@voltro/plugin-storage 0.1.0

package/dist/index.js

@@ -0,0 +1,2806 @@
+import { StorageAccessDenied as e, StorageError as t, StorageRejected as n, StorageScanRejected as r, StorageService as i } from "./types.js";
+import { abortMultipartUploadDescriptor as a, beginMultipartUploadDescriptor as o, beginResumableUploadDescriptor as s, completeMultipartUploadDescriptor as c, finalizeUploadDescriptor as l, ingestUrlDescriptor as u, listGrantsDescriptor as d, listRefsDescriptor as f, mintPresignedUploadDescriptor as p, mintUploadTicketDescriptor as m, mintUploadUrlDescriptor as h, mintUrlDescriptor as g, revokeDescriptor as _, shareDescriptor as ee, signMultipartPartDescriptor as te, storageRpcClientImports as v, uploadDescriptor as ne } from "./rpc.js";
+import { Chunk as y, Effect as b, Exit as x, Layer as S, Schedule as C, Stream as w } from "effect";
+import { definePlugin as re } from "@voltro/protocol";
+import { readCookie as T, resolveSessionSecret as ie, verifySession as ae } from "@voltro/protocol/session";
+import { and as E, bytes as oe, eq as D, generateId as O, id as k, integer as A, json as j, mixin as se, reference as ce, table as M, text as N, timestamp as P } from "@voltro/database";
+import { pluginEnv as le } from "@voltro/env";
+import { createHmac as F, randomBytes as I, randomUUID as ue, scryptSync as de, timingSafeEqual as L } from "node:crypto";
+import { spawn as fe } from "node:child_process";
+import { mkdtemp as pe, readFile as me, rm as R, writeFile as z } from "node:fs/promises";
+import { tmpdir as he } from "node:os";
+import { join as B } from "node:path";
+//#region src/streamBridge.ts
+var ge = 1 << 20, _e = (e, n, r = !1) => new t({
+	provider: e,
+	message: n,
+	transient: r
+}), ve = (e) => {
+	let t = 0;
+	for (let n of e) t += n.byteLength;
+	let n = new Uint8Array(t), r = 0;
+	for (let t of e) n.set(t, r), r += t.byteLength;
+	return n;
+}, ye = (e, t = ge) => {
+	let n = [];
+	for (let r = 0; r < e.byteLength; r += t) n.push(e.subarray(r, Math.min(r + t, e.byteLength)));
+	return w.fromIterable(n);
+}, be = (e) => e.pipe(w.runCollect, b.map((e) => ve(y.toReadonlyArray(e)))), xe = (e, t) => w.suspend(() => w.fromAsyncIterable(t(), (t) => _e(e, `read stream failed: ${String(t?.message ?? t)}`, !0))).pipe(w.map((e) => e instanceof Uint8Array ? e : new Uint8Array(e))), Se = async (e) => {
+	let { Readable: t } = await import("node:stream");
+	return t.fromWeb(w.toReadableStream(e));
+}, Ce = (e, t) => e.getStream ? e.getStream(t) : e.get(t).pipe(b.map((e) => ({
+	stream: ye(e.bytes),
+	contentType: e.contentType,
+	size: e.bytes.byteLength
+}))), we = (e, t, n, r) => e.putStream ? e.putStream(t, n, r) : be(n).pipe(b.flatMap((n) => e.put(t, n, {
+	contentType: r.contentType,
+	...r.public === void 0 ? {} : { public: r.public }
+}))), V = "_voltro_storage_refs", H = "_voltro_storage_grants", U = "_voltro_storage_blobs", Te = "_voltro_storage_usage", Ee = M(V, {
+	id: k({ prefix: "file" }),
+	tenantId: N().nullable(),
+	ownerId: N().nullable(),
+	bucket: N(),
+	key: N(),
+	contentType: N(),
+	size: A(),
+	checksum: N(),
+	visibility: N(),
+	accessPolicy: j().nullable(),
+	passwordHash: N().nullable(),
+	width: A().nullable(),
+	height: A().nullable(),
+	duration: A().nullable(),
+	placeholder: N().nullable(),
+	folder: N().nullable(),
+	tags: j().nullable(),
+	alt: N().nullable(),
+	caption: N().nullable(),
+	derivedFrom: N().nullable(),
+	kind: N().nullable(),
+	createdAt: P()
+}).index(["key"]).index(["tenantId"]).index(["ownerId"]).index(["folder"]).index(["derivedFrom"]), De = M(H, {
+	id: k({ prefix: "sgrant" }),
+	refId: N(),
+	principalType: N(),
+	principalId: N(),
+	permission: N(),
+	createdAt: P(),
+	expiresAt: P().nullable(),
+	createdBy: N().nullable()
+}).index(["refId"]).index(["principalId"]), Oe = M(Te, {
+	id: k({ prefix: "susage" }),
+	tenantId: N().maxLength(191),
+	bytes: A().default(0),
+	count: A().default(0),
+	updatedAt: P()
+}).unique("byStorageUsageTenant", ["tenantId"]), ke = M(U, {
+	id: k({ prefix: "blob" }),
+	key: N(),
+	data: oe(),
+	contentType: N(),
+	size: A()
+}).index(["key"]), W = le([
+	{
+		name: "STORAGE_PROVIDER",
+		required: !1,
+		secret: !1,
+		description: "Provider name: 's3' | 'minio' | 'azure' | 'database' | 'filesystem' | 'memory'. Default 'memory'."
+	},
+	{
+		name: "S3_BUCKET",
+		required: !1,
+		secret: !1,
+		description: "S3/MinIO bucket name. Default STORAGE_BUCKET, else \"voltro\"."
+	},
+	{
+		name: "STORAGE_BUCKET",
+		required: !1,
+		secret: !1,
+		description: "Fallback bucket name when S3_BUCKET is unset."
+	},
+	{
+		name: "S3_REGION",
+		required: !1,
+		secret: !1,
+		description: "S3 region. Falls back to AWS_REGION."
+	},
+	{
+		name: "AWS_REGION",
+		required: !1,
+		secret: !1,
+		description: "AWS region fallback for the S3 provider."
+	},
+	{
+		name: "S3_ENDPOINT",
+		required: !1,
+		secret: !1,
+		description: "Custom S3 endpoint URL. Falls back to MINIO_ENDPOINT."
+	},
+	{
+		name: "MINIO_ENDPOINT",
+		required: !1,
+		secret: !1,
+		description: "MinIO endpoint URL fallback for the S3 provider."
+	},
+	{
+		name: "S3_ACCESS_KEY_ID",
+		required: !1,
+		secret: !0,
+		description: "S3 access key id. Falls back to AWS_ACCESS_KEY_ID."
+	},
+	{
+		name: "AWS_ACCESS_KEY_ID",
+		required: !1,
+		secret: !0,
+		description: "AWS access key id fallback for the S3 provider."
+	},
+	{
+		name: "S3_SECRET_ACCESS_KEY",
+		required: !1,
+		secret: !0,
+		description: "S3 secret access key. Falls back to AWS_SECRET_ACCESS_KEY."
+	},
+	{
+		name: "AWS_SECRET_ACCESS_KEY",
+		required: !1,
+		secret: !0,
+		description: "AWS secret access key fallback for the S3 provider."
+	},
+	{
+		name: "S3_FORCE_PATH_STYLE",
+		required: !1,
+		secret: !1,
+		description: "Set to \"1\" to force path-style S3 addressing."
+	},
+	{
+		name: "STORAGE_CDN_URL",
+		required: !1,
+		secret: !1,
+		description: "Public base URL (CDN) served in front of the bucket for public objects."
+	},
+	{
+		name: "VOLTRO_PUBLIC_URL",
+		required: !1,
+		secret: !1,
+		description: "Absolute public base URL of THIS api (scheme://host[:port]) — prepended to the /_voltro/storage/:id serve URL so getUrl/mintUrl/the upload route emit ABSOLUTE URLs. Required when the api is a different origin than the app."
+	},
+	{
+		name: "STORAGE_ALLOWED_ORIGINS",
+		required: !1,
+		secret: !1,
+		description: "Comma-separated origins allowed to read the serve route + POST the upload route cross-origin (CORS). Use '*' for any. Omit for same-origin only."
+	},
+	{
+		name: "AZURE_STORAGE_ACCOUNT",
+		required: !1,
+		secret: !1,
+		description: "Azure storage account name (provider \"azure\")."
+	},
+	{
+		name: "AZURE_STORAGE_KEY",
+		required: !1,
+		secret: !0,
+		description: "Azure account key — needed to mint SAS URLs."
+	},
+	{
+		name: "AZURE_STORAGE_CONNECTION_STRING",
+		required: !1,
+		secret: !0,
+		description: "Azure connection string (carries the account key)."
+	},
+	{
+		name: "AZURE_STORAGE_ENDPOINT",
+		required: !1,
+		secret: !1,
+		description: "Custom Azure blob endpoint (e.g. Azurite)."
+	},
+	{
+		name: "AZURE_STORAGE_CONTAINER",
+		required: !1,
+		secret: !1,
+		description: "Azure blob container name (the \"bucket\")."
+	},
+	{
+		name: "STORAGE_ROOT",
+		required: !1,
+		secret: !1,
+		description: "Filesystem provider root directory. Default \".voltro-storage\"."
+	},
+	{
+		name: "VOLTRO_STORAGE_SECRET",
+		required: !1,
+		secret: !0,
+		description: "HMAC secret for signed grant tokens. Falls back to the session secret."
+	},
+	{
+		name: "VOLTRO_SESSION_COOKIE",
+		required: !1,
+		secret: !1,
+		description: "Session cookie name used to resolve private-object access. Default \"voltro:session\"."
+	},
+	{
+		name: "CLAMAV_HOST",
+		required: !1,
+		secret: !1,
+		description: "clamd host for the optional clamav virus scanner. Default 127.0.0.1."
+	},
+	{
+		name: "CLAMAV_PORT",
+		required: !1,
+		secret: !1,
+		description: "clamd port for the optional clamav virus scanner. Default 3310."
+	}
+]), G = (e, n, r, i) => new t({
+	provider: e,
+	message: n,
+	transient: r,
+	...i === void 0 ? {} : { status: i }
+}), K = (e) => e === void 0 || e === 408 || e === 429 || e >= 500, Ae = /* @__PURE__ */ new Map(), je = (e, t) => Ae.get(e)?.get(t)?.bytes, Me = (e) => {
+	Ae.get(e)?.clear();
+}, Ne = (e = "default") => {
+	let t = Ae.get(e) ?? /* @__PURE__ */ new Map();
+	return Ae.set(e, t), {
+		name: "memory",
+		presigns: !1,
+		put: (e, n, r) => b.sync(() => (t.set(e, {
+			bytes: n,
+			contentType: r.contentType
+		}), { size: n.byteLength })),
+		get: (e) => b.suspend(() => {
+			let n = t.get(e);
+			return n ? b.succeed({
+				bytes: n.bytes,
+				contentType: n.contentType
+			}) : b.fail(G("memory", `no object at key '${e}'`, !1, 404));
+		}),
+		delete: (e) => b.sync(() => {
+			t.delete(e);
+		}),
+		publicUrl: () => null,
+		getUrl: () => b.succeed(""),
+		head: (e) => b.sync(() => {
+			let n = t.get(e);
+			return n ? { size: n.bytes.byteLength } : null;
+		})
+	};
+}, Pe = (e) => {
+	let t = e.root, n = async (e) => {
+		let { join: n, resolve: r, sep: i } = await import("node:path"), a = r(t), o = r(a, e);
+		if (o !== a && !o.startsWith(a + i)) throw Error(`key '${e}' escapes the storage root`);
+		return n(o);
+	}, r = (e, t, n = !1) => b.tryPromise({
+		try: e,
+		catch: (e) => e?.code === "ENOENT" ? G("filesystem", `no object at key '${t}'`, !1, 404) : G("filesystem", String(e?.message ?? e), n)
+	});
+	return {
+		name: "filesystem",
+		presigns: !1,
+		put: (e, t, i) => r(async () => {
+			let r = await import("node:fs/promises"), { dirname: i } = await import("node:path"), { randomUUID: a } = await import("node:crypto"), o = await n(e), s = i(o);
+			await r.mkdir(s, { recursive: !0 });
+			let c = `${o}.tmp-${a()}`;
+			try {
+				await r.writeFile(c, t), await r.rename(c, o);
+			} catch (e) {
+				throw await r.rm(c, { force: !0 }).catch(() => {}), e;
+			}
+			return { size: t.byteLength };
+		}, e, !0),
+		get: (e) => r(async () => {
+			let t = await (await import("node:fs/promises")).readFile(await n(e));
+			return {
+				bytes: new Uint8Array(t),
+				contentType: "application/octet-stream"
+			};
+		}, e),
+		delete: (e) => r(async () => {
+			await (await import("node:fs/promises")).rm(await n(e), { force: !0 });
+		}, e),
+		publicUrl: () => null,
+		getUrl: () => b.succeed(""),
+		head: (e) => b.tryPromise({
+			try: async () => {
+				let t = await import("node:fs/promises");
+				try {
+					return { size: (await t.stat(await n(e))).size };
+				} catch (e) {
+					if (e?.code === "ENOENT") return null;
+					throw e;
+				}
+			},
+			catch: (e) => G("filesystem", String(e?.message ?? e), !1)
+		}),
+		getStream: (e) => r(async () => {
+			let t = await import("node:fs/promises"), { createReadStream: r } = await import("node:fs"), i = await n(e), a = await t.stat(i);
+			return {
+				stream: xe("filesystem", () => r(i)),
+				contentType: "application/octet-stream",
+				size: a.size
+			};
+		}, e),
+		putStream: (e, t, i) => r(async () => {
+			let r = await import("node:fs/promises"), { dirname: i } = await import("node:path"), { randomUUID: a } = await import("node:crypto"), { createWriteStream: o } = await import("node:fs"), { pipeline: s } = await import("node:stream/promises"), c = await n(e);
+			await r.mkdir(i(c), { recursive: !0 });
+			let l = `${c}.tmp-${a()}`;
+			try {
+				await s(await Se(t), o(l));
+				let e = await r.stat(l);
+				return await r.rename(l, c), { size: e.size };
+			} catch (e) {
+				throw await r.rm(l, { force: !0 }).catch(() => {}), e;
+			}
+		}, e, !0),
+		getRange: (e, t, i) => r(async () => {
+			let { createReadStream: r } = await import("node:fs"), a = await n(e), o = [];
+			return await new Promise((e, n) => {
+				let s = r(a, {
+					start: t,
+					end: i
+				});
+				s.on("data", (e) => o.push(e)), s.on("end", () => e()), s.on("error", n);
+			}), ve(o);
+		}, e)
+	};
+}, Fe = (e) => {
+	let t = e.name ?? "s3", n = e.publicAcl ?? !0, r = null, i = () => r || (r = (async () => {
+		let t, n;
+		try {
+			t = await import("@aws-sdk/client-s3"), n = await import("@aws-sdk/s3-request-presigner");
+		} catch (e) {
+			throw Error("the 's3'/'minio' storage provider requires the '@aws-sdk/client-s3' + '@aws-sdk/s3-request-presigner' optional dependencies. Install them to enable it.", { cause: e });
+		}
+		return {
+			client: new t.S3Client({
+				...e.region ? { region: e.region } : { region: "us-east-1" },
+				...e.endpoint ? { endpoint: e.endpoint } : {},
+				...e.forcePathStyle ? { forcePathStyle: !0 } : {},
+				...e.accessKeyId && e.secretAccessKey ? { credentials: {
+					accessKeyId: e.accessKeyId,
+					secretAccessKey: e.secretAccessKey
+				} } : {}
+			}),
+			cmds: t,
+			presign: n.getSignedUrl
+		};
+	})(), r), a = (e) => b.tryPromise({
+		try: e,
+		catch: (e) => {
+			let n = e?.$metadata?.httpStatusCode;
+			return G(t, String(e?.message ?? e), K(n), n);
+		}
+	}), o = async (e) => {
+		let t = e;
+		if (typeof t.transformToByteArray == "function") return t.transformToByteArray();
+		let n = [];
+		for await (let e of t) n.push(e);
+		let r = n.reduce((e, t) => e + t.byteLength, 0), i = new Uint8Array(r), a = 0;
+		for (let e of n) i.set(e, a), a += e.byteLength;
+		return i;
+	};
+	return {
+		name: t,
+		presigns: !0,
+		put: (t, r, o) => a(async () => {
+			let { client: a, cmds: s } = await i();
+			return await a.send(new s.PutObjectCommand({
+				Bucket: e.bucket,
+				Key: t,
+				Body: r,
+				ContentType: o.contentType,
+				...o.public && n ? { ACL: "public-read" } : {}
+			})), { size: r.byteLength };
+		}),
+		get: (t) => a(async () => {
+			let { client: n, cmds: r } = await i(), a = await n.send(new r.GetObjectCommand({
+				Bucket: e.bucket,
+				Key: t
+			}));
+			return {
+				bytes: await o(a.Body),
+				contentType: a.ContentType ?? "application/octet-stream"
+			};
+		}),
+		delete: (t) => a(async () => {
+			let { client: n, cmds: r } = await i();
+			await n.send(new r.DeleteObjectCommand({
+				Bucket: e.bucket,
+				Key: t
+			}));
+		}),
+		publicUrl: (t) => e.cdnBaseUrl ? `${e.cdnBaseUrl.replace(/\/$/, "")}/${t}` : null,
+		getUrl: (t, n) => a(async () => {
+			let { client: r, cmds: a, presign: o } = await i();
+			return o(r, new a.GetObjectCommand({
+				Bucket: e.bucket,
+				Key: t
+			}), { expiresIn: n });
+		}),
+		getUploadUrl: (t, n, r) => a(async () => {
+			let { client: a, cmds: o, presign: s } = await i();
+			return s(a, new o.PutObjectCommand({
+				Bucket: e.bucket,
+				Key: t,
+				ContentType: r
+			}), { expiresIn: n });
+		}),
+		createMultipartUpload: (t, r, o) => a(async () => {
+			let { client: a, cmds: s } = await i(), c = await a.send(new s.CreateMultipartUploadCommand({
+				Bucket: e.bucket,
+				Key: t,
+				ContentType: r,
+				...o?.public && n ? { ACL: "public-read" } : {}
+			}));
+			if (!c.UploadId) throw Error("s3 createMultipartUpload returned no UploadId");
+			return { uploadId: c.UploadId };
+		}),
+		presignUploadPart: (t, n, r, o) => a(async () => {
+			let { client: a, cmds: s, presign: c } = await i();
+			return c(a, new s.UploadPartCommand({
+				Bucket: e.bucket,
+				Key: t,
+				UploadId: n,
+				PartNumber: r
+			}), { expiresIn: o });
+		}),
+		completeMultipartUpload: (t, n, r) => a(async () => {
+			let { client: a, cmds: o } = await i(), s = await a.send(new o.CompleteMultipartUploadCommand({
+				Bucket: e.bucket,
+				Key: t,
+				UploadId: n,
+				MultipartUpload: { Parts: r.map((e) => ({
+					PartNumber: e.partNumber,
+					ETag: e.etag
+				})) }
+			}));
+			return s.ETag === void 0 ? {} : { etag: s.ETag };
+		}),
+		abortMultipartUpload: (t, n) => a(async () => {
+			let { client: r, cmds: a } = await i();
+			await r.send(new a.AbortMultipartUploadCommand({
+				Bucket: e.bucket,
+				Key: t,
+				UploadId: n
+			}));
+		}),
+		head: (n) => b.tryPromise({
+			try: async () => {
+				let { client: t, cmds: r } = await i();
+				try {
+					let i = await t.send(new r.HeadObjectCommand({
+						Bucket: e.bucket,
+						Key: n
+					}));
+					return {
+						size: i.ContentLength ?? 0,
+						...i.ETag === void 0 ? {} : { etag: i.ETag }
+					};
+				} catch (e) {
+					if (e?.$metadata?.httpStatusCode === 404) return null;
+					throw e;
+				}
+			},
+			catch: (e) => {
+				let n = e?.$metadata?.httpStatusCode;
+				return G(t, String(e?.message ?? e), K(n), n);
+			}
+		}),
+		getStream: (n) => a(async () => {
+			let { client: r, cmds: a } = await i(), o = await r.send(new a.GetObjectCommand({
+				Bucket: e.bucket,
+				Key: n
+			})), s = o.Body;
+			return {
+				stream: xe(t, () => s),
+				contentType: o.ContentType ?? "application/octet-stream",
+				...o.ContentLength === void 0 ? {} : { size: o.ContentLength }
+			};
+		}),
+		putStream: (t, r, o) => a(async () => {
+			let { client: a, cmds: s } = await i(), c;
+			try {
+				c = await import("@aws-sdk/lib-storage");
+			} catch (e) {
+				throw Error("s3/minio `putStream` requires the '@aws-sdk/lib-storage' optional dependency (multipart upload). Install it to enable streamed uploads.", { cause: e });
+			}
+			let l = await Se(r);
+			return await new c.Upload({
+				client: a,
+				params: {
+					Bucket: e.bucket,
+					Key: t,
+					Body: l,
+					ContentType: o.contentType,
+					...o.public && n ? { ACL: "public-read" } : {}
+				}
+			}).done(), { size: o.totalSize ?? (await a.send(new s.HeadObjectCommand({
+				Bucket: e.bucket,
+				Key: t
+			}))).ContentLength ?? 0 };
+		}),
+		getRange: (t, n, r) => a(async () => {
+			let { client: a, cmds: s } = await i(), c = await a.send(new s.GetObjectCommand({
+				Bucket: e.bucket,
+				Key: t,
+				Range: `bytes=${n}-${r}`
+			}));
+			return o(c.Body);
+		})
+	};
+}, Ie = (e) => e instanceof Uint8Array ? e : typeof e == "string" ? new Uint8Array(Buffer.from(e, "base64")) : new Uint8Array(e), Le = () => {
+	let e = null, t = () => {
+		if (!e) throw Error("the 'database' storage provider isn't bound to a DataStore yet");
+		return e;
+	}, n = (e) => b.tryPromise({
+		try: e,
+		catch: (e) => G("database", String(e?.message ?? e), !0)
+	}), r = async (e) => (await t().query({
+		table: U,
+		predicate: {
+			column: "key",
+			op: "eq",
+			value: e
+		},
+		order: [],
+		take: 1,
+		skip: void 0,
+		projection: void 0
+	}))[0];
+	return {
+		name: "database",
+		presigns: !1,
+		bindDataStore: (t) => {
+			e = t;
+		},
+		put: (e, i, a) => n(async () => {
+			let n = await r(e);
+			return n ? await t().update(U, String(n.id), {
+				data: i,
+				contentType: a.contentType,
+				size: i.byteLength
+			}) : await t().insert(U, {
+				id: O({
+					kind: "typeid",
+					prefix: "blob"
+				}, U),
+				key: e,
+				data: i,
+				contentType: a.contentType,
+				size: i.byteLength
+			}), { size: i.byteLength };
+		}),
+		get: (e) => b.suspend(() => n(() => r(e)).pipe(b.flatMap((t) => t ? b.succeed({
+			bytes: Ie(t.data),
+			contentType: String(t.contentType)
+		}) : b.fail(G("database", `no object at key '${e}'`, !1, 404))))),
+		delete: (e) => n(async () => {
+			let n = await r(e);
+			n && await t().delete(U, String(n.id));
+		}),
+		publicUrl: () => null,
+		getUrl: () => b.succeed(""),
+		head: (e) => n(async () => {
+			let t = await r(e);
+			return t ? { size: Number(t.size) } : null;
+		})
+	};
+}, Re = (e) => {
+	let t = null, n = () => t || (t = (async () => {
+		let t;
+		try {
+			t = await import("@azure/storage-blob");
+		} catch (e) {
+			throw Error("the 'azure' storage provider requires the '@azure/storage-blob' optional dependency. Install it to enable it.", { cause: e });
+		}
+		let n = W.read("AZURE_STORAGE_ACCOUNT", e.accountName), r = W.read("AZURE_STORAGE_KEY", e.accountKey), i = n && r ? new t.StorageSharedKeyCredential(n, r) : null, a = W.read("AZURE_STORAGE_CONNECTION_STRING", e.connectionString);
+		return {
+			container: (a ? t.BlobServiceClient.fromConnectionString(a) : new t.BlobServiceClient(e.endpoint ?? `https://${n}.blob.core.windows.net`, i ?? void 0)).getContainerClient(e.container),
+			sdk: t,
+			cred: i
+		};
+	})(), t), r = (e) => b.tryPromise({
+		try: e,
+		catch: (e) => {
+			let t = e?.statusCode;
+			return G("azure", String(e?.message ?? e), K(t), t);
+		}
+	}), i = async (e) => {
+		if (!e) return /* @__PURE__ */ new Uint8Array();
+		let t = [];
+		for await (let n of e) t.push(typeof n == "string" ? new TextEncoder().encode(n) : new Uint8Array(n));
+		let n = t.reduce((e, t) => e + t.byteLength, 0), r = new Uint8Array(n), i = 0;
+		for (let e of t) r.set(e, i), i += e.byteLength;
+		return r;
+	}, a = async (t, r, i) => {
+		let { container: a, sdk: o, cred: s } = await n();
+		if (!s) throw Error("azure SAS requires accountName + accountKey (set them or AZURE_STORAGE_ACCOUNT/AZURE_STORAGE_KEY)");
+		let c = a.getBlockBlobClient(t), l = o.generateBlobSASQueryParameters({
+			containerName: e.container,
+			blobName: t,
+			permissions: o.BlobSASPermissions.parse(r),
+			startsOn: /* @__PURE__ */ new Date(Date.now() - 6e4),
+			expiresOn: new Date(Date.now() + i * 1e3)
+		}, s).toString();
+		return `${c.url}?${l}`;
+	};
+	return {
+		name: "azure",
+		presigns: !0,
+		put: (e, t, i) => r(async () => {
+			let { container: r } = await n();
+			return await r.getBlockBlobClient(e).uploadData(Buffer.from(t), { blobHTTPHeaders: { blobContentType: i.contentType } }), { size: t.byteLength };
+		}),
+		get: (e) => r(async () => {
+			let { container: t } = await n(), r = await t.getBlockBlobClient(e).download();
+			return {
+				bytes: await i(r.readableStreamBody),
+				contentType: r.contentType ?? "application/octet-stream"
+			};
+		}),
+		delete: (e) => r(async () => {
+			let { container: t } = await n();
+			await t.getBlockBlobClient(e).deleteIfExists();
+		}),
+		publicUrl: (t) => e.cdnBaseUrl ? `${e.cdnBaseUrl.replace(/\/$/, "")}/${t}` : null,
+		getUrl: (e, t) => r(() => a(e, "r", t)),
+		getUploadUrl: (e, t, n) => r(() => a(e, "cw", t)),
+		head: (e) => b.tryPromise({
+			try: async () => {
+				let { container: t } = await n();
+				try {
+					let n = await t.getBlockBlobClient(e).getProperties();
+					return {
+						size: n.contentLength ?? 0,
+						...n.etag === void 0 ? {} : { etag: n.etag }
+					};
+				} catch (e) {
+					if (e?.statusCode === 404) return null;
+					throw e;
+				}
+			},
+			catch: (e) => {
+				let t = e?.statusCode;
+				return G("azure", String(e?.message ?? e), K(t), t);
+			}
+		}),
+		getStream: (e) => r(async () => {
+			let { container: t } = await n(), r = await t.getBlockBlobClient(e).download();
+			return {
+				stream: xe("azure", () => r.readableStreamBody),
+				contentType: r.contentType ?? "application/octet-stream",
+				...r.contentLength === void 0 ? {} : { size: r.contentLength }
+			};
+		}),
+		putStream: (e, t, i) => r(async () => {
+			let { container: r } = await n(), a = await Se(t);
+			return await r.getBlockBlobClient(e).uploadStream(a, 4 * 1024 * 1024, 5, { blobHTTPHeaders: { blobContentType: i.contentType } }), { size: i.totalSize ?? (await r.getBlockBlobClient(e).getProperties()).contentLength ?? 0 };
+		}),
+		getRange: (e, t, a) => r(async () => {
+			let { container: r } = await n(), o = await r.getBlockBlobClient(e).download(t, a - t + 1);
+			return i(o.readableStreamBody);
+		})
+	};
+}, ze = {
+	webp: "image/webp",
+	avif: "image/avif",
+	jpeg: "image/jpeg",
+	jpg: "image/jpeg",
+	png: "image/png"
+}, Be = (e) => {
+	if (!e) return null;
+	let t = new URLSearchParams(e), n = (e) => {
+		let n = t.get(e);
+		if (n == null) return;
+		let r = Number(n);
+		return Number.isFinite(r) && r > 0 ? Math.floor(r) : void 0;
+	}, r = n("w"), i = n("h"), a = n("q"), o = (t.get("format") ?? t.get("fm") ?? void 0)?.toLowerCase(), s = t.get("fit") ?? void 0;
+	return r === void 0 && i === void 0 && !o && a === void 0 ? null : {
+		...r === void 0 ? {} : { w: r },
+		...i === void 0 ? {} : { h: i },
+		...o ? { format: o } : {},
+		...a === void 0 ? {} : { q: a },
+		...s ? { fit: s } : {}
+	};
+}, Ve = (e) => e.startsWith("image/") && !e.includes("svg"), q, He = async () => {
+	if (q !== void 0) return q;
+	try {
+		let e = await import("sharp");
+		q = e.default ?? e;
+	} catch {
+		q = null;
+	}
+	return q;
+}, Ue = async (e, t, n) => {
+	if (!Ve(t)) return null;
+	let r = await He();
+	if (!r) return null;
+	try {
+		let i = r(Buffer.from(e), { failOn: "none" });
+		(n.w !== void 0 || n.h !== void 0) && (i = i.resize({
+			...n.w === void 0 ? {} : { width: n.w },
+			...n.h === void 0 ? {} : { height: n.h },
+			fit: n.fit ?? "cover",
+			withoutEnlargement: !0
+		}));
+		let a = n.format && ze[n.format] ? n.format : void 0, o = t;
+		if (a) {
+			let e = a === "jpg" ? "jpeg" : a;
+			i = i.toFormat(e, n.q === void 0 ? {} : { quality: n.q }), o = ze[a];
+		} else n.q !== void 0 && (t === "image/jpeg" || t === "image/webp") && (i = i.toFormat(t === "image/webp" ? "webp" : "jpeg", { quality: n.q }));
+		let s = await i.toBuffer();
+		return {
+			bytes: new Uint8Array(s),
+			contentType: o
+		};
+	} catch {
+		return null;
+	}
+}, We = 200, J = /* @__PURE__ */ new Map(), Ge = async (e, t, n, r) => {
+	let i = `${e}::${JSON.stringify(r)}`, a = J.get(i);
+	if (a) return a;
+	let o = await Ue(t, n, r);
+	if (o && (J.set(i, o), J.size > We)) {
+		let e = J.keys().next().value;
+		e !== void 0 && J.delete(e);
+	}
+	return o;
+}, Ke = (e) => {
+	let t = I(16).toString("hex");
+	return `${t}:${de(e, t, 32).toString("hex")}`;
+}, qe = (e, t) => {
+	if (!e || !t) return !1;
+	let [n, r] = t.split(":");
+	if (!n || !r) return !1;
+	let i = Buffer.from(r, "hex"), a = de(e, n, i.length);
+	return a.length === i.length && L(a, i);
+}, Je = (e) => Array.isArray(e) ? e.filter((e) => typeof e == "string") : [], Ye = (e) => Je(e.metadata?.roles), Xe = (e) => Je(e.scopes), Ze = (e, t) => e.some((e) => t.includes(e)), Qe = (e) => Je(e.metadata?.groups), $e = (e) => typeof e == "boolean" ? b.succeed(e) : b.isEffect(e) ? e : b.promise(() => e), et = (e, t, n = {}) => b.gen(function* () {
+	if (t.id && e.ownerId && t.id === e.ownerId) return !0;
+	let r = e.accessPolicy ?? [];
+	if (r.length === 0) return !1;
+	let i = n.resolveGroups ? yield* b.promise(async () => await n.resolveGroups(t)) : Qe(t);
+	for (let a of r) if (yield* tt(a, e, t, i, n)) return !0;
+	return !1;
+}), tt = (e, t, n, r, i) => b.gen(function* () {
+	let a = !1, o = (e) => (a = !0, e);
+	if (e.owner !== void 0 && e.owner && !o(!!n.id && !!t.ownerId && n.id === t.ownerId) || e.tenant !== void 0 && e.tenant && !o(!!n.tenantId && n.tenantId === t.tenantId) || e.apiKey !== void 0 && e.apiKey && !o(n.type === "apiKey") || e.roles && e.roles.length > 0 && !o(Ze(Ye(n), e.roles)) || e.groups && e.groups.length > 0 && !o(Ze(r, e.groups)) || e.scopes && e.scopes.length > 0 && !o(Ze(Xe(n), e.scopes)) || e.password !== void 0 && e.password && !o(qe(i.password, t.passwordHash))) return !1;
+	if (e.guard) {
+		let r = i.guards?.[e.guard];
+		if (!o(r ? yield* $e(r({
+			subject: n,
+			ref: t
+		})) : !1)) return !1;
+	}
+	return a;
+}), nt = (e, t) => {
+	let n = [];
+	e.id && n.push({
+		type: e.type === "apiKey" ? "apiKey" : "user",
+		id: e.id
+	});
+	for (let e of t) n.push({
+		type: "group",
+		id: e
+	});
+	return n;
+}, rt = (e, t, n, r, i) => {
+	let a = nt(t, n);
+	return e.some((e) => e.expiresAt && e.expiresAt.getTime() < i || r === "write" && e.permission !== "write" ? !1 : a.some((t) => t.type === e.principalType && t.id === e.principalId));
+}, it = (e, t) => t.resolveGroups ? b.promise(async () => await t.resolveGroups(e)) : b.succeed(Qe(e)), Y = () => W.read("VOLTRO_STORAGE_SECRET") ?? ie(), X = (e) => (typeof e == "string" ? Buffer.from(e, "utf8") : e).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, ""), Z = (e) => {
+	let t = e.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - e.length % 4) % 4);
+	return Buffer.from(t, "base64");
+}, at = (e, t, n = Y()) => {
+	if (!n) throw Error("signGrant: secret must be a non-empty string");
+	let r = {
+		refId: e,
+		exp: Math.floor(Date.now() / 1e3) + Math.floor(t)
+	}, i = X(JSON.stringify(r));
+	return `${i}.${X(F("sha256", n).update(i).digest())}`;
+}, ot = (e, t = Y()) => {
+	if (!e || !t) return null;
+	let n = e.indexOf(".");
+	if (n <= 0 || n === e.length - 1) return null;
+	let r = e.slice(0, n), i = e.slice(n + 1), a = F("sha256", t).update(r).digest(), o = Z(i);
+	if (o.length !== a.length || !L(o, a)) return null;
+	try {
+		let e = JSON.parse(Z(r).toString("utf8"));
+		return typeof e.refId != "string" || typeof e.exp != "number" || e.exp < Math.floor(Date.now() / 1e3) ? null : e;
+	} catch {
+		return null;
+	}
+}, st = (e, t, n = Y()) => {
+	if (!n) throw Error("signUploadTicket: secret must be a non-empty string");
+	let r = {
+		...e,
+		exp: Math.floor(Date.now() / 1e3) + Math.floor(t)
+	}, i = X(JSON.stringify(r));
+	return `${i}.${X(F("sha256", n).update(`u:${i}`).digest())}`;
+}, ct = (e, t = Y()) => {
+	if (!e || !t) return null;
+	let n = e.indexOf(".");
+	if (n <= 0 || n === e.length - 1) return null;
+	let r = e.slice(0, n), i = e.slice(n + 1), a = F("sha256", t).update(`u:${r}`).digest(), o = Z(i);
+	if (o.length !== a.length || !L(o, a)) return null;
+	try {
+		let e = JSON.parse(Z(r).toString("utf8"));
+		return typeof e.ct != "string" || typeof e.exp != "number" || e.vis !== "public" && e.vis !== "private" || e.exp < Math.floor(Date.now() / 1e3) ? null : e;
+	} catch {
+		return null;
+	}
+}, lt = (e, t, n = Y()) => {
+	if (!n) throw Error("signFinalizeTicket: secret must be a non-empty string");
+	let r = {
+		...e,
+		exp: Math.floor(Date.now() / 1e3) + Math.floor(t)
+	}, i = X(JSON.stringify(r));
+	return `${i}.${X(F("sha256", n).update(`f:${i}`).digest())}`;
+}, ut = (e, t = Y()) => {
+	if (!e || !t) return null;
+	let n = e.indexOf(".");
+	if (n <= 0 || n === e.length - 1) return null;
+	let r = e.slice(0, n), i = e.slice(n + 1), a = F("sha256", t).update(`f:${r}`).digest(), o = Z(i);
+	if (o.length !== a.length || !L(o, a)) return null;
+	try {
+		let e = JSON.parse(Z(r).toString("utf8"));
+		return typeof e.key != "string" || e.key.length === 0 || typeof e.ct != "string" || typeof e.exp != "number" || e.vis !== "public" && e.vis !== "private" || e.exp < Math.floor(Date.now() / 1e3) ? null : e;
+	} catch {
+		return null;
+	}
+}, dt = (e, t, n = Y()) => {
+	if (!n) throw Error("signResumableTicket: secret must be a non-empty string");
+	let r = {
+		...e,
+		exp: Math.floor(Date.now() / 1e3) + Math.floor(t)
+	}, i = X(JSON.stringify(r));
+	return `${i}.${X(F("sha256", n).update(`r:${i}`).digest())}`;
+}, ft = (e, t = Y()) => {
+	if (!e || !t) return null;
+	let n = e.indexOf(".");
+	if (n <= 0 || n === e.length - 1) return null;
+	let r = e.slice(0, n), i = e.slice(n + 1), a = F("sha256", t).update(`r:${r}`).digest(), o = Z(i);
+	if (o.length !== a.length || !L(o, a)) return null;
+	try {
+		let e = JSON.parse(Z(r).toString("utf8"));
+		return typeof e.id != "string" || e.id.length === 0 || typeof e.size != "number" || e.size < 0 || typeof e.ct != "string" || typeof e.exp != "number" || e.vis !== "public" && e.vis !== "private" || e.exp < Math.floor(Date.now() / 1e3) ? null : e;
+	} catch {
+		return null;
+	}
+}, pt = (e, t, n = Y()) => {
+	if (!n) throw Error("signMultipartTicket: secret must be a non-empty string");
+	let r = {
+		...e,
+		exp: Math.floor(Date.now() / 1e3) + Math.floor(t)
+	}, i = X(JSON.stringify(r));
+	return `${i}.${X(F("sha256", n).update(`m:${i}`).digest())}`;
+}, mt = (e, t = Y()) => {
+	if (!e || !t) return null;
+	let n = e.indexOf(".");
+	if (n <= 0 || n === e.length - 1) return null;
+	let r = e.slice(0, n), i = e.slice(n + 1), a = F("sha256", t).update(`m:${r}`).digest(), o = Z(i);
+	if (o.length !== a.length || !L(o, a)) return null;
+	try {
+		let e = JSON.parse(Z(r).toString("utf8"));
+		return typeof e.key != "string" || e.key.length === 0 || typeof e.uploadId != "string" || e.uploadId.length === 0 || typeof e.ct != "string" || typeof e.exp != "number" || e.vis !== "public" && e.vis !== "private" || e.exp < Math.floor(Date.now() / 1e3) ? null : e;
+	} catch {
+		return null;
+	}
+}, ht = (e, t) => {
+	if (!t || t.length === 0) return !0;
+	let n = e.toLowerCase();
+	return t.some((e) => {
+		let t = e.toLowerCase();
+		return t.endsWith("/*") ? n.startsWith(t.slice(0, -1)) : n === t;
+	});
+}, gt = [
+	{
+		ct: /^image\/png$/,
+		offset: 0,
+		magic: [
+			137,
+			80,
+			78,
+			71
+		]
+	},
+	{
+		ct: /^image\/jpe?g$/,
+		offset: 0,
+		magic: [
+			255,
+			216,
+			255
+		]
+	},
+	{
+		ct: /^image\/gif$/,
+		offset: 0,
+		magic: [
+			71,
+			73,
+			70,
+			56
+		]
+	},
+	{
+		ct: /^image\/webp$/,
+		offset: 0,
+		magic: [
+			82,
+			73,
+			70,
+			70
+		]
+	},
+	{
+		ct: /^image\/bmp$/,
+		offset: 0,
+		magic: [66, 77]
+	},
+	{
+		ct: /^application\/pdf$/,
+		offset: 0,
+		magic: [
+			37,
+			80,
+			68,
+			70
+		]
+	},
+	{
+		ct: /^application\/zip$/,
+		offset: 0,
+		magic: [
+			80,
+			75,
+			3,
+			4
+		]
+	},
+	{
+		ct: /^application\/gzip$/,
+		offset: 0,
+		magic: [31, 139]
+	}
+], _t = (e, t) => {
+	let n = t.toLowerCase(), r = gt.find((e) => e.ct.test(n));
+	return r ? e.length < r.offset + r.magic.length ? !1 : r.magic.every((t, n) => e[r.offset + n] === t) : !0;
+}, vt = (e, t, n) => n ? n.maxBytes !== void 0 && e.byteLength > n.maxBytes ? {
+	reason: "too-large",
+	detail: `${e.byteLength} bytes exceeds the ${n.maxBytes}-byte limit`
+} : ht(t, n.allowedContentTypes) ? n.sniff && !_t(e, t) ? {
+	reason: "content-mismatch",
+	detail: `bytes do not match the declared content type '${t}'`
+} : null : {
+	reason: "content-type-not-allowed",
+	detail: `content type '${t}' is not in the allow-list`
+} : null, yt = async (e, t, n) => {
+	if (!Ve(t)) return { bytes: e };
+	let r = await He();
+	if (!r) return { bytes: e };
+	try {
+		let t = e;
+		if (n?.normalize) {
+			let n = await r(Buffer.from(e), { failOn: "none" }).rotate().toBuffer();
+			t = new Uint8Array(n);
+		}
+		let i = await r(Buffer.from(t), { failOn: "none" }).metadata(), a = await r(Buffer.from(t), { failOn: "none" }).resize({
+			width: 24,
+			height: 24,
+			fit: "inside",
+			withoutEnlargement: !0
+		}).webp({ quality: 40 }).toBuffer().catch(() => null);
+		return {
+			bytes: t,
+			...typeof i.width == "number" ? { width: i.width } : {},
+			...typeof i.height == "number" ? { height: i.height } : {},
+			...a ? { placeholder: `data:image/webp;base64,${a.toString("base64")}` } : {}
+		};
+	} catch {
+		return { bytes: e };
+	}
+}, bt = async (e) => {
+	let { createHash: t } = await import("node:crypto");
+	return t("sha256").update(e).digest("hex");
+}, xt = (e, t) => e ? `${e.replace(/\/+$/, "")}/_voltro/storage/${t}` : `/_voltro/storage/${t}`, St = (e, t) => {
+	if (t.tenantId !== void 0 && (e.tenantId ?? null) !== (t.tenantId ?? null) || t.ownerId !== void 0 && e.ownerId !== t.ownerId || !t.includeDerived && e.derivedFrom != null) return !1;
+	if (t.folder !== void 0) {
+		let n = t.folder.replace(/\/+$/, ""), r = (e.folder ?? "").replace(/\/+$/, "");
+		if (r !== n && !r.startsWith(`${n}/`)) return !1;
+	}
+	if (t.tags.length > 0) {
+		let n = e.tags ?? [];
+		if (!t.tags.every((e) => n.includes(e))) return !1;
+	}
+	return !0;
+}, Ct = (e) => e ?? "global", wt = () => {
+	let e = /* @__PURE__ */ new Map(), t = /* @__PURE__ */ new Map();
+	return {
+		insert: (t) => b.sync(() => {
+			e.set(t.id, t);
+		}),
+		getById: (t) => b.sync(() => e.get(t) ?? null),
+		delete: (t) => b.sync(() => e.delete(t)),
+		listRecent: (t) => b.sync(() => [...e.values()].sort((e, t) => t.createdAt.getTime() - e.createdAt.getTime()).slice(0, t)),
+		countByKey: (t, n) => b.sync(() => [...e.values()].filter((e) => e.bucket === t && e.key === n).length),
+		usageByTenant: (t) => b.sync(() => {
+			let n = 0, r = 0;
+			for (let i of e.values()) (i.tenantId ?? null) === (t ?? null) && (n += i.size, r++);
+			return {
+				bytes: n,
+				count: r
+			};
+		}),
+		consumeUsage: (e, n, r) => b.sync(() => {
+			let i = Ct(e), a = t.get(i) ?? {
+				bytes: 0,
+				count: 0
+			}, o = (r?.maxBytes === void 0 || a.bytes + n.bytes <= r.maxBytes) && (r?.maxCount === void 0 || a.count + n.count <= r.maxCount);
+			return o && t.set(i, {
+				bytes: a.bytes + n.bytes,
+				count: a.count + n.count
+			}), {
+				allowed: o,
+				bytes: a.bytes,
+				count: a.count
+			};
+		}),
+		releaseUsage: (e, n) => b.sync(() => {
+			let r = Ct(e), i = t.get(r);
+			i && t.set(r, {
+				bytes: Math.max(0, i.bytes - n.bytes),
+				count: Math.max(0, i.count - n.count)
+			});
+		}),
+		listByDerivedFrom: (t) => b.sync(() => [...e.values()].filter((e) => (e.derivedFrom ?? null) === t)),
+		listRefs: (t) => b.sync(() => [...e.values()].filter((e) => St(e, t)).sort((e, t) => t.createdAt.getTime() - e.createdAt.getTime()).slice(t.offset, t.offset + t.limit))
+	};
+}, Q = (e) => ({
+	id: String(e.id),
+	tenantId: e.tenantId ?? null,
+	ownerId: e.ownerId ?? null,
+	bucket: String(e.bucket),
+	key: String(e.key),
+	contentType: String(e.contentType),
+	size: Number(e.size),
+	checksum: String(e.checksum),
+	visibility: e.visibility === "public" ? "public" : "private",
+	accessPolicy: e.accessPolicy ?? null,
+	passwordHash: e.passwordHash ?? null,
+	createdAt: e.createdAt instanceof Date ? e.createdAt : new Date(String(e.createdAt)),
+	width: e.width ?? null,
+	height: e.height ?? null,
+	duration: e.duration ?? null,
+	placeholder: e.placeholder ?? null,
+	folder: e.folder ?? null,
+	tags: e.tags ?? null,
+	alt: e.alt ?? null,
+	caption: e.caption ?? null,
+	derivedFrom: e.derivedFrom ?? null,
+	kind: e.kind ?? null
+}), $ = (e) => b.tryPromise({
+	try: e,
+	catch: (e) => new t({
+		provider: "refstore",
+		message: String(e?.message ?? e),
+		transient: !0
+	})
+}), Tt = async (e, t) => (await e.query({
+	table: "_voltro_storage_usage",
+	predicate: {
+		column: "tenantId",
+		op: "eq",
+		value: t
+	},
+	order: [],
+	take: 1,
+	skip: void 0,
+	projection: void 0
+}))[0] ?? null, Et = (e) => ({
+	insert: (t) => $(() => e.insert(V, { ...t })),
+	getById: (t) => $(async () => {
+		let n = await e.query({
+			table: V,
+			predicate: {
+				column: "id",
+				op: "eq",
+				value: t
+			},
+			order: [],
+			take: 1,
+			skip: void 0,
+			projection: void 0
+		});
+		return n[0] ? Q(n[0]) : null;
+	}),
+	delete: (t) => $(() => e.delete(V, t)),
+	listRecent: (t) => $(async () => (await e.query({
+		table: V,
+		predicate: void 0,
+		order: [{
+			column: "createdAt",
+			direction: "desc"
+		}],
+		take: t,
+		skip: void 0,
+		projection: void 0
+	})).map(Q)),
+	countByKey: (t, n) => $(async () => (await e.query({
+		table: V,
+		predicate: { and: [{
+			column: "bucket",
+			op: "eq",
+			value: t
+		}, {
+			column: "key",
+			op: "eq",
+			value: n
+		}] },
+		order: [],
+		take: void 0,
+		skip: void 0,
+		projection: void 0
+	})).length),
+	usageByTenant: (t) => $(async () => {
+		let n = await e.query({
+			table: V,
+			predicate: {
+				column: "tenantId",
+				op: "eq",
+				value: t
+			},
+			order: [],
+			take: void 0,
+			skip: void 0,
+			projection: void 0
+		}), r = 0;
+		for (let e of n) r += Number(e.size ?? 0);
+		return {
+			bytes: r,
+			count: n.length
+		};
+	}),
+	consumeUsage: (t, n, r) => $(async () => {
+		let i = Ct(t);
+		for (let t = 0; t < 32; t++) {
+			t > 0 && await new Promise((e) => setTimeout(e, t));
+			let a = await Tt(e, i), o = a ? Number(a.bytes ?? 0) : 0, s = a ? Number(a.count ?? 0) : 0;
+			if (!((r?.maxBytes === void 0 || o + n.bytes <= r.maxBytes) && (r?.maxCount === void 0 || s + n.count <= r.maxCount))) return {
+				allowed: !1,
+				bytes: o,
+				count: s
+			};
+			if (a) {
+				if (await e.updateMany("_voltro_storage_usage", {
+					bytes: o + n.bytes,
+					count: s + n.count,
+					updatedAt: /* @__PURE__ */ new Date()
+				}, { where: E(D("id", String(a.id)), D("bytes", o), D("count", s)) }) === 1) return {
+					allowed: !0,
+					bytes: o,
+					count: s
+				};
+			} else {
+				let t = O({
+					kind: "typeid",
+					prefix: "susage"
+				}, Te), r = await e.insertIgnore(Te, {
+					id: t,
+					tenantId: i,
+					bytes: n.bytes,
+					count: n.count,
+					updatedAt: /* @__PURE__ */ new Date()
+				}, { conflictColumns: ["tenantId"] });
+				if (String(r.id) === t) return {
+					allowed: !0,
+					bytes: 0,
+					count: 0
+				};
+			}
+		}
+		throw Error(`storage usage consume: contention on tenant '${i}' exceeded 32 attempts`);
+	}),
+	releaseUsage: (t, n) => $(async () => {
+		let r = Ct(t);
+		for (let t = 0; t < 32; t++) {
+			t > 0 && await new Promise((e) => setTimeout(e, t));
+			let i = await Tt(e, r);
+			if (!i) return;
+			let a = Number(i.bytes ?? 0), o = Number(i.count ?? 0);
+			if (await e.updateMany("_voltro_storage_usage", {
+				bytes: Math.max(0, a - n.bytes),
+				count: Math.max(0, o - n.count),
+				updatedAt: /* @__PURE__ */ new Date()
+			}, { where: E(D("id", String(i.id)), D("bytes", a), D("count", o)) }) === 1) return;
+		}
+		throw Error(`storage usage release: contention on tenant '${r}' exceeded 32 attempts`);
+	}),
+	listByDerivedFrom: (t) => $(async () => (await e.query({
+		table: V,
+		predicate: {
+			column: "derivedFrom",
+			op: "eq",
+			value: t
+		},
+		order: [{
+			column: "createdAt",
+			direction: "asc"
+		}],
+		take: void 0,
+		skip: void 0,
+		projection: void 0
+	})).map(Q)),
+	listRefs: (t) => $(async () => {
+		let n = [];
+		t.tenantId !== void 0 && n.push({
+			column: "tenantId",
+			op: "eq",
+			value: t.tenantId
+		}), t.ownerId !== void 0 && n.push({
+			column: "ownerId",
+			op: "eq",
+			value: t.ownerId
+		});
+		let r = n.length === 0 ? void 0 : n.length === 1 ? n[0] : { and: n };
+		return (await e.query({
+			table: V,
+			predicate: r,
+			order: [{
+				column: "createdAt",
+				direction: "desc"
+			}],
+			take: void 0,
+			skip: void 0,
+			projection: void 0
+		})).map(Q).filter((e) => St(e, t)).slice(t.offset, t.offset + t.limit);
+	})
+}), Dt = () => {
+	let e = /* @__PURE__ */ new Map();
+	return {
+		insert: (t) => b.sync(() => {
+			e.set(t.id, t);
+		}),
+		delete: (t) => b.sync(() => {
+			e.delete(t);
+		}),
+		listByRef: (t) => b.sync(() => [...e.values()].filter((e) => e.refId === t)),
+		deleteByRef: (t) => b.sync(() => {
+			for (let [n, r] of e) r.refId === t && e.delete(n);
+		})
+	};
+}, Ot = (e) => ({
+	id: String(e.id),
+	refId: String(e.refId),
+	principalType: e.principalType,
+	principalId: String(e.principalId),
+	permission: e.permission === "write" ? "write" : "read",
+	createdAt: e.createdAt instanceof Date ? e.createdAt : new Date(String(e.createdAt)),
+	expiresAt: e.expiresAt ? e.expiresAt instanceof Date ? e.expiresAt : new Date(String(e.expiresAt)) : null,
+	createdBy: e.createdBy ?? null
+}), kt = (e) => ({
+	insert: (t) => $(() => e.insert(H, { ...t })),
+	delete: (t) => $(() => e.delete(H, t)),
+	listByRef: (t) => $(async () => (await e.query({
+		table: H,
+		predicate: {
+			column: "refId",
+			op: "eq",
+			value: t
+		},
+		order: [{
+			column: "createdAt",
+			direction: "desc"
+		}],
+		take: void 0,
+		skip: void 0,
+		projection: void 0
+	})).map(Ot)),
+	deleteByRef: (t) => $(async () => {
+		let n = await e.query({
+			table: H,
+			predicate: {
+				column: "refId",
+				op: "eq",
+				value: t
+			},
+			order: [],
+			take: void 0,
+			skip: void 0,
+			projection: void 0
+		});
+		for (let t of n) await e.delete(H, String(t.id));
+	})
+}), At = () => O({
+	kind: "typeid",
+	prefix: "file"
+}, V), jt = () => O({
+	kind: "typeid",
+	prefix: "grant"
+}, H), Mt = (i) => {
+	let { provider: a, refStore: o, grantStore: s, bucket: c } = i, l = i.access ?? {}, u = i.attempts ?? 3, d = i.urlExpiresInSec ?? 3600, f = (e) => xt(i.publicBaseUrl, e), p = C.recurs(Math.max(0, u - 1)).pipe(C.intersect(C.exponential("100 millis")), C.whileInput((e) => e.transient)), m = (e, t, n) => [
+		i.tenantPrefix,
+		e ?? "global",
+		n ?? t
+	].filter(Boolean).join("/"), h = (e, t, n) => [
+		i.tenantPrefix,
+		e ?? "global",
+		"_incoming",
+		t,
+		String(n).padStart(6, "0")
+	].filter(Boolean).join("/"), g = (e, n) => n !== void 0 && e.tenantId !== n ? b.fail(new t({
+		provider: a.name,
+		message: "cross-tenant access denied",
+		transient: !1,
+		status: 403
+	})) : b.succeed(e), _ = (e, n) => o.getById(e).pipe(b.flatMap((r) => r ? g(r, n) : b.fail(new t({
+		provider: a.name,
+		message: `no ref '${e}'`,
+		transient: !1,
+		status: 404
+	})))), ee = (e) => b.suspend(() => {
+		let n = i.scan(e);
+		return b.isEffect(n) ? n : b.tryPromise({
+			try: () => Promise.resolve(n),
+			catch: (e) => new t({
+				provider: "scan",
+				message: String(e?.message ?? e),
+				transient: !0
+			})
+		});
+	}), te = (e) => b.suspend(() => {
+		let t = e.contentType;
+		if (!i.videoProbe || !(t.startsWith("video/") || t.startsWith("audio/"))) return b.succeed(null);
+		let n;
+		try {
+			n = i.videoProbe(e);
+		} catch {
+			return b.succeed(null);
+		}
+		return b.isEffect(n) ? n.pipe(b.catchAll(() => b.succeed(null))) : b.tryPromise({
+			try: () => Promise.resolve(n),
+			catch: () => null
+		}).pipe(b.catchAll(() => b.succeed(null)));
+	}), v = (e) => b.gen(function* () {
+		let t = vt(e.bytes, e.contentType, i.limits);
+		if (t) return yield* b.fail(new n(t));
+		if (i.scan) {
+			let t = yield* ee({
+				bytes: e.bytes,
+				contentType: e.contentType,
+				...e.key ? { key: e.key } : {}
+			});
+			if (!t.clean) return yield* b.fail(new r({ threat: t.threat ?? "unknown" }));
+		}
+		let s = yield* b.promise(() => yt(e.bytes, e.contentType, { normalize: i.normalizeImages ?? !1 })), l = s.bytes, u = yield* te({
+			bytes: l,
+			contentType: e.contentType
+		}), d = s.width ?? u?.width, f = s.height ?? u?.height, h = s.placeholder ?? u?.poster, g = e.duration ?? u?.duration, _ = yield* b.promise(() => bt(l)), v = e.tenantId ?? null, ne = e.visibility ?? "private", S = m(v, _, e.key), C = {
+			bytes: l.byteLength,
+			count: 1
+		}, w = yield* o.consumeUsage(v, C, i.quota);
+		if (!w.allowed) {
+			let e = i.quota ?? {}, t = e.maxCount !== void 0 && w.count + 1 > e.maxCount ? `tenant object count ${w.count} + 1 exceeds max ${e.maxCount}` : `tenant usage ${w.bytes} + ${l.byteLength} bytes exceeds max ${e.maxBytes}`;
+			return yield* b.fail(new n({
+				reason: "quota-exceeded",
+				detail: t
+			}));
+		}
+		let re = e.password ? yield* b.sync(() => Ke(e.password)) : null, T = {
+			id: At(),
+			tenantId: v,
+			ownerId: e.ownerId ?? null,
+			bucket: c,
+			key: S,
+			contentType: e.contentType,
+			size: l.byteLength,
+			checksum: _,
+			visibility: ne,
+			accessPolicy: e.access ?? null,
+			passwordHash: re,
+			createdAt: /* @__PURE__ */ new Date(),
+			...d === void 0 ? {} : { width: d },
+			...f === void 0 ? {} : { height: f },
+			...h === void 0 ? {} : { placeholder: h },
+			...g === void 0 ? {} : { duration: g },
+			...e.folder === void 0 ? {} : { folder: e.folder },
+			...e.tags === void 0 ? {} : { tags: e.tags },
+			...e.alt === void 0 ? {} : { alt: e.alt },
+			...e.caption === void 0 ? {} : { caption: e.caption },
+			...e.derivedFrom === void 0 ? {} : { derivedFrom: e.derivedFrom },
+			...e.kind === void 0 ? {} : { kind: e.kind }
+		};
+		return yield* ((e) => e.pipe(b.onExit((e) => x.isSuccess(e) ? b.void : o.delete(T.id).pipe(b.zipRight(o.releaseUsage(v, C)), b.ignore))))(o.insert(T).pipe(b.zipRight(a.put(S, l, {
+			contentType: e.contentType,
+			public: ne === "public"
+		}).pipe(b.retry(p))))), i.transcode !== void 0 && i.autoTranscode !== !1 && T.derivedFrom == null && (e.contentType.startsWith("video/") || e.contentType.startsWith("audio/")) && (yield* b.forkDaemon(y(T).pipe(b.ignore))), T;
+	}), ne = (e) => b.suspend(() => {
+		if (!i.transcode) return b.succeed([]);
+		let t;
+		try {
+			t = i.transcode(e);
+		} catch {
+			return b.succeed([]);
+		}
+		return b.isEffect(t) ? t.pipe(b.catchAll(() => b.succeed([]))) : b.tryPromise({
+			try: () => Promise.resolve(t),
+			catch: () => []
+		}).pipe(b.catchAll(() => b.succeed([])));
+	}), y = (e) => b.gen(function* () {
+		if (!i.transcode || e.derivedFrom != null) return [];
+		let t = yield* a.get(e.key).pipe(b.retry(p)), n = yield* ne({
+			bytes: t.bytes,
+			contentType: e.contentType,
+			ref: e
+		}), r = [];
+		for (let t of n) {
+			let n = yield* v({
+				bytes: t.bytes,
+				contentType: t.contentType,
+				tenantId: e.tenantId,
+				ownerId: e.ownerId,
+				visibility: e.visibility,
+				derivedFrom: e.id,
+				kind: t.kind,
+				...t.label === void 0 ? {} : { caption: t.label }
+			});
+			r.push(n);
+		}
+		return r;
+	}), S = (e, t, n) => b.gen(function* () {
+		if (e.visibility === "public" || (yield* et(e, t, {
+			...l,
+			...n?.password === void 0 ? {} : { password: n.password }
+		}))) return !0;
+		let r = yield* it(t, l);
+		return rt(yield* s.listByRef(e.id), t, r, n?.permission ?? "read", Date.now());
+	}), w = (e) => {
+		if (e.visibility === "public") {
+			let t = a.publicUrl?.(e.key);
+			if (t != null) return t;
+		}
+		return f(e.id);
+	};
+	return {
+		put: v,
+		get: (e, t) => _(e, t?.tenantId).pipe(b.flatMap((e) => a.get(e.key).pipe(b.retry(p), b.map((t) => ({
+			bytes: t.bytes,
+			ref: e
+		}))))),
+		getRange: (e, n, r) => _(e, r?.tenantId).pipe(b.flatMap((e) => {
+			let r = e.size, i = Math.max(0, Math.trunc(n.start));
+			if (r > 0 && i >= r) return b.fail(new t({
+				provider: a.name,
+				message: `range start ${i} past end ${r}`,
+				transient: !1,
+				status: 416
+			}));
+			let o = Math.min(Math.trunc(n.endInclusive), Math.max(0, r - 1));
+			return o < i ? b.fail(new t({
+				provider: a.name,
+				message: `empty range ${i}-${o}`,
+				transient: !1,
+				status: 416
+			})) : (a.getRange ? a.getRange(e.key, i, o).pipe(b.retry(p)) : a.get(e.key).pipe(b.retry(p), b.map((e) => e.bytes.subarray(i, o + 1)))).pipe(b.map((t) => ({
+				bytes: t,
+				ref: e,
+				totalSize: r
+			})));
+		})),
+		getUrl: (e, t) => _(e, t?.tenantId).pipe(b.flatMap((e) => e.visibility === "public" ? b.succeed(w(e)) : a.presigns ? a.getUrl(e.key, t?.expiresInSec ?? d) : b.succeed(f(e.id)))),
+		head: (e, t) => o.getById(e).pipe(b.flatMap((e) => e ? g(e, t?.tenantId).pipe(b.map((e) => e)) : b.succeed(null))),
+		delete: (e, t) => _(e, t?.tenantId).pipe(b.flatMap((t) => s.deleteByRef(e).pipe(b.flatMap(() => o.delete(e)), b.flatMap((e) => e ? o.countByKey(t.bucket, t.key).pipe(b.flatMap((e) => e === 0 ? a.delete(t.key).pipe(b.retry(p)) : b.void), b.flatMap(() => o.releaseUsage(t.tenantId, {
+			bytes: t.size,
+			count: 1
+		}))) : b.void), b.asVoid))),
+		mintUrl: (n, r, i) => b.gen(function* () {
+			let s = yield* o.getById(n).pipe(b.flatMap((e) => e ? b.succeed(e) : b.fail(new t({
+				provider: a.name,
+				message: `no ref '${n}'`,
+				transient: !1,
+				status: 404
+			}))));
+			if (s.visibility === "public") return w(s);
+			if (!(yield* S(s, r, i?.password === void 0 ? {} : { password: i.password }))) return yield* b.fail(new e({
+				refId: n,
+				reason: "access denied"
+			}));
+			let c = i?.expiresInSec ?? d;
+			if (a.presigns) return yield* a.getUrl(s.key, c);
+			let l = yield* b.sync(() => at(s.id, c));
+			return `${f(s.id)}?t=${l}`;
+		}),
+		mintUploadUrl: (e) => b.gen(function* () {
+			if (!a.getUploadUrl) return yield* b.fail(new t({
+				provider: a.name,
+				message: `provider '${a.name}' does not support presigned uploads`,
+				transient: !1,
+				status: 400
+			}));
+			let n = m(e.tenantId ?? null, "", e.key);
+			return yield* a.getUploadUrl(n, e.expiresInSec ?? d, e.contentType);
+		}),
+		checkAccess: S,
+		grant: (e) => b.gen(function* () {
+			let t = {
+				id: jt(),
+				refId: e.refId,
+				principalType: e.principalType,
+				principalId: e.principalId,
+				permission: e.permission ?? "read",
+				createdAt: /* @__PURE__ */ new Date(),
+				expiresAt: e.expiresAt ?? null,
+				createdBy: e.createdBy ?? null
+			};
+			return yield* s.insert(t), t;
+		}),
+		listRefs: (e) => b.suspend(() => {
+			let t = Math.min(500, Math.max(1, Math.trunc(e?.limit ?? 50))), n = Math.max(0, Math.trunc(e?.offset ?? 0)), r = {
+				tenantId: e && "tenantId" in e ? e.tenantId : void 0,
+				folder: e?.folder,
+				tags: e?.tags ?? [],
+				ownerId: e?.ownerId,
+				includeDerived: e?.includeDerived ?? !1,
+				limit: t + 1,
+				offset: n
+			};
+			return o.listRefs(r).pipe(b.map((e) => {
+				let r = e.length > t;
+				return {
+					refs: r ? e.slice(0, t) : e,
+					nextOffset: r ? n + t : null
+				};
+			}));
+		}),
+		revoke: (e) => s.delete(e),
+		listGrants: (e) => s.listByRef(e),
+		usage: (e) => o.usageByTenant(e),
+		sweepOrphans: (e) => b.gen(function* () {
+			let t = e?.limit ?? 1e3, n = e?.dryRun ?? !1, r = yield* o.listRecent(t), i = [];
+			for (let e of r) (yield* a.head(e.key).pipe(b.catchAll(() => b.succeed(null)))) === null && (n || (yield* o.delete(e.id).pipe(b.catchAll(() => b.succeed(!1)))) && (yield* o.releaseUsage(e.tenantId, {
+				bytes: e.size,
+				count: 1
+			}).pipe(b.ignore)), i.push(e.id));
+			return {
+				scanned: r.length,
+				removed: i
+			};
+		}),
+		ingestUrl: (e, n) => b.gen(function* () {
+			let r = yield* b.tryPromise({
+				try: () => fetch(e),
+				catch: (e) => new t({
+					provider: "ingest",
+					message: `fetch failed: ${String(e?.message ?? e)}`,
+					transient: !0
+				})
+			});
+			if (!r.ok) return yield* b.fail(new t({
+				provider: "ingest",
+				message: `fetch ${e} → ${r.status}`,
+				transient: r.status >= 500,
+				status: r.status
+			}));
+			let i = yield* b.tryPromise({
+				try: () => r.arrayBuffer(),
+				catch: (e) => new t({
+					provider: "ingest",
+					message: `read body failed: ${String(e?.message ?? e)}`,
+					transient: !0
+				})
+			}), a = n?.contentType ?? r.headers.get("content-type")?.split(";")[0]?.trim() ?? "application/octet-stream";
+			return yield* v({
+				bytes: new Uint8Array(i),
+				contentType: a,
+				...n?.tenantId === void 0 ? {} : { tenantId: n.tenantId },
+				...n?.ownerId === void 0 ? {} : { ownerId: n.ownerId },
+				...n?.visibility === void 0 ? {} : { visibility: n.visibility },
+				...n?.key === void 0 ? {} : { key: n.key },
+				...n?.folder === void 0 ? {} : { folder: n.folder },
+				...n?.tags === void 0 ? {} : { tags: n.tags },
+				...n?.alt === void 0 ? {} : { alt: n.alt },
+				...n?.caption === void 0 ? {} : { caption: n.caption }
+			});
+		}),
+		mintPresignedUpload: (e) => b.gen(function* () {
+			if (!a.getUploadUrl) return yield* b.fail(new t({
+				provider: a.name,
+				message: `provider '${a.name}' does not support presigned uploads`,
+				transient: !1,
+				status: 400
+			}));
+			let n = e.expiresInSec ?? d, r = `_incoming/${O({
+				kind: "typeid",
+				prefix: "up"
+			}, V)}`, i = m(e.tenantId ?? null, "", r);
+			return {
+				uploadUrl: yield* a.getUploadUrl(i, n, e.contentType),
+				key: i,
+				expiresInSec: n
+			};
+		}),
+		finalizeUpload: (e) => a.get(e.key).pipe(b.retry(p), b.flatMap((t) => v({
+			bytes: t.bytes,
+			contentType: e.contentType,
+			...e.tenantId === void 0 ? {} : { tenantId: e.tenantId },
+			...e.ownerId === void 0 ? {} : { ownerId: e.ownerId },
+			...e.visibility === void 0 ? {} : { visibility: e.visibility },
+			...e.folder === void 0 ? {} : { folder: e.folder },
+			...e.tags === void 0 ? {} : { tags: e.tags },
+			...e.alt === void 0 ? {} : { alt: e.alt },
+			...e.caption === void 0 ? {} : { caption: e.caption }
+		})), b.ensuring(a.delete(e.key).pipe(b.retry(p), b.ignore))),
+		putResumableChunk: (e) => a.put(h(e.tenantId ?? null, e.uploadId, e.index), e.bytes, { contentType: "application/octet-stream" }).pipe(b.retry(p), b.asVoid),
+		resumableStatus: (e) => b.gen(function* () {
+			let t = 0, n = 0;
+			for (; t < 1e6;) {
+				let r = yield* a.head(h(e.tenantId ?? null, e.uploadId, t)).pipe(b.retry(p), b.catchAll(() => b.succeed(null)));
+				if (r === null) break;
+				n += r.size, t += 1;
+			}
+			return {
+				offset: n,
+				nextIndex: t
+			};
+		}),
+		finalizeResumable: (e) => b.gen(function* () {
+			let t = [];
+			for (let n = 0; n < e.count; n++) {
+				let r = yield* a.get(h(e.tenantId ?? null, e.uploadId, n)).pipe(b.retry(p));
+				t.push(r.bytes);
+			}
+			let n = t.reduce((e, t) => e + t.byteLength, 0), r = new Uint8Array(n), i = 0;
+			for (let e of t) r.set(e, i), i += e.byteLength;
+			let o = b.forEach(Array.from({ length: e.count }, (e, t) => t), (t) => a.delete(h(e.tenantId ?? null, e.uploadId, t)).pipe(b.retry(p), b.ignore), { discard: !0 });
+			return yield* v({
+				bytes: r,
+				contentType: e.contentType,
+				...e.tenantId === void 0 ? {} : { tenantId: e.tenantId },
+				...e.ownerId === void 0 ? {} : { ownerId: e.ownerId },
+				...e.visibility === void 0 ? {} : { visibility: e.visibility },
+				...e.folder === void 0 ? {} : { folder: e.folder },
+				...e.tags === void 0 ? {} : { tags: e.tags },
+				...e.alt === void 0 ? {} : { alt: e.alt },
+				...e.caption === void 0 ? {} : { caption: e.caption }
+			}).pipe(b.ensuring(o));
+		}),
+		transcode: (e, t) => _(e, t?.tenantId).pipe(b.flatMap((e) => y(e))),
+		renditions: (e, t) => _(e, t?.tenantId).pipe(b.flatMap(() => o.listByDerivedFrom(e))),
+		beginMultipartUpload: (e) => b.gen(function* () {
+			if (!a.createMultipartUpload || !a.presignUploadPart || !a.completeMultipartUpload) return yield* b.fail(new t({
+				provider: a.name,
+				message: `provider '${a.name}' does not support multipart uploads`,
+				transient: !1,
+				status: 400
+			}));
+			let n = m(e.tenantId ?? null, "", `multipart/${O({
+				kind: "typeid",
+				prefix: "mp"
+			}, V)}`);
+			return {
+				uploadId: (yield* a.createMultipartUpload(n, e.contentType, { public: (e.visibility ?? "private") === "public" })).uploadId,
+				key: n
+			};
+		}),
+		signMultipartPart: (e) => b.suspend(() => a.presignUploadPart ? a.presignUploadPart(e.key, e.uploadId, e.partNumber, e.expiresInSec ?? d) : b.fail(new t({
+			provider: a.name,
+			message: "provider does not support multipart uploads",
+			transient: !1,
+			status: 400
+		}))),
+		completeMultipart: (e) => b.gen(function* () {
+			if (!a.completeMultipartUpload) return yield* b.fail(new t({
+				provider: a.name,
+				message: "provider does not support multipart uploads",
+				transient: !1,
+				status: 400
+			}));
+			let r = yield* a.completeMultipartUpload(e.key, e.uploadId, e.parts), s = yield* a.head(e.key).pipe(b.retry(p)), l = s?.size ?? 0, u = (r.etag ?? s?.etag ?? "").replace(/"/g, ""), d = e.tenantId ?? null, f = {
+				bytes: l,
+				count: 1
+			};
+			if (!(yield* o.consumeUsage(d, f, i.quota)).allowed) return yield* a.delete(e.key).pipe(b.retry(p), b.ignore), yield* b.fail(new n({
+				reason: "quota-exceeded",
+				detail: `multipart upload of ${l} bytes exceeds tenant quota`
+			}));
+			let m = {
+				id: At(),
+				tenantId: e.tenantId ?? null,
+				ownerId: e.ownerId ?? null,
+				bucket: c,
+				key: e.key,
+				contentType: e.contentType,
+				size: l,
+				checksum: u,
+				visibility: e.visibility ?? "private",
+				accessPolicy: null,
+				passwordHash: null,
+				createdAt: /* @__PURE__ */ new Date(),
+				...e.folder === void 0 ? {} : { folder: e.folder },
+				...e.tags === void 0 ? {} : { tags: e.tags },
+				...e.alt === void 0 ? {} : { alt: e.alt },
+				...e.caption === void 0 ? {} : { caption: e.caption }
+			};
+			return yield* o.insert(m).pipe(b.onExit((e) => x.isSuccess(e) ? b.void : o.releaseUsage(d, f).pipe(b.ignore))), m;
+		}),
+		abortMultipart: (e) => b.suspend(() => a.abortMultipartUpload ? a.abortMultipartUpload(e.key, e.uploadId).pipe(b.retry(p)) : b.void)
+	};
+}, Nt = (e) => S.succeed(i, Mt(e)), Pt = (e, t = 64 * 1024) => {
+	let n = [Buffer.from("zINSTREAM\0", "utf8")];
+	for (let r = 0; r < e.length; r += t) {
+		let i = e.subarray(r, Math.min(r + t, e.length)), a = Buffer.alloc(4);
+		a.writeUInt32BE(i.length, 0), n.push(a, Buffer.from(i));
+	}
+	let r = Buffer.alloc(4);
+	return r.writeUInt32BE(0, 0), n.push(r), Buffer.concat(n);
+}, Ft = (e) => {
+	let t = e.replace(/\0+$/, "").trim();
+	if (/\bOK$/.test(t)) return { clean: !0 };
+	let n = /:\s*(.+?)\s+FOUND$/.exec(t);
+	if (n) return {
+		clean: !1,
+		threat: n[1] ?? "unknown"
+	};
+	throw Error(`clamav: unexpected response: ${t}`);
+}, It = async (e, t) => {
+	let n = await import("node:net"), r = W.read("CLAMAV_HOST", t.host) ?? "127.0.0.1", i = W.read("CLAMAV_PORT"), a = t.port ?? (i ? Number(i) : 3310), o = t.timeoutMs ?? 3e4;
+	return new Promise((i, s) => {
+		let c = n.createConnection({
+			host: r,
+			port: a
+		}), l = "", u = setTimeout(() => {
+			c.destroy(), s(/* @__PURE__ */ Error("clamav scan timed out"));
+		}, o);
+		c.on("error", (e) => {
+			clearTimeout(u), s(e);
+		}), c.on("connect", () => {
+			c.end(Pt(e, t.chunkSize));
+		}), c.on("data", (e) => {
+			l += e.toString("utf8");
+		}), c.on("close", () => {
+			clearTimeout(u);
+			try {
+				i(Ft(l));
+			} catch (e) {
+				s(e);
+			}
+		});
+	});
+}, Lt = (e = {}) => (t) => It(t.bytes, e), Rt = (e, t, n) => new Promise((r, i) => {
+	let a = fe(e, [...t], { stdio: [
+		"ignore",
+		"ignore",
+		"pipe"
+	] }), o = "", s = setTimeout(() => {
+		a.kill("SIGKILL"), i(/* @__PURE__ */ Error("ffmpeg timed out"));
+	}, n);
+	a.stderr?.on("data", (e) => {
+		o += String(e);
+	}), a.on("error", (e) => {
+		clearTimeout(s), i(e);
+	}), a.on("close", (e) => {
+		clearTimeout(s), e === 0 ? r() : i(/* @__PURE__ */ Error(`ffmpeg exited ${String(e)}: ${o.slice(-400)}`));
+	});
+}), zt = (e) => async ({ bytes: t }) => {
+	let n = e.ffmpegPath ?? "ffmpeg", r = e.timeoutMs ?? 5 * 6e4, i = await pe(B(he(), "voltro-tc-")), a = B(i, "in"), o = [];
+	try {
+		await z(a, t);
+		for (let t of e.renditions) {
+			let e = B(i, `out.${t.ext}`);
+			try {
+				await Rt(n, [
+					"-y",
+					"-i",
+					a,
+					...t.args,
+					e
+				], r);
+				let i = await me(e);
+				o.push({
+					bytes: new Uint8Array(i),
+					contentType: t.contentType,
+					kind: t.kind,
+					...t.label === void 0 ? {} : { label: t.label }
+				}), await R(e, { force: !0 });
+			} catch {}
+		}
+	} finally {
+		await R(i, {
+			recursive: !0,
+			force: !0
+		}).catch(() => void 0);
+	}
+	return o;
+};
+//#endregion
+//#region src/assetRef.ts
+function Bt(e = {}) {
+	let t = e.nullable ?? !0, n = e.fk === !1 ? N() : ce(() => Ee, { onDelete: e.onDelete ?? "setNull" });
+	return t ? n.nullable() : n;
+}
+var Vt = () => se({
+	id: "@voltro/plugin-storage/withStorage",
+	fields: { asset: Bt() }
+}), Ht = {
+	"image/png": "png",
+	"image/jpeg": "jpg",
+	"image/jpg": "jpg",
+	"image/gif": "gif",
+	"image/webp": "webp",
+	"image/svg+xml": "svg"
+}, Ut = (e) => {
+	let t = /^data:([^;,]+)(;base64)?,(.*)$/s.exec(e);
+	if (!t) throw Error("not a data URI");
+	let n = t[1] || "application/octet-stream", r = !!t[2], i = t[3] ?? "";
+	return {
+		bytes: r ? new Uint8Array(Buffer.from(i, "base64")) : new Uint8Array(Buffer.from(decodeURIComponent(i), "utf8")),
+		contentType: n
+	};
+}, Wt = (e, n) => b.gen(function* () {
+	let r = yield* b.try({
+		try: () => Ut(n.dataUri),
+		catch: (e) => new t({
+			provider: "avatar",
+			message: String(e?.message ?? e),
+			transient: !1,
+			status: 400
+		})
+	}), i = Ht[r.contentType] ?? "bin";
+	return yield* e.put({
+		bytes: r.bytes,
+		contentType: r.contentType,
+		tenantId: n.tenantId,
+		ownerId: n.userId,
+		visibility: "public",
+		key: `avatars/${n.userId}/avatar.${i}`
+	});
+}), Gt = W.read("VOLTRO_SESSION_COOKIE") ?? "voltro:session", Kt = (e) => {
+	if (e.provider && typeof e.provider == "object") return e.provider;
+	let t = (e.provider ?? W.read("STORAGE_PROVIDER") ?? "memory").toLowerCase(), n = W.read("S3_BUCKET", e.bucket) ?? W.read("STORAGE_BUCKET") ?? "voltro";
+	switch (t) {
+		case "s3":
+		case "minio": {
+			let r = W.read("S3_REGION", e.region) ?? W.read("AWS_REGION"), i = W.read("S3_ENDPOINT", e.endpoint) ?? W.read("MINIO_ENDPOINT"), a = W.read("S3_ACCESS_KEY_ID", e.accessKeyId) ?? W.read("AWS_ACCESS_KEY_ID"), o = W.read("S3_SECRET_ACCESS_KEY", e.secretAccessKey) ?? W.read("AWS_SECRET_ACCESS_KEY"), s = W.read("STORAGE_CDN_URL", e.cdnBaseUrl);
+			return Fe({
+				bucket: n,
+				name: t,
+				...r ? { region: r } : {},
+				...i ? { endpoint: i } : {},
+				...a ? { accessKeyId: a } : {},
+				...o ? { secretAccessKey: o } : {},
+				...s ? { cdnBaseUrl: s } : {},
+				...e.publicAcl === void 0 ? {} : { publicAcl: e.publicAcl },
+				...t === "minio" || W.read("S3_FORCE_PATH_STYLE") === "1" ? { forcePathStyle: !0 } : {}
+			});
+		}
+		case "azure": {
+			let t = W.read("AZURE_STORAGE_ACCOUNT", e.accountName), r = W.read("AZURE_STORAGE_KEY", e.accountKey), i = W.read("AZURE_STORAGE_CONNECTION_STRING", e.connectionString), a = W.read("AZURE_STORAGE_ENDPOINT", e.endpoint), o = W.read("STORAGE_CDN_URL", e.cdnBaseUrl);
+			return Re({
+				container: W.read("AZURE_STORAGE_CONTAINER", e.bucket) ?? n,
+				...t ? { accountName: t } : {},
+				...r ? { accountKey: r } : {},
+				...i ? { connectionString: i } : {},
+				...a ? { endpoint: a } : {},
+				...o ? { cdnBaseUrl: o } : {}
+			});
+		}
+		case "database": return Le();
+		case "filesystem": return Pe({ root: W.read("STORAGE_ROOT", e.root) ?? ".voltro-storage" });
+		default: return Ne(e.name ?? "default");
+	}
+}, qt = (e) => {
+	if (e !== void 0) return e;
+	let t = W.read("STORAGE_ALLOWED_ORIGINS");
+	return t ? t.trim() === "*" ? "*" : t.split(",").map((e) => e.trim()).filter(Boolean) : [];
+}, Jt = (e, t) => {
+	if (!e || t !== "*" && !t.includes(e)) return {};
+	let n = {
+		"access-control-allow-origin": t === "*" ? "*" : e,
+		"access-control-allow-methods": "GET, POST, OPTIONS",
+		"access-control-allow-headers": "authorization, content-type, range, x-visibility, x-key, x-filename",
+		"access-control-expose-headers": "content-type, content-length, content-range, accept-ranges, location",
+		vary: "Origin"
+	};
+	return t !== "*" && (n["access-control-allow-credentials"] = "true"), n;
+}, Yt = (e) => ({
+	id: e.id,
+	tenantId: e.tenantId,
+	ownerId: e.ownerId,
+	bucket: e.bucket,
+	key: e.key,
+	contentType: e.contentType,
+	size: e.size,
+	checksum: e.checksum,
+	visibility: e.visibility,
+	accessPolicy: e.accessPolicy ?? null,
+	hasPassword: !!e.passwordHash,
+	createdAt: e.createdAt.toISOString(),
+	width: e.width ?? null,
+	height: e.height ?? null,
+	duration: e.duration ?? null,
+	placeholder: e.placeholder ?? null,
+	folder: e.folder ?? null,
+	tags: e.tags ?? null,
+	alt: e.alt ?? null,
+	caption: e.caption ?? null,
+	derivedFrom: e.derivedFrom ?? null,
+	kind: e.kind ?? null
+}), Xt = (e) => ({
+	id: e.id,
+	refId: e.refId,
+	principalType: e.principalType,
+	principalId: e.principalId,
+	permission: e.permission,
+	createdAt: e.createdAt.toISOString(),
+	expiresAt: e.expiresAt ? e.expiresAt.toISOString() : null,
+	createdBy: e.createdBy
+}), Zt = (i = {}) => {
+	let y = Kt(i), x = W.read("S3_BUCKET", i.bucket) ?? W.read("STORAGE_BUCKET") ?? "voltro", S = W.read("VOLTRO_PUBLIC_URL", i.publicBaseUrl), C = qt(i.allowedOrigins), w = i.limits?.maxBytes, E = 5 * 1024 * 1024, oe = 6 * 3600, D = i.refStore === void 0 || i.refStore === "memory", O = i.grantStore === void 0 || i.grantStore === "memory", k = { current: D ? wt() : i.refStore }, A = { current: O ? Dt() : i.grantStore }, j = {
+		insert: (e) => k.current.insert(e),
+		getById: (e) => k.current.getById(e),
+		delete: (e) => k.current.delete(e),
+		listRecent: (e) => k.current.listRecent(e),
+		countByKey: (e, t) => k.current.countByKey(e, t),
+		usageByTenant: (e) => k.current.usageByTenant(e),
+		consumeUsage: (e, t, n) => k.current.consumeUsage(e, t, n),
+		releaseUsage: (e, t) => k.current.releaseUsage(e, t),
+		listByDerivedFrom: (e) => k.current.listByDerivedFrom(e),
+		listRefs: (e) => k.current.listRefs(e)
+	}, se = {
+		insert: (e) => A.current.insert(e),
+		delete: (e) => A.current.delete(e),
+		listByRef: (e) => A.current.listByRef(e),
+		deleteByRef: (e) => A.current.deleteByRef(e)
+	}, ce = {
+		provider: y,
+		refStore: j,
+		grantStore: se,
+		bucket: x,
+		...i.tenantPrefix === void 0 ? {} : { tenantPrefix: i.tenantPrefix },
+		...i.attempts === void 0 ? {} : { attempts: i.attempts },
+		...i.urlExpiresInSec === void 0 ? {} : { urlExpiresInSec: i.urlExpiresInSec },
+		...i.access === void 0 ? {} : { access: i.access },
+		...i.limits === void 0 ? {} : { limits: i.limits },
+		...i.scan === void 0 ? {} : { scan: i.scan },
+		...i.videoProbe === void 0 ? {} : { videoProbe: i.videoProbe },
+		...i.transcode === void 0 ? {} : { transcode: i.transcode },
+		...i.autoTranscode === void 0 ? {} : { autoTranscode: i.autoTranscode },
+		...S ? { publicBaseUrl: S } : {},
+		...i.normalizeImages === void 0 ? {} : { normalizeImages: i.normalizeImages },
+		...i.quota === void 0 ? {} : { quota: i.quota }
+	}, M = Nt(ce), N = Mt(ce), P = (e) => b.runPromise(e.pipe(b.catchAll(() => b.succeed(null)))), le = (e, t) => {
+		if (!e) return "invalid";
+		let n = /^bytes=(\d*)-(\d*)$/.exec(e.trim());
+		if (!n) return "invalid";
+		let r = n[1] ?? "", i = n[2] ?? "";
+		if (r === "" && i === "") return "invalid";
+		if (r === "") {
+			let e = Number(i);
+			return !Number.isFinite(e) || e <= 0 ? "invalid" : t === 0 ? "unsatisfiable" : {
+				start: Math.max(0, t - e),
+				endInclusive: t - 1
+			};
+		}
+		let a = Number(r);
+		if (!Number.isFinite(a)) return "invalid";
+		if (t > 0 && a >= t) return "unsatisfiable";
+		let o = i === "" ? Math.max(0, t - 1) : Math.min(Number(i), Math.max(0, t - 1));
+		return !Number.isFinite(o) || o < a ? "invalid" : {
+			start: a,
+			endInclusive: o
+		};
+	}, F = /^(?:image\/(?!svg)|video\/|audio\/|application\/pdf(?:;|$)|text\/plain(?:;|$))/i, I = (e) => ({
+		"x-content-type-options": "nosniff",
+		"content-disposition": F.test(e) ? "inline" : "attachment"
+	}), de = async (e, t, n, r) => {
+		if (n) {
+			let r = await P(N.get(e.id));
+			if (!r) return {
+				status: 404,
+				body: "not found",
+				contentType: "text/plain"
+			};
+			let i = await Ge(e.id, r.bytes, e.contentType, n).catch(() => null), a = i ? i.bytes : r.bytes, o = i ? i.contentType : e.contentType;
+			return {
+				status: 200,
+				body: a,
+				contentType: o,
+				headers: {
+					...I(o),
+					"cache-control": t,
+					"accept-ranges": "none"
+				}
+			};
+		}
+		let i = r === void 0 ? "invalid" : le(r, e.size);
+		if (i === "unsatisfiable") return {
+			status: 416,
+			body: "range not satisfiable",
+			contentType: "text/plain",
+			headers: {
+				"content-range": `bytes */${e.size}`,
+				"accept-ranges": "bytes"
+			}
+		};
+		if (i !== "invalid") {
+			let n = await P(N.getRange(e.id, i));
+			return n ? {
+				status: 206,
+				body: n.bytes,
+				contentType: e.contentType,
+				headers: {
+					...I(e.contentType),
+					"cache-control": t,
+					"accept-ranges": "bytes",
+					"content-range": `bytes ${i.start}-${i.endInclusive}/${n.totalSize}`
+				}
+			} : {
+				status: 404,
+				body: "not found",
+				contentType: "text/plain"
+			};
+		}
+		let a = await P(N.get(e.id));
+		return a ? {
+			status: 200,
+			body: a.bytes,
+			contentType: e.contentType,
+			headers: {
+				...I(e.contentType),
+				"cache-control": t,
+				"accept-ranges": "bytes"
+			}
+		} : {
+			status: 404,
+			body: "not found",
+			contentType: "text/plain"
+		};
+	}, L = async (e) => {
+		let t = e.path.startsWith("/_voltro/storage/") ? e.path.slice(17).split("/")[0] ?? "" : "";
+		if (!t) return {
+			status: 404,
+			body: "not found",
+			contentType: "text/plain"
+		};
+		let n = await P(N.head(t));
+		if (!n) return {
+			status: 404,
+			body: "not found",
+			contentType: "text/plain"
+		};
+		let r = Be(e.query), i = e.headers.range;
+		if (n.visibility === "public") {
+			let e = y.publicUrl?.(n.key) ?? null;
+			return e && !r ? {
+				status: 302,
+				headers: {
+					location: e,
+					"cache-control": "public, max-age=300"
+				}
+			} : de(n, "public, max-age=31536000, immutable", r, i);
+		}
+		let a = !1, o = e.query ? new URLSearchParams(e.query).get("t") : null;
+		if (o) {
+			let e = ot(o);
+			a = !!e && e.refId === t;
+		}
+		if (!a) {
+			let t = T(e.headers.cookie, Gt), r = t ? ae(t, ie()) : null;
+			r && (a = await P(N.checkAccess(n, r)) === !0);
+		}
+		if (!a) return {
+			status: 403,
+			body: "forbidden",
+			contentType: "text/plain"
+		};
+		if (y.presigns && !r) {
+			let e = await P(y.getUrl(n.key, 300));
+			if (e && /^https?:/.test(e)) return {
+				status: 302,
+				headers: {
+					location: e,
+					"cache-control": "private, max-age=60"
+				}
+			};
+		}
+		return de(n, "private, no-store", r, i);
+	}, fe = {
+		method: "GET",
+		path: "/_voltro/storage",
+		handle: async (e) => {
+			let t = await L(e), n = Jt(e.headers.origin, C);
+			return Object.keys(n).length === 0 ? t : {
+				...t,
+				headers: {
+					...t.headers,
+					...n
+				}
+			};
+		}
+	}, pe = {
+		method: "*",
+		path: "/_voltro/storage/upload",
+		handle: async (e) => {
+			let t = Jt(e.headers.origin, C);
+			if (e.method === "OPTIONS") return {
+				status: 204,
+				headers: t
+			};
+			if (e.method !== "POST") return {
+				status: 405,
+				body: "method not allowed",
+				contentType: "text/plain",
+				headers: t
+			};
+			let n = e.query ? new URLSearchParams(e.query).get("ticket") : null, r = n ? ct(n) : null;
+			if (!r) return {
+				status: 401,
+				body: "invalid or expired upload ticket",
+				contentType: "text/plain",
+				headers: t
+			};
+			if (e.rawBody.length === 0) return {
+				status: 400,
+				body: "empty body",
+				contentType: "text/plain",
+				headers: t
+			};
+			if (r.max && e.rawBody.length > r.max) return {
+				status: 413,
+				body: "payload too large",
+				contentType: "text/plain",
+				headers: t
+			};
+			let i = await b.runPromise(N.put({
+				bytes: e.rawBody,
+				contentType: r.ct,
+				tenantId: r.tenant,
+				ownerId: r.sub,
+				visibility: r.vis,
+				...r.key === void 0 ? {} : { key: r.key },
+				...r.folder === void 0 ? {} : { folder: r.folder },
+				...r.tags === void 0 ? {} : { tags: r.tags },
+				...r.alt === void 0 ? {} : { alt: r.alt },
+				...r.caption === void 0 ? {} : { caption: r.caption }
+			}).pipe(b.flatMap((e) => N.getUrl(e.id).pipe(b.map((t) => ({
+				kind: "ok",
+				ref: e,
+				url: t
+			})))), b.catchTags({
+				StorageRejected: (e) => b.succeed({
+					kind: "rejected",
+					status: e.reason === "too-large" ? 413 : 415,
+					detail: e.detail
+				}),
+				StorageScanRejected: (e) => b.succeed({
+					kind: "scan",
+					threat: e.threat
+				}),
+				StorageError: (e) => b.succeed({
+					kind: "error",
+					message: e.message
+				})
+			})));
+			return i.kind === "ok" ? {
+				status: 201,
+				body: JSON.stringify({
+					id: i.ref.id,
+					url: i.url,
+					contentType: i.ref.contentType,
+					size: i.ref.size
+				}),
+				contentType: "application/json",
+				headers: t
+			} : i.kind === "rejected" ? {
+				status: i.status,
+				body: i.detail,
+				contentType: "text/plain",
+				headers: t
+			} : i.kind === "scan" ? {
+				status: 422,
+				body: `rejected: ${i.threat}`,
+				contentType: "text/plain",
+				headers: t
+			} : {
+				status: 500,
+				body: i.message,
+				contentType: "text/plain",
+				headers: t
+			};
+		}
+	}, me = {
+		method: "*",
+		path: "/_voltro/storage/upload/resumable",
+		handle: async (e) => {
+			let t = Jt(e.headers.origin, C);
+			if (e.method === "OPTIONS") return {
+				status: 204,
+				headers: t
+			};
+			let n = new URLSearchParams(e.query || ""), r = ft(n.get("token") ?? "");
+			if (!r) return {
+				status: 401,
+				body: "invalid or expired resumable token",
+				contentType: "text/plain",
+				headers: t
+			};
+			if (e.method === "GET" || e.method === "HEAD") {
+				let e = await b.runPromise(N.resumableStatus({
+					uploadId: r.id,
+					tenantId: r.tenant
+				}).pipe(b.match({
+					onFailure: (e) => ({ error: e.message }),
+					onSuccess: (e) => e
+				})));
+				return "error" in e ? {
+					status: 500,
+					body: e.error,
+					contentType: "text/plain",
+					headers: t
+				} : {
+					status: 200,
+					body: JSON.stringify(e),
+					contentType: "application/json",
+					headers: {
+						...t,
+						"upload-offset": String(e.offset)
+					}
+				};
+			}
+			if (e.method !== "POST") return {
+				status: 405,
+				body: "method not allowed",
+				contentType: "text/plain",
+				headers: t
+			};
+			let i = Number(n.get("index"));
+			if (!Number.isInteger(i) || i < 0) return {
+				status: 400,
+				body: "missing/invalid chunk index",
+				contentType: "text/plain",
+				headers: t
+			};
+			if (e.rawBody.length === 0) return {
+				status: 400,
+				body: "empty chunk",
+				contentType: "text/plain",
+				headers: t
+			};
+			let a = n.get("final") === "1", o = await b.runPromise(N.putResumableChunk({
+				uploadId: r.id,
+				tenantId: r.tenant,
+				index: i,
+				bytes: e.rawBody
+			}).pipe(b.flatMap(() => a ? N.finalizeResumable({
+				uploadId: r.id,
+				count: i + 1,
+				contentType: r.ct,
+				tenantId: r.tenant,
+				ownerId: r.sub,
+				visibility: r.vis,
+				...r.folder === void 0 ? {} : { folder: r.folder },
+				...r.tags === void 0 ? {} : { tags: r.tags },
+				...r.alt === void 0 ? {} : { alt: r.alt },
+				...r.caption === void 0 ? {} : { caption: r.caption }
+			}).pipe(b.flatMap((e) => N.getUrl(e.id).pipe(b.map((t) => ({
+				kind: "done",
+				ref: e,
+				url: t
+			}))))) : b.succeed({ kind: "chunk" })), b.catchTags({
+				StorageRejected: (e) => b.succeed({
+					kind: "rejected",
+					status: e.reason === "too-large" ? 413 : 415,
+					detail: e.detail
+				}),
+				StorageScanRejected: (e) => b.succeed({
+					kind: "scan",
+					threat: e.threat
+				}),
+				StorageError: (e) => b.succeed({
+					kind: "error",
+					message: e.message
+				})
+			})));
+			return o.kind === "chunk" ? {
+				status: 204,
+				headers: {
+					...t,
+					"upload-offset": String(i + 1)
+				}
+			} : o.kind === "done" ? {
+				status: 201,
+				body: JSON.stringify({
+					id: o.ref.id,
+					url: o.url,
+					contentType: o.ref.contentType,
+					size: o.ref.size
+				}),
+				contentType: "application/json",
+				headers: t
+			} : o.kind === "rejected" ? {
+				status: o.status,
+				body: o.detail,
+				contentType: "text/plain",
+				headers: t
+			} : o.kind === "scan" ? {
+				status: 422,
+				body: `rejected: ${o.threat}`,
+				contentType: "text/plain",
+				headers: t
+			} : {
+				status: 500,
+				body: o.message,
+				contentType: "text/plain",
+				headers: t
+			};
+		}
+	}, R = (e) => ({
+		kind: "json",
+		data: e
+	}), z = (e, t) => ({
+		kind: "json",
+		status: e,
+		data: { error: t }
+	}), he = (e, t) => {
+		try {
+			return new URL(e, "http://localhost").searchParams.get(t);
+		} catch {
+			return null;
+		}
+	}, B = [
+		{
+			method: "GET",
+			path: "/refs",
+			description: "Recent storage refs (newest first)",
+			handler: () => j.listRecent(100).pipe(b.map((e) => R({ refs: e.map(Yt) })), b.catchAll((e) => b.succeed(z(500, e.message))))
+		},
+		{
+			method: "GET",
+			path: "/stats",
+			description: "Object count + total bytes per tenant + visibility split",
+			handler: () => j.listRecent(1e4).pipe(b.map((e) => {
+				let t = {}, n = 0, r = 0;
+				for (let i of e) {
+					let e = i.tenantId ?? "(global)", a = t[e] ?? {
+						count: 0,
+						bytes: 0
+					};
+					a.count++, a.bytes += i.size, t[e] = a, i.visibility === "public" ? n++ : r++;
+				}
+				return R({
+					provider: y.name,
+					bucket: x,
+					byTenant: t,
+					visibility: {
+						public: n,
+						private: r
+					}
+				});
+			}), b.catchAll((e) => b.succeed(z(500, e.message))))
+		},
+		{
+			method: "GET",
+			path: "/grants",
+			description: "Grants for a ref (?refId=…)",
+			handler: (e) => {
+				let t = he(e.url, "refId");
+				return t ? se.listByRef(t).pipe(b.map((e) => R({ grants: e.map(Xt) })), b.catchAll((e) => b.succeed(z(500, e.message)))) : b.succeed(z(400, "refId query param required"));
+			}
+		},
+		{
+			method: "POST",
+			path: "/share",
+			description: "Grant a principal access to a ref",
+			handler: (e) => b.gen(function* () {
+				let n = yield* b.try({
+					try: () => JSON.parse(e.body || "{}"),
+					catch: () => new t({
+						provider: "inspect",
+						message: "invalid JSON body",
+						transient: !1,
+						status: 400
+					})
+				});
+				if (!n.refId || !n.principalType || !n.principalId) return z(400, "refId, principalType, principalId required");
+				let r = n.expiresInDays ? new Date(Date.now() + n.expiresInDays * 864e5) : null, i = yield* N.grant({
+					refId: n.refId,
+					principalType: n.principalType,
+					principalId: n.principalId,
+					...n.permission ? { permission: n.permission } : {},
+					expiresAt: r
+				});
+				return R({ grant: Xt(i) });
+			}).pipe(b.catchAll((e) => b.succeed(z(e.status ?? 500, e.message ?? "share failed"))))
+		},
+		{
+			method: "POST",
+			path: "/revoke",
+			description: "Revoke a grant by id",
+			handler: (e) => b.gen(function* () {
+				let n = yield* b.try({
+					try: () => JSON.parse(e.body || "{}"),
+					catch: () => new t({
+						provider: "inspect",
+						message: "invalid JSON body",
+						transient: !1,
+						status: 400
+					})
+				});
+				return n.grantId ? (yield* N.revoke(n.grantId), R({ ok: !0 })) : z(400, "grantId required");
+			}).pipe(b.catchAll((e) => b.succeed(z(e.status ?? 500, e.message ?? "revoke failed"))))
+		}
+	], ge = [
+		{
+			...g,
+			execute: (e, t) => {
+				let n = e;
+				return N.mintUrl(n.id, t.request.subject, {
+					...n.password === void 0 ? {} : { password: n.password },
+					...n.expiresInSec === void 0 ? {} : { expiresInSec: n.expiresInSec }
+				}).pipe(b.map((e) => ({ url: e })));
+			}
+		},
+		{
+			...h,
+			execute: (e, t) => {
+				let n = e;
+				return N.mintUploadUrl({
+					key: n.key,
+					contentType: n.contentType,
+					tenantId: t.request.subject.tenantId,
+					...n.expiresInSec === void 0 ? {} : { expiresInSec: n.expiresInSec }
+				}).pipe(b.map((e) => ({ url: e })));
+			}
+		},
+		{
+			...m,
+			execute: (e, t) => {
+				let n = e;
+				return b.sync(() => {
+					let e = n.expiresInSec ?? 900, r = st({
+						sub: t.request.subject.id,
+						tenant: t.request.subject.tenantId,
+						ct: n.contentType,
+						vis: n.visibility ?? "private",
+						...n.key === void 0 ? {} : { key: n.key },
+						...n.folder === void 0 ? {} : { folder: n.folder },
+						...n.tags === void 0 ? {} : { tags: n.tags },
+						...n.alt === void 0 ? {} : { alt: n.alt },
+						...n.caption === void 0 ? {} : { caption: n.caption },
+						...w === void 0 ? {} : { max: w }
+					}, e);
+					return {
+						uploadUrl: `${S ? S.replace(/\/+$/, "") : ""}/_voltro/storage/upload?ticket=${encodeURIComponent(r)}`,
+						expiresInSec: e
+					};
+				});
+			}
+		},
+		{
+			...p,
+			execute: (e, t) => {
+				let n = e;
+				return N.mintPresignedUpload({
+					contentType: n.contentType,
+					tenantId: t.request.subject.tenantId,
+					...n.expiresInSec === void 0 ? {} : { expiresInSec: n.expiresInSec }
+				}).pipe(b.map((e) => {
+					let r = lt({
+						key: e.key,
+						sub: t.request.subject.id,
+						tenant: t.request.subject.tenantId,
+						ct: n.contentType,
+						vis: n.visibility ?? "private",
+						...n.folder === void 0 ? {} : { folder: n.folder },
+						...n.tags === void 0 ? {} : { tags: n.tags },
+						...n.alt === void 0 ? {} : { alt: n.alt },
+						...n.caption === void 0 ? {} : { caption: n.caption },
+						...w === void 0 ? {} : { max: w }
+					}, e.expiresInSec);
+					return {
+						uploadUrl: e.uploadUrl,
+						finalizeToken: r,
+						expiresInSec: e.expiresInSec
+					};
+				}));
+			}
+		},
+		{
+			...l,
+			execute: (e, n) => {
+				let r = ut(e.finalizeToken);
+				return r ? r.sub !== null && r.sub !== n.request.subject.id ? b.fail(new t({
+					provider: "storage",
+					message: "finalize token belongs to another subject",
+					transient: !1,
+					status: 403
+				})) : N.finalizeUpload({
+					key: r.key,
+					contentType: r.ct,
+					tenantId: r.tenant,
+					ownerId: r.sub,
+					visibility: r.vis,
+					...r.folder === void 0 ? {} : { folder: r.folder },
+					...r.tags === void 0 ? {} : { tags: r.tags },
+					...r.alt === void 0 ? {} : { alt: r.alt },
+					...r.caption === void 0 ? {} : { caption: r.caption }
+				}).pipe(b.flatMap((e) => N.getUrl(e.id).pipe(b.map((t) => ({
+					id: e.id,
+					url: t,
+					contentType: e.contentType,
+					size: e.size,
+					...e.width == null ? {} : { width: e.width },
+					...e.height == null ? {} : { height: e.height }
+				}))))) : b.fail(new t({
+					provider: "storage",
+					message: "invalid or expired finalize token",
+					transient: !1,
+					status: 401
+				}));
+			}
+		},
+		{
+			...s,
+			execute: (e, t) => {
+				let n = e;
+				return b.sync(() => {
+					let e = n.expiresInSec ?? oe, r = ue(), i = n.chunkSize && n.chunkSize > 0 ? n.chunkSize : E;
+					return {
+						uploadId: r,
+						resumableToken: dt({
+							id: r,
+							sub: t.request.subject.id,
+							tenant: t.request.subject.tenantId,
+							ct: n.contentType,
+							vis: n.visibility ?? "private",
+							size: n.size,
+							...n.folder === void 0 ? {} : { folder: n.folder },
+							...n.tags === void 0 ? {} : { tags: n.tags },
+							...n.alt === void 0 ? {} : { alt: n.alt },
+							...n.caption === void 0 ? {} : { caption: n.caption },
+							...w === void 0 ? {} : { max: w }
+						}, e),
+						uploadUrl: `${S ? S.replace(/\/+$/, "") : ""}/_voltro/storage/upload/resumable`,
+						chunkSize: i,
+						expiresInSec: e
+					};
+				});
+			}
+		},
+		{
+			...o,
+			execute: (e, t) => {
+				let n = e, r = n.expiresInSec ?? oe;
+				return N.beginMultipartUpload({
+					contentType: n.contentType,
+					tenantId: t.request.subject.tenantId,
+					visibility: n.visibility ?? "private",
+					expiresInSec: r
+				}).pipe(b.map((e) => ({
+					multipartToken: pt({
+						key: e.key,
+						uploadId: e.uploadId,
+						sub: t.request.subject.id,
+						tenant: t.request.subject.tenantId,
+						ct: n.contentType,
+						vis: n.visibility ?? "private",
+						size: n.size,
+						...n.folder === void 0 ? {} : { folder: n.folder },
+						...n.tags === void 0 ? {} : { tags: n.tags },
+						...n.alt === void 0 ? {} : { alt: n.alt },
+						...n.caption === void 0 ? {} : { caption: n.caption }
+					}, r),
+					partSize: n.partSize && n.partSize >= E ? n.partSize : E,
+					expiresInSec: r
+				})));
+			}
+		},
+		{
+			...te,
+			execute: (e) => {
+				let n = e, r = mt(n.multipartToken);
+				return r ? !Number.isInteger(n.partNumber) || n.partNumber < 1 ? b.fail(new t({
+					provider: "storage",
+					message: "partNumber must be a positive integer",
+					transient: !1,
+					status: 400
+				})) : N.signMultipartPart({
+					key: r.key,
+					uploadId: r.uploadId,
+					partNumber: n.partNumber
+				}).pipe(b.map((e) => ({ url: e }))) : b.fail(new t({
+					provider: "storage",
+					message: "invalid or expired multipart token",
+					transient: !1,
+					status: 401
+				}));
+			}
+		},
+		{
+			...c,
+			execute: (e, n) => {
+				let r = e, i = mt(r.multipartToken);
+				return i ? i.sub !== null && i.sub !== n.request.subject.id ? b.fail(new t({
+					provider: "storage",
+					message: "multipart token belongs to another subject",
+					transient: !1,
+					status: 403
+				})) : N.completeMultipart({
+					key: i.key,
+					uploadId: i.uploadId,
+					parts: r.parts,
+					contentType: i.ct,
+					tenantId: i.tenant,
+					ownerId: i.sub,
+					visibility: i.vis,
+					...i.folder === void 0 ? {} : { folder: i.folder },
+					...i.tags === void 0 ? {} : { tags: i.tags },
+					...i.alt === void 0 ? {} : { alt: i.alt },
+					...i.caption === void 0 ? {} : { caption: i.caption }
+				}).pipe(b.flatMap((e) => N.getUrl(e.id).pipe(b.map((t) => ({
+					id: e.id,
+					url: t,
+					size: e.size
+				}))))) : b.fail(new t({
+					provider: "storage",
+					message: "invalid or expired multipart token",
+					transient: !1,
+					status: 401
+				}));
+			}
+		},
+		{
+			...a,
+			execute: (e) => {
+				let n = mt(e.multipartToken);
+				return n ? N.abortMultipart({
+					key: n.key,
+					uploadId: n.uploadId
+				}).pipe(b.as({ ok: !0 })) : b.fail(new t({
+					provider: "storage",
+					message: "invalid or expired multipart token",
+					transient: !1,
+					status: 401
+				}));
+			}
+		},
+		{
+			...ne,
+			execute: (e, t) => {
+				let n = e, r = new Uint8Array(Buffer.from(n.bytesBase64, "base64"));
+				return N.put({
+					bytes: r,
+					contentType: n.contentType,
+					tenantId: t.request.subject.tenantId,
+					ownerId: t.request.subject.id,
+					...n.visibility ? { visibility: n.visibility } : {},
+					...n.key ? { key: n.key } : {},
+					...n.password ? { password: n.password } : {}
+				}).pipe(b.flatMap((e) => N.getUrl(e.id).pipe(b.map((t) => ({
+					id: e.id,
+					url: t
+				})))));
+			}
+		},
+		{
+			...u,
+			execute: (e, t) => {
+				let n = e;
+				return N.ingestUrl(n.url, {
+					tenantId: t.request.subject.tenantId,
+					ownerId: t.request.subject.id,
+					...n.visibility ? { visibility: n.visibility } : {},
+					...n.folder === void 0 ? {} : { folder: n.folder },
+					...n.tags === void 0 ? {} : { tags: n.tags },
+					...n.alt === void 0 ? {} : { alt: n.alt },
+					...n.caption === void 0 ? {} : { caption: n.caption },
+					...n.key === void 0 ? {} : { key: n.key }
+				}).pipe(b.flatMap((e) => N.getUrl(e.id).pipe(b.map((t) => ({
+					id: e.id,
+					url: t
+				})))));
+			}
+		},
+		{
+			...ee,
+			execute: (e, t) => {
+				let n = e, r = n.expiresInDays ? new Date(Date.now() + n.expiresInDays * 864e5) : null;
+				return N.grant({
+					refId: n.refId,
+					principalType: n.principalType,
+					principalId: n.principalId,
+					...n.permission ? { permission: n.permission } : {},
+					expiresAt: r,
+					createdBy: t.request.subject.id
+				}).pipe(b.map((e) => ({ grantId: e.id })));
+			}
+		},
+		{
+			..._,
+			execute: (e) => {
+				let t = e;
+				return N.revoke(t.grantId).pipe(b.map(() => ({ ok: !0 })));
+			}
+		},
+		{
+			...d,
+			execute: (e) => {
+				let t = e;
+				return N.listGrants(t.refId).pipe(b.map((e) => ({ grants: e.map(Xt) })));
+			}
+		},
+		{
+			...f,
+			execute: (e, t) => {
+				let n = e;
+				return N.listRefs({
+					tenantId: t.request.subject.tenantId,
+					...n.folder === void 0 ? {} : { folder: n.folder },
+					...n.tags === void 0 ? {} : { tags: n.tags },
+					...n.ownerId === void 0 ? {} : { ownerId: n.ownerId },
+					...n.includeDerived === void 0 ? {} : { includeDerived: n.includeDerived },
+					...n.limit === void 0 ? {} : { limit: n.limit },
+					...n.offset === void 0 ? {} : { offset: n.offset }
+				}).pipe(b.map((e) => ({
+					refs: e.refs.map(Yt),
+					nextOffset: e.nextOffset
+				})));
+			}
+		}
+	];
+	return re({
+		name: i.name ? `@voltro/plugin-storage#${i.name}` : "@voltro/plugin-storage",
+		description: "File storage — StorageService over S3 / MinIO / filesystem / memory. Public objects served direct from bucket/CDN; private objects gated by an access policy + per-object grants. Checksums, tenant key-prefixing, _voltro_storage_refs + _voltro_storage_grants, retry.",
+		permissions: ["network:outbound:*", "inspect:read"],
+		declaredEnv: W.declared,
+		services: M,
+		inspectEndpoints: B,
+		httpRoutes: [
+			fe,
+			pe,
+			me
+		],
+		routes: ge,
+		rpcClientDescriptors: v,
+		errorSchemas: [
+			{
+				schema: t,
+				import: {
+					module: "@voltro/plugin-storage/errors",
+					name: "StorageError"
+				}
+			},
+			{
+				schema: e,
+				import: {
+					module: "@voltro/plugin-storage/errors",
+					name: "StorageAccessDenied"
+				}
+			},
+			{
+				schema: n,
+				import: {
+					module: "@voltro/plugin-storage/errors",
+					name: "StorageRejected"
+				}
+			},
+			{
+				schema: r,
+				import: {
+					module: "@voltro/plugin-storage/errors",
+					name: "StorageScanRejected"
+				}
+			}
+		],
+		bindDataStore: (e) => {
+			D && (k.current = Et(e)), O && (A.current = kt(e)), y.bindDataStore?.(e);
+		},
+		onActivate: (e) => b.sync(() => {
+			let t = !!S || !!W.read("STORAGE_CDN_URL", i.cdnBaseUrl);
+			e.logger.info(`storage: provider=${y.name} presign=${y.presigns ? "yes" : "no"} publicUrl=${t ? "yes" : "no"} transforms=yes`, {
+				provider: y.name,
+				bucket: x,
+				refStore: D ? "memory" : "custom"
+			}), y.name === "memory" && process.env.NODE_ENV !== "test" && e.logger.warn("storage: provider=memory — uploads are IN-MEMORY and LOST on restart. Set STORAGE_PROVIDER (filesystem / s3 / r2 / azure / gcs) for anything but throwaway dev. (Empty/placeholder storage env silently falls back to memory.)"), !t && !y.presigns && e.logger.warn("storage: no VOLTRO_PUBLIC_URL / STORAGE_CDN_URL and this provider can't presign — serve URLs are RELATIVE and will not resolve cross-origin (browser <img> / server-to-server AI fetches). Set VOLTRO_PUBLIC_URL to this api's absolute base URL.");
+		}),
+		onDeactivate: () => b.void
+	});
+};
+//#endregion
+export { U as STORAGE_BLOBS_TABLE, H as STORAGE_GRANTS_TABLE, V as STORAGE_REFS_TABLE, Te as STORAGE_USAGE_TABLE, e as StorageAccessDenied, t as StorageError, n as StorageRejected, r as StorageScanRejected, i as StorageService, ke as _voltroStorageBlobsTable, De as _voltroStorageGrantsTable, Ee as _voltroStorageRefsTable, Oe as _voltroStorageUsageTable, Bt as assetRef, Re as azureProvider, Mt as buildStorageService, ye as bytesToStream, vt as checkLimits, Lt as clamavScanner, Me as clearStorageBuffer, be as collectStream, ve as concatBytes, ht as contentTypeAllowed, kt as dataStoreGrantStore, Et as dataStoreRefStore, Le as databaseProvider, Ut as decodeDataUri, Pt as encodeInstream, zt as ffmpegTranscoder, Pe as filesystemProvider, xe as fromNodeReadable, Ce as getObjectStream, Ke as hashPassword, Dt as memoryGrantStore, Ne as memoryProvider, wt as memoryRefStore, Ft as parseClamavResponse, Be as parseTransformParams, Wt as putAvatar, we as putObjectStream, je as readStorageBuffer, St as refMatchesListQuery, Kt as resolveStorageProvider, Y as resolveStorageSecret, Fe as s3Provider, lt as signFinalizeTicket, at as signGrant, pt as signMultipartTicket, dt as signResumableTicket, st as signUploadTicket, _t as sniffMatches, Zt as storagePlugin, Nt as storageServiceLayer, Se as toNodeReadable, Ge as transformCached, Ue as transformImage, ut as verifyFinalizeTicket, ot as verifyGrant, mt as verifyMultipartTicket, qe as verifyPassword, ft as verifyResumableTicket, ct as verifyUploadTicket, Vt as withStorage };