@ddd-ts-kit/kernel 0.8.0 → 0.9.0

package/dist/infrastructure/files/local-paths.js

@@ -0,0 +1,33 @@
+import { randomUUID } from 'node:crypto';
+import path from 'node:path';
+import { assertFileKey } from '../../application/files/assert-file-key.js';
+/** Where the local storage puts a key: its content, its metadata, and a private place for a write in progress. */
+export class LocalPaths {
+    root;
+    constructor(directory) {
+        this.root = path.resolve(directory);
+    }
+    contentOf(key) {
+        return this.inside(assertFileKey(key).split('/'));
+    }
+    metadataOf(key) {
+        return this.inside(['.metadata', ...assertFileKey(key).split('/')]) + '.json';
+    }
+    incoming() {
+        return this.inside(['.incoming', randomUUID()]);
+    }
+    /** The key of a file found under the root, or `undefined` for what the storage keeps for itself. */
+    keyOf(file) {
+        const segments = path.relative(this.root, file).split(path.sep);
+        return segments.some((segment) => segment.startsWith('.') || segment === '') ? undefined : segments.join('/');
+    }
+    inside(segments) {
+        const resolved = path.resolve(this.root, ...segments);
+        // A valid key cannot climb out; this holds the promise even if the key rules change one day.
+        if (!resolved.startsWith(this.root + path.sep)) {
+            throw new Error('A file key resolved outside the directory of the storage.');
+        }
+        return resolved;
+    }
+}
+//# sourceMappingURL=local-paths.js.map

package/dist/infrastructure/files/local-paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-paths.js","sourceRoot":"","sources":["../../../src/infrastructure/files/local-paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,4CAA4C,CAAC;AAE3E,kHAAkH;AAClH,MAAM,OAAO,UAAU;IACZ,IAAI,CAAS;IAEtB,YAAY,SAAiB;QAC3B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;IAED,SAAS,CAAC,GAAW;QACnB,OAAO,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IACpD,CAAC;IAED,UAAU,CAAC,GAAW;QACpB,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC;IAChF,CAAC;IAED,QAAQ;QACN,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,oGAAoG;IACpG,KAAK,CAAC,IAAY;QAChB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEhE,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChH,CAAC;IAEO,MAAM,CAAC,QAA2B;QACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,QAAQ,CAAC,CAAC;QAEtD,6FAA6F;QAC7F,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC/E,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}

package/dist/infrastructure/files/purge-staged-files.d.ts

@@ -0,0 +1,16 @@
+import type { Clock } from '../../application/ports/clock.js';
+import type { ScheduledJob } from '../../application/scheduling/scheduled-job.js';
+import type { FileStaging } from './file-staging.js';
+/**
+ * The scheduled job of the platform that removes what rolled-back or crashed commands left in
+ * `staging/`: the files staged more than `olderThanMs` ago (a day by default). Registered under
+ * `files.purge-staged`, every hour, by the platform of a project that keeps files.
+ */
+export declare class PurgeStagedFiles implements ScheduledJob {
+    private readonly staging;
+    private readonly clock;
+    private readonly olderThanMs;
+    constructor(staging: FileStaging, clock: Clock, olderThanMs?: number);
+    run(): Promise<void>;
+}
+//# sourceMappingURL=purge-staged-files.d.ts.map

package/dist/infrastructure/files/purge-staged-files.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"purge-staged-files.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/files/purge-staged-files.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kCAAkC,CAAC;AAC9D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+CAA+C,CAAC;AAClF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAKrD;;;;GAIG;AACH,qBAAa,gBAAiB,YAAW,YAAY;IAEjD,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAH9B,YACmB,OAAO,EAAE,WAAW,EACpB,KAAK,EAAE,KAAK,EACZ,WAAW,GAAE,MAAiB,EAC7C;IAEE,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,CAEzB;CACF"}

package/dist/infrastructure/files/purge-staged-files.js

@@ -0,0 +1,21 @@
+/** A day: a command that staged a file has long committed or rolled back. */
+const A_DAY_MS = 86_400_000;
+/**
+ * The scheduled job of the platform that removes what rolled-back or crashed commands left in
+ * `staging/`: the files staged more than `olderThanMs` ago (a day by default). Registered under
+ * `files.purge-staged`, every hour, by the platform of a project that keeps files.
+ */
+export class PurgeStagedFiles {
+    staging;
+    clock;
+    olderThanMs;
+    constructor(staging, clock, olderThanMs = A_DAY_MS) {
+        this.staging = staging;
+        this.clock = clock;
+        this.olderThanMs = olderThanMs;
+    }
+    async run() {
+        await this.staging.purge(new Date(this.clock.now().getTime() - this.olderThanMs));
+    }
+}
+//# sourceMappingURL=purge-staged-files.js.map

package/dist/infrastructure/files/purge-staged-files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"purge-staged-files.js","sourceRoot":"","sources":["../../../src/infrastructure/files/purge-staged-files.ts"],"names":[],"mappings":"AAIA,6EAA6E;AAC7E,MAAM,QAAQ,GAAG,UAAU,CAAC;AAE5B;;;;GAIG;AACH,MAAM,OAAO,gBAAgB;IAER,OAAO;IACP,KAAK;IACL,WAAW;IAH9B,YACmB,OAAoB,EACpB,KAAY,EACZ,WAAW,GAAW,QAAQ;uBAF9B,OAAO;qBACP,KAAK;2BACL,WAAW;IAC3B,CAAC;IAEJ,KAAK,CAAC,GAAG;QACP,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IACpF,CAAC;CACF"}

package/dist/infrastructure/files/self-signed-file-storage.d.ts

@@ -0,0 +1,23 @@
+import type { DownloadUrlOptions } from '../../application/files/download-url-options.js';
+import type { FileSource } from '../../application/files/file-source.js';
+import type { SignedDownload } from '../../application/files/signed-download.js';
+import type { SignedUpload } from '../../application/files/signed-upload.js';
+import type { SignedUrl } from '../../application/files/signed-url.js';
+import type { StoredFile } from '../../application/files/stored-file.js';
+import type { UploadUrlOptions } from '../../application/files/upload-url-options.js';
+import { ServedFileStorage } from '../../application/ports/served-file-storage.js';
+import type { SignedLinkOptions } from './signed-link-options.js';
+/** The signed links of the storages the application serves itself: one token per link, under `baseUrl`. */
+export declare abstract class SelfSignedFileStorage extends ServedFileStorage {
+    private readonly tokens;
+    private readonly baseUrl;
+    protected constructor(options: SignedLinkOptions);
+    signedDownloadUrl(key: string, options: DownloadUrlOptions): Promise<SignedUrl>;
+    signedUploadUrl(key: string, options: UploadUrlOptions): Promise<SignedUpload>;
+    openSigned(token: string): Promise<SignedDownload | undefined>;
+    /** Stores what a signed upload link sends, refused beyond the size the link was signed for (`FILE_TOO_LARGE`). */
+    acceptSigned(token: string, content: FileSource, mediaType: string): Promise<StoredFile | undefined>;
+    /** The token travels in the query, where no router limits its length the way it limits a path parameter. */
+    private linkOf;
+}
+//# sourceMappingURL=self-signed-file-storage.d.ts.map

package/dist/infrastructure/files/self-signed-file-storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"self-signed-file-storage.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/files/self-signed-file-storage.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iDAAiD,CAAC;AAE1F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wCAAwC,CAAC;AAEzE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4CAA4C,CAAC;AACjF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uCAAuC,CAAC;AACvE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+CAA+C,CAAC;AACtF,OAAO,EAAE,iBAAiB,EAAE,MAAM,gDAAgD,CAAC;AAEnF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAIlE,2GAA2G;AAC3G,8BAAsB,qBAAsB,SAAQ,iBAAiB;IACnE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmB;IAE1C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IAEjC,SAAS,aAAa,OAAO,EAAE,iBAAiB,EAS/C;IAED,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,SAAS,CAAC,CAM9E;IAED,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,YAAY,CAAC,CAW7E;IAEK,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CASnE;IAED,kHAAkH;IAC5G,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAUzG;IAED,4GAA4G;IAC5G,OAAO,CAAC,MAAM;CAGf"}

package/dist/infrastructure/files/self-signed-file-storage.js

@@ -0,0 +1,57 @@
+import { randomBytes } from 'node:crypto';
+import { assertExpiry } from '../../application/files/assert-expiry.js';
+import { assertFileKey } from '../../application/files/assert-file-key.js';
+import { mediaTypeOf } from '../../application/files/media-type-of.js';
+import { ServedFileStorage } from '../../application/ports/served-file-storage.js';
+import { SystemClock } from '../clock/system-clock.js';
+import { SignedFileTokens } from './signed-file-tokens.js';
+import { withoutTrailingSlashes } from './without-trailing-slashes.js';
+/** The signed links of the storages the application serves itself: one token per link, under `baseUrl`. */
+export class SelfSignedFileStorage extends ServedFileStorage {
+    tokens;
+    baseUrl;
+    constructor(options) {
+        super();
+        this.tokens = new SignedFileTokens(options.secret ?? randomBytes(32).toString('hex'), options.clock ?? new SystemClock());
+        this.baseUrl = withoutTrailingSlashes(options.baseUrl ?? 'http://localhost:3000/files');
+    }
+    signedDownloadUrl(key, options) {
+        const grant = { action: 'download', key: assertFileKey(key) };
+        const named = options.fileName === undefined ? grant : { ...grant, fileName: options.fileName };
+        const { token, expiresAt } = this.tokens.sign(named, assertExpiry(options.expiresInSeconds));
+        return Promise.resolve({ url: this.linkOf(token), expiresAt });
+    }
+    signedUploadUrl(key, options) {
+        const mediaType = mediaTypeOf(options.mediaType);
+        const grant = { action: 'upload', key: assertFileKey(key), mediaType, maxBytes: options.maxBytes };
+        const { token, expiresAt } = this.tokens.sign(grant, assertExpiry(options.expiresInSeconds));
+        return Promise.resolve({
+            url: this.linkOf(token),
+            method: 'PUT',
+            headers: { 'content-type': mediaType },
+            expiresAt,
+        });
+    }
+    async openSigned(token) {
+        const grant = this.tokens.verify(token, 'download');
+        const content = grant === undefined ? undefined : await this.get(grant.key);
+        if (grant?.fileName === undefined || content === undefined) {
+            return content;
+        }
+        return { ...content, fileName: grant.fileName };
+    }
+    /** Stores what a signed upload link sends, refused beyond the size the link was signed for (`FILE_TOO_LARGE`). */
+    async acceptSigned(token, content, mediaType) {
+        const grant = this.tokens.verify(token, 'upload');
+        if (grant?.mediaType === undefined || grant.mediaType !== mediaTypeOf(mediaType)) {
+            return undefined;
+        }
+        const { key, maxBytes } = grant;
+        return this.put(key, content, { mediaType: grant.mediaType, ...(maxBytes === undefined ? {} : { maxBytes }) });
+    }
+    /** The token travels in the query, where no router limits its length the way it limits a path parameter. */
+    linkOf(token) {
+        return `${this.baseUrl}?token=${token}`;
+    }
+}
+//# sourceMappingURL=self-signed-file-storage.js.map

package/dist/infrastructure/files/self-signed-file-storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"self-signed-file-storage.js","sourceRoot":"","sources":["../../../src/infrastructure/files/self-signed-file-storage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,0CAA0C,CAAC;AAExE,OAAO,EAAE,aAAa,EAAE,MAAM,4CAA4C,CAAC;AAE3E,OAAO,EAAE,WAAW,EAAE,MAAM,0CAA0C,CAAC;AAMvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gDAAgD,CAAC;AACnF,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAEvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAEvE,2GAA2G;AAC3G,MAAM,OAAgB,qBAAsB,SAAQ,iBAAiB;IAClD,MAAM,CAAmB;IAEzB,OAAO,CAAS;IAEjC,YAAsB,OAA0B;QAC9C,KAAK,EAAE,CAAC;QAER,IAAI,CAAC,MAAM,GAAG,IAAI,gBAAgB,CAChC,OAAO,CAAC,MAAM,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EACjD,OAAO,CAAC,KAAK,IAAI,IAAI,WAAW,EAAE,CACnC,CAAC;QAEF,IAAI,CAAC,OAAO,GAAG,sBAAsB,CAAC,OAAO,CAAC,OAAO,IAAI,6BAA6B,CAAC,CAAC;IAC1F,CAAC;IAED,iBAAiB,CAAC,GAAW,EAAE,OAA2B;QACxD,MAAM,KAAK,GAAG,EAAE,MAAM,EAAE,UAAmB,EAAE,GAAG,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;QACvE,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;QAChG,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAE7F,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;IACjE,CAAC;IAED,eAAe,CAAC,GAAW,EAAE,OAAyB;QACpD,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,EAAE,MAAM,EAAE,QAAiB,EAAE,GAAG,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC5G,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAE7F,OAAO,OAAO,CAAC,OAAO,CAAC;YACrB,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YACvB,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,cAAc,EAAE,SAAS,EAAE;YACtC,SAAS;SACV,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAAa;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAE5E,IAAI,KAAK,EAAE,QAAQ,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC3D,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,OAAO,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;IAClD,CAAC;IAED,kHAAkH;IAClH,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,OAAmB,EAAE,SAAiB;QACtE,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAElD,IAAI,KAAK,EAAE,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;YACjF,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;QAEhC,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;IACjH,CAAC;IAED,4GAA4G;IACpG,MAAM,CAAC,KAAa;QAC1B,OAAO,GAAG,IAAI,CAAC,OAAO,UAAU,KAAK,EAAE,CAAC;IAC1C,CAAC;CACF"}

package/dist/infrastructure/files/signed-file-tokens.d.ts

@@ -0,0 +1,20 @@
+import type { Clock } from '../../application/ports/clock.js';
+import type { FileGrant } from './file-grant.js';
+/**
+ * The tokens of the links a `ServedFileStorage` signs: the grant in base64url, a dot, and its
+ * HMAC-SHA256 under the secret. Whoever holds the token holds the grant until it expires; whoever
+ * changes a byte of it holds nothing.
+ */
+export declare class SignedFileTokens {
+    private readonly secret;
+    private readonly clock;
+    constructor(secret: string, clock: Clock);
+    sign(grant: Omit<FileGrant, 'expiresAt'>, expiresInSeconds: number): {
+        token: string;
+        expiresAt: Date;
+    };
+    /** The grant of a genuine, unexpired token for this action, or `undefined`. */
+    verify(token: string, action: FileGrant['action']): FileGrant | undefined;
+    private signatureOf;
+}
+//# sourceMappingURL=signed-file-tokens.d.ts.map

package/dist/infrastructure/files/signed-file-tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signed-file-tokens.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/files/signed-file-tokens.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kCAAkC,CAAC;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAGjD;;;;GAIG;AACH,qBAAa,gBAAgB;IAEzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,KAAK;IAFxB,YACmB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,KAAK,EAC3B;IAEJ,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,gBAAgB,EAAE,MAAM,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,IAAI,CAAA;KAAE,CAKtG;IAED,+EAA+E;IAC/E,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,QAAQ,CAAC,GAAG,SAAS,GAAG,SAAS,CAaxE;IAED,OAAO,CAAC,WAAW;CAGpB"}

package/dist/infrastructure/files/signed-file-tokens.js

@@ -0,0 +1,45 @@
+import { createHmac, timingSafeEqual } from 'node:crypto';
+import { isFileGrant } from './is-file-grant.js';
+/**
+ * The tokens of the links a `ServedFileStorage` signs: the grant in base64url, a dot, and its
+ * HMAC-SHA256 under the secret. Whoever holds the token holds the grant until it expires; whoever
+ * changes a byte of it holds nothing.
+ */
+export class SignedFileTokens {
+    secret;
+    clock;
+    constructor(secret, clock) {
+        this.secret = secret;
+        this.clock = clock;
+    }
+    sign(grant, expiresInSeconds) {
+        const expiresAt = Math.floor(this.clock.now().getTime() / 1_000) + expiresInSeconds;
+        const payload = Buffer.from(JSON.stringify({ ...grant, expiresAt })).toString('base64url');
+        return { token: `${payload}.${this.signatureOf(payload)}`, expiresAt: new Date(expiresAt * 1_000) };
+    }
+    /** The grant of a genuine, unexpired token for this action, or `undefined`. */
+    verify(token, action) {
+        const [payload = '', signature = ''] = token.split('.');
+        const expected = Buffer.from(this.signatureOf(payload));
+        const given = Buffer.from(signature);
+        if (expected.length !== given.length || !timingSafeEqual(expected, given)) {
+            return undefined;
+        }
+        const grant = parsed(payload);
+        const now = this.clock.now().getTime() / 1_000;
+        return grant?.action === action && grant.expiresAt > now ? grant : undefined;
+    }
+    signatureOf(payload) {
+        return createHmac('sha256', this.secret).update(payload).digest('base64url');
+    }
+}
+function parsed(payload) {
+    try {
+        const value = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8'));
+        return isFileGrant(value) ? value : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=signed-file-tokens.js.map

package/dist/infrastructure/files/signed-file-tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signed-file-tokens.js","sourceRoot":"","sources":["../../../src/infrastructure/files/signed-file-tokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAG1D,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEjD;;;;GAIG;AACH,MAAM,OAAO,gBAAgB;IAER,MAAM;IACN,KAAK;IAFxB,YACmB,MAAc,EACd,KAAY;sBADZ,MAAM;qBACN,KAAK;IACrB,CAAC;IAEJ,IAAI,CAAC,KAAmC,EAAE,gBAAwB;QAChE,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,GAAG,gBAAgB,CAAC;QACpF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAE3F,OAAO,EAAE,KAAK,EAAE,GAAG,OAAO,IAAI,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,EAAE,CAAC;IACtG,CAAC;IAED,+EAA+E;IAC/E,MAAM,CAAC,KAAa,EAAE,MAA2B;QAC/C,MAAM,CAAC,OAAO,GAAG,EAAE,EAAE,SAAS,GAAG,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;QACxD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAErC,IAAI,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;YAC1E,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC;QAE/C,OAAO,KAAK,EAAE,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/E,CAAC;IAEO,WAAW,CAAC,OAAe;QACjC,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC/E,CAAC;CACF;AAED,SAAS,MAAM,CAAC,OAAe;IAC7B,IAAI,CAAC;QACH,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAEtF,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/infrastructure/files/signed-link-options.d.ts

@@ -0,0 +1,10 @@
+import type { Clock } from '../../application/ports/clock.js';
+export interface SignedLinkOptions {
+    /** Where `signedFileRoutes` of `@ddd-ts-kit/http` answers, as a client reaches it: `http://localhost:3000/files`. A link is `<baseUrl>?token=<token>`. */
+    readonly baseUrl?: string;
+    /** Signs the links. Left out, a random one is drawn: the links then die with the process. */
+    readonly secret?: string;
+    /** Reads the expiry of the links. Default: the system clock. */
+    readonly clock?: Clock;
+}
+//# sourceMappingURL=signed-link-options.d.ts.map

package/dist/infrastructure/files/signed-link-options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signed-link-options.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/files/signed-link-options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kCAAkC,CAAC;AAE9D,MAAM,WAAW,iBAAiB;IAChC,0JAA0J;IAC1J,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,6FAA6F;IAC7F,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,gEAAgE;IAChE,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;CACxB"}

package/dist/infrastructure/files/signed-link-options.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=signed-link-options.js.map

package/dist/infrastructure/files/signed-link-options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signed-link-options.js","sourceRoot":"","sources":["../../../src/infrastructure/files/signed-link-options.ts"],"names":[],"mappings":""}

package/dist/infrastructure/files/stored-metadata.d.ts

@@ -0,0 +1,6 @@
+/** What the local storage writes beside a file, under `.metadata/`: what the file system does not know. */
+export interface StoredMetadata {
+    readonly mediaType: string;
+    readonly checksum: string;
+}
+//# sourceMappingURL=stored-metadata.d.ts.map

package/dist/infrastructure/files/stored-metadata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stored-metadata.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/files/stored-metadata.ts"],"names":[],"mappings":"AAAA,2GAA2G;AAC3G,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B"}

package/dist/infrastructure/files/stored-metadata.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=stored-metadata.js.map

package/dist/infrastructure/files/stored-metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stored-metadata.js","sourceRoot":"","sources":["../../../src/infrastructure/files/stored-metadata.ts"],"names":[],"mappings":""}

package/dist/infrastructure/files/tenant-file-keys.d.ts

@@ -0,0 +1,20 @@
+import type { Clock } from '../../application/ports/clock.js';
+import type { ExecutionScope } from '../../application/ports/execution-scope.js';
+import type { FileKeys } from '../../application/ports/file-keys.js';
+import type { IdGenerator } from '../../application/ports/id-generator.js';
+/**
+ * Keys of the form `tenants/<tenant>/<area>/<year>/<month>/<id>`, the tenant segment only when
+ * the work in progress names a tenant: the files of a tenant then share a prefix that a bucket
+ * policy, an export or an erasure can address. A tenant id is a key segment as it is: the kernel
+ * refuses any other at every entry (`isTenantId`), so two tenants never share a prefix. An area that would put the key under `staging/`
+ * is refused (`INVALID_FILE_KEY`). The id comes from the `IdGenerator`, so a key is
+ * not guessable when the generator is not.
+ */
+export declare class TenantFileKeys implements FileKeys {
+    private readonly ids;
+    private readonly clock;
+    private readonly scope?;
+    constructor(ids: IdGenerator, clock: Clock, scope?: Pick<ExecutionScope, 'current'> | undefined);
+    next(area: string): string;
+}
+//# sourceMappingURL=tenant-file-keys.d.ts.map

package/dist/infrastructure/files/tenant-file-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-file-keys.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/files/tenant-file-keys.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kCAAkC,CAAC;AAC9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4CAA4C,CAAC;AACjF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sCAAsC,CAAC;AACrE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yCAAyC,CAAC;AAG3E;;;;;;;GAOG;AACH,qBAAa,cAAe,YAAW,QAAQ;IAE3C,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IAHzB,YACmB,GAAG,EAAE,WAAW,EAChB,KAAK,EAAE,KAAK,EACZ,KAAK,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,SAAS,CAAC,YAAA,EACtD;IAEJ,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAOzB;CACF"}

package/dist/infrastructure/files/tenant-file-keys.js

@@ -0,0 +1,27 @@
+import { assertFinalKey } from '../../application/files/assert-final-key.js';
+/**
+ * Keys of the form `tenants/<tenant>/<area>/<year>/<month>/<id>`, the tenant segment only when
+ * the work in progress names a tenant: the files of a tenant then share a prefix that a bucket
+ * policy, an export or an erasure can address. A tenant id is a key segment as it is: the kernel
+ * refuses any other at every entry (`isTenantId`), so two tenants never share a prefix. An area that would put the key under `staging/`
+ * is refused (`INVALID_FILE_KEY`). The id comes from the `IdGenerator`, so a key is
+ * not guessable when the generator is not.
+ */
+export class TenantFileKeys {
+    ids;
+    clock;
+    scope;
+    constructor(ids, clock, scope) {
+        this.ids = ids;
+        this.clock = clock;
+        this.scope = scope;
+    }
+    next(area) {
+        const now = this.clock.now();
+        const month = String(now.getUTCMonth() + 1).padStart(2, '0');
+        const key = `${area}/${String(now.getUTCFullYear())}/${month}/${this.ids.next()}`;
+        const tenantId = this.scope?.current()?.tenantId;
+        return assertFinalKey(tenantId === undefined ? key : `tenants/${tenantId}/${key}`);
+    }
+}
+//# sourceMappingURL=tenant-file-keys.js.map

package/dist/infrastructure/files/tenant-file-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-file-keys.js","sourceRoot":"","sources":["../../../src/infrastructure/files/tenant-file-keys.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,cAAc,EAAE,MAAM,6CAA6C,CAAC;AAE7E;;;;;;;GAOG;AACH,MAAM,OAAO,cAAc;IAEN,GAAG;IACH,KAAK;IACL,KAAK;IAHxB,YACmB,GAAgB,EAChB,KAAY,EACZ,KAAuC;mBAFvC,GAAG;qBACH,KAAK;qBACL,KAAK;IACrB,CAAC;IAEJ,IAAI,CAAC,IAAY;QACf,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC7D,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;QAClF,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,QAAQ,CAAC;QAEjD,OAAO,cAAc,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,QAAQ,IAAI,GAAG,EAAE,CAAC,CAAC;IACrF,CAAC;CACF"}

package/dist/infrastructure/files/upload-desk.d.ts

@@ -0,0 +1,8 @@
+import type { FileKeys } from '../../application/ports/file-keys.js';
+import type { FileStaging } from './file-staging.js';
+/** What `fileUploadsMiddleware` stages a file upload with: the keys of the server and the staging. */
+export interface UploadDesk {
+    readonly keys: FileKeys;
+    readonly staging: FileStaging;
+}
+//# sourceMappingURL=upload-desk.d.ts.map

package/dist/infrastructure/files/upload-desk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upload-desk.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/files/upload-desk.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sCAAsC,CAAC;AACrE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,sGAAsG;AACtG,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;CAC/B"}

package/dist/infrastructure/files/upload-desk.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=upload-desk.js.map

package/dist/infrastructure/files/upload-desk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upload-desk.js","sourceRoot":"","sources":["../../../src/infrastructure/files/upload-desk.ts"],"names":[],"mappings":""}

package/dist/infrastructure/files/without-trailing-slashes.d.ts

@@ -0,0 +1,3 @@
+/** `value` without the slashes it ends with. */
+export declare function withoutTrailingSlashes(value: string): string;
+//# sourceMappingURL=without-trailing-slashes.d.ts.map

package/dist/infrastructure/files/without-trailing-slashes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"without-trailing-slashes.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/files/without-trailing-slashes.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAQ5D"}

package/dist/infrastructure/files/without-trailing-slashes.js

@@ -0,0 +1,9 @@
+/** `value` without the slashes it ends with. */
+export function withoutTrailingSlashes(value) {
+    let end = value.length;
+    while (end > 0 && value[end - 1] === '/') {
+        end -= 1;
+    }
+    return value.slice(0, end);
+}
+//# sourceMappingURL=without-trailing-slashes.js.map

package/dist/infrastructure/files/without-trailing-slashes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"without-trailing-slashes.js","sourceRoot":"","sources":["../../../src/infrastructure/files/without-trailing-slashes.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC;IAEvB,OAAO,GAAG,GAAG,CAAC,IAAI,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;QACzC,GAAG,IAAI,CAAC,CAAC;IACX,CAAC;IAED,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC7B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ddd-ts-kit/kernel",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "Framework-agnostic DDD building blocks, application ports and an in-memory event bus.",
   "license": "MIT",
   "repository": {