@voltro/plugin-storage 0.33.0 → 0.35.0

package/dist/index.js

@@ -1,41 +1,41 @@
 import { StorageAccessDenied as e, StorageError as t, StorageRejected as n, StorageScanRejected as r, StorageService as i } from "./types.js";
 import { abortMultipartUploadDescriptor as a, beginMultipartUploadDescriptor as o, beginResumableUploadDescriptor as s, completeMultipartUploadDescriptor as c, finalizeUploadDescriptor as l, ingestUrlDescriptor as u, listGrantsDescriptor as d, listRefsDescriptor as f, mintPresignedUploadDescriptor as p, mintUploadTicketDescriptor as m, mintUploadUrlDescriptor as h, mintUrlDescriptor as g, revokeDescriptor as _, shareDescriptor as ee, signMultipartPartDescriptor as te, storageRpcClientImports as v, uploadDescriptor as ne } from "./rpc.js";
 import { Chunk as y, Effect as b, Exit as x, Layer as S, Schedule as C, Stream as w } from "effect";
-import { definePlugin as re } from "@voltro/protocol";
-import { readCookie as T, resolveSessionSecret as ie, verifySession as ae } from "@voltro/protocol/session";
-import { and as E, bytes as oe, eq as D, generateId as O, id as k, integer as A, json as j, mixin as se, reference as ce, table as M, text as N, timestamp as P } from "@voltro/database";
-import { pluginEnv as le } from "@voltro/env";
-import { createHmac as F, randomBytes as I, randomUUID as ue, scryptSync as de, timingSafeEqual as L } from "node:crypto";
-import { spawn as fe } from "node:child_process";
-import { mkdtemp as pe, readFile as me, rm as R, writeFile as z } from "node:fs/promises";
-import { tmpdir as he } from "node:os";
+import { definePlugin as re, pluginInstanceName as T } from "@voltro/protocol";
+import { readCookie as ie, resolveSessionSecret as ae, verifySession as oe } from "@voltro/protocol/session";
+import { and as E, bytes as se, eq as D, generateId as O, id as k, integer as A, json as j, mixin as ce, reference as le, table as M, text as N, timestamp as P } from "@voltro/database";
+import { pluginEnv as ue } from "@voltro/env";
+import { createHmac as F, randomBytes as I, randomUUID as de, scryptSync as fe, timingSafeEqual as L } from "node:crypto";
+import { spawn as pe } from "node:child_process";
+import { mkdtemp as me, readFile as he, rm as R, writeFile as z } from "node:fs/promises";
+import { tmpdir as ge } from "node:os";
 import { join as B } from "node:path";
 //#region src/streamBridge.ts
-var ge = 1 << 20, _e = (e, n, r = !1) => new t({
+var _e = 1 << 20, ve = (e, n, r = !1) => new t({
 	provider: e,
 	message: n,
 	transient: r
-}), ve = (e) => {
+}), ye = (e) => {
 	let t = 0;
 	for (let n of e) t += n.byteLength;
 	let n = new Uint8Array(t), r = 0;
 	for (let t of e) n.set(t, r), r += t.byteLength;
 	return n;
-}, ye = (e, t = ge) => {
+}, be = (e, t = _e) => {
 	let n = [];
 	for (let r = 0; r < e.byteLength; r += t) n.push(e.subarray(r, Math.min(r + t, e.byteLength)));
 	return w.fromIterable(n);
-}, be = (e) => e.pipe(w.runCollect, b.map((e) => ve(y.toReadonlyArray(e)))), xe = (e, t) => w.suspend(() => w.fromAsyncIterable(t(), (t) => _e(e, `read stream failed: ${String(t?.message ?? t)}`, !0))).pipe(w.map((e) => e instanceof Uint8Array ? e : new Uint8Array(e))), Se = async (e) => {
+}, xe = (e) => e.pipe(w.runCollect, b.map((e) => ye(y.toReadonlyArray(e)))), Se = (e, t) => w.suspend(() => w.fromAsyncIterable(t(), (t) => ve(e, `read stream failed: ${String(t?.message ?? t)}`, !0))).pipe(w.map((e) => e instanceof Uint8Array ? e : new Uint8Array(e))), Ce = async (e) => {
 	let { Readable: t } = await import("node:stream");
 	return t.fromWeb(w.toReadableStream(e));
-}, Ce = (e, t) => e.getStream ? e.getStream(t) : e.get(t).pipe(b.map((e) => ({
-	stream: ye(e.bytes),
+}, we = (e, t) => e.getStream ? e.getStream(t) : e.get(t).pipe(b.map((e) => ({
+	stream: be(e.bytes),
 	contentType: e.contentType,
 	size: e.bytes.byteLength
-}))), we = (e, t, n, r) => e.putStream ? e.putStream(t, n, r) : be(n).pipe(b.flatMap((n) => e.put(t, n, {
+}))), Te = (e, t, n, r) => e.putStream ? e.putStream(t, n, r) : xe(n).pipe(b.flatMap((n) => e.put(t, n, {
 	contentType: r.contentType,
 	...r.public === void 0 ? {} : { public: r.public }
-}))), V = "_voltro_storage_refs", H = "_voltro_storage_grants", U = "_voltro_storage_blobs", Te = "_voltro_storage_usage", Ee = M(V, {
+}))), V = "_voltro_storage_refs", H = "_voltro_storage_grants", U = "_voltro_storage_blobs", Ee = "_voltro_storage_usage", De = M(V, {
 	id: k({ prefix: "file" }),
 	tenantId: N().nullable(),
 	ownerId: N().nullable(),
@@ -58,7 +58,7 @@ var ge = 1 << 20, _e = (e, n, r = !1) => new t({
 	derivedFrom: N().nullable(),
 	kind: N().nullable(),
 	createdAt: P()
-}).index(["key"]).index(["tenantId"]).index(["ownerId"]).index(["folder"]).index(["derivedFrom"]), De = M(H, {
+}).index(["key"]).index(["tenantId"]).index(["ownerId"]).index(["folder"]).index(["derivedFrom"]), Oe = M(H, {
 	id: k({ prefix: "sgrant" }),
 	refId: N(),
 	principalType: N(),
@@ -67,19 +67,19 @@ var ge = 1 << 20, _e = (e, n, r = !1) => new t({
 	createdAt: P(),
 	expiresAt: P().nullable(),
 	createdBy: N().nullable()
-}).index(["refId"]).index(["principalId"]), Oe = M(Te, {
+}).index(["refId"]).index(["principalId"]), ke = M(Ee, {
 	id: k({ prefix: "susage" }),
 	tenantId: N().maxLength(191),
 	bytes: A().default(0),
 	count: A().default(0),
 	updatedAt: P()
-}).unique("byStorageUsageTenant", ["tenantId"]), ke = M(U, {
+}).unique("byStorageUsageTenant", ["tenantId"]), Ae = M(U, {
 	id: k({ prefix: "blob" }),
 	key: N(),
-	data: oe(),
+	data: se(),
 	contentType: N(),
 	size: A()
-}).index(["key"]), W = le([
+}).index(["key"]), W = ue([
 	{
 		name: "STORAGE_PROVIDER",
 		required: !1,
@@ -235,11 +235,11 @@ var ge = 1 << 20, _e = (e, n, r = !1) => new t({
 	message: n,
 	transient: r,
 	...i === void 0 ? {} : { status: i }
-}), K = (e) => e === void 0 || e === 408 || e === 429 || e >= 500, Ae = /* @__PURE__ */ new Map(), je = (e, t) => Ae.get(e)?.get(t)?.bytes, Me = (e) => {
-	Ae.get(e)?.clear();
-}, Ne = (e = "default") => {
-	let t = Ae.get(e) ?? /* @__PURE__ */ new Map();
-	return Ae.set(e, t), {
+}), K = (e) => e === void 0 || e === 408 || e === 429 || e >= 500, je = /* @__PURE__ */ new Map(), Me = (e, t) => je.get(e)?.get(t)?.bytes, Ne = (e) => {
+	je.get(e)?.clear();
+}, Pe = (e = "default") => {
+	let t = je.get(e) ?? /* @__PURE__ */ new Map();
+	return je.set(e, t), {
 		name: "memory",
 		presigns: !1,
 		put: (e, n, r) => b.sync(() => (t.set(e, {
@@ -263,7 +263,7 @@ var ge = 1 << 20, _e = (e, n, r = !1) => new t({
 			return n ? { size: n.bytes.byteLength } : null;
 		})
 	};
-}, Pe = (e) => {
+}, Fe = (e) => {
 	let t = e.root, n = async (e) => {
 		let { join: n, resolve: r, sep: i } = await import("node:path"), a = r(t), o = r(a, e);
 		if (o !== a && !o.startsWith(a + i)) throw Error(`key '${e}' escapes the storage root`);
@@ -313,7 +313,7 @@ var ge = 1 << 20, _e = (e, n, r = !1) => new t({
 		getStream: (e) => r(async () => {
 			let t = await import("node:fs/promises"), { createReadStream: r } = await import("node:fs"), i = await n(e), a = await t.stat(i);
 			return {
-				stream: xe("filesystem", () => r(i)),
+				stream: Se("filesystem", () => r(i)),
 				contentType: "application/octet-stream",
 				size: a.size
 			};
@@ -323,7 +323,7 @@ var ge = 1 << 20, _e = (e, n, r = !1) => new t({
 			await r.mkdir(i(c), { recursive: !0 });
 			let l = `${c}.tmp-${a()}`;
 			try {
-				await s(await Se(t), o(l));
+				await s(await Ce(t), o(l));
 				let e = await r.stat(l);
 				return await r.rename(l, c), { size: e.size };
 			} catch (e) {
@@ -338,10 +338,10 @@ var ge = 1 << 20, _e = (e, n, r = !1) => new t({
 					end: i
 				});
 				s.on("data", (e) => o.push(e)), s.on("end", () => e()), s.on("error", n);
-			}), ve(o);
+			}), ye(o);
 		}, e)
 	};
-}, Fe = (e) => {
+}, Ie = (e) => {
 	let t = e.name ?? "s3", n = e.publicAcl ?? !0, r = null, i = () => r || (r = (async () => {
 		let t, n;
 		try {
@@ -490,7 +490,7 @@ var ge = 1 << 20, _e = (e, n, r = !1) => new t({
 				Key: n
 			})), s = o.Body;
 			return {
-				stream: xe(t, () => s),
+				stream: Se(t, () => s),
 				contentType: o.ContentType ?? "application/octet-stream",
 				...o.ContentLength === void 0 ? {} : { size: o.ContentLength }
 			};
@@ -502,7 +502,7 @@ var ge = 1 << 20, _e = (e, n, r = !1) => new t({
 			} catch (e) {
 				throw Error("s3/minio `putStream` requires the '@aws-sdk/lib-storage' optional dependency (multipart upload). Install it to enable streamed uploads.", { cause: e });
 			}
-			let l = await Se(r);
+			let l = await Ce(r);
 			return await new c.Upload({
 				client: a,
 				params: {
@@ -526,7 +526,7 @@ var ge = 1 << 20, _e = (e, n, r = !1) => new t({
 			return o(c.Body);
 		})
 	};
-}, Ie = (e) => e instanceof Uint8Array ? e : typeof e == "string" ? new Uint8Array(Buffer.from(e, "base64")) : new Uint8Array(e), Le = () => {
+}, Le = (e) => e instanceof Uint8Array ? e : typeof e == "string" ? new Uint8Array(Buffer.from(e, "base64")) : new Uint8Array(e), Re = () => {
 	let e = null, t = () => {
 		if (!e) throw Error("the 'database' storage provider isn't bound to a DataStore yet");
 		return e;
@@ -569,7 +569,7 @@ var ge = 1 << 20, _e = (e, n, r = !1) => new t({
 			}), { size: i.byteLength };
 		}),
 		get: (e) => b.suspend(() => n(() => r(e)).pipe(b.flatMap((t) => t ? b.succeed({
-			bytes: Ie(t.data),
+			bytes: Le(t.data),
 			contentType: String(t.contentType)
 		}) : b.fail(G("database", `no object at key '${e}'`, !1, 404))))),
 		delete: (e) => n(async () => {
@@ -583,7 +583,7 @@ var ge = 1 << 20, _e = (e, n, r = !1) => new t({
 			return t ? { size: Number(t.size) } : null;
 		})
 	};
-}, Re = (e) => {
+}, ze = (e) => {
 	let t = null, n = () => t || (t = (async () => {
 		let t;
 		try {
@@ -665,13 +665,13 @@ var ge = 1 << 20, _e = (e, n, r = !1) => new t({
 		getStream: (e) => r(async () => {
 			let { container: t } = await n(), r = await t.getBlockBlobClient(e).download();
 			return {
-				stream: xe("azure", () => r.readableStreamBody),
+				stream: Se("azure", () => r.readableStreamBody),
 				contentType: r.contentType ?? "application/octet-stream",
 				...r.contentLength === void 0 ? {} : { size: r.contentLength }
 			};
 		}),
 		putStream: (e, t, i) => r(async () => {
-			let { container: r } = await n(), a = await Se(t);
+			let { container: r } = await n(), a = await Ce(t);
 			return await r.getBlockBlobClient(e).uploadStream(a, 4 * 1024 * 1024, 5, { blobHTTPHeaders: { blobContentType: i.contentType } }), { size: i.totalSize ?? (await r.getBlockBlobClient(e).getProperties()).contentLength ?? 0 };
 		}),
 		getRange: (e, t, a) => r(async () => {
@@ -679,13 +679,13 @@ var ge = 1 << 20, _e = (e, n, r = !1) => new t({
 			return i(o.readableStreamBody);
 		})
 	};
-}, ze = {
+}, Be = {
 	webp: "image/webp",
 	avif: "image/avif",
 	jpeg: "image/jpeg",
 	jpg: "image/jpeg",
 	png: "image/png"
-}, Be = (e) => {
+}, Ve = (e) => {
 	if (!e) return null;
 	let t = new URLSearchParams(e), n = (e) => {
 		let n = t.get(e);
@@ -700,7 +700,7 @@ var ge = 1 << 20, _e = (e, n, r = !1) => new t({
 		...a === void 0 ? {} : { q: a },
 		...s ? { fit: s } : {}
 	};
-}, Ve = (e) => e.startsWith("image/") && !e.includes("svg"), q, He = async () => {
+}, He = (e) => e.startsWith("image/") && !e.includes("svg"), q, Ue = async () => {
 	if (q !== void 0) return q;
 	try {
 		let e = await import("sharp");
@@ -709,9 +709,9 @@ var ge = 1 << 20, _e = (e, n, r = !1) => new t({
 		q = null;
 	}
 	return q;
-}, Ue = async (e, t, n) => {
-	if (!Ve(t)) return null;
-	let r = await He();
+}, We = async (e, t, n) => {
+	if (!He(t)) return null;
+	let r = await Ue();
 	if (!r) return null;
 	try {
 		let i = r(Buffer.from(e), { failOn: "none" });
@@ -721,10 +721,10 @@ var ge = 1 << 20, _e = (e, n, r = !1) => new t({
 			fit: n.fit ?? "cover",
 			withoutEnlargement: !0
 		}));
-		let a = n.format && ze[n.format] ? n.format : void 0, o = t;
+		let a = n.format && Be[n.format] ? n.format : void 0, o = t;
 		if (a) {
 			let e = a === "jpg" ? "jpeg" : a;
-			i = i.toFormat(e, n.q === void 0 ? {} : { quality: n.q }), o = ze[a];
+			i = i.toFormat(e, n.q === void 0 ? {} : { quality: n.q }), o = Be[a];
 		} else n.q !== void 0 && (t === "image/jpeg" || t === "image/webp") && (i = i.toFormat(t === "image/webp" ? "webp" : "jpeg", { quality: n.q }));
 		let s = await i.toBuffer();
 		return {
@@ -734,43 +734,43 @@ var ge = 1 << 20, _e = (e, n, r = !1) => new t({
 	} catch {
 		return null;
 	}
-}, We = 200, J = /* @__PURE__ */ new Map(), Ge = async (e, t, n, r) => {
+}, Ge = 200, J = /* @__PURE__ */ new Map(), Ke = async (e, t, n, r) => {
 	let i = `${e}::${JSON.stringify(r)}`, a = J.get(i);
 	if (a) return a;
-	let o = await Ue(t, n, r);
-	if (o && (J.set(i, o), J.size > We)) {
+	let o = await We(t, n, r);
+	if (o && (J.set(i, o), J.size > Ge)) {
 		let e = J.keys().next().value;
 		e !== void 0 && J.delete(e);
 	}
 	return o;
-}, Ke = (e) => {
+}, qe = (e) => {
 	let t = I(16).toString("hex");
-	return `${t}:${de(e, t, 32).toString("hex")}`;
-}, qe = (e, t) => {
+	return `${t}:${fe(e, t, 32).toString("hex")}`;
+}, Je = (e, t) => {
 	if (!e || !t) return !1;
 	let [n, r] = t.split(":");
 	if (!n || !r) return !1;
-	let i = Buffer.from(r, "hex"), a = de(e, n, i.length);
+	let i = Buffer.from(r, "hex"), a = fe(e, n, i.length);
 	return a.length === i.length && L(a, i);
-}, Je = (e) => Array.isArray(e) ? e.filter((e) => typeof e == "string") : [], Ye = (e) => Je(e.metadata?.roles), Xe = (e) => Je(e.scopes), Ze = (e, t) => e.some((e) => t.includes(e)), Qe = (e) => Je(e.metadata?.groups), $e = (e) => typeof e == "boolean" ? b.succeed(e) : b.isEffect(e) ? e : b.promise(() => e), et = (e, t, n = {}) => b.gen(function* () {
+}, Ye = (e) => Array.isArray(e) ? e.filter((e) => typeof e == "string") : [], Xe = (e) => Ye(e.metadata?.roles), Ze = (e) => Ye(e.scopes), Qe = (e, t) => e.some((e) => t.includes(e)), $e = (e) => Ye(e.metadata?.groups), et = (e) => typeof e == "boolean" ? b.succeed(e) : b.isEffect(e) ? e : b.promise(() => e), tt = (e, t, n = {}) => b.gen(function* () {
 	if (t.id && e.ownerId && t.id === e.ownerId) return !0;
 	let r = e.accessPolicy ?? [];
 	if (r.length === 0) return !1;
-	let i = n.resolveGroups ? yield* b.promise(async () => await n.resolveGroups(t)) : Qe(t);
-	for (let a of r) if (yield* tt(a, e, t, i, n)) return !0;
+	let i = n.resolveGroups ? yield* b.promise(async () => await n.resolveGroups(t)) : $e(t);
+	for (let a of r) if (yield* nt(a, e, t, i, n)) return !0;
 	return !1;
-}), tt = (e, t, n, r, i) => b.gen(function* () {
+}), nt = (e, t, n, r, i) => b.gen(function* () {
 	let a = !1, o = (e) => (a = !0, e);
-	if (e.owner !== void 0 && e.owner && !o(!!n.id && !!t.ownerId && n.id === t.ownerId) || e.tenant !== void 0 && e.tenant && !o(!!n.tenantId && n.tenantId === t.tenantId) || e.apiKey !== void 0 && e.apiKey && !o(n.type === "apiKey") || e.roles && e.roles.length > 0 && !o(Ze(Ye(n), e.roles)) || e.groups && e.groups.length > 0 && !o(Ze(r, e.groups)) || e.scopes && e.scopes.length > 0 && !o(Ze(Xe(n), e.scopes)) || e.password !== void 0 && e.password && !o(qe(i.password, t.passwordHash))) return !1;
+	if (e.owner !== void 0 && e.owner && !o(!!n.id && !!t.ownerId && n.id === t.ownerId) || e.tenant !== void 0 && e.tenant && !o(!!n.tenantId && n.tenantId === t.tenantId) || e.apiKey !== void 0 && e.apiKey && !o(n.type === "apiKey") || e.roles && e.roles.length > 0 && !o(Qe(Xe(n), e.roles)) || e.groups && e.groups.length > 0 && !o(Qe(r, e.groups)) || e.scopes && e.scopes.length > 0 && !o(Qe(Ze(n), e.scopes)) || e.password !== void 0 && e.password && !o(Je(i.password, t.passwordHash))) return !1;
 	if (e.guard) {
 		let r = i.guards?.[e.guard];
-		if (!o(r ? yield* $e(r({
+		if (!o(r ? yield* et(r({
 			subject: n,
 			ref: t
 		})) : !1)) return !1;
 	}
 	return a;
-}), nt = (e, t) => {
+}), rt = (e, t) => {
 	let n = [];
 	e.id && n.push({
 		type: e.type === "apiKey" ? "apiKey" : "user",
@@ -781,20 +781,20 @@ var ge = 1 << 20, _e = (e, n, r = !1) => new t({
 		id: e
 	});
 	return n;
-}, rt = (e, t, n, r, i) => {
-	let a = nt(t, n);
+}, it = (e, t, n, r, i) => {
+	let a = rt(t, n);
 	return e.some((e) => e.expiresAt && e.expiresAt.getTime() < i || r === "write" && e.permission !== "write" ? !1 : a.some((t) => t.type === e.principalType && t.id === e.principalId));
-}, it = (e, t) => t.resolveGroups ? b.promise(async () => await t.resolveGroups(e)) : b.succeed(Qe(e)), Y = () => W.read("VOLTRO_STORAGE_SECRET") ?? ie(), X = (e) => (typeof e == "string" ? Buffer.from(e, "utf8") : e).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, ""), Z = (e) => {
+}, at = (e, t) => t.resolveGroups ? b.promise(async () => await t.resolveGroups(e)) : b.succeed($e(e)), Y = () => W.read("VOLTRO_STORAGE_SECRET") ?? ae(), X = (e) => (typeof e == "string" ? Buffer.from(e, "utf8") : e).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, ""), Z = (e) => {
 	let t = e.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - e.length % 4) % 4);
 	return Buffer.from(t, "base64");
-}, at = (e, t, n = Y()) => {
+}, ot = (e, t, n = Y()) => {
 	if (!n) throw Error("signGrant: secret must be a non-empty string");
 	let r = {
 		refId: e,
 		exp: Math.floor(Date.now() / 1e3) + Math.floor(t)
 	}, i = X(JSON.stringify(r));
 	return `${i}.${X(F("sha256", n).update(i).digest())}`;
-}, ot = (e, t = Y()) => {
+}, st = (e, t = Y()) => {
 	if (!e || !t) return null;
 	let n = e.indexOf(".");
 	if (n <= 0 || n === e.length - 1) return null;
@@ -806,14 +806,14 @@ var ge = 1 << 20, _e = (e, n, r = !1) => new t({
 	} catch {
 		return null;
 	}
-}, st = (e, t, n = Y()) => {
+}, ct = (e, t, n = Y()) => {
 	if (!n) throw Error("signUploadTicket: secret must be a non-empty string");
 	let r = {
 		...e,
 		exp: Math.floor(Date.now() / 1e3) + Math.floor(t)
 	}, i = X(JSON.stringify(r));
 	return `${i}.${X(F("sha256", n).update(`u:${i}`).digest())}`;
-}, ct = (e, t = Y()) => {
+}, lt = (e, t = Y()) => {
 	if (!e || !t) return null;
 	let n = e.indexOf(".");
 	if (n <= 0 || n === e.length - 1) return null;
@@ -825,14 +825,14 @@ var ge = 1 << 20, _e = (e, n, r = !1) => new t({
 	} catch {
 		return null;
 	}
-}, lt = (e, t, n = Y()) => {
+}, ut = (e, t, n = Y()) => {
 	if (!n) throw Error("signFinalizeTicket: secret must be a non-empty string");
 	let r = {
 		...e,
 		exp: Math.floor(Date.now() / 1e3) + Math.floor(t)
 	}, i = X(JSON.stringify(r));
 	return `${i}.${X(F("sha256", n).update(`f:${i}`).digest())}`;
-}, ut = (e, t = Y()) => {
+}, dt = (e, t = Y()) => {
 	if (!e || !t) return null;
 	let n = e.indexOf(".");
 	if (n <= 0 || n === e.length - 1) return null;
@@ -844,14 +844,14 @@ var ge = 1 << 20, _e = (e, n, r = !1) => new t({
 	} catch {
 		return null;
 	}
-}, dt = (e, t, n = Y()) => {
+}, ft = (e, t, n = Y()) => {
 	if (!n) throw Error("signResumableTicket: secret must be a non-empty string");
 	let r = {
 		...e,
 		exp: Math.floor(Date.now() / 1e3) + Math.floor(t)
 	}, i = X(JSON.stringify(r));
 	return `${i}.${X(F("sha256", n).update(`r:${i}`).digest())}`;
-}, ft = (e, t = Y()) => {
+}, pt = (e, t = Y()) => {
 	if (!e || !t) return null;
 	let n = e.indexOf(".");
 	if (n <= 0 || n === e.length - 1) return null;
@@ -863,14 +863,14 @@ var ge = 1 << 20, _e = (e, n, r = !1) => new t({
 	} catch {
 		return null;
 	}
-}, pt = (e, t, n = Y()) => {
+}, mt = (e, t, n = Y()) => {
 	if (!n) throw Error("signMultipartTicket: secret must be a non-empty string");
 	let r = {
 		...e,
 		exp: Math.floor(Date.now() / 1e3) + Math.floor(t)
 	}, i = X(JSON.stringify(r));
 	return `${i}.${X(F("sha256", n).update(`m:${i}`).digest())}`;
-}, mt = (e, t = Y()) => {
+}, ht = (e, t = Y()) => {
 	if (!e || !t) return null;
 	let n = e.indexOf(".");
 	if (n <= 0 || n === e.length - 1) return null;
@@ -882,14 +882,14 @@ var ge = 1 << 20, _e = (e, n, r = !1) => new t({
 	} catch {
 		return null;
 	}
-}, ht = (e, t) => {
+}, gt = (e, t) => {
 	if (!t || t.length === 0) return !0;
 	let n = e.toLowerCase();
 	return t.some((e) => {
 		let t = e.toLowerCase();
 		return t.endsWith("/*") ? n.startsWith(t.slice(0, -1)) : n === t;
 	});
-}, gt = [
+}, _t = [
 	{
 		ct: /^image\/png$/,
 		offset: 0,
@@ -959,21 +959,21 @@ var ge = 1 << 20, _e = (e, n, r = !1) => new t({
 		offset: 0,
 		magic: [31, 139]
 	}
-], _t = (e, t) => {
-	let n = t.toLowerCase(), r = gt.find((e) => e.ct.test(n));
+], vt = (e, t) => {
+	let n = t.toLowerCase(), r = _t.find((e) => e.ct.test(n));
 	return r ? e.length < r.offset + r.magic.length ? !1 : r.magic.every((t, n) => e[r.offset + n] === t) : !0;
-}, vt = (e, t, n) => n ? n.maxBytes !== void 0 && e.byteLength > n.maxBytes ? {
+}, yt = (e, t, n) => n ? n.maxBytes !== void 0 && e.byteLength > n.maxBytes ? {
 	reason: "too-large",
 	detail: `${e.byteLength} bytes exceeds the ${n.maxBytes}-byte limit`
-} : ht(t, n.allowedContentTypes) ? n.sniff && !_t(e, t) ? {
+} : gt(t, n.allowedContentTypes) ? n.sniff && !vt(e, t) ? {
 	reason: "content-mismatch",
 	detail: `bytes do not match the declared content type '${t}'`
 } : null : {
 	reason: "content-type-not-allowed",
 	detail: `content type '${t}' is not in the allow-list`
-} : null, yt = async (e, t, n) => {
-	if (!Ve(t)) return { bytes: e };
-	let r = await He();
+} : null, bt = async (e, t, n) => {
+	if (!He(t)) return { bytes: e };
+	let r = await Ue();
 	if (!r) return { bytes: e };
 	try {
 		let t = e;
@@ -996,10 +996,10 @@ var ge = 1 << 20, _e = (e, n, r = !1) => new t({
 	} catch {
 		return { bytes: e };
 	}
-}, bt = async (e) => {
+}, xt = async (e) => {
 	let { createHash: t } = await import("node:crypto");
 	return t("sha256").update(e).digest("hex");
-}, xt = (e, t) => e ? `${e.replace(/\/+$/, "")}/_voltro/storage/${t}` : `/_voltro/storage/${t}`, St = (e, t) => {
+}, St = (e, t) => e ? `${e.replace(/\/+$/, "")}/_voltro/storage/${t}` : `/_voltro/storage/${t}`, Ct = (e, t) => {
 	if (t.tenantId !== void 0 && (e.tenantId ?? null) !== (t.tenantId ?? null) || t.ownerId !== void 0 && e.ownerId !== t.ownerId || !t.includeDerived && e.derivedFrom != null) return !1;
 	if (t.folder !== void 0) {
 		let n = t.folder.replace(/\/+$/, ""), r = (e.folder ?? "").replace(/\/+$/, "");
@@ -1010,7 +1010,7 @@ var ge = 1 << 20, _e = (e, n, r = !1) => new t({
 		if (!t.tags.every((e) => n.includes(e))) return !1;
 	}
 	return !0;
-}, Q = (e) => e ?? "global", Ct = () => {
+}, Q = (e) => e ?? "global", wt = () => {
 	let e = /* @__PURE__ */ new Map(), t = /* @__PURE__ */ new Map();
 	return {
 		insert: (t) => b.sync(() => {
@@ -1050,9 +1050,9 @@ var ge = 1 << 20, _e = (e, n, r = !1) => new t({
 			});
 		}),
 		listByDerivedFrom: (t) => b.sync(() => [...e.values()].filter((e) => (e.derivedFrom ?? null) === t)),
-		listRefs: (t) => b.sync(() => [...e.values()].filter((e) => St(e, t)).sort((e, t) => t.createdAt.getTime() - e.createdAt.getTime()).slice(t.offset, t.offset + t.limit))
+		listRefs: (t) => b.sync(() => [...e.values()].filter((e) => Ct(e, t)).sort((e, t) => t.createdAt.getTime() - e.createdAt.getTime()).slice(t.offset, t.offset + t.limit))
 	};
-}, wt = (e) => Array.isArray(e) && e.every((e) => typeof e == "string") ? e : null, Tt = (e) => ({
+}, Tt = (e) => Array.isArray(e) && e.every((e) => typeof e == "string") ? e : null, Et = (e) => ({
 	id: String(e.id),
 	tenantId: e.tenantId ?? null,
 	ownerId: e.ownerId ?? null,
@@ -1070,7 +1070,7 @@ var ge = 1 << 20, _e = (e, n, r = !1) => new t({
 	duration: e.duration ?? null,
 	placeholder: e.placeholder ?? null,
 	folder: e.folder ?? null,
-	tags: wt(e.tags),
+	tags: Tt(e.tags),
 	alt: e.alt ?? null,
 	caption: e.caption ?? null,
 	derivedFrom: e.derivedFrom ?? null,
@@ -1082,7 +1082,7 @@ var ge = 1 << 20, _e = (e, n, r = !1) => new t({
 		message: String(e?.message ?? e),
 		transient: !0
 	})
-}), Et = async (e, t) => (await e.query({
+}), Dt = async (e, t) => (await e.query({
 	table: "_voltro_storage_usage",
 	predicate: {
 		column: "tenantId",
@@ -1093,7 +1093,7 @@ var ge = 1 << 20, _e = (e, n, r = !1) => new t({
 	take: 1,
 	skip: void 0,
 	projection: void 0
-}))[0] ?? null, Dt = (e) => ({
+}))[0] ?? null, Ot = (e) => ({
 	insert: (t) => $(() => e.insert(V, { ...t })),
 	getById: (t) => $(async () => {
 		let n = await e.query({
@@ -1108,7 +1108,7 @@ var ge = 1 << 20, _e = (e, n, r = !1) => new t({
 			skip: void 0,
 			projection: void 0
 		});
-		return n[0] ? Tt(n[0]) : null;
+		return n[0] ? Et(n[0]) : null;
 	}),
 	delete: (t) => $(() => e.delete(V, t)),
 	listRecent: (t) => $(async () => (await e.query({
@@ -1121,7 +1121,7 @@ var ge = 1 << 20, _e = (e, n, r = !1) => new t({
 		take: t,
 		skip: void 0,
 		projection: void 0
-	})).map(Tt)),
+	})).map(Et)),
 	countByKey: (t, n) => $(async () => (await e.query({
 		table: V,
 		predicate: { and: [{
@@ -1161,7 +1161,7 @@ var ge = 1 << 20, _e = (e, n, r = !1) => new t({
 		let i = Q(t);
 		for (let t = 0; t < 32; t++) {
 			t > 0 && await new Promise((e) => setTimeout(e, t));
-			let a = await Et(e, i), o = a ? Number(a.bytes ?? 0) : 0, s = a ? Number(a.count ?? 0) : 0;
+			let a = await Dt(e, i), o = a ? Number(a.bytes ?? 0) : 0, s = a ? Number(a.count ?? 0) : 0;
 			if (!((r?.maxBytes === void 0 || o + n.bytes <= r.maxBytes) && (r?.maxCount === void 0 || s + n.count <= r.maxCount))) return {
 				allowed: !1,
 				bytes: o,
@@ -1181,7 +1181,7 @@ var ge = 1 << 20, _e = (e, n, r = !1) => new t({
 				let t = O({
 					kind: "typeid",
 					prefix: "susage"
-				}, Te), r = await e.insertIgnore(Te, {
+				}, Ee), r = await e.insertIgnore(Ee, {
 					id: t,
 					tenantId: i,
 					bytes: n.bytes,
@@ -1201,7 +1201,7 @@ var ge = 1 << 20, _e = (e, n, r = !1) => new t({
 		let r = Q(t);
 		for (let t = 0; t < 32; t++) {
 			t > 0 && await new Promise((e) => setTimeout(e, t));
-			let i = await Et(e, r);
+			let i = await Dt(e, r);
 			if (!i) return;
 			let a = Number(i.bytes ?? 0), o = Number(i.count ?? 0);
 			if (await e.updateMany("_voltro_storage_usage", {
@@ -1226,7 +1226,7 @@ var ge = 1 << 20, _e = (e, n, r = !1) => new t({
 		take: void 0,
 		skip: void 0,
 		projection: void 0
-	})).map(Tt)),
+	})).map(Et)),
 	listRefs: (t) => $(async () => {
 		let n = [];
 		t.tenantId !== void 0 && n.push({
@@ -1249,9 +1249,9 @@ var ge = 1 << 20, _e = (e, n, r = !1) => new t({
 			take: void 0,
 			skip: void 0,
 			projection: void 0
-		})).map(Tt).filter((e) => St(e, t)).slice(t.offset, t.offset + t.limit);
+		})).map(Et).filter((e) => Ct(e, t)).slice(t.offset, t.offset + t.limit);
 	})
-}), Ot = () => {
+}), kt = () => {
 	let e = /* @__PURE__ */ new Map();
 	return {
 		insert: (t) => b.sync(() => {
@@ -1266,7 +1266,7 @@ var ge = 1 << 20, _e = (e, n, r = !1) => new t({
 			for (let [n, r] of e) r.refId === t && e.delete(n);
 		})
 	};
-}, kt = (e) => ({
+}, At = (e) => ({
 	id: String(e.id),
 	refId: String(e.refId),
 	principalType: e.principalType,
@@ -1275,7 +1275,7 @@ var ge = 1 << 20, _e = (e, n, r = !1) => new t({
 	createdAt: e.createdAt instanceof Date ? e.createdAt : new Date(String(e.createdAt)),
 	expiresAt: e.expiresAt ? e.expiresAt instanceof Date ? e.expiresAt : new Date(String(e.expiresAt)) : null,
 	createdBy: e.createdBy ?? null
-}), At = (e) => ({
+}), jt = (e) => ({
 	insert: (t) => $(() => e.insert(H, { ...t })),
 	delete: (t) => $(() => e.delete(H, t)),
 	getById: (t) => $(async () => {
@@ -1291,7 +1291,7 @@ var ge = 1 << 20, _e = (e, n, r = !1) => new t({
 			skip: void 0,
 			projection: void 0
 		}))[0];
-		return n ? kt(n) : null;
+		return n ? At(n) : null;
 	}),
 	listByRef: (t) => $(async () => (await e.query({
 		table: H,
@@ -1307,7 +1307,7 @@ var ge = 1 << 20, _e = (e, n, r = !1) => new t({
 		take: void 0,
 		skip: void 0,
 		projection: void 0
-	})).map(kt)),
+	})).map(At)),
 	deleteByRef: (t) => $(async () => {
 		let n = await e.query({
 			table: H,
@@ -1323,14 +1323,14 @@ var ge = 1 << 20, _e = (e, n, r = !1) => new t({
 		});
 		for (let t of n) await e.delete(H, String(t.id));
 	})
-}), jt = () => O({
+}), Mt = () => O({
 	kind: "typeid",
 	prefix: "file"
-}, V), Mt = () => O({
+}, V), Nt = () => O({
 	kind: "typeid",
 	prefix: "grant"
-}, H), Nt = (i) => {
-	let { provider: a, refStore: o, grantStore: s, bucket: c } = i, l = i.access ?? {}, u = i.attempts ?? 3, d = i.urlExpiresInSec ?? 3600, f = (e) => xt(i.publicBaseUrl, e), p = C.recurs(Math.max(0, u - 1)).pipe(C.intersect(C.exponential("100 millis")), C.whileInput((e) => e.transient)), m = (e, t, n) => [
+}, H), Pt = (i) => {
+	let { provider: a, refStore: o, grantStore: s, bucket: c } = i, l = i.access ?? {}, u = i.attempts ?? 3, d = i.urlExpiresInSec ?? 3600, f = (e) => St(i.publicBaseUrl, e), p = C.recurs(Math.max(0, u - 1)).pipe(C.intersect(C.exponential("100 millis")), C.whileInput((e) => e.transient)), m = (e, t, n) => [
 		i.tenantPrefix,
 		e ?? "global",
 		n ?? t
@@ -1374,7 +1374,7 @@ var ge = 1 << 20, _e = (e, n, r = !1) => new t({
 			catch: () => null
 		}).pipe(b.catchAll(() => b.succeed(null)));
 	}), v = (e) => b.gen(function* () {
-		let t = vt(e.bytes, e.contentType, i.limits);
+		let t = yt(e.bytes, e.contentType, i.limits);
 		if (t) return yield* b.fail(new n(t));
 		if (i.scan) {
 			let t = yield* ee({
@@ -1384,10 +1384,10 @@ var ge = 1 << 20, _e = (e, n, r = !1) => new t({
 			});
 			if (!t.clean) return yield* b.fail(new r({ threat: t.threat ?? "unknown" }));
 		}
-		let s = yield* b.promise(() => yt(e.bytes, e.contentType, { normalize: i.normalizeImages ?? !1 })), l = s.bytes, u = yield* te({
+		let s = yield* b.promise(() => bt(e.bytes, e.contentType, { normalize: i.normalizeImages ?? !1 })), l = s.bytes, u = yield* te({
 			bytes: l,
 			contentType: e.contentType
-		}), d = s.width ?? u?.width, f = s.height ?? u?.height, h = s.placeholder ?? u?.poster, g = e.duration ?? u?.duration, _ = yield* b.promise(() => bt(l)), v = e.tenantId ?? null, ne = e.visibility ?? "private", S = m(v, _, e.key), C = {
+		}), d = s.width ?? u?.width, f = s.height ?? u?.height, h = s.placeholder ?? u?.poster, g = e.duration ?? u?.duration, _ = yield* b.promise(() => xt(l)), v = e.tenantId ?? null, ne = e.visibility ?? "private", S = m(v, _, e.key), C = {
 			bytes: l.byteLength,
 			count: 1
 		}, w = yield* o.consumeUsage(v, C, i.quota);
@@ -1398,8 +1398,8 @@ var ge = 1 << 20, _e = (e, n, r = !1) => new t({
 				detail: t
 			}));
 		}
-		let re = e.password ? yield* b.sync(() => Ke(e.password)) : null, T = {
-			id: jt(),
+		let re = e.password ? yield* b.sync(() => qe(e.password)) : null, T = {
+			id: Mt(),
 			tenantId: v,
 			ownerId: e.ownerId ?? null,
 			bucket: c,
@@ -1460,12 +1460,12 @@ var ge = 1 << 20, _e = (e, n, r = !1) => new t({
 		}
 		return r;
 	}), S = (e, t, n) => b.gen(function* () {
-		if (e.visibility === "public" || (yield* et(e, t, {
+		if (e.visibility === "public" || (yield* tt(e, t, {
 			...l,
 			...n?.password === void 0 ? {} : { password: n.password }
 		}))) return !0;
-		let r = yield* it(t, l);
-		return rt(yield* s.listByRef(e.id), t, r, n?.permission ?? "read", Date.now());
+		let r = yield* at(t, l);
+		return it(yield* s.listByRef(e.id), t, r, n?.permission ?? "read", Date.now());
 	}), w = (e) => {
 		if (e.visibility === "public") {
 			let t = a.publicUrl?.(e.key);
@@ -1519,7 +1519,7 @@ var ge = 1 << 20, _e = (e, n, r = !1) => new t({
 			}));
 			let c = i?.expiresInSec ?? d;
 			if (a.presigns) return yield* a.getUrl(s.key, c);
-			let l = yield* b.sync(() => at(s.id, c));
+			let l = yield* b.sync(() => ot(s.id, c));
 			return `${f(s.id)}?t=${l}`;
 		}),
 		mintUploadUrl: (e) => b.gen(function* () {
@@ -1535,7 +1535,7 @@ var ge = 1 << 20, _e = (e, n, r = !1) => new t({
 		checkAccess: S,
 		grant: (e) => b.gen(function* () {
 			let t = {
-				id: Mt(),
+				id: Nt(),
 				refId: e.refId,
 				principalType: e.principalType,
 				principalId: e.principalId,
@@ -1717,7 +1717,7 @@ var ge = 1 << 20, _e = (e, n, r = !1) => new t({
 				detail: `multipart upload of ${l} bytes exceeds tenant quota`
 			}));
 			let m = {
-				id: jt(),
+				id: Mt(),
 				tenantId: e.tenantId ?? null,
 				ownerId: e.ownerId ?? null,
 				bucket: c,
@@ -1738,7 +1738,7 @@ var ge = 1 << 20, _e = (e, n, r = !1) => new t({
 		}),
 		abortMultipart: (e) => b.suspend(() => a.abortMultipartUpload ? a.abortMultipartUpload(e.key, e.uploadId).pipe(b.retry(p)) : b.void)
 	};
-}, Pt = (e) => S.succeed(i, Nt(e)), Ft = (e, t = 64 * 1024) => {
+}, Ft = (e) => S.succeed(i, Pt(e)), It = (e, t = 64 * 1024) => {
 	let n = [Buffer.from("zINSTREAM\0", "utf8")];
 	for (let r = 0; r < e.length; r += t) {
 		let i = e.subarray(r, Math.min(r + t, e.length)), a = Buffer.alloc(4);
@@ -1746,7 +1746,7 @@ var ge = 1 << 20, _e = (e, n, r = !1) => new t({
 	}
 	let r = Buffer.alloc(4);
 	return r.writeUInt32BE(0, 0), n.push(r), Buffer.concat(n);
-}, It = (e) => {
+}, Lt = (e) => {
 	let t = e.replace(/\0+$/, "").trim();
 	if (/\bOK$/.test(t)) return { clean: !0 };
 	let n = /:\s*(.+?)\s+FOUND$/.exec(t);
@@ -1755,7 +1755,7 @@ var ge = 1 << 20, _e = (e, n, r = !1) => new t({
 		threat: n[1] ?? "unknown"
 	};
 	throw Error(`clamav: unexpected response: ${t}`);
-}, Lt = async (e, t) => {
+}, Rt = async (e, t) => {
 	let n = await import("node:net"), r = W.read("CLAMAV_HOST", t.host) ?? "127.0.0.1", i = W.read("CLAMAV_PORT"), a = t.port ?? (i ? Number(i) : 3310), o = t.timeoutMs ?? 3e4;
 	return new Promise((i, s) => {
 		let c = n.createConnection({
@@ -1767,20 +1767,20 @@ var ge = 1 << 20, _e = (e, n, r = !1) => new t({
 		c.on("error", (e) => {
 			clearTimeout(u), s(e);
 		}), c.on("connect", () => {
-			c.end(Ft(e, t.chunkSize));
+			c.end(It(e, t.chunkSize));
 		}), c.on("data", (e) => {
 			l += e.toString("utf8");
 		}), c.on("close", () => {
 			clearTimeout(u);
 			try {
-				i(It(l));
+				i(Lt(l));
 			} catch (e) {
 				s(e);
 			}
 		});
 	});
-}, Rt = (e = {}) => (t) => Lt(t.bytes, e), zt = (e, t, n) => new Promise((r, i) => {
-	let a = fe(e, [...t], { stdio: [
+}, zt = (e = {}) => (t) => Rt(t.bytes, e), Bt = (e, t, n) => new Promise((r, i) => {
+	let a = pe(e, [...t], { stdio: [
 		"ignore",
 		"ignore",
 		"pipe"
@@ -1794,21 +1794,21 @@ var ge = 1 << 20, _e = (e, n, r = !1) => new t({
 	}), a.on("close", (e) => {
 		clearTimeout(s), e === 0 ? r() : i(/* @__PURE__ */ Error(`ffmpeg exited ${String(e)}: ${o.slice(-400)}`));
 	});
-}), Bt = (e) => async ({ bytes: t }) => {
-	let n = e.ffmpegPath ?? "ffmpeg", r = e.timeoutMs ?? 5 * 6e4, i = await pe(B(he(), "voltro-tc-")), a = B(i, "in"), o = [];
+}), Vt = (e) => async ({ bytes: t }) => {
+	let n = e.ffmpegPath ?? "ffmpeg", r = e.timeoutMs ?? 5 * 6e4, i = await me(B(ge(), "voltro-tc-")), a = B(i, "in"), o = [];
 	try {
 		await z(a, t);
 		for (let t of e.renditions) {
 			let e = B(i, `out.${t.ext}`);
 			try {
-				await zt(n, [
+				await Bt(n, [
 					"-y",
 					"-i",
 					a,
 					...t.args,
 					e
 				], r);
-				let i = await me(e);
+				let i = await he(e);
 				o.push({
 					bytes: new Uint8Array(i),
 					contentType: t.contentType,
@@ -1827,21 +1827,21 @@ var ge = 1 << 20, _e = (e, n, r = !1) => new t({
 };
 //#endregion
 //#region src/assetRef.ts
-function Vt(e = {}) {
-	let t = e.nullable ?? !0, n = e.fk === !1 ? N() : ce(() => Ee, { onDelete: e.onDelete ?? "setNull" });
+function Ht(e = {}) {
+	let t = e.nullable ?? !0, n = e.fk === !1 ? N() : le(() => De, { onDelete: e.onDelete ?? "setNull" });
 	return t ? n.nullable() : n;
 }
-var Ht = () => se({
+var Ut = () => ce({
 	id: "@voltro/plugin-storage/withStorage",
-	fields: { asset: Vt() }
-}), Ut = {
+	fields: { asset: Ht() }
+}), Wt = {
 	"image/png": "png",
 	"image/jpeg": "jpg",
 	"image/jpg": "jpg",
 	"image/gif": "gif",
 	"image/webp": "webp",
 	"image/svg+xml": "svg"
-}, Wt = (e) => {
+}, Gt = (e) => {
 	let t = /^data:([^;,]+)(;base64)?,(.*)$/s.exec(e);
 	if (!t) throw Error("not a data URI");
 	let n = t[1] || "application/octet-stream", r = !!t[2], i = t[3] ?? "";
@@ -1849,16 +1849,16 @@ var Ht = () => se({
 		bytes: r ? new Uint8Array(Buffer.from(i, "base64")) : new Uint8Array(Buffer.from(decodeURIComponent(i), "utf8")),
 		contentType: n
 	};
-}, Gt = (e, n) => b.gen(function* () {
+}, Kt = (e, n) => b.gen(function* () {
 	let r = yield* b.try({
-		try: () => Wt(n.dataUri),
+		try: () => Gt(n.dataUri),
 		catch: (e) => new t({
 			provider: "avatar",
 			message: String(e?.message ?? e),
 			transient: !1,
 			status: 400
 		})
-	}), i = Ut[r.contentType] ?? "bin";
+	}), i = Wt[r.contentType] ?? "bin";
 	return yield* e.put({
 		bytes: r.bytes,
 		contentType: r.contentType,
@@ -1867,16 +1867,16 @@ var Ht = () => se({
 		visibility: "public",
 		key: `avatars/${n.userId}/avatar.${i}`
 	});
-}), Kt = W.read("VOLTRO_SESSION_COOKIE") ?? "voltro:session", qt, Jt = (e) => {
-	qt = e;
-}, Yt = () => qt ?? Xt({}), Xt = (e) => {
+}), qt = W.read("VOLTRO_SESSION_COOKIE") ?? "voltro:session", Jt, Yt = (e) => {
+	Jt = e;
+}, Xt = () => Jt ?? Zt({}), Zt = (e) => {
 	if (e.provider && typeof e.provider == "object") return e.provider;
 	let t = (e.provider ?? W.read("STORAGE_PROVIDER") ?? "memory").toLowerCase(), n = W.read("S3_BUCKET", e.bucket) ?? W.read("STORAGE_BUCKET") ?? "voltro";
 	switch (t) {
 		case "s3":
 		case "minio": {
 			let r = W.read("S3_REGION", e.region) ?? W.read("AWS_REGION"), i = W.read("S3_ENDPOINT", e.endpoint) ?? W.read("MINIO_ENDPOINT"), a = W.read("S3_ACCESS_KEY_ID", e.accessKeyId) ?? W.read("AWS_ACCESS_KEY_ID"), o = W.read("S3_SECRET_ACCESS_KEY", e.secretAccessKey) ?? W.read("AWS_SECRET_ACCESS_KEY"), s = W.read("STORAGE_CDN_URL", e.cdnBaseUrl);
-			return Fe({
+			return Ie({
 				bucket: n,
 				name: t,
 				...r ? { region: r } : {},
@@ -1890,7 +1890,7 @@ var Ht = () => se({
 		}
 		case "azure": {
 			let t = W.read("AZURE_STORAGE_ACCOUNT", e.accountName), r = W.read("AZURE_STORAGE_KEY", e.accountKey), i = W.read("AZURE_STORAGE_CONNECTION_STRING", e.connectionString), a = W.read("AZURE_STORAGE_ENDPOINT", e.endpoint), o = W.read("STORAGE_CDN_URL", e.cdnBaseUrl);
-			return Re({
+			return ze({
 				container: W.read("AZURE_STORAGE_CONTAINER", e.bucket) ?? n,
 				...t ? { accountName: t } : {},
 				...r ? { accountKey: r } : {},
@@ -1899,15 +1899,15 @@ var Ht = () => se({
 				...o ? { cdnBaseUrl: o } : {}
 			});
 		}
-		case "database": return Le();
-		case "filesystem": return Pe({ root: W.read("STORAGE_ROOT", e.root) ?? ".voltro-storage" });
-		default: return Ne(e.name ?? "default");
+		case "database": return Re();
+		case "filesystem": return Fe({ root: W.read("STORAGE_ROOT", e.root) ?? ".voltro-storage" });
+		default: return Pe(e.name ?? "default");
 	}
-}, Zt = (e) => {
+}, Qt = (e) => {
 	if (e !== void 0) return e;
 	let t = W.read("STORAGE_ALLOWED_ORIGINS");
 	return t ? t.trim() === "*" ? "*" : t.split(",").map((e) => e.trim()).filter(Boolean) : [];
-}, Qt = (e, t) => {
+}, $t = (e, t) => {
 	if (!e || t !== "*" && !t.includes(e)) return {};
 	let n = {
 		"access-control-allow-origin": t === "*" ? "*" : e,
@@ -1917,7 +1917,7 @@ var Ht = () => se({
 		vary: "Origin"
 	};
 	return t !== "*" && (n["access-control-allow-credentials"] = "true"), n;
-}, $t = (e) => ({
+}, en = (e) => ({
 	id: e.id,
 	tenantId: e.tenantId,
 	ownerId: e.ownerId,
@@ -1940,18 +1940,18 @@ var Ht = () => se({
 	caption: e.caption ?? null,
 	derivedFrom: e.derivedFrom ?? null,
 	kind: e.kind ?? null
-}), en = () => new t({
+}), tn = () => new t({
 	provider: "storage",
 	message: "not permitted to administer sharing for this object",
 	transient: !1,
 	status: 403
-}), tn = (e, t, n) => {
+}), nn = (e, t, n) => {
 	let r = n.request.subject;
-	return (r.scopes ?? []).includes("admin:full") ? b.void : e.head(t, { tenantId: r.tenantId ?? null }).pipe(b.catchAll(() => b.fail(en())), b.flatMap((e) => {
+	return (r.scopes ?? []).includes("admin:full") ? b.void : e.head(t, { tenantId: r.tenantId ?? null }).pipe(b.catchAll(() => b.fail(tn())), b.flatMap((e) => {
 		let t = e?.ownerId;
-		return t != null && t === r.id ? b.void : b.fail(en());
+		return t != null && t === r.id ? b.void : b.fail(tn());
 	}));
-}, nn = (e) => ({
+}, rn = (e) => ({
 	id: e.id,
 	refId: e.refId,
 	principalType: e.principalType,
@@ -1960,10 +1960,10 @@ var Ht = () => se({
 	createdAt: e.createdAt.toISOString(),
 	expiresAt: e.expiresAt ? e.expiresAt.toISOString() : null,
 	createdBy: e.createdBy
-}), rn = (i = {}) => {
-	let y = Xt(i);
-	Jt(y);
-	let x = W.read("S3_BUCKET", i.bucket) ?? W.read("STORAGE_BUCKET") ?? "voltro", S = W.read("VOLTRO_PUBLIC_URL", i.publicBaseUrl), C = Zt(i.allowedOrigins), w = i.limits?.maxBytes, E = 5 * 1024 * 1024, oe = 6 * 3600, D = i.refStore === void 0 || i.refStore === "memory", O = i.grantStore === void 0 || i.grantStore === "memory", k = { current: D ? Ct() : i.refStore }, A = { current: O ? Ot() : i.grantStore }, j = {
+}), an = "@voltro/plugin-storage", on = (i = {}) => {
+	let y = Zt(i);
+	Yt(y);
+	let x = W.read("S3_BUCKET", i.bucket) ?? W.read("STORAGE_BUCKET") ?? "voltro", S = W.read("VOLTRO_PUBLIC_URL", i.publicBaseUrl), C = Qt(i.allowedOrigins), w = i.limits?.maxBytes, E = 5 * 1024 * 1024, se = 6 * 3600, D = i.refStore === void 0 || i.refStore === "memory", O = i.grantStore === void 0 || i.grantStore === "memory", k = { current: D ? wt() : i.refStore }, A = { current: O ? kt() : i.grantStore }, j = {
 		insert: (e) => k.current.insert(e),
 		getById: (e) => k.current.getById(e),
 		delete: (e) => k.current.delete(e),
@@ -1974,16 +1974,16 @@ var Ht = () => se({
 		releaseUsage: (e, t) => k.current.releaseUsage(e, t),
 		listByDerivedFrom: (e) => k.current.listByDerivedFrom(e),
 		listRefs: (e) => k.current.listRefs(e)
-	}, se = {
+	}, ce = {
 		insert: (e) => A.current.insert(e),
 		delete: (e) => A.current.delete(e),
 		getById: (e) => A.current.getById(e),
 		listByRef: (e) => A.current.listByRef(e),
 		deleteByRef: (e) => A.current.deleteByRef(e)
-	}, ce = {
+	}, le = {
 		provider: y,
 		refStore: j,
-		grantStore: se,
+		grantStore: ce,
 		bucket: x,
 		...i.tenantPrefix === void 0 ? {} : { tenantPrefix: i.tenantPrefix },
 		...i.attempts === void 0 ? {} : { attempts: i.attempts },
@@ -1997,7 +1997,7 @@ var Ht = () => se({
 		...S ? { publicBaseUrl: S } : {},
 		...i.normalizeImages === void 0 ? {} : { normalizeImages: i.normalizeImages },
 		...i.quota === void 0 ? {} : { quota: i.quota }
-	}, M = Pt(ce), N = Nt(ce), P = (e) => b.runPromise(e.pipe(b.catchAll(() => b.succeed(null)))), le = (e, t) => {
+	}, M = Ft(le), N = Pt(le), P = (e) => b.runPromise(e.pipe(b.catchAll(() => b.succeed(null)))), ue = (e, t) => {
 		if (!e) return "invalid";
 		let n = /^bytes=(\d*)-(\d*)$/.exec(e.trim());
 		if (!n) return "invalid";
@@ -2021,7 +2021,7 @@ var Ht = () => se({
 	}, F = /^(?:image\/(?!svg)|video\/|audio\/|application\/pdf(?:;|$)|text\/plain(?:;|$))/i, I = (e) => ({
 		"x-content-type-options": "nosniff",
 		"content-disposition": F.test(e) ? "inline" : "attachment"
-	}), de = async (e, t, n, r) => {
+	}), fe = async (e, t, n, r) => {
 		if (n) {
 			let r = await P(N.get(e.id));
 			if (!r) return {
@@ -2029,7 +2029,7 @@ var Ht = () => se({
 				body: "not found",
 				contentType: "text/plain"
 			};
-			let i = await Ge(e.id, r.bytes, e.contentType, n).catch(() => null), a = i ? i.bytes : r.bytes, o = i ? i.contentType : e.contentType;
+			let i = await Ke(e.id, r.bytes, e.contentType, n).catch(() => null), a = i ? i.bytes : r.bytes, o = i ? i.contentType : e.contentType;
 			return {
 				status: 200,
 				body: a,
@@ -2041,7 +2041,7 @@ var Ht = () => se({
 				}
 			};
 		}
-		let i = r === void 0 ? "invalid" : le(r, e.size);
+		let i = r === void 0 ? "invalid" : ue(r, e.size);
 		if (i === "unsatisfiable") return {
 			status: 416,
 			body: "range not satisfiable",
@@ -2097,7 +2097,7 @@ var Ht = () => se({
 			body: "not found",
 			contentType: "text/plain"
 		};
-		let r = Be(e.query), i = e.headers.range;
+		let r = Ve(e.query), i = e.headers.range;
 		if (n.visibility === "public") {
 			let e = y.publicUrl?.(n.key) ?? null;
 			return e && !r ? {
@@ -2106,15 +2106,15 @@ var Ht = () => se({
 					location: e,
 					"cache-control": "public, max-age=300"
 				}
-			} : de(n, "public, max-age=31536000, immutable", r, i);
+			} : fe(n, "public, max-age=31536000, immutable", r, i);
 		}
 		let a = !1, o = e.query ? new URLSearchParams(e.query).get("t") : null;
 		if (o) {
-			let e = ot(o);
+			let e = st(o);
 			a = !!e && e.refId === t;
 		}
 		if (!a) {
-			let t = T(e.headers.cookie, Kt), r = t ? ae(t, ie()) : null;
+			let t = ie(e.headers.cookie, qt), r = t ? oe(t, ae()) : null;
 			r && (a = await P(N.checkAccess(n, r)) === !0);
 		}
 		if (!a) return {
@@ -2132,12 +2132,12 @@ var Ht = () => se({
 				}
 			};
 		}
-		return de(n, "private, no-store", r, i);
-	}, fe = {
+		return fe(n, "private, no-store", r, i);
+	}, pe = {
 		method: "GET",
 		path: "/_voltro/storage",
 		handle: async (e) => {
-			let t = await L(e), n = Qt(e.headers.origin, C);
+			let t = await L(e), n = $t(e.headers.origin, C);
 			return Object.keys(n).length === 0 ? t : {
 				...t,
 				headers: {
@@ -2146,11 +2146,12 @@ var Ht = () => se({
 				}
 			};
 		}
-	}, pe = {
+	}, me = {
 		method: "*",
 		path: "/_voltro/storage/upload",
+		originGuard: "exempt",
 		handle: async (e) => {
-			let t = Qt(e.headers.origin, C);
+			let t = $t(e.headers.origin, C);
 			if (e.method === "OPTIONS") return {
 				status: 204,
 				headers: t
@@ -2161,7 +2162,7 @@ var Ht = () => se({
 				contentType: "text/plain",
 				headers: t
 			};
-			let n = e.query ? new URLSearchParams(e.query).get("ticket") : null, r = n ? ct(n) : null;
+			let n = e.query ? new URLSearchParams(e.query).get("ticket") : null, r = n ? lt(n) : null;
 			if (!r) return {
 				status: 401,
 				body: "invalid or expired upload ticket",
@@ -2237,16 +2238,17 @@ var Ht = () => se({
 				headers: t
 			};
 		}
-	}, me = {
+	}, he = {
 		method: "*",
 		path: "/_voltro/storage/upload/resumable",
+		originGuard: "exempt",
 		handle: async (e) => {
-			let t = Qt(e.headers.origin, C);
+			let t = $t(e.headers.origin, C);
 			if (e.method === "OPTIONS") return {
 				status: 204,
 				headers: t
 			};
-			let n = new URLSearchParams(e.query || ""), r = ft(n.get("token") ?? "");
+			let n = new URLSearchParams(e.query || ""), r = pt(n.get("token") ?? "");
 			if (!r) return {
 				status: 401,
 				body: "invalid or expired resumable token",
@@ -2370,7 +2372,7 @@ var Ht = () => se({
 		kind: "json",
 		status: e,
 		data: { error: t }
-	}), he = (e, t) => {
+	}), ge = (e, t) => {
 		try {
 			return new URL(e, "http://localhost").searchParams.get(t);
 		} catch {
@@ -2381,7 +2383,7 @@ var Ht = () => se({
 			method: "GET",
 			path: "/refs",
 			description: "Recent storage refs (newest first)",
-			handler: () => j.listRecent(100).pipe(b.map((e) => R({ refs: e.map($t) })), b.catchAll((e) => b.succeed(z(500, e.message))))
+			handler: () => j.listRecent(100).pipe(b.map((e) => R({ refs: e.map(en) })), b.catchAll((e) => b.succeed(z(500, e.message))))
 		},
 		{
 			method: "GET",
@@ -2412,8 +2414,8 @@ var Ht = () => se({
 			path: "/grants",
 			description: "Grants for a ref (?refId=…)",
 			handler: (e) => {
-				let t = he(e.url, "refId");
-				return t ? se.listByRef(t).pipe(b.map((e) => R({ grants: e.map(nn) })), b.catchAll((e) => b.succeed(z(500, e.message)))) : b.succeed(z(400, "refId query param required"));
+				let t = ge(e.url, "refId");
+				return t ? ce.listByRef(t).pipe(b.map((e) => R({ grants: e.map(rn) })), b.catchAll((e) => b.succeed(z(500, e.message)))) : b.succeed(z(400, "refId query param required"));
 			}
 		},
 		{
@@ -2438,7 +2440,7 @@ var Ht = () => se({
 					...n.permission ? { permission: n.permission } : {},
 					expiresAt: r
 				});
-				return R({ grant: nn(i) });
+				return R({ grant: rn(i) });
 			}).pipe(b.catchAll((e) => b.succeed(z(e.status ?? 500, e.message ?? "share failed"))))
 		},
 		{
@@ -2458,7 +2460,7 @@ var Ht = () => se({
 				return n.grantId ? (yield* N.revoke(n.grantId), R({ ok: !0 })) : z(400, "grantId required");
 			}).pipe(b.catchAll((e) => b.succeed(z(e.status ?? 500, e.message ?? "revoke failed"))))
 		}
-	], ge = [
+	], _e = [
 		{
 			...g,
 			execute: (e, t) => {
@@ -2486,7 +2488,7 @@ var Ht = () => se({
 			execute: (e, t) => {
 				let n = e;
 				return b.sync(() => {
-					let e = n.expiresInSec ?? 900, r = st({
+					let e = n.expiresInSec ?? 900, r = ct({
 						sub: t.request.subject.id,
 						tenant: t.request.subject.tenantId,
 						ct: n.contentType,
@@ -2514,7 +2516,7 @@ var Ht = () => se({
 					tenantId: t.request.subject.tenantId,
 					...n.expiresInSec === void 0 ? {} : { expiresInSec: n.expiresInSec }
 				}).pipe(b.map((e) => {
-					let r = lt({
+					let r = ut({
 						key: e.key,
 						sub: t.request.subject.id,
 						tenant: t.request.subject.tenantId,
@@ -2537,7 +2539,7 @@ var Ht = () => se({
 		{
 			...l,
 			execute: (e, n) => {
-				let r = ut(e.finalizeToken);
+				let r = dt(e.finalizeToken);
 				return r ? r.sub !== null && r.sub !== n.request.subject.id ? b.fail(new t({
 					provider: "storage",
 					message: "finalize token belongs to another subject",
@@ -2573,10 +2575,10 @@ var Ht = () => se({
 			execute: (e, t) => {
 				let n = e;
 				return b.sync(() => {
-					let e = n.expiresInSec ?? oe, r = ue(), i = n.chunkSize && n.chunkSize > 0 ? n.chunkSize : E;
+					let e = n.expiresInSec ?? se, r = de(), i = n.chunkSize && n.chunkSize > 0 ? n.chunkSize : E;
 					return {
 						uploadId: r,
-						resumableToken: dt({
+						resumableToken: ft({
 							id: r,
 							sub: t.request.subject.id,
 							tenant: t.request.subject.tenantId,
@@ -2599,14 +2601,14 @@ var Ht = () => se({
 		{
 			...o,
 			execute: (e, t) => {
-				let n = e, r = n.expiresInSec ?? oe;
+				let n = e, r = n.expiresInSec ?? se;
 				return N.beginMultipartUpload({
 					contentType: n.contentType,
 					tenantId: t.request.subject.tenantId,
 					visibility: n.visibility ?? "private",
 					expiresInSec: r
 				}).pipe(b.map((e) => ({
-					multipartToken: pt({
+					multipartToken: mt({
 						key: e.key,
 						uploadId: e.uploadId,
 						sub: t.request.subject.id,
@@ -2627,7 +2629,7 @@ var Ht = () => se({
 		{
 			...te,
 			execute: (e) => {
-				let n = e, r = mt(n.multipartToken);
+				let n = e, r = ht(n.multipartToken);
 				return r ? !Number.isInteger(n.partNumber) || n.partNumber < 1 ? b.fail(new t({
 					provider: "storage",
 					message: "partNumber must be a positive integer",
@@ -2648,7 +2650,7 @@ var Ht = () => se({
 		{
 			...c,
 			execute: (e, n) => {
-				let r = e, i = mt(r.multipartToken);
+				let r = e, i = ht(r.multipartToken);
 				return i ? i.sub !== null && i.sub !== n.request.subject.id ? b.fail(new t({
 					provider: "storage",
 					message: "multipart token belongs to another subject",
@@ -2681,7 +2683,7 @@ var Ht = () => se({
 		{
 			...a,
 			execute: (e) => {
-				let n = mt(e.multipartToken);
+				let n = ht(e.multipartToken);
 				return n ? N.abortMultipart({
 					key: n.key,
 					uploadId: n.uploadId
@@ -2734,7 +2736,7 @@ var Ht = () => se({
 			...ee,
 			execute: (e, t) => {
 				let n = e, r = n.expiresInDays ? new Date(Date.now() + n.expiresInDays * 864e5) : null;
-				return tn(N, n.refId, t).pipe(b.flatMap(() => N.grant({
+				return nn(N, n.refId, t).pipe(b.flatMap(() => N.grant({
 					refId: n.refId,
 					principalType: n.principalType,
 					principalId: n.principalId,
@@ -2748,14 +2750,14 @@ var Ht = () => se({
 			..._,
 			execute: (e, t) => {
 				let n = e;
-				return N.getGrant(n.grantId).pipe(b.flatMap((e) => e === null ? b.fail(en()) : tn(N, e.refId, t)), b.flatMap(() => N.revoke(n.grantId)), b.map(() => ({ ok: !0 })));
+				return N.getGrant(n.grantId).pipe(b.flatMap((e) => e === null ? b.fail(tn()) : nn(N, e.refId, t)), b.flatMap(() => N.revoke(n.grantId)), b.map(() => ({ ok: !0 })));
 			}
 		},
 		{
 			...d,
 			execute: (e, t) => {
 				let n = e;
-				return tn(N, n.refId, t).pipe(b.flatMap(() => N.listGrants(n.refId)), b.map((e) => ({ grants: e.map(nn) })));
+				return nn(N, n.refId, t).pipe(b.flatMap(() => N.listGrants(n.refId)), b.map((e) => ({ grants: e.map(rn) })));
 			}
 		},
 		{
@@ -2771,14 +2773,19 @@ var Ht = () => se({
 					...n.limit === void 0 ? {} : { limit: n.limit },
 					...n.offset === void 0 ? {} : { offset: n.offset }
 				}).pipe(b.map((e) => ({
-					refs: e.refs.map($t),
+					refs: e.refs.map(en),
 					nextOffset: e.nextOffset
 				})));
 			}
 		}
 	];
 	return re({
-		name: i.name ? `@voltro/plugin-storage#${i.name}` : "@voltro/plugin-storage",
+		name: T({
+			base: an,
+			alias: i.alias,
+			instance: i.name
+		}),
+		baseName: an,
 		description: "File storage — StorageService over S3 / MinIO / filesystem / memory. Public objects served direct from bucket/CDN; private objects gated by an access policy + per-object grants. Checksums, tenant key-prefixing, _voltro_storage_refs + _voltro_storage_grants, retry.",
 		permissions: [
 			"network:outbound:*",
@@ -2789,11 +2796,11 @@ var Ht = () => se({
 		services: M,
 		inspectEndpoints: B,
 		httpRoutes: [
-			fe,
 			pe,
-			me
+			me,
+			he
 		],
-		routes: ge,
+		routes: _e,
 		rpcClientDescriptors: v,
 		errorSchemas: [
 			{
@@ -2826,7 +2833,7 @@ var Ht = () => se({
 			}
 		],
 		bindDataStore: (e) => {
-			D && (k.current = Dt(e)), O && (A.current = At(e)), y.bindDataStore?.(e);
+			D && (k.current = Ot(e)), O && (A.current = jt(e)), y.bindDataStore?.(e);
 		},
 		onActivate: (e) => b.sync(() => {
 			let t = !!S || !!W.read("STORAGE_CDN_URL", i.cdnBaseUrl);
@@ -2840,4 +2847,4 @@ var Ht = () => se({
 	});
 };
 //#endregion
-export { U as STORAGE_BLOBS_TABLE, H as STORAGE_GRANTS_TABLE, V as STORAGE_REFS_TABLE, Te as STORAGE_USAGE_TABLE, e as StorageAccessDenied, t as StorageError, n as StorageRejected, r as StorageScanRejected, i as StorageService, ke as _voltroStorageBlobsTable, De as _voltroStorageGrantsTable, Ee as _voltroStorageRefsTable, Oe as _voltroStorageUsageTable, Yt as appStorageProvider, Vt as assetRef, Re as azureProvider, Nt as buildStorageService, ye as bytesToStream, vt as checkLimits, Rt as clamavScanner, Me as clearStorageBuffer, be as collectStream, ve as concatBytes, ht as contentTypeAllowed, At as dataStoreGrantStore, Dt as dataStoreRefStore, Le as databaseProvider, Wt as decodeDataUri, Ft as encodeInstream, Bt as ffmpegTranscoder, Pe as filesystemProvider, xe as fromNodeReadable, Ce as getObjectStream, Ke as hashPassword, Ot as memoryGrantStore, Ne as memoryProvider, Ct as memoryRefStore, It as parseClamavResponse, Be as parseTransformParams, Gt as putAvatar, we as putObjectStream, je as readStorageBuffer, St as refMatchesListQuery, Xt as resolveStorageProvider, Y as resolveStorageSecret, Fe as s3Provider, Jt as setActiveStorageProvider, lt as signFinalizeTicket, at as signGrant, pt as signMultipartTicket, dt as signResumableTicket, st as signUploadTicket, _t as sniffMatches, rn as storagePlugin, Pt as storageServiceLayer, Se as toNodeReadable, Ge as transformCached, Ue as transformImage, ut as verifyFinalizeTicket, ot as verifyGrant, mt as verifyMultipartTicket, qe as verifyPassword, ft as verifyResumableTicket, ct as verifyUploadTicket, Ht as withStorage };
+export { U as STORAGE_BLOBS_TABLE, H as STORAGE_GRANTS_TABLE, V as STORAGE_REFS_TABLE, Ee as STORAGE_USAGE_TABLE, e as StorageAccessDenied, t as StorageError, n as StorageRejected, r as StorageScanRejected, i as StorageService, Ae as _voltroStorageBlobsTable, Oe as _voltroStorageGrantsTable, De as _voltroStorageRefsTable, ke as _voltroStorageUsageTable, Xt as appStorageProvider, Ht as assetRef, ze as azureProvider, Pt as buildStorageService, be as bytesToStream, yt as checkLimits, zt as clamavScanner, Ne as clearStorageBuffer, xe as collectStream, ye as concatBytes, gt as contentTypeAllowed, jt as dataStoreGrantStore, Ot as dataStoreRefStore, Re as databaseProvider, Gt as decodeDataUri, It as encodeInstream, Vt as ffmpegTranscoder, Fe as filesystemProvider, Se as fromNodeReadable, we as getObjectStream, qe as hashPassword, kt as memoryGrantStore, Pe as memoryProvider, wt as memoryRefStore, Lt as parseClamavResponse, Ve as parseTransformParams, Kt as putAvatar, Te as putObjectStream, Me as readStorageBuffer, Ct as refMatchesListQuery, Zt as resolveStorageProvider, Y as resolveStorageSecret, Ie as s3Provider, Yt as setActiveStorageProvider, ut as signFinalizeTicket, ot as signGrant, mt as signMultipartTicket, ft as signResumableTicket, ct as signUploadTicket, vt as sniffMatches, on as storagePlugin, Ft as storageServiceLayer, Ce as toNodeReadable, Ke as transformCached, We as transformImage, dt as verifyFinalizeTicket, st as verifyGrant, ht as verifyMultipartTicket, Je as verifyPassword, pt as verifyResumableTicket, lt as verifyUploadTicket, Ut as withStorage };