pipework 0.67.0 → 0.68.0

package/dist/infra/storage/backend.d.ts

@@ -0,0 +1,32 @@
+import type { Readable } from 'node:stream';
+/** One stored object as a listing reports it. `key` is relative to the backend's prefix. */
+export interface BackendObject {
+    readonly key: string;
+    readonly lastModified: Date;
+}
+export interface BackendSignedUrlOptions {
+    readonly expiresInSeconds: number;
+    readonly disposition: 'attachment' | 'inline';
+    readonly filename?: string;
+    readonly mediaType: string;
+}
+/**
+ * Where the bytes of stored files live. `storage.s3(...)` and `storage.local(...)`
+ * make one; keys are the relative `tenants/<tenantId>/...` names the handle builds.
+ */
+export interface StorageBackend {
+    readonly name: 's3' | 'local';
+    /** Streams `body` to `key`, replacing any object there. A stream error leaves nothing at `key`. */
+    put(key: string, body: AsyncIterable<Buffer | Uint8Array>): Promise<void>;
+    exists(key: string): Promise<boolean>;
+    copy(from: string, to: string): Promise<void>;
+    /** Removes an object; absent is not an error. */
+    remove(key: string): Promise<void>;
+    /** Streams an object's bytes. */
+    read(key: string): Promise<Readable>;
+    /** Every object whose key starts with `prefix`, in key order. */
+    list(prefix: string): AsyncIterable<BackendObject>;
+    /** A time-limited URL that serves the object to a client with no credentials; throws where the backend cannot. */
+    signedUrl(key: string, options: BackendSignedUrlOptions): Promise<string>;
+}
+//# sourceMappingURL=backend.d.ts.map

package/dist/infra/storage/backend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backend.d.ts","sourceRoot":"","sources":["../../../src/infra/storage/backend.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAE3C,4FAA4F;AAC5F,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAA;CAC5B;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,QAAQ,CAAC,WAAW,EAAE,YAAY,GAAG,QAAQ,CAAA;IAC7C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAA;IAC7B,mGAAmG;IACnG,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,CAAC,MAAM,GAAG,UAAU,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACzE,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACrC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC7C,iDAAiD;IACjD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAClC,iCAAiC;IACjC,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IACpC,iEAAiE;IACjE,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,CAAC,aAAa,CAAC,CAAA;IAClD,kHAAkH;IAClH,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;CAC1E"}

package/dist/infra/storage/backend.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=backend.js.map

package/dist/infra/storage/backend.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backend.js","sourceRoot":"","sources":["../../../src/infra/storage/backend.ts"],"names":[],"mappings":""}

package/dist/infra/storage/handle.d.ts

@@ -0,0 +1,110 @@
+import type { Readable } from 'node:stream';
+import type { StorageBackend } from './backend.js';
+export interface StorageConfig {
+    readonly backend: StorageBackend;
+    /** Largest file `put` accepts, in bytes. Default 1 GiB; at most 5 GiB. */
+    readonly maxBytes?: number;
+    /** The app's environment. The local backend is refused when this is `production`. */
+    readonly environment?: string;
+}
+/** The metadata row of a stored file. */
+export interface StoredFile {
+    readonly id: string;
+    readonly tenantId: string;
+    /** Lowercase hex SHA-256 of the content. */
+    readonly sha256: string;
+    readonly size: number;
+    readonly mediaType: string;
+    readonly filename: string | null;
+    readonly createdAt: Date;
+    /** The Flow's `auth.userId` when `put` ran. */
+    readonly createdBy: string | null;
+    /** `null` = kept until deleted. */
+    readonly expiresAt: Date | null;
+    readonly metadata: unknown;
+}
+export interface PutOptions {
+    /** The bytes. Read once, never held whole; the length need not be known. */
+    readonly body: Readable;
+    readonly mediaType: string;
+    readonly filename?: string;
+    /** Hex SHA-256 the content must have; a different digest fails with 422 and stores nothing. */
+    readonly expectedSha256?: string;
+    /** After this time the file is no longer returned and `sweep` deletes it. */
+    readonly expiresAt?: Date;
+    readonly metadata?: unknown;
+}
+export interface SignedUrlOptions {
+    /** 1 to 604800 (seven days). Default 900. */
+    readonly expiresInSeconds?: number;
+    /** `'attachment'` (default) downloads; `'inline'` lets the browser display it. */
+    readonly disposition?: 'attachment' | 'inline';
+    /** Name the browser saves under; default the stored filename. */
+    readonly filename?: string;
+}
+export interface SweepOptions {
+    /** Most rows expired and most objects deleted in one call (each). Default 1000. */
+    readonly limit?: number;
+}
+export interface SweepResult {
+    /** Rows past `expiresAt` deleted. */
+    readonly expired: number;
+    /** Content objects deleted because no row referenced them. */
+    readonly objects: number;
+    /** Abandoned upload temp objects (over 24 hours old) deleted. */
+    readonly temp: number;
+}
+export interface Storage {
+    /**
+     * Stores a stream for the Flow's tenant and returns its metadata row. The bytes are written to a
+     * temporary object while hashed and counted, then moved to the tenant's content address
+     * (`tenants/<tenantId>/sha256/<hex>`); the same bytes put again by the tenant add a row and no
+     * object. Over `maxBytes` throws `PayloadTooLargeError` (413); a digest other than `expectedSha256`
+     * throws `ValidationError` (422); either leaves no row and no object. The blob is written first
+     * and the row in the Flow's transaction, so a rolled-back transaction leaves an object that
+     * `sweep()` removes. An `StoredFile:put` audit record is written when the Flow has an open trace step.
+     */
+    put(options: PutOptions): Promise<StoredFile>;
+    putFor(tenantId: string, options: PutOptions): Promise<StoredFile>;
+    /** The file's row, or `null` when there is none (or it has expired). */
+    get(id: string): Promise<StoredFile | null>;
+    getFor(tenantId: string, id: string): Promise<StoredFile | null>;
+    /** The row and a stream of the content (pass `file.size` as `length` to `http.file()`). Throws `NotFoundError` when there is no row. */
+    open(id: string): Promise<{
+        file: StoredFile;
+        stream: Readable;
+    }>;
+    openFor(tenantId: string, id: string): Promise<{
+        file: StoredFile;
+        stream: Readable;
+    }>;
+    /**
+     * A URL that serves the content to anyone holding it until it expires, with the requested
+     * Content-Disposition and the stored media type. S3 backend only; the local backend throws.
+     */
+    signedUrl(id: string, options?: SignedUrlOptions): Promise<{
+        url: string;
+        expiresAt: Date;
+    }>;
+    signedUrlFor(tenantId: string, id: string, options?: SignedUrlOptions): Promise<{
+        url: string;
+        expiresAt: Date;
+    }>;
+    /** Deletes the row (audit `StoredFile:delete`); the object goes at the next `sweep()` once no row references it. Returns whether there was a row. */
+    delete(id: string): Promise<boolean>;
+    deleteFor(tenantId: string, id: string): Promise<boolean>;
+    /**
+     * For a cron (system, all tenants). Deletes rows past `expiresAt` (audit `StoredFile:expire`), then
+     * content objects no row references and upload temp objects over 24 hours old. Needs a Flow
+     * (a job or schedule run). Audit records need an open trace step, as in `put`.
+     */
+    sweep(options?: SweepOptions): Promise<SweepResult>;
+}
+/**
+ * Tenant-scoped, content-addressed file storage over a backend (`storage.s3(...)` or
+ * `storage.local(...)`). Requires blueprint `storage: {}` for the `storage_file` table.
+ * Throws when the local backend is used with `environment: 'production'`, or `maxBytes`
+ * is not an integer from 1 to 5 GiB.
+ */
+export declare function createStorage(config: StorageConfig): Storage;
+//# sourceMappingURL=handle.d.ts.map

package/dist/infra/storage/handle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handle.d.ts","sourceRoot":"","sources":["../../../src/infra/storage/handle.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAU3C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAYlD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAA;IAChC,0EAA0E;IAC1E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,qFAAqF;IACrF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAC9B;AAED,yCAAyC;AACzC,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,4CAA4C;IAC5C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IAChC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;IACxB,+CAA+C;IAC/C,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,mCAAmC;IACnC,QAAQ,CAAC,SAAS,EAAE,IAAI,GAAG,IAAI,CAAA;IAC/B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;CAC3B;AAED,MAAM,WAAW,UAAU;IACzB,4EAA4E;IAC5E,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,+FAA+F;IAC/F,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,6EAA6E;IAC7E,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,CAAA;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAC5B;AAED,MAAM,WAAW,gBAAgB;IAC/B,6CAA6C;IAC7C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC,kFAAkF;IAClF,QAAQ,CAAC,WAAW,CAAC,EAAE,YAAY,GAAG,QAAQ,CAAA;IAC9C,iEAAiE;IACjE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED,MAAM,WAAW,YAAY;IAC3B,mFAAmF;IACnF,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,qCAAqC;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,8DAA8D;IAC9D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,iEAAiE;IACjE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,OAAO;IACtB;;;;;;;;OAQG;IACH,GAAG,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;IAC7C,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;IAClE,wEAAwE;IACxE,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAA;IAC3C,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAA;IAChE,wIAAwI;IACxI,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,UAAU,CAAC;QAAC,MAAM,EAAE,QAAQ,CAAA;KAAE,CAAC,CAAA;IACjE,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,UAAU,CAAC;QAAC,MAAM,EAAE,QAAQ,CAAA;KAAE,CAAC,CAAA;IACtF;;;OAGG;IACH,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,IAAI,CAAA;KAAE,CAAC,CAAA;IAC5F,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,IAAI,CAAA;KAAE,CAAC,CAAA;IACjH,qJAAqJ;IACrJ,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACpC,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACzD;;;;OAIG;IACH,KAAK,CAAC,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;CACpD;AAyCD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAwQ5D"}

package/dist/infra/storage/handle.js

@@ -0,0 +1,317 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { sql } from '../../data/db/sql.js';
+import { pipe, pipeSystem } from '../../data/db/db.js';
+import { requireContext } from '../../request/context/store.js';
+import { inTenant } from '../../auth/tenant/in-tenant.js';
+import { resolveActorId } from '../../data/write/audit/actor.js';
+import { getBaseLogger } from '../../core/logging/index.js';
+import { NotFoundError, PayloadTooLargeError, ValidationError } from '../../core/errors/index.js';
+const DEFAULT_MAX_BYTES = 1024 ** 3;
+const MAX_BACKEND_BYTES = 5 * 1024 ** 3;
+const MAX_SIGNED_SECONDS = 604800;
+const DEFAULT_SIGNED_SECONDS = 900;
+const DEFAULT_SWEEP_LIMIT = 1000;
+const TMP_MAX_AGE_MS = 24 * 3_600_000;
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const OBJECT_KEY = /^tenants\/([0-9a-f-]{36})\/sha256\/([0-9a-f]{64})$/;
+const TMP_KEY = /^tenants\/[0-9a-f-]{36}\/tmp\/[0-9a-f-]{36}$/;
+function toDate(value) {
+    if (value instanceof Date)
+        return value;
+    const text = String(value);
+    return new Date(/(Z|[+-]\d\d(:?\d\d)?)$/.test(text) ? text : `${text.replace(' ', 'T')}Z`);
+}
+function rowToFile(row) {
+    const expires = row['expires_at'];
+    return {
+        id: row['id'],
+        tenantId: row['tenant_id'],
+        sha256: row['sha256'],
+        size: Number(row['size']),
+        mediaType: row['media_type'],
+        filename: row['filename'] ?? null,
+        createdAt: toDate(row['created_at']),
+        createdBy: row['created_by'] ?? null,
+        expiresAt: expires === null || expires === undefined ? null : toDate(expires),
+        metadata: row['metadata'] ?? null,
+    };
+}
+function auditProjection(file) {
+    return {
+        id: file.id, sha256: file.sha256, size: file.size, mediaType: file.mediaType, filename: file.filename,
+        createdBy: file.createdBy, expiresAt: file.expiresAt,
+    };
+}
+function requireId(name, value) {
+    if (typeof value !== 'string' || !UUID.test(value)) {
+        throw new ValidationError({ [name]: ['must be a UUID'] }, `Storage ${name} must be a UUID.`);
+    }
+}
+function keyFor(tenantId, sha256) {
+    return `tenants/${tenantId.toLowerCase()}/sha256/${sha256}`;
+}
+/**
+ * Tenant-scoped, content-addressed file storage over a backend (`storage.s3(...)` or
+ * `storage.local(...)`). Requires blueprint `storage: {}` for the `storage_file` table.
+ * Throws when the local backend is used with `environment: 'production'`, or `maxBytes`
+ * is not an integer from 1 to 5 GiB.
+ */
+export function createStorage(config) {
+    const backend = config.backend;
+    const maxBytes = config.maxBytes ?? DEFAULT_MAX_BYTES;
+    if (!Number.isSafeInteger(maxBytes) || maxBytes < 1 || maxBytes > MAX_BACKEND_BYTES) {
+        throw new Error('[pipework] storage maxBytes must be an integer from 1 to 5 GiB (5368709120).\n');
+    }
+    if (backend.name === 'local' && config.environment === 'production') {
+        throw new Error('[pipework] storage.local is refused in production.\n\n' +
+            '  It keeps files on this machine\'s disk. Configure storage.s3({ bucket, region, credentials }).\n');
+    }
+    function tenantOf(explicit, flow) {
+        if (explicit !== null) {
+            requireId('tenantId', explicit);
+            return explicit;
+        }
+        if (flow.tenant === null) {
+            throw new Error('[pipework] This storage method needs a tenant in the Flow.\n\n' +
+                '  Call it from an authenticated tenant route, or use the ...For(tenantId, ...) form\n' +
+                '  (putFor, getFor, openFor, ...) from a webhook or a job with no tenant.\n');
+        }
+        return flow.tenant;
+    }
+    async function run(explicit, fn) {
+        const flow = requireContext();
+        const tenantId = tenantOf(explicit, flow);
+        if (explicit !== null)
+            return inTenant(flow, tenantId, tx => fn(tx, tenantId, flow));
+        return pipe.transaction((tx) => fn(tx, tenantId, flow));
+    }
+    async function audit(flow, tx, tenantId, verb, fileId, details) {
+        const trace = flow.trace;
+        const stepId = trace?.buffer.openStepId ?? null;
+        if (trace === null || stepId === null)
+            return;
+        try {
+            await tx.transaction(async (sp) => {
+                await sp.execute(sql `
+          INSERT INTO audit_record
+            (trace_day, trace_id, trace_step_id, tenant_id, actor_id, entity, verb, entity_id, after, occurred_at)
+          VALUES (${trace.openedDay}, ${trace.id}, ${stepId}, ${tenantId}, ${resolveActorId(flow)},
+            'StoredFile', ${verb}, ${fileId}, ${JSON.stringify(details)}::jsonb, now())
+        `);
+            });
+        }
+        catch (err) {
+            getBaseLogger().error({ err, traceId: trace.id }, `Failed to write the stored file ${verb} audit record`);
+        }
+    }
+    // One tenant-and-content lock orders a put's "does the object exist, then the row" against a
+    // sweep's "is there a row, then delete the object". Held to the end of the transaction.
+    async function lockContent(tx, tenantId, sha256) {
+        await tx.execute(sql `SELECT pg_advisory_xact_lock(hashtextextended(${`pipework.storage:${tenantId.toLowerCase()}:${sha256}`}, 0))`);
+    }
+    async function discard(key) {
+        try {
+            await backend.remove(key);
+        }
+        catch (err) {
+            getBaseLogger().error({ err, key }, 'storage failed to remove a temporary object; sweep() will');
+        }
+    }
+    async function doPut(explicit, options) {
+        if (typeof options.mediaType !== 'string' || options.mediaType.trim() === '' || /[\r\n]/.test(options.mediaType)) {
+            throw new ValidationError({ mediaType: ['must be a media type such as "application/pdf"'] }, 'Storage mediaType must be a non-empty single line.');
+        }
+        let expected = null;
+        if (options.expectedSha256 !== undefined) {
+            if (!/^[0-9a-f]{64}$/i.test(options.expectedSha256)) {
+                throw new ValidationError({ expectedSha256: ['must be 64 hex characters'] }, 'Storage expectedSha256 must be a hex SHA-256.');
+            }
+            expected = options.expectedSha256.toLowerCase();
+        }
+        if (options.expiresAt !== undefined && !(options.expiresAt instanceof Date && !Number.isNaN(options.expiresAt.getTime()))) {
+            throw new ValidationError({ expiresAt: ['must be a valid Date'] }, 'Storage expiresAt must be a Date.');
+        }
+        // Resolve the tenant before any byte is written.
+        const flow = requireContext();
+        const tenantId = tenantOf(explicit, flow);
+        const hash = createHash('sha256');
+        let size = 0;
+        const measured = (async function* () {
+            for await (const chunk of options.body) {
+                const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+                size += buf.length;
+                if (size > maxBytes)
+                    throw new PayloadTooLargeError(`File is larger than ${maxBytes} bytes`, { maxBytes });
+                hash.update(buf);
+                yield buf;
+            }
+        })();
+        const tmpKey = `tenants/${tenantId.toLowerCase()}/tmp/${randomUUID()}`;
+        try {
+            await backend.put(tmpKey, measured);
+        }
+        catch (err) {
+            options.body.destroy();
+            await discard(tmpKey);
+            throw err;
+        }
+        const sha256 = hash.digest('hex');
+        if (expected !== null && expected !== sha256) {
+            await discard(tmpKey);
+            throw new ValidationError({ expectedSha256: [`content has sha256 ${sha256}`] }, 'The uploaded content does not match expectedSha256.');
+        }
+        const finalKey = keyFor(tenantId, sha256);
+        try {
+            return await run(explicit, async (tx, tenant, f) => {
+                await lockContent(tx, tenant, sha256);
+                if (!(await backend.exists(finalKey)))
+                    await backend.copy(tmpKey, finalKey);
+                const metadata = options.metadata === undefined ? null : JSON.stringify(options.metadata);
+                const rows = await tx.execute(sql `
+          INSERT INTO storage_file (tenant_id, sha256, size, media_type, filename, created_by, expires_at, metadata)
+          VALUES (${tenant}, ${sha256}, ${size}, ${options.mediaType.trim()}, ${options.filename ?? null},
+            ${resolveActorId(f)}, ${options.expiresAt?.toISOString() ?? null},
+            ${metadata === null ? sql `NULL` : sql `${metadata}::jsonb`})
+          RETURNING *
+        `);
+                const file = rowToFile(rows[0]);
+                await audit(f, tx, tenant, 'put', file.id, auditProjection(file));
+                return file;
+            });
+        }
+        finally {
+            await discard(tmpKey);
+        }
+    }
+    async function findFile(tx, tenantId, id, includeExpired) {
+        const rows = await tx.execute(includeExpired
+            ? sql `SELECT * FROM storage_file WHERE tenant_id = ${tenantId} AND id = ${id}`
+            : sql `SELECT * FROM storage_file WHERE tenant_id = ${tenantId} AND id = ${id} AND (expires_at IS NULL OR expires_at > now())`);
+        return rows.length === 0 ? null : rowToFile(rows[0]);
+    }
+    async function doGet(explicit, id) {
+        requireId('id', id);
+        return run(explicit, (tx, tenantId) => findFile(tx, tenantId, id, false));
+    }
+    async function doOpen(explicit, id) {
+        const file = await doGet(explicit, id);
+        if (file === null)
+            throw new NotFoundError('File', { id });
+        return { file, stream: await backend.read(keyFor(file.tenantId, file.sha256)) };
+    }
+    async function doSignedUrl(explicit, id, options = {}) {
+        const seconds = options.expiresInSeconds ?? DEFAULT_SIGNED_SECONDS;
+        if (!Number.isInteger(seconds) || seconds < 1 || seconds > MAX_SIGNED_SECONDS) {
+            throw new ValidationError({ expiresInSeconds: [`must be an integer from 1 to ${MAX_SIGNED_SECONDS}`] }, 'Storage expiresInSeconds is out of range.');
+        }
+        const disposition = options.disposition ?? 'attachment';
+        if (disposition !== 'attachment' && disposition !== 'inline') {
+            throw new ValidationError({ disposition: ["must be 'attachment' or 'inline'"] }, 'Storage disposition must be attachment or inline.');
+        }
+        const file = await doGet(explicit, id);
+        if (file === null)
+            throw new NotFoundError('File', { id });
+        const filename = options.filename ?? file.filename ?? undefined;
+        const issued = Date.now();
+        const url = await backend.signedUrl(keyFor(file.tenantId, file.sha256), {
+            expiresInSeconds: seconds, disposition: disposition, mediaType: file.mediaType, ...(filename !== undefined ? { filename } : {}),
+        });
+        return { url, expiresAt: new Date(issued + seconds * 1000) };
+    }
+    async function doDelete(explicit, id) {
+        requireId('id', id);
+        return run(explicit, async (tx, tenantId, flow) => {
+            const rows = await tx.execute(sql `DELETE FROM storage_file WHERE tenant_id = ${tenantId} AND id = ${id} RETURNING *`);
+            if (rows.length === 0)
+                return false;
+            const file = rowToFile(rows[0]);
+            await audit(flow, tx, tenantId, 'delete', file.id, auditProjection(file));
+            return true;
+        });
+    }
+    async function doSweep(options = {}) {
+        const limit = options.limit ?? DEFAULT_SWEEP_LIMIT;
+        if (!Number.isSafeInteger(limit) || limit < 1) {
+            throw new ValidationError({ limit: ['must be a positive integer'] }, 'Storage sweep limit must be a positive integer.');
+        }
+        const flow = requireContext();
+        let expired = 0;
+        let objects = 0;
+        let temp = 0;
+        await pipeSystem().transaction(async (tx) => {
+            const rows = await tx.execute(sql `
+        DELETE FROM storage_file WHERE id IN (
+          SELECT id FROM storage_file WHERE expires_at IS NOT NULL AND expires_at <= now()
+          ORDER BY expires_at LIMIT ${limit} FOR UPDATE SKIP LOCKED
+        ) RETURNING *
+      `);
+            for (const row of rows) {
+                const file = rowToFile(row);
+                await audit(flow, tx, file.tenantId, 'expire', file.id, auditProjection(file));
+            }
+            expired = rows.length;
+        });
+        const cutoff = Date.now() - TMP_MAX_AGE_MS;
+        let batch = [];
+        const settle = async () => {
+            if (batch.length === 0)
+                return;
+            const candidates = batch;
+            batch = [];
+            const present = await pipeSystem().execute(sql `
+        SELECT tenant_id::text AS t, sha256 AS h FROM storage_file
+        WHERE tenant_id::text || ':' || sha256 IN (SELECT jsonb_array_elements_text(${JSON.stringify(candidates.map(c => `${c.tenantId}:${c.sha256}`))}::jsonb))
+      `);
+            const referenced = new Set(present.map(r => `${r['t']}:${r['h']}`));
+            for (const c of candidates) {
+                if (objects >= limit)
+                    return;
+                if (referenced.has(`${c.tenantId}:${c.sha256}`))
+                    continue;
+                const removed = await pipeSystem().transaction(async (tx) => {
+                    await lockContent(tx, c.tenantId, c.sha256);
+                    const again = await tx.execute(sql `
+            SELECT 1 FROM storage_file WHERE tenant_id = ${c.tenantId} AND sha256 = ${c.sha256} LIMIT 1
+          `);
+                    if (again.length > 0)
+                        return false;
+                    await backend.remove(c.key);
+                    return true;
+                });
+                if (removed)
+                    objects += 1;
+            }
+        };
+        for await (const object of backend.list('tenants/')) {
+            if (objects >= limit && temp >= limit)
+                break;
+            const match = OBJECT_KEY.exec(object.key);
+            if (match !== null) {
+                if (objects < limit)
+                    batch.push({ tenantId: match[1], sha256: match[2], key: object.key });
+                if (batch.length >= 200)
+                    await settle();
+            }
+            else if (TMP_KEY.test(object.key) && object.lastModified.getTime() < cutoff && temp < limit) {
+                await backend.remove(object.key);
+                temp += 1;
+            }
+        }
+        await settle();
+        return { expired, objects, temp };
+    }
+    return {
+        put: o => doPut(null, o),
+        putFor: (t, o) => doPut(t, o),
+        get: id => doGet(null, id),
+        getFor: (t, id) => doGet(t, id),
+        open: id => doOpen(null, id),
+        openFor: (t, id) => doOpen(t, id),
+        signedUrl: (id, o) => doSignedUrl(null, id, o),
+        signedUrlFor: (t, id, o) => doSignedUrl(t, id, o),
+        delete: id => doDelete(null, id),
+        deleteFor: (t, id) => doDelete(t, id),
+        sweep: o => doSweep(o),
+    };
+}
+//# sourceMappingURL=handle.js.map

package/dist/infra/storage/handle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handle.js","sourceRoot":"","sources":["../../../src/infra/storage/handle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAEpD,OAAO,EAAE,GAAG,EAAE,MAAM,sBAAsB,CAAA;AAC1C,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAEtD,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAA;AAE/D,OAAO,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAA;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAA;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAA;AAC3D,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAA;AAGjG,MAAM,iBAAiB,GAAG,IAAI,IAAI,CAAC,CAAA;AACnC,MAAM,iBAAiB,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC,CAAA;AACvC,MAAM,kBAAkB,GAAG,MAAM,CAAA;AACjC,MAAM,sBAAsB,GAAG,GAAG,CAAA;AAClC,MAAM,mBAAmB,GAAG,IAAI,CAAA;AAChC,MAAM,cAAc,GAAG,EAAE,GAAG,SAAS,CAAA;AACrC,MAAM,IAAI,GAAG,iEAAiE,CAAA;AAC9E,MAAM,UAAU,GAAG,oDAAoD,CAAA;AACvE,MAAM,OAAO,GAAG,8CAA8C,CAAA;AAiG9D,SAAS,MAAM,CAAC,KAAc;IAC5B,IAAI,KAAK,YAAY,IAAI;QAAE,OAAO,KAAK,CAAA;IACvC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;IAC1B,OAAO,IAAI,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAA;AAC5F,CAAC;AAED,SAAS,SAAS,CAAC,GAA4B;IAC7C,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,CAAC,CAAA;IACjC,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,IAAI,CAAW;QACvB,QAAQ,EAAE,GAAG,CAAC,WAAW,CAAW;QACpC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAW;QAC/B,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACzB,SAAS,EAAE,GAAG,CAAC,YAAY,CAAW;QACtC,QAAQ,EAAG,GAAG,CAAC,UAAU,CAAmB,IAAI,IAAI;QACpD,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACpC,SAAS,EAAG,GAAG,CAAC,YAAY,CAAmB,IAAI,IAAI;QACvD,SAAS,EAAE,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;QAC7E,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI;KAClC,CAAA;AACH,CAAC;AAED,SAAS,eAAe,CAAC,IAAgB;IACvC,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACrG,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS;KACrD,CAAA;AACH,CAAC;AAED,SAAS,SAAS,CAAC,IAAY,EAAE,KAAa;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,eAAe,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,WAAW,IAAI,kBAAkB,CAAC,CAAA;IAC9F,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,QAAgB,EAAE,MAAc;IAC9C,OAAO,WAAW,QAAQ,CAAC,WAAW,EAAE,WAAW,MAAM,EAAE,CAAA;AAC7D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,MAAqB;IACjD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAA;IAC9B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,iBAAiB,CAAA;IACrD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,IAAI,QAAQ,GAAG,iBAAiB,EAAE,CAAC;QACpF,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAA;IACnG,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,WAAW,KAAK,YAAY,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CACb,wDAAwD;YACxD,oGAAoG,CACrG,CAAA;IACH,CAAC;IAED,SAAS,QAAQ,CAAC,QAAuB,EAAE,IAAU;QACnD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,SAAS,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAA;YAC/B,OAAO,QAAQ,CAAA;QACjB,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACb,gEAAgE;gBAChE,uFAAuF;gBACvF,4EAA4E,CAC7E,CAAA;QACH,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAA;IACpB,CAAC;IAED,KAAK,UAAU,GAAG,CAAI,QAAuB,EAAE,EAAwD;QACrG,MAAM,IAAI,GAAG,cAAc,EAAE,CAAA;QAC7B,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;QACzC,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAA;QACpF,OAAO,IAAI,CAAC,WAAW,CAAC,CAAC,EAAM,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAA;IAC7D,CAAC;IAED,KAAK,UAAU,KAAK,CAAC,IAAU,EAAE,EAAM,EAAE,QAAgB,EAAE,IAAY,EAAE,MAAc,EAAE,OAAgC;QACvH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAA;QACxB,MAAM,MAAM,GAAG,KAAK,EAAE,MAAM,CAAC,UAAU,IAAI,IAAI,CAAA;QAC/C,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,KAAK,IAAI;YAAE,OAAM;QAC7C,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAM,EAAE,EAAE;gBACpC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;;;oBAGR,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,EAAE,KAAK,MAAM,KAAK,QAAQ,KAAK,cAAc,CAAC,IAAI,CAAC;4BACrE,IAAI,KAAK,MAAM,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;SAC9D,CAAC,CAAA;YACJ,CAAC,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,aAAa,EAAE,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,EAAE,mCAAmC,IAAI,eAAe,CAAC,CAAA;QAC3G,CAAC;IACH,CAAC;IAED,6FAA6F;IAC7F,wFAAwF;IACxF,KAAK,UAAU,WAAW,CAAC,EAAM,EAAE,QAAgB,EAAE,MAAc;QACjE,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,iDAAiD,oBAAoB,QAAQ,CAAC,WAAW,EAAE,IAAI,MAAM,EAAE,OAAO,CAAC,CAAA;IACrI,CAAC;IAED,KAAK,UAAU,OAAO,CAAC,GAAW;QAChC,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,aAAa,EAAE,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,2DAA2D,CAAC,CAAA;QAClG,CAAC;IACH,CAAC;IAED,KAAK,UAAU,KAAK,CAAC,QAAuB,EAAE,OAAmB;QAC/D,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACjH,MAAM,IAAI,eAAe,CAAC,EAAE,SAAS,EAAE,CAAC,gDAAgD,CAAC,EAAE,EAAE,oDAAoD,CAAC,CAAA;QACpJ,CAAC;QACD,IAAI,QAAQ,GAAkB,IAAI,CAAA;QAClC,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YACzC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;gBACpD,MAAM,IAAI,eAAe,CAAC,EAAE,cAAc,EAAE,CAAC,2BAA2B,CAAC,EAAE,EAAE,+CAA+C,CAAC,CAAA;YAC/H,CAAC;YACD,QAAQ,GAAG,OAAO,CAAC,cAAc,CAAC,WAAW,EAAE,CAAA;QACjD,CAAC;QACD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,YAAY,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC;YAC1H,MAAM,IAAI,eAAe,CAAC,EAAE,SAAS,EAAE,CAAC,sBAAsB,CAAC,EAAE,EAAE,mCAAmC,CAAC,CAAA;QACzG,CAAC;QACD,iDAAiD;QACjD,MAAM,IAAI,GAAG,cAAc,EAAE,CAAA;QAC7B,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;QAEzC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAA;QACjC,IAAI,IAAI,GAAG,CAAC,CAAA;QACZ,MAAM,QAAQ,GAAG,CAAC,KAAK,SAAS,CAAC;YAC/B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACvC,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAmB,CAAC,CAAA;gBAC7E,IAAI,IAAI,GAAG,CAAC,MAAM,CAAA;gBAClB,IAAI,IAAI,GAAG,QAAQ;oBAAE,MAAM,IAAI,oBAAoB,CAAC,uBAAuB,QAAQ,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAA;gBAC1G,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;gBAChB,MAAM,GAAG,CAAA;YACX,CAAC;QACH,CAAC,CAAC,EAAE,CAAA;QAEJ,MAAM,MAAM,GAAG,WAAW,QAAQ,CAAC,WAAW,EAAE,QAAQ,UAAU,EAAE,EAAE,CAAA;QACtE,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,CAAA;YACtB,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;YACrB,MAAM,GAAG,CAAA;QACX,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACjC,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YAC7C,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;YACrB,MAAM,IAAI,eAAe,CACvB,EAAE,cAAc,EAAE,CAAC,sBAAsB,MAAM,EAAE,CAAC,EAAE,EACpD,qDAAqD,CACtD,CAAA;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;QACzC,IAAI,CAAC;YACH,OAAO,MAAM,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE;gBACjD,MAAM,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;gBACrC,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;oBAAE,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;gBAC3E,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;gBACzF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;;oBAErB,MAAM,KAAK,MAAM,KAAK,IAAI,KAAK,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,OAAO,CAAC,QAAQ,IAAI,IAAI;cAC1F,cAAc,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,IAAI;cAC9D,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAA,MAAM,CAAC,CAAC,CAAC,GAAG,CAAA,GAAG,QAAQ,SAAS;;SAE5D,CAAC,CAAA;gBACF,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAA;gBAChC,MAAM,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC,CAAA;gBACjE,OAAO,IAAI,CAAA;YACb,CAAC,CAAC,CAAA;QACJ,CAAC;gBAAS,CAAC;YACT,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;QACvB,CAAC;IACH,CAAC;IAED,KAAK,UAAU,QAAQ,CAAC,EAAM,EAAE,QAAgB,EAAE,EAAU,EAAE,cAAuB;QACnF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,cAAc;YAC1C,CAAC,CAAC,GAAG,CAAA,gDAAgD,QAAQ,aAAa,EAAE,EAAE;YAC9E,CAAC,CAAC,GAAG,CAAA,gDAAgD,QAAQ,aAAa,EAAE,iDAAiD,CAAC,CAAA;QAChI,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAA;IACvD,CAAC;IAED,KAAK,UAAU,KAAK,CAAC,QAAuB,EAAE,EAAU;QACtD,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QACnB,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC,CAAA;IAC3E,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,QAAuB,EAAE,EAAU;QACvD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;QACtC,IAAI,IAAI,KAAK,IAAI;YAAE,MAAM,IAAI,aAAa,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QAC1D,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAA;IACjF,CAAC;IAED,KAAK,UAAU,WAAW,CAAC,QAAuB,EAAE,EAAU,EAAE,UAA4B,EAAE;QAC5F,MAAM,OAAO,GAAG,OAAO,CAAC,gBAAgB,IAAI,sBAAsB,CAAA;QAClE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,IAAI,OAAO,GAAG,kBAAkB,EAAE,CAAC;YAC9E,MAAM,IAAI,eAAe,CAAC,EAAE,gBAAgB,EAAE,CAAC,gCAAgC,kBAAkB,EAAE,CAAC,EAAE,EAAE,2CAA2C,CAAC,CAAA;QACtJ,CAAC;QACD,MAAM,WAAW,GAAW,OAAO,CAAC,WAAW,IAAI,YAAY,CAAA;QAC/D,IAAI,WAAW,KAAK,YAAY,IAAI,WAAW,KAAK,QAAQ,EAAE,CAAC;YAC7D,MAAM,IAAI,eAAe,CAAC,EAAE,WAAW,EAAE,CAAC,kCAAkC,CAAC,EAAE,EAAE,mDAAmD,CAAC,CAAA;QACvI,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;QACtC,IAAI,IAAI,KAAK,IAAI;YAAE,MAAM,IAAI,aAAa,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QAC1D,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,IAAI,SAAS,CAAA;QAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACzB,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;YACtE,gBAAgB,EAAE,OAAO,EAAE,WAAW,EAAE,WAAsC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3J,CAAC,CAAA;QACF,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC,EAAE,CAAA;IAC9D,CAAC;IAED,KAAK,UAAU,QAAQ,CAAC,QAAuB,EAAE,EAAU;QACzD,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QACnB,OAAO,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;YAChD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,8CAA8C,QAAQ,aAAa,EAAE,cAAc,CAAC,CAAA;YACrH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAA;YACnC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAA;YAChC,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC,CAAA;YACzE,OAAO,IAAI,CAAA;QACb,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,UAAU,OAAO,CAAC,UAAwB,EAAE;QAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,mBAAmB,CAAA;QAClD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,CAAC,4BAA4B,CAAC,EAAE,EAAE,iDAAiD,CAAC,CAAA;QACzH,CAAC;QACD,MAAM,IAAI,GAAG,cAAc,EAAE,CAAA;QAC7B,IAAI,OAAO,GAAG,CAAC,CAAA;QACf,IAAI,OAAO,GAAG,CAAC,CAAA;QACf,IAAI,IAAI,GAAG,CAAC,CAAA;QAEZ,MAAM,UAAU,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAM,EAAE,EAAE;YAC9C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;;;sCAGD,KAAK;;OAEpC,CAAC,CAAA;YACF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;gBAC3B,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC,CAAA;YAChF,CAAC;YACD,OAAO,GAAG,IAAI,CAAC,MAAM,CAAA;QACvB,CAAC,CAAC,CAAA;QAEF,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,CAAA;QAC1C,IAAI,KAAK,GAAwD,EAAE,CAAA;QAEnE,MAAM,MAAM,GAAG,KAAK,IAAmB,EAAE;YACvC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAM;YAC9B,MAAM,UAAU,GAAG,KAAK,CAAA;YACxB,KAAK,GAAG,EAAE,CAAA;YACV,MAAM,OAAO,GAAG,MAAM,UAAU,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;;sFAEkC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;OAC/I,CAAC,CAAA;YACF,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,CAAW,IAAI,CAAC,CAAC,GAAG,CAAW,EAAE,CAAC,CAAC,CAAA;YACvF,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;gBAC3B,IAAI,OAAO,IAAI,KAAK;oBAAE,OAAM;gBAC5B,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;oBAAE,SAAQ;gBACzD,MAAM,OAAO,GAAG,MAAM,UAAU,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAM,EAAE,EAAE;oBAC9D,MAAM,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAA;oBAC3C,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;2DACe,CAAC,CAAC,QAAQ,iBAAiB,CAAC,CAAC,MAAM;WACnF,CAAC,CAAA;oBACF,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;wBAAE,OAAO,KAAK,CAAA;oBAClC,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;oBAC3B,OAAO,IAAI,CAAA;gBACb,CAAC,CAAC,CAAA;gBACF,IAAI,OAAO;oBAAE,OAAO,IAAI,CAAC,CAAA;YAC3B,CAAC;QACH,CAAC,CAAA;QAED,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACpD,IAAI,OAAO,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK;gBAAE,MAAK;YAC5C,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YACzC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,IAAI,OAAO,GAAG,KAAK;oBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAE,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAA;gBAC5F,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG;oBAAE,MAAM,MAAM,EAAE,CAAA;YACzC,CAAC;iBAAM,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,GAAG,MAAM,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;gBAC9F,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;gBAChC,IAAI,IAAI,CAAC,CAAA;YACX,CAAC;QACH,CAAC;QACD,MAAM,MAAM,EAAE,CAAA;QACd,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;IACnC,CAAC;IAED,OAAO;QACL,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACxB,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7B,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC1B,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QAC/B,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC;QACjC,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9C,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACjD,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC;QACrC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;KACvB,CAAA;AACH,CAAC"}

package/dist/infra/storage/index.d.ts

@@ -0,0 +1,8 @@
+export { createStorage } from './handle.js';
+export { s3, encryptionHeaders, PART_SIZE } from './s3.js';
+export { local } from './local.js';
+export type { S3Config, S3Encryption } from './s3.js';
+export type { LocalConfig } from './local.js';
+export type { StorageBackend, BackendObject, BackendSignedUrlOptions } from './backend.js';
+export type { Storage, StorageConfig, StoredFile, PutOptions, SignedUrlOptions, SweepOptions, SweepResult, } from './handle.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/infra/storage/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/infra/storage/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,EAAE,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AAC1D,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACrD,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAC7C,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAA;AAC1F,YAAY,EACV,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,YAAY,EAAE,WAAW,GAC5F,MAAM,aAAa,CAAA"}

package/dist/infra/storage/index.js

@@ -0,0 +1,4 @@
+export { createStorage } from './handle.js';
+export { s3, encryptionHeaders, PART_SIZE } from './s3.js';
+export { local } from './local.js';
+//# sourceMappingURL=index.js.map

package/dist/infra/storage/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/infra/storage/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,EAAE,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AAC1D,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA"}

package/dist/infra/storage/local.d.ts

@@ -0,0 +1,16 @@
+import type { StorageBackend } from './backend.js';
+export interface LocalConfig {
+    /** Directory the files are written under; created on first write. */
+    readonly dir: string;
+}
+/**
+ * Files on local disk, for development and tests. Refused by `storage.create` when
+ * its `environment` is `production`. There are no signed URLs: `signedUrl` throws
+ * here, so serve a file by streaming `open()` through `http.file()`.
+ *
+ * In a test, give each file its own directory (`mkdtemp`) and remove it in `afterAll`;
+ * rows written through the test harness roll back with its transaction, and the
+ * leftover blobs are then plain files in that directory.
+ */
+export declare function local(config: LocalConfig): StorageBackend;
+//# sourceMappingURL=local.d.ts.map

package/dist/infra/storage/local.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local.d.ts","sourceRoot":"","sources":["../../../src/infra/storage/local.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAiB,cAAc,EAAE,MAAM,cAAc,CAAA;AAEjE,MAAM,WAAW,WAAW;IAC1B,qEAAqE;IACrE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACrB;AAED;;;;;;;;GAQG;AACH,wBAAgB,KAAK,CAAC,MAAM,EAAE,WAAW,GAAG,cAAc,CAiFzD"}

package/dist/infra/storage/local.js

@@ -0,0 +1,95 @@
+import { createReadStream, createWriteStream } from 'node:fs';
+import { copyFile, mkdir, readdir, rename, rm, stat } from 'node:fs/promises';
+import { dirname, join, resolve, sep } from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { pipeline } from 'node:stream/promises';
+import { Readable } from 'node:stream';
+/**
+ * Files on local disk, for development and tests. Refused by `storage.create` when
+ * its `environment` is `production`. There are no signed URLs: `signedUrl` throws
+ * here, so serve a file by streaming `open()` through `http.file()`.
+ *
+ * In a test, give each file its own directory (`mkdtemp`) and remove it in `afterAll`;
+ * rows written through the test harness roll back with its transaction, and the
+ * leftover blobs are then plain files in that directory.
+ */
+export function local(config) {
+    const root = resolve(config.dir);
+    function pathOf(key) {
+        const full = resolve(root, ...key.split('/'));
+        if (full !== root && !full.startsWith(root + sep)) {
+            throw new Error(`[pipework] storage local: key "${key}" escapes the storage directory.\n`);
+        }
+        return full;
+    }
+    return {
+        name: 'local',
+        async put(key, body) {
+            const target = pathOf(key);
+            await mkdir(dirname(target), { recursive: true });
+            const partial = `${target}.${randomUUID()}.partial`;
+            try {
+                await pipeline(Readable.from(body, { objectMode: false }), createWriteStream(partial));
+                await rename(partial, target);
+            }
+            catch (err) {
+                await rm(partial, { force: true });
+                throw err;
+            }
+        },
+        async exists(key) {
+            try {
+                return (await stat(pathOf(key))).isFile();
+            }
+            catch (err) {
+                if (err.code === 'ENOENT')
+                    return false;
+                throw err;
+            }
+        },
+        async copy(from, to) {
+            const target = pathOf(to);
+            await mkdir(dirname(target), { recursive: true });
+            await copyFile(pathOf(from), target);
+        },
+        async remove(key) {
+            await rm(pathOf(key), { force: true });
+        },
+        async read(key) {
+            const path = pathOf(key);
+            await stat(path);
+            return createReadStream(path);
+        },
+        async *list(prefix) {
+            const walk = async function* (dir) {
+                let entries;
+                try {
+                    entries = await readdir(dir, { withFileTypes: true });
+                }
+                catch (err) {
+                    if (err.code === 'ENOENT')
+                        return;
+                    throw err;
+                }
+                for (const entry of entries.sort((a, b) => (a.name < b.name ? -1 : 1))) {
+                    const full = join(dir, entry.name);
+                    if (entry.isDirectory())
+                        yield* walk(full);
+                    else if (entry.isFile() && !entry.name.endsWith('.partial'))
+                        yield full;
+                }
+            };
+            for await (const file of walk(root)) {
+                const key = file.slice(root.length + 1).split(sep).join('/');
+                if (!key.startsWith(prefix))
+                    continue;
+                yield { key, lastModified: (await stat(file)).mtime };
+            }
+        },
+        signedUrl() {
+            return Promise.reject(new Error('[pipework] The local storage backend has no signed URLs.\n\n' +
+                '  Stream the file with storage.open(id) and send it with http.file(), or use storage.s3(...).\n'));
+        },
+    };
+}
+//# sourceMappingURL=local.js.map