@spinajs/authz-fs 0.0.0-stage → 3.0.0

package/lib/mjs/middleware/index.js

@@ -0,0 +1,231 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { AuthzConfigError, AuthzService, SYSTEM, currentPrincipal, definite, engineLog, thrownError } from '@spinajs/authz';
+import { Configuration } from '@spinajs/configuration';
+import { DI, Injectable } from '@spinajs/di';
+import { InvalidArgument } from '@spinajs/exceptions';
+import { FsMiddleware, normalizeFsPath } from '@spinajs/fs';
+import { fsAccessConfig } from '../access-config/index.js';
+import { FS_ACL_LIMITS, fileAclStore } from '../acl/shared.js';
+import { fsRowOf } from '../refs/index.js';
+import { decideFs, domainNow, domainService, refOf, validNow, warnDenied } from './decide.js';
+import { ownerOf } from './owner.js';
+import { askedUntil, signingUntil } from './signed-url.js';
+export { FS_NO_OWNER_TYPES } from './owner.js';
+export { DEFAULT_SIGNED_URL_TTL_SECONDS } from './signed-url.js';
+const PLAN = Symbol('authz-fs.plan');
+const OFF = Object.freeze({ mode: 'off', domain: 'root' });
+const MOVES = new Set(['move', 'rename']);
+const writes = (t) => t.access.includes('write');
+const deletes = (t) => t.access.includes('delete');
+const where = (t) => `${t.fs.Name}:${t.path}`;
+/** No row can sit at a longer path, nor under it. */
+const holdsRows = (t) => t.path.length <= FS_ACL_LIMITS.path;
+/**
+ * Whether anything answers at the target's path, whatever its kind: a file, a directory, or keys under it as a
+ * prefix. On a key store (S3) a key and the prefix of the same name share one ACL path, so a key written there must
+ * neither clear the folder's rows nor claim them.
+ */
+async function occupied(ctx, t) {
+    return (await ctx.exists({ ...t, kind: 'file' })) || (await ctx.isDir(t)) || (await ctx.hasEntries(t));
+}
+/**
+ * Checks every target of every fs action with the `authz.fs.<name>` entry of the target's own filesystem (fs
+ * middleware design §2.1) and keeps the file ACL in step with what the action did.
+ */
+let AuthzFsMiddleware = class AuthzFsMiddleware extends FsMiddleware {
+    constructor(options = {}) {
+        super();
+        this.options = options;
+        this.order = 100;
+    }
+    isEnabled(target) {
+        return this.configOf(target).mode !== 'off';
+    }
+    async before(ctx) {
+        const asked = ctx.action === 'signedUrl' ? askedUntil(ctx.args[0]) : undefined;
+        const enabled = ctx.targets.map((target) => ({ target, config: this.configOf(target.fs) })).filter((t) => t.config.mode !== 'off');
+        for (const { target } of enabled) {
+            if (writes(target) && target.path.length > FS_ACL_LIMITS.path)
+                throw new InvalidArgument(`${target.fs.Name}: a path of ${target.path.length} characters is longer than the ${FS_ACL_LIMITS.path} the file ACL holds`, 'path');
+        }
+        const principal = (this.options.principal ?? currentPrincipal)();
+        const checked = [];
+        for (const { target, config } of enabled)
+            checked.push({ target, config, decisions: principal === SYSTEM ? [] : await this.decide(principal, target, config) });
+        if (ctx.action === 'signedUrl' && checked.length > 0)
+            await this.narrowSignedUrl(ctx, checked[0], asked);
+        // Only after every check passed: a refused action leaves the ACL alone.
+        const planned = [];
+        for (const c of checked) {
+            // Probed before the IO: once rm, move or rename ran, the path is gone and no provider calls it a directory.
+            const probed = deletes(c.target) ? await this.probeDeleted(ctx, c) : c;
+            if (!writes(c.target)) {
+                planned.push(probed);
+                continue;
+            }
+            const existed = await occupied(ctx, c.target);
+            // Nothing lives at or under a free path, so its rows are stale (an rm outside the middleware, an update that
+            // failed): what is created there must not inherit them.
+            if (!existed)
+                await (await this.store()).deleteTree(c.target.fs.Name, c.target.path);
+            planned.push({ ...probed, existed });
+        }
+        const destination = MOVES.has(ctx.action) ? ctx.targets.find(writes) : undefined;
+        const plan = { principal, checked: planned, ...(destination ? { destination, destinationExisted: await occupied(ctx, destination) } : {}) };
+        ctx.state.set(PLAN, plan);
+    }
+    async after(ctx, result) {
+        const plan = ctx.state.get(PLAN);
+        if (!plan)
+            return result;
+        try {
+            await this.applyRows(ctx.action, plan);
+        }
+        catch (e) {
+            const log = this.log;
+            const fields = { error: thrownError(e), action: ctx.action, paths: ctx.targets.map(where).join(', ') };
+            const message = 'authz.fs: ${action} on ${paths} succeeded, but the file ACL was not updated';
+            if (log.error)
+                log.error(fields, message);
+            else
+                log.warn(fields, message);
+            throw e;
+        }
+        return ctx.action === 'list' && Array.isArray(result) ? this.listEach(plan, result) : result;
+    }
+    get container() {
+        return this.options.container ?? DI.RootContainer;
+    }
+    // Without a Configuration and an authz host (tools, other packages' unit tests) there is no authz.fs entry to
+    // enforce. A resolved AuthzService is the host (it resolves Configuration as it boots; AuthzDomains alone is not,
+    // it resolves without one): once it runs, a missing Configuration must not leave every filesystem unchecked.
+    configOf(target) {
+        if (this.container.get(Configuration))
+            return fsAccessConfig(target.Name, this.container);
+        if (this.container.isResolved(AuthzService)) {
+            throw new AuthzConfigError('authz.fs: an authz host is resolved but Configuration is not; await DI.resolve(Configuration) first');
+        }
+        return OFF;
+    }
+    get log() {
+        return (this.logger ??= this.options.log ?? engineLog('authz-fs'));
+    }
+    service(domain) {
+        return this.options.service ? this.options.service(domain) : domainService(this.container, domain);
+    }
+    store() {
+        return this.options.store ? this.options.store() : fileAclStore(this.container);
+    }
+    async decide(principal, target, config) {
+        const service = await this.service(config.domain);
+        const fsName = target.fs.Name;
+        const ref = refOf(fsName, target.path, target.kind);
+        const subject = fsRowOf(fsName, target.path, target.kind);
+        const mode = config.mode === 'enforce' ? 'enforce' : 'audit';
+        const decisions = [];
+        for (const access of target.access)
+            decisions.push(await decideFs({ fsName, mode, service, log: this.log, principal, permission: `fs:${access}`, ref, subject }));
+        return decisions;
+    }
+    // The URL never outlives the asked until (else the default lifetime), the TTL cap or the permit; audit narrows too.
+    async narrowSignedUrl(ctx, c, asked) {
+        const { maxTtlSeconds, defaultTtlSeconds } = c.config.signedUrl ?? {};
+        const now = this.options.now ? validNow(this.options.now()) : await domainNow(this.container, c.config.domain);
+        const until = signingUntil({ asked, defaultTtlSeconds, maxTtlSeconds, now, decisions: c.decisions });
+        const opts = ctx.args[0] !== null && typeof ctx.args[0] === 'object' ? ctx.args[0] : {};
+        ctx.args[0] = { ...opts, until };
+    }
+    async probeDeleted(ctx, c) {
+        const dir = await ctx.isDir(c.target);
+        return dir ? { ...c, dir } : { ...c, dir, shared: await ctx.hasEntries(c.target) };
+    }
+    async applyRows(action, plan) {
+        if (action === 'rm') {
+            const store = await this.store();
+            for (const c of plan.checked.filter((c) => holdsRows(c.target))) {
+                if (c.dir)
+                    await store.deleteTree(c.target.fs.Name, c.target.path);
+                else if (!c.shared)
+                    await store.deletePath(c.target.fs.Name, c.target.path);
+            }
+            return;
+        }
+        if (MOVES.has(action))
+            return this.moveRows(plan);
+        for (const c of plan.checked) {
+            if (c.existed !== false || c.config.stampOwner !== true || c.target.path === '')
+                continue;
+            // Only a definite allow stamps: an audit-mode denial or a conditional permit must leave no owner behind.
+            if (c.decisions.length === 0 || !c.decisions.every(definite))
+                continue;
+            const owner = ownerOf(plan.principal, c.decisions[0]);
+            if (owner)
+                await (await this.store()).setOwnerIfAbsent(c.target.fs.Name, c.target.path, owner);
+        }
+    }
+    /**
+     * A destination that existed keeps its rows (first writer) and the source rows go; otherwise the source rows move
+     * there, onto another filesystem too (one table): a directory's whole tree, anything else only its own rows. No
+     * owner is stamped: the rows travel with the file. A key whose prefix holds keys leaves its rows to the prefix. A
+     * destination too long for a row gets none: the source rows go, its parents' rows cover it.
+     */
+    async moveRows(plan) {
+        const checked = plan.checked.find((c) => c.target.role === 'source');
+        const source = checked?.target;
+        const destination = plan.destination;
+        if (!source || !destination || checked?.shared === true || !holdsRows(source))
+            return;
+        if (source.fs.Name === destination.fs.Name && source.path === destination.path)
+            return;
+        const store = await this.store();
+        const tree = checked?.dir === true;
+        if (plan.destinationExisted || !holdsRows(destination))
+            await (tree ? store.deleteTree(source.fs.Name, source.path) : store.deletePath(source.fs.Name, source.path));
+        else if (tree)
+            await store.moveTree(source.fs.Name, source.path, destination.fs.Name, destination.path);
+        else
+            await store.movePath(source.fs.Name, source.path, destination.fs.Name, destination.path);
+    }
+    async listEach(plan, entries) {
+        const dir = plan.checked[0];
+        if (!dir || dir.config.list !== 'each' || plan.principal === SYSTEM)
+            return entries;
+        const { target, config } = dir;
+        const fsName = target.fs.Name;
+        const service = await this.service(config.domain);
+        const enforce = config.mode === 'enforce';
+        const keep = await Promise.all(entries.map(async (entry) => {
+            let path;
+            try {
+                // Local providers list names inside the directory, S3 whole keys.
+                const joined = typeof entry === 'string' && target.path !== '' && !entry.includes('/') ? `${target.path}/${entry}` : entry;
+                path = normalizeFsPath(joined, target.fs.BasePath);
+            }
+            catch {
+                return !enforce;
+            }
+            const ref = refOf(fsName, path, 'file');
+            const decision = await service.check({ principal: plan.principal, permission: 'fs:stat', resource: ref, subject: fsRowOf(fsName, path, 'file') });
+            if (definite(decision))
+                return true;
+            if (!enforce)
+                warnDenied(fsName, this.log, plan.principal, 'fs:stat', ref, decision);
+            return !enforce;
+        }));
+        return entries.filter((_, i) => keep[i]);
+    }
+};
+AuthzFsMiddleware = __decorate([
+    Injectable(FsMiddleware),
+    __metadata("design:paramtypes", [Object])
+], AuthzFsMiddleware);
+export { AuthzFsMiddleware };
+//# sourceMappingURL=index.js.map

package/lib/mjs/middleware/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/middleware/index.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE5H,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE7C,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAG5D,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAE3D,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAE/D,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9F,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAI3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,8BAA8B,EAAE,MAAM,iBAAiB,CAAC;AAwCjE,MAAM,IAAI,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC;AACrC,MAAM,GAAG,GAAmB,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;AAC3E,MAAM,KAAK,GAAwB,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AAE/D,MAAM,MAAM,GAAG,CAAC,CAAW,EAAW,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACpE,MAAM,OAAO,GAAG,CAAC,CAAW,EAAW,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACtE,MAAM,KAAK,GAAG,CAAC,CAAW,EAAU,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;AAChE,qDAAqD;AACrD,MAAM,SAAS,GAAG,CAAC,CAAW,EAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,aAAa,CAAC,IAAI,CAAC;AAEhF;;;;GAIG;AACH,KAAK,UAAU,QAAQ,CAAC,GAAoB,EAAE,CAAW;IACvD,OAAO,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AACzG,CAAC;AAED;;;GAGG;AAEI,IAAM,iBAAiB,GAAvB,MAAM,iBAAkB,SAAQ,YAAY;IAIjD,YAA+B,OAAO,GAA6B,EAAE;QACnE,KAAK,EAAE,CAAC;QADqB,YAAO,GAAP,OAAO,CAA+B;QAH9D,UAAK,GAAG,GAAG,CAAC;IAKnB,CAAC;IAED,SAAS,CAAC,MAAU;QAClB,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAoB;QAC/B,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/E,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;QACnI,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;YACjC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,aAAa,CAAC,IAAI;gBAAE,MAAM,IAAI,eAAe,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,IAAI,eAAe,MAAM,CAAC,IAAI,CAAC,MAAM,kCAAkC,aAAa,CAAC,IAAI,qBAAqB,EAAE,MAAM,CAAC,CAAC;QAChO,CAAC;QAED,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,gBAAgB,CAAC,EAAE,CAAC;QACjE,MAAM,OAAO,GAAc,EAAE,CAAC;QAC9B,KAAK,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,OAAO;YAAE,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAChK,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAEzG,wEAAwE;QACxE,MAAM,OAAO,GAAc,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,4GAA4G;YAC5G,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACvE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACrB,SAAS;YACX,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;YAC9C,6GAA6G;YAC7G,wDAAwD;YACxD,IAAI,CAAC,OAAO;gBAAE,MAAM,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACrF,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QACvC,CAAC;QACD,MAAM,WAAW,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACjF,MAAM,IAAI,GAAS,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAClJ,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAoB,EAAE,MAAe;QAC/C,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAqB,CAAC;QACrD,IAAI,CAAC,IAAI;YAAE,OAAO,MAAM,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;YACrB,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACvG,MAAM,OAAO,GAAG,6EAA6E,CAAC;YAC9F,IAAI,GAAG,CAAC,KAAK;gBAAE,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;;gBACrC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC/B,MAAM,CAAC,CAAC;QACV,CAAC;QACD,OAAO,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC/F,CAAC;IAED,IAAc,SAAS;QACrB,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,aAAa,CAAC;IACpD,CAAC;IAED,8GAA8G;IAC9G,kHAAkH;IAClH,6GAA6G;IACnG,QAAQ,CAAC,MAAU;QAC3B,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC;YAAE,OAAO,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1F,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,gBAAgB,CAAC,qGAAqG,CAAC,CAAC;QACpI,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,IAAY,GAAG;QACb,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC;IACrE,CAAC;IAEO,OAAO,CAAC,MAAc;QAC5B,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACrG,CAAC;IAEO,KAAK;QACX,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAClF,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,SAAoB,EAAE,MAAgB,EAAE,MAAsB;QACjF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC;QAC9B,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;QAC7D,MAAM,SAAS,GAAe,EAAE,CAAC;QACjC,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,MAAM;YAAE,SAAS,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,MAAM,EAAgB,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QAChL,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,oHAAoH;IAC5G,KAAK,CAAC,eAAe,CAAC,GAAoB,EAAE,CAAU,EAAE,KAA6B;QAC3F,MAAM,EAAE,aAAa,EAAE,iBAAiB,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;QACtE,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/G,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,aAAa,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QACrG,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAY,CAAC,CAAC,CAAC,EAAE,CAAC;QACpG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,CAAC;IACnC,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,GAAoB,EAAE,CAAU;QACzD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACtC,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;IACrF,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,MAAc,EAAE,IAAU;QAChD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YACjC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBAChE,IAAI,CAAC,CAAC,GAAG;oBAAE,MAAM,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;qBAC9D,IAAI,CAAC,CAAC,CAAC,MAAM;oBAAE,MAAM,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC9E,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAClD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC,CAAC,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,EAAE;gBAAE,SAAS;YAC1F,yGAAyG;YACzG,IAAI,CAAC,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC;gBAAE,SAAS;YACvE,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;YACtD,IAAI,KAAK;gBAAE,MAAM,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACjG,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,QAAQ,CAAC,IAAU;QAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;QACrE,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,CAAC;QAC/B,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACrC,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,IAAI,OAAO,EAAE,MAAM,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;YAAE,OAAO;QACtF,IAAI,MAAM,CAAC,EAAE,CAAC,IAAI,KAAK,WAAW,CAAC,EAAE,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,CAAC,IAAI;YAAE,OAAO;QACvF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,OAAO,EAAE,GAAG,KAAK,IAAI,CAAC;QACnC,IAAI,IAAI,CAAC,kBAAkB,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;aAChK,IAAI,IAAI;YAAE,MAAM,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;;YACnG,MAAM,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;IAChG,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,IAAU,EAAE,OAAkB;QACnD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,SAAS,KAAK,MAAM;YAAE,OAAO,OAAO,CAAC;QACpF,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC;QAC/B,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC;QAC9B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC;QAC1C,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAC5B,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC1B,IAAI,IAAY,CAAC;YACjB,IAAI,CAAC;gBACH,kEAAkE;gBAClE,MAAM,MAAM,GAAG,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;gBAC3H,IAAI,GAAG,eAAe,CAAC,MAAgB,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;YAC/D,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,OAAO,CAAC;YAClB,CAAC;YACD,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YACxC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;YAClJ,IAAI,QAAQ,CAAC,QAAQ,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpC,IAAI,CAAC,OAAO;gBAAE,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;YACrF,OAAO,CAAC,OAAO,CAAC;QAClB,CAAC,CAAC,CACH,CAAC;QACF,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,CAAC;CACF,CAAA;AAhLY,iBAAiB;IAD7B,UAAU,CAAC,YAAY,CAAC;;GACZ,iBAAiB,CAgL7B"}

package/lib/mjs/middleware/owner.d.ts

@@ -0,0 +1,10 @@
+import type { Decision, Principal, PrincipalRef } from '@spinajs/authz';
+/** Principal types that never own a file nor hold an ACL relation: no one in particular, or an id many share (anonymous callers, every bearer of a link). */
+export declare const FS_NO_OWNER_TYPES: ReadonlySet<string>;
+/**
+ * Who owns what an action creates: the principal the decision ran for (under 'inherit' delegation the delegate, as
+ * the owner relation is later evaluated for the delegate too), else the request principal; undefined for principals
+ * that own nothing.
+ */
+export declare function ownerOf(principal: Principal, decision: Decision | undefined): PrincipalRef | undefined;
+//# sourceMappingURL=owner.d.ts.map

package/lib/mjs/middleware/owner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner.d.ts","sourceRoot":"","sources":["../../../src/middleware/owner.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAExE,6JAA6J;AAC7J,eAAO,MAAM,iBAAiB,EAAE,WAAW,CAAC,MAAM,CAA0D,CAAC;AAE7G;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,GAAG,SAAS,GAAG,YAAY,GAAG,SAAS,CAKtG"}

package/lib/mjs/middleware/owner.js

@@ -0,0 +1,16 @@
+import { SYSTEM, UNATTENDED } from '@spinajs/authz';
+/** Principal types that never own a file nor hold an ACL relation: no one in particular, or an id many share (anonymous callers, every bearer of a link). */
+export const FS_NO_OWNER_TYPES = new Set(['system', 'unattended', 'anonymous', 'link']);
+/**
+ * Who owns what an action creates: the principal the decision ran for (under 'inherit' delegation the delegate, as
+ * the owner relation is later evaluated for the delegate too), else the request principal; undefined for principals
+ * that own nothing.
+ */
+export function ownerOf(principal, decision) {
+    if (principal === SYSTEM || principal === UNATTENDED)
+        return undefined;
+    const ran = decision?.principal;
+    const who = ran !== null && typeof ran === 'object' && typeof ran.type === 'string' && typeof ran.id === 'string' ? ran : principal;
+    return FS_NO_OWNER_TYPES.has(who.type) || who.id === '' ? undefined : { type: who.type, id: who.id };
+}
+//# sourceMappingURL=owner.js.map

package/lib/mjs/middleware/owner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner.js","sourceRoot":"","sources":["../../../src/middleware/owner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAGpD,6JAA6J;AAC7J,MAAM,CAAC,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;AAE7G;;;;GAIG;AACH,MAAM,UAAU,OAAO,CAAC,SAAoB,EAAE,QAA8B;IAC1E,IAAI,SAAS,KAAK,MAAM,IAAI,SAAS,KAAK,UAAU;QAAE,OAAO,SAAS,CAAC;IACvE,MAAM,GAAG,GAAY,QAAQ,EAAE,SAAS,CAAC;IACzC,MAAM,GAAG,GAAG,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAQ,GAAoB,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAQ,GAAoB,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAoB,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1L,OAAO,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;AACvG,CAAC"}

package/lib/mjs/middleware/signed-url.d.ts

@@ -0,0 +1,22 @@
+import type { Decision } from '@spinajs/authz';
+import { DateTime } from 'luxon';
+import type { Zone } from 'luxon';
+/** The lifetime of a URL nobody asked an until for: the S3 signer's own default (D9 rev.). */
+export declare const DEFAULT_SIGNED_URL_TTL_SECONDS = 900;
+/** An asked until, read once: the middleware signs this value, never the caller's object. */
+export interface AskedUntil {
+    readonly millis: number;
+    readonly zone?: Zone;
+}
+/** The `until` of `signedUrl(path, opts)`'s options. */
+export declare function askedUntil(opts: unknown): AskedUntil | undefined;
+export interface SigningTerms {
+    readonly asked?: AskedUntil;
+    readonly defaultTtlSeconds?: number;
+    readonly maxTtlSeconds?: number;
+    readonly now: Date;
+    readonly decisions: readonly Decision[];
+}
+/** min(asked, else now + defaultTtlSeconds; now + maxTtlSeconds; decision.validUntil), in the asked zone. */
+export declare function signingUntil({ asked, defaultTtlSeconds, maxTtlSeconds, now, decisions }: SigningTerms): DateTime;
+//# sourceMappingURL=signed-url.d.ts.map

package/lib/mjs/middleware/signed-url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signed-url.d.ts","sourceRoot":"","sources":["../../../src/middleware/signed-url.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE/C,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC;AAElC,8FAA8F;AAC9F,eAAO,MAAM,8BAA8B,MAAM,CAAC;AAElD,6FAA6F;AAC7F,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC;CACtB;AAED,wDAAwD;AACxD,wBAAgB,UAAU,CAAC,IAAI,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,CAShE;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;IACnB,QAAQ,CAAC,SAAS,EAAE,SAAS,QAAQ,EAAE,CAAC;CACzC;AAED,6GAA6G;AAC7G,wBAAgB,YAAY,CAAC,EAAE,KAAK,EAAE,iBAAkD,EAAE,aAAa,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,YAAY,GAAG,QAAQ,CAQjJ"}

package/lib/mjs/middleware/signed-url.js

@@ -0,0 +1,31 @@
+import { InvalidArgument } from '@spinajs/exceptions';
+import { DateTime } from 'luxon';
+/** The lifetime of a URL nobody asked an until for: the S3 signer's own default (D9 rev.). */
+export const DEFAULT_SIGNED_URL_TTL_SECONDS = 900;
+/** The `until` of `signedUrl(path, opts)`'s options. */
+export function askedUntil(opts) {
+    const asked = opts !== null && typeof opts === 'object' ? opts.until : undefined;
+    if (asked === undefined || asked === null)
+        return undefined;
+    const refused = () => new InvalidArgument('signedUrl: until must be a valid luxon DateTime', 'until');
+    // An until that cannot be compared would drop out of the minimum and widen the URL's lifetime.
+    if (!DateTime.isDateTime(asked) || !asked.isValid)
+        throw refused();
+    const millis = asked.toMillis();
+    if (!Number.isFinite(millis))
+        throw refused();
+    return { millis, zone: asked.zone };
+}
+/** min(asked, else now + defaultTtlSeconds; now + maxTtlSeconds; decision.validUntil), in the asked zone. */
+export function signingUntil({ asked, defaultTtlSeconds = DEFAULT_SIGNED_URL_TTL_SECONDS, maxTtlSeconds, now, decisions }) {
+    const terms = [asked ? asked.millis : now.getTime() + defaultTtlSeconds * 1000];
+    if (maxTtlSeconds !== undefined)
+        terms.push(now.getTime() + maxTtlSeconds * 1000);
+    for (const d of decisions) {
+        const until = d.validUntil instanceof Date ? d.validUntil.getTime() : NaN;
+        if (Number.isFinite(until))
+            terms.push(until);
+    }
+    return DateTime.fromMillis(Math.min(...terms), asked?.zone ? { zone: asked.zone } : {});
+}
+//# sourceMappingURL=signed-url.js.map

package/lib/mjs/middleware/signed-url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signed-url.js","sourceRoot":"","sources":["../../../src/middleware/signed-url.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAGjC,8FAA8F;AAC9F,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAQlD,wDAAwD;AACxD,MAAM,UAAU,UAAU,CAAC,IAAa;IACtC,MAAM,KAAK,GAAY,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAE,IAA4B,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACnH,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5D,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,IAAI,eAAe,CAAC,iDAAiD,EAAE,OAAO,CAAC,CAAC;IACtG,+FAA+F;IAC/F,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO;QAAE,MAAM,OAAO,EAAE,CAAC;IACnE,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;IAChC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,MAAM,OAAO,EAAE,CAAC;IAC9C,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;AACtC,CAAC;AAUD,6GAA6G;AAC7G,MAAM,UAAU,YAAY,CAAC,EAAE,KAAK,EAAE,iBAAiB,GAAG,8BAA8B,EAAE,aAAa,EAAE,GAAG,EAAE,SAAS,EAAgB;IACrI,MAAM,KAAK,GAAa,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,iBAAiB,GAAG,IAAI,CAAC,CAAC;IAC1F,IAAI,aAAa,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,aAAa,GAAG,IAAI,CAAC,CAAC;IAClF,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,YAAY,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QAC1E,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC1F,CAAC"}

package/lib/mjs/migrations/AuthzFsAcl_2026_10_17_00_00_00.d.ts

@@ -0,0 +1,8 @@
+import { OrmMigration } from '@spinajs/orm';
+import type { OrmDriver } from '@spinajs/orm';
+/** fs_acl of the fs middleware design §3.1 (OrmFileAclStore). */
+export declare class AuthzFsAcl_2026_10_17_00_00_00 extends OrmMigration {
+    up(connection: OrmDriver): Promise<void>;
+    down(connection: OrmDriver): Promise<void>;
+}
+//# sourceMappingURL=AuthzFsAcl_2026_10_17_00_00_00.d.ts.map

package/lib/mjs/migrations/AuthzFsAcl_2026_10_17_00_00_00.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthzFsAcl_2026_10_17_00_00_00.d.ts","sourceRoot":"","sources":["../../../src/migrations/AuthzFsAcl_2026_10_17_00_00_00.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,YAAY,EAA8B,MAAM,cAAc,CAAC;AACnF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAI9C,iEAAiE;AACjE,qBACa,8BAA+B,SAAQ,YAAY;IACjD,EAAE,CAAC,UAAU,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBpD;IAEY,IAAI,CAAC,UAAU,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAEtD;CACF"}

package/lib/mjs/migrations/AuthzFsAcl_2026_10_17_00_00_00.js

@@ -0,0 +1,42 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { Migration, OrmMigration, extractMigrationDescriptor } from '@spinajs/orm';
+import { fsAclConfig } from '../access-config/acl-config.js';
+/** fs_acl of the fs middleware design §3.1 (OrmFileAclStore). */
+let AuthzFsAcl_2026_10_17_00_00_00 = class AuthzFsAcl_2026_10_17_00_00_00 extends OrmMigration {
+    async up(connection) {
+        await connection.schema().createTable('fs_acl', (table) => {
+            table.string('id', 36).notNull().primaryKey();
+            // byte-for-byte keys, so case variants of a path, a subject key or a relation stay apart
+            for (const [name, length] of [
+                ['fs', 64],
+                ['path', 512],
+                ['path_hash', 64],
+                ['subject_key', 200],
+                ['relation', 64],
+            ]) {
+                table.string(name, length).notNull().exact();
+            }
+            table.dateTime('expires_at');
+            table.string('granted_by', 100);
+            table.dateTime('created_at').notNull();
+        });
+        // path_hash, not path: 392 characters stay under InnoDB's 3072-byte key limit in utf8mb4 (path alone is 2048 bytes).
+        await connection.index().unique().table('fs_acl').name('fs_acl_uq').columns(['fs', 'path_hash', 'subject_key', 'relation']);
+        await connection.index().table('fs_acl').name('fs_acl_path').columns(['fs', 'path_hash', 'relation']);
+    }
+    async down(connection) {
+        await connection.schema().dropTable('fs_acl');
+    }
+};
+AuthzFsAcl_2026_10_17_00_00_00 = __decorate([
+    Migration('default')
+], AuthzFsAcl_2026_10_17_00_00_00);
+export { AuthzFsAcl_2026_10_17_00_00_00 };
+// Read when the migrations run, so the table lands on the connection OrmFileAclStore uses.
+Object.defineProperty(extractMigrationDescriptor(AuthzFsAcl_2026_10_17_00_00_00), 'Connection', { get: () => fsAclConfig().connection, enumerable: true, configurable: true });
+//# sourceMappingURL=AuthzFsAcl_2026_10_17_00_00_00.js.map

package/lib/mjs/migrations/AuthzFsAcl_2026_10_17_00_00_00.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthzFsAcl_2026_10_17_00_00_00.js","sourceRoot":"","sources":["../../../src/migrations/AuthzFsAcl_2026_10_17_00_00_00.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAC;AAGnF,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAE7D,iEAAiE;AAE1D,IAAM,8BAA8B,GAApC,MAAM,8BAA+B,SAAQ,YAAY;IACvD,KAAK,CAAC,EAAE,CAAC,UAAqB;QACnC,MAAM,UAAU,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE;YACxD,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,CAAC;YAC9C,yFAAyF;YACzF,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI;gBAC3B,CAAC,IAAI,EAAE,EAAE,CAAC;gBACV,CAAC,MAAM,EAAE,GAAG,CAAC;gBACb,CAAC,WAAW,EAAE,EAAE,CAAC;gBACjB,CAAC,aAAa,EAAE,GAAG,CAAC;gBACpB,CAAC,UAAU,EAAE,EAAE,CAAC;aACR,EAAE,CAAC;gBACX,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC;YAC/C,CAAC;YACD,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;YAC7B,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;YAChC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC;QACzC,CAAC,CAAC,CAAC;QACH,qHAAqH;QACrH,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC;QAC5H,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;IACxG,CAAC;IAEM,KAAK,CAAC,IAAI,CAAC,UAAqB;QACrC,MAAM,UAAU,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC;CACF,CAAA;AA1BY,8BAA8B;IAD1C,SAAS,CAAC,SAAS,CAAC;GACR,8BAA8B,CA0B1C;;AAED,2FAA2F;AAC3F,MAAM,CAAC,cAAc,CAAC,0BAA0B,CAAC,8BAA8B,CAAE,EAAE,YAAY,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC"}

package/lib/mjs/migrations/index.d.ts

@@ -0,0 +1,2 @@
+export * from './AuthzFsAcl_2026_10_17_00_00_00.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/mjs/migrations/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/migrations/index.ts"],"names":[],"mappings":"AAAA,cAAc,qCAAqC,CAAC"}

package/lib/mjs/migrations/index.js

@@ -0,0 +1,2 @@
+export * from './AuthzFsAcl_2026_10_17_00_00_00.js';
+//# sourceMappingURL=index.js.map

package/lib/mjs/migrations/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/migrations/index.ts"],"names":[],"mappings":"AAAA,cAAc,qCAAqC,CAAC"}

package/lib/mjs/package.json

@@ -0,0 +1 @@
+{"type":"module"}

package/lib/mjs/permissions/index.d.ts

@@ -0,0 +1,3 @@
+import type { PermissionDef } from '@spinajs/authz';
+export declare const FS_PERMISSIONS: readonly Omit<PermissionDef, 'source'>[];
+//# sourceMappingURL=index.d.ts.map

package/lib/mjs/permissions/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/permissions/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAMpD,eAAO,MAAM,cAAc,EAAE,SAAS,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,EAAmd,CAAC"}

package/lib/mjs/permissions/index.js

@@ -0,0 +1,4 @@
+import { FS_RESOURCE_TYPES } from '../refs/index.js';
+const fsPermission = (action, description, implies) => Object.freeze({ name: `fs:${action}`, resource: 'fs', action, types: FS_RESOURCE_TYPES, ...(implies ? { implies: Object.freeze([...implies]) } : {}), description });
+export const FS_PERMISSIONS = Object.freeze([fsPermission('read', "Read a file's content", ['fs:stat']), fsPermission('stat', 'Check that a path exists and read its stats'), fsPermission('list', 'List the entries of a directory'), fsPermission('write', 'Create or change files and directories', ['fs:stat']), fsPermission('delete', 'Delete files and directories'), fsPermission('share', 'Create a signed URL for a file'), fsPermission('manage', 'Change the file ACL rows of a path (FsAcl)')]);
+//# sourceMappingURL=index.js.map

package/lib/mjs/permissions/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/permissions/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAErD,MAAM,YAAY,GAAG,CAAC,MAAc,EAAE,WAAmB,EAAE,OAA2B,EAAiC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC;AAE/R,MAAM,CAAC,MAAM,cAAc,GAA6C,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,uBAAuB,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,YAAY,CAAC,MAAM,EAAE,6CAA6C,CAAC,EAAE,YAAY,CAAC,MAAM,EAAE,iCAAiC,CAAC,EAAE,YAAY,CAAC,OAAO,EAAE,wCAAwC,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,YAAY,CAAC,QAAQ,EAAE,8BAA8B,CAAC,EAAE,YAAY,CAAC,OAAO,EAAE,gCAAgC,CAAC,EAAE,YAAY,CAAC,QAAQ,EAAE,4CAA4C,CAAC,CAAC,CAAC,CAAC"}

package/lib/mjs/refs/index.d.ts

@@ -0,0 +1,3 @@
+export { normalizeFsPath } from '@spinajs/fs';
+export * from './refs.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/mjs/refs/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/refs/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,cAAc,WAAW,CAAC"}

package/lib/mjs/refs/index.js

@@ -0,0 +1,3 @@
+export { normalizeFsPath } from '@spinajs/fs';
+export * from './refs.js';
+//# sourceMappingURL=index.js.map

package/lib/mjs/refs/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/refs/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,cAAc,WAAW,CAAC"}

package/lib/mjs/refs/refs.d.ts

@@ -0,0 +1,34 @@
+import type { ResourceRef } from '@spinajs/authz';
+import type { FsPathKind } from '@spinajs/fs';
+export type { FsPathKind };
+export type FsRefType = 'fs' | FsPathKind;
+export declare const FS_RESOURCE_TYPES: readonly FsRefType[];
+export interface ParsedFsRef {
+    readonly fs: string;
+    /** Normalised; '' for the filesystem root. */
+    readonly path: string;
+    readonly type: FsRefType;
+}
+/** `{ type: 'fs', id: fsName }` for the root, else `{ type: kind, id: '<fsName>:<normalised path>' }`. */
+export declare function fsRef(fsName: string, path: string, kind: FsPathKind): ResourceRef;
+/** undefined for a ref that is not an fs ref, or whose id is not in the form fsRef builds. */
+export declare function parseFsRef(ref: ResourceRef): ParsedFsRef | undefined;
+/** The subject row of an fs ref: what `resource.*` conditions and relation resolvers read (design §13). */
+export interface FsRow {
+    /** The ref id: `attribute(row, 'id')` equals it. */
+    readonly id: string;
+    readonly type: FsRefType;
+    readonly fs: string;
+    /** Normalised; '' for the filesystem root. */
+    readonly path: string;
+}
+/** The row of a ref fsRef builds; null for a ref parseFsRef refuses. */
+export declare function fsRow(ref: ResourceRef): FsRow | null;
+/** The row of an already normalised path, with no second normalisation; '' gives the fs row. */
+export declare function fsRowOf(fsName: string, normalised: string, type: FsRefType): FsRow;
+/**
+ * `[self, parent dirs nearest first, fs, GLOBAL]`, null for a ref parseFsRef refuses. This does not know which
+ * filesystems exist: an fs name no provider has still gets a chain.
+ */
+export declare function fsAncestors(ref: ResourceRef): readonly ResourceRef[] | null;
+//# sourceMappingURL=refs.d.ts.map

package/lib/mjs/refs/refs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refs.d.ts","sourceRoot":"","sources":["../../../src/refs/refs.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAIlD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAI9C,YAAY,EAAE,UAAU,EAAE,CAAC;AAC3B,MAAM,MAAM,SAAS,GAAG,IAAI,GAAG,UAAU,CAAC;AAE1C,eAAO,MAAM,iBAAiB,EAAE,SAAS,SAAS,EAAkD,CAAC;AAErG,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,8CAA8C;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;CAC1B;AAKD,0GAA0G;AAC1G,wBAAgB,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,WAAW,CAKjF;AAED,8FAA8F;AAC9F,wBAAgB,UAAU,CAAC,GAAG,EAAE,WAAW,GAAG,WAAW,GAAG,SAAS,CAiBpE;AAED,2GAA2G;AAC3G,MAAM,WAAW,KAAK;IACpB,oDAAoD;IACpD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,8CAA8C;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,wEAAwE;AACxE,wBAAgB,KAAK,CAAC,GAAG,EAAE,WAAW,GAAG,KAAK,GAAG,IAAI,CAGpD;AAED,gGAAgG;AAChG,wBAAgB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,KAAK,CAElF;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,WAAW,GAAG,SAAS,WAAW,EAAE,GAAG,IAAI,CAgB3E"}

package/lib/mjs/refs/refs.js

@@ -0,0 +1,71 @@
+import { GLOBAL } from '@spinajs/authz';
+import { _check_arg, _one_of } from '@spinajs/util';
+import { normalizeFsPath } from '@spinajs/fs';
+import { checkFsName } from '../checks.js';
+export const FS_RESOURCE_TYPES = Object.freeze(['fs', 'dir', 'file']);
+// The first ':' of a file or dir id ends the fs name, so a name must not hold one.
+const isFsName = (name) => typeof name === 'string' && name.length > 0 && !name.includes(':');
+/** `{ type: 'fs', id: fsName }` for the root, else `{ type: kind, id: '<fsName>:<normalised path>' }`. */
+export function fsRef(fsName, path, kind) {
+    checkFsName(fsName);
+    _check_arg(_one_of(['file', 'dir']))(kind, 'kind');
+    const normalised = normalizeFsPath(path);
+    return normalised === '' ? { type: 'fs', id: fsName } : { type: kind, id: `${fsName}:${normalised}` };
+}
+/** undefined for a ref that is not an fs ref, or whose id is not in the form fsRef builds. */
+export function parseFsRef(ref) {
+    if (!ref || typeof ref.id !== 'string') {
+        return undefined;
+    }
+    if (ref.type === 'fs') {
+        return isFsName(ref.id) ? { fs: ref.id, path: '', type: 'fs' } : undefined;
+    }
+    if (ref.type !== 'file' && ref.type !== 'dir') {
+        return undefined;
+    }
+    const at = ref.id.indexOf(':');
+    const fs = ref.id.slice(0, at);
+    const path = ref.id.slice(at + 1);
+    if (at <= 0 || path === '' || !isCanonical(path)) {
+        return undefined;
+    }
+    return { fs, path, type: ref.type };
+}
+/** The row of a ref fsRef builds; null for a ref parseFsRef refuses. */
+export function fsRow(ref) {
+    const parsed = parseFsRef(ref);
+    return parsed ? fsRowOf(parsed.fs, parsed.path, parsed.type) : null;
+}
+/** The row of an already normalised path, with no second normalisation; '' gives the fs row. */
+export function fsRowOf(fsName, normalised, type) {
+    return normalised === '' ? Object.freeze({ id: fsName, type: 'fs', fs: fsName, path: '' }) : Object.freeze({ id: `${fsName}:${normalised}`, type, fs: fsName, path: normalised });
+}
+/**
+ * `[self, parent dirs nearest first, fs, GLOBAL]`, null for a ref parseFsRef refuses. This does not know which
+ * filesystems exist: an fs name no provider has still gets a chain.
+ */
+export function fsAncestors(ref) {
+    const parsed = parseFsRef(ref);
+    if (!parsed) {
+        return null;
+    }
+    const chain = [];
+    if (parsed.type !== 'fs') {
+        chain.push({ type: parsed.type, id: `${parsed.fs}:${parsed.path}` });
+        const segments = parsed.path.split('/');
+        for (let n = segments.length - 1; n > 0; n--) {
+            chain.push({ type: 'dir', id: `${parsed.fs}:${segments.slice(0, n).join('/')}` });
+        }
+    }
+    chain.push({ type: 'fs', id: parsed.fs }, GLOBAL);
+    return chain;
+}
+function isCanonical(path) {
+    try {
+        return normalizeFsPath(path) === path;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=refs.js.map

package/lib/mjs/refs/refs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refs.js","sourceRoot":"","sources":["../../../src/refs/refs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAExC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAEpD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAG9C,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAK3C,MAAM,CAAC,MAAM,iBAAiB,GAAyB,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAU,CAAC,CAAC;AASrG,mFAAmF;AACnF,MAAM,QAAQ,GAAG,CAAC,IAAa,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAEvH,0GAA0G;AAC1G,MAAM,UAAU,KAAK,CAAC,MAAc,EAAE,IAAY,EAAE,IAAgB;IAClE,WAAW,CAAC,MAAM,CAAC,CAAC;IACpB,UAAU,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnD,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACzC,OAAO,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,MAAM,IAAI,UAAU,EAAE,EAAE,CAAC;AACxG,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,UAAU,CAAC,GAAgB;IACzC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7E,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC9C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAClC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QACjD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;AACtC,CAAC;AAYD,wEAAwE;AACxE,MAAM,UAAU,KAAK,CAAC,GAAgB;IACpC,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACtE,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,OAAO,CAAC,MAAc,EAAE,UAAkB,EAAE,IAAe;IACzE,OAAO,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,MAAM,IAAI,UAAU,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;AACpL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,GAAgB;IAC1C,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,KAAK,GAAkB,EAAE,CAAC;IAChC,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACrE,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,KAAK,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7C,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,MAAM,CAAC,EAAE,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;IAClD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,IAAI,CAAC;QACH,OAAO,eAAe,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}