileRoutes` of
+ * `@ddd-ts-kit/http` mounts that answer. An object store answers its own links and is not one.
+ */
+export class ServedFileStorage extends FileStorage {
+    static {
+        Object.defineProperty(this, 'tokenKey', { value: 'kernel.ServedFileStorage' });
+    }
+}
+//# sourceMappingURL=served-file-storage.js.map

package/dist/application/ports/served-file-storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"served-file-storage.js","sourceRoot":"","sources":["../../../src/application/ports/served-file-storage.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD;;;;GAIG;AACH,MAAM,OAAgB,iBAAkB,SAAQ,WAAW;IACzD;QACE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;IACjF,CAAC;CAOF"}

package/dist/application/ports/tenant-directory.d.ts

@@ -0,0 +1,8 @@
+/**
+ * The tenants that exist, for work that runs once per tenant: a job declared `tenancy:
+ * 'per-tenant'`, the provisioning of a schema or a database, a migration applied to each.
+ */
+export declare abstract class TenantDirectory {
+    abstract tenants(): Promise<readonly string[]>;
+}
+//# sourceMappingURL=tenant-directory.d.ts.map

package/dist/application/ports/tenant-directory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-directory.d.ts","sourceRoot":"","sources":["../../../src/application/ports/tenant-directory.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,8BAAsB,eAAe;IAKnC,QAAQ,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;CAChD"}

package/dist/application/ports/tenant-directory.js

@@ -0,0 +1,10 @@
+/**
+ * The tenants that exist, for work that runs once per tenant: a job declared `tenancy:
+ * 'per-tenant'`, the provisioning of a schema or a database, a migration applied to each.
+ */
+export class TenantDirectory {
+    static {
+        Object.defineProperty(this, 'tokenKey', { value: 'kernel.TenantDirectory' });
+    }
+}
+//# sourceMappingURL=tenant-directory.js.map

package/dist/application/ports/tenant-directory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-directory.js","sourceRoot":"","sources":["../../../src/application/ports/tenant-directory.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,OAAgB,eAAe;IACnC;QACE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;IAC/E,CAAC;CAGF"}

package/dist/application/scheduling/execution-context-of-job.d.ts

@@ -4,10 +4,12 @@ export interface JobExecutionStart {
     readonly scheduledAt: Date;
     /** The instant the timeout of the job ends the run, when it has one. */
     readonly deadline?: Date;
+    /** For a job declared `tenancy: 'per-tenant'`: the tenant of this run. */
+    readonly tenantId?: string;
 }
 /**
  * The execution context of one run: origin `schedule`, the system actor named after the job, a
- * correlation of its own and the instant the run was due.
+ * correlation of its own, the instant the run was due, and the tenant of a per-tenant run.
  */
 export declare function executionContextOfJob(job: string, start: JobExecutionStart): ExecutionContext;
 //# sourceMappingURL=execution-context-of-job.d.ts.map

package/dist/application/scheduling/execution-context-of-job.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"execution-context-of-job.d.ts","sourceRoot":"","sources":["../../../src/application/scheduling/execution-context-of-job.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,gBAAgB,EAAoB,MAAM,mCAAmC,CAAC;AAE5F,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC;IAC3B,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC;CAC1B;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,GAAG,gBAAgB,CAE7F"}
+{"version":3,"file":"execution-context-of-job.d.ts","sourceRoot":"","sources":["../../../src/application/scheduling/execution-context-of-job.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,gBAAgB,EAAoB,MAAM,mCAAmC,CAAC;AAE5F,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC;IAC3B,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC;IACzB,0EAA0E;IAC1E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,GAAG,gBAAgB,CAE7F"}

package/dist/application/scheduling/execution-context-of-job.js

@@ -2,7 +2,7 @@ import { systemActor } from '../actor/system-actor.js';
 import { executionContext } from '../execution/execution-context.js';
 /**
  * The execution context of one run: origin `schedule`, the system actor named after the job, a
- * correlation of its own and the instant the run was due.
+ * correlation of its own, the instant the run was due, and the tenant of a per-tenant run.
  */
 export function executionContextOfJob(job, start) {
     return executionContext({ ...start, actor: systemActor(job), origin: 'schedule' });

package/dist/application/scheduling/execution-context-of-job.js.map

@@ -1 +1 @@
-{"version":3,"file":"execution-context-of-job.js","sourceRoot":"","sources":["../../../src/application/scheduling/execution-context-of-job.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAyB,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAS5F;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAW,EAAE,KAAwB;IACzE,OAAO,gBAAgB,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;AACrF,CAAC"}
+{"version":3,"file":"execution-context-of-job.js","sourceRoot":"","sources":["../../../src/application/scheduling/execution-context-of-job.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAyB,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAW5F;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAW,EAAE,KAAwB;IACzE,OAAO,gBAAgB,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;AACrF,CAAC"}

package/dist/application/scheduling/job-execution.d.ts

@@ -8,5 +8,7 @@ export interface JobExecution {
     readonly attempt: number;
     /** Aborted when the run exceeds its timeout or the scheduler stops: a long job checks it. */
     readonly signal: AbortSignal;
+    /** The tenant of this run, for a job declared `tenancy: 'per-tenant'`. */
+    readonly tenantId?: string;
 }
 //# sourceMappingURL=job-execution.d.ts.map

package/dist/application/scheduling/job-execution.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"job-execution.d.ts","sourceRoot":"","sources":["../../../src/application/scheduling/job-execution.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,MAAM,WAAW,YAAY;IAC3B,2EAA2E;IAC3E,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC;IAC3B,yGAAyG;IACzG,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,uGAAuG;IACvG,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,6FAA6F;IAC7F,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;CAC9B"}
+{"version":3,"file":"job-execution.d.ts","sourceRoot":"","sources":["../../../src/application/scheduling/job-execution.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,MAAM,WAAW,YAAY;IAC3B,2EAA2E;IAC3E,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC;IAC3B,yGAAyG;IACzG,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,uGAAuG;IACvG,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,6FAA6F;IAC7F,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,0EAA0E;IAC1E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B"}

package/dist/application/scheduling/job-options.d.ts

@@ -21,5 +21,11 @@ export interface JobOptions {
      * an application running several runs it. Best effort: see the scheduler.
      */
     readonly singleInstance?: boolean;
+    /**
+     * `global` (default): one run per occurrence, in no tenant. `per-tenant`: one run per tenant
+     * of the `TenantDirectory` for each occurrence, each in that tenant's execution scope, so the
+     * job reads and writes one tenant at a time; one failing tenant does not stop the others.
+     */
+    readonly tenancy?: 'global' | 'per-tenant';
 }
 //# sourceMappingURL=job-options.d.ts.map

package/dist/application/scheduling/job-options.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"job-options.d.ts","sourceRoot":"","sources":["../../../src/application/scheduling/job-options.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,UAAU;IACzB;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IACpC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;IACtC,6EAA6E;IAC7E,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,sHAAsH;IACtH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,uGAAuG;IACvG,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;CACnC"}
+{"version":3,"file":"job-options.d.ts","sourceRoot":"","sources":["../../../src/application/scheduling/job-options.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,UAAU;IACzB;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IACpC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;IACtC,6EAA6E;IAC7E,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,sHAAsH;IACtH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,uGAAuG;IACvG,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,GAAG,YAAY,CAAC;CAC5C"}

package/dist/application/scheduling/job-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"job-policy.d.ts","sourceRoot":"","sources":["../../../src/application/scheduling/job-policy.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAGnD,iDAAiD;AACjD,MAAM,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,GAAG,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;AAEhG,yFAAyF;AACzF,wBAAgB,SAAS,CAAC,OAAO,EAAE,UAAU,GAAG,SAAS,CAiBxD"}
+{"version":3,"file":"job-policy.d.ts","sourceRoot":"","sources":["../../../src/application/scheduling/job-policy.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAGnD,iDAAiD;AACjD,MAAM,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,GAAG,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;AAEhG,yFAAyF;AACzF,wBAAgB,SAAS,CAAC,OAAO,EAAE,UAAU,GAAG,SAAS,CAmBxD"}

package/dist/application/scheduling/job-policy.js

@@ -3,15 +3,17 @@ import { parseDuration } from './parse-duration.js';
 /** Validates the options and fills in the defaults. Throws `InvalidJobScheduleError`. */
 export function jobPolicy(options) {
     const { overlap = 'skip', missed = 'skip', timeoutMs, jitterMs = 0, enabled = true, singleInstance = true } = options;
+    const tenancy = options.tenancy ?? 'global';
     assertOneOf('overlap', overlap, ['skip', 'queue']);
     assertOneOf('missed', missed, ['skip', 'run-once']);
+    assertOneOf('tenancy', tenancy, ['global', 'per-tenant']);
     if (!Number.isSafeInteger(jitterMs) || jitterMs < 0) {
         throw new InvalidJobScheduleError(`jitterMs is ${jitterMs}: a whole number of milliseconds, zero or more, is expected.`);
     }
     if (timeoutMs === undefined) {
-        return { overlap, missed, jitterMs, enabled, singleInstance };
+        return { overlap, missed, jitterMs, enabled, singleInstance, tenancy };
     }
-    return { overlap, missed, jitterMs, enabled, singleInstance, timeoutMs: parseDuration(timeoutMs) };
+    return { overlap, missed, jitterMs, enabled, singleInstance, tenancy, timeoutMs: parseDuration(timeoutMs) };
 }
 function assertOneOf(option, value, allowed) {
     if (allowed.includes(value)) {

package/dist/application/scheduling/job-policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"job-policy.js","sourceRoot":"","sources":["../../../src/application/scheduling/job-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAE1E,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAKpD,yFAAyF;AACzF,MAAM,UAAU,SAAS,CAAC,OAAmB;IAC3C,MAAM,EAAE,OAAO,GAAG,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,SAAS,EAAE,QAAQ,GAAG,CAAC,EAAE,OAAO,GAAG,IAAI,EAAE,cAAc,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;IAEtH,WAAW,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACnD,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IAEpD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,QAAQ,8DAA8D,CACtF,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;IAChE,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC;AACrG,CAAC;AAED,SAAS,WAAW,CAAC,MAAc,EAAE,KAAa,EAAE,OAA0B;IAC5E,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO;IACT,CAAC;IAED,MAAM,IAAI,uBAAuB,CAAC,GAAG,MAAM,QAAQ,KAAK,aAAa,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;AAC1G,CAAC"}
+{"version":3,"file":"job-policy.js","sourceRoot":"","sources":["../../../src/application/scheduling/job-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAE1E,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAKpD,yFAAyF;AACzF,MAAM,UAAU,SAAS,CAAC,OAAmB;IAC3C,MAAM,EAAE,OAAO,GAAG,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,SAAS,EAAE,QAAQ,GAAG,CAAC,EAAE,OAAO,GAAG,IAAI,EAAE,cAAc,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;IACtH,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,QAAQ,CAAC;IAE5C,WAAW,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACnD,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IACpD,WAAW,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC;IAE1D,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,uBAAuB,CAC/B,eAAe,QAAQ,8DAA8D,CACtF,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC;IACzE,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC;AAC9G,CAAC;AAED,SAAS,WAAW,CAAC,MAAc,EAAE,KAAa,EAAE,OAA0B;IAC5E,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO;IACT,CAAC;IAED,MAAM,IAAI,uBAAuB,CAAC,GAAG,MAAM,QAAQ,KAAK,aAAa,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;AAC1G,CAAC"}

package/dist/application/session/has-scope.d.ts

@@ -0,0 +1,5 @@
+import type { SessionScope } from './session-scope.js';
+import type { Session } from './session.js';
+/** Whether the session was granted the scope; a request without a session was granted none. */
+export declare function hasScope(session: Session | undefined, scope: SessionScope): boolean;
+//# sourceMappingURL=has-scope.d.ts.map

package/dist/application/session/has-scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"has-scope.d.ts","sourceRoot":"","sources":["../../../src/application/session/has-scope.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAE5C,+FAA+F;AAC/F,wBAAgB,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,SAAS,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAEnF"}

package/dist/application/session/has-scope.js

@@ -0,0 +1,5 @@
+/** Whether the session was granted the scope; a request without a session was granted none. */
+export function hasScope(session, scope) {
+    return session?.scopes?.includes(scope) === true;
+}
+//# sourceMappingURL=has-scope.js.map

package/dist/application/session/has-scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"has-scope.js","sourceRoot":"","sources":["../../../src/application/session/has-scope.ts"],"names":[],"mappings":"AAGA,+FAA+F;AAC/F,MAAM,UAAU,QAAQ,CAAC,OAA4B,EAAE,KAAmB;IACxE,OAAO,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC;AACnD,CAAC"}

package/dist/application/session/session-scope.d.ts

@@ -0,0 +1,4 @@
+import type { SessionScopes } from './session-scopes.js';
+/** A scope of the project's vocabulary once `SessionScopes` declares one, any string before. */
+export type SessionScope = [keyof SessionScopes] extends [never] ? string : Extract<keyof SessionScopes, string>;
+//# sourceMappingURL=session-scope.d.ts.map

package/dist/application/session/session-scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-scope.d.ts","sourceRoot":"","sources":["../../../src/application/session/session-scope.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,gGAAgG;AAChG,MAAM,MAAM,YAAY,GAAG,CAAC,MAAM,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,aAAa,EAAE,MAAM,CAAC,CAAC"}

package/dist/application/session/session-scope.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=session-scope.js.map

package/dist/application/session/session-scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-scope.js","sourceRoot":"","sources":["../../../src/application/session/session-scope.ts"],"names":[],"mappings":""}

package/dist/application/session/session-scopes.d.ts

@@ -0,0 +1,11 @@
+/**
+ * The vocabulary of the scopes a project grants its clients, by declaration merging, so that a
+ * guard names only scopes that exist:
+ *
+ *     declare module '@ddd-ts-kit/kernel' {
+ *       interface SessionScopes { readonly 'invoices:read': true; readonly 'invoices:write': true }
+ *     }
+ */
+export interface SessionScopes {
+}
+//# sourceMappingURL=session-scopes.d.ts.map

package/dist/application/session/session-scopes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-scopes.d.ts","sourceRoot":"","sources":["../../../src/application/session/session-scopes.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;CAAG"}

package/dist/application/session/session-scopes.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=session-scopes.js.map

package/dist/application/session/session-scopes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-scopes.js","sourceRoot":"","sources":["../../../src/application/session/session-scopes.ts"],"names":[],"mappings":""}

package/dist/application/session/session.d.ts

@@ -22,6 +22,12 @@ export interface Session {
     /** IANA time zone, for example `Europe/Paris`. */
     readonly timeZone?: string;
     readonly client?: SessionClient;
+    /**
+     * What the credential allows whoever presents it (the OAuth 2.0 `scope` of the token): a
+     * limit on the client, checked at the edge (`HasScope`), never what the actor may do, which
+     * stays a permission of the use case. Absent when the credential carries none.
+     */
+    readonly scopes?: readonly string[];
     readonly extensions: SessionExtensionValues;
 }
 //# sourceMappingURL=session.d.ts.map

package/dist/application/session/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../../src/application/session/session.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAE5E;;;;GAIG;AACH,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC;IAC1B,QAAQ,CAAC,oBAAoB,EAAE,oBAAoB,CAAC;IACpD,QAAQ,CAAC,sBAAsB,CAAC,EAAE,sBAAsB,CAAC;IACzD,kFAAkF;IAClF,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,gDAAgD;IAChD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,kDAAkD;IAClD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC;CAC7C"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../../src/application/session/session.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAE5E;;;;GAIG;AACH,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC;IAC1B,QAAQ,CAAC,oBAAoB,EAAE,oBAAoB,CAAC;IACpD,QAAQ,CAAC,sBAAsB,CAAC,EAAE,sBAAsB,CAAC;IACzD,kFAAkF;IAClF,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,gDAAgD;IAChD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,kDAAkD;IAClD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC;CAC7C"}

package/dist/application/tenancy/across-tenants.d.ts

@@ -0,0 +1,12 @@
+import type { ElevationOptions } from './elevation-options.js';
+import type { TenantElevation } from './tenant-elevation.js';
+/** The action of the audit entry an elevation writes. */
+export declare const TENANT_ELEVATION_ACTION = "tenancy:elevate";
+/**
+ * Runs `work` with reads widened to the tenants of `elevation`, for platform staff. Never
+ * implicit: the platform calls it after the permission to elevate was decided, and the
+ * elevation is written to the audit trail before the work starts; a trail that fails refuses
+ * the elevation. Writes still name one tenant (`tenantScopeOf`).
+ */
+export declare function acrossTenants<T>(options: ElevationOptions, elevation: TenantElevation, work: () => Promise<T>): Promise<T>;
+//# sourceMappingURL=across-tenants.d.ts.map

package/dist/application/tenancy/across-tenants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"across-tenants.d.ts","sourceRoot":"","sources":["../../../src/application/tenancy/across-tenants.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE7D,yDAAyD;AACzD,eAAO,MAAM,uBAAuB,oBAAoB,CAAC;AAEzD;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,CAAC,EACnC,OAAO,EAAE,gBAAgB,EACzB,SAAS,EAAE,eAAe,EAC1B,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACrB,OAAO,CAAC,CAAC,CAAC,CAQZ"}