@devultur/self-host 1.0.3 → 1.2.0

package/dist/index.js

@@ -38,9 +38,10 @@ import {
   storageKey,
   storagePrefix,
   updateRequestState,
+  verifyJobLocation,
   verifyJobTicket,
   verifyViewerToken
-} from "./chunk-VF4KBW3I.js";
+} from "./chunk-PQO3X57I.js";
 import {
   ImageTransformsMode,
   WORKER_DECODABLE_TYPES,
@@ -67,39 +68,18 @@ import {
   SHA256_HEADER as SHA256_HEADER3,
   SHA256_VERIFIED_HEADER as SHA256_VERIFIED_HEADER2
 } from "@devultur/core";
-import { Hono as Hono10 } from "hono";
+import { Hono as Hono11 } from "hono";
 import { cors } from "hono/cors";
 import { logger } from "hono/logger";
 
-// src/plugin.ts
-var PHASES = ["beforeAuth", "auth", "afterAuth"];
-function assertComposable(plugins) {
-  const names = /* @__PURE__ */ new Set();
-  for (const plugin of plugins) {
-    if (names.has(plugin.name)) throw new Error(`createWorker: two plugins are named "${plugin.name}"`);
-    names.add(plugin.name);
-  }
-  if (!plugins.some((plugin) => (plugin.middleware?.auth?.length ?? 0) > 0)) {
-    throw new Error("createWorker: no plugin authenticates requests. Add workerSecretAuth() or your own auth plugin.");
-  }
-}
-function composePlugins(plugins) {
-  assertComposable(plugins);
-  return {
-    middleware: PHASES.flatMap((phase) => plugins.flatMap((plugin) => plugin.middleware?.[phase] ?? [])),
-    routes: plugins.flatMap((plugin) => plugin.routes ?? []),
-    hooks: {
-      issueCredential: plugins.flatMap((plugin) => plugin.issueCredential ? [plugin.issueCredential] : []),
-      beforeLinkRedeem: plugins.flatMap((plugin) => plugin.beforeLinkRedeem ? [plugin.beforeLinkRedeem] : [])
-    }
-  };
-}
+// src/object-lock/guard.ts
+import { isVideoRawKey } from "@devultur/core";
 
 // src/plugin-hooks.ts
 var PLUGIN_HOOKS_VARIABLE = "pluginHooks";
-var NO_HOOKS = { issueCredential: [], beforeLinkRedeem: [] };
+var NO_HOOKS = { issueCredential: [], beforeLinkRedeem: [], authorizeLockChange: [], onLockAudit: [] };
 function getPluginHooks(context) {
-  return context.get(PLUGIN_HOOKS_VARIABLE) ?? NO_HOOKS;
+  return { ...NO_HOOKS, ...context.get(PLUGIN_HOOKS_VARIABLE) };
 }
 var earliest = (current, next) => current === void 0 ? next : next === void 0 ? current : Math.min(current, next);
 async function decideCredential(context, request) {
@@ -115,11 +95,19 @@ async function decideCredential(context, request) {
 }
 async function gateLinkRedemption(context, link) {
   for (const hook of getPluginHooks(context).beforeLinkRedeem) {
-    const refusal = await hook(context, link);
-    if (refusal) return refusal;
+    const refusal2 = await hook(context, link);
+    if (refusal2) return refusal2;
   }
   return null;
 }
+async function decideLockChange(context, request) {
+  const hooks = getPluginHooks(context).authorizeLockChange;
+  for (const hook of hooks) {
+    const decision = await hook(context, request);
+    if (!decision.allow) return decision;
+  }
+  return { allow: true, isApproved: hooks.length > 0 };
+}
 function cappedExpiry(requested, cap, toUnit) {
   return cap === void 0 ? requested : Math.min(requested, toUnit(cap));
 }
@@ -127,6 +115,599 @@ function withPluginClaims(claims, decision) {
   return { ...decision.claims, ...claims };
 }
 
+// src/object-lock/audit.ts
+var LOCK_AUDIT_PREFIX = "__lock-audit/";
+function auditObjectKey(root, at, id = crypto.randomUUID()) {
+  return `${root}${LOCK_AUDIT_PREFIX}${at.toISOString().slice(0, 10)}/${at.getTime()}-${id}.json`;
+}
+async function deliver(context, root, record) {
+  const body = JSON.stringify(record);
+  const stored = context.env.MEDIA_BUCKET.put(auditObjectKey(root, new Date(record.at)), body, {
+    onlyIf: new Headers({ "If-None-Match": "*" }),
+    httpMetadata: { contentType: "application/json" }
+  });
+  const hooks = getPluginHooks(context).onLockAudit.map((hook) => hook(context, record));
+  const results = await Promise.allSettled([stored, ...hooks]);
+  for (const result of results) {
+    if (result.status === "rejected") console.error("lock audit delivery failed:", result.reason);
+  }
+}
+async function inBackground(context, task) {
+  let executionCtx;
+  try {
+    executionCtx = context.executionCtx;
+  } catch {
+  }
+  if (!executionCtx) return task;
+  executionCtx.waitUntil(task);
+}
+async function recordLockAudit(context, input) {
+  const { root = getRequestState(context).storagePrefix, actor, ...event } = input;
+  const record = {
+    at: (/* @__PURE__ */ new Date()).toISOString(),
+    ...event,
+    actor: actor === void 0 ? getRequestState(context).context ?? null : actor
+  };
+  console.log(JSON.stringify({ event: "lock.audit", ...record }));
+  await inBackground(context, deliver(context, root, record));
+}
+
+// src/object-lock/object-keys.ts
+import { decodeEncryptionMeta } from "@devultur/core";
+var DELETE_BATCH_SIZE = 1e3;
+async function listAll(bucket, options) {
+  const objects = [];
+  let cursor;
+  do {
+    const listing = await bucket.list({ ...options, ...cursor ? { cursor } : {} });
+    objects.push(...listing.objects);
+    cursor = listing.truncated ? listing.cursor : void 0;
+  } while (cursor);
+  return objects;
+}
+var isWrittenBy = (key, writtenBy) => key.uploaded.getTime() <= writtenBy.getTime();
+async function keysWrittenBy(keysBucket, prefix, writtenBy) {
+  return (await listAll(keysBucket, { prefix })).filter((key) => isWrittenBy(key, writtenBy)).map((key) => key.key);
+}
+async function objectKeysToDelete(keysBucket, fullKey, deleted) {
+  const own = await listAll(keysBucket, { prefix: `${fullKey}/`, delimiter: "/" });
+  const keys = new Set(own.filter((key) => isWrittenBy(key, deleted.uploaded)).map((key) => key.key));
+  const meta = decodeEncryptionMeta(deleted.customMetadata?.enc);
+  if (meta) keys.add(`${fullKey}/${meta.keyId}`);
+  for (const variantKey of await listAll(keysBucket, { prefix: variantPrefix(fullKey) })) keys.add(variantKey.key);
+  return [...keys];
+}
+var deleteCallsFor = (keys) => Math.ceil(keys.length / DELETE_BATCH_SIZE);
+async function deleteKeys(keysBucket, keys) {
+  for (let start = 0; start < keys.length; start += DELETE_BATCH_SIZE) {
+    await keysBucket.delete(keys.slice(start, start + DELETE_BATCH_SIZE));
+  }
+  return keys.length;
+}
+async function sweepObjectKeys(keysBucket, fullKey, deleted) {
+  return deleteKeys(keysBucket, await objectKeysToDelete(keysBucket, fullKey, deleted));
+}
+
+// src/object-lock/sidecar.ts
+import { isIsoInstant, validateLock as validateLock2 } from "@devultur/core";
+
+// src/object-lock/state.ts
+import { effectiveUntil, isLocked, validateLock } from "@devultur/core";
+var LOCK_METADATA_KEY = "lock";
+function encodeLockMetadata(lock) {
+  if (!lock || !lock.retention && !lock.hold) return void 0;
+  return JSON.stringify(lock);
+}
+function readLockMetadata(raw) {
+  if (raw === void 0) return void 0;
+  try {
+    const validation = validateLock(JSON.parse(raw));
+    if (validation.ok) return { lock: validation.lock, isUnreadable: false };
+  } catch {
+  }
+  return { lock: { hold: true }, isUnreadable: true };
+}
+function lockStateOf(object) {
+  const stored = readLockMetadata(object.customMetadata?.[LOCK_METADATA_KEY]);
+  if (!stored) return null;
+  return {
+    lock: stored.lock,
+    ...object.uploaded ? { uploadedAt: object.uploaded } : {},
+    ...stored.isUnreadable ? { isUnreadable: true } : {}
+  };
+}
+function isStateLocked(state, now) {
+  try {
+    return isLocked(state.lock, now, { uploadedAt: state.uploadedAt, holdReleasedAt: state.holdReleasedAt });
+  } catch {
+    return true;
+  }
+}
+function untilOf(state) {
+  try {
+    return effectiveUntil(state.lock, { uploadedAt: state.uploadedAt, holdReleasedAt: state.holdReleasedAt });
+  } catch {
+    return void 0;
+  }
+}
+
+// src/object-lock/sidecar.ts
+var LOCK_SIDECAR_PREFIX = "__lock/";
+function objectVersionOf(object) {
+  return object.version ?? `${object.etag}@${object.uploaded?.toISOString() ?? ""}`;
+}
+var sidecarKey = (root, key) => `${root}${LOCK_SIDECAR_PREFIX}${key}`;
+function parseSidecar(raw) {
+  try {
+    const parsed = JSON.parse(raw);
+    const lock = validateLock2(parsed.lock);
+    if (!lock.ok || typeof parsed.revision !== "number" || typeof parsed.objectVersion !== "string") return null;
+    if (parsed.holdReleasedAt !== void 0 && !isIsoInstant(parsed.holdReleasedAt)) return null;
+    return { ...parsed, lock: lock.lock };
+  } catch {
+    return null;
+  }
+}
+async function readSidecar(bucket, root, key) {
+  const object = await bucket.get(sidecarKey(root, key));
+  if (!object) return null;
+  const sidecar = parseSidecar(await object.text());
+  if (sidecar) return { sidecar, etag: object.etag };
+  const unreadable = { revision: 0, objectVersion: "*", lock: { hold: true }, updatedAt: "" };
+  return { sidecar: unreadable, etag: object.etag, isUnreadable: true };
+}
+async function writeSidecar(bucket, root, key, sidecar, previous) {
+  const onlyIf = previous ? { etagMatches: previous.etag } : new Headers({ "If-None-Match": "*" });
+  const stored = await bucket.put(sidecarKey(root, key), JSON.stringify(sidecar), {
+    onlyIf,
+    httpMetadata: { contentType: "application/json" }
+  });
+  return stored !== null;
+}
+async function effectiveLock(bucket, root, key, object) {
+  const stored = await readSidecar(bucket, root, key);
+  const bound = stored?.sidecar.objectVersion;
+  const applies = stored && (bound === "*" || bound === objectVersionOf(object));
+  if (stored && applies) {
+    const { lock, holdReleasedAt } = stored.sidecar;
+    const state2 = {
+      lock,
+      ...object.uploaded ? { uploadedAt: object.uploaded } : {},
+      ...holdReleasedAt ? { holdReleasedAt: new Date(holdReleasedAt) } : {},
+      ...stored.isUnreadable ? { isUnreadable: true } : {}
+    };
+    return { state: state2, source: "sidecar", stored };
+  }
+  const state = lockStateOf(object);
+  return { state, source: state ? "upload" : "none", stored };
+}
+function unreadableLockRefusal(state, key) {
+  if (!state?.isUnreadable) return null;
+  return Response.json(
+    {
+      error: `The lock record of ${key} can't be read; it stays held until an operator repairs it`,
+      code: "lock_record_unreadable",
+      key
+    },
+    { status: 409 }
+  );
+}
+var VIDEO_STORAGE_KEY = /^(.*?)((?:public|private)\/video\/[^/]+\/.+)$/;
+function splitVideoStorageKey(storageKey2) {
+  const match = VIDEO_STORAGE_KEY.exec(storageKey2);
+  return match ? { root: match[1] ?? "", key: match[2] ?? "" } : null;
+}
+
+// src/object-lock/guard.ts
+var RESERVED_LOCK_PREFIXES = ["__lock/", "__lock-audit/"];
+function isReservedLockKey(key) {
+  const normalized = `${key.replace(/^\/+/, "")}/`;
+  return RESERVED_LOCK_PREFIXES.some((prefix) => normalized.startsWith(prefix));
+}
+function reservedKeyResponse(context, key) {
+  return context.json({ error: `${key} is under a reserved prefix`, code: "reserved_key", key }, 400);
+}
+function routeKeyOf(path) {
+  const key = path.split("/").slice(3).join("/");
+  try {
+    return decodeURIComponent(key);
+  } catch {
+    return key;
+  }
+}
+var rejectReservedLockPaths = async (context, next) => {
+  const key = routeKeyOf(context.req.path);
+  if (isReservedLockKey(key)) return reservedKeyResponse(context, key);
+  await next();
+};
+var VIDEO_KEY = /^((?:public|private)\/video\/[^/]+)(?:\/|$)/;
+function lockSubjectOf(key) {
+  if (isVariantKey(key)) return null;
+  if (isVideoRawKey(key)) return { kind: "original", key };
+  const video = VIDEO_KEY.exec(key);
+  if (video) return { kind: "video", rawPrefix: `${video[1]}/raw/` };
+  return { kind: "original", key };
+}
+function protectsDerived(state) {
+  const derivatives = state.lock.retention?.derivatives ?? "inherit";
+  return derivatives === "inherit";
+}
+async function lockedObject(bucket, root, key, object, now) {
+  const { state } = await effectiveLock(bucket, root, key, object);
+  return state && isStateLocked(state, now) ? { key, state } : null;
+}
+async function lockedOriginal(bucket, root, key, now) {
+  const object = await bucket.head(`${root}${key}`);
+  return object ? lockedObject(bucket, root, key, object, now) : null;
+}
+async function lockedRaw(bucket, root, rawPrefix, now) {
+  let cursor;
+  do {
+    const listing = await bucket.list({ prefix: `${root}${rawPrefix}`, cursor });
+    for (const listed of listing.objects) {
+      const key = listed.key.slice(root.length);
+      const object = await bucket.head(listed.key);
+      const state = object ? (await effectiveLock(bucket, root, key, object)).state : null;
+      if (state && protectsDerived(state) && isStateLocked(state, now)) return { key, state };
+    }
+    cursor = listing.truncated ? listing.cursor : void 0;
+  } while (cursor);
+  return null;
+}
+function findLockedOriginal(bucket, root, subject, now) {
+  return subject.kind === "original" ? lockedOriginal(bucket, root, subject.key, now) : lockedRaw(bucket, root, subject.rawPrefix, now);
+}
+function retentionActive(context, locked, op) {
+  const { lock } = locked.state;
+  const until = untilOf(locked.state);
+  const verb = op === "delete" ? "deleted" : "overwritten";
+  return context.json(
+    {
+      error: `${locked.key} is retained and can't be ${verb}`,
+      code: "retention_active",
+      key: locked.key,
+      ...lock.retention ? { mode: lock.retention.mode } : {},
+      ...until ? { until } : {},
+      hold: lock.hold === true
+    },
+    409
+  );
+}
+async function assertWritable(context, keys, op, root = getRequestState(context).storagePrefix) {
+  const reserved = keys.find(isReservedLockKey);
+  if (reserved !== void 0) return reservedKeyResponse(context, reserved);
+  const now = /* @__PURE__ */ new Date();
+  const checked = /* @__PURE__ */ new Set();
+  for (const key of keys) {
+    const subject = lockSubjectOf(key);
+    if (!subject) continue;
+    const subjectId = subject.kind === "original" ? subject.key : subject.rawPrefix;
+    if (checked.has(subjectId)) continue;
+    checked.add(subjectId);
+    const locked = await findLockedOriginal(context.env.MEDIA_BUCKET, root, subject, now);
+    if (!locked) continue;
+    const requested = key === locked.key ? [key] : [key, locked.key];
+    await recordLockAudit(context, {
+      action: op === "delete" ? "delete_rejected" : "overwrite_rejected",
+      keys: requested,
+      before: locked.state.lock,
+      after: null,
+      outcome: "rejected",
+      reason: "retention_active",
+      root
+    });
+    return retentionActive(context, locked, op);
+  }
+  return null;
+}
+var DELETE_BATCH_SIZE2 = 1e3;
+async function guardedDeletePrefix(context, prefix) {
+  const root = getRequestState(context).storagePrefix;
+  const storageKeys = [];
+  let cursor;
+  do {
+    const listing = await context.env.MEDIA_BUCKET.list({ prefix: storageKey(context, prefix), cursor });
+    storageKeys.push(...listing.objects.map((object) => object.key));
+    cursor = listing.truncated ? listing.cursor : void 0;
+  } while (cursor);
+  const keys = storageKeys.map((key) => key.slice(root.length));
+  const blocked = await assertWritable(context, keys, "delete");
+  if (blocked) return { blocked };
+  for (let start = 0; start < storageKeys.length; start += DELETE_BATCH_SIZE2) {
+    await context.env.MEDIA_BUCKET.delete(storageKeys.slice(start, start + DELETE_BATCH_SIZE2));
+  }
+  return { deletedCount: storageKeys.length };
+}
+async function deleteKeysFor(context, objectKey, deleted) {
+  const blocked = await assertWritable(context, [objectKey], "delete");
+  if (blocked) return { blocked };
+  const keysBucket = context.env.KEYS_BUCKET;
+  if (!keysBucket) return { deletedCount: 0 };
+  return { deletedCount: await sweepObjectKeys(keysBucket, storageKey(context, objectKey), deleted) };
+}
+async function deleteFolderKeys(context, videoFolder) {
+  const blocked = await assertWritable(context, [videoFolder], "delete");
+  if (blocked) return { blocked };
+  if (!context.env.KEYS_BUCKET) return { deletedCount: 0 };
+  return { deletedCount: await deletePrefix(context.env.KEYS_BUCKET, `${storageKey(context, videoFolder)}/`) };
+}
+
+// src/object-lock/lock-route.ts
+import { canChange as canChange2, effectiveUntil as effectiveUntil2 } from "@devultur/core";
+import { Hono } from "hono";
+
+// src/object-lock/change.ts
+import { canChange, validateLock as validateLock3 } from "@devultur/core";
+var BODY_FIELDS = /* @__PURE__ */ new Set(["mode", "until", "period", "derivatives", "remove", "bypassGovernance"]);
+function nextLock(before, body) {
+  const unknown = Object.keys(body).filter((field) => !BODY_FIELDS.has(field));
+  if (unknown.length > 0) return { ok: false, errors: unknown.map((field) => `${field}: unknown field`) };
+  if (body.remove !== void 0 && body.remove !== true) return { ok: false, errors: ["remove: must be true"] };
+  const hold = before?.hold === true;
+  if (body.remove === true) return { ok: true, lock: { hold } };
+  const current = before?.retention;
+  const isExpiryChanged = body.until !== void 0 || body.period !== void 0;
+  const retention = {
+    mode: body.mode ?? current?.mode,
+    ...isExpiryChanged ? {
+      ...body.until !== void 0 ? { until: body.until } : {},
+      ...body.period !== void 0 ? { period: body.period } : {}
+    } : {
+      ...current?.until ? { until: current.until } : {},
+      ...current?.period ? { period: current.period } : {}
+    },
+    derivatives: body.derivatives ?? current?.derivatives ?? "inherit"
+  };
+  const validation = validateLock3({ retention, hold });
+  if (!validation.ok) return validation;
+  return { ok: true, lock: validation.lock };
+}
+var timingOf = (state) => ({
+  uploadedAt: state?.uploadedAt,
+  holdReleasedAt: state?.holdReleasedAt
+});
+function classifyChange(state, after, now) {
+  const before = state?.lock ?? {};
+  const isActive = canChange(before, { hold: before.hold }, { privileged: false, now, timing: timingOf(state) });
+  if (isActive.ok) return after.retention ? "set" : "remove";
+  if (!after.retention) return "remove";
+  const change = canChange(before, after, { privileged: false, now, timing: timingOf(state) });
+  return change.ok ? "extend" : "shorten";
+}
+
+// src/object-lock/hold.ts
+import { validateLock as validateLock4 } from "@devultur/core";
+var HOLD_PAGE_SIZE = 50;
+var isKeyList = (value) => Array.isArray(value) && value.every((key) => typeof key === "string" && key.length > 0);
+async function targetsOf(context, body) {
+  if (body.keys === void 0 === (body.prefix === void 0)) return { error: "pass either keys or prefix" };
+  if (body.keys !== void 0) {
+    if (!isKeyList(body.keys) || body.keys.length === 0) return { error: "keys must be a non-empty list of keys" };
+    if (body.keys.length > HOLD_PAGE_SIZE) return { error: `keys may list at most ${HOLD_PAGE_SIZE} keys` };
+    if (body.keys.some(isReservedLockKey)) return { error: "keys may not be under a reserved prefix" };
+    return { keys: [...new Set(body.keys)] };
+  }
+  if (typeof body.prefix !== "string" || body.prefix === "" || isReservedLockKey(body.prefix)) {
+    return { error: "prefix must be a non-empty key prefix outside the reserved ones" };
+  }
+  const cursor = typeof body.cursor === "string" ? body.cursor : void 0;
+  const listing = await context.env.MEDIA_BUCKET.list({
+    prefix: storageKey(context, body.prefix),
+    limit: HOLD_PAGE_SIZE,
+    ...cursor ? { cursor } : {}
+  });
+  const root = getRequestState(context).storagePrefix;
+  const keys = listing.objects.map((object) => object.key.slice(root.length)).filter((key) => !isVariantKey(key) && !isReservedLockKey(key));
+  return { keys, prefix: body.prefix, ...listing.truncated ? { cursor: listing.cursor } : {} };
+}
+async function applyHold(context, key, hold, now) {
+  const root = getRequestState(context).storagePrefix;
+  const object = await context.env.MEDIA_BUCKET.head(storageKey(context, key));
+  if (!object) return { updated: false, reason: "not_found" };
+  const effective = await effectiveLock(context.env.MEDIA_BUCKET, root, key, object);
+  const before = effective.state?.lock ?? { hold: false };
+  if (before.hold === true === hold) return { updated: false, reason: "unchanged" };
+  if (effective.state?.isUnreadable) {
+    await recordLockAudit(context, {
+      action: "release",
+      keys: [key],
+      before,
+      after: { ...before, hold },
+      outcome: "rejected",
+      reason: "lock_record_unreadable"
+    });
+    return { updated: false, reason: "lock_record_unreadable" };
+  }
+  const validated = validateLock4({ ...before, hold });
+  const after = validated.ok ? validated.lock : { ...before, hold };
+  const previous = effective.source === "sidecar" ? effective.stored?.sidecar : void 0;
+  const holdReleasedAt = hold ? previous?.holdReleasedAt : now.toISOString();
+  const sidecar = {
+    revision: (effective.stored?.sidecar.revision ?? 0) + 1,
+    objectVersion: objectVersionOf(object),
+    lock: after,
+    ...holdReleasedAt ? { holdReleasedAt } : {},
+    updatedAt: now.toISOString()
+  };
+  const action = hold ? "hold" : "release";
+  if (!await writeSidecar(context.env.MEDIA_BUCKET, root, key, sidecar, effective.stored)) {
+    await recordLockAudit(context, {
+      action,
+      keys: [key],
+      before,
+      after,
+      outcome: "rejected",
+      reason: "lock_conflict"
+    });
+    return { updated: false, reason: "lock_conflict" };
+  }
+  await recordLockAudit(context, { action, keys: [key], before, after, outcome: "applied" });
+  return { updated: true };
+}
+async function handleHold(context) {
+  const body = await context.req.json().catch(() => null) ?? {};
+  if (typeof body.hold !== "boolean")
+    return context.json({ error: "hold must be a boolean", code: "invalid_hold" }, 400);
+  const targets = await targetsOf(context, body);
+  if ("error" in targets) return context.json({ error: targets.error, code: "invalid_hold" }, 400);
+  const hold = body.hold;
+  const decision = await decideLockChange(context, {
+    action: hold ? "hold" : "release",
+    keys: targets.keys,
+    ...targets.prefix ? { prefix: targets.prefix } : {},
+    before: null,
+    after: { hold }
+  });
+  if (!decision.allow) {
+    await recordLockAudit(context, {
+      action: hold ? "hold" : "release",
+      keys: targets.keys,
+      before: null,
+      after: { hold },
+      outcome: "rejected",
+      reason: "hook_refused"
+    });
+    return decision.response;
+  }
+  const now = /* @__PURE__ */ new Date();
+  const updated = [];
+  const skipped = [];
+  for (const key of targets.keys) {
+    const outcome = await applyHold(context, key, hold, now);
+    if (outcome.updated) updated.push(key);
+    else skipped.push({ key, reason: outcome.reason });
+  }
+  return context.json({ updated, skipped, ...targets.cursor ? { cursor: targets.cursor } : {} });
+}
+
+// src/object-lock/lock-route.ts
+function lockView(key, effective) {
+  const lock = effective.state?.lock;
+  let until;
+  try {
+    until = lock ? effectiveUntil2(lock, timingOf(effective.state)) : void 0;
+  } catch {
+  }
+  return {
+    key,
+    mode: lock?.retention?.mode ?? null,
+    until: until ?? null,
+    period: lock?.retention?.period ?? null,
+    hold: lock?.hold === true,
+    derivatives: lock?.retention ? lock.retention.derivatives ?? "inherit" : null,
+    source: effective.source,
+    revision: effective.source === "sidecar" ? effective.stored?.sidecar.revision ?? null : null
+  };
+}
+async function loadTarget(context) {
+  const key = context.req.param("key") ?? "";
+  const root = getRequestState(context).storagePrefix;
+  const object = await context.env.MEDIA_BUCKET.head(storageKey(context, key));
+  if (!object) return { key, root, object: null, effective: null };
+  return { key, root, object, effective: await effectiveLock(context.env.MEDIA_BUCKET, root, key, object) };
+}
+var lockRoute = new Hono();
+lockRoute.use("*", async (context, next) => {
+  if (!isAuthenticated(context)) return context.json({ error: "Unauthorized" }, 401);
+  await next();
+});
+lockRoute.post("/hold", handleHold);
+lockRoute.get("/:key{.+}", async (context) => {
+  const { key, effective } = await loadTarget(context);
+  if (!effective) return context.json({ error: "Not found" }, 404);
+  return context.json(lockView(key, effective));
+});
+lockRoute.put("/:key{.+}", async (context) => {
+  const body = await context.req.json().catch(() => null) ?? {};
+  const { key, root, object, effective } = await loadTarget(context);
+  if (!object || !effective) return context.json({ error: "Not found" }, 404);
+  const before = effective.state?.lock ?? null;
+  const next = nextLock(before, body);
+  if (!next.ok) return context.json({ error: next.errors.join("; "), code: "invalid_lock" }, 400);
+  const now = /* @__PURE__ */ new Date();
+  const action = classifyChange(effective.state, next.lock, now);
+  const audit = { action, keys: [key], before, after: next.lock, root };
+  const unreadable = unreadableLockRefusal(effective.state, key);
+  if (unreadable) {
+    await recordLockAudit(context, { ...audit, outcome: "rejected", reason: "lock_record_unreadable" });
+    return unreadable;
+  }
+  const decision = await decideLockChange(context, { action, keys: [key], before, after: next.lock });
+  if (!decision.allow) {
+    await recordLockAudit(context, { ...audit, outcome: "rejected", reason: "hook_refused" });
+    return decision.response;
+  }
+  const isPrivileged = body.bypassGovernance === true && decision.isApproved;
+  const change = canChange2(before ?? {}, next.lock, {
+    privileged: isPrivileged,
+    now,
+    timing: timingOf(effective.state)
+  });
+  if (!change.ok) {
+    await recordLockAudit(context, { ...audit, outcome: "rejected", reason: change.reason });
+    return refusal(context, key, change.reason);
+  }
+  const sidecar = nextSidecar(effective, objectVersionOf(object), next.lock, now);
+  if (!await writeSidecar(context.env.MEDIA_BUCKET, root, key, sidecar, effective.stored)) {
+    await recordLockAudit(context, { ...audit, outcome: "rejected", reason: "lock_conflict" });
+    return context.json({ error: `The lock of ${key} changed meanwhile; retry`, code: "lock_conflict", key }, 409);
+  }
+  await recordLockAudit(context, { ...audit, outcome: "applied", ...change.bypass ? { bypass: true } : {} });
+  const state = { ...effective.state ?? {}, lock: next.lock };
+  return context.json(lockView(key, { state, source: "sidecar", stored: { sidecar, etag: "" } }));
+});
+function nextSidecar(effective, objectVersion, lock, now) {
+  const previous = effective.source === "sidecar" ? effective.stored?.sidecar : void 0;
+  return {
+    revision: (effective.stored?.sidecar.revision ?? 0) + 1,
+    objectVersion,
+    lock,
+    ...previous?.holdReleasedAt ? { holdReleasedAt: previous.holdReleasedAt } : {},
+    updatedAt: now.toISOString()
+  };
+}
+function refusal(context, key, reason) {
+  if (reason === "lock_privilege_required") {
+    return context.json(
+      {
+        error: "Shortening or removing a governance retention needs bypassGovernance and an authorizeLockChange approval",
+        code: reason,
+        key
+      },
+      403
+    );
+  }
+  return context.json({ error: `The compliance retention of ${key} can only be extended`, code: reason, key }, 409);
+}
+
+// src/plugin.ts
+var PHASES = ["beforeAuth", "auth", "afterAuth"];
+function assertComposable(plugins) {
+  const names = /* @__PURE__ */ new Set();
+  for (const plugin of plugins) {
+    if (names.has(plugin.name)) throw new Error(`createWorker: two plugins are named "${plugin.name}"`);
+    names.add(plugin.name);
+  }
+  if (!plugins.some((plugin) => (plugin.middleware?.auth?.length ?? 0) > 0)) {
+    throw new Error("createWorker: no plugin authenticates requests. Add workerSecretAuth() or your own auth plugin.");
+  }
+}
+function composePlugins(plugins) {
+  assertComposable(plugins);
+  return {
+    middleware: PHASES.flatMap((phase) => plugins.flatMap((plugin) => plugin.middleware?.[phase] ?? [])),
+    routes: plugins.flatMap((plugin) => plugin.routes ?? []),
+    hooks: {
+      issueCredential: plugins.flatMap((plugin) => plugin.issueCredential ? [plugin.issueCredential] : []),
+      beforeLinkRedeem: plugins.flatMap((plugin) => plugin.beforeLinkRedeem ? [plugin.beforeLinkRedeem] : []),
+      authorizeLockChange: plugins.flatMap(
+        (plugin) => plugin.authorizeLockChange ? [plugin.authorizeLockChange] : []
+      ),
+      onLockAudit: plugins.flatMap((plugin) => plugin.onLockAudit ? [plugin.onLockAudit] : [])
+    }
+  };
+}
+
 // src/plugins/credential-policy.ts
 function credentialPolicy(options = {}) {
   return {
@@ -140,11 +721,11 @@ function credentialPolicy(options = {}) {
 }
 
 // src/plugins/download-links.ts
-import { Hono as Hono2 } from "hono";
+import { Hono as Hono3 } from "hono";
 
 // src/routes/download.ts
 import { contentDispositionAttachment as contentDispositionAttachment2, relativeMediaPath, TokenScope } from "@devultur/core";
-import { Hono } from "hono";
+import { Hono as Hono2 } from "hono";
 
 // src/download-link.ts
 var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
@@ -224,7 +805,7 @@ function addRouteResult(context, result) {
 import {
   AES_BLOCK_BYTES,
   createDecryptStream,
-  decodeEncryptionMeta,
+  decodeEncryptionMeta as decodeEncryptionMeta2,
   decryptChunk,
   EXPIRES_AT_HEADER,
   REPR_DIGEST_HEADER,
@@ -242,7 +823,13 @@ var ObjectMeta = {
   /** Epoch ms. From then on the gate responds 410 (and an external sweeper may delete it). */
   EXPIRES_AT: "expiresAt"
 };
-var WORKER_METADATA_KEYS = /* @__PURE__ */ new Set(["security", "enc", ObjectMeta.EXPIRES_AT.toLowerCase(), "derivedfrom"]);
+var WORKER_METADATA_KEYS = /* @__PURE__ */ new Set([
+  "security",
+  "enc",
+  ObjectMeta.EXPIRES_AT.toLowerCase(),
+  "derivedfrom",
+  LOCK_METADATA_KEY
+]);
 function isWorkerMetadataKey(key) {
   const lowerKey = key.toLowerCase();
   return lowerKey.startsWith(ObjectMeta.SHA256) || WORKER_METADATA_KEYS.has(lowerKey);
@@ -251,8 +838,8 @@ function allowedUploadMetadata(metadata) {
   if (!metadata) return {};
   return Object.fromEntries(Object.entries(metadata).filter(([key]) => !isWorkerMetadataKey(key)));
 }
-function targetFailure(context, failure3) {
-  return context.json({ error: failure3.error, code: failure3.code }, failure3.status);
+function targetFailure(context, failure4) {
+  return context.json({ error: failure4.error, code: failure4.code }, failure4.status);
 }
 function alreadyExists(context, key) {
   return context.json(
@@ -278,14 +865,19 @@ async function digestBody(body, declared, header) {
   if (expected && expected !== actual) return { mismatch: { expected, actual } };
   return { sha256: actual };
 }
+function lockMetadata(lock) {
+  const encoded = encodeLockMetadata(lock);
+  return encoded ? { [LOCK_METADATA_KEY]: encoded } : {};
+}
 function integrityMetadata(sha256, isVerified, expiresAt) {
   return {
     ...sha256 ? { [ObjectMeta.SHA256]: sha256, [ObjectMeta.SHA256_VERIFIED]: String(isVerified) } : {},
     ...expiresAt ? { [ObjectMeta.EXPIRES_AT]: String(expiresAt) } : {}
   };
 }
-function createOnlyCondition() {
-  return new Headers({ "If-None-Match": "*" });
+function expiryMetadataOf(customMetadata) {
+  const expiresAt = customMetadata?.[ObjectMeta.EXPIRES_AT];
+  return expiresAt ? { [ObjectMeta.EXPIRES_AT]: expiresAt } : {};
 }
 async function discardStaleVariants(bucket, pending) {
   if (!pending?.overwrite) return;
@@ -293,9 +885,13 @@ async function discardStaleVariants(bucket, pending) {
 }
 
 // src/routes/object-response.ts
-function isObjectExpired(customMetadata, now = Date.now()) {
+function objectExpiresAt(customMetadata) {
   const expiresAt = Number(customMetadata?.[ObjectMeta.EXPIRES_AT]);
-  return Number.isFinite(expiresAt) && expiresAt > 0 && expiresAt <= now;
+  return Number.isFinite(expiresAt) && expiresAt > 0 ? expiresAt : void 0;
+}
+function isObjectExpired(customMetadata, now = Date.now()) {
+  const expiresAt = objectExpiresAt(customMetadata);
+  return expiresAt !== void 0 && expiresAt <= now;
 }
 function expiredResponse() {
   return Response.json({ error: "This file has expired", code: "expired" }, { status: 410 });
@@ -352,7 +948,7 @@ async function streamObject(input) {
   headers.set("ETag", object.httpEtag);
   headers.set("Accept-Ranges", "bytes");
   applyIntegrityHeaders(headers, object.customMetadata);
-  const enc = decodeEncryptionMeta(object.customMetadata?.enc);
+  const enc = decodeEncryptionMeta2(object.customMetadata?.enc);
   const loaded = enc ? await loadStorageKey(input.keysBucket, input.fullKey, enc.keyId) : null;
   if (enc && !loaded) {
     return { response: Response.json({ error: "Decryption key unavailable" }, { status: 500 }), kind: "other" };
@@ -410,8 +1006,8 @@ async function handleDownloadLink(context) {
   const object = await context.env.MEDIA_BUCKET.head(fullKey);
   if (!object) return context.json({ error: "Not found" }, 404);
   if (isObjectExpired(object.customMetadata)) return expiredResponse();
-  const objectExpiresAt = Number(object.customMetadata?.expiresAt) || Infinity;
-  const requestedExpiresAt = Math.min(Date.now() + parsed.expiresIn * 1e3, objectExpiresAt);
+  const objectExpiresAt2 = Number(object.customMetadata?.expiresAt) || Infinity;
+  const requestedExpiresAt = Math.min(Date.now() + parsed.expiresIn * 1e3, objectExpiresAt2);
   const decision = await decideCredential(context, {
     kind: "download-link",
     scopes: [TokenScope.MEDIA_READ],
@@ -456,7 +1052,7 @@ async function gateRedemption(context, stub) {
   if (!peeked.ok) return relayLinkFailure(peeked);
   return gateLinkRedemption(context, linkInfoOf(await peeked.json()));
 }
-var download = new Hono();
+var download = new Hono2();
 download.get("/:linkId", async (context) => {
   if (context.req.method === "HEAD") return new Response(null, { status: 405, headers: { Allow: "GET" } });
   const linkId = context.req.param("linkId");
@@ -490,7 +1086,7 @@ download.get("/:linkId", async (context) => {
 
 // src/plugins/download-links.ts
 function downloadLinks() {
-  const issue = new Hono2().post("/", handleDownloadLink);
+  const issue = new Hono3().post("/", handleDownloadLink);
   return {
     name: "download-links",
     routes: [
@@ -510,7 +1106,11 @@ function staticConfig(config) {
 }
 
 // src/routes/token-upload.ts
-import { assetRelativePath as assetRelativePath2, normalizeAssetPrefix } from "@devultur/core";
+import {
+  assetRelativePath as assetRelativePath2,
+  normalizeAssetPrefix,
+  validateLock as validateLock5
+} from "@devultur/core";
 
 // src/token-claims.ts
 function audienceClaim(storagePrefix2) {
@@ -671,18 +1271,26 @@ function parseVisibility(value) {
   if (value === void 0 || value === null) return "private";
   return value === "public" || value === "private" ? value : null;
 }
+function lockClaim(value) {
+  if (value === void 0) return void 0;
+  const validation = validateLock5(value);
+  return validation.ok ? validation.lock : null;
+}
 function uploadGrantFromClaims(payload) {
   if (payload.typ !== UPLOAD_TOKEN_TYPE || typeof payload.res !== "string" || typeof payload.jti !== "string") {
     return null;
   }
   if (payload.visibility !== "public" && payload.visibility !== "private") return null;
+  const lock = lockClaim(payload.lock);
+  if (lock === null) return null;
   return {
     tokenId: payload.jti,
     pathPrefix: payload.res,
     visibility: payload.visibility,
     ...isPositiveInteger(payload.max_bytes) ? { maxBytes: payload.max_bytes } : {},
     ...isPositiveInteger(payload.max_files) ? { maxFiles: payload.max_files } : {},
-    ...isPositiveInteger(payload.file_ttl) ? { fileExpiresIn: payload.file_ttl } : {}
+    ...isPositiveInteger(payload.file_ttl) ? { fileExpiresIn: payload.file_ttl } : {},
+    ...lock ? { lock } : {}
   };
 }
 var badRequest = (context, code, error) => context.json({ error, code }, 400);
@@ -703,6 +1311,8 @@ async function handleUploadToken(context) {
   if (fileExpiresIn === null) {
     return badRequest(context, "invalid_file_expires_in", "fileExpiresIn must be a positive number of seconds");
   }
+  const lock = body.lock === void 0 ? { ok: true, lock: void 0 } : validateLock5(body.lock);
+  if (!lock.ok) return badRequest(context, "invalid_lock", lock.errors.join("; "));
   const pathPrefix = assetRelativePath2(prefix);
   const now = Math.floor(Date.now() / 1e3);
   const requestedExp = now + (expiresIn ?? DEFAULT_UPLOAD_TOKEN_TTL_SECONDS);
@@ -726,7 +1336,8 @@ async function handleUploadToken(context) {
       exp: expiresAt,
       ...maxBytes ? { max_bytes: maxBytes } : {},
       ...maxFiles ? { max_files: maxFiles } : {},
-      ...fileExpiresIn ? { file_ttl: fileExpiresIn } : {}
+      ...fileExpiresIn ? { file_ttl: fileExpiresIn } : {},
+      ...lock.lock ? { lock: lock.lock } : {}
     },
     decision
   );
@@ -738,7 +1349,8 @@ async function handleUploadToken(context) {
     expiresAt,
     ...maxBytes ? { maxBytes } : {},
     ...maxFiles ? { maxFiles } : {},
-    ...fileExpiresIn ? { fileExpiresIn } : {}
+    ...fileExpiresIn ? { fileExpiresIn } : {},
+    ...lock.lock ? { lock: lock.lock } : {}
   });
 }
 
@@ -821,9 +1433,46 @@ function defaultPlugins(config = {}) {
 
 // src/routes/assets.ts
 import { ASSET_NAMESPACE, normalizeAssetPrefix as normalizeAssetPrefix2 } from "@devultur/core";
-import { Hono as Hono3 } from "hono";
+import { Hono as Hono4 } from "hono";
+
+// src/object-lock/delivery.ts
+import { effectiveUntil as effectiveUntil3 } from "@devultur/core";
+var LOCK_UNTIL_HEADER = "x-devultur-lock-until";
+var LOCK_HOLD_HEADER = "x-devultur-lock-hold";
+async function lockHeaders(context, key, object) {
+  const root = getRequestState(context).storagePrefix;
+  const { state } = await effectiveLock(context.env.MEDIA_BUCKET, root, key, object);
+  if (!state || !isStateLocked(state, /* @__PURE__ */ new Date())) return [];
+  const headers = [];
+  try {
+    const until = effectiveUntil3(state.lock, timingOf(state));
+    if (until) headers.push([LOCK_UNTIL_HEADER, until]);
+  } catch {
+  }
+  if (state.lock.hold) headers.push([LOCK_HOLD_HEADER, "true"]);
+  return headers;
+}
+async function retainedOf(bucket, location, object) {
+  const { state } = await effectiveLock(bucket, location.root, location.key, object);
+  if (!state || !isStateLocked(state, /* @__PURE__ */ new Date())) return null;
+  let until;
+  try {
+    until = effectiveUntil3(state.lock, timingOf(state));
+  } catch {
+  }
+  return { ...until ? { until } : {}, hold: state.lock.hold === true };
+}
+async function expiredRefusal(bucket, location, object, isOwnerRead) {
+  if (!isObjectExpired(object.customMetadata)) return null;
+  if (isOwnerRead && await retainedOf(bucket, location, object) !== null) return null;
+  return expiredResponse();
+}
+
+// src/routes/assets.ts
 var MAX_ASSET_LIST_LIMIT = 1e3;
+var MAX_EXPIRED_LOOKUPS = 32;
 var VISIBILITY_ORDER = ["private", "public"];
+var RESUME_AFTER_MARK = "~";
 function parseListPrefix(raw) {
   if (!raw?.trim()) return "";
   return normalizeAssetPrefix2(raw);
@@ -834,7 +1483,12 @@ function parseListCursor(raw, visibilities) {
   const visibility = raw.slice(0, separator);
   if (separator < 0 || !visibilities.includes(visibility)) return null;
   const cursor = raw.slice(separator + 1);
-  return { visibility, ...cursor ? { cursor } : {} };
+  if (!cursor.startsWith(RESUME_AFTER_MARK)) return { visibility, ...cursor ? { cursor } : {} };
+  try {
+    return { visibility, startAfter: decodeURIComponent(cursor.slice(RESUME_AFTER_MARK.length)) };
+  } catch {
+    return null;
+  }
 }
 function parseLimit(raw) {
   const limit = Number(raw);
@@ -861,7 +1515,32 @@ function nextCursor(listing, position, visibilities) {
   const next = visibilities[visibilities.indexOf(position.visibility) + 1];
   return next ? `${next}:` : null;
 }
-var assets = new Hono3();
+var resumeCursor = (visibility, afterKey) => `${visibility}:${RESUME_AFTER_MARK}${encodeURIComponent(afterKey)}`;
+var expiredEntry = (entry, retained) => ({
+  ...entry,
+  expired: true,
+  ...retained.until ? { retainedUntil: retained.until } : {},
+  ...retained.hold ? { hold: true } : {}
+});
+async function listedEntries(bucket, listing, storageRoot, visibility) {
+  const page = { objects: [] };
+  let lookups = 0;
+  let lastKey;
+  for (const object of listing.objects) {
+    const entry = toEntry(object, storageRoot, visibility);
+    if (isObjectExpired(object.customMetadata)) {
+      if (lookups === MAX_EXPIRED_LOOKUPS) return { ...page, cutAfter: lastKey };
+      lookups += 1;
+      const retained = await retainedOf(bucket, { root: storageRoot, key: entry.key }, object);
+      if (retained) page.objects.push(expiredEntry(entry, retained));
+    } else {
+      page.objects.push(entry);
+    }
+    lastKey = entry.key;
+  }
+  return page;
+}
+var assets = new Hono4();
 assets.get("/", async (context) => {
   const prefix = parseListPrefix(context.req.query("prefix"));
   if (prefix === null) {
@@ -879,23 +1558,251 @@ assets.get("/", async (context) => {
     prefix: `${storageRoot}${position.visibility}/${ASSET_NAMESPACE}/${prefix}`,
     limit: parseLimit(context.req.query("limit")),
     ...position.cursor ? { cursor: position.cursor } : {},
+    ...position.startAfter ? { startAfter: `${storageRoot}${position.startAfter}` } : {},
     include: ["httpMetadata", "customMetadata"]
   };
   const listing = await context.env.MEDIA_BUCKET.list(listOptions);
-  const objects = listing.objects.filter((object) => !isObjectExpired(object.customMetadata)).map((object) => toEntry(object, storageRoot, position.visibility));
-  return context.json({ objects, cursor: nextCursor(listing, position, visibilities) });
+  const page = await listedEntries(context.env.MEDIA_BUCKET, listing, storageRoot, position.visibility);
+  const cursor = page.cutAfter ? resumeCursor(position.visibility, page.cutAfter) : nextCursor(listing, position, visibilities);
+  return context.json({ objects: page.objects, cursor });
 });
 
 // src/routes/captions.ts
 import {
   captionPath,
   createDecryptStream as createDecryptStream2,
-  decodeEncryptionMeta as decodeEncryptionMeta2,
+  decodeEncryptionMeta as decodeEncryptionMeta5,
   extractId,
   resolveSecurity,
   visibilityFromKey
 } from "@devultur/core";
-import { Hono as Hono5 } from "hono";
+import { Hono as Hono6 } from "hono";
+
+// src/keys-bucket.ts
+import { decodeEncryptionMeta as decodeEncryptionMeta3 } from "@devultur/core";
+var KEYS_BUCKET_MISSING_CODE = "keys_bucket_missing";
+function isKeysBucketMissing(shouldEncrypt, env) {
+  return shouldEncrypt && !env.KEYS_BUCKET;
+}
+function keysBucketMissing(context) {
+  console.error("[encrypt] security.encrypt is on but KEYS_BUCKET is not bound: refusing to store a private file");
+  return context.json(
+    { error: "Encryption at rest is on but KEYS_BUCKET is not bound", code: KEYS_BUCKET_MISSING_CODE },
+    503
+  );
+}
+var ENCRYPTION_KEY_MISSING_CODE = "encryption_key_missing";
+async function hasEncryptionKey(keysBucket, objectStorageKey, enc) {
+  const meta = decodeEncryptionMeta3(enc);
+  if (!meta) return true;
+  if (!keysBucket) return false;
+  return await keysBucket.head(`${objectStorageKey}/${meta.keyId}`) !== null;
+}
+function encryptionKeyMissing(context, key) {
+  console.error(`[encrypt] the encryption key of ${key} is gone: refusing to store an object nobody could decrypt`);
+  return context.json(
+    { error: `The encryption key of ${key} was deleted; upload it again`, code: ENCRYPTION_KEY_MISSING_CODE, key },
+    500
+  );
+}
+
+// src/object-lock/overwrite.ts
+import { decodeEncryptionMeta as decodeEncryptionMeta4, TranscodeStatus as TranscodeStatus2 } from "@devultur/core";
+
+// src/transcode/status.ts
+import { TranscodeStatus } from "@devultur/core";
+var statusKey = (videoId) => `${KvPrefix.TRANSCODE_STATUS}:${videoId}`;
+function statusChangeFor(event) {
+  switch (event.event) {
+    case "transcode.started":
+      return { status: TranscodeStatus.RUNNING };
+    case "transcode.progress":
+      return event.phase === "downloading" ? { status: TranscodeStatus.RUNNING } : null;
+    case "transcode.complete":
+      return { status: TranscodeStatus.COMPLETED };
+    case "transcode.failed":
+      return {
+        status: TranscodeStatus.FAILED,
+        ...typeof event.error === "string" ? { error: event.error } : {},
+        ...typeof event.reason === "string" ? { reason: event.reason } : {},
+        ...typeof event.retriable === "boolean" ? { retriable: event.retriable } : {}
+      };
+    default:
+      return null;
+  }
+}
+async function readStatus(kv, videoId) {
+  return kv.get(statusKey(videoId), "json");
+}
+async function writeQueuedStatus(kv, videoId, job) {
+  const record = { status: TranscodeStatus.QUEUED, ...job, updatedAt: Date.now() };
+  await kv.put(statusKey(videoId), JSON.stringify(record), { expirationTtl: KV_JOB_TTL_SECONDS });
+}
+async function applyStatusEvent(kv, event) {
+  const change = statusChangeFor(event);
+  const videoId = typeof event.videoId === "string" ? event.videoId : "";
+  if (!change || !videoId) return;
+  const current = await readStatus(kv, videoId);
+  if (!current) return;
+  if (current.status === TranscodeStatus.COMPLETED) return;
+  const record = {
+    jobRef: current.jobRef,
+    ...current.runner ? { runner: current.runner } : {},
+    ...change,
+    updatedAt: Date.now()
+  };
+  await kv.put(statusKey(videoId), JSON.stringify(record), { expirationTtl: KV_JOB_TTL_SECONDS });
+}
+
+// src/transcode/raw-retention.ts
+import { isVideoRawKey as isVideoRawKey2 } from "@devultur/core";
+var disposalKey = (videoId) => `${KvPrefix.TRANSCODE_RAW}:${videoId}`;
+async function readRawDisposal(kv, videoId) {
+  return kv.get(disposalKey(videoId), "json");
+}
+async function rememberRawDisposal(kv, videoId, disposal) {
+  await kv.put(disposalKey(videoId), JSON.stringify(disposal), { expirationTtl: KV_JOB_TTL_SECONDS });
+}
+async function disposeRawAfterTranscode(context, videoId) {
+  const { env } = context;
+  const disposal = await readRawDisposal(env.MEDIA_KV, videoId);
+  if (!disposal?.deleteOnComplete || !disposal.storageKey) return "kept";
+  const raw = await env.MEDIA_BUCKET.head(disposal.storageKey);
+  const location = splitVideoStorageKey(disposal.storageKey);
+  const lock = raw && location ? await effectiveLock(env.MEDIA_BUCKET, location.root, location.key, raw) : null;
+  if (lock?.state && isStateLocked(lock.state, /* @__PURE__ */ new Date())) {
+    await recordLockAudit(context, {
+      action: "original_retained",
+      keys: [location?.key ?? disposal.storageKey],
+      before: lock.state.lock,
+      after: null,
+      outcome: "skipped",
+      root: location?.root ?? ""
+    });
+    return "retained";
+  }
+  await env.MEDIA_BUCKET.delete(disposal.storageKey);
+  if (env.KEYS_BUCKET) await deletePrefix(env.KEYS_BUCKET, `${disposal.storageKey}/`);
+  return "deleted";
+}
+var ORIGINAL_NOT_RETAINED = {
+  error: "The original of this video is no longer retained, so it can't be re-encoded. Upload it again, or set `config.transcode.deleteOriginalOnSuccess` to false for future videos.",
+  code: "original_not_retained"
+};
+var PRIOR_OUTPUTS_LIST_LIMIT = 100;
+async function hasPriorTranscodeOutputs(bucket, videoFolder) {
+  const listing = await bucket.list({ prefix: videoFolder, limit: PRIOR_OUTPUTS_LIST_LIMIT });
+  return listing.objects.some((object) => !isVideoRawKey2(object.key));
+}
+
+// src/object-lock/transcode-marker.ts
+var MARKER_NAME = "transcode-completed";
+var markerKey = (root, videoFolder) => sidecarKey(root, `${videoFolder}/${MARKER_NAME}`);
+async function markTranscodeCompleted(env, videoId, ticketLocation) {
+  const location = ticketLocation ?? await rememberedLocation(env, videoId);
+  if (!location) return;
+  await env.MEDIA_BUCKET.put(markerKey(location.root, location.folder), (/* @__PURE__ */ new Date()).toISOString(), {
+    httpMetadata: { contentType: "text/plain" }
+  });
+}
+async function rememberedLocation(env, videoId) {
+  const disposal = await readRawDisposal(env.MEDIA_KV, videoId);
+  const raw = disposal?.storageKey ? splitVideoStorageKey(disposal.storageKey) : null;
+  const folder = raw?.key.split("/").slice(0, 3).join("/");
+  return raw && folder ? { root: raw.root, folder } : null;
+}
+async function hasCompletedTranscode(bucket, root, videoFolder) {
+  return await bucket.head(markerKey(root, videoFolder)) !== null;
+}
+async function forgetTranscodeCompleted(bucket, root, videoFolder) {
+  await bucket.delete(markerKey(root, videoFolder));
+}
+
+// src/object-lock/overwrite.ts
+function sameObject(object) {
+  return {
+    etagMatches: object.etag,
+    // R2 keeps `uploaded` to the millisecond, so "before uploaded + 1 ms" matches exactly this write and refuses
+    // any later one. Real R2 only: the in-memory bucket of the tests can't prove the precision.
+    ...object.uploaded ? { uploadedBefore: new Date(object.uploaded.getTime() + 1) } : {}
+  };
+}
+function overwriteOf(object) {
+  const replacedEnc = object.customMetadata?.enc;
+  return { onlyIf: sameObject(object), exists: true, ...replacedEnc ? { replacedEnc } : {} };
+}
+function createOnlyCondition() {
+  return new Headers({ "If-None-Match": "*" });
+}
+async function checkWrite(context, key, fullKey = storageKey(context, key), options = {}) {
+  if (isReservedLockKey(key)) return { blocked: reservedKeyResponse(context, key) };
+  const object = await context.env.MEDIA_BUCKET.head(fullKey);
+  if (!object) return { onlyIf: createOnlyCondition(), exists: false };
+  if (options.isLockExempt) return overwriteOf(object);
+  const root = fullKey.endsWith(key) ? fullKey.slice(0, fullKey.length - key.length) : void 0;
+  const blocked = await assertWritable(context, [key], "overwrite", root);
+  if (blocked) return { blocked };
+  return overwriteOf(object);
+}
+async function deleteReplacedKey(context, fullKey, replacedEnc, writtenEnc) {
+  const meta = decodeEncryptionMeta4(replacedEnc);
+  if (!meta || !context.env.KEYS_BUCKET) return;
+  if (decodeEncryptionMeta4(writtenEnc)?.keyId === meta.keyId) return;
+  await context.env.KEYS_BUCKET.delete(`${fullKey}/${meta.keyId}`);
+}
+function writeConflict(context, key) {
+  return context.json({ error: `${key} changed while it was being written; retry`, code: "write_conflict", key }, 409);
+}
+var WriteConflictError = class extends Error {
+  constructor(key) {
+    super(`${key} changed while it was being written`);
+    this.key = key;
+    this.name = "WriteConflictError";
+  }
+  key;
+};
+async function assertRetranscodable(context, video, raw) {
+  const root = getRequestState(context).storagePrefix;
+  const { state } = await effectiveLock(context.env.MEDIA_BUCKET, root, video.rawKey, raw);
+  if (!state) return null;
+  const isCompleted = await hasCompletedTranscode(context.env.MEDIA_BUCKET, root, video.folder) || (await readStatus(context.env.MEDIA_KV, video.id))?.status === TranscodeStatus2.COMPLETED;
+  if (!isCompleted) return null;
+  return assertWritable(context, [video.folder], "overwrite");
+}
+async function checkWrites(context, keys) {
+  const checks = /* @__PURE__ */ new Map();
+  for (const key of keys) {
+    const check = await checkWrite(context, key);
+    if ("blocked" in check) return check;
+    checks.set(key, check);
+  }
+  return { checks };
+}
+
+// src/object-lock/caption-writes.ts
+async function prepareCaptionWrites(context, locales, virtualKeyOf, source) {
+  const writes = await checkWrites(context, locales.map(virtualKeyOf));
+  if ("blocked" in writes) return writes;
+  const storageKeyOf = (locale) => storageKey(context, virtualKeyOf(locale));
+  const expiry = expiryMetadataOf(source.customMetadata);
+  return {
+    storageKeyOf,
+    put: async (locale, body, options) => {
+      const check = writes.checks.get(virtualKeyOf(locale));
+      const customMetadata = { ...options.customMetadata, ...expiry };
+      const stored = await context.env.MEDIA_BUCKET.put(storageKeyOf(locale), body, {
+        ...options,
+        ...Object.keys(customMetadata).length > 0 ? { customMetadata } : {},
+        onlyIf: check?.onlyIf
+      });
+      if (stored === null) throw new WriteConflictError(virtualKeyOf(locale));
+      await deleteReplacedKey(context, storageKeyOf(locale), check?.replacedEnc, customMetadata.enc);
+    }
+  };
+}
+function captionConflictResponse(context, error) {
+  return error instanceof WriteConflictError ? writeConflict(context, error.key) : null;
+}
 
 // src/routes/captions-errors.ts
 var CaptionsErrorCode = {
@@ -954,7 +1861,7 @@ function logCaptionsError(context, error) {
 }
 
 // src/routes/webhooks.ts
-import { Hono as Hono4 } from "hono";
+import { Hono as Hono5 } from "hono";
 
 // src/transcode/metrics.ts
 var OPERATOR_EVENT_FIELDS = ["encode", "posterKey", "posterFormats"];
@@ -1072,76 +1979,8 @@ async function loadOutputBaseUrl(kv, videoId, fallbackUrl) {
   return await kv.get(outputBaseKey(videoId)) ?? fallbackUrl;
 }
 
-// src/transcode/raw-retention.ts
-import { isVideoRawKey } from "@devultur/core";
-var disposalKey = (videoId) => `${KvPrefix.TRANSCODE_RAW}:${videoId}`;
-async function rememberRawDisposal(kv, videoId, disposal) {
-  await kv.put(disposalKey(videoId), JSON.stringify(disposal), { expirationTtl: KV_JOB_TTL_SECONDS });
-}
-async function disposeRawAfterTranscode(env, videoId) {
-  const disposal = await env.MEDIA_KV.get(disposalKey(videoId), "json");
-  if (!disposal?.deleteOnComplete || !disposal.storageKey) return false;
-  await env.MEDIA_BUCKET.delete(disposal.storageKey);
-  if (env.KEYS_BUCKET) await deletePrefix(env.KEYS_BUCKET, `${disposal.storageKey}/`);
-  return true;
-}
-var ORIGINAL_NOT_RETAINED = {
-  error: "The original of this video is no longer retained, so it can't be re-encoded. Upload it again, or set `config.transcode.deleteOriginalOnSuccess` to false for future videos.",
-  code: "original_not_retained"
-};
-var PRIOR_OUTPUTS_LIST_LIMIT = 100;
-async function hasPriorTranscodeOutputs(bucket, videoFolder) {
-  const listing = await bucket.list({ prefix: videoFolder, limit: PRIOR_OUTPUTS_LIST_LIMIT });
-  return listing.objects.some((object) => !isVideoRawKey(object.key));
-}
-
-// src/transcode/status.ts
-import { TranscodeStatus } from "@devultur/core";
-var statusKey = (videoId) => `${KvPrefix.TRANSCODE_STATUS}:${videoId}`;
-function statusChangeFor(event) {
-  switch (event.event) {
-    case "transcode.started":
-      return { status: TranscodeStatus.RUNNING };
-    case "transcode.progress":
-      return event.phase === "downloading" ? { status: TranscodeStatus.RUNNING } : null;
-    case "transcode.complete":
-      return { status: TranscodeStatus.COMPLETED };
-    case "transcode.failed":
-      return {
-        status: TranscodeStatus.FAILED,
-        ...typeof event.error === "string" ? { error: event.error } : {},
-        ...typeof event.reason === "string" ? { reason: event.reason } : {},
-        ...typeof event.retriable === "boolean" ? { retriable: event.retriable } : {}
-      };
-    default:
-      return null;
-  }
-}
-async function readStatus(kv, videoId) {
-  return kv.get(statusKey(videoId), "json");
-}
-async function writeQueuedStatus(kv, videoId, job) {
-  const record = { status: TranscodeStatus.QUEUED, ...job, updatedAt: Date.now() };
-  await kv.put(statusKey(videoId), JSON.stringify(record), { expirationTtl: KV_JOB_TTL_SECONDS });
-}
-async function applyStatusEvent(kv, event) {
-  const change = statusChangeFor(event);
-  const videoId = typeof event.videoId === "string" ? event.videoId : "";
-  if (!change || !videoId) return;
-  const current = await readStatus(kv, videoId);
-  if (!current) return;
-  if (current.status === TranscodeStatus.COMPLETED) return;
-  const record = {
-    jobRef: current.jobRef,
-    ...current.runner ? { runner: current.runner } : {},
-    ...change,
-    updatedAt: Date.now()
-  };
-  await kv.put(statusKey(videoId), JSON.stringify(record), { expirationTtl: KV_JOB_TTL_SECONDS });
-}
-
 // src/routes/webhooks.ts
-var webhooks = new Hono4();
+var webhooks = new Hono5();
 webhooks.post("/transcode", async (context) => {
   const webhookSecret = context.env.TRANSCODE_WEBHOOK_SECRET;
   if (!webhookSecret) {
@@ -1156,7 +1995,12 @@ webhooks.post("/transcode", async (context) => {
   const body = await context.req.json();
   await publishTranscodeJob(context, body);
   if (body.event === "transcode.complete" && body.videoId) {
-    if (await disposeRawAfterTranscode(context.env, body.videoId)) addRouteResult(context, { originalDeleted: true });
+    const disposal = await disposeRawAfterTranscode(context, body.videoId);
+    if (disposal === "deleted") addRouteResult(context, { originalDeleted: true });
+    if (disposal === "retained") addRouteResult(context, { originalRetained: true });
+    const ticket = context.req.header(JOB_TICKET_HEADER);
+    const location = await verifyJobLocation(context.env.DELIVERY_SIGN_SECRET, ticket, body.videoId);
+    await markTranscodeCompleted(context.env, body.videoId, location);
     await context.env.MEDIA_KV.put(
       `${KvPrefix.TRANSCODE_META}:${body.videoId}`,
       JSON.stringify({ duration: body.duration }),
@@ -1358,7 +2202,7 @@ async function transcodedDuration(kv, videoId) {
   const meta = await kv.get(`${KvPrefix.TRANSCODE_META}:${videoId}`, "json");
   return meta?.duration ?? void 0;
 }
-var captions = new Hono5();
+var captions = new Hono6();
 captions.post("/", async (context) => {
   const body = await context.req.json();
   if (!body.key || !body.locales?.length) {
@@ -1382,7 +2226,7 @@ captions.post("/", async (context) => {
   }
   const filename = body.key.split("/").pop() ?? "audio.mp4";
   const webhookData = await resolveCaptionsWebhook(context, videoId, body.callbackUrl);
-  const rawEnc = decodeEncryptionMeta2(file.customMetadata?.enc);
+  const rawEnc = decodeEncryptionMeta5(file.customMetadata?.enc);
   let audioBody = file.body;
   if (rawEnc) {
     const loaded = await loadStorageKey(context.env.KEYS_BUCKET, fullKey, rawEnc.keyId);
@@ -1392,12 +2236,15 @@ captions.post("/", async (context) => {
     audioBody = file.body.pipeThrough(createDecryptStream2(loaded.key, rawEnc.iv));
   }
   const visibility = visibilityFromKey(body.key) ?? "private";
-  const captionKey = (locale) => storageKey(context, `${visibility}/${captionPath(videoId, locale)}`);
+  const captionVirtualKey = (locale) => `${visibility}/${captionPath(videoId, locale)}`;
   const resourceOverride = parseSecurityHeader(file.customMetadata?.security);
   const captionPolicy = resolveSecurity(resourceOverride, scope.config?.security);
-  const encryptCaptions = captionPolicy.encrypt && visibility === "private" && Boolean(context.env.KEYS_BUCKET);
+  const encryptCaptions = Boolean(captionPolicy.encrypt) && visibility === "private";
+  if (isKeysBucketMissing(encryptCaptions, context.env)) return keysBucketMissing(context);
+  const writes = await prepareCaptionWrites(context, body.locales, captionVirtualKey, file);
+  if ("blocked" in writes) return writes.blocked;
   const putCaption = async (locale, vtt) => {
-    const objectKey = captionKey(locale);
+    const objectKey = writes.storageKeyOf(locale);
     const metadata = {};
     if (resourceOverride) metadata.security = JSON.stringify(resourceOverride);
     let bodyToStore = vtt;
@@ -1411,7 +2258,7 @@ captions.post("/", async (context) => {
       bodyToStore = result.body;
       metadata.enc = result.enc;
     }
-    await context.env.MEDIA_BUCKET.put(objectKey, bodyToStore, {
+    await writes.put(locale, bodyToStore, {
       httpMetadata: { contentType: "text/vtt" },
       ...Object.keys(metadata).length > 0 ? { customMetadata: metadata } : {}
     });
@@ -1466,18 +2313,19 @@ captions.post("/", async (context) => {
     });
   } catch (err) {
     logCaptionsError(`job failed for ${videoId}`, err);
-    const failure3 = toCaptionsFailure(err);
+    const failure4 = toCaptionsFailure(err);
     await forwardToClientWebhook(
       {
         event: "captions.failed",
         videoId,
-        error: failure3.error,
-        reason: failure3.reason,
-        retriable: failure3.retriable
+        error: failure4.error,
+        reason: failure4.reason,
+        retriable: failure4.retriable
       },
       webhookData
     );
-    return context.json({ error: failure3.error, code: failure3.code }, failure3.status);
+    const conflict = captionConflictResponse(context, err);
+    return conflict ?? context.json({ error: failure4.error, code: failure4.code }, failure4.status);
   }
 });
 captions.get("/:transcriptId", async (context) => {
@@ -1498,16 +2346,15 @@ captions.get("/:transcriptId", async (context) => {
 // src/routes/media.ts
 import {
   computeFingerprint,
-  decodeEncryptionMeta as decodeEncryptionMeta4,
+  decodeEncryptionMeta as decodeEncryptionMeta7,
   GENERATED_PRIVATE_CACHE_CONTROL,
   GENERATED_PUBLIC_CACHE_CONTROL,
   resolveSecurity as resolveSecurity2,
   SESSION_HEADER,
   toPrivateCacheControl,
-  videoBasePath,
   visibilityFromKey as visibilityFromKey2
 } from "@devultur/core";
-import { Hono as Hono6 } from "hono";
+import { Hono as Hono7 } from "hono";
 
 // src/image/cloudflare.ts
 var IMAGE_RESIZING_VIA = "image-resizing";
@@ -1714,7 +2561,7 @@ function hasAvifSequenceBrand(bytes) {
 }
 
 // src/image/storage.ts
-import { decodeEncryptionMeta as decodeEncryptionMeta3, decryptChunk as decryptChunk2 } from "@devultur/core";
+import { decodeEncryptionMeta as decodeEncryptionMeta6, decryptChunk as decryptChunk2 } from "@devultur/core";
 var HEADER_PROBE_BYTES = 256 * 1024;
 var passThrough = async (bytes) => bytes;
 var DerivedKind = {
@@ -1722,7 +2569,7 @@ var DerivedKind = {
   MEZZANINE: "mezzanine"
 };
 async function loadDecryptor(env, objectKey, customMetadata) {
-  const enc = decodeEncryptionMeta3(customMetadata?.enc);
+  const enc = decodeEncryptionMeta6(customMetadata?.enc);
   if (!enc) return passThrough;
   const loaded = await loadStorageKey(env.KEYS_BUCKET, objectKey, enc.keyId);
   if (!loaded) return null;
@@ -1743,7 +2590,7 @@ async function storeDerived(env, storageKey2, body, contentType, original, kind)
   const customMetadata = { derivedFrom: kind };
   if (security) customMetadata.security = security;
   let storedBody = body;
-  if (decodeEncryptionMeta3(original.customMetadata?.enc)) {
+  if (decodeEncryptionMeta6(original.customMetadata?.enc)) {
     if (!env.KEYS_BUCKET) throw new Error("Encrypted original without KEYS_BUCKET");
     const encrypted = await encryptForStorage(env.KEYS_BUCKET, storageKey2, body, security ? { security } : void 0);
     storedBody = encrypted.body;
@@ -1912,6 +2759,8 @@ import { edgeTtlSeconds, isAssetKey, sha256Hex as sha256Hex2 } from "@devultur/c
 var MAX_EDGE_TTL_SECONDS = 7 * 24 * 60 * 60;
 var MAX_EDGE_CACHE_FILL_BYTES = 100 * 1024 * 1024;
 var ORIGINAL_CACHE_CONTROL_HEADER = "x-devultur-cache-control";
+var EDGE_EXPIRES_HEADER = "x-devultur-edge-expires";
+var OWNER_HEADER_PREFIX = "x-devultur-lock";
 var CACHE_TAG_HEADER = "Cache-Tag";
 var TAG_HASH_LENGTH = 40;
 function publicEdgeCache() {
@@ -1935,35 +2784,112 @@ async function edgeCacheTags(storagePrefix2, virtualKey) {
   const objectTag = await edgeCacheTag(storagePrefix2, virtualKey);
   return prefixTag ? `${objectTag},${prefixTag}` : objectTag;
 }
+function isEdgeCopyExpired(hit, now = Date.now()) {
+  const expiresAt = Number(hit.headers.get(EDGE_EXPIRES_HEADER));
+  return Number.isFinite(expiresAt) && expiresAt > 0 && expiresAt <= now;
+}
+async function matchEdgeCopy(cache, request, options) {
+  const hit = await cache.match(request);
+  if (!hit || isEdgeCopyExpired(hit)) return null;
+  return responseFromEdgeHit(hit, options);
+}
 function responseFromEdgeHit(hit, options) {
   const headers = new Headers(hit.headers);
   if (options.isFormatNegotiated) headers.set("Vary", "Accept");
   const original = headers.get(ORIGINAL_CACHE_CONTROL_HEADER);
   if (original) headers.set("Cache-Control", original);
   headers.delete(ORIGINAL_CACHE_CONTROL_HEADER);
+  headers.delete(EDGE_EXPIRES_HEADER);
   headers.delete(CACHE_TAG_HEADER);
   return new Response(hit.body, { status: hit.status, headers });
 }
 function edgeTtlFor(cacheControl) {
   return edgeTtlSeconds(cacheControl, MAX_EDGE_TTL_SECONDS);
 }
-async function putEdgeCopy(target, body, headers) {
+function edgeCopyTtl(target, now = Date.now()) {
   const ttl = edgeTtlFor(target.cacheControl);
+  if (target.expiresAt === void 0) return ttl;
+  return Math.max(0, Math.min(ttl, Math.floor((target.expiresAt - now) / 1e3)));
+}
+var carriesOwnerHeaders = (headers) => [...headers.keys()].some((name) => name.toLowerCase().startsWith(OWNER_HEADER_PREFIX));
+async function putEdgeCopy(target, body, headers) {
+  const ttl = edgeCopyTtl(target);
+  if (ttl <= 0 || carriesOwnerHeaders(headers)) {
+    await body?.cancel();
+    return;
+  }
   const copyHeaders = new Headers(headers);
   copyHeaders.delete("Content-Range");
   copyHeaders.delete("Vary");
   copyHeaders.set(ORIGINAL_CACHE_CONTROL_HEADER, target.cacheControl);
   copyHeaders.set("Cache-Control", `public, max-age=${ttl}`);
+  if (target.expiresAt !== void 0) copyHeaders.set(EDGE_EXPIRES_HEADER, String(target.expiresAt));
   copyHeaders.set(CACHE_TAG_HEADER, await edgeCacheTags(target.storagePrefix, target.virtualKey));
   await target.cache.put(target.cacheKey, new Response(body, { status: 200, headers: copyHeaders }));
 }
 async function fillEdgeCache(target, bucket, fullKey, headers) {
+  if (edgeCopyTtl(target) <= 0 || carriesOwnerHeaders(headers)) return;
   const full = await bucket.get(fullKey);
   if (!full) return;
   const fullHeaders = new Headers(headers);
   fullHeaders.set("Content-Length", String(full.size));
   await putEdgeCopy(target, full.body, fullHeaders);
 }
+function cacheDelivered(waitUntil, target, delivered) {
+  if (edgeCopyTtl(target) <= 0) return;
+  if (delivered.kind === "plain-range" && delivered.size <= MAX_EDGE_CACHE_FILL_BYTES) {
+    waitUntil(fillEdgeCache(target, delivered.bucket, delivered.servedKey, delivered.response.headers));
+  }
+  if (delivered.kind === "plain-full") {
+    waitUntil(putEdgeCopy(target, delivered.response.clone().body, delivered.headers));
+  }
+}
+
+// src/routes/media-delete.ts
+import { videoBasePath } from "@devultur/core";
+async function handleVideoDelete(context) {
+  const videoId = context.req.param("videoId") ?? "";
+  const visibilityParam = context.req.query("visibility");
+  const visibilities = visibilityParam === "public" || visibilityParam === "private" ? [visibilityParam] : ["public", "private"];
+  const folders = visibilities.map((visibility) => `${visibility}/${videoBasePath(videoId)}`);
+  const blocked = await assertWritable(context, folders, "delete");
+  if (blocked) return blocked;
+  let deletedCount = 0;
+  let deletedKeyCount = 0;
+  for (const folder of folders) {
+    const deleted = await guardedDeletePrefix(context, `${folder}/`);
+    if ("blocked" in deleted) return deleted.blocked;
+    deletedCount += deleted.deletedCount;
+    if (deleted.deletedCount > 0) {
+      await forgetTranscodeCompleted(context.env.MEDIA_BUCKET, getRequestState(context).storagePrefix, folder);
+    }
+    if (!folder.startsWith("private/")) continue;
+    const deletedKeys = await deleteFolderKeys(context, folder);
+    if ("blocked" in deletedKeys) return deletedKeys.blocked;
+    deletedKeyCount += deletedKeys.deletedCount;
+  }
+  return context.json({ videoId, deletedCount, deletedKeyCount });
+}
+async function handleKeyDelete(context) {
+  const key = context.req.param("key") ?? "";
+  const fullKey = storageKey(context, key);
+  if (isVariantKey(key)) {
+    return context.json({ error: "Not found" }, 404);
+  }
+  if (isReservedLockKey(key)) return reservedKeyResponse(context, key);
+  const exists = await context.env.MEDIA_BUCKET.head(fullKey);
+  if (!exists) {
+    return context.json({ error: "Not found" }, 404);
+  }
+  const blocked = await assertWritable(context, [key], "delete");
+  if (blocked) return blocked;
+  await context.env.MEDIA_BUCKET.delete(fullKey);
+  const variants = await guardedDeletePrefix(context, variantPrefix(key));
+  if ("blocked" in variants) return variants.blocked;
+  const keys = await deleteKeysFor(context, key, exists);
+  if ("blocked" in keys) return keys.blocked;
+  return new Response(null, { status: 204 });
+}
 
 // src/routes/storyboard-vtt.ts
 import { createDecryptStream as createDecryptStream3 } from "@devultur/core";
@@ -1993,7 +2919,7 @@ function downloadDisposition(storedDisposition, key, filename) {
   if (storedDisposition?.startsWith("inline")) return `attachment${storedDisposition.slice("inline".length)}`;
   return contentDispositionAttachment(key.split("/").pop() || "download");
 }
-var media = new Hono6();
+var media = new Hono7();
 media.get("/:key{.+}", async (context) => {
   const key = context.req.param("key");
   const fullKey = storageKey(context, key);
@@ -2033,24 +2959,28 @@ media.get("/:key{.+}", async (context) => {
   const accept = context.req.header("Accept");
   const edgeCacheKey = workerParams ? `${requestUrl.origin}/__variant/${workerVariantKey(fullKey, workerParams, accept)}` : requestUrl.toString();
   const isUncachedTransform = hasTransformQuery(requestUrl) && !workerParams;
-  const edgeCache = isPrivate || isOriginRequest || isUncachedTransform ? null : publicEdgeCache();
+  const isEdgeCached = !isPrivate && !isOriginRequest && !isUncachedTransform && !isOwnerAccess;
+  const edgeCache = isEdgeCached ? publicEdgeCache() : null;
   if (edgeCache) {
     const cacheRequest = workerParams ? new Request(edgeCacheKey, context.req.raw) : context.req.raw;
-    const hit = await edgeCache.match(cacheRequest);
-    if (hit) return responseFromEdgeHit(hit, { isFormatNegotiated });
+    const hit = await matchEdgeCopy(edgeCache, cacheRequest, { isFormatNegotiated });
+    if (hit) return hit;
   }
   let object = await context.env.MEDIA_BUCKET.get(fullKey);
   let servedKey = fullKey;
   if (!object) {
     return context.json({ error: "Not found" }, 404);
   }
-  if (isObjectExpired(object.customMetadata)) return expiredResponse();
+  const location = { root: getRequestState(context).storagePrefix, key };
+  const expired = await expiredRefusal(context.env.MEDIA_BUCKET, location, object, isOwnerAccess);
+  if (expired) return expired;
+  const expiresAt = objectExpiresAt(object.customMetadata);
   if (tokenPayload && await bindingMismatch(context, tokenPayload, object.customMetadata)) {
     return context.json({ error: "Session mismatch", code: "session_mismatch" }, 401);
   }
   let contentType = object.httpMetadata?.contentType ?? "application/octet-stream";
   const isPlaylist = key.endsWith(".m3u8");
-  const cacheControl = servedCacheControl(object.httpMetadata?.cacheControl, isPrivate);
+  const cacheControl = servedCacheControl(object.httpMetadata?.cacheControl, isPrivate || isOwnerAccess);
   const downloadParam = requestUrl.searchParams.get("download");
   const isDownload = downloadParam !== null;
   if (isPlaylist && token2) {
@@ -2096,7 +3026,7 @@ media.get("/:key{.+}", async (context) => {
     });
   }
   if (token2 && isStoryboardVttKey(key) && object.body) {
-    const enc = decodeEncryptionMeta4(object.customMetadata?.enc);
+    const enc = decodeEncryptionMeta7(object.customMetadata?.enc);
     const loaded = enc ? await loadStorageKey(context.env.KEYS_BUCKET, fullKey, enc.keyId) : null;
     if (enc && !loaded) return context.json({ error: "Decryption key unavailable" }, 500);
     const decryption = enc && loaded ? { key: loaded.key, iv: enc.iv } : null;
@@ -2111,6 +3041,7 @@ media.get("/:key{.+}", async (context) => {
   } else if (object.httpMetadata?.contentDisposition) {
     headers.set("Content-Disposition", object.httpMetadata.contentDisposition);
   }
+  if (isOwnerAccess) for (const [name, value] of await lockHeaders(context, key, object)) headers.set(name, value);
   const { response, kind } = await streamObject({
     bucket: context.env.MEDIA_BUCKET,
     keysBucket: context.env.KEYS_BUCKET,
@@ -2119,56 +3050,25 @@ media.get("/:key{.+}", async (context) => {
     headers,
     range: context.req.header("Range")
   });
-  if (!edgeCache || edgeTtlFor(cacheControl) <= 0) return response;
+  if (!edgeCache) return response;
   const target = {
     cache: edgeCache,
     cacheKey: edgeCacheKey,
     storagePrefix: getRequestState(context).storagePrefix,
     virtualKey: key,
-    cacheControl
+    cacheControl,
+    expiresAt
   };
-  if (kind === "plain-range" && object.size <= MAX_EDGE_CACHE_FILL_BYTES) {
-    context.executionCtx.waitUntil(fillEdgeCache(target, context.env.MEDIA_BUCKET, servedKey, response.headers));
-  }
-  if (kind === "plain-full") {
-    context.executionCtx.waitUntil(putEdgeCopy(target, response.clone().body, headers));
-  }
+  const delivered = { bucket: context.env.MEDIA_BUCKET, servedKey, size: object.size, kind, response, headers };
+  cacheDelivered((task) => context.executionCtx.waitUntil(task), target, delivered);
   return response;
 });
 function servedCacheControl(stored, isPrivate) {
   if (!stored) return isPrivate ? GENERATED_PRIVATE_CACHE_CONTROL : GENERATED_PUBLIC_CACHE_CONTROL;
   return isPrivate ? toPrivateCacheControl(stored) : stored;
 }
-media.delete("/videos/:videoId", async (context) => {
-  const videoId = context.req.param("videoId");
-  const visibilityParam = context.req.query("visibility");
-  const visibilities = visibilityParam === "public" || visibilityParam === "private" ? [visibilityParam] : ["public", "private"];
-  let deletedCount = 0;
-  let deletedKeyCount = 0;
-  for (const visibility of visibilities) {
-    const prefix = storagePrefix(context, `${visibility}/${videoBasePath(videoId)}/`);
-    deletedCount += await deletePrefix(context.env.MEDIA_BUCKET, prefix);
-    if (visibility === "private" && context.env.KEYS_BUCKET) {
-      deletedKeyCount += await deletePrefix(context.env.KEYS_BUCKET, prefix);
-    }
-  }
-  return context.json({ videoId, deletedCount, deletedKeyCount });
-});
-media.delete("/:key{.+}", async (context) => {
-  const key = context.req.param("key");
-  const fullKey = storageKey(context, key);
-  if (isVariantKey(key)) {
-    return context.json({ error: "Not found" }, 404);
-  }
-  const exists = await context.env.MEDIA_BUCKET.head(fullKey);
-  if (!exists) {
-    return context.json({ error: "Not found" }, 404);
-  }
-  await context.env.MEDIA_BUCKET.delete(fullKey);
-  await deletePrefix(context.env.MEDIA_BUCKET, variantPrefix(fullKey));
-  if (context.env.KEYS_BUCKET) await deletePrefix(context.env.KEYS_BUCKET, `${fullKey}/`);
-  return new Response(null, { status: 204 });
-});
+media.delete("/videos/:videoId", handleVideoDelete);
+media.delete("/:key{.+}", handleKeyDelete);
 function parseSecurityMeta(raw) {
   if (!raw) return void 0;
   try {
@@ -2217,9 +3117,9 @@ async function serveEncryptionKey(context, key, tokenPayload) {
 
 // src/routes/token.ts
 import { computeFingerprint as computeFingerprint2, DEFAULT_SECURITY, TokenScope as TokenScope3 } from "@devultur/core";
-import { Hono as Hono7 } from "hono";
+import { Hono as Hono8 } from "hono";
 var DEFAULT_VIEWER_TOKEN_TTL_SECONDS = 7200;
-var token = new Hono7();
+var token = new Hono8();
 token.post("/", async (context) => {
   const body = await context.req.json();
   if (!body.userId) {
@@ -2281,7 +3181,7 @@ import {
   resolveSecurity as resolveSecurity3,
   resolveTranscodePreset,
   TokenScope as TokenScope4,
-  TranscodeStatus as TranscodeStatus2,
+  TranscodeStatus as TranscodeStatus3,
   videoBasePath as videoBasePath2,
   videoHlsPath,
   videoMp4Dir,
@@ -2290,7 +3190,7 @@ import {
   videoThumbnailPath,
   visibilityFromKey as visibilityFromKey3
 } from "@devultur/core";
-import { Hono as Hono8 } from "hono";
+import { Hono as Hono9 } from "hono";
 
 // src/transcode/plan.ts
 import { MAIN_VARIANT } from "@devultur/core";
@@ -3229,7 +4129,7 @@ function parseSecurityMeta2(raw) {
 }
 var SERVICE_TOKEN_TTL_SECONDS = 3600;
 var isVideoId = (videoId, key) => Boolean(videoId) && videoId !== key;
-var transcode = new Hono8();
+var transcode = new Hono9();
 transcode.post("/", async (context) => {
   const body = await context.req.json();
   if (!body.key) {
@@ -3250,6 +4150,9 @@ transcode.post("/", async (context) => {
   if (!isVideoId(videoId, body.key)) {
     return context.json({ error: "Invalid key format" }, 400);
   }
+  const video = { id: videoId, folder: `${visibility}/${videoBasePath2(videoId)}`, rawKey: body.key };
+  const retained = await assertRetranscodable(context, video, object);
+  if (retained) return retained;
   const scope = getRequestState(context);
   const transcodeConfig = scope.config?.transcode;
   const resolved = resolveTranscodePreset(body.preset, transcodeConfig?.presets);
@@ -3269,7 +4172,8 @@ transcode.post("/", async (context) => {
   const resourceSecurityHeader = rawOverride ? JSON.stringify(rawOverride) : "";
   const keyMetadata = rawOverride ? { security: resourceSecurityHeader } : void 0;
   const policy = resolveSecurity3(rawOverride, scope.config?.security);
-  const shouldEncrypt = policy.encrypt && visibility === "private" && Boolean(context.env.KEYS_BUCKET);
+  const shouldEncrypt = Boolean(policy.encrypt) && visibility === "private";
+  if (isKeysBucketMissing(shouldEncrypt, context.env)) return keysBucketMissing(context);
   let encryptKeyB64 = "";
   let encryptKeyId = "";
   if (shouldEncrypt && context.env.KEYS_BUCKET) {
@@ -3325,7 +4229,8 @@ transcode.post("/", async (context) => {
   });
   const { ticket: jobTicket } = await signJobTicket(context.env.DELIVERY_SIGN_SECRET, {
     videoId,
-    ...scope.context ? { context: scope.context } : {}
+    ...scope.context ? { context: scope.context } : {},
+    location: { root: scope.storagePrefix, folder: video.folder }
   });
   const runner = createRunner(context.env);
   if (!runner) {
@@ -3386,7 +4291,7 @@ transcode.post("/", async (context) => {
     outputPrefix,
     thumbnailKey,
     preset,
-    status: TranscodeStatus2.QUEUED
+    status: TranscodeStatus3.QUEUED
   });
 });
 transcode.get("/:jobId", async (context) => {
@@ -3399,12 +4304,12 @@ transcode.get("/:jobId", async (context) => {
     kv.get(`${KvPrefix.TRANSCODE_META}:${jobMeta.videoId}`, "json")
   ]);
   const ownRecord = record?.jobRef === jobId ? record : null;
-  const status = ownRecord?.status ?? (durationMeta ? TranscodeStatus2.COMPLETED : TranscodeStatus2.QUEUED);
-  if (status === TranscodeStatus2.FAILED) {
+  const status = ownRecord?.status ?? (durationMeta ? TranscodeStatus3.COMPLETED : TranscodeStatus3.QUEUED);
+  if (status === TranscodeStatus3.FAILED) {
     const { error, reason, retriable } = ownRecord ?? {};
     return context.json({ jobId, status, error, reason, retriable });
   }
-  if (status !== TranscodeStatus2.COMPLETED) return context.json({ jobId, status });
+  if (status !== TranscodeStatus3.COMPLETED) return context.json({ jobId, status });
   return context.json({
     jobId,
     status,
@@ -3415,29 +4320,42 @@ transcode.get("/:jobId", async (context) => {
 });
 
 // src/routes/upload.ts
-import {
-  decodeEncryptionMeta as decodeEncryptionMeta6,
-  MediaType as MediaType2,
-  resolveSecurity as resolveSecurity5,
-  resolveVisibility,
-  UploadRequestKind as UploadRequestKind2
-} from "@devultur/core";
-import { Hono as Hono9 } from "hono";
+import { MediaType as MediaType2, resolveSecurity as resolveSecurity5, resolveVisibility, UploadRequestKind as UploadRequestKind2 } from "@devultur/core";
+import { Hono as Hono10 } from "hono";
 
-// src/routes/upload-multipart.ts
-import {
-  AES_BLOCK_BYTES as AES_BLOCK_BYTES2,
-  classifyUploadRequest,
-  counterForBlock,
-  decodeEncryptionMeta as decodeEncryptionMeta5,
-  encryptBytes,
-  MULTIPART_PART_SIZE_BYTES,
-  MULTIPART_QUERY,
-  multipartPartCount,
-  multipartPartRange,
-  resolveSecurity as resolveSecurity4,
-  UploadRequestKind
-} from "@devultur/core";
+// src/object-lock/upload-lock.ts
+import { canChange as canChange3, resolveLock, validateLock as validateLock6 } from "@devultur/core";
+var failure3 = (status, code, error) => ({ status, code, error });
+function requestedLock(lock, hold) {
+  if (hold !== void 0 && typeof hold !== "boolean") return failure3(400, "invalid_lock", "hold must be a boolean");
+  if (lock === void 0 && hold === void 0) return void 0;
+  const validation = validateLock6(lock ?? {});
+  if (!validation.ok) return failure3(400, "invalid_lock", validation.errors.join("; "));
+  return { ...validation.lock, ...hold !== void 0 ? { hold } : {} };
+}
+function satisfiesMinimum(minimum, lock, now) {
+  if (minimum.hold && !lock.hold) return false;
+  const change = canChange3(minimum, lock, { privileged: false, now, timing: { uploadedAt: now } });
+  return change.ok && !change.bypass;
+}
+function resolveUploadLock(input) {
+  const requested = requestedLock(input.lock, input.hold);
+  if (requested && "code" in requested) return requested;
+  const minimum = input.grant?.lock;
+  const resolution = resolveLock(requested ?? minimum, input.appDefault);
+  if (!resolution.ok) return failure3(400, "invalid_lock", resolution.errors.join("; "));
+  const lock = resolution.lock;
+  if (minimum && !satisfiesMinimum(minimum, lock, input.now)) {
+    return failure3(403, "lock_below_minimum", "The upload token requires a stricter lock than the request asks for");
+  }
+  return lock.retention || lock.hold ? lock : void 0;
+}
+
+// src/object-lock/upload-write.ts
+import { decodeEncryptionMeta as decodeEncryptionMeta8, resolveLock as resolveLock2 } from "@devultur/core";
+
+// src/object-lock/job-outputs.ts
+import { isBearerOf, TranscodeStatus as TranscodeStatus4 } from "@devultur/core";
 
 // src/routes/derived-upload.ts
 var DERIVED_ASSET_KEY = /^(public|private)\/video\/[A-Za-z0-9-]+\/(hls|mp4|thumbnails|storyboard)\/[^/]+$/;
@@ -3451,18 +4369,109 @@ var DERIVED_CONTENT_TYPES = /* @__PURE__ */ new Set([
 function isDerivedAssetKey(key) {
   return DERIVED_ASSET_KEY.test(key);
 }
+var RAW_LIST_LIMIT = 100;
+async function inheritedExpiresAt(context, key) {
+  if (!isDerivedAssetKey(key)) return void 0;
+  const videoFolder = key.split("/").slice(0, 3).join("/");
+  const options = {
+    prefix: `${getRequestState(context).storagePrefix}${videoFolder}/raw/`,
+    limit: RAW_LIST_LIMIT,
+    include: ["customMetadata"]
+  };
+  const listing = await context.env.MEDIA_BUCKET.list(options);
+  const expiries = listing.objects.map((raw) => objectExpiresAt(raw.customMetadata)).filter((expiresAt) => expiresAt !== void 0);
+  return expiries.length > 0 ? Math.min(...expiries) : void 0;
+}
 async function derivedAssetPending(context, key) {
   if (!isDerivedAssetKey(key) || !isAuthenticated(context)) return null;
   const body = await context.req.json().catch(() => null);
   const declared = typeof body?.contentType === "string" ? body.contentType : "";
   const security = parseSecurityHeader(context.req.header(RESOURCE_SECURITY_HEADER));
+  const expiresAt = await inheritedExpiresAt(context, key);
   return {
     contentType: DERIVED_CONTENT_TYPES.has(declared) ? declared : "application/octet-stream",
     storageKey: storageKey(context, key),
-    ...security ? { security } : {}
+    ...security ? { security } : {},
+    ...expiresAt ? { expiresAt } : {}
   };
 }
 
+// src/object-lock/job-outputs.ts
+var VIDEO_ID = /^(?:public|private)\/video\/([^/]+)\//;
+var IN_PROGRESS = /* @__PURE__ */ new Set([TranscodeStatus4.QUEUED, TranscodeStatus4.RUNNING]);
+async function isInProgressJobOutput(context, key) {
+  if (!isDerivedAssetKey(key)) return false;
+  if (!isBearerOf(context.req.header("Authorization"), getRequestState(context).runnerCredential)) return false;
+  const videoId = VIDEO_ID.exec(key)?.[1];
+  if (!videoId) return false;
+  const status = await readStatus(context.env.MEDIA_KV, videoId);
+  return status !== null && IN_PROGRESS.has(status.status);
+}
+
+// src/object-lock/upload-write.ts
+async function prepareUploadWrite(context, key, pending, fullKey) {
+  const isLockExempt = await isInProgressJobOutput(context, key);
+  const check = await checkWrite(context, key, fullKey, { isLockExempt });
+  if ("blocked" in check) return check;
+  const isCreateOnly = Boolean(pending?.isAsset && !pending.overwrite);
+  if (isCreateOnly && check.exists) return { blocked: alreadyExists(context, key) };
+  return check;
+}
+async function assetUploadConflict(context, key, fullKey, shouldOverwrite) {
+  const check = await checkWrite(context, key, fullKey);
+  if ("blocked" in check) return check.blocked;
+  return check.exists && !shouldOverwrite ? alreadyExists(context, key) : null;
+}
+async function failedWrite(context, key, pending, enc) {
+  const meta = decodeEncryptionMeta8(enc);
+  const fullKey = pending?.storageKey ?? storageKey(context, key);
+  if (context.env.KEYS_BUCKET && meta) await context.env.KEYS_BUCKET.delete(`${fullKey}/${meta.keyId}`);
+  return pending?.isAsset && !pending.overwrite ? alreadyExists(context, key) : writeConflict(context, key);
+}
+function uploadLockOf(context, key, pending) {
+  if (pending) return pending.lock;
+  if (lockSubjectOf(key)?.kind !== "original") return void 0;
+  const resolution = resolveLock2(void 0, getRequestState(context).config?.lock);
+  if (!resolution.ok) {
+    console.error("config.lock is invalid:", resolution.errors.join("; "));
+    return { hold: true };
+  }
+  const { lock } = resolution;
+  return lock.retention || lock.hold ? lock : void 0;
+}
+async function afterUploadWrite(context, key, pending, write, writtenEnc) {
+  const fullKey = pending?.storageKey ?? storageKey(context, key);
+  const root = fullKey.endsWith(key) ? fullKey.slice(0, -key.length) : getRequestState(context).storagePrefix;
+  if (pending) await discardStaleVariants(context.env.MEDIA_BUCKET, pending);
+  if (write.exists) await deleteReplacedKey(context, fullKey, write.replacedEnc, writtenEnc);
+  const lock = uploadLockOf(context, key, pending);
+  if (!lock) return;
+  await recordLockAudit(context, {
+    action: "set",
+    keys: [key],
+    before: null,
+    after: lock,
+    outcome: "applied",
+    actor: pending ? pending.context ?? null : getRequestState(context).context ?? null,
+    root
+  });
+}
+
+// src/routes/upload-multipart.ts
+import {
+  AES_BLOCK_BYTES as AES_BLOCK_BYTES2,
+  classifyUploadRequest,
+  counterForBlock,
+  decodeEncryptionMeta as decodeEncryptionMeta9,
+  encryptBytes,
+  MULTIPART_PART_SIZE_BYTES,
+  MULTIPART_QUERY,
+  multipartPartCount,
+  multipartPartRange,
+  resolveSecurity as resolveSecurity4,
+  UploadRequestKind
+} from "@devultur/core";
+
 // src/routes/upload-pending.ts
 var UPLOAD_PENDING_QUERY = "u";
 var PENDING_ID_BYTES = 16;
@@ -3620,15 +4629,19 @@ async function handleMultipartCreate(context, key, target) {
   if (pending.multipart) {
     return context.json({ uploadId: pending.multipart.uploadId, partSize: pending.multipart.partSize, partCount });
   }
-  if (await isTakenAsset(context, pending)) return alreadyExists(context, key);
+  const policy = resolveSecurity4(pending.security, getRequestState(context).config?.security);
+  const shouldEncrypt = shouldEncryptAtRest(policy, key);
+  if (isKeysBucketMissing(shouldEncrypt, context.env)) return keysBucketMissing(context);
+  const write = await prepareUploadWrite(context, pending.key ?? key, pending, pending.storageKey);
+  if ("blocked" in write) return write.blocked;
   const customMetadata = {
     ...allowedUploadMetadata(pending.uploadMetadata),
-    ...integrityMetadata(declaredSha256, false, pending.expiresAt)
+    ...integrityMetadata(declaredSha256, false, pending.expiresAt),
+    ...lockMetadata(pending.lock)
   };
   if (pending.security) customMetadata.security = JSON.stringify(pending.security);
-  const policy = resolveSecurity4(pending.security, getRequestState(context).config?.security);
   let enc;
-  if (context.env.KEYS_BUCKET && shouldEncryptAtRest(policy, key, true)) {
+  if (shouldEncrypt && context.env.KEYS_BUCKET) {
     ({ enc } = await createObjectEncryption(context.env.KEYS_BUCKET, pending.storageKey, { ...customMetadata }));
     customMetadata.enc = enc;
   }
@@ -3661,7 +4674,7 @@ async function handleMultipartCreate(context, key, target) {
 }
 async function encryptPart(context, pending, multipart, partNumber, body) {
   if (!multipart.enc) return body;
-  const meta = decodeEncryptionMeta5(multipart.enc);
+  const meta = decodeEncryptionMeta9(multipart.enc);
   const material = meta ? await loadStorageKey(context.env.KEYS_BUCKET, pending.storageKey, meta.keyId) : null;
   if (!meta || !material) return null;
   const startBlock = (partNumber - 1) * multipart.partSize / AES_BLOCK_BYTES2;
@@ -3698,18 +4711,20 @@ async function handleMultipartComplete(context, key) {
   const { pending, multipart, kvKey } = active;
   const parts = normalizeCompletedParts(multipart, body?.parts);
   if (!parts) return context.json({ error: "parts must list every part exactly once", code: "invalid_parts" }, 400);
-  if (await isTakenAsset(context, pending)) return alreadyExists(context, key);
+  const write = await prepareUploadWrite(context, pending.key ?? key, pending, pending.storageKey);
+  if ("blocked" in write) return write.blocked;
   const multipartUpload = context.env.MEDIA_BUCKET.resumeMultipartUpload(pending.storageKey, multipart.uploadId);
+  if (!await hasEncryptionKey(context.env.KEYS_BUCKET, pending.storageKey, multipart.enc)) {
+    await multipartUpload.abort();
+    await context.env.MEDIA_KV.delete(kvKey);
+    return encryptionKeyMissing(context, key);
+  }
   const object = await multipartUpload.complete(parts);
   await context.env.MEDIA_KV.delete(kvKey);
-  await discardStaleVariants(context.env.MEDIA_BUCKET, pending);
+  await afterUploadWrite(context, key, pending, write, multipart.enc);
   const integrity = multipart.sha256 ? { sha256: multipart.sha256, sha256Verified: false } : {};
   return context.json({ key, size: object.size, ...integrity });
 }
-async function isTakenAsset(context, pending) {
-  if (!pending.isAsset || pending.overwrite) return false;
-  return Boolean(await context.env.MEDIA_BUCKET.head(pending.storageKey));
-}
 async function checkPartSha256(context, multipart, body) {
   const partSha256 = headerSha256(context);
   if (partSha256 === null) {
@@ -3754,7 +4769,7 @@ async function handleMultipartAbort(context) {
 }
 
 // src/routes/upload.ts
-var upload = new Hono9();
+var upload = new Hono10();
 upload.post("/", async (context) => {
   const body = await context.req.json();
   const isAssetRequest = body.path !== void 0;
@@ -3798,6 +4813,14 @@ upload.post("/", async (context) => {
   if (isUploadTargetError(sha256)) return targetFailure(context, sha256);
   const cacheControl = resolveObjectCacheControl(body.cacheControl, target, scope.config?.cacheRules);
   if (isUploadTargetError(cacheControl)) return targetFailure(context, cacheControl);
+  const lock = resolveUploadLock({
+    lock: body.lock,
+    hold: body.hold,
+    grant,
+    appDefault: scope.config?.lock,
+    now: Date.now()
+  });
+  if (isUploadTargetError(lock)) return targetFailure(context, lock);
   const maxSizeBytes = effectiveMaxBytes(uploadRule?.maxSizeBytes, grant);
   const declaredSize = Number(body.size);
   if (maxSizeBytes != null && Number.isFinite(declaredSize) && declaredSize > maxSizeBytes) {
@@ -3805,15 +4828,17 @@ upload.post("/", async (context) => {
   }
   const virtualKey = target.key;
   const fullKey = storageKey(context, virtualKey);
-  const shouldOverwrite = body.overwrite === true;
-  if (target.isAsset && !shouldOverwrite && await context.env.MEDIA_BUCKET.head(fullKey)) {
-    return alreadyExists(context, virtualKey);
+  const resolvedSecurity = resolveSecurity5(body.security, scope.config?.security);
+  if (isKeysBucketMissing(shouldEncryptAtRest(resolvedSecurity, virtualKey), context.env)) {
+    return keysBucketMissing(context);
   }
+  const shouldOverwrite = body.overwrite === true;
+  const conflict = target.isAsset ? await assetUploadConflict(context, virtualKey, fullKey, shouldOverwrite) : null;
+  if (conflict) return conflict;
   if (grant) {
     const exhausted = await claimTokenFileSlot(context.env.MEDIA_KV, grant);
     if (exhausted) return targetFailure(context, exhausted);
   }
-  const resolvedSecurity = resolveSecurity5(body.security, scope.config?.security);
   const pending = {
     contentType: body.contentType,
     storageKey: fullKey,
@@ -3828,7 +4853,8 @@ upload.post("/", async (context) => {
     ...expiresAt ? { expiresAt } : {},
     ...target.isAsset ? { isAsset: true, overwrite: shouldOverwrite } : {},
     ...cacheControl ? { cacheControl } : {},
-    ...scope.config?.uploadMetadata ? { uploadMetadata: scope.config.uploadMetadata } : {}
+    ...scope.config?.uploadMetadata ? { uploadMetadata: scope.config.uploadMetadata } : {},
+    ...lock ? { lock } : {}
   };
   const pendingId = newUploadPendingId();
   await context.env.MEDIA_KV.put(uploadPendingKvKey(pendingId), JSON.stringify(pending), {
@@ -3883,25 +4909,30 @@ upload.put("/:key{.+}", async (context) => {
   }
   if ("mismatch" in digest) return sha256Mismatch(context, digest.mismatch.expected, digest.mismatch.actual);
   const policy = resolveSecurity5(resourceSecurity, getRequestState(context).config?.security);
-  const shouldEncrypt = shouldEncryptAtRest(policy, key, Boolean(context.env.KEYS_BUCKET));
+  const shouldEncrypt = shouldEncryptAtRest(policy, key);
+  if (isKeysBucketMissing(shouldEncrypt, context.env)) return keysBucketMissing(context);
   const customMetadata = {
     ...allowedUploadMetadata(pending?.uploadMetadata ?? getRequestState(context).config?.uploadMetadata),
-    ...integrityMetadata(digest.sha256, true, pending?.expiresAt)
+    // A transcode output (no pending) expires with its video's raw.
+    ...integrityMetadata(digest.sha256, true, pending?.expiresAt ?? await inheritedExpiresAt(context, key)),
+    ...lockMetadata(uploadLockOf(context, key, pending))
   };
   if (resourceSecurity) customMetadata.security = JSON.stringify(resourceSecurity);
+  const write = await prepareUploadWrite(context, pending?.key ?? key, pending, finalStorageKey);
+  if ("blocked" in write) return write.blocked;
   let storedBody = body;
   if (shouldEncrypt && context.env.KEYS_BUCKET) {
     const result = await encryptForStorage(context.env.KEYS_BUCKET, finalStorageKey, body, customMetadata);
     storedBody = result.body;
     customMetadata.enc = result.enc;
   }
-  const isCreateOnly = Boolean(pending?.isAsset && !pending.overwrite);
+  if (!await hasEncryptionKey(context.env.KEYS_BUCKET, finalStorageKey, customMetadata.enc)) {
+    return encryptionKeyMissing(context, key);
+  }
   const stored = await context.env.MEDIA_BUCKET.put(finalStorageKey, storedBody, {
-    ...isCreateOnly ? { onlyIf: createOnlyCondition() } : {},
-    // Standard except for the video raw when the config retains it ≥30 days (Infrequent Access, see
-    // `RAW_STORAGE_CLASS`): IA has a 30-day minimum and charges retrieval ($0.01/GB) on every read — the
-    // transcode's read, and the direct MP4 delivery if it isn't transcoded. With retention `off` the raw lives
-    // for minutes.
+    onlyIf: write.onlyIf,
+    // Standard, except a video raw the config keeps ≥30 days: Infrequent Access (30-day minimum, and a retrieval
+    // charge on every read, the transcode's included; see `RAW_STORAGE_CLASS`).
     storageClass,
     httpMetadata: {
       contentType,
@@ -3910,23 +4941,325 @@ upload.put("/:key{.+}", async (context) => {
     },
     ...Object.keys(customMetadata).length > 0 ? { customMetadata } : {}
   });
-  if (isCreateOnly && !stored) {
-    await discardObjectKey(context.env.KEYS_BUCKET, finalStorageKey, customMetadata.enc);
-    return alreadyExists(context, key);
-  }
+  if (stored === null) return failedWrite(context, key, pending, customMetadata.enc);
   if (resolved) await context.env.MEDIA_KV.delete(resolved.kvKey);
-  await discardStaleVariants(context.env.MEDIA_BUCKET, pending);
+  await afterUploadWrite(context, key, pending, write, customMetadata.enc);
   return context.json({ key, size: body.byteLength, sha256: digest.sha256, sha256Verified: true });
 });
-async function discardObjectKey(keysBucket, objectStorageKey, enc) {
-  const meta = decodeEncryptionMeta6(enc);
-  if (keysBucket && meta) await keysBucket.delete(`${objectStorageKey}/${meta.keyId}`);
+
+// src/object-lock/lock-status.ts
+var VISIBILITY_SEGMENTS = /* @__PURE__ */ new Set(["public", "private"]);
+var RESERVED_SEGMENT = /__lock(?:-audit)?$/;
+function placeOfStorageKey(storageKey2, root) {
+  const segments = storageKey2.split("/");
+  if (segments.some((segment) => RESERVED_SEGMENT.test(segment))) return { kind: "reserved" };
+  if (root !== void 0) {
+    const key = storageKey2.slice(root.length);
+    const isWorkerKey = storageKey2.startsWith(root) && VISIBILITY_SEGMENTS.has(key.split("/")[0] ?? "");
+    return isWorkerKey ? { kind: "object", root, key } : { kind: "unrecognized" };
+  }
+  const first = segments.findIndex((segment) => VISIBILITY_SEGMENTS.has(segment));
+  if (first < 0) return { kind: "unrecognized" };
+  const inferredRoot = first === 0 ? "" : `${segments.slice(0, first).join("/")}/`;
+  return { kind: "object", root: inferredRoot, key: storageKey2.slice(inferredRoot.length) };
+}
+var UNRECOGNIZED_LOCK = { locked: true, hold: false, unrecognized: true };
+var VARIANTS_SEGMENT = "/__variants/";
+function retentionSubjectOf(key) {
+  const isVariant = isVariantKey(key);
+  const original = isVariant ? key.slice(0, key.indexOf(VARIANTS_SEGMENT)) : key;
+  return { subject: lockSubjectOf(original) ?? { kind: "original", key: original }, isVariant };
+}
+function toStoredObjectLock(locked, place) {
+  if (!locked) return { locked: false, hold: false };
+  const { lock, isUnreadable } = locked.state;
+  const until = untilOf(locked.state);
+  return {
+    locked: true,
+    hold: lock.hold === true,
+    ...until ? { until } : {},
+    ...lock.retention ? { mode: lock.retention.mode } : {},
+    ...isUnreadable ? { unreadable: true } : {},
+    ...locked.key === place.key ? {} : { lockedBy: `${place.root}${locked.key}` }
+  };
+}
+var LOCK_CACHE_MAX_USES = 50;
+var LOCK_CACHE_MAX_AGE_MS = 5e3;
+function lockResolver(mediaBucket, now) {
+  const cache = /* @__PURE__ */ new Map();
+  const resolveSubject = (root, subject) => {
+    const id = `${root}\0${subject.kind === "original" ? subject.key : subject.rawPrefix}`;
+    const cached = cache.get(id);
+    const isFresh = cached && cached.uses < LOCK_CACHE_MAX_USES && Date.now() - cached.readAt < LOCK_CACHE_MAX_AGE_MS;
+    if (cached && isFresh) {
+      cached.uses += 1;
+      return cached.pending;
+    }
+    const pending = findLockedOriginal(mediaBucket, root, subject, now);
+    pending.catch(() => cache.delete(id));
+    cache.set(id, { pending, readAt: Date.now(), uses: 1 });
+    return pending;
+  };
+  return async (place, object) => {
+    const { subject, isVariant } = retentionSubjectOf(place.key);
+    if (subject.kind === "original" && subject.key === place.key) {
+      return lockedObject(mediaBucket, place.root, place.key, object, now);
+    }
+    const locked = await resolveSubject(place.root, subject);
+    if (isVariant && subject.kind === "original" && locked && !protectsDerived(locked.state)) return null;
+    return locked;
+  };
+}
+async function readObjectLock(options, storageKey2) {
+  const place = placeOfStorageKey(storageKey2, options.root);
+  if (place.kind === "reserved") return null;
+  const object = await options.mediaBucket.head(storageKey2);
+  if (!object) return null;
+  if (place.kind === "unrecognized") return UNRECOGNIZED_LOCK;
+  const locked = await lockResolver(options.mediaBucket, options.now ?? /* @__PURE__ */ new Date())(place, object);
+  return toStoredObjectLock(locked, place);
+}
+
+// src/object-lock/prefix-walk.ts
+var DEFAULT_MAX_SUBREQUESTS = 40;
+var DEFAULT_BATCH_SIZE = 100;
+var MAX_BATCH_SIZE = 1e3;
+var BudgetExhausted = class extends Error {
+  constructor() {
+    super("subrequest budget exhausted");
+  }
+};
+function subrequestBudget(max) {
+  if (!Number.isInteger(max) || max < 1) throw new RangeError("maxSubrequests must be a positive integer");
+  let used = 0;
+  return {
+    get used() {
+      return used;
+    },
+    canAfford: (count) => used + count <= max,
+    track: (bucket) => new Proxy(bucket, {
+      get(target, property) {
+        const value = Reflect.get(target, property);
+        if (typeof value !== "function") return value;
+        return (...args) => {
+          if (used >= max) throw new BudgetExhausted();
+          used += 1;
+          return value.apply(target, args);
+        };
+      }
+    })
+  };
+}
+function encodeCursor(prefix, cursor) {
+  return btoa(JSON.stringify({ prefix, ...cursor }));
+}
+var VIDEO_FOLDER_SHAPE = /^(?:public|private)\/video\/[^/]+$/;
+function invalidCursor(reason) {
+  throw new RangeError(`cursor isn't one this function returned for this prefix: ${reason}`);
+}
+function parseCursor(cursor) {
+  try {
+    const parsed = JSON.parse(atob(cursor));
+    if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed))
+      return parsed;
+  } catch {
+  }
+  return invalidCursor("not a cursor");
+}
+var isOptionalString = (value) => value === void 0 || typeof value === "string";
+function validFolder(value, options) {
+  if (value === void 0) return void 0;
+  const { root, folder } = typeof value === "object" && value !== null ? value : {};
+  if (typeof root !== "string" || typeof folder !== "string" || !VIDEO_FOLDER_SHAPE.test(folder)) {
+    return invalidCursor("folder");
+  }
+  const folderPrefix = `${root}${folder}/`;
+  const place = placeOfStorageKey(`${folderPrefix}x`, options.root);
+  const isPlaced = place.kind === "object" && place.root === root;
+  if (!isPlaced || !folderPrefix.startsWith(options.prefix)) return invalidCursor("folder outside the prefix");
+  return { root, folder };
+}
+function decodeCursor(cursor, options) {
+  if (cursor === void 0) return {};
+  const { prefix, after, listCursor, folder } = parseCursor(cursor);
+  if (prefix !== options.prefix) return invalidCursor("another prefix");
+  if (!isOptionalString(after) || !isOptionalString(listCursor)) return invalidCursor("position");
+  if (typeof after === "string" && !after.startsWith(options.prefix))
+    return invalidCursor("position outside the prefix");
+  const pendingFolder = validFolder(folder, options);
+  return {
+    ...typeof after === "string" ? { after } : {},
+    ...typeof listCursor === "string" ? { listCursor } : {},
+    ...pendingFolder ? { folder: pendingFolder } : {}
+  };
+}
+async function walkPrefix(options, mediaBucket, start, visit) {
+  const limit = Math.min(Math.max(1, Math.floor(options.batchSize ?? DEFAULT_BATCH_SIZE)), MAX_BATCH_SIZE);
+  let position = { ...start };
+  let hasProgressed = false;
+  const stopped = () => ({ position, isDone: false, hasProgressed });
+  for (; ; ) {
+    let listing;
+    try {
+      listing = await mediaBucket.list({ prefix: options.prefix, limit, ...listFrom(position) });
+    } catch (error) {
+      if (error instanceof BudgetExhausted) return stopped();
+      throw error;
+    }
+    const stray = listing.objects.find((listed) => !listed.key.startsWith(options.prefix));
+    if (stray) throw new RangeError(`listing returned ${stray.key}, outside the prefix ${options.prefix}`);
+    for (const listed of listing.objects) {
+      try {
+        await visit({ listed, place: placeOfStorageKey(listed.key, options.root) });
+      } catch (error) {
+        if (error instanceof BudgetExhausted) return stopped();
+        throw error;
+      }
+      position = { after: listed.key };
+      hasProgressed = true;
+    }
+    if (!listing.truncated) return { position, isDone: true, hasProgressed };
+    if (listing.objects.length > 0) continue;
+    position = { ...position, listCursor: listing.cursor };
+    hasProgressed = true;
+  }
+}
+function listFrom(position) {
+  if (position.listCursor) return { cursor: position.listCursor };
+  return position.after ? { startAfter: position.after } : {};
+}
+function assertProgress(hasProgressed) {
+  if (hasProgressed) return;
+  throw new RangeError("maxSubrequests is too small to finish the next object: raise it");
+}
+
+// src/object-lock/prefix-delete.ts
+var VIDEO_FOLDER = /^((?:public|private)\/video\/[^/]+)\//;
+var isPending = (folder) => folder?.hasDeleted === true && !folder.hasRetained;
+async function deletePrefixRespectingLocks(options) {
+  const startedAt = /* @__PURE__ */ new Date();
+  const budget = subrequestBudget(options.maxSubrequests ?? DEFAULT_MAX_SUBREQUESTS);
+  const mediaBucket = budget.track(options.mediaBucket);
+  const keysBucket = options.keysBucket ? budget.track(options.keysBucket) : void 0;
+  const resolveLock3 = lockResolver(mediaBucket, startedAt);
+  const start = decodeCursor(options.cursor, options);
+  const result = {
+    deletedCount: 0,
+    deletedBytes: 0,
+    deletedKeyCount: 0,
+    retainedCount: 0,
+    retainedBytes: 0,
+    retained: [],
+    skippedCount: 0,
+    subrequests: 0
+  };
+  let openFolder = start.folder ? { ...start.folder, hasDeleted: true, hasRetained: false } : null;
+  let hasClosed = false;
+  const closeFolder = async () => {
+    if (isPending(openFolder)) {
+      const { root, folder } = openFolder;
+      const folderPrefix = `${root}${folder}/`;
+      const remaining = await mediaBucket.list({ prefix: folderPrefix, limit: 1 });
+      if (remaining.objects.length === 0) {
+        if (keysBucket) {
+          const keys = await keysWrittenBy(keysBucket, folderPrefix, startedAt);
+          result.deletedKeyCount += await deleteKeys(keysBucket, keys);
+        }
+        await forgetTranscodeCompleted(mediaBucket, root, folder);
+      }
+      hasClosed = true;
+    }
+    openFolder = null;
+  };
+  const enterFolder = async (place) => {
+    const videoFolder = VIDEO_FOLDER.exec(place.key)?.[1];
+    const folder = videoFolder && `${place.root}${videoFolder}/`.startsWith(options.prefix) ? videoFolder : void 0;
+    if (openFolder && openFolder.root === place.root && openFolder.folder === folder) return openFolder;
+    await closeFolder();
+    openFolder = folder ? { root: place.root, folder, hasDeleted: false, hasRetained: false } : null;
+    return openFolder;
+  };
+  const retain = (key, size, lock) => {
+    result.retained.push({ key, size, ...lock });
+    result.retainedCount += 1;
+    result.retainedBytes += size;
+  };
+  const visit = async ({ listed, place }) => {
+    if (place.kind === "reserved") {
+      result.skippedCount += 1;
+      return;
+    }
+    if (place.kind === "unrecognized") return retain(listed.key, listed.size, UNRECOGNIZED_LOCK);
+    const folder = await enterFolder(place);
+    const object = await mediaBucket.head(listed.key);
+    if (!object) return;
+    const locked = await resolveLock3(place, object);
+    if (locked) {
+      if (folder) folder.hasRetained = true;
+      return retain(listed.key, object.size, toStoredObjectLock(locked, place));
+    }
+    const keys = keysBucket ? await objectKeysToDelete(keysBucket, listed.key, object) : [];
+    if (!budget.canAfford(1 + deleteCallsFor(keys))) throw new BudgetExhausted();
+    await mediaBucket.delete(listed.key);
+    result.deletedCount += 1;
+    result.deletedBytes += object.size;
+    if (folder) folder.hasDeleted = true;
+    if (keysBucket) result.deletedKeyCount += await deleteKeys(keysBucket, keys);
+  };
+  const walk = await walkPrefix(options, mediaBucket, start, visit);
+  if (walk.isDone) {
+    try {
+      await closeFolder();
+    } catch (error) {
+      if (!(error instanceof BudgetExhausted)) throw error;
+    }
+  }
+  const pendingFolder = isPending(openFolder) ? { root: openFolder.root, folder: openFolder.folder } : void 0;
+  const isFinished = walk.isDone && !pendingFolder;
+  assertProgress(walk.hasProgressed || hasClosed || isFinished);
+  const cursor = isFinished ? void 0 : encodeCursor(options.prefix, { ...walk.position, ...pendingFolder ? { folder: pendingFolder } : {} });
+  return { ...result, ...cursor ? { cursor } : {}, subrequests: budget.used };
+}
+
+// src/object-lock/retained-summary.ts
+async function retainedSummary(options) {
+  const budget = subrequestBudget(options.maxSubrequests ?? DEFAULT_MAX_SUBREQUESTS);
+  const mediaBucket = budget.track(options.mediaBucket);
+  const resolveLock3 = lockResolver(mediaBucket, options.now ?? /* @__PURE__ */ new Date());
+  const summary = {
+    scannedCount: 0,
+    retainedCount: 0,
+    retainedBytes: 0,
+    hasHold: false,
+    subrequests: 0
+  };
+  const visit = async ({ listed, place }) => {
+    if (place.kind === "reserved") return;
+    let lock = UNRECOGNIZED_LOCK;
+    let size = listed.size;
+    if (place.kind === "object") {
+      const object = await mediaBucket.head(listed.key);
+      if (!object) return;
+      lock = toStoredObjectLock(await resolveLock3(place, object), place);
+      size = object.size;
+    }
+    summary.scannedCount += 1;
+    if (!lock.locked) return;
+    summary.retainedCount += 1;
+    summary.retainedBytes += size;
+    if (lock.hold) summary.hasHold = true;
+    if (lock.until && (!summary.latestUntil || lock.until > summary.latestUntil)) summary.latestUntil = lock.until;
+  };
+  const walk = await walkPrefix(options, mediaBucket, decodeCursor(options.cursor, options), visit);
+  assertProgress(walk.hasProgressed || walk.isDone);
+  const cursor = walk.isDone ? void 0 : encodeCursor(options.prefix, walk.position);
+  return { ...summary, ...cursor ? { cursor } : {}, subrequests: budget.used };
 }
 
 // src/index.ts
 function createWorker(options) {
   const { middleware, routes, hooks } = composePlugins(options?.plugins ?? defaultPlugins());
-  const app = new Hono10();
+  const app = new Hono11();
   app.use("*", logger());
   app.use(
     "*",
@@ -3941,6 +5274,7 @@ function createWorker(options) {
     context.set(PLUGIN_HOOKS_VARIABLE, hooks);
     await next();
   });
+  app.use("/v1/*", rejectReservedLockPaths);
   for (const handler of middleware) app.use("*", handler);
   app.get("/health", (c) => c.json({ status: "ok" }));
   app.post("/v1/metrics/playback", (c) => c.body(null, 204));
@@ -3951,6 +5285,7 @@ function createWorker(options) {
   app.route("/v1/transcode", transcode);
   app.route("/v1/captions", captions);
   app.route("/v1/token", token);
+  app.route("/v1/lock", lockRoute);
   for (const route of routes) app.route(route.path, route.app);
   app.notFound((c) => c.json({ error: "Not found" }, 404));
   app.onError((err, c) => {
@@ -3961,10 +5296,20 @@ function createWorker(options) {
 }
 export {
   DownloadLink,
+  ENCRYPTION_KEY_MISSING_CODE,
+  HOLD_PAGE_SIZE,
+  KEYS_BUCKET_MISSING_CODE,
+  LOCK_AUDIT_PREFIX,
+  LOCK_HOLD_HEADER,
+  LOCK_METADATA_KEY,
+  LOCK_SIDECAR_PREFIX,
+  LOCK_UNTIL_HEADER,
   MAX_ASSET_LIST_LIMIT,
+  MAX_EXPIRED_LOOKUPS,
   MAX_UPLOAD_TOKEN_TTL_SECONDS,
   MaxResolution,
   ObjectMeta,
+  RESERVED_LOCK_PREFIXES,
   TOKEN_REJECTED_CODE,
   UPLOAD_TOKEN_TYPE,
   WorkerAuthErrorCode,
@@ -3973,6 +5318,7 @@ export {
   credentialPolicy,
   defaultPlugins,
   deletePrefix,
+  deletePrefixRespectingLocks,
   downloadLinks,
   edgeCacheTag,
   getPendingUpload,
@@ -3991,10 +5337,12 @@ export {
   parseEncodeMetrics,
   parseTransformParams,
   readImageOriginScope,
+  readObjectLock,
   readStoryboardKey,
   readTokenScopes,
   readTranscodeOutputKeys,
   readTranscodeOutputs,
+  retainedSummary,
   servedCacheControl,
   staticConfig,
   storageKey,