@spinajs/authz-fs 0.0.0-stage → 3.0.1

package/lib/mjs/adapter/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/adapter/index.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEjD,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE7C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAUjG,MAAM,MAAM,GAAG,CAAC,CAAU,EAAmB,EAAE,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,KAAK,CAAC;AAE5E,kGAAkG;AAE3F,IAAM,iBAAiB,GAAvB,MAAM,iBAAkB,SAAQ,eAAiC;IAItE,4EAA4E;IAC5E,YAA+B,SAAS,GAAe,EAAE,CAAC,aAAa;QACrE,KAAK,EAAE,CAAC;QADqB,cAAS,GAAT,SAAS,CAA+B;QAJ9D,SAAI,GAAG,IAAI,CAAC;QACZ,UAAK,GAA4B,iBAAiB,CAAC;IAK5D,CAAC;IAED,OAAO,CAAC,MAAe;QACrB,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAChE,MAAM,KAAK,GAAY,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACrD,IAAI,KAAK,KAAK,MAAM,CAAC,SAAS,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAC/D,MAAM,CAAC,GAAG,MAAiC,CAAC;QAC5C,OAAO,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5G,CAAC;IAED,KAAK,CAAC,MAAwB;QAC5B,MAAM,IAAI,GAAa,MAA6B,CAAC,IAAI,CAAC;QAC1D,OAAO,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,eAAe,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACtI,CAAC;IAED,oHAAoH;IACpH,KAAK,CAAC,SAAS,CAAC,GAAgB;QAC9B,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,wFAAwF;IACxF,KAAK,CAAC,IAAI,CAAC,GAAgB;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IAED,SAAS,CAAC,OAAgB,EAAE,KAAa;QACvC,OAAO,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAE,OAAmC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpJ,CAAC;IAED;;;OAGG;IACH,SAAS;QACP,MAAM,EAAE,SAAS,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAClD,OAAO,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5I,CAAC;IAED,WAAW;QACT,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,yDAAyD;IAC/C,UAAU,CAAC,MAAc;QACjC,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC;QAC/D,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAChF,CAAC;CACF,CAAA;AAtDY,iBAAiB;IAD7B,UAAU,CAAC,eAAe,CAAC;;GACf,iBAAiB,CAsD7B"}

package/lib/mjs/checks.d.ts

@@ -0,0 +1,5 @@
+/** A non-empty filesystem name without ':' (the first ':' of a ref id ends the name). */
+export declare function checkFsName(fsName: unknown): string;
+/** `value` as JSON for an error message; a value JSON cannot hold gives its String or its tag. */
+export declare function show(value: unknown): string;
+//# sourceMappingURL=checks.d.ts.map

package/lib/mjs/checks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checks.d.ts","sourceRoot":"","sources":["../../src/checks.ts"],"names":[],"mappings":"AAIA,yFAAyF;AACzF,wBAAgB,WAAW,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAEnD;AAED,kGAAkG;AAClG,wBAAgB,IAAI,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAM3C"}

package/lib/mjs/checks.js

@@ -0,0 +1,16 @@
+import { _check_arg, _is_string, _non_empty, _reg_match } from '@spinajs/util';
+// Internal: the barrel does not export this module.
+/** A non-empty filesystem name without ':' (the first ':' of a ref id ends the name). */
+export function checkFsName(fsName) {
+    return _check_arg(_is_string(_non_empty(), _reg_match(/^[^:]*$/)))(fsName, 'fsName');
+}
+/** `value` as JSON for an error message; a value JSON cannot hold gives its String or its tag. */
+export function show(value) {
+    try {
+        return JSON.stringify(value) ?? String(value);
+    }
+    catch {
+        return Object.prototype.toString.call(value);
+    }
+}
+//# sourceMappingURL=checks.js.map

package/lib/mjs/checks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checks.js","sourceRoot":"","sources":["../../src/checks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE/E,oDAAoD;AAEpD,yFAAyF;AACzF,MAAM,UAAU,WAAW,CAAC,MAAe;IACzC,OAAO,UAAU,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AACvF,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,IAAI,CAAC,KAAc;IACjC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC"}

package/lib/mjs/http/from-fs-path.d.ts

@@ -0,0 +1,15 @@
+import type { ResourceRef } from '@spinajs/authz';
+import type { IContainer } from '@spinajs/di';
+/**
+ * A resource extractor for `@Access` (authz-http's `ResourceExtractor`): the `file` ref of the url parameter
+ * `param` on `fsName`, the `fs` ref for the root. The path is normalised as the fs core does (D3), with the base
+ * path of the published provider, so the ref is the one AuthzFsMiddleware checks for the same path. Only url
+ * parameters are read, as authz-http's `fromParam` does. An Express 5 wildcard (`*path`) gives an array of
+ * segments: they are joined with '/', each segment refused on its own when the normaliser refuses it (`..` included).
+ *
+ * @param container - where the published provider is looked up; default the root container
+ * @throws InvalidArgument (400) when the parameter is missing, not a string or a non-empty string array, or the
+ * path is refused
+ */
+export declare function fromFsPath(fsName: string, param: string, container?: IContainer): (req: unknown) => ResourceRef | Promise<ResourceRef>;
+//# sourceMappingURL=from-fs-path.d.ts.map

package/lib/mjs/http/from-fs-path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"from-fs-path.d.ts","sourceRoot":"","sources":["../../../src/http/from-fs-path.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAElD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAS9C;;;;;;;;;;GAUG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,UAAU,GAAG,CAAC,GAAG,EAAE,OAAO,KAAK,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAStI"}

package/lib/mjs/http/from-fs-path.js

@@ -0,0 +1,40 @@
+import { DI } from '@spinajs/di';
+import { InvalidArgument } from '@spinajs/exceptions';
+import { publishedFs } from '@spinajs/fs';
+import { _check_arg, _is_string, _non_empty, isStringArray } from '@spinajs/util';
+import { checkFsName } from '../checks.js';
+import { refOf } from '../middleware/decide.js';
+import { normalizeFsPath } from '../refs/index.js';
+/**
+ * A resource extractor for `@Access` (authz-http's `ResourceExtractor`): the `file` ref of the url parameter
+ * `param` on `fsName`, the `fs` ref for the root. The path is normalised as the fs core does (D3), with the base
+ * path of the published provider, so the ref is the one AuthzFsMiddleware checks for the same path. Only url
+ * parameters are read, as authz-http's `fromParam` does. An Express 5 wildcard (`*path`) gives an array of
+ * segments: they are joined with '/', each segment refused on its own when the normaliser refuses it (`..` included).
+ *
+ * @param container - where the published provider is looked up; default the root container
+ * @throws InvalidArgument (400) when the parameter is missing, not a string or a non-empty string array, or the
+ * path is refused
+ */
+export function fromFsPath(fsName, param, container) {
+    checkFsName(fsName);
+    _check_arg(_is_string(_non_empty()))(param, 'param');
+    return (req) => {
+        const params = req !== null && typeof req === 'object' ? req.params : undefined;
+        const value = params !== null && typeof params === 'object' && Object.hasOwn(params, param) ? params[param] : undefined;
+        return refOf(fsName, normalizeFsPath(pathOf(value, param, fsName), publishedFs(fsName, container ?? DI.RootContainer)?.BasePath), 'file');
+    };
+}
+function pathOf(value, param, fsName) {
+    if (typeof value === 'string')
+        return value;
+    if (isStringArray(value) && value.length > 0) {
+        // A segment such as '..' is refused even where the joined path would stay inside the filesystem.
+        for (const segment of value)
+            if (segment === '' || segment.includes('/') || normalizeFsPath(segment) !== segment)
+                throw new InvalidArgument(`url parameter ${param} has the segment ${JSON.stringify(segment)}`, param);
+        return value.join('/');
+    }
+    throw new InvalidArgument(`url parameter ${param} is required to identify a file of ${fsName}`, param);
+}
+//# sourceMappingURL=from-fs-path.js.map

package/lib/mjs/http/from-fs-path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"from-fs-path.js","sourceRoot":"","sources":["../../../src/http/from-fs-path.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAElF,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,KAAK,EAAE,MAAM,yBAAyB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,UAAU,CAAC,MAAc,EAAE,KAAa,EAAE,SAAsB;IAC9E,WAAW,CAAC,MAAM,CAAC,CAAC;IACpB,UAAU,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAErD,OAAO,CAAC,GAAY,EAAe,EAAE;QACnC,MAAM,MAAM,GAAY,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAE,GAA4B,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QACnH,MAAM,KAAK,GAAY,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAE,MAAkC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9J,OAAO,KAAK,CAAC,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,IAAI,EAAE,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;IAC5I,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,KAAc,EAAE,KAAa,EAAE,MAAc;IAC3D,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7C,iGAAiG;QACjG,KAAK,MAAM,OAAO,IAAI,KAAiB;YAAE,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,KAAK,OAAO;gBAAE,MAAM,IAAI,eAAe,CAAC,iBAAiB,KAAK,oBAAoB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACpO,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IACD,MAAM,IAAI,eAAe,CAAC,iBAAiB,KAAK,sCAAsC,MAAM,EAAE,EAAE,KAAK,CAAC,CAAC;AACzG,CAAC"}

package/lib/mjs/http/index.d.ts

@@ -0,0 +1,3 @@
+export * from './upload.js';
+export * from './from-fs-path.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/mjs/http/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/http/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,mBAAmB,CAAC"}

package/lib/mjs/http/index.js

@@ -0,0 +1,3 @@
+export * from './upload.js';
+export * from './from-fs-path.js';
+//# sourceMappingURL=index.js.map

package/lib/mjs/http/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/http/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,mBAAmB,CAAC"}

package/lib/mjs/http/upload.d.ts

@@ -0,0 +1,29 @@
+import type { Principal } from '@spinajs/authz';
+import type { IContainer } from '@spinajs/di';
+import { FileUploadMiddleware } from '@spinajs/http';
+import type { IUploadOptions, IUploadedFile } from '@spinajs/http';
+import type { FsDecideService, FsLog } from '../middleware/decide.js';
+/** The filesystem `FromFile` uploads to when the route names none. */
+export declare const DEFAULT_UPLOAD_FS = "__file_upload_default_provider__";
+export interface AuthzUploadMiddlewareOptions {
+    /** Where the Configuration, the published providers and AuthzDomains are resolved; default the root. */
+    readonly container?: IContainer;
+    /** The service that decides for a domain; default the root AuthzService, else `AuthzDomains.service(domain)`. */
+    readonly service?: (domain: string) => Promise<FsDecideService>;
+    /** Default: the ALS principal, else UNATTENDED (what AuthzService.current() returns). */
+    readonly principal?: () => Principal;
+    readonly log?: FsLog;
+}
+/**
+ * Checks `fs:write` on the file an upload will be written to (`file.Provider`, else `options.fs`, else the default
+ * upload filesystem, at `file.BaseName`) before the uploader copies it, with that filesystem's mode and domain:
+ * enforce refuses with AccessDenied (403) so the formidable temp file is never copied, audit warns, off does
+ * nothing. AuthzFsMiddleware checks the copy again, but the uploader turns its denial into an IOFail (500); this
+ * gives the 403. Apps add it after middlewares that rename the file.
+ */
+export declare class AuthzUploadMiddleware extends FileUploadMiddleware {
+    protected readonly options: AuthzUploadMiddlewareOptions;
+    constructor(options?: AuthzUploadMiddlewareOptions);
+    beforeUpload(file: IUploadedFile, options?: IUploadOptions): Promise<IUploadedFile>;
+}
+//# sourceMappingURL=upload.d.ts.map

package/lib/mjs/http/upload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upload.d.ts","sourceRoot":"","sources":["../../../src/http/upload.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAG9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAInE,OAAO,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,yBAAyB,CAAC;AAGtE,sEAAsE;AACtE,eAAO,MAAM,iBAAiB,qCAAqC,CAAC;AAEpE,MAAM,WAAW,4BAA4B;IAC3C,wGAAwG;IACxG,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC;IAChC,iHAAiH;IACjH,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;IAChE,yFAAyF;IACzF,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,SAAS,CAAC;IACrC,QAAQ,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC;CACtB;AAED;;;;;;GAMG;AACH,qBACa,qBAAsB,SAAQ,oBAAoB;IACjD,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,4BAA4B;IAApE,YAA+B,OAAO,GAAE,4BAAiC,EAExE;IAEY,YAAY,CAAC,IAAI,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAyB/F;CACF"}

package/lib/mjs/http/upload.js

@@ -0,0 +1,64 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { currentPrincipal, engineLog } from '@spinajs/authz';
+import { DI, Injectable } from '@spinajs/di';
+import { InvalidArgument } from '@spinajs/exceptions';
+import { publishedFs } from '@spinajs/fs';
+import { FileUploadMiddleware } from '@spinajs/http';
+import { fsAccessConfig } from '../access-config/index.js';
+import { decideFs, domainService, refOf } from '../middleware/decide.js';
+import { fsRowOf, normalizeFsPath } from '../refs/index.js';
+/** The filesystem `FromFile` uploads to when the route names none. */
+export const DEFAULT_UPLOAD_FS = '__file_upload_default_provider__';
+/**
+ * Checks `fs:write` on the file an upload will be written to (`file.Provider`, else `options.fs`, else the default
+ * upload filesystem, at `file.BaseName`) before the uploader copies it, with that filesystem's mode and domain:
+ * enforce refuses with AccessDenied (403) so the formidable temp file is never copied, audit warns, off does
+ * nothing. AuthzFsMiddleware checks the copy again, but the uploader turns its denial into an IOFail (500); this
+ * gives the 403. Apps add it after middlewares that rename the file.
+ */
+let AuthzUploadMiddleware = class AuthzUploadMiddleware extends FileUploadMiddleware {
+    constructor(options = {}) {
+        super();
+        this.options = options;
+    }
+    async beforeUpload(file, options) {
+        // ImmediateFileUploader copies to file.Provider, which an earlier middleware may have replaced; FromFile also
+        // falls back on an empty options.fs.
+        const named = file.Provider?.Name;
+        const fsName = typeof named === 'string' && named !== '' ? named : options?.fs || DEFAULT_UPLOAD_FS;
+        const container = this.options.container ?? DI.RootContainer;
+        const config = fsAccessConfig(fsName, container);
+        if (config.mode === 'off')
+            return file;
+        const provider = publishedFs(fsName, container) ?? (file.Provider?.Name === fsName ? file.Provider : undefined);
+        const path = normalizeFsPath(file.BaseName, provider?.BasePath);
+        if (path === '')
+            throw new InvalidArgument(`upload ${JSON.stringify(file.Name)} has no file name to write to`, 'BaseName');
+        const service = await (this.options.service ?? ((domain) => domainService(container, domain)))(config.domain);
+        await decideFs({
+            fsName,
+            mode: config.mode,
+            service,
+            log: this.options.log ?? engineLog('authz-fs'),
+            principal: (this.options.principal ?? currentPrincipal)(),
+            permission: 'fs:write',
+            ref: refOf(fsName, path, 'file'),
+            subject: fsRowOf(fsName, path, 'file'),
+        });
+        return file;
+    }
+};
+AuthzUploadMiddleware = __decorate([
+    Injectable(FileUploadMiddleware),
+    __metadata("design:paramtypes", [Object])
+], AuthzUploadMiddleware);
+export { AuthzUploadMiddleware };
+//# sourceMappingURL=upload.js.map

package/lib/mjs/http/upload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upload.js","sourceRoot":"","sources":["../../../src/http/upload.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE7D,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE7C,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAGrD,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,yBAAyB,CAAC;AAEzE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAE5D,sEAAsE;AACtE,MAAM,CAAC,MAAM,iBAAiB,GAAG,kCAAkC,CAAC;AAYpE;;;;;;GAMG;AAEI,IAAM,qBAAqB,GAA3B,MAAM,qBAAsB,SAAQ,oBAAoB;IAC7D,YAA+B,OAAO,GAAiC,EAAE;QACvE,KAAK,EAAE,CAAC;uBADqB,OAAO;IAEtC,CAAC;IAEM,KAAK,CAAC,YAAY,CAAC,IAAmB,EAAE,OAAwB;QACrE,8GAA8G;QAC9G,qCAAqC;QACrC,MAAM,KAAK,GAAY,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC;QAC3C,MAAM,MAAM,GAAG,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,IAAI,iBAAiB,CAAC;QACpG,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,aAAa,CAAC;QAC7D,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACjD,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QAEvC,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAChH,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAChE,IAAI,IAAI,KAAK,EAAE;YAAE,MAAM,IAAI,eAAe,CAAC,UAAU,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,+BAA+B,EAAE,UAAU,CAAC,CAAC;QAE3H,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC,MAAc,EAAE,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtH,MAAM,QAAQ,CAAC;YACb,MAAM;YACN,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO;YACP,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,SAAS,CAAC,UAAU,CAAC;YAC9C,SAAS,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,gBAAgB,CAAC,EAAE;YACzD,UAAU,EAAE,UAAU;YACtB,GAAG,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC;YAChC,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC;SACvC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AA/BY,qBAAqB;IADjC,UAAU,CAAC,oBAAoB,CAAC;;GACpB,qBAAqB,CA+BjC"}

package/lib/mjs/index.d.ts

@@ -0,0 +1,9 @@
+export * from './refs/index.js';
+export * from './permissions/index.js';
+export * from './access-config/index.js';
+export * from './acl/index.js';
+export * from './adapter/index.js';
+export * from './middleware/index.js';
+export * from './migrations/index.js';
+export * from './http/index.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/mjs/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,wBAAwB,CAAC;AACvC,cAAc,0BAA0B,CAAC;AACzC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,oBAAoB,CAAC;AACnC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,iBAAiB,CAAC"}

package/lib/mjs/index.js

@@ -0,0 +1,9 @@
+export * from './refs/index.js';
+export * from './permissions/index.js';
+export * from './access-config/index.js';
+export * from './acl/index.js';
+export * from './adapter/index.js';
+export * from './middleware/index.js';
+export * from './migrations/index.js';
+export * from './http/index.js';
+//# sourceMappingURL=index.js.map

package/lib/mjs/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,wBAAwB,CAAC;AACvC,cAAc,0BAA0B,CAAC;AACzC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,oBAAoB,CAAC;AACnC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,iBAAiB,CAAC"}

package/lib/mjs/middleware/decide.d.ts

@@ -0,0 +1,32 @@
+import type { AuthzLog, CheckInput, Decision, Permission, Principal, ResourceRef } from '@spinajs/authz';
+import type { IContainer } from '@spinajs/di';
+import type { FsAccessMode } from '../access-config/index.js';
+import type { FsPathKind, FsRow } from '../refs/index.js';
+/** The part of AuthzService the fs checks call. */
+export interface FsDecideService {
+    check(req: CheckInput): Promise<Decision>;
+    assert(principal: Principal, permission: Permission, resource?: ResourceRef | object, subject?: unknown): Promise<Decision>;
+}
+/** `error` is for a file ACL update that failed after the IO; default `warn`. */
+export type FsLog = Pick<AuthzLog, 'warn'> & Partial<Pick<AuthzLog, 'error'>>;
+/** One check of one path: enforce asserts, audit checks and warns. */
+export interface FsCheck {
+    readonly fsName: string;
+    readonly mode: Exclude<FsAccessMode, 'off'>;
+    readonly service: FsDecideService;
+    readonly log: FsLog;
+    readonly principal: Principal;
+    readonly permission: Permission;
+    readonly ref: ResourceRef;
+    readonly subject: FsRow;
+}
+export declare function decideFs({ fsName, mode, service, log, principal, permission, ref, subject }: FsCheck): Promise<Decision>;
+export declare function warnDenied(fsName: string, log: FsLog, principal: Principal, permission: Permission, ref: ResourceRef, decision: Decision): void;
+/** 'root' is the root AuthzService; any other domain must exist already (`authz.domains`): it is never created here. */
+export declare function domainService(container: IContainer, domain: string): Promise<FsDecideService>;
+/** `now` when it is a valid Date, else the system time. */
+export declare const validNow: (now: unknown) => Date;
+/** The AuthzClock the domain's service booted with, else the system time. */
+export declare function domainNow(container: IContainer, domain: string): Promise<Date>;
+export declare const refOf: (fsName: string, normalised: string, kind: FsPathKind) => ResourceRef;
+//# sourceMappingURL=decide.d.ts.map

package/lib/mjs/middleware/decide.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decide.d.ts","sourceRoot":"","sources":["../../../src/middleware/decide.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AACzG,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAI1D,mDAAmD;AACnD,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,WAAW,GAAG,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC7H;AAED,iFAAiF;AACjF,MAAM,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AAE9E,sEAAsE;AACtE,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IAC5C,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;CACzB;AAED,wBAAsB,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAS9H;AAMD,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAG/I;AAED,wHAAwH;AACxH,wBAAsB,aAAa,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAGnG;AAED,2DAA2D;AAC3D,eAAO,MAAM,QAAQ,QAAS,OAAO,KAAG,IAAgF,CAAC;AAEzH,6EAA6E;AAC7E,wBAAsB,SAAS,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQpF;AAED,eAAO,MAAM,KAAK,WAAY,MAAM,cAAc,MAAM,QAAQ,UAAU,KAAG,WAA+G,CAAC"}

package/lib/mjs/middleware/decide.js

@@ -0,0 +1,42 @@
+import { AccessDenied, AuthzDomains, AuthzService, DEFAULT_DENY_PRIORITY, DefaultAuthzDomains, FALSE, definite, principalKey, resourceKey } from '@spinajs/authz';
+export async function decideFs({ fsName, mode, service, log, principal, permission, ref, subject }) {
+    if (mode === 'enforce') {
+        const decision = await service.assert(principal, permission, ref, subject);
+        if (!definite(decision))
+            throw new AccessDenied(conditional(decision));
+        return decision;
+    }
+    const decision = await service.check({ principal, permission, resource: ref, subject });
+    if (!definite(decision))
+        warnDenied(fsName, log, principal, permission, ref, decision);
+    return decision;
+}
+function conditional(decision) {
+    return { ...decision, allowed: false, residual: FALSE, reason: { code: 'needs_subject', priority: DEFAULT_DENY_PRIORITY.needs_subject } };
+}
+export function warnDenied(fsName, log, principal, permission, ref, decision) {
+    const why = decision.allowed ? 'conditional' : decision.reason?.code;
+    log.warn({ fsName, principal: principalKey(principal), permission, resource: resourceKey(ref), why }, 'authz.fs.${fsName}: ${principal} lacks ${permission} on ${resource}${?why} (${why})${/why}; allowed in audit mode');
+}
+/** 'root' is the root AuthzService; any other domain must exist already (`authz.domains`): it is never created here. */
+export async function domainService(container, domain) {
+    if (domain === 'root')
+        return (await container.resolve(AuthzService));
+    return (await container.resolve(AuthzDomains)).service(domain);
+}
+/** `now` when it is a valid Date, else the system time. */
+export const validNow = (now) => (now instanceof Date && !Number.isNaN(now.getTime()) ? now : new Date());
+/** The AuthzClock the domain's service booted with, else the system time. */
+export async function domainNow(container, domain) {
+    try {
+        const domains = await container.resolve(AuthzDomains);
+        if (domains instanceof DefaultAuthzDomains)
+            return validNow(domains.clock(domain).now());
+    }
+    catch {
+        // no authz host, no such domain or its service has not booted: the system time
+    }
+    return new Date();
+}
+export const refOf = (fsName, normalised, kind) => (normalised === '' ? { type: 'fs', id: fsName } : { type: kind, id: `${fsName}:${normalised}` });
+//# sourceMappingURL=decide.js.map

package/lib/mjs/middleware/decide.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decide.js","sourceRoot":"","sources":["../../../src/middleware/decide.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AA8BlK,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAW;IACzG,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAC3E,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,YAAY,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;QACvE,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;IACxF,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IACvF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,WAAW,CAAC,QAAkB;IACrC,OAAO,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,qBAAqB,CAAC,aAAa,EAAE,EAAE,CAAC;AAC5I,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAc,EAAE,GAAU,EAAE,SAAoB,EAAE,UAAsB,EAAE,GAAgB,EAAE,QAAkB;IACvI,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IACrE,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,EAAE,mHAAmH,CAAC,CAAC;AAC7N,CAAC;AAED,wHAAwH;AACxH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAqB,EAAE,MAAc;IACvE,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,CAAC,MAAM,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC,CAAiB,CAAC;IACtF,OAAQ,CAAC,MAAM,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC,CAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;AACnF,CAAC;AAED,2DAA2D;AAC3D,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,GAAY,EAAQ,EAAE,CAAC,CAAC,GAAG,YAAY,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;AAEzH,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,SAAqB,EAAE,MAAc;IACnE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACtD,IAAI,OAAO,YAAY,mBAAmB;YAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3F,CAAC;IAAC,MAAM,CAAC;QACP,+EAA+E;IACjF,CAAC;IACD,OAAO,IAAI,IAAI,EAAE,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,MAAc,EAAE,UAAkB,EAAE,IAAgB,EAAe,EAAE,CAAC,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,MAAM,IAAI,UAAU,EAAE,EAAE,CAAC,CAAC"}

package/lib/mjs/middleware/index.d.ts

@@ -0,0 +1,53 @@
+import type { Principal } from '@spinajs/authz';
+import type { IContainer } from '@spinajs/di';
+import { FsMiddleware } from '@spinajs/fs';
+import type { FsActionContext, fs } from '@spinajs/fs';
+import type { FsAccessConfig } from '../access-config/index.js';
+import type { FileAclStore } from '../acl/store.js';
+import type { FsDecideService, FsLog } from './decide.js';
+export type { FsDecideService, FsLog } from './decide.js';
+export { FS_NO_OWNER_TYPES } from './owner.js';
+export { DEFAULT_SIGNED_URL_TTL_SECONDS } from './signed-url.js';
+export interface AuthzFsMiddlewareOptions {
+    /** Where the Configuration, AuthzService, AuthzDomains and the FileAclStore are resolved; default the root. */
+    readonly container?: IContainer;
+    /** The service that decides for a domain; default the root AuthzService, else `AuthzDomains.service(domain)`. */
+    readonly service?: (domain: string) => Promise<FsDecideService>;
+    /** Default: the ALS principal, else UNATTENDED (what AuthzService.current() returns). */
+    readonly principal?: () => Principal;
+    readonly log?: FsLog;
+    /** The time signed URL lifetimes count from; default the AuthzClock of the filesystem's domain. */
+    readonly now?: () => Date;
+    readonly store?: () => Promise<FileAclStore>;
+}
+/**
+ * Checks every target of every fs action with the `authz.fs.<name>` entry of the target's own filesystem (fs
+ * middleware design §2.1) and keeps the file ACL in step with what the action did.
+ */
+export declare class AuthzFsMiddleware extends FsMiddleware {
+    protected readonly options: AuthzFsMiddlewareOptions;
+    order: number;
+    private logger?;
+    constructor(options?: AuthzFsMiddlewareOptions);
+    isEnabled(target: fs): boolean;
+    before(ctx: FsActionContext): Promise<void>;
+    after(ctx: FsActionContext, result: unknown): Promise<unknown>;
+    protected get container(): IContainer;
+    protected configOf(target: fs): FsAccessConfig;
+    private get log();
+    private service;
+    private store;
+    private decide;
+    private narrowSignedUrl;
+    private probeDeleted;
+    private applyRows;
+    /**
+     * A destination that existed keeps its rows (first writer) and the source rows go; otherwise the source rows move
+     * there, onto another filesystem too (one table): a directory's whole tree, anything else only its own rows. No
+     * owner is stamped: the rows travel with the file. A key whose prefix holds keys leaves its rows to the prefix. A
+     * destination too long for a row gets none: the source rows go, its parents' rows cover it.
+     */
+    private moveRows;
+    private listEach;
+}
+//# sourceMappingURL=index.d.ts.map

package/lib/mjs/middleware/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/middleware/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAwB,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAGtE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,EAAE,YAAY,EAAmB,MAAM,aAAa,CAAC;AAC5D,OAAO,KAAK,EAAE,eAAe,EAAY,EAAE,EAAE,MAAM,aAAa,CAAC;AAGjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAEhE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAGpD,OAAO,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAK1D,YAAY,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,8BAA8B,EAAE,MAAM,iBAAiB,CAAC;AAEjE,MAAM,WAAW,wBAAwB;IACvC,+GAA+G;IAC/G,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC;IAChC,iHAAiH;IACjH,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;IAChE,yFAAyF;IACzF,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,SAAS,CAAC;IACrC,QAAQ,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC;IACrB,mGAAmG;IACnG,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC,YAAY,CAAC,CAAC;CAC9C;AA8CD;;;GAGG;AACH,qBACa,iBAAkB,SAAQ,YAAY;IAIrC,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,wBAAwB;IAHzD,KAAK,SAAO;IACnB,OAAO,CAAC,MAAM,CAAC,CAAQ;IAEvB,YAA+B,OAAO,GAAE,wBAA6B,EAEpE;IAED,SAAS,CAAC,MAAM,EAAE,EAAE,GAAG,OAAO,CAE7B;IAEK,MAAM,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BhD;IAEK,KAAK,CAAC,GAAG,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAcnE;IAED,SAAS,KAAK,SAAS,IAAI,UAAU,CAEpC;IAKD,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,GAAG,cAAc,CAM7C;IAED,OAAO,KAAK,GAAG,GAEd;IAED,OAAO,CAAC,OAAO;IAIf,OAAO,CAAC,KAAK;YAIC,MAAM;YAYN,eAAe;YAQf,YAAY;YAKZ,SAAS;IAmBvB;;;;;OAKG;YACW,QAAQ;YAaR,QAAQ;CA0BvB"}