@devultur/self-host 1.5.1 → 1.6.0

package/dist/index.js

@@ -23,6 +23,7 @@ import {
   hashKey,
   isAuthenticated,
   isBearerAuthorized,
+  isConstantTimeEqual,
   isContentTypeAllowed,
   isServiceToken,
   isTranscodeWebhookAuthorized,
@@ -41,7 +42,7 @@ import {
   verifyJobLocation,
   verifyJobTicket,
   verifyViewerToken
-} from "./chunk-PQO3X57I.js";
+} from "./chunk-BPHMKSQ7.js";
 import {
   ImageTransformsMode,
   WORKER_DECODABLE_TYPES,
@@ -62,13 +63,17 @@ import {
 
 // src/index.ts
 import {
+  ENCRYPTED_HEADER as ENCRYPTED_HEADER2,
   EXPIRES_AT_HEADER as EXPIRES_AT_HEADER2,
+  GRANT_EXPIRES_AT_HEADER as GRANT_EXPIRES_AT_HEADER2,
+  GRANT_KEY_HEADER as GRANT_KEY_HEADER2,
+  GRANT_METADATA_HEADER as GRANT_METADATA_HEADER2,
   REPR_DIGEST_HEADER as REPR_DIGEST_HEADER2,
   SESSION_HEADER as SESSION_HEADER2,
   SHA256_HEADER as SHA256_HEADER3,
   SHA256_VERIFIED_HEADER as SHA256_VERIFIED_HEADER2
 } from "@devultur/core";
-import { Hono as Hono11 } from "hono";
+import { Hono as Hono13 } from "hono";
 import { cors } from "hono/cors";
 import { logger } from "hono/logger";
 
@@ -77,7 +82,13 @@ import { isVideoRawKey } from "@devultur/core";
 
 // src/plugin-hooks.ts
 var PLUGIN_HOOKS_VARIABLE = "pluginHooks";
-var NO_HOOKS = { issueCredential: [], beforeLinkRedeem: [], authorizeLockChange: [], onLockAudit: [] };
+var NO_HOOKS = {
+  issueCredential: [],
+  beforeLinkRedeem: [],
+  authorizeGrant: [],
+  authorizeLockChange: [],
+  onLockAudit: []
+};
 function getPluginHooks(context) {
   return { ...NO_HOOKS, ...context.get(PLUGIN_HOOKS_VARIABLE) };
 }
@@ -100,6 +111,13 @@ async function gateLinkRedemption(context, link) {
   }
   return null;
 }
+async function gateGrantAccess(context, request) {
+  for (const hook of getPluginHooks(context).authorizeGrant) {
+    const refusal2 = await hook(context, request);
+    if (refusal2) return refusal2;
+  }
+  return null;
+}
 async function decideLockChange(context, request) {
   const hooks = getPluginHooks(context).authorizeLockChange;
   for (const hook of hooks) {
@@ -700,6 +718,7 @@ function composePlugins(plugins) {
     hooks: {
       issueCredential: plugins.flatMap((plugin) => plugin.issueCredential ? [plugin.issueCredential] : []),
       beforeLinkRedeem: plugins.flatMap((plugin) => plugin.beforeLinkRedeem ? [plugin.beforeLinkRedeem] : []),
+      authorizeGrant: plugins.flatMap((plugin) => plugin.authorizeGrant ? [plugin.authorizeGrant] : []),
       authorizeLockChange: plugins.flatMap(
         (plugin) => plugin.authorizeLockChange ? [plugin.authorizeLockChange] : []
       ),
@@ -721,7 +740,7 @@ function credentialPolicy(options = {}) {
 }
 
 // src/plugins/download-links.ts
-import { Hono as Hono3 } from "hono";
+import { Hono as Hono5 } from "hono";
 
 // src/routes/download.ts
 import { contentDispositionAttachment as contentDispositionAttachment2, relativeMediaPath, TokenScope } from "@devultur/core";
@@ -792,6 +811,35 @@ var DownloadLink = class {
   }
 };
 
+// src/grant-credential.ts
+import { DOWNLOAD_GRANT_ID_PREFIX, DOWNLOAD_GRANT_PREFIX } from "@devultur/core";
+var OBJECT_ID = "[0-9a-f]{64}";
+var GRANT_ID = "[A-Za-z0-9_-]{22}";
+var SECRET = "[A-Za-z0-9_-]{43}";
+var SECRET_PATTERN = new RegExp(`^${DOWNLOAD_GRANT_PREFIX}(${OBJECT_ID})\\.(${GRANT_ID})\\.(${SECRET})$`);
+var PUBLIC_ID_PATTERN = new RegExp(`^${DOWNLOAD_GRANT_ID_PREFIX}(${OBJECT_ID})\\.(${GRANT_ID})$`);
+function randomBase64Url(bytes) {
+  const random = crypto.getRandomValues(new Uint8Array(bytes));
+  return btoa(String.fromCharCode(...random)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+var newGrantId = () => randomBase64Url(16);
+var newGrantSecret = () => randomBase64Url(32);
+function formatGrantSecret({ objectId, grantId, secret }) {
+  return `${DOWNLOAD_GRANT_PREFIX}${objectId}.${grantId}.${secret}`;
+}
+function formatGrantPublicId({ objectId, grantId }) {
+  return `${DOWNLOAD_GRANT_ID_PREFIX}${objectId}.${grantId}`;
+}
+function parseGrantSecret(value) {
+  const match = SECRET_PATTERN.exec(value);
+  return match ? { objectId: match[1], grantId: match[2], secret: match[3] } : null;
+}
+function parseGrantPublicId(value) {
+  const match = PUBLIC_ID_PATTERN.exec(value);
+  return match ? { objectId: match[1], grantId: match[2] } : null;
+}
+var hashGrantSecret = (secret) => hashKey(secret);
+
 // src/route-result.ts
 var ROUTE_RESULT_VARIABLE = "routeResult";
 function getRouteResult(context) {
@@ -988,8 +1036,8 @@ function allowedUploadMetadata(metadata) {
   if (!metadata) return {};
   return Object.fromEntries(Object.entries(metadata).filter(([key]) => !isWorkerMetadataKey(key)));
 }
-function targetFailure(context, failure4) {
-  return context.json({ error: failure4.error, code: failure4.code }, failure4.status);
+function targetFailure(context, failure5) {
+  return context.json({ error: failure5.error, code: failure5.code }, failure5.status);
 }
 function alreadyExists(context, key) {
   return context.json(
@@ -1162,10 +1210,7 @@ var DEFAULT_LINK_TTL_SECONDS = 15 * 60;
 var MAX_LINK_TTL_SECONDS = 7 * 24 * 60 * 60;
 var MAX_LINK_USES = 100;
 var LINK_ID_PATTERN = /^[A-Za-z0-9_-]{22}$/;
-function newLinkId() {
-  const bytes = crypto.getRandomValues(new Uint8Array(16));
-  return btoa(String.fromCharCode(...bytes)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
+var newLinkId = () => randomBase64Url(16);
 function linkStub(namespace, linkId) {
   return namespace.get(namespace.idFromName(linkId));
 }
@@ -1205,9 +1250,8 @@ async function handleDownloadLink(context) {
   });
   if (!decision.allow) return decision.response;
   const expiresAt = cappedExpiry(requestedExpiresAt, decision.expiresAt, (epochMs) => epochMs);
-  const linkId = newLinkId();
   const scope = getRequestState(context);
-  const record = {
+  const created = await storeLink(context, namespace, {
     storageKey: fullKey,
     key: parsed.key,
     expiresAt,
@@ -1215,14 +1259,18 @@ async function handleDownloadLink(context) {
     ...parsed.filename ? { filename: parsed.filename } : {},
     storagePrefix: scope.storagePrefix,
     ...scope.context ? { context: scope.context } : {}
-  };
+  });
+  if (!created) return context.json({ error: "Could not create the download link" }, 500);
+  return context.json({ ...created, expiresAt, maxUses: parsed.maxUses });
+}
+async function storeLink(context, namespace, record) {
+  const linkId = newLinkId();
   const created = await linkStub(namespace, linkId).fetch(`https://download-link${DownloadLinkPath.CREATE}`, {
     method: "POST",
     body: JSON.stringify(record)
   });
-  if (!created.ok) return context.json({ error: "Could not create the download link" }, 500);
-  const origin = new URL(context.req.url).origin;
-  return context.json({ url: `${origin}/v1/download/${linkId}`, expiresAt, maxUses: parsed.maxUses });
+  if (!created.ok) return null;
+  return { id: linkId, url: `${new URL(context.req.url).origin}/v1/download/${linkId}` };
 }
 function attachmentDisposition(record, storedDisposition) {
   if (record.filename) return contentDispositionAttachment2(record.filename);
@@ -1274,14 +1322,700 @@ download.get("/:linkId", async (context) => {
   return response;
 });
 
+// src/routes/grant-bearer.ts
+import {
+  DownloadGrantErrorCode as DownloadGrantErrorCode2,
+  DownloadGrantLimits,
+  ENCRYPTED_HEADER,
+  GRANT_EXPIRES_AT_HEADER,
+  GRANT_KEY_HEADER,
+  GRANT_METADATA_HEADER,
+  TokenScope as TokenScope2
+} from "@devultur/core";
+import { Hono as Hono3 } from "hono";
+
+// src/download-grants.ts
+import { DownloadGrantErrorCode } from "@devultur/core";
+var DownloadGrantPath = {
+  /** Stores a new grant. Body: the record without `linksIssued`/`revokedAt`. */
+  CREATE: "/create",
+  /** The live grant for `{ id, secretHash }`. */
+  AUTHORIZE: "/authorize",
+  /** The grant for `{ id, secretHash }`, live or not: who it belongs to, before deciding anything. */
+  IDENTIFY: "/identify",
+  /** Spends one link of a live grant. Body: `{ id, secretHash, expiresIn, maxUses }`. */
+  ISSUE: "/issue",
+  /** Gives back a link spent by `ISSUE` whose creation failed. Body: `{ id }`. */
+  REFUND: "/refund",
+  /** Revokes `{ id }` (the owner) or `{ id, secretHash }` (the bearer). Idempotent. */
+  REVOKE: "/revoke",
+  /** One grant by `{ id }`, live or not, for the owner. */
+  GET: "/get",
+  /** Every grant of the file, for the owner. */
+  LIST: "/list",
+  /** Revokes every grant of the file: it's gone. They stay listed until they expire. */
+  REVOKE_ALL: "/revoke-all"
+};
+var GRANT_KEY_PREFIX = "grant:";
+var grantKey = (id) => `${GRANT_KEY_PREFIX}${id}`;
+var failure = (status, code, error) => Response.json({ error, code }, { status });
+var invalidGrant = () => failure(401, DownloadGrantErrorCode.INVALID, "Invalid download grant");
+var grantGone = () => failure(410, DownloadGrantErrorCode.GONE, "This download grant is no longer valid");
+var notFound2 = () => failure(404, DownloadGrantErrorCode.NOT_FOUND, "Download grant not found");
+function grantInfoOf(record) {
+  const { secretHash: _secretHash, ...info } = record;
+  return info;
+}
+function isGrantDead(record, now = Date.now()) {
+  return record.revokedAt !== null || record.expiresAt <= now;
+}
+function fitsLinkCaps(caps, expiresIn, maxUses) {
+  return expiresIn <= caps.maxExpiresIn && maxUses <= caps.maxUses;
+}
+var DownloadGrants = class {
+  state;
+  storage;
+  constructor(state) {
+    this.state = state;
+    this.storage = state.storage;
+  }
+  async fetch(request) {
+    if (request.method !== "POST") return new Response(null, { status: 405 });
+    const handler = this.handlerFor(new URL(request.url).pathname);
+    if (!handler) return new Response(null, { status: 404 });
+    const body = await request.json().catch(() => ({}));
+    return this.state.blockConcurrencyWhile(() => handler(body));
+  }
+  handlerFor(pathname) {
+    switch (pathname) {
+      case DownloadGrantPath.CREATE:
+        return (body) => this.create(body);
+      case DownloadGrantPath.AUTHORIZE:
+        return (body) => this.authorize(body);
+      case DownloadGrantPath.IDENTIFY:
+        return (body) => this.identify(body);
+      case DownloadGrantPath.ISSUE:
+        return (body) => this.issue(body);
+      case DownloadGrantPath.REFUND:
+        return (body) => this.refund(body);
+      case DownloadGrantPath.REVOKE:
+        return (body) => this.revoke(body);
+      case DownloadGrantPath.GET:
+        return (body) => this.getOne(body);
+      case DownloadGrantPath.LIST:
+        return () => this.list();
+      case DownloadGrantPath.REVOKE_ALL:
+        return () => this.revokeAll();
+      default:
+        return null;
+    }
+  }
+  async create(record) {
+    if (await this.storage.get(grantKey(record.id))) {
+      return failure(409, "grant_exists", "Grant id already in use");
+    }
+    await this.storage.put(grantKey(record.id), { ...record, linksIssued: 0, revokedAt: null });
+    await this.scheduleAlarm();
+    return Response.json({ ok: true }, { status: 201 });
+  }
+  async recordOf(id) {
+    return typeof id === "string" ? this.storage.get(grantKey(id)) : void 0;
+  }
+  /** The record whose secret hash matches, live or not, or 401. */
+  async matchingRecord(body) {
+    const record = await this.recordOf(body.id);
+    const secretHash = typeof body.secretHash === "string" ? body.secretHash : "";
+    if (!record || !isConstantTimeEqual(secretHash, record.secretHash)) return invalidGrant();
+    return record;
+  }
+  /** The live record whose secret hash matches, or the response explaining why not. */
+  async liveRecord(body) {
+    const record = await this.matchingRecord(body);
+    if (record instanceof Response) return record;
+    if (isGrantDead(record)) return grantGone();
+    return record;
+  }
+  async identify(body) {
+    const record = await this.matchingRecord(body);
+    return record instanceof Response ? record : Response.json(grantInfoOf(record));
+  }
+  async authorize(body) {
+    const record = await this.liveRecord(body);
+    return record instanceof Response ? record : Response.json(grantInfoOf(record));
+  }
+  /** Spends one link: caps first (a refused link spends nothing), then the total. */
+  async issue(body) {
+    const record = await this.liveRecord(body);
+    if (record instanceof Response) return record;
+    if (!fitsLinkCaps(record.link, Number(body.expiresIn), Number(body.maxUses))) {
+      return Response.json(
+        {
+          error: "The link exceeds the grant's caps",
+          code: DownloadGrantErrorCode.LINK_EXCEEDS_GRANT,
+          link: record.link
+        },
+        { status: 400 }
+      );
+    }
+    if (record.linksIssued >= record.maxLinks) {
+      return failure(410, DownloadGrantErrorCode.EXHAUSTED, "This download grant has issued all its links");
+    }
+    const spent = { ...record, linksIssued: record.linksIssued + 1 };
+    await this.storage.put(grantKey(record.id), spent);
+    return Response.json(grantInfoOf(spent));
+  }
+  async refund(body) {
+    const record = await this.recordOf(body.id);
+    if (!record) return notFound2();
+    await this.storage.put(grantKey(record.id), { ...record, linksIssued: Math.max(0, record.linksIssued - 1) });
+    return new Response(null, { status: 204 });
+  }
+  /** Without `secretHash` the route already authorized the owner; with it, only the grant's own secret revokes it. */
+  async revoke(body) {
+    const record = await this.recordOf(body.id);
+    if (!record) return body.secretHash === void 0 ? notFound2() : invalidGrant();
+    const isBearer = body.secretHash !== void 0;
+    if (isBearer && !isConstantTimeEqual(String(body.secretHash), record.secretHash)) return invalidGrant();
+    if (record.revokedAt !== null) return Response.json(grantInfoOf(record));
+    const revoked = { ...record, revokedAt: Date.now() };
+    await this.storage.put(grantKey(record.id), revoked);
+    return Response.json(grantInfoOf(revoked));
+  }
+  async getOne(body) {
+    const record = await this.recordOf(body.id);
+    return record ? Response.json(grantInfoOf(record)) : notFound2();
+  }
+  async records() {
+    const stored = await this.storage.list({ prefix: GRANT_KEY_PREFIX });
+    return [...stored.values()];
+  }
+  async list() {
+    const records = await this.records();
+    return Response.json(records.sort((first, second) => first.createdAt - second.createdAt).map(grantInfoOf));
+  }
+  async revokeAll() {
+    const now = Date.now();
+    for (const record of await this.records()) {
+      if (record.revokedAt === null) await this.storage.put(grantKey(record.id), { ...record, revokedAt: now });
+    }
+    return new Response(null, { status: 204 });
+  }
+  /** Alarm at the earliest expiry among the stored grants; none left: no alarm. */
+  async scheduleAlarm() {
+    const expiries = (await this.records()).map((record) => record.expiresAt);
+    if (expiries.length === 0) {
+      await this.storage.deleteAlarm();
+      return;
+    }
+    await this.storage.setAlarm(Math.min(...expiries));
+  }
+  /** Drops the grants past their expiry (revoked ones stay listed until then) and schedules the next alarm. */
+  async alarm() {
+    const now = Date.now();
+    for (const record of await this.records()) {
+      if (record.expiresAt <= now) await this.storage.delete(grantKey(record.id));
+    }
+    await this.scheduleAlarm();
+  }
+};
+
+// src/routes/grant-shared.ts
+function grantNamespaces(context) {
+  const { DOWNLOAD_GRANTS: grants, DOWNLOAD_LINKS: links } = context.env;
+  return grants && links ? { grants, links } : null;
+}
+function notConfigured2(context) {
+  return context.json({ error: "Download grants are not configured", code: "not_configured" }, 501);
+}
+function fileGrantsObject(namespace, storageKey2) {
+  const id = namespace.idFromName(storageKey2);
+  return { objectId: id.toString(), stub: namespace.get(id) };
+}
+function grantsObjectById(namespace, objectId) {
+  try {
+    return namespace.get(namespace.idFromString(objectId));
+  } catch {
+    return null;
+  }
+}
+function callGrants(stub, path, body = {}) {
+  return stub.fetch(`https://download-grants${path}`, { method: "POST", body: JSON.stringify(body) });
+}
+var relayGrantFailure = (response) => new Response(response.body, { status: response.status, headers: response.headers });
+function grantListEntry(objectId, grant) {
+  return {
+    id: formatGrantPublicId({ objectId, grantId: grant.id }),
+    key: grant.key,
+    expiresAt: grant.expiresAt,
+    link: grant.link,
+    maxLinks: grant.maxLinks,
+    canDelete: grant.canDelete,
+    ...grant.metadata ? { metadata: grant.metadata } : {},
+    linksIssued: grant.linksIssued,
+    createdAt: grant.createdAt,
+    revokedAt: grant.revokedAt
+  };
+}
+var isPlainObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+function parseMetadata(value, maxBytes) {
+  if (value === void 0) return void 0;
+  if (!isPlainObject(value)) return null;
+  if (!Object.values(value).every((entry) => typeof entry === "string")) return null;
+  const size = new TextEncoder().encode(JSON.stringify(value)).byteLength;
+  return size <= maxBytes ? value : null;
+}
+function parseCount(value, fallback2, max) {
+  const count = value ?? fallback2;
+  return typeof count === "number" && Number.isSafeInteger(count) && count > 0 && count <= max ? count : null;
+}
+
+// src/routes/media-delete.ts
+import { videoBasePath } from "@devultur/core";
+
+// src/transcode/raw-retention.ts
+import { isVideoRawKey as isVideoRawKey2 } from "@devultur/core";
+var disposalKey = (videoId) => `${KvPrefix.TRANSCODE_RAW}:${videoId}`;
+async function readRawDisposal(kv, videoId) {
+  return kv.get(disposalKey(videoId), "json");
+}
+async function rememberRawDisposal(kv, videoId, disposal) {
+  await kv.put(disposalKey(videoId), JSON.stringify(disposal), { expirationTtl: KV_JOB_TTL_SECONDS });
+}
+async function disposeRawAfterTranscode(context, videoId) {
+  const { env } = context;
+  const disposal = await readRawDisposal(env.MEDIA_KV, videoId);
+  if (!disposal?.deleteOnComplete || !disposal.storageKey) return "kept";
+  const raw = await env.MEDIA_BUCKET.head(disposal.storageKey);
+  const location = splitVideoStorageKey(disposal.storageKey);
+  const lock = raw && location ? await effectiveLock(env.MEDIA_BUCKET, location.root, location.key, raw) : null;
+  if (lock?.state && isStateLocked(lock.state, /* @__PURE__ */ new Date())) {
+    await recordLockAudit(context, {
+      action: "original_retained",
+      keys: [location?.key ?? disposal.storageKey],
+      before: lock.state.lock,
+      after: null,
+      outcome: "skipped",
+      root: location?.root ?? ""
+    });
+    return "retained";
+  }
+  await env.MEDIA_BUCKET.delete(disposal.storageKey);
+  if (env.KEYS_BUCKET) await deletePrefix(env.KEYS_BUCKET, `${disposal.storageKey}/`);
+  return "deleted";
+}
+var ORIGINAL_NOT_RETAINED = {
+  error: "The original of this video is no longer retained, so it can't be re-encoded. Upload it again, or set `config.transcode.deleteOriginalOnSuccess` to false for future videos.",
+  code: "original_not_retained"
+};
+var PRIOR_OUTPUTS_LIST_LIMIT = 100;
+async function hasPriorTranscodeOutputs(bucket, videoFolder) {
+  const listing = await bucket.list({ prefix: videoFolder, limit: PRIOR_OUTPUTS_LIST_LIMIT });
+  return listing.objects.some((object) => !isVideoRawKey2(object.key));
+}
+
+// src/object-lock/transcode-marker.ts
+var MARKER_NAME = "transcode-completed";
+var markerKey = (root, videoFolder) => sidecarKey(root, `${videoFolder}/${MARKER_NAME}`);
+async function markTranscodeCompleted(env, videoId, ticketLocation) {
+  const location = ticketLocation ?? await rememberedLocation(env, videoId);
+  if (!location) return;
+  await env.MEDIA_BUCKET.put(markerKey(location.root, location.folder), (/* @__PURE__ */ new Date()).toISOString(), {
+    httpMetadata: { contentType: "text/plain" }
+  });
+}
+async function rememberedLocation(env, videoId) {
+  const disposal = await readRawDisposal(env.MEDIA_KV, videoId);
+  const raw = disposal?.storageKey ? splitVideoStorageKey(disposal.storageKey) : null;
+  const folder = raw?.key.split("/").slice(0, 3).join("/");
+  return raw && folder ? { root: raw.root, folder } : null;
+}
+async function hasCompletedTranscode(bucket, root, videoFolder) {
+  return await bucket.head(markerKey(root, videoFolder)) !== null;
+}
+async function forgetTranscodeCompleted(bucket, root, videoFolder) {
+  await bucket.delete(markerKey(root, videoFolder));
+}
+
+// src/routes/media-delete.ts
+async function handleVideoDelete(context) {
+  const videoId = context.req.param("videoId") ?? "";
+  const visibilityParam = context.req.query("visibility");
+  const visibilities = visibilityParam === "public" || visibilityParam === "private" ? [visibilityParam] : ["public", "private"];
+  const folders = visibilities.map((visibility) => `${visibility}/${videoBasePath(videoId)}`);
+  const blocked = await assertWritable(context, folders, "delete");
+  if (blocked) return blocked;
+  let deletedCount = 0;
+  let deletedKeyCount = 0;
+  for (const folder of folders) {
+    const deleted = await guardedDeletePrefix(context, `${folder}/`);
+    if ("blocked" in deleted) return deleted.blocked;
+    deletedCount += deleted.deletedCount;
+    if (deleted.deletedCount > 0) {
+      await forgetTranscodeCompleted(context.env.MEDIA_BUCKET, getRequestState(context).storagePrefix, folder);
+    }
+    if (!folder.startsWith("private/")) continue;
+    const deletedKeys = await deleteFolderKeys(context, folder);
+    if ("blocked" in deletedKeys) return deletedKeys.blocked;
+    deletedKeyCount += deletedKeys.deletedCount;
+  }
+  return context.json({ videoId, deletedCount, deletedKeyCount });
+}
+function handleKeyDelete(context) {
+  return deleteMediaKey(context, context.req.param("key") ?? "");
+}
+async function deleteMediaKey(context, key) {
+  const fullKey = storageKey(context, key);
+  if (isVariantKey(key)) {
+    return context.json({ error: "Not found" }, 404);
+  }
+  if (isReservedLockKey(key)) return reservedKeyResponse(context, key);
+  const exists = await context.env.MEDIA_BUCKET.head(fullKey);
+  if (!exists) {
+    return context.json({ error: "Not found" }, 404);
+  }
+  const blocked = await assertWritable(context, [key], "delete");
+  if (blocked) return blocked;
+  await context.env.MEDIA_BUCKET.delete(fullKey);
+  const variants = await guardedDeletePrefix(context, variantPrefix(key));
+  if ("blocked" in variants) return variants.blocked;
+  const keys = await deleteKeysFor(context, key, exists);
+  if ("blocked" in keys) return keys.blocked;
+  return new Response(null, { status: 204 });
+}
+
+// src/routes/grant-bearer.ts
+var grantError = (status, code, error) => Response.json({ error, code }, { status });
+var invalidGrant2 = () => grantError(401, DownloadGrantErrorCode2.INVALID, "Invalid download grant");
+var grantGone2 = () => grantError(410, DownloadGrantErrorCode2.GONE, "This download grant is no longer valid");
+async function readBearer(context, grants) {
+  const bearer = context.req.header("Authorization")?.match(/^Bearer\s+(\S+)$/i)?.[1];
+  if (!bearer && context.req.query("token") !== void 0) {
+    return grantError(401, DownloadGrantErrorCode2.IN_QUERY, "Send the grant in Authorization: Bearer, never in a URL");
+  }
+  const parsed = bearer ? parseGrantSecret(bearer) : null;
+  const stub = parsed ? grantsObjectById(grants, parsed.objectId) : null;
+  if (!parsed || !stub) return invalidGrant2();
+  return {
+    stub,
+    parsed,
+    secretHash: await hashGrantSecret(parsed.secret),
+    publicId: formatGrantPublicId(parsed)
+  };
+}
+async function identifyDownloadGrant(anyContext) {
+  const context = anyContext;
+  const namespaces = grantNamespaces(context);
+  if (!namespaces) return notConfigured2(context);
+  const bearer = await readBearer(context, namespaces.grants);
+  if (bearer instanceof Response) return bearer;
+  const identified = await callGrants(bearer.stub, DownloadGrantPath.IDENTIFY, {
+    id: bearer.parsed.grantId,
+    secretHash: bearer.secretHash
+  });
+  if (!identified.ok) return relayGrantFailure(identified);
+  return { publicId: bearer.publicId, grant: await identified.json() };
+}
+async function grantedObject(context, bearer, grant) {
+  const object = await context.env.MEDIA_BUCKET.head(grant.storageKey);
+  if (!object) {
+    await callGrants(bearer.stub, DownloadGrantPath.REVOKE_ALL);
+    return grantGone2();
+  }
+  if (object.version !== grant.version || isObjectExpired(object.customMetadata)) return grantGone2();
+  return object;
+}
+async function authorizeGrant(context, action) {
+  const namespaces = grantNamespaces(context);
+  if (!namespaces) return notConfigured2(context);
+  const bearer = await readBearer(context, namespaces.grants);
+  if (bearer instanceof Response) return bearer;
+  const authorized = await callGrants(bearer.stub, DownloadGrantPath.AUTHORIZE, {
+    id: bearer.parsed.grantId,
+    secretHash: bearer.secretHash
+  });
+  if (!authorized.ok) return relayGrantFailure(authorized);
+  const grant = await authorized.json();
+  if (grant.storagePrefix !== getRequestState(context).storagePrefix) return invalidGrant2();
+  const refusal2 = await gateGrantAccess(context, { action, grant });
+  if (refusal2) return refusal2;
+  const object = await grantedObject(context, bearer, grant);
+  if (object instanceof Response) return object;
+  return { ...bearer, grant, object };
+}
+function headHeaders({ grant, object }) {
+  const headers = new Headers({
+    "Content-Type": object.httpMetadata?.contentType ?? "application/octet-stream",
+    "Content-Length": String(object.size),
+    ETag: object.httpEtag,
+    "Cache-Control": "private, no-store",
+    [ENCRYPTED_HEADER]: object.customMetadata?.enc ? "true" : "false",
+    [GRANT_EXPIRES_AT_HEADER]: String(grant.expiresAt),
+    [GRANT_KEY_HEADER]: grant.key
+  });
+  applyIntegrityHeaders(headers, object.customMetadata);
+  applyImageSizeHeaders(headers, object.customMetadata);
+  if (grant.metadata) headers.set(GRANT_METADATA_HEADER, encodeURIComponent(JSON.stringify(grant.metadata)));
+  return headers;
+}
+async function handleHead(context) {
+  if (context.req.method !== "HEAD") return new Response(null, { status: 405, headers: { Allow: "HEAD" } });
+  const authorized = await authorizeGrant(context, "head");
+  if (authorized instanceof Response) return authorized;
+  return new Response(null, { status: 200, headers: headHeaders(authorized) });
+}
+function parseGrantLinkRequest(body, grant) {
+  const defaultExpiresIn = Math.min(DownloadGrantLimits.DEFAULT_LINK_EXPIRES_IN, grant.link.maxExpiresIn);
+  const expiresIn = parseCount(body.expiresIn, defaultExpiresIn, MAX_LINK_TTL_SECONDS);
+  if (expiresIn === null)
+    return { error: "expiresIn must be a positive number of seconds", code: "invalid_expires_in" };
+  const maxUses = parseCount(body.maxUses, 1, Number.MAX_SAFE_INTEGER);
+  if (maxUses === null) return { error: "maxUses must be a positive integer", code: "invalid_max_uses" };
+  const metadata = parseMetadata(body.metadata, DownloadGrantLimits.MAX_METADATA_BYTES);
+  if (metadata === null)
+    return { error: "metadata must map strings to strings, 1 KB at most", code: "invalid_metadata" };
+  const filename = typeof body.filename === "string" && body.filename ? body.filename : void 0;
+  const parsed = {
+    expiresIn,
+    maxUses,
+    ...filename ? { filename } : {},
+    ...metadata ? { metadata } : {}
+  };
+  return parsed;
+}
+async function handleIssueLink(context) {
+  const namespaces = grantNamespaces(context);
+  if (!namespaces) return notConfigured2(context);
+  const authorized = await authorizeGrant(context, "issue-link");
+  if (authorized instanceof Response) return authorized;
+  const { grant, object, stub } = authorized;
+  const parsed = parseGrantLinkRequest(await context.req.json().catch(() => null) ?? {}, grant);
+  if ("error" in parsed) return context.json(parsed, 400);
+  const requestedExpiresAt = Math.min(
+    Date.now() + parsed.expiresIn * 1e3,
+    objectExpiresAt(object.customMetadata) ?? Number.POSITIVE_INFINITY,
+    grant.expiresAt
+  );
+  const decision = await decideCredential(context, {
+    kind: "download-link",
+    scopes: [TokenScope2.MEDIA_READ],
+    path: grant.key,
+    expiresAt: requestedExpiresAt
+  });
+  if (!decision.allow) return decision.response;
+  const credential = { id: authorized.parsed.grantId, secretHash: authorized.secretHash };
+  const spent = await callGrants(stub, DownloadGrantPath.ISSUE, { ...credential, ...parsed });
+  if (!spent.ok) return relayGrantFailure(spent);
+  const expiresAt = cappedExpiry(requestedExpiresAt, decision.expiresAt, (epochMs) => epochMs);
+  const created = await storeLink(context, namespaces.links, {
+    storageKey: grant.storageKey,
+    key: grant.key,
+    expiresAt,
+    maxUses: parsed.maxUses,
+    ...parsed.filename ? { filename: parsed.filename } : {},
+    storagePrefix: grant.storagePrefix,
+    ...grant.context ? { context: grant.context } : {},
+    grantId: authorized.publicId,
+    ...parsed.metadata ? { metadata: parsed.metadata } : {}
+  });
+  if (!created) {
+    await callGrants(stub, DownloadGrantPath.REFUND, { id: credential.id });
+    return context.json({ error: "Could not create the download link" }, 500);
+  }
+  return context.json({ ...created, expiresAt, maxUses: parsed.maxUses });
+}
+async function handleDeleteFile(context) {
+  const authorized = await authorizeGrant(context, "delete-file");
+  if (authorized instanceof Response) return authorized;
+  const { grant, stub, publicId } = authorized;
+  if (!grant.canDelete) {
+    return grantError(403, DownloadGrantErrorCode2.CANNOT_DELETE, "This download grant can't delete its file");
+  }
+  const deleted = await deleteMediaKey(context, grant.key);
+  if (deleted.status !== 204) return deleted;
+  await callGrants(stub, DownloadGrantPath.REVOKE_ALL);
+  addRouteResult(context, {
+    grantDeletedKey: grant.key,
+    revokedGrant: { publicId, grant: { ...grant, revokedAt: Date.now() }, by: "bearer" }
+  });
+  return deleted;
+}
+async function handleRevoke(context) {
+  const namespaces = grantNamespaces(context);
+  if (!namespaces) return notConfigured2(context);
+  const bearer = await readBearer(context, namespaces.grants);
+  if (bearer instanceof Response) return bearer;
+  const revoked = await callGrants(bearer.stub, DownloadGrantPath.REVOKE, {
+    id: bearer.parsed.grantId,
+    secretHash: bearer.secretHash
+  });
+  if (!revoked.ok) return relayGrantFailure(revoked);
+  const grant = await revoked.json();
+  if (grant.storagePrefix === getRequestState(context).storagePrefix) {
+    addRouteResult(context, { revokedGrant: { publicId: bearer.publicId, grant, by: "bearer" } });
+  }
+  return new Response(null, { status: 204 });
+}
+var grantBearer = new Hono3().get("/file", handleHead).post("/links", handleIssueLink).delete("/file", handleDeleteFile).delete("/", handleRevoke);
+
+// src/routes/grant-owner.ts
+import { DownloadGrantLimits as DownloadGrantLimits2, relativeMediaPath as relativeMediaPath2, TokenScope as TokenScope3 } from "@devultur/core";
+import { Hono as Hono4 } from "hono";
+var GRANT_DELETE_SCOPE = "media:delete";
+var invalid = (code, error) => ({ error, code });
+function parseLinkCaps(link) {
+  const maxExpiresIn = parseCount(
+    link?.maxExpiresIn,
+    DownloadGrantLimits2.DEFAULT_LINK_EXPIRES_IN,
+    DownloadGrantLimits2.MAX_LINK_EXPIRES_IN
+  );
+  if (maxExpiresIn === null) {
+    return invalid("invalid_link_caps", `link.maxExpiresIn must be 1..${DownloadGrantLimits2.MAX_LINK_EXPIRES_IN}`);
+  }
+  const maxUses = parseCount(
+    link?.maxUses,
+    DownloadGrantLimits2.DEFAULT_LINK_MAX_USES,
+    DownloadGrantLimits2.MAX_LINK_MAX_USES
+  );
+  if (maxUses === null) {
+    return invalid("invalid_link_caps", `link.maxUses must be 1..${DownloadGrantLimits2.MAX_LINK_MAX_USES}`);
+  }
+  return { maxExpiresIn, maxUses };
+}
+function parseGrantRequest(body) {
+  const key = typeof body.key === "string" ? body.key : "";
+  if (relativeMediaPath2(key) === null) return invalid("invalid_key", "key must be a visibility-prefixed media key");
+  const expiresIn = body.expiresIn === void 0 ? void 0 : parseCount(body.expiresIn, 0, Number.MAX_SAFE_INTEGER);
+  if (expiresIn === null) return invalid("invalid_expires_in", "expiresIn must be a positive number of seconds");
+  if (body.link !== void 0 && (typeof body.link !== "object" || body.link === null)) {
+    return invalid("invalid_link_caps", "link must be an object");
+  }
+  const link = parseLinkCaps(body.link);
+  if ("error" in link) return link;
+  const maxLinks = parseCount(body.maxLinks, DownloadGrantLimits2.DEFAULT_MAX_LINKS, DownloadGrantLimits2.MAX_MAX_LINKS);
+  if (maxLinks === null)
+    return invalid("invalid_max_links", `maxLinks must be 1..${DownloadGrantLimits2.MAX_MAX_LINKS}`);
+  if (body.canDelete !== void 0 && typeof body.canDelete !== "boolean") {
+    return invalid("invalid_can_delete", "canDelete must be a boolean");
+  }
+  const metadata = parseMetadata(body.metadata, DownloadGrantLimits2.MAX_METADATA_BYTES);
+  if (metadata === null) {
+    return invalid(
+      "invalid_metadata",
+      `metadata must map strings to strings, ${DownloadGrantLimits2.MAX_METADATA_BYTES} bytes at most`
+    );
+  }
+  return {
+    key,
+    ...expiresIn ? { expiresIn } : {},
+    link,
+    maxLinks,
+    canDelete: body.canDelete === true,
+    ...metadata ? { metadata } : {}
+  };
+}
+function grantExpiry(expiresIn, fileExpiresAt, now) {
+  const cap = fileExpiresAt ?? now + DownloadGrantLimits2.MAX_LIFETIME_SECONDS * 1e3;
+  return expiresIn === void 0 ? cap : Math.min(now + expiresIn * 1e3, cap);
+}
+async function handleCreateGrant(context) {
+  const namespaces = grantNamespaces(context);
+  if (!namespaces) return notConfigured2(context);
+  const parsed = parseGrantRequest(await context.req.json().catch(() => null) ?? {});
+  if ("error" in parsed) return context.json(parsed, 400);
+  const fullKey = storageKey(context, parsed.key);
+  const object = await context.env.MEDIA_BUCKET.head(fullKey);
+  if (!object) return context.json({ error: "Not found" }, 404);
+  if (isObjectExpired(object.customMetadata)) return expiredResponse();
+  const requestedExpiresAt = grantExpiry(parsed.expiresIn, objectExpiresAt(object.customMetadata), Date.now());
+  const decision = await decideCredential(context, {
+    kind: "download-grant",
+    scopes: parsed.canDelete ? [TokenScope3.MEDIA_READ, GRANT_DELETE_SCOPE] : [TokenScope3.MEDIA_READ],
+    path: parsed.key,
+    expiresAt: requestedExpiresAt
+  });
+  if (!decision.allow) return decision.response;
+  const { objectId, stub } = fileGrantsObject(namespaces.grants, fullKey);
+  const grantId = newGrantId();
+  const secret = newGrantSecret();
+  const scope = getRequestState(context);
+  const record = {
+    id: grantId,
+    secretHash: await hashGrantSecret(secret),
+    storageKey: fullKey,
+    key: parsed.key,
+    version: object.version,
+    storagePrefix: scope.storagePrefix,
+    expiresAt: cappedExpiry(requestedExpiresAt, decision.expiresAt, (epochMs) => epochMs),
+    link: parsed.link,
+    maxLinks: parsed.maxLinks,
+    canDelete: parsed.canDelete,
+    ...parsed.metadata ? { metadata: parsed.metadata } : {},
+    ...scope.context ? { context: scope.context } : {},
+    createdAt: Date.now()
+  };
+  const created = await callGrants(stub, DownloadGrantPath.CREATE, record);
+  if (!created.ok) return context.json({ error: "Could not create the download grant" }, 500);
+  const publicId = formatGrantPublicId({ objectId, grantId });
+  const { secretHash: _secretHash, ...info } = record;
+  addRouteResult(context, { issuedGrant: { publicId, grant: { ...info, linksIssued: 0, revokedAt: null } } });
+  const grant = {
+    grant: formatGrantSecret({ objectId, grantId, secret }),
+    id: publicId,
+    key: record.key,
+    expiresAt: record.expiresAt,
+    link: record.link,
+    maxLinks: record.maxLinks,
+    canDelete: record.canDelete,
+    ...record.metadata ? { metadata: record.metadata } : {}
+  };
+  return context.json(grant);
+}
+async function handleListGrants(context) {
+  const namespaces = grantNamespaces(context);
+  if (!namespaces) return notConfigured2(context);
+  const key = context.req.query("key") ?? "";
+  if (relativeMediaPath2(key) === null) {
+    return context.json({ error: "key must be a visibility-prefixed media key", code: "invalid_key" }, 400);
+  }
+  const { objectId, stub } = fileGrantsObject(namespaces.grants, storageKey(context, key));
+  const listed = await callGrants(stub, DownloadGrantPath.LIST);
+  if (!listed.ok) return context.json({ error: "Could not list the download grants" }, 500);
+  const grants = await listed.json();
+  return context.json(grants.map((grant) => grantListEntry(objectId, grant)));
+}
+var grantNotFound = (context) => context.json({ error: "Download grant not found", code: "grant_not_found" }, 404);
+async function handleRevokeGrant(context) {
+  const namespaces = grantNamespaces(context);
+  if (!namespaces) return notConfigured2(context);
+  const publicId = context.req.param("id") ?? "";
+  const location = parseGrantPublicId(publicId);
+  const stub = location ? grantsObjectById(namespaces.grants, location.objectId) : null;
+  if (!location || !stub) return grantNotFound(context);
+  const found = await callGrants(stub, DownloadGrantPath.GET, { id: location.grantId });
+  if (!found.ok) return grantNotFound(context);
+  const grant = await found.json();
+  if (grant.storagePrefix !== getRequestState(context).storagePrefix) return grantNotFound(context);
+  const refusal2 = await gateGrantAccess(context, { action: "owner-revoke", grant });
+  if (refusal2) return refusal2;
+  const revoked = await callGrants(stub, DownloadGrantPath.REVOKE, { id: location.grantId });
+  if (!revoked.ok) return context.json({ error: "Could not revoke the download grant" }, 500);
+  addRouteResult(context, {
+    revokedGrant: { publicId, grant: await revoked.json(), by: "owner" }
+  });
+  return new Response(null, { status: 204 });
+}
+var grantOwner = new Hono4().post("/", handleCreateGrant).get("/", handleListGrants).delete("/:id", handleRevokeGrant);
+
 // src/plugins/download-links.ts
 function downloadLinks() {
-  const issue = new Hono3().post("/", handleDownloadLink);
+  const issue = new Hono5().post("/", handleDownloadLink);
   return {
     name: "download-links",
     routes: [
       { path: "/v1/token/download", app: issue },
-      { path: "/v1/download", app: download }
+      { path: "/v1/download", app: download },
+      { path: "/v1/token/grant", app: grantOwner },
+      { path: "/v1/grant", app: grantBearer }
     ]
   };
 }
@@ -1336,7 +2070,7 @@ import {
 } from "@devultur/core";
 
 // src/routes/viewer-token-claims.ts
-import { coversScope, isWithinPathPrefix, relativeMediaPath as relativeMediaPath2, TokenScope as TokenScope2 } from "@devultur/core";
+import { coversScope, isWithinPathPrefix, relativeMediaPath as relativeMediaPath3, TokenScope as TokenScope4 } from "@devultur/core";
 var TOKEN_REJECTED_CODE = "token_rejected";
 function isOtherAudience(payload, storagePrefix2) {
   if (payload.aud === void 0) return false;
@@ -1345,12 +2079,12 @@ function isOtherAudience(payload, storagePrefix2) {
 function isOutsideResource(payload, key) {
   if (payload.res === void 0) return false;
   if (typeof payload.res !== "string") return true;
-  const relativePath = relativeMediaPath2(key);
+  const relativePath = relativeMediaPath3(key);
   return relativePath === null || !isWithinPathPrefix(relativePath, payload.res);
 }
 function lacksReadScope(payload) {
   const scopes = readTokenScopes(payload);
-  return scopes !== void 0 && !coversScope(scopes, TokenScope2.MEDIA_READ);
+  return scopes !== void 0 && !coversScope(scopes, TokenScope4.MEDIA_READ);
 }
 function rejectionReason(payload, target) {
   if (isOtherAudience(payload, target.storagePrefix)) return "audience";
@@ -1368,7 +2102,7 @@ function viewerTokenClaimRejection(payload, target) {
 var MAX_FILE_TTL_SECONDS = 365 * 24 * 60 * 60;
 var MAX_FILES_COUNTER_TTL_SECONDS = 24 * 60 * 60;
 var MAX_FILES_PREFIX = "upload-token-files";
-var failure = (status, code, error) => ({
+var failure2 = (status, code, error) => ({
   status,
   code,
   error
@@ -1384,12 +2118,12 @@ function generatedKindPath(mediaType, id, filename) {
 }
 function tokenRejected(reason, path) {
   console.warn(`[upload] token rejected (${reason}) for path ${String(path)}`);
-  return failure(403, TOKEN_REJECTED_CODE, "Token rejected");
+  return failure2(403, TOKEN_REJECTED_CODE, "Token rejected");
 }
 function assetTarget(rawPath, visibility, grant) {
   const assetPath = normalizeAssetPath(rawPath);
   if (!assetPath) {
-    return failure(400, "invalid_path", "path must be a relative path of [A-Za-z0-9._-] segments, without `..`");
+    return failure2(400, "invalid_path", "path must be a relative path of [A-Za-z0-9._-] segments, without `..`");
   }
   const relativePath = assetRelativePath(assetPath);
   if (grant && !isWithinPathPrefix2(relativePath, grant.pathPrefix)) return tokenRejected("resource", relativePath);
@@ -1398,7 +2132,7 @@ function assetTarget(rawPath, visibility, grant) {
 }
 function resolveUploadTarget(body, mediaType, visibility, grant) {
   if (grant && body.path === void 0) {
-    return failure(400, "path_required", "an upload token can only create files at an explicit `path`");
+    return failure2(400, "path_required", "an upload token can only create files at an explicit `path`");
   }
   if (grant && body.visibility && body.visibility !== grant.visibility) return tokenRejected("visibility", body.path);
   if (body.path !== void 0) return assetTarget(body.path, grant?.visibility ?? visibility, grant);
@@ -1409,7 +2143,7 @@ function resolveExpiresAt(requested, grant, now, maxTtlSeconds) {
   const hasRequest = requested !== void 0 && requested !== null;
   const isValid = typeof requested === "number" && Number.isInteger(requested) && requested > 0;
   if (hasRequest && (!isValid || requested > MAX_FILE_TTL_SECONDS)) {
-    return failure(400, "invalid_expires_in", "expiresIn must be a positive integer number of seconds (max 1 year)");
+    return failure2(400, "invalid_expires_in", "expiresIn must be a positive integer number of seconds (max 1 year)");
   }
   const candidates = [hasRequest ? requested : void 0, grant?.fileExpiresIn, maxTtlSeconds];
   const ttls = candidates.filter((ttl) => typeof ttl === "number" && ttl > 0);
@@ -1417,7 +2151,7 @@ function resolveExpiresAt(requested, grant, now, maxTtlSeconds) {
 }
 function resolveDeclaredSha256(raw) {
   if (raw === void 0 || raw === null) return void 0;
-  return normalizeSha2562(raw) ?? failure(400, "invalid_sha256", "sha256 must be a 64-character hex string");
+  return normalizeSha2562(raw) ?? failure2(400, "invalid_sha256", "sha256 must be a 64-character hex string");
 }
 function effectiveMaxBytes(ruleMax, grant) {
   const limits = [ruleMax, grant?.maxBytes].filter((limit) => typeof limit === "number");
@@ -1428,7 +2162,7 @@ async function claimTokenFileSlot(kv, grant) {
   const counterKey = `${MAX_FILES_PREFIX}:${grant.tokenId}`;
   const used = Number(await kv.get(counterKey) ?? "0");
   if (used >= grant.maxFiles) {
-    return failure(403, "max_files_reached", `the upload token already created ${grant.maxFiles} files`);
+    return failure2(403, "max_files_reached", `the upload token already created ${grant.maxFiles} files`);
   }
   await kv.put(counterKey, String(used + 1), { expirationTtl: MAX_FILES_COUNTER_TTL_SECONDS });
   return null;
@@ -1436,7 +2170,7 @@ async function claimTokenFileSlot(kv, grant) {
 function resolveObjectCacheControl(requested, target, rules) {
   if (!target.isAsset || !target.assetPath) return void 0;
   if (requested !== void 0 && requested !== null) {
-    return resolveCacheControl(requested) ?? failure(400, "invalid_cache_control", "cacheControl must be immutable, revalidate, no-cache or a valid header");
+    return resolveCacheControl(requested) ?? failure2(400, "invalid_cache_control", "cacheControl must be immutable, revalidate, no-cache or a valid header");
   }
   return matchCacheRule(rules, target.assetPath)?.cacheControl ?? DEFAULT_ASSET_CACHE_CONTROL;
 }
@@ -1449,10 +2183,10 @@ function inferMediaType(contentType) {
 function resolveUploadMediaType(declared, contentType, isAssetRequest) {
   const inferredType = inferMediaType(contentType);
   if (declared && inferredType && declared !== inferredType) {
-    return failure(400, "media_type_mismatch", `mediaType "${declared}" does not match content type ${contentType}`);
+    return failure2(400, "media_type_mismatch", `mediaType "${declared}" does not match content type ${contentType}`);
   }
   const mediaType = declared ?? inferredType ?? (isAssetRequest ? MediaType.FILE : null);
-  return mediaType ?? failure(400, "unsupported_content_type", `Unsupported content type: ${contentType}`);
+  return mediaType ?? failure2(400, "unsupported_content_type", `Unsupported content type: ${contentType}`);
 }
 
 // src/routes/token-upload.ts
@@ -1560,6 +2294,7 @@ var WorkerAuthErrorCode = {
 var MEDIA_PREFIX = "/v1/media/";
 var DOWNLOAD_PREFIX = "/v1/download/";
 var WEBHOOKS_PREFIX = "/v1/webhooks/";
+var GRANT_PATH = "/v1/grant";
 var UPLOAD_CREATE_PATH = "/v1/upload";
 var UPLOAD_URL_PREFIX = "/v1/upload/";
 var isReadMethod = (method) => method === "GET" || method === "HEAD";
@@ -1568,6 +2303,7 @@ function isOpenRoute(method, path) {
   if (path === "/health") return isReadMethod(method);
   if (path === "/v1/metrics/playback") return method === "POST";
   if (path.startsWith(MEDIA_PREFIX) || path.startsWith(DOWNLOAD_PREFIX)) return isReadMethod(method);
+  if (path === GRANT_PATH || path.startsWith(`${GRANT_PATH}/`)) return true;
   return path.startsWith(WEBHOOKS_PREFIX) && method === "POST";
 }
 function isUploadUrl(path) {
@@ -1631,7 +2367,7 @@ function defaultPlugins(config = {}) {
 
 // src/routes/assets.ts
 import { ASSET_NAMESPACE, normalizeAssetPrefix as normalizeAssetPrefix2 } from "@devultur/core";
-import { Hono as Hono4 } from "hono";
+import { Hono as Hono6 } from "hono";
 
 // src/object-lock/delivery.ts
 import { effectiveUntil as effectiveUntil3 } from "@devultur/core";
@@ -1738,7 +2474,7 @@ async function listedEntries(bucket, listing, storageRoot, visibility) {
   }
   return page;
 }
-var assets = new Hono4();
+var assets = new Hono6();
 assets.get("/", async (context) => {
   const prefix = parseListPrefix(context.req.query("prefix"));
   if (prefix === null) {
@@ -1774,7 +2510,7 @@ import {
   resolveSecurity,
   visibilityFromKey
 } from "@devultur/core";
-import { Hono as Hono6 } from "hono";
+import { Hono as Hono8 } from "hono";
 
 // src/keys-bucket.ts
 import { decodeEncryptionMeta as decodeEncryptionMeta3 } from "@devultur/core";
@@ -1852,70 +2588,6 @@ async function applyStatusEvent(kv, event) {
   await kv.put(statusKey(videoId), JSON.stringify(record), { expirationTtl: KV_JOB_TTL_SECONDS });
 }
 
-// src/transcode/raw-retention.ts
-import { isVideoRawKey as isVideoRawKey2 } from "@devultur/core";
-var disposalKey = (videoId) => `${KvPrefix.TRANSCODE_RAW}:${videoId}`;
-async function readRawDisposal(kv, videoId) {
-  return kv.get(disposalKey(videoId), "json");
-}
-async function rememberRawDisposal(kv, videoId, disposal) {
-  await kv.put(disposalKey(videoId), JSON.stringify(disposal), { expirationTtl: KV_JOB_TTL_SECONDS });
-}
-async function disposeRawAfterTranscode(context, videoId) {
-  const { env } = context;
-  const disposal = await readRawDisposal(env.MEDIA_KV, videoId);
-  if (!disposal?.deleteOnComplete || !disposal.storageKey) return "kept";
-  const raw = await env.MEDIA_BUCKET.head(disposal.storageKey);
-  const location = splitVideoStorageKey(disposal.storageKey);
-  const lock = raw && location ? await effectiveLock(env.MEDIA_BUCKET, location.root, location.key, raw) : null;
-  if (lock?.state && isStateLocked(lock.state, /* @__PURE__ */ new Date())) {
-    await recordLockAudit(context, {
-      action: "original_retained",
-      keys: [location?.key ?? disposal.storageKey],
-      before: lock.state.lock,
-      after: null,
-      outcome: "skipped",
-      root: location?.root ?? ""
-    });
-    return "retained";
-  }
-  await env.MEDIA_BUCKET.delete(disposal.storageKey);
-  if (env.KEYS_BUCKET) await deletePrefix(env.KEYS_BUCKET, `${disposal.storageKey}/`);
-  return "deleted";
-}
-var ORIGINAL_NOT_RETAINED = {
-  error: "The original of this video is no longer retained, so it can't be re-encoded. Upload it again, or set `config.transcode.deleteOriginalOnSuccess` to false for future videos.",
-  code: "original_not_retained"
-};
-var PRIOR_OUTPUTS_LIST_LIMIT = 100;
-async function hasPriorTranscodeOutputs(bucket, videoFolder) {
-  const listing = await bucket.list({ prefix: videoFolder, limit: PRIOR_OUTPUTS_LIST_LIMIT });
-  return listing.objects.some((object) => !isVideoRawKey2(object.key));
-}
-
-// src/object-lock/transcode-marker.ts
-var MARKER_NAME = "transcode-completed";
-var markerKey = (root, videoFolder) => sidecarKey(root, `${videoFolder}/${MARKER_NAME}`);
-async function markTranscodeCompleted(env, videoId, ticketLocation) {
-  const location = ticketLocation ?? await rememberedLocation(env, videoId);
-  if (!location) return;
-  await env.MEDIA_BUCKET.put(markerKey(location.root, location.folder), (/* @__PURE__ */ new Date()).toISOString(), {
-    httpMetadata: { contentType: "text/plain" }
-  });
-}
-async function rememberedLocation(env, videoId) {
-  const disposal = await readRawDisposal(env.MEDIA_KV, videoId);
-  const raw = disposal?.storageKey ? splitVideoStorageKey(disposal.storageKey) : null;
-  const folder = raw?.key.split("/").slice(0, 3).join("/");
-  return raw && folder ? { root: raw.root, folder } : null;
-}
-async function hasCompletedTranscode(bucket, root, videoFolder) {
-  return await bucket.head(markerKey(root, videoFolder)) !== null;
-}
-async function forgetTranscodeCompleted(bucket, root, videoFolder) {
-  await bucket.delete(markerKey(root, videoFolder));
-}
-
 // src/object-lock/overwrite.ts
 function sameObject(object) {
   return {
@@ -2059,7 +2731,7 @@ function logCaptionsError(context, error) {
 }
 
 // src/routes/webhooks.ts
-import { Hono as Hono5 } from "hono";
+import { Hono as Hono7 } from "hono";
 
 // src/transcode/metrics.ts
 var OPERATOR_EVENT_FIELDS = ["encode", "posterKey", "posterFormats"];
@@ -2178,7 +2850,7 @@ async function loadOutputBaseUrl(kv, videoId, fallbackUrl) {
 }
 
 // src/routes/webhooks.ts
-var webhooks = new Hono5();
+var webhooks = new Hono7();
 webhooks.post("/transcode", async (context) => {
   const webhookSecret = context.env.TRANSCODE_WEBHOOK_SECRET;
   if (!webhookSecret) {
@@ -2400,7 +3072,7 @@ async function transcodedDuration(kv, videoId) {
   const meta = await kv.get(`${KvPrefix.TRANSCODE_META}:${videoId}`, "json");
   return meta?.duration ?? void 0;
 }
-var captions = new Hono6();
+var captions = new Hono8();
 captions.post("/", async (context) => {
   const body = await context.req.json();
   if (!body.key || !body.locales?.length) {
@@ -2511,19 +3183,19 @@ captions.post("/", async (context) => {
     });
   } catch (err) {
     logCaptionsError(`job failed for ${videoId}`, err);
-    const failure4 = toCaptionsFailure(err);
+    const failure5 = toCaptionsFailure(err);
     await forwardToClientWebhook(
       {
         event: "captions.failed",
         videoId,
-        error: failure4.error,
-        reason: failure4.reason,
-        retriable: failure4.retriable
+        error: failure5.error,
+        reason: failure5.reason,
+        retriable: failure5.retriable
       },
       webhookData
     );
     const conflict = captionConflictResponse(context, err);
-    return conflict ?? context.json({ error: failure4.error, code: failure4.code }, failure4.status);
+    return conflict ?? context.json({ error: failure5.error, code: failure5.code }, failure5.status);
   }
 });
 captions.get("/:transcriptId", async (context) => {
@@ -2552,7 +3224,7 @@ import {
   toPrivateCacheControl,
   visibilityFromKey as visibilityFromKey2
 } from "@devultur/core";
-import { Hono as Hono7 } from "hono";
+import { Hono as Hono9 } from "hono";
 
 // src/image/cloudflare.ts
 var IMAGE_RESIZING_VIA = "image-resizing";
@@ -2964,52 +3636,6 @@ function cacheDelivered(waitUntil, target, delivered) {
   }
 }
 
-// src/routes/media-delete.ts
-import { videoBasePath } from "@devultur/core";
-async function handleVideoDelete(context) {
-  const videoId = context.req.param("videoId") ?? "";
-  const visibilityParam = context.req.query("visibility");
-  const visibilities = visibilityParam === "public" || visibilityParam === "private" ? [visibilityParam] : ["public", "private"];
-  const folders = visibilities.map((visibility) => `${visibility}/${videoBasePath(videoId)}`);
-  const blocked = await assertWritable(context, folders, "delete");
-  if (blocked) return blocked;
-  let deletedCount = 0;
-  let deletedKeyCount = 0;
-  for (const folder of folders) {
-    const deleted = await guardedDeletePrefix(context, `${folder}/`);
-    if ("blocked" in deleted) return deleted.blocked;
-    deletedCount += deleted.deletedCount;
-    if (deleted.deletedCount > 0) {
-      await forgetTranscodeCompleted(context.env.MEDIA_BUCKET, getRequestState(context).storagePrefix, folder);
-    }
-    if (!folder.startsWith("private/")) continue;
-    const deletedKeys = await deleteFolderKeys(context, folder);
-    if ("blocked" in deletedKeys) return deletedKeys.blocked;
-    deletedKeyCount += deletedKeys.deletedCount;
-  }
-  return context.json({ videoId, deletedCount, deletedKeyCount });
-}
-async function handleKeyDelete(context) {
-  const key = context.req.param("key") ?? "";
-  const fullKey = storageKey(context, key);
-  if (isVariantKey(key)) {
-    return context.json({ error: "Not found" }, 404);
-  }
-  if (isReservedLockKey(key)) return reservedKeyResponse(context, key);
-  const exists = await context.env.MEDIA_BUCKET.head(fullKey);
-  if (!exists) {
-    return context.json({ error: "Not found" }, 404);
-  }
-  const blocked = await assertWritable(context, [key], "delete");
-  if (blocked) return blocked;
-  await context.env.MEDIA_BUCKET.delete(fullKey);
-  const variants = await guardedDeletePrefix(context, variantPrefix(key));
-  if ("blocked" in variants) return variants.blocked;
-  const keys = await deleteKeysFor(context, key, exists);
-  if ("blocked" in keys) return keys.blocked;
-  return new Response(null, { status: 204 });
-}
-
 // src/routes/storyboard-vtt.ts
 import { createDecryptStream as createDecryptStream3 } from "@devultur/core";
 var STORYBOARD_VTT = /(?:^|\/)video\/[^/]+\/storyboard\/[^/]+\.vtt$/;
@@ -3038,7 +3664,7 @@ function downloadDisposition(storedDisposition, key, filename) {
   if (storedDisposition?.startsWith("inline")) return `attachment${storedDisposition.slice("inline".length)}`;
   return contentDispositionAttachment(key.split("/").pop() || "download");
 }
-var media = new Hono7();
+var media = new Hono9();
 media.use("*", contentSafety);
 media.get("/:key{.+}", async (context) => {
   const key = context.req.param("key");
@@ -3237,10 +3863,10 @@ async function serveEncryptionKey(context, key, tokenPayload) {
 }
 
 // src/routes/token.ts
-import { computeFingerprint as computeFingerprint2, DEFAULT_SECURITY, TokenScope as TokenScope3 } from "@devultur/core";
-import { Hono as Hono8 } from "hono";
+import { computeFingerprint as computeFingerprint2, DEFAULT_SECURITY, TokenScope as TokenScope5 } from "@devultur/core";
+import { Hono as Hono10 } from "hono";
 var DEFAULT_VIEWER_TOKEN_TTL_SECONDS = 7200;
-var token = new Hono8();
+var token = new Hono10();
 token.post("/", async (context) => {
   const body = await context.req.json();
   if (!body.userId) {
@@ -3253,7 +3879,7 @@ token.post("/", async (context) => {
     );
   }
   const clientIp = context.req.header("CF-Connecting-IP") ?? context.req.header("X-Forwarded-For") ?? "unknown";
-  const requestedScopes = body.scopes ?? [TokenScope3.MEDIA_READ];
+  const requestedScopes = body.scopes ?? [TokenScope5.MEDIA_READ];
   if (!Array.isArray(requestedScopes) || hasInvalidScope(requestedScopes)) {
     return context.json({ error: "scopes must be non-empty strings without spaces", code: "invalid_scopes" }, 400);
   }
@@ -3301,7 +3927,7 @@ import {
   generateId as generateId2,
   resolveSecurity as resolveSecurity3,
   resolveTranscodePreset,
-  TokenScope as TokenScope4,
+  TokenScope as TokenScope6,
   TranscodeStatus as TranscodeStatus3,
   videoBasePath as videoBasePath2,
   videoHlsPath,
@@ -3311,7 +3937,7 @@ import {
   videoThumbnailPath,
   visibilityFromKey as visibilityFromKey3
 } from "@devultur/core";
-import { Hono as Hono9 } from "hono";
+import { Hono as Hono11 } from "hono";
 
 // src/transcode/plan.ts
 import { MAIN_VARIANT } from "@devultur/core";
@@ -3586,7 +4212,7 @@ function postMachine(request, retry) {
     retry
   );
 }
-async function failure2(response, error) {
+async function failure3(response, error) {
   const detail = await response.text();
   const status = response.status === 429 || response.status >= 500 ? 503 : 500;
   console.error(`[transcode] fly: ${error} (status ${response.status}):`, detail);
@@ -3598,7 +4224,7 @@ async function createFlyMachine(request, retry) {
   const errorBody = await response.text();
   const isSuspended = response.status === 412 || errorBody.includes("suspended");
   if (!isSuspended) {
-    return failure2(new Response(errorBody, { status: response.status }), "Failed to create transcode job");
+    return failure3(new Response(errorBody, { status: response.status }), "Failed to create transcode job");
   }
   if (!await resumeFlyApp(request.appName, request.apiToken)) {
     console.error("[transcode] fly: failed to resume suspended app:", errorBody);
@@ -3612,7 +4238,7 @@ async function createFlyMachine(request, retry) {
   }
   const retried = await postMachine(request, retry);
   if (retried.ok) return { ok: true, machine: await retried.json() };
-  return failure2(retried, "Failed to create transcode job after resume");
+  return failure3(retried, "Failed to create transcode job after resume");
 }
 function createFlyRunner(env, retry) {
   const guest = flyGuestFromEnv(env);
@@ -4250,7 +4876,7 @@ function parseSecurityMeta2(raw) {
 }
 var SERVICE_TOKEN_TTL_SECONDS = 3600;
 var isVideoId = (videoId, key) => Boolean(videoId) && videoId !== key;
-var transcode = new Hono9();
+var transcode = new Hono11();
 transcode.post("/", async (context) => {
   const body = await context.req.json();
   if (!body.key) {
@@ -4310,7 +4936,7 @@ transcode.post("/", async (context) => {
   const requestedExp = nowSeconds + SERVICE_TOKEN_TTL_SECONDS;
   const decision = await decideCredential(context, {
     kind: "service",
-    scopes: [TokenScope4.MEDIA_READ],
+    scopes: [TokenScope6.MEDIA_READ],
     path: body.key,
     expiresAt: requestedExp * 1e3
   });
@@ -4320,7 +4946,7 @@ transcode.post("/", async (context) => {
       {
         sub: `${SERVICE_SUBJECT_PREFIX}${videoId}`,
         typ: SERVICE_TOKEN_TYPE,
-        ...scopeClaim([TokenScope4.MEDIA_READ]),
+        ...scopeClaim([TokenScope6.MEDIA_READ]),
         ...audienceClaim(scope.storagePrefix),
         bind: { sessionBinding: false, ipBinding: false },
         iat: nowSeconds,
@@ -4442,16 +5068,16 @@ transcode.get("/:jobId", async (context) => {
 
 // src/routes/upload.ts
 import { MediaType as MediaType2, resolveSecurity as resolveSecurity5, resolveVisibility, UploadRequestKind as UploadRequestKind2 } from "@devultur/core";
-import { Hono as Hono10 } from "hono";
+import { Hono as Hono12 } from "hono";
 
 // src/object-lock/upload-lock.ts
 import { canChange as canChange3, resolveLock, validateLock as validateLock6 } from "@devultur/core";
-var failure3 = (status, code, error) => ({ status, code, error });
+var failure4 = (status, code, error) => ({ status, code, error });
 function requestedLock(lock, hold) {
-  if (hold !== void 0 && typeof hold !== "boolean") return failure3(400, "invalid_lock", "hold must be a boolean");
+  if (hold !== void 0 && typeof hold !== "boolean") return failure4(400, "invalid_lock", "hold must be a boolean");
   if (lock === void 0 && hold === void 0) return void 0;
   const validation = validateLock6(lock ?? {});
-  if (!validation.ok) return failure3(400, "invalid_lock", validation.errors.join("; "));
+  if (!validation.ok) return failure4(400, "invalid_lock", validation.errors.join("; "));
   return { ...validation.lock, ...hold !== void 0 ? { hold } : {} };
 }
 function satisfiesMinimum(minimum, lock, now) {
@@ -4464,10 +5090,10 @@ function resolveUploadLock(input) {
   if (requested && "code" in requested) return requested;
   const minimum = input.grant?.lock;
   const resolution = resolveLock(requested ?? minimum, input.appDefault);
-  if (!resolution.ok) return failure3(400, "invalid_lock", resolution.errors.join("; "));
+  if (!resolution.ok) return failure4(400, "invalid_lock", resolution.errors.join("; "));
   const lock = resolution.lock;
   if (minimum && !satisfiesMinimum(minimum, lock, input.now)) {
-    return failure3(403, "lock_below_minimum", "The upload token requires a stricter lock than the request asks for");
+    return failure4(403, "lock_below_minimum", "The upload token requires a stricter lock than the request asks for");
   }
   return lock.retention || lock.hold ? lock : void 0;
 }
@@ -5175,7 +5801,7 @@ async function handleMultipartAbort(context) {
 }
 
 // src/routes/upload.ts
-var upload = new Hono10();
+var upload = new Hono12();
 upload.post("/", async (context) => {
   const body = await context.req.json();
   const isAssetRequest = body.path !== void 0;
@@ -5658,7 +6284,7 @@ async function retainedSummary(options) {
 // src/index.ts
 function createWorker(options) {
   const { middleware, routes, hooks } = composePlugins(options?.plugins ?? defaultPlugins());
-  const app = new Hono11();
+  const app = new Hono13();
   app.use("*", logger());
   app.use(
     "*",
@@ -5666,7 +6292,17 @@ function createWorker(options) {
       origin: "*",
       allowMethods: ["GET", "HEAD", "POST", "PUT", "DELETE", "OPTIONS"],
       allowHeaders: ["Content-Type", "Authorization", "Range", SESSION_HEADER2, SHA256_HEADER3],
-      exposeHeaders: [SHA256_HEADER3, SHA256_VERIFIED_HEADER2, REPR_DIGEST_HEADER2, EXPIRES_AT_HEADER2, "Content-Range"]
+      exposeHeaders: [
+        SHA256_HEADER3,
+        SHA256_VERIFIED_HEADER2,
+        REPR_DIGEST_HEADER2,
+        EXPIRES_AT_HEADER2,
+        ENCRYPTED_HEADER2,
+        GRANT_EXPIRES_AT_HEADER2,
+        GRANT_KEY_HEADER2,
+        GRANT_METADATA_HEADER2,
+        "Content-Range"
+      ]
     })
   );
   app.use("*", async (context, next) => {
@@ -5694,6 +6330,7 @@ function createWorker(options) {
   return app;
 }
 export {
+  DownloadGrants,
   DownloadLink,
   ENCRYPTION_KEY_MISSING_CODE,
   HOLD_PAGE_SIZE,
@@ -5724,6 +6361,7 @@ export {
   getRequestState,
   getRouteResult,
   hashKey,
+  identifyDownloadGrant,
   imageOriginAuthorization,
   isAuthenticated,
   isImageOriginRequest,