@ddd-ts-kit/kernel 0.8.0 → 0.10.0

package/dist/infrastructure/files/collect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"collect.js","sourceRoot":"","sources":["../../../src/infrastructure/files/collect.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,uFAAuF;AACvF,MAAM,UAAU,OAAO,CAAC,MAAgB;IACtC,OAAO,IAAI,QAAQ,CAAC;QAClB,KAAK,CAAC,KAAa,EAAE,SAAS,EAAE,IAAI;YAClC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnB,IAAI,EAAE,CAAC;QACT,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/infrastructure/files/file-grant.d.ts

@@ -0,0 +1,11 @@
+/** What a signed link allows: one action on one key, until `expiresAt` (seconds since the epoch). */
+export interface FileGrant {
+    readonly action: 'download' | 'upload';
+    readonly key: string;
+    readonly expiresAt: number;
+    readonly fileName?: string;
+    readonly mediaType?: string;
+    /** The size an upload may not exceed, in bytes. */
+    readonly maxBytes?: number;
+}
+//# sourceMappingURL=file-grant.d.ts.map

package/dist/infrastructure/files/file-grant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-grant.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/files/file-grant.ts"],"names":[],"mappings":"AAAA,qGAAqG;AACrG,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,QAAQ,CAAC;IACvC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,mDAAmD;IACnD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B"}

package/dist/infrastructure/files/file-grant.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=file-grant.js.map

package/dist/infrastructure/files/file-grant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-grant.js","sourceRoot":"","sources":["../../../src/infrastructure/files/file-grant.ts"],"names":[],"mappings":""}

package/dist/infrastructure/files/file-inspection.d.ts

@@ -0,0 +1,22 @@
+import { Transform, type TransformCallback } from 'node:stream';
+import type { InspectionLimits } from '../../application/files/inspection-limits.js';
+/**
+ * A pass-through for content on its way to a storage: counts it and fails beyond `maxBytes`,
+ * hashes it, and when an expectation is given holds back the first bytes until they prove the
+ * declared media type. Nothing of a refused content goes on. Read `size` and `checksum` once the
+ * stream has finished.
+ */
+export declare class FileInspection extends Transform {
+    private readonly limits;
+    size: number;
+    private readonly hash;
+    private held;
+    private verified;
+    constructor(limits?: InspectionLimits);
+    get checksum(): string;
+    _transform(chunk: unknown, _encoding: BufferEncoding, done: TransformCallback): void;
+    _flush(done: TransformCallback): void;
+    private pass;
+    private refusalOf;
+}
+//# sourceMappingURL=file-inspection.d.ts.map

package/dist/infrastructure/files/file-inspection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-inspection.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/files/file-inspection.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAIhE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8CAA8C,CAAC;AAKrF;;;;;GAKG;AACH,qBAAa,cAAe,SAAQ,SAAS;IAS/B,OAAO,CAAC,QAAQ,CAAC,MAAM;IARnC,IAAI,SAAK;IAET,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA8B;IAEnD,OAAO,CAAC,IAAI,CAAgB;IAE5B,OAAO,CAAC,QAAQ,CAAU;IAE1B,YAA6B,MAAM,GAAE,gBAAqB,EAGzD;IAED,IAAI,QAAQ,IAAI,MAAM,CAErB;IAEQ,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,IAAI,EAAE,iBAAiB,GAAG,IAAI,CAa5F;IAEQ,MAAM,CAAC,IAAI,EAAE,iBAAiB,GAAG,IAAI,CAE7C;IAED,OAAO,CAAC,IAAI;IAqBZ,OAAO,CAAC,SAAS;CAalB"}

package/dist/infrastructure/files/file-inspection.js

@@ -0,0 +1,66 @@
+import { createHash } from 'node:crypto';
+import { Transform } from 'node:stream';
+import { acceptsMediaType } from '../../application/files/accepts-media-type.js';
+import { contentMatches } from '../../application/files/content-matches.js';
+import { FileError } from '../../application/files/file-error.js';
+/** Enough bytes for every signature, and for a fair judgement of text. */
+const HEAD_BYTES = 4_096;
+/**
+ * A pass-through for content on its way to a storage: counts it and fails beyond `maxBytes`,
+ * hashes it, and when an expectation is given holds back the first bytes until they prove the
+ * declared media type. Nothing of a refused content goes on. Read `size` and `checksum` once the
+ * stream has finished.
+ */
+export class FileInspection extends Transform {
+    limits;
+    size = 0;
+    hash = createHash('sha256');
+    held = [];
+    verified;
+    constructor(limits = {}) {
+        super();
+        this.limits = limits;
+        this.verified = limits.expected === undefined;
+    }
+    get checksum() {
+        return `sha256:${this.hash.copy().digest('hex')}`;
+    }
+    _transform(chunk, _encoding, done) {
+        const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk instanceof Uint8Array ? chunk : String(chunk));
+        this.size += bytes.length;
+        if (this.limits.maxBytes !== undefined && this.size > this.limits.maxBytes) {
+            done(FileError.tooLarge(this.limits.maxBytes));
+            return;
+        }
+        this.hash.update(bytes);
+        this.pass(bytes, false, done);
+    }
+    _flush(done) {
+        this.pass(Buffer.alloc(0), true, done);
+    }
+    pass(bytes, ended, done) {
+        if (this.verified) {
+            done(null, bytes);
+            return;
+        }
+        this.held.push(bytes);
+        const head = Buffer.concat(this.held);
+        if (head.length < HEAD_BYTES && !ended) {
+            done();
+            return;
+        }
+        this.held = [];
+        this.verified = true;
+        done(this.refusalOf(head), head);
+    }
+    refusalOf(head) {
+        const { expected } = this.limits;
+        if (expected === undefined) {
+            return null;
+        }
+        const valid = acceptsMediaType(expected.accepted, expected.mediaType) &&
+            contentMatches(head.subarray(0, HEAD_BYTES), expected.mediaType);
+        return valid ? null : FileError.unsupportedMediaType(expected.mediaType, expected.accepted);
+    }
+}
+//# sourceMappingURL=file-inspection.js.map

package/dist/infrastructure/files/file-inspection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-inspection.js","sourceRoot":"","sources":["../../../src/infrastructure/files/file-inspection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAa,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,SAAS,EAA0B,MAAM,aAAa,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,+CAA+C,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,MAAM,4CAA4C,CAAC;AAC5E,OAAO,EAAE,SAAS,EAAE,MAAM,uCAAuC,CAAC;AAGlE,0EAA0E;AAC1E,MAAM,UAAU,GAAG,KAAK,CAAC;AAEzB;;;;;GAKG;AACH,MAAM,OAAO,cAAe,SAAQ,SAAS;IASd,MAAM;IARnC,IAAI,GAAG,CAAC,CAAC;IAEQ,IAAI,GAAS,UAAU,CAAC,QAAQ,CAAC,CAAC;IAE3C,IAAI,GAAa,EAAE,CAAC;IAEpB,QAAQ,CAAU;IAE1B,YAA6B,MAAM,GAAqB,EAAE;QACxD,KAAK,EAAE,CAAC;sBADmB,MAAM;QAEjC,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC;IAChD,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,UAAU,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IACpD,CAAC;IAEQ,UAAU,CAAC,KAAc,EAAE,SAAyB,EAAE,IAAuB;QACpF,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,YAAY,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAEhH,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;QAE1B,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC3E,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;YAE/C,OAAO;QACT,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IAChC,CAAC;IAEQ,MAAM,CAAC,IAAuB;QACrC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;IAEO,IAAI,CAAC,KAAa,EAAE,KAAc,EAAE,IAAuB;QACjE,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAElB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEtC,IAAI,IAAI,CAAC,MAAM,GAAG,UAAU,IAAI,CAAC,KAAK,EAAE,CAAC;YACvC,IAAI,EAAE,CAAC;YAEP,OAAO;QACT,CAAC;QAED,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC;QACf,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IACnC,CAAC;IAEO,SAAS,CAAC,IAAY;QAC5B,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;QAEjC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,KAAK,GACT,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,SAAS,CAAC;YACvD,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;QAEnE,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC9F,CAAC;CACF"}

package/dist/infrastructure/files/file-staging.d.ts

@@ -0,0 +1,59 @@
+import type { ContentExpectation } from '../../application/files/content-expectation.js';
+import type { FileSource } from '../../application/files/file-source.js';
+import type { PendingUpload } from '../../application/files/pending-upload.js';
+import type { PendingUploadLink } from '../../application/files/pending-upload-link.js';
+import type { PutOptions } from '../../application/files/put-options.js';
+import type { StoredFile } from '../../application/files/stored-file.js';
+import type { UploadUrlOptions } from '../../application/files/upload-url-options.js';
+import type { ErrorReporter } from '../../application/ports/error-reporter.js';
+import type { FileScanner } from '../../application/ports/file-scanner.js';
+import type { FileStorage } from '../../application/ports/file-storage.js';
+/**
+ * Keeps the storage consistent with the database, which a write to the storage cannot join in a
+ * transaction. A file is staged first (under `staging/`, scanned, where nothing reads), before
+ * the unit of work opens when it comes from a client. The handler records its reference, under
+ * its final key, in the aggregate it saves, and asks for `promoteOnCommit`: the file moves to its
+ * key as the last step of the transaction, and back to `staging/` if the transaction rolls back.
+ * So a committed row never points into `staging/`, and every staged file is an orphan (a refused
+ * command, a rollback, an upload never confirmed) that `purge` removes on a schedule.
+ */
+export declare class FileStaging {
+    private readonly storage;
+    private readonly scanner;
+    private readonly reporter;
+    constructor(storage: FileStorage, scanner: FileScanner, reporter: ErrorReporter);
+    /** Writes the content under the staged key, then has it scanned; a refused file is removed and `FILE_REJECTED` thrown. */
+    stage(key: string, content: FileSource, options: PutOptions): Promise<StoredFile>;
+    /**
+     * A request the client sends the file with, straight to the staged key, and the grant to keep
+     * on the server (on the aggregate that awaits the file) for `confirm` to read back.
+     */
+    uploadUrl(key: string, options: UploadUrlOptions & Pick<ContentExpectation, 'accepted'>): Promise<PendingUploadLink>;
+    /**
+     * Reads a file uploaded straight to the staged key of a grant the server kept: its size against
+     * the cap of the grant, its media type on its bytes, its checksum, the scan. A file that fails
+     * is discarded.
+     */
+    confirm(pending: PendingUpload): Promise<StoredFile>;
+    /**
+     * Moves the staged file to its key as the last step of the unit of work in progress, so that
+     * the commit and the file land together: a promotion that fails rolls the command back, and a
+     * transaction that rolls back after it returns the file to `staging/`. At once outside of any.
+     */
+    promoteOnCommit(key: string): Promise<void>;
+    /** Moves the staged file to its key. Promoting twice is not an error; a key staged nowhere and stored nowhere is `FILE_NOT_FOUND`. */
+    promote(key: string): Promise<void>;
+    /** Deletes a stored file once the unit of work in progress has committed, the one its aggregate no longer references; a failure is reported. */
+    deleteAfterCommit(key: string): Promise<void>;
+    /** Removes a staged file, one a command will not record. */
+    discard(key: string): Promise<void>;
+    /**
+     * Removes the staged files older than the instant; answers how many. Each is an orphan: no
+     * committed row points into `staging/`, since a promotion lands with its commit.
+     */
+    purge(olderThan: Date): Promise<number>;
+    /** A transaction rolled back after the promotion: the file goes back where the purge finds it; a failure is reported. */
+    private returnToStaging;
+    private scanned;
+}
+//# sourceMappingURL=file-staging.d.ts.map

package/dist/infrastructure/files/file-staging.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-staging.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/files/file-staging.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAEzF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wCAAwC,CAAC;AAEzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAC/E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gDAAgD,CAAC;AACxF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wCAAwC,CAAC;AAEzE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+CAA+C,CAAC;AACtF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAC/E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yCAAyC,CAAC;AAC3E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yCAAyC,CAAC;AAK3E;;;;;;;;GAQG;AACH,qBAAa,WAAW;IAMpB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAH3B,YACmB,OAAO,EAAE,WAAW,EACpB,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,aAAa,EACtC;IAEJ,0HAA0H;IACpH,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAItF;IAED;;;OAGG;IACG,SAAS,CACb,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAAC,kBAAkB,EAAE,UAAU,CAAC,GAC/D,OAAO,CAAC,iBAAiB,CAAC,CAU5B;IAED;;;;OAIG;IACG,OAAO,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,UAAU,CAAC,CAqBzD;IAED;;;;OAIG;IACH,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1C;IAED,sIAAsI;IAChI,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAUxC;IAED,gJAAgJ;IAChJ,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAM5C;IAED,4DAA4D;IAC5D,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAElC;IAED;;;OAGG;IACG,KAAK,CAAC,SAAS,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAW5C;IAED,yHAAyH;YAC3G,eAAe;YAUf,OAAO;CAkBtB"}

package/dist/infrastructure/files/file-staging.js

@@ -0,0 +1,142 @@
+import { Writable } from 'node:stream';
+import { pipeline } from 'node:stream/promises';
+import { errorReportOf } from '../../application/error-reporting/error-report-of.js';
+import { reportOnce } from '../../application/error-reporting/report-once.js';
+import { assertFinalKey } from '../../application/files/assert-final-key.js';
+import { FileError } from '../../application/files/file-error.js';
+import { mediaTypeOf } from '../../application/files/media-type-of.js';
+import { STAGING_PREFIX, stagedKeyOf } from '../../application/files/staged-key-of.js';
+import { afterCommit } from '../domain-events/after-commit.js';
+import { atCommit } from '../domain-events/at-commit.js';
+import { FileInspection } from './file-inspection.js';
+/**
+ * Keeps the storage consistent with the database, which a write to the storage cannot join in a
+ * transaction. A file is staged first (under `staging/`, scanned, where nothing reads), before
+ * the unit of work opens when it comes from a client. The handler records its reference, under
+ * its final key, in the aggregate it saves, and asks for `promoteOnCommit`: the file moves to its
+ * key as the last step of the transaction, and back to `staging/` if the transaction rolls back.
+ * So a committed row never points into `staging/`, and every staged file is an orphan (a refused
+ * command, a rollback, an upload never confirmed) that `purge` removes on a schedule.
+ */
+export class FileStaging {
+    storage;
+    scanner;
+    reporter;
+    static {
+        Object.defineProperty(this, 'tokenKey', { value: 'kernel.FileStaging' });
+    }
+    constructor(storage, scanner, reporter) {
+        this.storage = storage;
+        this.scanner = scanner;
+        this.reporter = reporter;
+    }
+    /** Writes the content under the staged key, then has it scanned; a refused file is removed and `FILE_REJECTED` thrown. */
+    async stage(key, content, options) {
+        const staged = await this.storage.put(stagedKeyOf(assertFinalKey(key)), content, options);
+        return this.scanned({ ...staged, key });
+    }
+    /**
+     * A request the client sends the file with, straight to the staged key, and the grant to keep
+     * on the server (on the aggregate that awaits the file) for `confirm` to read back.
+     */
+    async uploadUrl(key, options) {
+        const { expiresInSeconds, mediaType, maxBytes, accepted } = options;
+        const link = await this.storage.signedUploadUrl(stagedKeyOf(assertFinalKey(key)), {
+            expiresInSeconds,
+            mediaType,
+            maxBytes,
+        });
+        return { link, pending: { key, mediaType: mediaTypeOf(mediaType), accepted, maxBytes } };
+    }
+    /**
+     * Reads a file uploaded straight to the staged key of a grant the server kept: its size against
+     * the cap of the grant, its media type on its bytes, its checksum, the scan. A file that fails
+     * is discarded.
+     */
+    async confirm(pending) {
+        const { key, maxBytes, mediaType, accepted } = pending;
+        const content = await this.storage.get(stagedKeyOf(assertFinalKey(key)));
+        if (content === undefined) {
+            throw FileError.notFound(key);
+        }
+        const inspection = new FileInspection({ maxBytes, expected: { mediaType, accepted } });
+        await pipeline(content.stream, inspection, sink()).catch(async (error) => {
+            await this.discard(key);
+            throw error;
+        });
+        return this.scanned({
+            key,
+            size: inspection.size,
+            mediaType: mediaTypeOf(mediaType),
+            checksum: inspection.checksum,
+        });
+    }
+    /**
+     * Moves the staged file to its key as the last step of the unit of work in progress, so that
+     * the commit and the file land together: a promotion that fails rolls the command back, and a
+     * transaction that rolls back after it returns the file to `staging/`. At once outside of any.
+     */
+    promoteOnCommit(key) {
+        return atCommit({ apply: () => this.promote(key), undo: () => this.returnToStaging(key) });
+    }
+    /** Moves the staged file to its key. Promoting twice is not an error; a key staged nowhere and stored nowhere is `FILE_NOT_FOUND`. */
+    async promote(key) {
+        if ((await this.storage.stat(stagedKeyOf(assertFinalKey(key)))) !== undefined) {
+            await this.storage.move(stagedKeyOf(key), key);
+            return;
+        }
+        if ((await this.storage.stat(key)) === undefined) {
+            throw FileError.notFound(key);
+        }
+    }
+    /** Deletes a stored file once the unit of work in progress has committed, the one its aggregate no longer references; a failure is reported. */
+    deleteAfterCommit(key) {
+        return afterCommit(async () => {
+            await this.storage.delete(key).catch((error) => {
+                reportOnce(this.reporter, error, errorReportOf(error, { origin: 'process', operation: 'delete stored file' }));
+            });
+        });
+    }
+    /** Removes a staged file, one a command will not record. */
+    discard(key) {
+        return this.storage.delete(stagedKeyOf(key));
+    }
+    /**
+     * Removes the staged files older than the instant; answers how many. Each is an orphan: no
+     * committed row points into `staging/`, since a promotion lands with its commit.
+     */
+    async purge(olderThan) {
+        let purged = 0;
+        for await (const file of this.storage.list(STAGING_PREFIX)) {
+            if (file.lastModified < olderThan) {
+                await this.storage.delete(file.key);
+                purged += 1;
+            }
+        }
+        return purged;
+    }
+    /** A transaction rolled back after the promotion: the file goes back where the purge finds it; a failure is reported. */
+    async returnToStaging(key) {
+        await this.storage.move(key, stagedKeyOf(key)).catch((error) => {
+            reportOnce(this.reporter, error, errorReportOf(error, { origin: 'process', operation: 'return file to staging' }));
+        });
+    }
+    async scanned(file) {
+        const verdict = await this.scanner.scan(file, async () => {
+            const content = await this.storage.get(stagedKeyOf(file.key));
+            if (content === undefined) {
+                throw FileError.notFound(file.key);
+            }
+            return content.stream;
+        });
+        if (!verdict.accepted) {
+            await this.discard(file.key);
+            throw FileError.rejected(file.key, verdict.reason);
+        }
+        return file;
+    }
+}
+function sink() {
+    return new Writable({ write: (_chunk, _encoding, done) => done() });
+}
+//# sourceMappingURL=file-staging.js.map

package/dist/infrastructure/files/file-staging.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-staging.js","sourceRoot":"","sources":["../../../src/infrastructure/files/file-staging.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,sDAAsD,CAAC;AACrF,OAAO,EAAE,UAAU,EAAE,MAAM,kDAAkD,CAAC;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,6CAA6C,CAAC;AAE7E,OAAO,EAAE,SAAS,EAAE,MAAM,uCAAuC,CAAC;AAElE,OAAO,EAAE,WAAW,EAAE,MAAM,0CAA0C,CAAC;AAIvE,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,0CAA0C,CAAC;AAMvF,OAAO,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAC/D,OAAO,EAAE,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD;;;;;;;;GAQG;AACH,MAAM,OAAO,WAAW;IAMH,OAAO;IACP,OAAO;IACP,QAAQ;IAP3B;QACE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,YACmB,OAAoB,EACpB,OAAoB,EACpB,QAAuB;uBAFvB,OAAO;uBACP,OAAO;wBACP,QAAQ;IACxB,CAAC;IAEJ,0HAA0H;IAC1H,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,OAAmB,EAAE,OAAmB;QAC/D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QAE1F,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,SAAS,CACb,GAAW,EACX,OAAgE;QAEhE,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;QAEpE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,WAAW,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,EAAE;YAChF,gBAAgB;YAChB,SAAS;YACT,QAAQ;SACT,CAAC,CAAC;QAEH,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC;IAC3F,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO,CAAC,OAAsB;QAClC,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;QACvD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAEzE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAChC,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,cAAc,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QAEvF,MAAM,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;YAChF,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACxB,MAAM,KAAK,CAAC;QACd,CAAC,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,OAAO,CAAC;YAClB,GAAG;YACH,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,SAAS,EAAE,WAAW,CAAC,SAAS,CAAC;YACjC,QAAQ,EAAE,UAAU,CAAC,QAAQ;SAC9B,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,eAAe,CAAC,GAAW;QACzB,OAAO,QAAQ,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC7F,CAAC;IAED,sIAAsI;IACtI,KAAK,CAAC,OAAO,CAAC,GAAW;QACvB,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;YAC9E,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;YAE/C,OAAO;QACT,CAAC;QAED,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;YACjD,MAAM,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAED,gJAAgJ;IAChJ,iBAAiB,CAAC,GAAW;QAC3B,OAAO,WAAW,CAAC,KAAK,IAAI,EAAE;YAC5B,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBACtD,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC;YACjH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,4DAA4D;IAC5D,OAAO,CAAC,GAAW;QACjB,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,KAAK,CAAC,SAAe;QACzB,IAAI,MAAM,GAAG,CAAC,CAAC;QAEf,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;YAC3D,IAAI,IAAI,CAAC,YAAY,GAAG,SAAS,EAAE,CAAC;gBAClC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACpC,MAAM,IAAI,CAAC,CAAC;YACd,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,yHAAyH;IACjH,KAAK,CAAC,eAAe,CAAC,GAAW;QACvC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACtE,UAAU,CACR,IAAI,CAAC,QAAQ,EACb,KAAK,EACL,aAAa,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,wBAAwB,EAAE,CAAC,CACjF,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,IAAgB;QACpC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE;YACvD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAE9D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACrC,CAAC;YAED,OAAO,OAAO,CAAC,MAAM,CAAC;QACxB,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC7B,MAAM,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACrD,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,SAAS,IAAI;IACX,OAAO,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AACtE,CAAC"}

package/dist/infrastructure/files/file-uploads-middleware.d.ts

@@ -0,0 +1,11 @@
+import type { BusMiddleware } from '../../application/messaging/bus-middleware.js';
+import type { UploadDesk } from './upload-desk.js';
+/**
+ * Stages the `FileUpload` fields of a command, each under a new key of its area, scanned, then
+ * hands over to the next middleware. Installed after the permission check, so a refused actor
+ * stores nothing, and before the unit of work (and the audit entry that opens it), so that no
+ * transaction waits while a client uploads. `desk` is resolved only for a command that carries
+ * a file: building the bus opens nothing.
+ */
+export declare function fileUploadsMiddleware(desk: () => UploadDesk): BusMiddleware;
+//# sourceMappingURL=file-uploads-middleware.d.ts.map

package/dist/infrastructure/files/file-uploads-middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-uploads-middleware.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/files/file-uploads-middleware.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+CAA+C,CAAC;AAEnF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,UAAU,GAAG,aAAa,CAgB3E"}

package/dist/infrastructure/files/file-uploads-middleware.js

@@ -0,0 +1,25 @@
+import { FileUpload } from '../../application/files/file-upload.js';
+/**
+ * Stages the `FileUpload` fields of a command, each under a new key of its area, scanned, then
+ * hands over to the next middleware. Installed after the permission check, so a refused actor
+ * stores nothing, and before the unit of work (and the audit entry that opens it), so that no
+ * transaction waits while a client uploads. `desk` is resolved only for a command that carries
+ * a file: building the bus opens nothing.
+ */
+export function fileUploadsMiddleware(desk) {
+    return async (message, next, info) => {
+        const uploads = info.kind === 'command' ? waitingUploadsOf(message) : [];
+        if (uploads.length > 0) {
+            const { keys, staging } = desk();
+            for (const upload of uploads) {
+                const { stream, mediaType } = upload.received;
+                upload.stagedAs(await staging.stage(keys.next(upload.area), stream, { mediaType }));
+            }
+        }
+        return next();
+    };
+}
+function waitingUploadsOf(message) {
+    return Object.values(message).filter((value) => value instanceof FileUpload && !value.isStaged);
+}
+//# sourceMappingURL=file-uploads-middleware.js.map

package/dist/infrastructure/files/file-uploads-middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-uploads-middleware.js","sourceRoot":"","sources":["../../../src/infrastructure/files/file-uploads-middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,wCAAwC,CAAC;AAKpE;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAsB;IAC1D,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAEzE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;YAEjC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;gBAE9C,MAAM,CAAC,QAAQ,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;YACtF,CAAC;QACH,CAAC;QAED,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAgB;IACxC,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAuB,EAAE,CAAC,KAAK,YAAY,UAAU,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;AACvH,CAAC"}

package/dist/infrastructure/files/in-memory-file-storage.d.ts

@@ -0,0 +1,25 @@
+import type { FileContent } from '../../application/files/file-content.js';
+import type { FileMetadata } from '../../application/files/file-metadata.js';
+import type { FileSource } from '../../application/files/file-source.js';
+import type { ListedFile } from '../../application/files/listed-file.js';
+import type { PutOptions } from '../../application/files/put-options.js';
+import type { StoredFile } from '../../application/files/stored-file.js';
+import type { SignedLinkOptions } from './signed-link-options.js';
+import { SelfSignedFileStorage } from './self-signed-file-storage.js';
+/** The storage of the tests: files in a map, the same contract as every connector, links served by the application. */
+export declare class InMemoryFileStorage extends SelfSignedFileStorage {
+    private readonly files;
+    private readonly clock;
+    constructor(options?: SignedLinkOptions);
+    /** The keys held, sorted: what a test asserts about the storage, for instance that a rollback left none. */
+    keys(): readonly string[];
+    put(key: string, content: FileSource, options: PutOptions): Promise<StoredFile>;
+    get(key: string): Promise<FileContent | undefined>;
+    stat(key: string): Promise<FileMetadata | undefined>;
+    delete(key: string): Promise<void>;
+    copy(from: string, to: string): Promise<void>;
+    move(from: string, to: string): Promise<void>;
+    list(prefix: string): AsyncIterable<ListedFile>;
+    private held;
+}
+//# sourceMappingURL=in-memory-file-storage.d.ts.map

package/dist/infrastructure/files/in-memory-file-storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"in-memory-file-storage.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/files/in-memory-file-storage.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yCAAyC,CAAC;AAG3E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wCAAwC,CAAC;AAEzE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wCAAwC,CAAC;AAKzE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAOtE,uHAAuH;AACvH,qBAAa,mBAAoB,SAAQ,qBAAqB;IAC5D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA2B;IAEjD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAE9B,YAAY,OAAO,GAAE,iBAAsB,EAG1C;IAED,4GAA4G;IAC5G,IAAI,IAAI,SAAS,MAAM,EAAE,CAExB;IAEK,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAgBpF;IAED,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAMjD;IAED,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAEnD;IAED,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAIjC;IAED,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS5C;IAEK,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAMlD;IAEM,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,CAAC,UAAU,CAAC,CAIrD;IAED,OAAO,CAAC,IAAI;CASb"}

package/dist/infrastructure/files/in-memory-file-storage.js

@@ -0,0 +1,73 @@
+import { Readable } from 'node:stream';
+import { pipeline } from 'node:stream/promises';
+import { FileError } from '../../application/files/file-error.js';
+import { assertFileKey } from '../../application/files/assert-file-key.js';
+import { mediaTypeOf } from '../../application/files/media-type-of.js';
+import { SystemClock } from '../clock/system-clock.js';
+import { collect } from './collect.js';
+import { FileInspection } from './file-inspection.js';
+import { SelfSignedFileStorage } from './self-signed-file-storage.js';
+/** The storage of the tests: files in a map, the same contract as every connector, links served by the application. */
+export class InMemoryFileStorage extends SelfSignedFileStorage {
+    files = new Map();
+    clock;
+    constructor(options = {}) {
+        super(options);
+        this.clock = options.clock ?? new SystemClock();
+    }
+    /** The keys held, sorted: what a test asserts about the storage, for instance that a rollback left none. */
+    keys() {
+        return [...this.files.keys()].sort();
+    }
+    async put(key, content, options) {
+        assertFileKey(key);
+        const inspection = new FileInspection(options.maxBytes === undefined ? {} : { maxBytes: options.maxBytes });
+        const chunks = [];
+        await pipeline(content, inspection, collect(chunks));
+        const { size, checksum } = inspection;
+        const mediaType = mediaTypeOf(options.mediaType);
+        this.files.set(key, {
+            bytes: Buffer.concat(chunks),
+            metadata: { key, size, mediaType, checksum, lastModified: this.clock.now() },
+        });
+        return { key, size, mediaType, checksum };
+    }
+    get(key) {
+        const held = this.files.get(assertFileKey(key));
+        return Promise.resolve(held === undefined ? undefined : { metadata: held.metadata, stream: Readable.from([held.bytes]) });
+    }
+    stat(key) {
+        return Promise.resolve(this.files.get(assertFileKey(key))?.metadata);
+    }
+    delete(key) {
+        this.files.delete(assertFileKey(key));
+        return Promise.resolve();
+    }
+    copy(from, to) {
+        const held = this.held(from);
+        this.files.set(assertFileKey(to), {
+            bytes: held.bytes,
+            metadata: { ...held.metadata, key: to, lastModified: this.clock.now() },
+        });
+        return Promise.resolve();
+    }
+    async move(from, to) {
+        await this.copy(from, to);
+        if (from !== to) {
+            this.files.delete(from);
+        }
+    }
+    async *list(prefix) {
+        for (const { metadata } of [...this.files.values()].filter((held) => held.metadata.key.startsWith(prefix))) {
+            yield { key: metadata.key, size: metadata.size, lastModified: metadata.lastModified };
+        }
+    }
+    held(key) {
+        const held = this.files.get(assertFileKey(key));
+        if (held === undefined) {
+            throw FileError.notFound(key);
+        }
+        return held;
+    }
+}
+//# sourceMappingURL=in-memory-file-storage.js.map

package/dist/infrastructure/files/in-memory-file-storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"in-memory-file-storage.js","sourceRoot":"","sources":["../../../src/infrastructure/files/in-memory-file-storage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAEhD,OAAO,EAAE,SAAS,EAAE,MAAM,uCAAuC,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,4CAA4C,CAAC;AAI3E,OAAO,EAAE,WAAW,EAAE,MAAM,0CAA0C,CAAC;AAIvE,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAOtE,uHAAuH;AACvH,MAAM,OAAO,mBAAoB,SAAQ,qBAAqB;IAC3C,KAAK,GAAG,IAAI,GAAG,EAAgB,CAAC;IAEhC,KAAK,CAAQ;IAE9B,YAAY,OAAO,GAAsB,EAAE;QACzC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,WAAW,EAAE,CAAC;IAClD,CAAC;IAED,4GAA4G;IAC5G,IAAI;QACF,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,OAAmB,EAAE,OAAmB;QAC7D,aAAa,CAAC,GAAG,CAAC,CAAC;QACnB,MAAM,UAAU,GAAG,IAAI,cAAc,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC5G,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,MAAM,QAAQ,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QAErD,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,UAAU,CAAC;QACtC,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAEjD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE;YAClB,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;YAC5B,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE;SAC7E,CAAC,CAAC;QAEH,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;IAC5C,CAAC;IAED,GAAG,CAAC,GAAW;QACb,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;QAEhD,OAAO,OAAO,CAAC,OAAO,CACpB,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAClG,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,GAAW;QACd,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,CAAC,GAAW;QAChB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;QAEtC,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED,IAAI,CAAC,IAAY,EAAE,EAAU;QAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAE7B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE;YAChC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE;SACxE,CAAC,CAAC;QAEH,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAY,EAAE,EAAU;QACjC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAE1B,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;YAChB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,KAAK,CAAC,CAAC,IAAI,CAAC,MAAc;QACxB,KAAK,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAC3G,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC;QACxF,CAAC;IACH,CAAC;IAEO,IAAI,CAAC,GAAW;QACtB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;QAEhD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAChC,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/infrastructure/files/is-file-grant.d.ts

@@ -0,0 +1,3 @@
+import type { FileGrant } from './file-grant.js';
+export declare function isFileGrant(value: unknown): value is FileGrant;
+//# sourceMappingURL=is-file-grant.d.ts.map

package/dist/infrastructure/files/is-file-grant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"is-file-grant.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/files/is-file-grant.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,SAAS,CAe9D"}

package/dist/infrastructure/files/is-file-grant.js

@@ -0,0 +1,16 @@
+export function isFileGrant(value) {
+    if (typeof value !== 'object' || value === null) {
+        return false;
+    }
+    const grant = value;
+    return ((grant.action === 'download' || grant.action === 'upload') &&
+        typeof grant.key === 'string' &&
+        typeof grant.expiresAt === 'number' &&
+        optionalString(grant.fileName) &&
+        optionalString(grant.mediaType) &&
+        (grant.maxBytes === undefined || typeof grant.maxBytes === 'number'));
+}
+function optionalString(value) {
+    return value === undefined || typeof value === 'string';
+}
+//# sourceMappingURL=is-file-grant.js.map

package/dist/infrastructure/files/is-file-grant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"is-file-grant.js","sourceRoot":"","sources":["../../../src/infrastructure/files/is-file-grant.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,KAAK,GAA8C,KAAK,CAAC;IAE/D,OAAO,CACL,CAAC,KAAK,CAAC,MAAM,KAAK,UAAU,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC;QAC1D,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ;QAC7B,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QACnC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC9B,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC;QAC/B,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CACrE,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC;AAC1D,CAAC"}

package/dist/infrastructure/files/is-stored-metadata.d.ts

@@ -0,0 +1,3 @@
+import type { StoredMetadata } from './stored-metadata.js';
+export declare function isStoredMetadata(value: unknown): value is StoredMetadata;
+//# sourceMappingURL=is-stored-metadata.d.ts.map

package/dist/infrastructure/files/is-stored-metadata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"is-stored-metadata.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/files/is-stored-metadata.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,cAAc,CAQxE"}

package/dist/infrastructure/files/is-stored-metadata.js

@@ -0,0 +1,8 @@
+export function isStoredMetadata(value) {
+    if (typeof value !== 'object' || value === null) {
+        return false;
+    }
+    const metadata = value;
+    return typeof metadata.mediaType === 'string' && typeof metadata.checksum === 'string';
+}
+//# sourceMappingURL=is-stored-metadata.js.map

package/dist/infrastructure/files/is-stored-metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"is-stored-metadata.js","sourceRoot":"","sources":["../../../src/infrastructure/files/is-stored-metadata.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,QAAQ,GAAmD,KAAK,CAAC;IAEvE,OAAO,OAAO,QAAQ,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC;AACzF,CAAC"}

package/dist/infrastructure/files/local-file-storage-options.d.ts

@@ -0,0 +1,6 @@
+import type { SignedLinkOptions } from './signed-link-options.js';
+export interface LocalFileStorageOptions extends SignedLinkOptions {
+    /** The directory that holds the files, created when missing. Keep it out of version control. */
+    readonly directory: string;
+}
+//# sourceMappingURL=local-file-storage-options.d.ts.map

package/dist/infrastructure/files/local-file-storage-options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-file-storage-options.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/files/local-file-storage-options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAElE,MAAM,WAAW,uBAAwB,SAAQ,iBAAiB;IAChE,gGAAgG;IAChG,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B"}

package/dist/infrastructure/files/local-file-storage-options.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=local-file-storage-options.js.map

package/dist/infrastructure/files/local-file-storage-options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-file-storage-options.js","sourceRoot":"","sources":["../../../src/infrastructure/files/local-file-storage-options.ts"],"names":[],"mappings":""}

package/dist/infrastructure/files/local-file-storage.d.ts

@@ -0,0 +1,29 @@
+import type { FileContent } from '../../application/files/file-content.js';
+import type { FileMetadata } from '../../application/files/file-metadata.js';
+import type { FileSource } from '../../application/files/file-source.js';
+import type { ListedFile } from '../../application/files/listed-file.js';
+import type { PutOptions } from '../../application/files/put-options.js';
+import type { StoredFile } from '../../application/files/stored-file.js';
+import type { LocalFileStorageOptions } from './local-file-storage-options.js';
+import { SelfSignedFileStorage } from './self-signed-file-storage.js';
+/**
+ * The storage of development: a directory, each file under its key and what the file system does
+ * not know beside it in `.metadata/`. A write goes to `.incoming/` first and is renamed into place,
+ * so a failed or refused write leaves nothing under its key. One machine only: in a deployment
+ * with several instances, use an object store.
+ */
+export declare class LocalFileStorage extends SelfSignedFileStorage {
+    private readonly paths;
+    constructor(options: LocalFileStorageOptions);
+    put(key: string, content: FileSource, options: PutOptions): Promise<StoredFile>;
+    get(key: string): Promise<FileContent | undefined>;
+    stat(key: string): Promise<FileMetadata | undefined>;
+    delete(key: string): Promise<void>;
+    copy(from: string, to: string): Promise<void>;
+    move(from: string, to: string): Promise<void>;
+    list(prefix: string): AsyncIterable<ListedFile>;
+    private existing;
+    private readMetadata;
+    private writeMetadata;
+}
+//# sourceMappingURL=local-file-storage.d.ts.map

package/dist/infrastructure/files/local-file-storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-file-storage.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/files/local-file-storage.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yCAAyC,CAAC;AAE3E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wCAAwC,CAAC;AAEzE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wCAAwC,CAAC;AAEzE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAI/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAEtE;;;;;GAKG;AACH,qBAAa,gBAAiB,SAAQ,qBAAqB;IACzD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAa;IAEnC,YAAY,OAAO,EAAE,uBAAuB,EAG3C;IAEK,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAuBpF;IAEK,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAIvD;IAEK,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAUzD;IAEK,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAGvC;IAEK,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKlD;IAEK,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQlD;IAEM,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,CAAC,UAAU,CAAC,CAYrD;YAEa,QAAQ;YAMR,YAAY;YAOZ,aAAa;CAO5B"}