@memberjunction/storage 6.2.0-edge.4 → 6.2.0-edge.6

package/dist/generic/FileStorageBase.d.ts

@@ -1,4 +1,5 @@
 import { Readable } from 'stream';
+import { StorageObjectKeyNormalizer } from './ObjectKeys.js';
 /**
  * Represents the payload returned by the CreatePreAuthUploadUrl method.
  * This type contains the necessary information for uploading a file to a storage provider.
@@ -369,7 +370,7 @@ export interface StorageProviderConfig {
  * `driver.GetObject is not a function`. The marker turns an unresolved driver key into an
  * immediate, named failure at the point of resolution.
  */
-export declare abstract class FileStorageBase {
+export declare abstract class FileStorageBase implements StorageObjectKeyNormalizer {
     /**
      * The name of this storage provider, used in error messages and logging.
      * Each implementation must define this property with a descriptive name.
@@ -860,6 +861,21 @@ export declare abstract class FileStorageBase {
      * @returns A Promise that resolves to a boolean indicating if the directory exists.
      */
     abstract DirectoryExists(directoryPath: string): Promise<boolean>;
+    /**
+     * The canonical form of an object key for this storage — what the storage access checks compare when they ask whether
+     * an object backs an `MJ: Files` row (see `StorageAccessEvaluator.UnreadableTrackedObjectKeys`). Both the key a client
+     * sends and the key a row stores go through this one method, so two spellings this driver resolves to the same object
+     * must canonicalize alike.
+     *
+     * The default ({@link NormalizeStorageObjectKey}) trims the key, collapses runs of `/` and strips leading and
+     * trailing `/` — right for every driver whose spellings differ only in slashes. A driver that adds its own root or
+     * prefix to SOME keys and not others (S3's key prefix) overrides this to return the key relative to that root.
+     * Case is preserved; callers compare case-insensitively.
+     *
+     * @param objectKey - An object key as a client or an `MJ: Files` row spells it
+     * @returns The canonical key: relative to this driver's root, no leading/trailing `/`, no repeated `/`
+     */
+    NormalizeObjectKey(objectKey: string): string;
     /**
      * Initialize storage provider with optional configuration.
      *

package/dist/generic/FileStorageBase.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"FileStorageBase.d.ts","sourceRoot":"","sources":["../../src/generic/FileStorageBase.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAGlC;;;;;;;GAOG;AACH,MAAM,MAAM,6BAA6B,GAAG;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,UAAU,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC;IACxC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;CAClD,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,SAAS,GAAG;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,SAAS,CAAC;CACnB,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,MAAM,EAAE,QAAQ,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9D,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,IAAI,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACzC,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAE7D;AAED;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,OAAO,EAAE,qBAAqB,EAAE,CAAC;IACjC,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IAErB;;OAEG;IACH,aAAa,CAAC,EAAE,IAAI,CAAC;IAErB;;OAEG;IACH,cAAc,CAAC,EAAE,IAAI,CAAC;IAEtB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IAExB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC5C,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,YAAY,EAAE,IAAI,CAAC;IAEnB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB;;;OAGG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAE1B;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAExC;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxC,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC;;OAEG;IACH,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAE5B;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;OAEG;IACH,OAAO,EAAE,OAAO,CAAC;IAEjB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF;;;;GAIG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;IAClD;;;;;OAKG;gBACS,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM;CAIrD;AAED;;;;;;;;GAQG;AACH,qBAAa,0BAA2B,SAAQ,KAAK;IACnD;;;;OAIG;gBACS,YAAY,EAAE,MAAM;CAIjC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;;;;;;OAQG;IACH,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,8BACsB,eAAe;IACnC;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAEjD;;;OAGG;IACH,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAEzC;;OAEG;IACH,SAAS,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IAE3C;;;OAGG;IACH,IAAW,SAAS,IAAI,MAAM,GAAG,SAAS,CAEzC;IAED;;;OAGG;IACH,IAAW,WAAW,IAAI,MAAM,GAAG,SAAS,CAE3C;IAED;;;;;;OAMG;IACH,SAAS,CAAC,8BAA8B,CAAC,UAAU,EAAE,MAAM,GAAG,KAAK;IAInE;;;;;;;;;;OAUG;IACI,OAAO,IAAI,IAAI;IAItB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmCG;aACa,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,6BAA6B,CAAC;IAElG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;aACa,wBAAwB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAE7E;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;aACa,UAAU,CAAC,aAAa,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAE1F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;aACa,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAElE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;aACa,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAE3F;;;;;;;;;;;;;;;;;;;;;OAqBG;aACa,eAAe,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAExE;;;;;;;;;;;;;;;;;;;OAmBG;aACa,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAE7F;;;;;;;;;;;;;;;;;;;;;;OAsBG;aACa,iBAAiB,CAAC,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAElG;;;;;;;;;;;;;;;;;;;;;OAqBG;aACa,SAAS,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC;IAEnE;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,IAAW,iBAAiB,IAAI,OAAO,CAEtC;IAED;;;;;;;;OAQG;IACH,IAAW,qBAAqB,IAAI,OAAO,CAE1C;IAED;;;;OAIG;IACH,IAAW,uBAAuB,IAAI,OAAO,CAE5C;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+CG;IACI,eAAe,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAIlF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;aACa,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAEtI;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;aACa,UAAU,CAAC,gBAAgB,EAAE,MAAM,EAAE,qBAAqB,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAErG;;;;;;;;;;;;;;;;;;;OAmBG;aACa,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAElE;;;;;;;;;;;;;;;;;;;OAmBG;aACa,eAAe,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAExE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiEG;IACU,UAAU,CAAC,MAAM,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC;IAQtE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2CG;IACH,aAAoB,YAAY,IAAI,OAAO,CAAC;IAE5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4DG;aACa,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,mBAAmB,CAAC;CACtG"}
+{"version":3,"file":"FileStorageBase.d.ts","sourceRoot":"","sources":["../../src/generic/FileStorageBase.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAElC,OAAO,EAA6B,0BAA0B,EAAE,MAAM,cAAc,CAAC;AAErF;;;;;;;GAOG;AACH,MAAM,MAAM,6BAA6B,GAAG;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,UAAU,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC;IACxC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;CAClD,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,SAAS,GAAG;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,SAAS,CAAC;CACnB,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,MAAM,EAAE,QAAQ,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9D,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,IAAI,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACzC,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAE7D;AAED;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,OAAO,EAAE,qBAAqB,EAAE,CAAC;IACjC,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IAErB;;OAEG;IACH,aAAa,CAAC,EAAE,IAAI,CAAC;IAErB;;OAEG;IACH,cAAc,CAAC,EAAE,IAAI,CAAC;IAEtB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IAExB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC5C,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,YAAY,EAAE,IAAI,CAAC;IAEnB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB;;;OAGG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAE1B;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAExC;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxC,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC;;OAEG;IACH,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAE5B;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;OAEG;IACH,OAAO,EAAE,OAAO,CAAC;IAEjB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF;;;;GAIG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;IAClD;;;;;OAKG;gBACS,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM;CAIrD;AAED;;;;;;;;GAQG;AACH,qBAAa,0BAA2B,SAAQ,KAAK;IACnD;;;;OAIG;gBACS,YAAY,EAAE,MAAM;CAIjC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;;;;;;OAQG;IACH,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,8BACsB,eAAgB,YAAW,0BAA0B;IACzE;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAEjD;;;OAGG;IACH,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAEzC;;OAEG;IACH,SAAS,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IAE3C;;;OAGG;IACH,IAAW,SAAS,IAAI,MAAM,GAAG,SAAS,CAEzC;IAED;;;OAGG;IACH,IAAW,WAAW,IAAI,MAAM,GAAG,SAAS,CAE3C;IAED;;;;;;OAMG;IACH,SAAS,CAAC,8BAA8B,CAAC,UAAU,EAAE,MAAM,GAAG,KAAK;IAInE;;;;;;;;;;OAUG;IACI,OAAO,IAAI,IAAI;IAItB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmCG;aACa,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,6BAA6B,CAAC;IAElG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;aACa,wBAAwB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAE7E;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;aACa,UAAU,CAAC,aAAa,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAE1F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;aACa,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAElE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;aACa,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAE3F;;;;;;;;;;;;;;;;;;;;;OAqBG;aACa,eAAe,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAExE;;;;;;;;;;;;;;;;;;;OAmBG;aACa,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAE7F;;;;;;;;;;;;;;;;;;;;;;OAsBG;aACa,iBAAiB,CAAC,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAElG;;;;;;;;;;;;;;;;;;;;;OAqBG;aACa,SAAS,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC;IAEnE;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,IAAW,iBAAiB,IAAI,OAAO,CAEtC;IAED;;;;;;;;OAQG;IACH,IAAW,qBAAqB,IAAI,OAAO,CAE1C;IAED;;;;OAIG;IACH,IAAW,uBAAuB,IAAI,OAAO,CAE5C;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+CG;IACI,eAAe,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAIlF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;aACa,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAEtI;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;aACa,UAAU,CAAC,gBAAgB,EAAE,MAAM,EAAE,qBAAqB,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAErG;;;;;;;;;;;;;;;;;;;OAmBG;aACa,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAElE;;;;;;;;;;;;;;;;;;;OAmBG;aACa,eAAe,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAExE;;;;;;;;;;;;;OAaG;IACI,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAIpD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiEG;IACU,UAAU,CAAC,MAAM,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC;IAQtE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2CG;IACH,aAAoB,YAAY,IAAI,OAAO,CAAC;IAE5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4DG;aACa,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,mBAAmB,CAAC;CACtG"}

package/dist/generic/FileStorageBase.js

@@ -5,6 +5,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
 import { RequiresSubclass } from '@memberjunction/global';
+import { NormalizeStorageObjectKey } from './ObjectKeys.js';
 /**
  * Builds an HTTP `Range` header value (`bytes=Start-End` or `bytes=Start-`) from a
  * {@link ByteRange}. Shared by streaming-capable drivers so the inclusive-range
@@ -218,6 +219,23 @@ let FileStorageBase = class FileStorageBase {
     GetObjectStream(params) {
         throw new StreamingNotSupportedError(this.providerName);
     }
+    /**
+     * The canonical form of an object key for this storage — what the storage access checks compare when they ask whether
+     * an object backs an `MJ: Files` row (see `StorageAccessEvaluator.UnreadableTrackedObjectKeys`). Both the key a client
+     * sends and the key a row stores go through this one method, so two spellings this driver resolves to the same object
+     * must canonicalize alike.
+     *
+     * The default ({@link NormalizeStorageObjectKey}) trims the key, collapses runs of `/` and strips leading and
+     * trailing `/` — right for every driver whose spellings differ only in slashes. A driver that adds its own root or
+     * prefix to SOME keys and not others (S3's key prefix) overrides this to return the key relative to that root.
+     * Case is preserved; callers compare case-insensitively.
+     *
+     * @param objectKey - An object key as a client or an `MJ: Files` row spells it
+     * @returns The canonical key: relative to this driver's root, no leading/trailing `/`, no repeated `/`
+     */
+    NormalizeObjectKey(objectKey) {
+        return NormalizeStorageObjectKey(objectKey);
+    }
     /**
      * Initialize storage provider with optional configuration.
      *

package/dist/generic/FileStorageBase.js.map

@@ -1 +1 @@
-{"version":3,"file":"FileStorageBase.js","sourceRoot":"","sources":["../../src/generic/FileStorageBase.ts"],"names":[],"mappings":";;;;;;AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AA8H1D;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAgB;IACnD,OAAO,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;AAC3F,CAAC;AAiKD;;;;GAIG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAClD;;;;;OAKG;IACH,YAAY,UAAkB,EAAE,YAAoB;QAClD,KAAK,CAAC,cAAc,UAAU,6BAA6B,YAAY,WAAW,CAAC,CAAC;QACpF,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IACnD;;;;OAIG;IACH,YAAY,YAAoB;QAC9B,KAAK,CAAC,uDAAuD,YAAY,WAAW,CAAC,CAAC;QACtF,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AA+CD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEI,IAAe,eAAe,GAA9B,MAAe,eAAe;IAkBnC;;;OAGG;IACH,IAAW,SAAS;QAClB,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED;;;OAGG;IACH,IAAW,WAAW;QACpB,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED;;;;;;OAMG;IACO,8BAA8B,CAAC,UAAkB;QACzD,MAAM,IAAI,yBAAyB,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACrE,CAAC;IAED;;;;;;;;;;OAUG;IACI,OAAO;QACZ,0CAA0C;IAC5C,CAAC;IA4QD;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,IAAW,iBAAiB;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;;;OAQG;IACH,IAAW,qBAAqB;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;OAIG;IACH,IAAW,uBAAuB;QAChC,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+CG;IACI,eAAe,CAAC,MAA6B;QAClD,MAAM,IAAI,0BAA0B,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC1D,CAAC;IA4GD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiEG;IACI,KAAK,CAAC,UAAU,CAAC,MAA8B;QACpD,oEAAoE;QACpE,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,SAAS,CAAC;YACnC,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,WAAW,CAAC;QACzC,CAAC;IACH,CAAC;CA8GF,CAAA;AAzsBqB,eAAe;IADpC,gBAAgB,EAAE;GACG,eAAe,CAysBpC"}
+{"version":3,"file":"FileStorageBase.js","sourceRoot":"","sources":["../../src/generic/FileStorageBase.ts"],"names":[],"mappings":";;;;;;AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,yBAAyB,EAA8B,MAAM,cAAc,CAAC;AA8HrF;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAgB;IACnD,OAAO,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;AAC3F,CAAC;AAiKD;;;;GAIG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAClD;;;;;OAKG;IACH,YAAY,UAAkB,EAAE,YAAoB;QAClD,KAAK,CAAC,cAAc,UAAU,6BAA6B,YAAY,WAAW,CAAC,CAAC;QACpF,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IACnD;;;;OAIG;IACH,YAAY,YAAoB;QAC9B,KAAK,CAAC,uDAAuD,YAAY,WAAW,CAAC,CAAC;QACtF,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AA+CD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEI,IAAe,eAAe,GAA9B,MAAe,eAAe;IAkBnC;;;OAGG;IACH,IAAW,SAAS;QAClB,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED;;;OAGG;IACH,IAAW,WAAW;QACpB,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED;;;;;;OAMG;IACO,8BAA8B,CAAC,UAAkB;QACzD,MAAM,IAAI,yBAAyB,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACrE,CAAC;IAED;;;;;;;;;;OAUG;IACI,OAAO;QACZ,0CAA0C;IAC5C,CAAC;IA4QD;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,IAAW,iBAAiB;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;;;OAQG;IACH,IAAW,qBAAqB;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;OAIG;IACH,IAAW,uBAAuB;QAChC,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+CG;IACI,eAAe,CAAC,MAA6B;QAClD,MAAM,IAAI,0BAA0B,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC1D,CAAC;IA4GD;;;;;;;;;;;;;OAaG;IACI,kBAAkB,CAAC,SAAiB;QACzC,OAAO,yBAAyB,CAAC,SAAS,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiEG;IACI,KAAK,CAAC,UAAU,CAAC,MAA8B;QACpD,oEAAoE;QACpE,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,SAAS,CAAC;YACnC,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,WAAW,CAAC;QACzC,CAAC;IACH,CAAC;CA8GF,CAAA;AA3tBqB,eAAe;IADpC,gBAAgB,EAAE;GACG,eAAe,CA2tBpC"}

package/dist/generic/ObjectKeys.d.ts

@@ -0,0 +1,61 @@
+/**
+ * @fileoverview Object-key canonicalization and the key-safety rule the storage access checks use.
+ *
+ * The tracked-file rule ("an object backing an `MJ: Files` row the caller cannot read is refused") compares the key a
+ * client sends with the key an `MJ: Files` row stores. Drivers accept several spellings of the same object — S3 adds or
+ * keeps its key prefix, Box strips leading and trailing `/`, Dropbox adds a leading `/` — so a raw string comparison would
+ * let `/hr/secret.pdf` or `hr/secret.pdf/` through as "untracked" while the driver serves `hr/secret.pdf`. Both sides are
+ * therefore put through ONE canonicalizer ({@link StorageObjectKeyNormalizer}, implemented by every driver as
+ * `FileStorageBase.NormalizeObjectKey`) and compared case-insensitively.
+ *
+ * The canonical form is deliberately coarse: when two spellings might name the same object they canonicalize alike. A
+ * coarse form can only make the rule refuse more, never less.
+ *
+ * @module @memberjunction/storage
+ */
+/**
+ * The object key an `MJ: Files` row resolves to: its `ProviderKey`, or its `Name` when `ProviderKey` is null or empty.
+ * The one rule every route from a row to its bytes and the tracked-file lookup use, so a row cannot be served under one
+ * key and checked under another.
+ */
+export declare function StorageObjectKeyOf(file: {
+    ProviderKey?: string | null;
+    Name?: string | null;
+}): string;
+/** Turns an object key into the canonical form the storage access checks compare. */
+export interface StorageObjectKeyNormalizer {
+    /**
+     * The canonical form of `objectKey` for this storage: the object the driver would address, relative to the driver's
+     * own root or prefix, with no leading or trailing `/` and no repeated `/`. Case is preserved; callers compare
+     * case-insensitively.
+     */
+    NormalizeObjectKey(objectKey: string): string;
+}
+/**
+ * The default canonical form of an object key: trimmed, with runs of `/` collapsed to one and leading and trailing `/`
+ * removed. Case is preserved (callers compare case-insensitively).
+ *
+ * Nothing else is rewritten. A key whose meaning depends on the provider (a backslash, a `.`/`..` segment, a
+ * meaning-changing percent encoding) is refused by {@link IsSafeStorageObjectKey} before it is ever compared, so the
+ * canonical form never has to guess what a driver would make of it.
+ */
+export declare function NormalizeStorageObjectKey(objectKey: string): string;
+/** The default {@link StorageObjectKeyNormalizer}: {@link NormalizeStorageObjectKey}. */
+export declare const DEFAULT_OBJECT_KEY_NORMALIZER: StorageObjectKeyNormalizer;
+/**
+ * Whether an object key is one the storage access checks will compare at all. A key that fails is refused (treated as
+ * an object the caller may not read) rather than canonicalized, because its meaning depends on the provider:
+ *
+ * - a `.` or `..` path segment, including one padded with whitespace or zero-width characters — a hierarchical
+ *   provider (Box, Dropbox, Google Drive, SharePoint) may resolve it as traversal, so the object served need not be
+ *   the one compared;
+ * - a backslash — some providers and URL layers treat it as a path separator;
+ * - a percent-encoded `/`, `\`, `.` or control character (`%2F`, `%5C`, `%2E`, `%00`–`%1F`, `%7F`) — a pre-signed URL
+ *   carries the key in its path, where the provider decodes it, so `hr%2Fsecret.pdf` would be compared as one segment and
+ *   served as `hr/secret.pdf`. A literal `%` followed by anything else (`50% off.pdf`, `%20`) is allowed;
+ * - a raw control character (including NUL).
+ *
+ * An empty or whitespace-only key is not unsafe — it names the root, which no `MJ: Files` row tracks.
+ */
+export declare function IsSafeStorageObjectKey(objectKey: string): boolean;
+//# sourceMappingURL=ObjectKeys.d.ts.map

package/dist/generic/ObjectKeys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ObjectKeys.d.ts","sourceRoot":"","sources":["../../src/generic/ObjectKeys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,MAAM,CAEtG;AAED,qFAAqF;AACrF,MAAM,WAAW,0BAA0B;IACvC;;;;OAIG;IACH,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;CACjD;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CASnE;AAED,yFAAyF;AACzF,eAAO,MAAM,6BAA6B,EAAE,0BAE3C,CAAC;AAQF;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAQjE"}

package/dist/generic/ObjectKeys.js

@@ -0,0 +1,82 @@
+/**
+ * @fileoverview Object-key canonicalization and the key-safety rule the storage access checks use.
+ *
+ * The tracked-file rule ("an object backing an `MJ: Files` row the caller cannot read is refused") compares the key a
+ * client sends with the key an `MJ: Files` row stores. Drivers accept several spellings of the same object — S3 adds or
+ * keeps its key prefix, Box strips leading and trailing `/`, Dropbox adds a leading `/` — so a raw string comparison would
+ * let `/hr/secret.pdf` or `hr/secret.pdf/` through as "untracked" while the driver serves `hr/secret.pdf`. Both sides are
+ * therefore put through ONE canonicalizer ({@link StorageObjectKeyNormalizer}, implemented by every driver as
+ * `FileStorageBase.NormalizeObjectKey`) and compared case-insensitively.
+ *
+ * The canonical form is deliberately coarse: when two spellings might name the same object they canonicalize alike. A
+ * coarse form can only make the rule refuse more, never less.
+ *
+ * @module @memberjunction/storage
+ */
+/**
+ * The object key an `MJ: Files` row resolves to: its `ProviderKey`, or its `Name` when `ProviderKey` is null or empty.
+ * The one rule every route from a row to its bytes and the tracked-file lookup use, so a row cannot be served under one
+ * key and checked under another.
+ */
+export function StorageObjectKeyOf(file) {
+    return file.ProviderKey || file.Name || '';
+}
+/**
+ * The default canonical form of an object key: trimmed, with runs of `/` collapsed to one and leading and trailing `/`
+ * removed. Case is preserved (callers compare case-insensitively).
+ *
+ * Nothing else is rewritten. A key whose meaning depends on the provider (a backslash, a `.`/`..` segment, a
+ * meaning-changing percent encoding) is refused by {@link IsSafeStorageObjectKey} before it is ever compared, so the
+ * canonical form never has to guess what a driver would make of it.
+ */
+export function NormalizeStorageObjectKey(objectKey) {
+    // Split and join rather than regex trimming: dropping empty segments collapses runs of `/` and strips leading and
+    // trailing `/` in one linear pass with no backtracking. CodeQL flags a trailing-anchor pattern such as `/\/+$/` on
+    // caller input as polynomial (js/polynomial-redos), so this form keeps every pattern out of the path.
+    return (objectKey ?? '')
+        .trim()
+        .split('/')
+        .filter(segment => segment.length > 0)
+        .join('/');
+}
+/** The default {@link StorageObjectKeyNormalizer}: {@link NormalizeStorageObjectKey}. */
+export const DEFAULT_OBJECT_KEY_NORMALIZER = {
+    NormalizeObjectKey: NormalizeStorageObjectKey
+};
+/** Characters whose percent-encoded form a provider or URL layer could decode into a path-changing character. */
+const MEANING_CHANGING_ENCODED = /%(2f|5c|2e|[01][0-9a-f]|7f)/i;
+/** ASCII control characters, including NUL. */
+const CONTROL_CHARACTERS = /[\x00-\x1f\x7f]/;
+/**
+ * Whether an object key is one the storage access checks will compare at all. A key that fails is refused (treated as
+ * an object the caller may not read) rather than canonicalized, because its meaning depends on the provider:
+ *
+ * - a `.` or `..` path segment, including one padded with whitespace or zero-width characters — a hierarchical
+ *   provider (Box, Dropbox, Google Drive, SharePoint) may resolve it as traversal, so the object served need not be
+ *   the one compared;
+ * - a backslash — some providers and URL layers treat it as a path separator;
+ * - a percent-encoded `/`, `\`, `.` or control character (`%2F`, `%5C`, `%2E`, `%00`–`%1F`, `%7F`) — a pre-signed URL
+ *   carries the key in its path, where the provider decodes it, so `hr%2Fsecret.pdf` would be compared as one segment and
+ *   served as `hr/secret.pdf`. A literal `%` followed by anything else (`50% off.pdf`, `%20`) is allowed;
+ * - a raw control character (including NUL).
+ *
+ * An empty or whitespace-only key is not unsafe — it names the root, which no `MJ: Files` row tracks.
+ */
+export function IsSafeStorageObjectKey(objectKey) {
+    if (typeof objectKey !== 'string') {
+        return false;
+    }
+    if (objectKey.includes('\\') || CONTROL_CHARACTERS.test(objectKey) || MEANING_CHANGING_ENCODED.test(objectKey)) {
+        return false;
+    }
+    return !objectKey.split('/').map(visibleSegment).some(segment => segment === '.' || segment === '..');
+}
+/**
+ * A path segment as a filesystem would read it: Unicode format characters (`\p{Cf}`: zero-width space, joiners,
+ * word joiner, BOM, soft hyphen) removed, then trimmed. Without this, `\u200B..\u200B` would not compare equal to
+ * `..` though a driver that drops such characters would resolve it as traversal.
+ */
+function visibleSegment(segment) {
+    return segment.replace(/\p{Cf}/gu, '').trim();
+}
+//# sourceMappingURL=ObjectKeys.js.map

package/dist/generic/ObjectKeys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ObjectKeys.js","sourceRoot":"","sources":["../../src/generic/ObjectKeys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAA2D;IAC1F,OAAO,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;AAC/C,CAAC;AAYD;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CAAC,SAAiB;IACvD,kHAAkH;IAClH,mHAAmH;IACnH,sGAAsG;IACtG,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;SACnB,IAAI,EAAE;SACN,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;SACrC,IAAI,CAAC,GAAG,CAAC,CAAC;AACnB,CAAC;AAED,yFAAyF;AACzF,MAAM,CAAC,MAAM,6BAA6B,GAA+B;IACrE,kBAAkB,EAAE,yBAAyB;CAChD,CAAC;AAEF,iHAAiH;AACjH,MAAM,wBAAwB,GAAG,8BAA8B,CAAC;AAEhE,+CAA+C;AAC/C,MAAM,kBAAkB,GAAG,iBAAiB,CAAC;AAE7C;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,sBAAsB,CAAC,SAAiB;IACpD,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,wBAAwB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7G,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CAAC,CAAC;AAC1G,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,OAAe;IACnC,OAAO,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AAClD,CAAC"}

package/dist/index.d.ts

@@ -6,7 +6,9 @@ export * from './drivers/SharePointFileStorage.js';
 export * from './drivers/DropboxFileStorage.js';
 export * from './drivers/BoxFileStorage.js';
 export * from './generic/FileStorageBase.js';
+export * from './generic/ObjectKeys.js';
 export * from './util.js';
 export * from './config.js';
 export * from './FileStorageEngine.js';
+export * from './StorageAccessEvaluator.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,0BAA0B,CAAC;AACzC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,kCAAkC,CAAC;AACjD,cAAc,iCAAiC,CAAC;AAChD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,0BAA0B,CAAC;AACzC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,QAAQ,CAAC;AACvB,cAAc,UAAU,CAAC;AACzB,cAAc,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,0BAA0B,CAAC;AACzC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,kCAAkC,CAAC;AACjD,cAAc,iCAAiC,CAAC;AAChD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,0BAA0B,CAAC;AACzC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,sBAAsB,CAAC;AACrC,cAAc,QAAQ,CAAC;AACvB,cAAc,UAAU,CAAC;AACzB,cAAc,qBAAqB,CAAC;AACpC,cAAc,0BAA0B,CAAC"}

package/dist/index.js

@@ -6,7 +6,9 @@ export * from './drivers/SharePointFileStorage.js';
 export * from './drivers/DropboxFileStorage.js';
 export * from './drivers/BoxFileStorage.js';
 export * from './generic/FileStorageBase.js';
+export * from './generic/ObjectKeys.js';
 export * from './util.js';
 export * from './config.js';
 export * from './FileStorageEngine.js';
+export * from './StorageAccessEvaluator.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,0BAA0B,CAAC;AACzC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,kCAAkC,CAAC;AACjD,cAAc,iCAAiC,CAAC;AAChD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,0BAA0B,CAAC;AACzC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,QAAQ,CAAC;AACvB,cAAc,UAAU,CAAC;AACzB,cAAc,qBAAqB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,0BAA0B,CAAC;AACzC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,kCAAkC,CAAC;AACjD,cAAc,iCAAiC,CAAC;AAChD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,0BAA0B,CAAC;AACzC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,sBAAsB,CAAC;AACrC,cAAc,QAAQ,CAAC;AACvB,cAAc,UAAU,CAAC;AACzB,cAAc,qBAAqB,CAAC;AACpC,cAAc,0BAA0B,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@memberjunction/storage",
   "type": "module",
-  "version": "6.2.0-edge.4",
+  "version": "6.2.0-edge.6",
   "description": "This library provides a set of objects that handle the interface between the server-side API and various cloud storage providers.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -21,11 +21,11 @@
     "@azure/identity": "^4.13.0",
     "@azure/storage-blob": "^12.30.0",
     "@google-cloud/storage": "^7.19.0",
-    "@memberjunction/core": "6.2.0-edge.4",
-    "@memberjunction/core-entities": "6.2.0-edge.4",
-    "@memberjunction/credentials": "6.2.0-edge.4",
-    "@memberjunction/global": "6.2.0-edge.4",
-    "@memberjunction/network-utils": "6.2.0-edge.4",
+    "@memberjunction/core": "6.2.0-edge.6",
+    "@memberjunction/core-entities": "6.2.0-edge.6",
+    "@memberjunction/credentials": "6.2.0-edge.6",
+    "@memberjunction/global": "6.2.0-edge.6",
+    "@memberjunction/network-utils": "6.2.0-edge.6",
     "@microsoft/mgt-element": "^4.6.0",
     "@microsoft/mgt-msal2-provider": "^4.6.0",
     "@microsoft/mgt-sharepoint-provider": "^4.6.0",

package/readme.md

@@ -251,6 +251,79 @@ sequenceDiagram
     Driver-->>App: initialized driver
 ```
 
+### Account Permissions (`StorageAccessEvaluator`)
+
+Neither `FileStorageEngine.GetDriver()` nor the utility functions check who is asking — they act on whatever account
+they are given. Anything that acts on an account on a user's behalf must ask `StorageAccessEvaluator` first. It is the
+one place `MJ: File Storage Account Permissions` (Everyone / Role / User rows with `CanRead` / `CanWrite`) are decided,
+and the one place the tracked-file rule (below) is decided:
+
+```typescript
+import { FileStorageEngine, StorageAccessEvaluator } from '@memberjunction/storage';
+
+const evaluator = StorageAccessEvaluator.Instance;
+
+// Throws StorageAccountAccessDeniedError ("You do not have access to this storage account or it does not exist.")
+await evaluator.AssertAccountAccess(accountId, contextUser, 'Write', provider);
+
+// Or filter a list: returns the NormalizeUUID'd IDs the user may read
+const readable = await evaluator.AccessibleAccountIDs(accountIds, contextUser, 'Read', provider);
+
+// Object keys in an account that back an MJ: Files row the user cannot read — pass the account's driver so keys are
+// compared the way that driver addresses them
+const driver = await FileStorageEngine.Instance.GetDriver(accountId, contextUser);
+const blocked = await evaluator.UnreadableTrackedObjectKeys(account.ProviderID, [objectKey], contextUser, provider, driver);
+// Or throw TrackedFileAccessDeniedError ("You do not have access to this file or it does not exist.")
+await evaluator.AssertTrackedObjectsReadable(account.ProviderID, [objectKey], contextUser, provider, driver);
+
+// From an MJ: Files row (loaded as the caller) to its bytes: account gate + tracked-file rule, then the driver
+const resolved = await FileStorageEngine.Instance.ResolveFileObject(fileRow, contextUser, 'Read', provider);
+const bytes = resolved ? await resolved.Driver.GetObject({ fullPath: resolved.ObjectKey }) : null;
+```
+
+**The account rule**
+
+- **Evaluated per call** — nothing is cached, so a grant or revocation applies to the next call.
+- **Read as the system user, decided for the caller** — the permission rows are read with the MJ system user
+  (`WellKnownUserSource`), so a caller who cannot read the permission table is not mistaken for an account with no rows.
+- **Never truncated** — every read sets `IgnoreMaxRows`, so the entity's row cap cannot drop an account's rows (which
+  would make it look like an account with none) or a tracked file's row.
+- **An account with no permission rows is open** to every authenticated user (the current product rule, kept in one
+  place in the evaluator; flipping it needs a data migration that writes explicit `Everyone` rows).
+- **`Read` vs `Write`** — listing, downloading, signing a download URL and searching need `CanRead`; uploading, signing an
+  upload URL, copying into, moving, deleting and creating directories need `CanWrite`. A copy between accounts needs
+  `Read` on the source and `Write` on the destination.
+- **Fails closed** — an unknown account, a malformed ID, a user without `UserRoles`, a missing system user or a failed
+  read all mean "no access". An unknown account is refused with the same message as a restricted one.
+
+**The tracked-file rule**
+
+- An object that backs an `MJ: Files` row — the row's `ProviderKey`, or `Name` when `ProviderKey` is empty, on the
+  account's storage provider — may be read, signed, listed or returned by search only when the caller can read that row
+  (entity permission and row-level security, asked as the caller). Untracked objects are governed by the account rule
+  alone. Rows are keyed by provider, not account, so a row in another account on the same provider counts too.
+- **Writes**: an object may be overwritten (upload, upload URL, copy/move destination), moved, copied out of or deleted
+  only when the caller can read every row that tracks it — the minimum; the account rule still requires `CanWrite`.
+  `UploadFile` applies this before `PutObject`.
+- **Matching** — the client's key and the row's key both go through the account driver's `NormalizeObjectKey` (default:
+  trim, collapse repeated `/`, strip leading/trailing `/`; S3 also strips its key prefix the way it addresses keys) and
+  are compared case-insensitively, so `/hr/secret.pdf`, `hr/secret.pdf/` and `HR/Secret.PDF` are the same tracked
+  object.
+- **Refused keys** — a key with a `.`/`..` segment, a backslash, a percent-encoded `/`, `\`, `.` or control character
+  (`%2F`, `%5C`, `%2E`, `%00`–`%1F`, `%7F`) or a raw control character is never compared: its meaning depends on the
+  provider, so it is treated as an object the caller may not read. A literal `%` otherwise (`50% off.pdf`) is fine.
+- **File-ID routes** (`DownloadUrl`, `GetFileContents`, `CreateMediaAccessToken`, `DeleteFile`, the artifact download
+  URL, the agent file handler, the realtime recording reader) go through `FileStorageEngine.ResolveFileObject`: the
+  row's provider resolves to its first account, which must allow the access, and the row's object gets the tracked-file
+  rule — so a row whose `ProviderKey`/`Name` aliases another row's object is refused. On the server, `ProviderID` and
+  `ProviderKey` cannot be changed on an existing row by a client save (`MJFileEntityServer`).
+
+**Pre-authenticated URLs** are scoped to one object: Azure Blob URLs carry a blob-scoped service SAS (`sr=b`, `r` to
+download, `cw` to upload), never an account SAS; every URL expires after 10 minutes.
+
+The MJServer storage GraphQL routes, the File Storage core actions (and `List Storage Accounts`, which lists only the
+accounts the caller may read), `StorageSearchProvider` and `SearchEngine`'s late permission filter all use it.
+
 ### Using Utility Functions
 
 The library provides high-level utility functions that work with MemberJunction's entity system:
@@ -594,6 +667,7 @@ Each provider also supports environment variable configuration. Environment vari
 | `STORAGE_GOOGLE_DRIVE_REFRESH_TOKEN` | OAuth refresh token |
 | `STORAGE_GOOGLE_DRIVE_REDIRECT_URI` | OAuth redirect URI |
 | `STORAGE_GDRIVE_ROOT_FOLDER_ID` | Root folder ID (optional) |
+| `STORAGE_GDRIVE_DRIVE_ID` | Shared Drive ID. Required for a service account to upload, since a service account has no storage quota of its own. Also the default root when no root folder is set. A credential record carries it as `driveID`. |
 | `STORAGE_GDRIVE_KEY_FILE` | Service account key file (legacy) |
 | `STORAGE_GDRIVE_CREDENTIALS_JSON` | Service account credentials JSON (legacy) |