@voltro/plugin-storage 0.63.0 → 0.64.0

package/dist/index.js

@@ -1,8 +1,8 @@
 import { StorageAccessDenied as e, StorageError as t, StorageRejected as n, StorageScanRejected as r, StorageService as i } from "./types.js";
-import { abortMultipartUploadDescriptor as a, beginMultipartUploadDescriptor as o, beginResumableUploadDescriptor as s, completeMultipartUploadDescriptor as c, finalizeUploadDescriptor as l, ingestUrlDescriptor as u, listGrantsDescriptor as d, listRefsDescriptor as f, mintPresignedUploadDescriptor as p, mintUploadTicketDescriptor as m, mintUploadUrlDescriptor as h, mintUrlDescriptor as g, revokeDescriptor as _, shareDescriptor as ee, signMultipartPartDescriptor as te, storageRpcClientImports as v, uploadDescriptor as y } from "./rpc.js";
-import { Chunk as b, Effect as x, Exit as S, Layer as C, Schedule as w, Stream as T } from "effect";
-import { definePlugin as ne, pluginInstanceName as E } from "@voltro/protocol";
-import { readCookie as re, resolveSessionSecret as ie, verifySession as ae } from "@voltro/protocol/session";
+import { abortMultipartUploadDescriptor as a, beginMultipartUploadDescriptor as o, beginResumableUploadDescriptor as s, completeMultipartUploadDescriptor as c, finalizeUploadDescriptor as l, ingestUrlDescriptor as u, listGrantsDescriptor as d, listRefsDescriptor as f, mintPresignedUploadDescriptor as p, mintUploadTicketDescriptor as m, mintUploadUrlDescriptor as ee, mintUrlDescriptor as h, revokeDescriptor as g, shareDescriptor as _, signMultipartPartDescriptor as te, storageRpcClientImports as ne, uploadDescriptor as v } from "./rpc.js";
+import { Chunk as y, Effect as b, Exit as x, Layer as S, Schedule as C, Stream as w } from "effect";
+import { definePlugin as T, pluginInstanceName as re } from "@voltro/protocol";
+import { readCookie as E, resolveSessionSecret as ie, verifySession as ae } from "@voltro/protocol/session";
 import { and as D, bytes as oe, eq as O, generateId as k, id as A, integer as j, json as M, mixin as se, reference as ce, table as N, text as P, timestamp as F } from "@voltro/database";
 import { pluginEnv as le } from "@voltro/env";
 import { createHmac as I, randomBytes as ue, randomUUID as de, scryptSync as fe, timingSafeEqual as L } from "node:crypto";
@@ -25,18 +25,18 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 }, xe = (e, t = ve) => {
 	let n = [];
 	for (let r = 0; r < e.byteLength; r += t) n.push(e.subarray(r, Math.min(r + t, e.byteLength)));
-	return T.fromIterable(n);
-}, Se = (e) => e.pipe(T.runCollect, x.map((e) => be(b.toReadonlyArray(e)))), Ce = (e, t) => T.suspend(() => T.fromAsyncIterable(t(), (t) => ye(e, `read stream failed: ${String(t?.message ?? t)}`, !0))).pipe(T.map((e) => e instanceof Uint8Array ? e : new Uint8Array(e))), we = async (e) => {
+	return w.fromIterable(n);
+}, Se = (e) => e.pipe(w.runCollect, b.map((e) => be(y.toReadonlyArray(e)))), Ce = (e, t) => w.suspend(() => w.fromAsyncIterable(t(), (t) => ye(e, `read stream failed: ${String(t?.message ?? t)}`, !0))).pipe(w.map((e) => e instanceof Uint8Array ? e : new Uint8Array(e))), V = async (e) => {
 	let { Readable: t } = await import("node:stream");
-	return t.fromWeb(T.toReadableStream(e));
-}, Te = (e, t) => e.getStream ? e.getStream(t) : e.get(t).pipe(x.map((e) => ({
+	return t.fromWeb(w.toReadableStream(e));
+}, we = (e, t) => e.getStream ? e.getStream(t) : e.get(t).pipe(b.map((e) => ({
 	stream: xe(e.bytes),
 	contentType: e.contentType,
 	size: e.bytes.byteLength
-}))), Ee = (e, t, n, r) => e.putStream ? e.putStream(t, n, r) : Se(n).pipe(x.flatMap((n) => e.put(t, n, {
+}))), Te = (e, t, n, r) => e.putStream ? e.putStream(t, n, r) : Se(n).pipe(b.flatMap((n) => e.put(t, n, {
 	contentType: r.contentType,
 	...r.public === void 0 ? {} : { public: r.public }
-}))), V = "_voltro_storage_refs", H = "_voltro_storage_grants", U = "_voltro_storage_blobs", W = "_voltro_storage_usage", De = N(V, {
+}))), H = "_voltro_storage_refs", U = "_voltro_storage_grants", W = "_voltro_storage_blobs", G = "_voltro_storage_usage", Ee = N(H, {
 	id: A({ prefix: "file" }),
 	tenantId: P().nullable(),
 	ownerId: P().nullable(),
@@ -59,7 +59,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 	derivedFrom: P().nullable(),
 	kind: P().nullable(),
 	createdAt: F()
-}).index(["key"]).index(["tenantId"]).index(["ownerId"]).index(["folder"]).index(["derivedFrom"]), Oe = N(H, {
+}).index(["key"]).index(["tenantId"]).index(["ownerId"]).index(["folder"]).index(["derivedFrom"]), De = N(U, {
 	id: A({ prefix: "sgrant" }),
 	refId: P(),
 	principalType: P(),
@@ -68,19 +68,19 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 	createdAt: F(),
 	expiresAt: F().nullable(),
 	createdBy: P().nullable()
-}).index(["refId"]).index(["principalId"]), ke = N(W, {
+}).index(["refId"]).index(["principalId"]), Oe = N(G, {
 	id: A({ prefix: "susage" }),
 	tenantId: P().maxLength(191),
 	bytes: j().default(0),
 	count: j().default(0),
 	updatedAt: F()
-}).unique("byStorageUsageTenant", ["tenantId"]), Ae = N(U, {
+}).unique("byStorageUsageTenant", ["tenantId"]), ke = N(W, {
 	id: A({ prefix: "blob" }),
 	key: P(),
 	data: oe(),
 	contentType: P(),
 	size: j()
-}).index(["key"]), G = le([
+}).index(["key"]), K = le([
 	{
 		name: "STORAGE_PROVIDER",
 		required: !1,
@@ -231,35 +231,35 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 		secret: !1,
 		description: "clamd port for the optional clamav virus scanner. Default 3310."
 	}
-]), K = (e, n, r, i) => new t({
+]), q = (e, n, r, i) => new t({
 	provider: e,
 	message: n,
 	transient: r,
 	...i === void 0 ? {} : { status: i }
-}), q = (e) => e === void 0 || e === 408 || e === 429 || e >= 500, je = /* @__PURE__ */ new Map(), Me = (e, t) => je.get(e)?.get(t)?.bytes, Ne = (e) => {
+}), Ae = (e) => e === void 0 || e === 408 || e === 429 || e >= 500, je = /* @__PURE__ */ new Map(), Me = (e, t) => je.get(e)?.get(t)?.bytes, Ne = (e) => {
 	je.get(e)?.clear();
 }, Pe = (e = "default") => {
 	let t = je.get(e) ?? /* @__PURE__ */ new Map();
 	return je.set(e, t), {
 		name: "memory",
 		presigns: !1,
-		put: (e, n, r) => x.sync(() => (t.set(e, {
+		put: (e, n, r) => b.sync(() => (t.set(e, {
 			bytes: n,
 			contentType: r.contentType
 		}), { size: n.byteLength })),
-		get: (e) => x.suspend(() => {
+		get: (e) => b.suspend(() => {
 			let n = t.get(e);
-			return n ? x.succeed({
+			return n ? b.succeed({
 				bytes: n.bytes,
 				contentType: n.contentType
-			}) : x.fail(K("memory", `no object at key '${e}'`, !1, 404));
+			}) : b.fail(q("memory", `no object at key '${e}'`, !1, 404));
 		}),
-		delete: (e) => x.sync(() => {
+		delete: (e) => b.sync(() => {
 			t.delete(e);
 		}),
 		publicUrl: () => null,
-		getUrl: () => x.succeed(""),
-		head: (e) => x.sync(() => {
+		getUrl: () => b.succeed(""),
+		head: (e) => b.sync(() => {
 			let n = t.get(e);
 			return n ? { size: n.bytes.byteLength } : null;
 		})
@@ -269,9 +269,9 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 		let { join: n, resolve: r, sep: i } = await import("node:path"), a = r(t), o = r(a, e);
 		if (o !== a && !o.startsWith(a + i)) throw Error(`key '${e}' escapes the storage root`);
 		return n(o);
-	}, r = (e, t, n = !1) => x.tryPromise({
+	}, r = (e, t, n = !1) => b.tryPromise({
 		try: e,
-		catch: (e) => e?.code === "ENOENT" ? K("filesystem", `no object at key '${t}'`, !1, 404) : K("filesystem", String(e?.message ?? e), n)
+		catch: (e) => e?.code === "ENOENT" ? q("filesystem", `no object at key '${t}'`, !1, 404) : q("filesystem", String(e?.message ?? e), n)
 	});
 	return {
 		root: t,
@@ -299,8 +299,8 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 			await (await import("node:fs/promises")).rm(await n(e), { force: !0 });
 		}, e),
 		publicUrl: () => null,
-		getUrl: () => x.succeed(""),
-		head: (e) => x.tryPromise({
+		getUrl: () => b.succeed(""),
+		head: (e) => b.tryPromise({
 			try: async () => {
 				let t = await import("node:fs/promises");
 				try {
@@ -310,7 +310,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 					throw e;
 				}
 			},
-			catch: (e) => K("filesystem", String(e?.message ?? e), !1)
+			catch: (e) => q("filesystem", String(e?.message ?? e), !1)
 		}),
 		getStream: (e) => r(async () => {
 			let t = await import("node:fs/promises"), { createReadStream: r } = await import("node:fs"), i = await n(e), a = await t.stat(i);
@@ -325,7 +325,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 			await r.mkdir(i(c), { recursive: !0 });
 			let l = `${c}.tmp-${a()}`;
 			try {
-				await s(await we(t), o(l));
+				await s(await V(t), o(l));
 				let e = await r.stat(l);
 				return await r.rename(l, c), { size: e.size };
 			} catch (e) {
@@ -364,11 +364,11 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 			cmds: t,
 			presign: n.getSignedUrl
 		};
-	})(), r), a = (e) => x.tryPromise({
+	})(), r), a = (e) => b.tryPromise({
 		try: e,
 		catch: (e) => {
 			let n = e?.$metadata?.httpStatusCode;
-			return K(t, String(e?.message ?? e), q(n), n);
+			return q(t, String(e?.message ?? e), Ae(n), n);
 		}
 	}), o = async (e) => {
 		let t = e;
@@ -464,7 +464,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 				UploadId: n
 			}));
 		}),
-		head: (n) => x.tryPromise({
+		head: (n) => b.tryPromise({
 			try: async () => {
 				let { client: t, cmds: r } = await i();
 				try {
@@ -483,7 +483,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 			},
 			catch: (e) => {
 				let n = e?.$metadata?.httpStatusCode;
-				return K(t, String(e?.message ?? e), q(n), n);
+				return q(t, String(e?.message ?? e), Ae(n), n);
 			}
 		}),
 		getStream: (n) => a(async () => {
@@ -504,7 +504,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 			} catch (e) {
 				throw Error("s3/minio `putStream` requires the '@aws-sdk/lib-storage' optional dependency (multipart upload). Install it to enable streamed uploads.", { cause: e });
 			}
-			let l = await we(r);
+			let l = await V(r);
 			return await new c.Upload({
 				client: a,
 				params: {
@@ -532,11 +532,11 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 	let e = null, t = () => {
 		if (!e) throw Error("the 'database' storage provider isn't bound to a DataStore yet");
 		return e;
-	}, n = (e) => x.tryPromise({
+	}, n = (e) => b.tryPromise({
 		try: e,
-		catch: (e) => K("database", String(e?.message ?? e), !0)
+		catch: (e) => q("database", String(e?.message ?? e), !0)
 	}), r = async (e) => (await t().query({
-		table: U,
+		table: W,
 		predicate: {
 			column: "key",
 			op: "eq",
@@ -555,31 +555,31 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 		},
 		put: (e, i, a) => n(async () => {
 			let n = await r(e);
-			return n ? await t().update(U, String(n.id), {
+			return n ? await t().update(W, String(n.id), {
 				data: i,
 				contentType: a.contentType,
 				size: i.byteLength
-			}) : await t().insert(U, {
+			}) : await t().insert(W, {
 				id: k({
 					kind: "typeid",
 					prefix: "blob"
-				}, U),
+				}, W),
 				key: e,
 				data: i,
 				contentType: a.contentType,
 				size: i.byteLength
 			}), { size: i.byteLength };
 		}),
-		get: (e) => x.suspend(() => n(() => r(e)).pipe(x.flatMap((t) => t ? x.succeed({
+		get: (e) => b.suspend(() => n(() => r(e)).pipe(b.flatMap((t) => t ? b.succeed({
 			bytes: Le(t.data),
 			contentType: String(t.contentType)
-		}) : x.fail(K("database", `no object at key '${e}'`, !1, 404))))),
+		}) : b.fail(q("database", `no object at key '${e}'`, !1, 404))))),
 		delete: (e) => n(async () => {
 			let n = await r(e);
-			n && await t().delete(U, String(n.id));
+			n && await t().delete(W, String(n.id));
 		}),
 		publicUrl: () => null,
-		getUrl: () => x.succeed(""),
+		getUrl: () => b.succeed(""),
 		head: (e) => n(async () => {
 			let t = await r(e);
 			return t ? { size: Number(t.size) } : null;
@@ -593,17 +593,17 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 		} catch (e) {
 			throw Error("the 'azure' storage provider requires the '@azure/storage-blob' optional dependency. Install it to enable it.", { cause: e });
 		}
-		let n = G.read("AZURE_STORAGE_ACCOUNT", e.accountName), r = G.read("AZURE_STORAGE_KEY", e.accountKey), i = n && r ? new t.StorageSharedKeyCredential(n, r) : null, a = G.read("AZURE_STORAGE_CONNECTION_STRING", e.connectionString);
+		let n = K.read("AZURE_STORAGE_ACCOUNT", e.accountName), r = K.read("AZURE_STORAGE_KEY", e.accountKey), i = n && r ? new t.StorageSharedKeyCredential(n, r) : null, a = K.read("AZURE_STORAGE_CONNECTION_STRING", e.connectionString);
 		return {
 			container: (a ? t.BlobServiceClient.fromConnectionString(a) : new t.BlobServiceClient(e.endpoint ?? `https://${n}.blob.core.windows.net`, i ?? void 0)).getContainerClient(e.container),
 			sdk: t,
 			cred: i
 		};
-	})(), t), r = (e) => x.tryPromise({
+	})(), t), r = (e) => b.tryPromise({
 		try: e,
 		catch: (e) => {
 			let t = e?.statusCode;
-			return K("azure", String(e?.message ?? e), q(t), t);
+			return q("azure", String(e?.message ?? e), Ae(t), t);
 		}
 	}), i = async (e) => {
 		if (!e) return /* @__PURE__ */ new Uint8Array();
@@ -645,7 +645,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 		publicUrl: (t) => e.cdnBaseUrl ? `${e.cdnBaseUrl.replace(/\/$/, "")}/${t}` : null,
 		getUrl: (e, t) => r(() => a(e, "r", t)),
 		getUploadUrl: (e, t, n) => r(() => a(e, "cw", t)),
-		head: (e) => x.tryPromise({
+		head: (e) => b.tryPromise({
 			try: async () => {
 				let { container: t } = await n();
 				try {
@@ -661,7 +661,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 			},
 			catch: (e) => {
 				let t = e?.statusCode;
-				return K("azure", String(e?.message ?? e), q(t), t);
+				return q("azure", String(e?.message ?? e), Ae(t), t);
 			}
 		}),
 		getStream: (e) => r(async () => {
@@ -673,7 +673,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 			};
 		}),
 		putStream: (e, t, i) => r(async () => {
-			let { container: r } = await n(), a = await we(t);
+			let { container: r } = await n(), a = await V(t);
 			return await r.getBlockBlobClient(e).uploadStream(a, 4194304, 5, { blobHTTPHeaders: { blobContentType: i.contentType } }), { size: i.totalSize ?? (await r.getBlockBlobClient(e).getProperties()).contentLength ?? 0 };
 		}),
 		getRange: (e, t, a) => r(async () => {
@@ -754,14 +754,14 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 	if (!n || !r) return !1;
 	let i = Buffer.from(r, "hex"), a = fe(e, n, i.length);
 	return a.length === i.length && L(a, i);
-}, Ye = (e) => Array.isArray(e) ? e.filter((e) => typeof e == "string") : [], Xe = (e) => Ye(e.metadata?.roles), Ze = (e) => Ye(e.scopes), Qe = (e, t) => e.some((e) => t.includes(e)), $e = (e) => Ye(e.metadata?.groups), et = (e) => typeof e == "boolean" ? x.succeed(e) : x.isEffect(e) ? e : x.promise(() => e), tt = (e, t, n = {}) => x.gen(function* () {
+}, Ye = (e) => Array.isArray(e) ? e.filter((e) => typeof e == "string") : [], Xe = (e) => Ye(e.metadata?.roles), Ze = (e) => Ye(e.scopes), Qe = (e, t) => e.some((e) => t.includes(e)), $e = (e) => Ye(e.metadata?.groups), et = (e) => typeof e == "boolean" ? b.succeed(e) : b.isEffect(e) ? e : b.promise(() => e), tt = (e, t, n = {}) => b.gen(function* () {
 	if (t.id && e.ownerId && t.id === e.ownerId) return !0;
 	let r = e.accessPolicy ?? [];
 	if (r.length === 0) return !1;
-	let i = n.resolveGroups ? yield* x.promise(async () => await n.resolveGroups(t)) : $e(t);
+	let i = n.resolveGroups ? yield* b.promise(async () => await n.resolveGroups(t)) : $e(t);
 	for (let a of r) if (yield* nt(a, e, t, i, n)) return !0;
 	return !1;
-}), nt = (e, t, n, r, i) => x.gen(function* () {
+}), nt = (e, t, n, r, i) => b.gen(function* () {
 	let a = !1, o = (e) => (a = !0, e);
 	if (e.owner !== void 0 && e.owner && !o(!!n.id && !!t.ownerId && n.id === t.ownerId) || e.tenant !== void 0 && e.tenant && !o(!!n.tenantId && n.tenantId === t.tenantId) || e.apiKey !== void 0 && e.apiKey && !o(n.type === "apiKey") || e.roles && e.roles.length > 0 && !o(Qe(Xe(n), e.roles)) || e.groups && e.groups.length > 0 && !o(Qe(r, e.groups)) || e.scopes && e.scopes.length > 0 && !o(Qe(Ze(n), e.scopes)) || e.password !== void 0 && e.password && !o(Je(i.password, t.passwordHash))) return !1;
 	if (e.guard) {
@@ -786,7 +786,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 }, it = (e, t, n, r, i) => {
 	let a = rt(t, n);
 	return e.some((e) => e.expiresAt && e.expiresAt.getTime() < i || r === "write" && e.permission !== "write" ? !1 : a.some((t) => t.type === e.principalType && t.id === e.principalId));
-}, at = (e, t) => t.resolveGroups ? x.promise(async () => await t.resolveGroups(e)) : x.succeed($e(e)), X = () => G.read("VOLTRO_STORAGE_SECRET") ?? ie(), Z = (e) => (typeof e == "string" ? Buffer.from(e, "utf8") : e).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, ""), Q = (e) => {
+}, at = (e, t) => t.resolveGroups ? b.promise(async () => await t.resolveGroups(e)) : b.succeed($e(e)), X = () => K.read("VOLTRO_STORAGE_SECRET") ?? ie(), Z = (e) => (typeof e == "string" ? Buffer.from(e, "utf8") : e).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, ""), Q = (e) => {
 	let t = e.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - e.length % 4) % 4);
 	return Buffer.from(t, "base64");
 }, ot = (e, t, n = X()) => {
@@ -1015,14 +1015,14 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 }, wt = (e) => e ?? "global", Tt = () => {
 	let e = /* @__PURE__ */ new Map(), t = /* @__PURE__ */ new Map();
 	return {
-		insert: (t) => x.sync(() => {
+		insert: (t) => b.sync(() => {
 			e.set(t.id, t);
 		}),
-		getById: (t) => x.sync(() => e.get(t) ?? null),
-		delete: (t) => x.sync(() => e.delete(t)),
-		listRecent: (t) => x.sync(() => [...e.values()].sort((e, t) => t.createdAt.getTime() - e.createdAt.getTime()).slice(0, t)),
-		countByKey: (t, n) => x.sync(() => [...e.values()].filter((e) => e.bucket === t && e.key === n).length),
-		usageByTenant: (t) => x.sync(() => {
+		getById: (t) => b.sync(() => e.get(t) ?? null),
+		delete: (t) => b.sync(() => e.delete(t)),
+		listRecent: (t) => b.sync(() => [...e.values()].sort((e, t) => t.createdAt.getTime() - e.createdAt.getTime()).slice(0, t)),
+		countByKey: (t, n) => b.sync(() => [...e.values()].filter((e) => e.bucket === t && e.key === n).length),
+		usageByTenant: (t) => b.sync(() => {
 			let n = 0, r = 0;
 			for (let i of e.values()) (i.tenantId ?? null) === (t ?? null) && (n += i.size, r++);
 			return {
@@ -1030,7 +1030,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 				count: r
 			};
 		}),
-		consumeUsage: (e, n, r) => x.sync(() => {
+		consumeUsage: (e, n, r) => b.sync(() => {
 			let i = wt(e), a = t.get(i) ?? {
 				bytes: 0,
 				count: 0
@@ -1044,15 +1044,15 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 				count: a.count
 			};
 		}),
-		releaseUsage: (e, n) => x.sync(() => {
+		releaseUsage: (e, n) => b.sync(() => {
 			let r = wt(e), i = t.get(r);
 			i && t.set(r, {
 				bytes: Math.max(0, i.bytes - n.bytes),
 				count: Math.max(0, i.count - n.count)
 			});
 		}),
-		listByDerivedFrom: (t) => x.sync(() => [...e.values()].filter((e) => (e.derivedFrom ?? null) === t)),
-		listRefs: (t) => x.sync(() => [...e.values()].filter((e) => Ct(e, t)).sort((e, t) => t.createdAt.getTime() - e.createdAt.getTime()).slice(t.offset, t.offset + t.limit))
+		listByDerivedFrom: (t) => b.sync(() => [...e.values()].filter((e) => (e.derivedFrom ?? null) === t)),
+		listRefs: (t) => b.sync(() => [...e.values()].filter((e) => Ct(e, t)).sort((e, t) => t.createdAt.getTime() - e.createdAt.getTime()).slice(t.offset, t.offset + t.limit))
 	};
 }, Et = (e) => Array.isArray(e) && e.every((e) => typeof e == "string") ? e : null, Dt = (e) => ({
 	id: String(e.id),
@@ -1077,7 +1077,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 	caption: e.caption ?? null,
 	derivedFrom: e.derivedFrom ?? null,
 	kind: e.kind ?? null
-}), $ = (e) => x.tryPromise({
+}), $ = (e) => b.tryPromise({
 	try: e,
 	catch: (e) => new t({
 		provider: "refstore",
@@ -1096,10 +1096,10 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 	skip: void 0,
 	projection: void 0
 }))[0] ?? null, kt = (e) => ({
-	insert: (t) => $(() => e.insert(V, { ...t })),
+	insert: (t) => $(() => e.insert(H, { ...t })),
 	getById: (t) => $(async () => {
 		let n = await e.query({
-			table: V,
+			table: H,
 			predicate: {
 				column: "id",
 				op: "eq",
@@ -1112,9 +1112,9 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 		});
 		return n[0] ? Dt(n[0]) : null;
 	}),
-	delete: (t) => $(() => e.delete(V, t)),
+	delete: (t) => $(() => e.delete(H, t)),
 	listRecent: (t) => $(async () => (await e.query({
-		table: V,
+		table: H,
 		predicate: void 0,
 		order: [{
 			column: "createdAt",
@@ -1125,7 +1125,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 		projection: void 0
 	})).map(Dt)),
 	countByKey: (t, n) => $(async () => (await e.query({
-		table: V,
+		table: H,
 		predicate: { and: [{
 			column: "bucket",
 			op: "eq",
@@ -1142,7 +1142,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 	})).length),
 	usageByTenant: (t) => $(async () => {
 		let n = await e.query({
-			table: V,
+			table: H,
 			predicate: {
 				column: "tenantId",
 				op: "eq",
@@ -1183,7 +1183,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 				let t = k({
 					kind: "typeid",
 					prefix: "susage"
-				}, W), r = await e.insertIgnore(W, {
+				}, G), r = await e.insertIgnore(G, {
 					id: t,
 					tenantId: i,
 					bytes: n.bytes,
@@ -1215,7 +1215,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 		throw Error(`storage usage release: contention on tenant '${r}' exceeded 32 attempts`);
 	}),
 	listByDerivedFrom: (t) => $(async () => (await e.query({
-		table: V,
+		table: H,
 		predicate: {
 			column: "derivedFrom",
 			op: "eq",
@@ -1242,7 +1242,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 		});
 		let r = n.length === 0 ? void 0 : n.length === 1 ? n[0] : { and: n };
 		return (await e.query({
-			table: V,
+			table: H,
 			predicate: r,
 			order: [{
 				column: "createdAt",
@@ -1256,15 +1256,15 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 }), At = () => {
 	let e = /* @__PURE__ */ new Map();
 	return {
-		insert: (t) => x.sync(() => {
+		insert: (t) => b.sync(() => {
 			e.set(t.id, t);
 		}),
-		delete: (t) => x.sync(() => {
+		delete: (t) => b.sync(() => {
 			e.delete(t);
 		}),
-		getById: (t) => x.sync(() => e.get(t) ?? null),
-		listByRef: (t) => x.sync(() => [...e.values()].filter((e) => e.refId === t)),
-		deleteByRef: (t) => x.sync(() => {
+		getById: (t) => b.sync(() => e.get(t) ?? null),
+		listByRef: (t) => b.sync(() => [...e.values()].filter((e) => e.refId === t)),
+		deleteByRef: (t) => b.sync(() => {
 			for (let [n, r] of e) r.refId === t && e.delete(n);
 		})
 	};
@@ -1278,11 +1278,11 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 	expiresAt: e.expiresAt ? e.expiresAt instanceof Date ? e.expiresAt : new Date(String(e.expiresAt)) : null,
 	createdBy: e.createdBy ?? null
 }), Mt = (e) => ({
-	insert: (t) => $(() => e.insert(H, { ...t })),
-	delete: (t) => $(() => e.delete(H, t)),
+	insert: (t) => $(() => e.insert(U, { ...t })),
+	delete: (t) => $(() => e.delete(U, t)),
 	getById: (t) => $(async () => {
 		let n = (await e.query({
-			table: H,
+			table: U,
 			predicate: {
 				column: "id",
 				op: "eq",
@@ -1296,7 +1296,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 		return n ? jt(n) : null;
 	}),
 	listByRef: (t) => $(async () => (await e.query({
-		table: H,
+		table: U,
 		predicate: {
 			column: "refId",
 			op: "eq",
@@ -1312,7 +1312,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 	})).map(jt)),
 	deleteByRef: (t) => $(async () => {
 		let n = await e.query({
-			table: H,
+			table: U,
 			predicate: {
 				column: "refId",
 				op: "eq",
@@ -1323,38 +1323,47 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 			skip: void 0,
 			projection: void 0
 		});
-		for (let t of n) await e.delete(H, String(t.id));
+		for (let t of n) await e.delete(U, String(t.id));
 	})
 }), Nt = () => k({
 	kind: "typeid",
 	prefix: "file"
-}, V), Pt = () => k({
+}, H), Pt = () => k({
 	kind: "typeid",
 	prefix: "grant"
-}, H), Ft = (i) => {
-	let { provider: a, refStore: o, grantStore: s, bucket: c } = i, l = i.access ?? {}, u = i.attempts ?? 3, d = i.urlExpiresInSec ?? 3600, f = (e) => St(i.publicBaseUrl, e), p = w.recurs(Math.max(0, u - 1)).pipe(w.intersect(w.exponential("100 millis")), w.whileInput((e) => e.transient)), m = (e, t, n) => [
+}, U), Ft = (i) => {
+	let { provider: a, refStore: o, grantStore: s, bucket: c } = i, l = i.access ?? {}, u = i.attempts ?? 3, d = i.urlExpiresInSec ?? 3600, f = (e) => St(i.publicBaseUrl, e), p = C.recurs(Math.max(0, u - 1)).pipe(C.intersect(C.exponential("100 millis")), C.whileInput((e) => e.transient)), m = (e, t, n) => [
 		i.tenantPrefix,
 		e ?? "global",
 		n ?? t
-	].filter(Boolean).join("/"), h = (e, t, n) => [
+	].filter(Boolean).join("/"), ee = (e) => {
+		if (e === void 0) return b.succeed(void 0);
+		let n = e.length === 0 ? "empty" : e.includes("\0") ? "contains NUL" : e.startsWith("/") || e.startsWith("\\") ? "starts with a path separator" : e.includes("\\") ? "contains a backslash" : e.split("/").some((e) => e === "" || e === "." || e === "..") ? "contains an empty, \".\" or \"..\" segment" : void 0;
+		return n === void 0 ? b.succeed(e) : b.fail(new t({
+			provider: a.name,
+			message: `storage key rejected: ${n}`,
+			transient: !1,
+			status: 400
+		}));
+	}, h = (e, t, n) => [
 		i.tenantPrefix,
 		e ?? "global",
 		"_incoming",
 		t,
 		String(n).padStart(6, "0")
-	].filter(Boolean).join("/"), g = (e, n) => n !== void 0 && e.tenantId !== n ? x.fail(new t({
+	].filter(Boolean).join("/"), g = (e, n) => n !== void 0 && e.tenantId !== n ? b.fail(new t({
 		provider: a.name,
 		message: "cross-tenant access denied",
 		transient: !1,
 		status: 403
-	})) : x.succeed(e), _ = (e, n) => o.getById(e).pipe(x.flatMap((r) => r ? g(r, n) : x.fail(new t({
+	})) : b.succeed(e), _ = (e, n) => o.getById(e).pipe(b.flatMap((r) => r ? g(r, n) : b.fail(new t({
 		provider: a.name,
 		message: `no ref '${e}'`,
 		transient: !1,
 		status: 404
-	})))), ee = (e) => x.suspend(() => {
+	})))), te = (e) => b.suspend(() => {
 		let n = i.scan(e);
-		return x.isEffect(n) ? n : x.tryPromise({
+		return b.isEffect(n) ? n : b.tryPromise({
 			try: () => Promise.resolve(n),
 			catch: (e) => new t({
 				provider: "scan",
@@ -1362,45 +1371,45 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 				transient: !0
 			})
 		});
-	}), te = (e) => x.suspend(() => {
+	}), ne = (e) => b.suspend(() => {
 		let t = e.contentType;
-		if (!i.videoProbe || !(t.startsWith("video/") || t.startsWith("audio/"))) return x.succeed(null);
+		if (!i.videoProbe || !(t.startsWith("video/") || t.startsWith("audio/"))) return b.succeed(null);
 		let n;
 		try {
 			n = i.videoProbe(e);
 		} catch {
-			return x.succeed(null);
+			return b.succeed(null);
 		}
-		return x.isEffect(n) ? n.pipe(x.catchAll(() => x.succeed(null))) : x.tryPromise({
+		return b.isEffect(n) ? n.pipe(b.catchAll(() => b.succeed(null))) : b.tryPromise({
 			try: () => Promise.resolve(n),
 			catch: () => null
-		}).pipe(x.catchAll(() => x.succeed(null)));
-	}), v = (e) => x.gen(function* () {
+		}).pipe(b.catchAll(() => b.succeed(null)));
+	}), v = (e) => b.gen(function* () {
 		let t = yt(e.bytes, e.contentType, i.limits);
-		if (t) return yield* x.fail(new n(t));
+		if (t) return yield* b.fail(new n(t));
 		if (i.scan) {
-			let t = yield* ee({
+			let t = yield* te({
 				bytes: e.bytes,
 				contentType: e.contentType,
 				...e.key ? { key: e.key } : {}
 			});
-			if (!t.clean) return yield* x.fail(new r({ threat: t.threat ?? "unknown" }));
+			if (!t.clean) return yield* b.fail(new r({ threat: t.threat ?? "unknown" }));
 		}
-		let s = yield* x.promise(() => bt(e.bytes, e.contentType, { normalize: i.normalizeImages ?? !1 })), l = s.bytes, u = yield* te({
+		let s = yield* b.promise(() => bt(e.bytes, e.contentType, { normalize: i.normalizeImages ?? !1 })), l = s.bytes, u = yield* ne({
 			bytes: l,
 			contentType: e.contentType
-		}), d = s.width ?? u?.width, f = s.height ?? u?.height, h = s.placeholder ?? u?.poster, g = e.duration ?? u?.duration, _ = yield* x.promise(() => xt(l)), v = e.tenantId ?? null, y = e.visibility ?? "private", C = m(v, _, e.key), w = {
+		}), d = s.width ?? u?.width, f = s.height ?? u?.height, h = s.placeholder ?? u?.poster, g = e.duration ?? u?.duration, _ = yield* b.promise(() => xt(l)), v = e.tenantId ?? null, y = e.visibility ?? "private", C = m(v, _, yield* ee(e.key)), w = {
 			bytes: l.byteLength,
 			count: 1
 		}, T = yield* o.consumeUsage(v, w, i.quota);
 		if (!T.allowed) {
 			let e = i.quota ?? {}, t = e.maxCount !== void 0 && T.count + 1 > e.maxCount ? `tenant object count ${T.count} + 1 exceeds max ${e.maxCount}` : `tenant usage ${T.bytes} + ${l.byteLength} bytes exceeds max ${e.maxBytes}`;
-			return yield* x.fail(new n({
+			return yield* b.fail(new n({
 				reason: "quota-exceeded",
 				detail: t
 			}));
 		}
-		let ne = e.password ? yield* x.sync(() => qe(e.password)) : null, E = {
+		let re = e.password ? yield* b.sync(() => qe(e.password)) : null, E = {
 			id: Nt(),
 			tenantId: v,
 			ownerId: e.ownerId ?? null,
@@ -1411,7 +1420,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 			checksum: _,
 			visibility: y,
 			accessPolicy: e.access ?? null,
-			passwordHash: ne,
+			passwordHash: re,
 			createdAt: /* @__PURE__ */ new Date(),
 			...d === void 0 ? {} : { width: d },
 			...f === void 0 ? {} : { height: f },
@@ -1424,25 +1433,25 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 			...e.derivedFrom === void 0 ? {} : { derivedFrom: e.derivedFrom },
 			...e.kind === void 0 ? {} : { kind: e.kind }
 		};
-		return yield* ((e) => e.pipe(x.onExit((e) => S.isSuccess(e) ? x.void : o.delete(E.id).pipe(x.zipRight(o.releaseUsage(v, w)), x.ignore))))(o.insert(E).pipe(x.zipRight(a.put(C, l, {
+		return yield* ((e) => e.pipe(b.onExit((e) => x.isSuccess(e) ? b.void : o.delete(E.id).pipe(b.zipRight(o.releaseUsage(v, w)), b.ignore))))(o.insert(E).pipe(b.zipRight(a.put(C, l, {
 			contentType: e.contentType,
 			public: y === "public"
-		}).pipe(x.retry(p))))), i.transcode !== void 0 && i.autoTranscode !== !1 && E.derivedFrom == null && (e.contentType.startsWith("video/") || e.contentType.startsWith("audio/")) && (yield* x.forkDaemon(b(E).pipe(x.ignore))), E;
-	}), y = (e) => x.suspend(() => {
-		if (!i.transcode) return x.succeed([]);
+		}).pipe(b.retry(p))))), i.transcode !== void 0 && i.autoTranscode !== !1 && E.derivedFrom == null && (e.contentType.startsWith("video/") || e.contentType.startsWith("audio/")) && (yield* b.forkDaemon(S(E).pipe(b.ignore))), E;
+	}), y = (e) => b.suspend(() => {
+		if (!i.transcode) return b.succeed([]);
 		let t;
 		try {
 			t = i.transcode(e);
 		} catch {
-			return x.succeed([]);
+			return b.succeed([]);
 		}
-		return x.isEffect(t) ? t.pipe(x.catchAll(() => x.succeed([]))) : x.tryPromise({
+		return b.isEffect(t) ? t.pipe(b.catchAll(() => b.succeed([]))) : b.tryPromise({
 			try: () => Promise.resolve(t),
 			catch: () => []
-		}).pipe(x.catchAll(() => x.succeed([])));
-	}), b = (e) => x.gen(function* () {
+		}).pipe(b.catchAll(() => b.succeed([])));
+	}), S = (e) => b.gen(function* () {
 		if (!i.transcode || e.derivedFrom != null) return [];
-		let t = yield* a.get(e.key).pipe(x.retry(p)), n = yield* y({
+		let t = yield* a.get(e.key).pipe(b.retry(p)), n = yield* y({
 			bytes: t.bytes,
 			contentType: e.contentType,
 			ref: e
@@ -1461,7 +1470,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 			r.push(n);
 		}
 		return r;
-	}), C = (e, t, n) => x.gen(function* () {
+	}), w = (e, t, n) => b.gen(function* () {
 		if (e.visibility === "public" || (yield* tt(e, t, {
 			...l,
 			...n?.password === void 0 ? {} : { password: n.password }
@@ -1477,65 +1486,65 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 	};
 	return {
 		put: v,
-		get: (e, t) => _(e, t?.tenantId).pipe(x.flatMap((e) => a.get(e.key).pipe(x.retry(p), x.map((t) => ({
+		get: (e, t) => _(e, t?.tenantId).pipe(b.flatMap((e) => a.get(e.key).pipe(b.retry(p), b.map((t) => ({
 			bytes: t.bytes,
 			ref: e
 		}))))),
-		getRange: (e, n, r) => _(e, r?.tenantId).pipe(x.flatMap((e) => {
+		getRange: (e, n, r) => _(e, r?.tenantId).pipe(b.flatMap((e) => {
 			let r = e.size, i = Math.max(0, Math.trunc(n.start));
-			if (r > 0 && i >= r) return x.fail(new t({
+			if (r > 0 && i >= r) return b.fail(new t({
 				provider: a.name,
 				message: `range start ${i} past end ${r}`,
 				transient: !1,
 				status: 416
 			}));
 			let o = Math.min(Math.trunc(n.endInclusive), Math.max(0, r - 1));
-			return o < i ? x.fail(new t({
+			return o < i ? b.fail(new t({
 				provider: a.name,
 				message: `empty range ${i}-${o}`,
 				transient: !1,
 				status: 416
-			})) : (a.getRange ? a.getRange(e.key, i, o).pipe(x.retry(p)) : a.get(e.key).pipe(x.retry(p), x.map((e) => e.bytes.subarray(i, o + 1)))).pipe(x.map((t) => ({
+			})) : (a.getRange ? a.getRange(e.key, i, o).pipe(b.retry(p)) : a.get(e.key).pipe(b.retry(p), b.map((e) => e.bytes.subarray(i, o + 1)))).pipe(b.map((t) => ({
 				bytes: t,
 				ref: e,
 				totalSize: r
 			})));
 		})),
-		getUrl: (e, t) => _(e, t?.tenantId).pipe(x.flatMap((e) => e.visibility === "public" ? x.succeed(T(e)) : a.presigns ? a.getUrl(e.key, t?.expiresInSec ?? d) : x.succeed(f(e.id)))),
-		head: (e, t) => o.getById(e).pipe(x.flatMap((e) => e ? g(e, t?.tenantId).pipe(x.map((e) => e)) : x.succeed(null))),
-		delete: (e, t) => _(e, t?.tenantId).pipe(x.flatMap((t) => s.deleteByRef(e).pipe(x.flatMap(() => o.delete(e)), x.flatMap((e) => e ? o.countByKey(t.bucket, t.key).pipe(x.flatMap((e) => e === 0 ? a.delete(t.key).pipe(x.retry(p)) : x.void), x.flatMap(() => o.releaseUsage(t.tenantId, {
+		getUrl: (e, t) => _(e, t?.tenantId).pipe(b.flatMap((e) => e.visibility === "public" ? b.succeed(T(e)) : a.presigns ? a.getUrl(e.key, t?.expiresInSec ?? d) : b.succeed(f(e.id)))),
+		head: (e, t) => o.getById(e).pipe(b.flatMap((e) => e ? g(e, t?.tenantId).pipe(b.map((e) => e)) : b.succeed(null))),
+		delete: (e, t) => _(e, t?.tenantId).pipe(b.flatMap((t) => s.deleteByRef(e).pipe(b.flatMap(() => o.delete(e)), b.flatMap((e) => e ? o.countByKey(t.bucket, t.key).pipe(b.flatMap((e) => e === 0 ? a.delete(t.key).pipe(b.retry(p)) : b.void), b.flatMap(() => o.releaseUsage(t.tenantId, {
 			bytes: t.size,
 			count: 1
-		}))) : x.void), x.asVoid))),
-		mintUrl: (n, r, i) => x.gen(function* () {
-			let s = yield* o.getById(n).pipe(x.flatMap((e) => e ? x.succeed(e) : x.fail(new t({
+		}))) : b.void), b.asVoid))),
+		mintUrl: (n, r, i) => b.gen(function* () {
+			let s = yield* o.getById(n).pipe(b.flatMap((e) => e ? b.succeed(e) : b.fail(new t({
 				provider: a.name,
 				message: `no ref '${n}'`,
 				transient: !1,
 				status: 404
 			}))));
 			if (s.visibility === "public") return T(s);
-			if (!(yield* C(s, r, i?.password === void 0 ? {} : { password: i.password }))) return yield* x.fail(new e({
+			if (!(yield* w(s, r, i?.password === void 0 ? {} : { password: i.password }))) return yield* b.fail(new e({
 				refId: n,
 				reason: "access denied"
 			}));
 			let c = i?.expiresInSec ?? d;
 			if (a.presigns) return yield* a.getUrl(s.key, c);
-			let l = yield* x.sync(() => ot(s.id, c));
+			let l = yield* b.sync(() => ot(s.id, c));
 			return `${f(s.id)}?t=${l}`;
 		}),
-		mintUploadUrl: (e) => x.gen(function* () {
-			if (!a.getUploadUrl) return yield* x.fail(new t({
+		mintUploadUrl: (e) => b.gen(function* () {
+			if (!a.getUploadUrl) return yield* b.fail(new t({
 				provider: a.name,
 				message: `provider '${a.name}' does not support presigned uploads`,
 				transient: !1,
 				status: 400
 			}));
-			let n = m(e.tenantId ?? null, "", e.key);
+			let n = m(e.tenantId ?? null, "", yield* ee(e.key));
 			return yield* a.getUploadUrl(n, e.expiresInSec ?? d, e.contentType);
 		}),
-		checkAccess: C,
-		grant: (e) => x.gen(function* () {
+		checkAccess: w,
+		grant: (e) => b.gen(function* () {
 			let t = {
 				id: Pt(),
 				refId: e.refId,
@@ -1548,7 +1557,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 			};
 			return yield* s.insert(t), t;
 		}),
-		listRefs: (e) => x.suspend(() => {
+		listRefs: (e) => b.suspend(() => {
 			let t = Math.min(500, Math.max(1, Math.trunc(e?.limit ?? 50))), n = Math.max(0, Math.trunc(e?.offset ?? 0)), r = {
 				tenantId: e && "tenantId" in e ? e.tenantId : void 0,
 				folder: e?.folder,
@@ -1558,7 +1567,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 				limit: t + 1,
 				offset: n
 			};
-			return o.listRefs(r).pipe(x.map((e) => {
+			return o.listRefs(r).pipe(b.map((e) => {
 				let r = e.length > t;
 				return {
 					refs: r ? e.slice(0, t) : e,
@@ -1570,19 +1579,19 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 		getGrant: (e) => s.getById(e),
 		listGrants: (e) => s.listByRef(e),
 		usage: (e) => o.usageByTenant(e),
-		sweepOrphans: (e) => x.gen(function* () {
+		sweepOrphans: (e) => b.gen(function* () {
 			let t = e?.limit ?? 1e3, n = e?.dryRun ?? !1, r = yield* o.listRecent(t), i = [];
-			for (let e of r) (yield* a.head(e.key).pipe(x.catchAll(() => x.succeed(null)))) === null && (n || (yield* o.delete(e.id).pipe(x.catchAll(() => x.succeed(!1)))) && (yield* o.releaseUsage(e.tenantId, {
+			for (let e of r) (yield* a.head(e.key).pipe(b.catchAll(() => b.succeed(null)))) === null && (n || (yield* o.delete(e.id).pipe(b.catchAll(() => b.succeed(!1)))) && (yield* o.releaseUsage(e.tenantId, {
 				bytes: e.size,
 				count: 1
-			}).pipe(x.ignore)), i.push(e.id));
+			}).pipe(b.ignore)), i.push(e.id));
 			return {
 				scanned: r.length,
 				removed: i
 			};
 		}),
-		ingestUrl: (e, n) => x.gen(function* () {
-			let r = yield* x.tryPromise({
+		ingestUrl: (e, n) => b.gen(function* () {
+			let r = yield* b.tryPromise({
 				try: () => fetch(e),
 				catch: (e) => new t({
 					provider: "ingest",
@@ -1590,13 +1599,13 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 					transient: !0
 				})
 			});
-			if (!r.ok) return yield* x.fail(new t({
+			if (!r.ok) return yield* b.fail(new t({
 				provider: "ingest",
 				message: `fetch ${e} → ${r.status}`,
 				transient: r.status >= 500,
 				status: r.status
 			}));
-			let i = yield* x.tryPromise({
+			let i = yield* b.tryPromise({
 				try: () => r.arrayBuffer(),
 				catch: (e) => new t({
 					provider: "ingest",
@@ -1617,8 +1626,8 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 				...n?.caption === void 0 ? {} : { caption: n.caption }
 			});
 		}),
-		mintPresignedUpload: (e) => x.gen(function* () {
-			if (!a.getUploadUrl) return yield* x.fail(new t({
+		mintPresignedUpload: (e) => b.gen(function* () {
+			if (!a.getUploadUrl) return yield* b.fail(new t({
 				provider: a.name,
 				message: `provider '${a.name}' does not support presigned uploads`,
 				transient: !1,
@@ -1627,14 +1636,14 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 			let n = e.expiresInSec ?? d, r = `_incoming/${k({
 				kind: "typeid",
 				prefix: "up"
-			}, V)}`, i = m(e.tenantId ?? null, "", r);
+			}, H)}`, i = m(e.tenantId ?? null, "", r);
 			return {
 				uploadUrl: yield* a.getUploadUrl(i, n, e.contentType),
 				key: i,
 				expiresInSec: n
 			};
 		}),
-		finalizeUpload: (e) => a.get(e.key).pipe(x.retry(p), x.flatMap((t) => v({
+		finalizeUpload: (e) => a.get(e.key).pipe(b.retry(p), b.flatMap((t) => v({
 			bytes: t.bytes,
 			contentType: e.contentType,
 			...e.tenantId === void 0 ? {} : { tenantId: e.tenantId },
@@ -1644,12 +1653,12 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 			...e.tags === void 0 ? {} : { tags: e.tags },
 			...e.alt === void 0 ? {} : { alt: e.alt },
 			...e.caption === void 0 ? {} : { caption: e.caption }
-		})), x.ensuring(a.delete(e.key).pipe(x.retry(p), x.ignore))),
-		putResumableChunk: (e) => a.put(h(e.tenantId ?? null, e.uploadId, e.index), e.bytes, { contentType: "application/octet-stream" }).pipe(x.retry(p), x.asVoid),
-		resumableStatus: (e) => x.gen(function* () {
+		})), b.ensuring(a.delete(e.key).pipe(b.retry(p), b.ignore))),
+		putResumableChunk: (e) => a.put(h(e.tenantId ?? null, e.uploadId, e.index), e.bytes, { contentType: "application/octet-stream" }).pipe(b.retry(p), b.asVoid),
+		resumableStatus: (e) => b.gen(function* () {
 			let t = 0, n = 0;
 			for (; t < 1e6;) {
-				let r = yield* a.head(h(e.tenantId ?? null, e.uploadId, t)).pipe(x.retry(p), x.catchAll(() => x.succeed(null)));
+				let r = yield* a.head(h(e.tenantId ?? null, e.uploadId, t)).pipe(b.retry(p), b.catchAll(() => b.succeed(null)));
 				if (r === null) break;
 				n += r.size, t += 1;
 			}
@@ -1658,15 +1667,15 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 				nextIndex: t
 			};
 		}),
-		finalizeResumable: (e) => x.gen(function* () {
+		finalizeResumable: (e) => b.gen(function* () {
 			let t = [];
 			for (let n = 0; n < e.count; n++) {
-				let r = yield* a.get(h(e.tenantId ?? null, e.uploadId, n)).pipe(x.retry(p));
+				let r = yield* a.get(h(e.tenantId ?? null, e.uploadId, n)).pipe(b.retry(p));
 				t.push(r.bytes);
 			}
 			let n = t.reduce((e, t) => e + t.byteLength, 0), r = new Uint8Array(n), i = 0;
 			for (let e of t) r.set(e, i), i += e.byteLength;
-			let o = x.forEach(Array.from({ length: e.count }, (e, t) => t), (t) => a.delete(h(e.tenantId ?? null, e.uploadId, t)).pipe(x.retry(p), x.ignore), { discard: !0 });
+			let o = b.forEach(Array.from({ length: e.count }, (e, t) => t), (t) => a.delete(h(e.tenantId ?? null, e.uploadId, t)).pipe(b.retry(p), b.ignore), { discard: !0 });
 			return yield* v({
 				bytes: r,
 				contentType: e.contentType,
@@ -1677,12 +1686,12 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 				...e.tags === void 0 ? {} : { tags: e.tags },
 				...e.alt === void 0 ? {} : { alt: e.alt },
 				...e.caption === void 0 ? {} : { caption: e.caption }
-			}).pipe(x.ensuring(o));
+			}).pipe(b.ensuring(o));
 		}),
-		transcode: (e, t) => _(e, t?.tenantId).pipe(x.flatMap((e) => b(e))),
-		renditions: (e, t) => _(e, t?.tenantId).pipe(x.flatMap(() => o.listByDerivedFrom(e))),
-		beginMultipartUpload: (e) => x.gen(function* () {
-			if (!a.createMultipartUpload || !a.presignUploadPart || !a.completeMultipartUpload) return yield* x.fail(new t({
+		transcode: (e, t) => _(e, t?.tenantId).pipe(b.flatMap((e) => S(e))),
+		renditions: (e, t) => _(e, t?.tenantId).pipe(b.flatMap(() => o.listByDerivedFrom(e))),
+		beginMultipartUpload: (e) => b.gen(function* () {
+			if (!a.createMultipartUpload || !a.presignUploadPart || !a.completeMultipartUpload) return yield* b.fail(new t({
 				provider: a.name,
 				message: `provider '${a.name}' does not support multipart uploads`,
 				transient: !1,
@@ -1691,30 +1700,30 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 			let n = m(e.tenantId ?? null, "", `multipart/${k({
 				kind: "typeid",
 				prefix: "mp"
-			}, V)}`);
+			}, H)}`);
 			return {
 				uploadId: (yield* a.createMultipartUpload(n, e.contentType, { public: (e.visibility ?? "private") === "public" })).uploadId,
 				key: n
 			};
 		}),
-		signMultipartPart: (e) => x.suspend(() => a.presignUploadPart ? a.presignUploadPart(e.key, e.uploadId, e.partNumber, e.expiresInSec ?? d) : x.fail(new t({
+		signMultipartPart: (e) => b.suspend(() => a.presignUploadPart ? a.presignUploadPart(e.key, e.uploadId, e.partNumber, e.expiresInSec ?? d) : b.fail(new t({
 			provider: a.name,
 			message: "provider does not support multipart uploads",
 			transient: !1,
 			status: 400
 		}))),
-		completeMultipart: (e) => x.gen(function* () {
-			if (!a.completeMultipartUpload) return yield* x.fail(new t({
+		completeMultipart: (e) => b.gen(function* () {
+			if (!a.completeMultipartUpload) return yield* b.fail(new t({
 				provider: a.name,
 				message: "provider does not support multipart uploads",
 				transient: !1,
 				status: 400
 			}));
-			let r = yield* a.completeMultipartUpload(e.key, e.uploadId, e.parts), s = yield* a.head(e.key).pipe(x.retry(p)), l = s?.size ?? 0, u = (r.etag ?? s?.etag ?? "").replace(/"/g, ""), d = e.tenantId ?? null, f = {
+			let r = yield* a.completeMultipartUpload(e.key, e.uploadId, e.parts), s = yield* a.head(e.key).pipe(b.retry(p)), l = s?.size ?? 0, u = (r.etag ?? s?.etag ?? "").replace(/"/g, ""), d = e.tenantId ?? null, f = {
 				bytes: l,
 				count: 1
 			};
-			if (!(yield* o.consumeUsage(d, f, i.quota)).allowed) return yield* a.delete(e.key).pipe(x.retry(p), x.ignore), yield* x.fail(new n({
+			if (!(yield* o.consumeUsage(d, f, i.quota)).allowed) return yield* a.delete(e.key).pipe(b.retry(p), b.ignore), yield* b.fail(new n({
 				reason: "quota-exceeded",
 				detail: `multipart upload of ${l} bytes exceeds tenant quota`
 			}));
@@ -1736,11 +1745,11 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 				...e.alt === void 0 ? {} : { alt: e.alt },
 				...e.caption === void 0 ? {} : { caption: e.caption }
 			};
-			return yield* o.insert(m).pipe(x.onExit((e) => S.isSuccess(e) ? x.void : o.releaseUsage(d, f).pipe(x.ignore))), m;
+			return yield* o.insert(m).pipe(b.onExit((e) => x.isSuccess(e) ? b.void : o.releaseUsage(d, f).pipe(b.ignore))), m;
 		}),
-		abortMultipart: (e) => x.suspend(() => a.abortMultipartUpload ? a.abortMultipartUpload(e.key, e.uploadId).pipe(x.retry(p)) : x.void)
+		abortMultipart: (e) => b.suspend(() => a.abortMultipartUpload ? a.abortMultipartUpload(e.key, e.uploadId).pipe(b.retry(p)) : b.void)
 	};
-}, It = (e) => C.succeed(i, Ft(e)), Lt = (e, t = 65536) => {
+}, It = (e) => S.succeed(i, Ft(e)), Lt = (e, t = 65536) => {
 	let n = [Buffer.from("zINSTREAM\0", "utf8")];
 	for (let r = 0; r < e.length; r += t) {
 		let i = e.subarray(r, Math.min(r + t, e.length)), a = Buffer.alloc(4);
@@ -1758,7 +1767,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 	};
 	throw Error(`clamav: unexpected response: ${t}`);
 }, zt = async (e, t) => {
-	let n = await import("node:net"), r = G.read("CLAMAV_HOST", t.host) ?? "127.0.0.1", i = G.read("CLAMAV_PORT"), a = t.port ?? (i ? Number(i) : 3310), o = t.timeoutMs ?? 3e4;
+	let n = await import("node:net"), r = K.read("CLAMAV_HOST", t.host) ?? "127.0.0.1", i = K.read("CLAMAV_PORT"), a = t.port ?? (i ? Number(i) : 3310), o = t.timeoutMs ?? 3e4;
 	return new Promise((i, s) => {
 		let c = n.createConnection({
 			host: r,
@@ -1830,7 +1839,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 //#endregion
 //#region src/assetRef.ts
 function Ut(e = {}) {
-	let t = e.nullable ?? !0, n = e.fk === !1 ? P().externalId() : ce(() => De, { onDelete: e.onDelete ?? "setNull" });
+	let t = e.nullable ?? !0, n = e.fk === !1 ? P().externalId() : ce(() => Ee, { onDelete: e.onDelete ?? "setNull" });
 	return t ? n.nullable() : n;
 }
 var Wt = () => se({
@@ -1851,8 +1860,8 @@ var Wt = () => se({
 		bytes: r ? new Uint8Array(Buffer.from(i, "base64")) : new Uint8Array(Buffer.from(decodeURIComponent(i), "utf8")),
 		contentType: n
 	};
-}, qt = (e, n) => x.gen(function* () {
-	let r = yield* x.try({
+}, qt = (e, n) => b.gen(function* () {
+	let r = yield* b.try({
 		try: () => Kt(n.dataUri),
 		catch: (e) => new t({
 			provider: "avatar",
@@ -1880,15 +1889,15 @@ var Wt = () => se({
 	if (Jt(e) === "same-device-as-root") return `the capture is going to ${e}, which is on the SAME filesystem as \`/\`.\n  A mounted volume would be a separate one. If this process is a container, that means the capture
   dies with it — which is the exact failure it exists for. On a development machine this is normal
   and can be ignored.`;
-}, Xt = G.read("VOLTRO_SESSION_COOKIE") ?? "voltro:session", Zt, Qt = (e) => {
+}, Xt = K.read("VOLTRO_SESSION_COOKIE") ?? "voltro:session", Zt, Qt = (e) => {
 	Zt = e;
-}, $t = () => Zt ?? tn({}), en = () => Zt === void 0 ? G.read("STORAGE_PROVIDER") === void 0 ? void 0 : tn({}) : Zt, tn = (e) => {
+}, $t = () => Zt ?? tn({}), en = () => Zt === void 0 ? K.read("STORAGE_PROVIDER") === void 0 ? void 0 : tn({}) : Zt, tn = (e) => {
 	if (e.provider && typeof e.provider == "object") return e.provider;
-	let t = (e.provider ?? G.read("STORAGE_PROVIDER") ?? "memory").toLowerCase(), n = G.read("S3_BUCKET", e.bucket) ?? G.read("STORAGE_BUCKET") ?? "voltro";
+	let t = (e.provider ?? K.read("STORAGE_PROVIDER") ?? "memory").toLowerCase(), n = K.read("S3_BUCKET", e.bucket) ?? K.read("STORAGE_BUCKET") ?? "voltro";
 	switch (t) {
 		case "s3":
 		case "minio": {
-			let r = G.read("S3_REGION", e.region) ?? G.read("AWS_REGION"), i = G.read("S3_ENDPOINT", e.endpoint) ?? G.read("MINIO_ENDPOINT"), a = G.read("S3_ACCESS_KEY_ID", e.accessKeyId) ?? G.read("AWS_ACCESS_KEY_ID"), o = G.read("S3_SECRET_ACCESS_KEY", e.secretAccessKey) ?? G.read("AWS_SECRET_ACCESS_KEY"), s = G.read("STORAGE_CDN_URL", e.cdnBaseUrl);
+			let r = K.read("S3_REGION", e.region) ?? K.read("AWS_REGION"), i = K.read("S3_ENDPOINT", e.endpoint) ?? K.read("MINIO_ENDPOINT"), a = K.read("S3_ACCESS_KEY_ID", e.accessKeyId) ?? K.read("AWS_ACCESS_KEY_ID"), o = K.read("S3_SECRET_ACCESS_KEY", e.secretAccessKey) ?? K.read("AWS_SECRET_ACCESS_KEY"), s = K.read("STORAGE_CDN_URL", e.cdnBaseUrl);
 			return Ie({
 				bucket: n,
 				name: t,
@@ -1898,13 +1907,13 @@ var Wt = () => se({
 				...o ? { secretAccessKey: o } : {},
 				...s ? { cdnBaseUrl: s } : {},
 				...e.publicAcl === void 0 ? {} : { publicAcl: e.publicAcl },
-				...t === "minio" || G.read("S3_FORCE_PATH_STYLE") === "1" ? { forcePathStyle: !0 } : {}
+				...t === "minio" || K.read("S3_FORCE_PATH_STYLE") === "1" ? { forcePathStyle: !0 } : {}
 			});
 		}
 		case "azure": {
-			let t = G.read("AZURE_STORAGE_ACCOUNT", e.accountName), r = G.read("AZURE_STORAGE_KEY", e.accountKey), i = G.read("AZURE_STORAGE_CONNECTION_STRING", e.connectionString), a = G.read("AZURE_STORAGE_ENDPOINT", e.endpoint), o = G.read("STORAGE_CDN_URL", e.cdnBaseUrl);
+			let t = K.read("AZURE_STORAGE_ACCOUNT", e.accountName), r = K.read("AZURE_STORAGE_KEY", e.accountKey), i = K.read("AZURE_STORAGE_CONNECTION_STRING", e.connectionString), a = K.read("AZURE_STORAGE_ENDPOINT", e.endpoint), o = K.read("STORAGE_CDN_URL", e.cdnBaseUrl);
 			return ze({
-				container: G.read("AZURE_STORAGE_CONTAINER", e.bucket) ?? n,
+				container: K.read("AZURE_STORAGE_CONTAINER", e.bucket) ?? n,
 				...t ? { accountName: t } : {},
 				...r ? { accountKey: r } : {},
 				...i ? { connectionString: i } : {},
@@ -1913,12 +1922,12 @@ var Wt = () => se({
 			});
 		}
 		case "database": return Re();
-		case "filesystem": return Fe({ root: G.read("STORAGE_ROOT", e.root) ?? ".voltro-storage" });
+		case "filesystem": return Fe({ root: K.read("STORAGE_ROOT", e.root) ?? ".voltro-storage" });
 		default: return Pe(e.name ?? "default");
 	}
 }, nn = (e) => {
 	if (e !== void 0) return e;
-	let t = G.read("STORAGE_ALLOWED_ORIGINS");
+	let t = K.read("STORAGE_ALLOWED_ORIGINS");
 	return t ? t.trim() === "*" ? "*" : t.split(",").map((e) => e.trim()).filter(Boolean) : [];
 }, rn = (e, t) => {
 	if (!e || t !== "*" && !t.includes(e)) return {};
@@ -1960,9 +1969,9 @@ var Wt = () => se({
 	status: 403
 }), sn = (e, t, n) => {
 	let r = n.request.subject;
-	return (r.scopes ?? []).includes("admin:full") ? x.void : e.head(t, { tenantId: r.tenantId ?? null }).pipe(x.catchAll(() => x.fail(on())), x.flatMap((e) => {
+	return (r.scopes ?? []).includes("admin:full") ? b.void : e.head(t, { tenantId: r.tenantId ?? null }).pipe(b.catchAll(() => b.fail(on())), b.flatMap((e) => {
 		let t = e?.ownerId;
-		return t != null && t === r.id ? x.void : x.fail(on());
+		return t != null && t === r.id ? b.void : b.fail(on());
 	}));
 }, cn = (e) => ({
 	id: e.id,
@@ -1974,9 +1983,9 @@ var Wt = () => se({
 	expiresAt: e.expiresAt ? e.expiresAt.toISOString() : null,
 	createdBy: e.createdBy
 }), ln = "@voltro/plugin-storage", un = (i = {}) => {
-	let b = tn(i);
-	Qt(b);
-	let S = G.read("S3_BUCKET", i.bucket) ?? G.read("STORAGE_BUCKET") ?? "voltro", C = G.read("VOLTRO_PUBLIC_URL", i.publicBaseUrl), w = nn(i.allowedOrigins), T = i.limits?.maxBytes, D = 5242880, oe = 21600, O = i.refStore === void 0 || i.refStore === "memory", k = i.grantStore === void 0 || i.grantStore === "memory", A = { current: O ? Tt() : i.refStore }, j = { current: k ? At() : i.grantStore }, M = {
+	let y = tn(i);
+	Qt(y);
+	let x = K.read("S3_BUCKET", i.bucket) ?? K.read("STORAGE_BUCKET") ?? "voltro", S = K.read("VOLTRO_PUBLIC_URL", i.publicBaseUrl), C = nn(i.allowedOrigins), w = i.limits?.maxBytes, D = 5242880, oe = 21600, O = i.refStore === void 0 || i.refStore === "memory", k = i.grantStore === void 0 || i.grantStore === "memory", A = { current: O ? Tt() : i.refStore }, j = { current: k ? At() : i.grantStore }, M = {
 		insert: (e) => A.current.insert(e),
 		getById: (e) => A.current.getById(e),
 		delete: (e) => A.current.delete(e),
@@ -1994,10 +2003,10 @@ var Wt = () => se({
 		listByRef: (e) => j.current.listByRef(e),
 		deleteByRef: (e) => j.current.deleteByRef(e)
 	}, ce = {
-		provider: b,
+		provider: y,
 		refStore: M,
 		grantStore: se,
-		bucket: S,
+		bucket: x,
 		...i.tenantPrefix === void 0 ? {} : { tenantPrefix: i.tenantPrefix },
 		...i.attempts === void 0 ? {} : { attempts: i.attempts },
 		...i.urlExpiresInSec === void 0 ? {} : { urlExpiresInSec: i.urlExpiresInSec },
@@ -2007,10 +2016,10 @@ var Wt = () => se({
 		...i.videoProbe === void 0 ? {} : { videoProbe: i.videoProbe },
 		...i.transcode === void 0 ? {} : { transcode: i.transcode },
 		...i.autoTranscode === void 0 ? {} : { autoTranscode: i.autoTranscode },
-		...C ? { publicBaseUrl: C } : {},
+		...S ? { publicBaseUrl: S } : {},
 		...i.normalizeImages === void 0 ? {} : { normalizeImages: i.normalizeImages },
 		...i.quota === void 0 ? {} : { quota: i.quota }
-	}, N = It(ce), P = Ft(ce), F = (e) => x.runPromise(e.pipe(x.catchAll(() => x.succeed(null)))), le = (e, t) => {
+	}, N = It(ce), P = Ft(ce), F = (e) => b.runPromise(e.pipe(b.catchAll(() => b.succeed(null)))), le = (e, t) => {
 		if (!e) return "invalid";
 		let n = /^bytes=(\d*)-(\d*)$/.exec(e.trim());
 		if (!n) return "invalid";
@@ -2126,7 +2135,7 @@ var Wt = () => se({
 		};
 		let r = Ve(e.query), i = e.headers.range;
 		if (n.visibility === "public") {
-			let e = b.publicUrl?.(n.key) ?? null;
+			let e = y.publicUrl?.(n.key) ?? null;
 			return e && !r ? {
 				status: 302,
 				headers: {
@@ -2141,7 +2150,7 @@ var Wt = () => se({
 			a = !!e && e.refId === t;
 		}
 		if (!a) {
-			let t = re(e.headers.cookie, Xt), r = t ? ae(t, ie()) : null;
+			let t = E(e.headers.cookie, Xt), r = t ? ae(t, ie()) : null;
 			r && (a = await F(P.checkAccess(n, r)) === !0);
 		}
 		if (!a) return {
@@ -2149,8 +2158,8 @@ var Wt = () => se({
 			body: "forbidden",
 			contentType: "text/plain"
 		};
-		if (b.presigns && !r) {
-			let e = await F(b.getUrl(n.key, 300));
+		if (y.presigns && !r) {
+			let e = await F(y.getUrl(n.key, 300));
 			if (e && /^https?:/.test(e)) return {
 				status: 302,
 				headers: {
@@ -2164,7 +2173,7 @@ var Wt = () => se({
 		method: "GET",
 		path: "/_voltro/storage",
 		handle: async (e) => {
-			let t = await L(e), n = rn(e.headers.origin, w);
+			let t = await L(e), n = rn(e.headers.origin, C);
 			return Object.keys(n).length === 0 ? t : {
 				...t,
 				headers: {
@@ -2178,7 +2187,7 @@ var Wt = () => se({
 		path: "/_voltro/storage/upload",
 		originGuard: "exempt",
 		handle: async (e) => {
-			let t = rn(e.headers.origin, w);
+			let t = rn(e.headers.origin, C);
 			if (e.method === "OPTIONS") return {
 				status: 204,
 				headers: t
@@ -2208,7 +2217,7 @@ var Wt = () => se({
 				contentType: "text/plain",
 				headers: t
 			};
-			let i = await x.runPromise(P.put({
+			let i = await b.runPromise(P.put({
 				bytes: e.rawBody,
 				contentType: r.ct,
 				tenantId: r.tenant,
@@ -2219,21 +2228,21 @@ var Wt = () => se({
 				...r.tags === void 0 ? {} : { tags: r.tags },
 				...r.alt === void 0 ? {} : { alt: r.alt },
 				...r.caption === void 0 ? {} : { caption: r.caption }
-			}).pipe(x.flatMap((e) => P.getUrl(e.id).pipe(x.map((t) => ({
+			}).pipe(b.flatMap((e) => P.getUrl(e.id).pipe(b.map((t) => ({
 				kind: "ok",
 				ref: e,
 				url: t
-			})))), x.catchTags({
-				StorageRejected: (e) => x.succeed({
+			})))), b.catchTags({
+				StorageRejected: (e) => b.succeed({
 					kind: "rejected",
 					status: e.reason === "too-large" ? 413 : 415,
 					detail: e.detail
 				}),
-				StorageScanRejected: (e) => x.succeed({
+				StorageScanRejected: (e) => b.succeed({
 					kind: "scan",
 					threat: e.threat
 				}),
-				StorageError: (e) => x.succeed({
+				StorageError: (e) => b.succeed({
 					kind: "error",
 					message: e.message
 				})
@@ -2270,7 +2279,7 @@ var Wt = () => se({
 		path: "/_voltro/storage/upload/resumable",
 		originGuard: "exempt",
 		handle: async (e) => {
-			let t = rn(e.headers.origin, w);
+			let t = rn(e.headers.origin, C);
 			if (e.method === "OPTIONS") return {
 				status: 204,
 				headers: t
@@ -2283,10 +2292,10 @@ var Wt = () => se({
 				headers: t
 			};
 			if (e.method === "GET" || e.method === "HEAD") {
-				let e = await x.runPromise(P.resumableStatus({
+				let e = await b.runPromise(P.resumableStatus({
 					uploadId: r.id,
 					tenantId: r.tenant
-				}).pipe(x.match({
+				}).pipe(b.match({
 					onFailure: (e) => ({ error: e.message }),
 					onSuccess: (e) => e
 				})));
@@ -2324,12 +2333,12 @@ var Wt = () => se({
 				contentType: "text/plain",
 				headers: t
 			};
-			let a = n.get("final") === "1", o = await x.runPromise(P.putResumableChunk({
+			let a = n.get("final") === "1", o = await b.runPromise(P.putResumableChunk({
 				uploadId: r.id,
 				tenantId: r.tenant,
 				index: i,
 				bytes: e.rawBody
-			}).pipe(x.flatMap(() => a ? P.finalizeResumable({
+			}).pipe(b.flatMap(() => a ? P.finalizeResumable({
 				uploadId: r.id,
 				count: i + 1,
 				contentType: r.ct,
@@ -2340,21 +2349,21 @@ var Wt = () => se({
 				...r.tags === void 0 ? {} : { tags: r.tags },
 				...r.alt === void 0 ? {} : { alt: r.alt },
 				...r.caption === void 0 ? {} : { caption: r.caption }
-			}).pipe(x.flatMap((e) => P.getUrl(e.id).pipe(x.map((t) => ({
+			}).pipe(b.flatMap((e) => P.getUrl(e.id).pipe(b.map((t) => ({
 				kind: "done",
 				ref: e,
 				url: t
-			}))))) : x.succeed({ kind: "chunk" })), x.catchTags({
-				StorageRejected: (e) => x.succeed({
+			}))))) : b.succeed({ kind: "chunk" })), b.catchTags({
+				StorageRejected: (e) => b.succeed({
 					kind: "rejected",
 					status: e.reason === "too-large" ? 413 : 415,
 					detail: e.detail
 				}),
-				StorageScanRejected: (e) => x.succeed({
+				StorageScanRejected: (e) => b.succeed({
 					kind: "scan",
 					threat: e.threat
 				}),
-				StorageError: (e) => x.succeed({
+				StorageError: (e) => b.succeed({
 					kind: "error",
 					message: e.message
 				})
@@ -2410,13 +2419,13 @@ var Wt = () => se({
 			method: "GET",
 			path: "/refs",
 			description: "Recent storage refs (newest first)",
-			handler: () => M.listRecent(100).pipe(x.map((e) => R({ refs: e.map(an) })), x.catchAll((e) => x.succeed(z(500, e.message))))
+			handler: () => M.listRecent(100).pipe(b.map((e) => R({ refs: e.map(an) })), b.catchAll((e) => b.succeed(z(500, e.message))))
 		},
 		{
 			method: "GET",
 			path: "/stats",
 			description: "Object count + total bytes per tenant + visibility split",
-			handler: () => M.listRecent(1e4).pipe(x.map((e) => {
+			handler: () => M.listRecent(1e4).pipe(b.map((e) => {
 				let t = {}, n = 0, r = 0;
 				for (let i of e) {
 					let e = i.tenantId ?? "(global)", a = t[e] ?? {
@@ -2426,15 +2435,15 @@ var Wt = () => se({
 					a.count++, a.bytes += i.size, t[e] = a, i.visibility === "public" ? n++ : r++;
 				}
 				return R({
-					provider: b.name,
-					bucket: S,
+					provider: y.name,
+					bucket: x,
 					byTenant: t,
 					visibility: {
 						public: n,
 						private: r
 					}
 				});
-			}), x.catchAll((e) => x.succeed(z(500, e.message))))
+			}), b.catchAll((e) => b.succeed(z(500, e.message))))
 		},
 		{
 			method: "GET",
@@ -2442,15 +2451,15 @@ var Wt = () => se({
 			description: "Grants for a ref (?refId=…)",
 			handler: (e) => {
 				let t = ge(e.url, "refId");
-				return t ? se.listByRef(t).pipe(x.map((e) => R({ grants: e.map(cn) })), x.catchAll((e) => x.succeed(z(500, e.message)))) : x.succeed(z(400, "refId query param required"));
+				return t ? se.listByRef(t).pipe(b.map((e) => R({ grants: e.map(cn) })), b.catchAll((e) => b.succeed(z(500, e.message)))) : b.succeed(z(400, "refId query param required"));
 			}
 		},
 		{
 			method: "POST",
 			path: "/share",
 			description: "Grant a principal access to a ref",
-			handler: (e) => x.gen(function* () {
-				let n = yield* x.try({
+			handler: (e) => b.gen(function* () {
+				let n = yield* b.try({
 					try: () => JSON.parse(e.body || "{}"),
 					catch: () => new t({
 						provider: "inspect",
@@ -2468,14 +2477,14 @@ var Wt = () => se({
 					expiresAt: r
 				});
 				return R({ grant: cn(i) });
-			}).pipe(x.catchAll((e) => x.succeed(z(e.status ?? 500, e.message ?? "share failed"))))
+			}).pipe(b.catchAll((e) => b.succeed(z(e.status ?? 500, e.message ?? "share failed"))))
 		},
 		{
 			method: "POST",
 			path: "/revoke",
 			description: "Revoke a grant by id",
-			handler: (e) => x.gen(function* () {
-				let n = yield* x.try({
+			handler: (e) => b.gen(function* () {
+				let n = yield* b.try({
 					try: () => JSON.parse(e.body || "{}"),
 					catch: () => new t({
 						provider: "inspect",
@@ -2485,21 +2494,21 @@ var Wt = () => se({
 					})
 				});
 				return n.grantId ? (yield* P.revoke(n.grantId), R({ ok: !0 })) : z(400, "grantId required");
-			}).pipe(x.catchAll((e) => x.succeed(z(e.status ?? 500, e.message ?? "revoke failed"))))
+			}).pipe(b.catchAll((e) => b.succeed(z(e.status ?? 500, e.message ?? "revoke failed"))))
 		}
 	], _e = [
 		{
-			...g,
+			...h,
 			execute: (e, t) => {
 				let n = e;
 				return P.mintUrl(n.id, t.request.subject, {
 					...n.password === void 0 ? {} : { password: n.password },
 					...n.expiresInSec === void 0 ? {} : { expiresInSec: n.expiresInSec }
-				}).pipe(x.map((e) => ({ url: e })));
+				}).pipe(b.map((e) => ({ url: e })));
 			}
 		},
 		{
-			...h,
+			...ee,
 			execute: (e, t) => {
 				let n = e;
 				return P.mintUploadUrl({
@@ -2507,14 +2516,14 @@ var Wt = () => se({
 					contentType: n.contentType,
 					tenantId: t.request.subject.tenantId,
 					...n.expiresInSec === void 0 ? {} : { expiresInSec: n.expiresInSec }
-				}).pipe(x.map((e) => ({ url: e })));
+				}).pipe(b.map((e) => ({ url: e })));
 			}
 		},
 		{
 			...m,
 			execute: (e, t) => {
 				let n = e;
-				return x.sync(() => {
+				return b.sync(() => {
 					let e = n.expiresInSec ?? 900, r = ct({
 						sub: t.request.subject.id,
 						tenant: t.request.subject.tenantId,
@@ -2525,10 +2534,10 @@ var Wt = () => se({
 						...n.tags === void 0 ? {} : { tags: n.tags },
 						...n.alt === void 0 ? {} : { alt: n.alt },
 						...n.caption === void 0 ? {} : { caption: n.caption },
-						...T === void 0 ? {} : { max: T }
+						...w === void 0 ? {} : { max: w }
 					}, e);
 					return {
-						uploadUrl: `${C ? C.replace(/\/+$/, "") : ""}/_voltro/storage/upload?ticket=${encodeURIComponent(r)}`,
+						uploadUrl: `${S ? S.replace(/\/+$/, "") : ""}/_voltro/storage/upload?ticket=${encodeURIComponent(r)}`,
 						expiresInSec: e
 					};
 				});
@@ -2542,7 +2551,7 @@ var Wt = () => se({
 					contentType: n.contentType,
 					tenantId: t.request.subject.tenantId,
 					...n.expiresInSec === void 0 ? {} : { expiresInSec: n.expiresInSec }
-				}).pipe(x.map((e) => {
+				}).pipe(b.map((e) => {
 					let r = ut({
 						key: e.key,
 						sub: t.request.subject.id,
@@ -2553,7 +2562,7 @@ var Wt = () => se({
 						...n.tags === void 0 ? {} : { tags: n.tags },
 						...n.alt === void 0 ? {} : { alt: n.alt },
 						...n.caption === void 0 ? {} : { caption: n.caption },
-						...T === void 0 ? {} : { max: T }
+						...w === void 0 ? {} : { max: w }
 					}, e.expiresInSec);
 					return {
 						uploadUrl: e.uploadUrl,
@@ -2567,7 +2576,7 @@ var Wt = () => se({
 			...l,
 			execute: (e, n) => {
 				let r = dt(e.finalizeToken);
-				return r ? r.sub !== null && r.sub !== n.request.subject.id ? x.fail(new t({
+				return r ? r.sub !== null && r.sub !== n.request.subject.id ? b.fail(new t({
 					provider: "storage",
 					message: "finalize token belongs to another subject",
 					transient: !1,
@@ -2582,14 +2591,14 @@ var Wt = () => se({
 					...r.tags === void 0 ? {} : { tags: r.tags },
 					...r.alt === void 0 ? {} : { alt: r.alt },
 					...r.caption === void 0 ? {} : { caption: r.caption }
-				}).pipe(x.flatMap((e) => P.getUrl(e.id).pipe(x.map((t) => ({
+				}).pipe(b.flatMap((e) => P.getUrl(e.id).pipe(b.map((t) => ({
 					id: e.id,
 					url: t,
 					contentType: e.contentType,
 					size: e.size,
 					...e.width == null ? {} : { width: e.width },
 					...e.height == null ? {} : { height: e.height }
-				}))))) : x.fail(new t({
+				}))))) : b.fail(new t({
 					provider: "storage",
 					message: "invalid or expired finalize token",
 					transient: !1,
@@ -2601,7 +2610,7 @@ var Wt = () => se({
 			...s,
 			execute: (e, t) => {
 				let n = e;
-				return x.sync(() => {
+				return b.sync(() => {
 					let e = n.expiresInSec ?? oe, r = de(), i = n.chunkSize && n.chunkSize > 0 ? n.chunkSize : D;
 					return {
 						uploadId: r,
@@ -2616,9 +2625,9 @@ var Wt = () => se({
 							...n.tags === void 0 ? {} : { tags: n.tags },
 							...n.alt === void 0 ? {} : { alt: n.alt },
 							...n.caption === void 0 ? {} : { caption: n.caption },
-							...T === void 0 ? {} : { max: T }
+							...w === void 0 ? {} : { max: w }
 						}, e),
-						uploadUrl: `${C ? C.replace(/\/+$/, "") : ""}/_voltro/storage/upload/resumable`,
+						uploadUrl: `${S ? S.replace(/\/+$/, "") : ""}/_voltro/storage/upload/resumable`,
 						chunkSize: i,
 						expiresInSec: e
 					};
@@ -2634,7 +2643,7 @@ var Wt = () => se({
 					tenantId: t.request.subject.tenantId,
 					visibility: n.visibility ?? "private",
 					expiresInSec: r
-				}).pipe(x.map((e) => ({
+				}).pipe(b.map((e) => ({
 					multipartToken: mt({
 						key: e.key,
 						uploadId: e.uploadId,
@@ -2657,7 +2666,7 @@ var Wt = () => se({
 			...te,
 			execute: (e) => {
 				let n = e, r = ht(n.multipartToken);
-				return r ? !Number.isInteger(n.partNumber) || n.partNumber < 1 ? x.fail(new t({
+				return r ? !Number.isInteger(n.partNumber) || n.partNumber < 1 ? b.fail(new t({
 					provider: "storage",
 					message: "partNumber must be a positive integer",
 					transient: !1,
@@ -2666,7 +2675,7 @@ var Wt = () => se({
 					key: r.key,
 					uploadId: r.uploadId,
 					partNumber: n.partNumber
-				}).pipe(x.map((e) => ({ url: e }))) : x.fail(new t({
+				}).pipe(b.map((e) => ({ url: e }))) : b.fail(new t({
 					provider: "storage",
 					message: "invalid or expired multipart token",
 					transient: !1,
@@ -2678,7 +2687,7 @@ var Wt = () => se({
 			...c,
 			execute: (e, n) => {
 				let r = e, i = ht(r.multipartToken);
-				return i ? i.sub !== null && i.sub !== n.request.subject.id ? x.fail(new t({
+				return i ? i.sub !== null && i.sub !== n.request.subject.id ? b.fail(new t({
 					provider: "storage",
 					message: "multipart token belongs to another subject",
 					transient: !1,
@@ -2695,11 +2704,11 @@ var Wt = () => se({
 					...i.tags === void 0 ? {} : { tags: i.tags },
 					...i.alt === void 0 ? {} : { alt: i.alt },
 					...i.caption === void 0 ? {} : { caption: i.caption }
-				}).pipe(x.flatMap((e) => P.getUrl(e.id).pipe(x.map((t) => ({
+				}).pipe(b.flatMap((e) => P.getUrl(e.id).pipe(b.map((t) => ({
 					id: e.id,
 					url: t,
 					size: e.size
-				}))))) : x.fail(new t({
+				}))))) : b.fail(new t({
 					provider: "storage",
 					message: "invalid or expired multipart token",
 					transient: !1,
@@ -2714,7 +2723,7 @@ var Wt = () => se({
 				return n ? P.abortMultipart({
 					key: n.key,
 					uploadId: n.uploadId
-				}).pipe(x.as({ ok: !0 })) : x.fail(new t({
+				}).pipe(b.as({ ok: !0 })) : b.fail(new t({
 					provider: "storage",
 					message: "invalid or expired multipart token",
 					transient: !1,
@@ -2723,7 +2732,7 @@ var Wt = () => se({
 			}
 		},
 		{
-			...y,
+			...v,
 			execute: (e, t) => {
 				let n = e, r = new Uint8Array(Buffer.from(n.bytesBase64, "base64"));
 				return P.put({
@@ -2734,7 +2743,7 @@ var Wt = () => se({
 					...n.visibility ? { visibility: n.visibility } : {},
 					...n.key ? { key: n.key } : {},
 					...n.password ? { password: n.password } : {}
-				}).pipe(x.flatMap((e) => P.getUrl(e.id).pipe(x.map((t) => ({
+				}).pipe(b.flatMap((e) => P.getUrl(e.id).pipe(b.map((t) => ({
 					id: e.id,
 					url: t
 				})))));
@@ -2753,38 +2762,38 @@ var Wt = () => se({
 					...n.alt === void 0 ? {} : { alt: n.alt },
 					...n.caption === void 0 ? {} : { caption: n.caption },
 					...n.key === void 0 ? {} : { key: n.key }
-				}).pipe(x.flatMap((e) => P.getUrl(e.id).pipe(x.map((t) => ({
+				}).pipe(b.flatMap((e) => P.getUrl(e.id).pipe(b.map((t) => ({
 					id: e.id,
 					url: t
 				})))));
 			}
 		},
 		{
-			...ee,
+			..._,
 			execute: (e, t) => {
 				let n = e, r = n.expiresInDays ? new Date(Date.now() + n.expiresInDays * 864e5) : null;
-				return sn(P, n.refId, t).pipe(x.flatMap(() => P.grant({
+				return sn(P, n.refId, t).pipe(b.flatMap(() => P.grant({
 					refId: n.refId,
 					principalType: n.principalType,
 					principalId: n.principalId,
 					...n.permission ? { permission: n.permission } : {},
 					expiresAt: r,
 					createdBy: t.request.subject.id
-				})), x.map((e) => ({ grantId: e.id })));
+				})), b.map((e) => ({ grantId: e.id })));
 			}
 		},
 		{
-			..._,
+			...g,
 			execute: (e, t) => {
 				let n = e;
-				return P.getGrant(n.grantId).pipe(x.flatMap((e) => e === null ? x.fail(on()) : sn(P, e.refId, t)), x.flatMap(() => P.revoke(n.grantId)), x.map(() => ({ ok: !0 })));
+				return P.getGrant(n.grantId).pipe(b.flatMap((e) => e === null ? b.fail(on()) : sn(P, e.refId, t)), b.flatMap(() => P.revoke(n.grantId)), b.map(() => ({ ok: !0 })));
 			}
 		},
 		{
 			...d,
 			execute: (e, t) => {
 				let n = e;
-				return sn(P, n.refId, t).pipe(x.flatMap(() => P.listGrants(n.refId)), x.map((e) => ({ grants: e.map(cn) })));
+				return sn(P, n.refId, t).pipe(b.flatMap(() => P.listGrants(n.refId)), b.map((e) => ({ grants: e.map(cn) })));
 			}
 		},
 		{
@@ -2799,15 +2808,15 @@ var Wt = () => se({
 					...n.includeDerived === void 0 ? {} : { includeDerived: n.includeDerived },
 					...n.limit === void 0 ? {} : { limit: n.limit },
 					...n.offset === void 0 ? {} : { offset: n.offset }
-				}).pipe(x.map((e) => ({
+				}).pipe(b.map((e) => ({
 					refs: e.refs.map(an),
 					nextOffset: e.nextOffset
 				})));
 			}
 		}
 	];
-	return ne({
-		name: E({
+	return T({
+		name: re({
 			base: ln,
 			alias: i.alias,
 			instance: i.name
@@ -2819,7 +2828,7 @@ var Wt = () => se({
 			"inspect:read",
 			"inspect:write"
 		],
-		declaredEnv: G.declared,
+		declaredEnv: K.declared,
 		services: N,
 		inspectEndpoints: B,
 		httpRoutes: [
@@ -2828,7 +2837,7 @@ var Wt = () => se({
 			he
 		],
 		routes: _e,
-		rpcClientDescriptors: v,
+		rpcClientDescriptors: ne,
 		errorSchemas: [
 			{
 				schema: t,
@@ -2860,18 +2869,18 @@ var Wt = () => se({
 			}
 		],
 		bindDataStore: (e) => {
-			O && (A.current = kt(e)), k && (j.current = Mt(e)), b.bindDataStore?.(e);
+			O && (A.current = kt(e)), k && (j.current = Mt(e)), y.bindDataStore?.(e);
 		},
-		onActivate: (e) => x.sync(() => {
-			let t = !!C || !!G.read("STORAGE_CDN_URL", i.cdnBaseUrl);
-			e.logger.info(`storage: provider=${b.name} presign=${b.presigns ? "yes" : "no"} publicUrl=${t ? "yes" : "no"} transforms=yes`, {
-				provider: b.name,
-				bucket: S,
+		onActivate: (e) => b.sync(() => {
+			let t = !!S || !!K.read("STORAGE_CDN_URL", i.cdnBaseUrl);
+			e.logger.info(`storage: provider=${y.name} presign=${y.presigns ? "yes" : "no"} publicUrl=${t ? "yes" : "no"} transforms=yes`, {
+				provider: y.name,
+				bucket: x,
 				refStore: O ? "memory" : "custom"
-			}), b.name === "memory" && process.env.NODE_ENV !== "test" && e.logger.warn("storage: provider=memory — uploads are IN-MEMORY and LOST on restart. Set STORAGE_PROVIDER (filesystem / s3 / r2 / azure / gcs) for anything but throwaway dev. (Empty/placeholder storage env silently falls back to memory.)"), !t && !b.presigns && e.logger.warn("storage: no VOLTRO_PUBLIC_URL / STORAGE_CDN_URL and this provider can't presign — serve URLs are RELATIVE and will not resolve cross-origin (browser <img> / server-to-server AI fetches). Set VOLTRO_PUBLIC_URL to this api's absolute base URL.");
+			}), y.name === "memory" && process.env.NODE_ENV !== "test" && e.logger.warn("storage: provider=memory — uploads are IN-MEMORY and LOST on restart. Set STORAGE_PROVIDER (filesystem / s3 / r2 / azure / gcs) for anything but throwaway dev. (Empty/placeholder storage env silently falls back to memory.)"), !t && !y.presigns && e.logger.warn("storage: no VOLTRO_PUBLIC_URL / STORAGE_CDN_URL and this provider can't presign — serve URLs are RELATIVE and will not resolve cross-origin (browser <img> / server-to-server AI fetches). Set VOLTRO_PUBLIC_URL to this api's absolute base URL.");
 		}),
-		onDeactivate: () => x.void
+		onDeactivate: () => b.void
 	});
 };
 //#endregion
-export { U as STORAGE_BLOBS_TABLE, H as STORAGE_GRANTS_TABLE, V as STORAGE_REFS_TABLE, W as STORAGE_USAGE_TABLE, e as StorageAccessDenied, t as StorageError, n as StorageRejected, r as StorageScanRejected, i as StorageService, Ae as _voltroStorageBlobsTable, Oe as _voltroStorageGrantsTable, De as _voltroStorageRefsTable, ke as _voltroStorageUsageTable, $t as appStorageProvider, Ut as assetRef, ze as azureProvider, Ft as buildStorageService, xe as bytesToStream, yt as checkLimits, Bt as clamavScanner, Ne as clearStorageBuffer, Se as collectStream, be as concatBytes, en as configuredStorageProvider, gt as contentTypeAllowed, Mt as dataStoreGrantStore, kt as dataStoreRefStore, Re as databaseProvider, Kt as decodeDataUri, Yt as durabilityNotice, Lt as encodeInstream, Ht as ffmpegTranscoder, Fe as filesystemProvider, Ce as fromNodeReadable, Te as getObjectStream, qe as hashPassword, At as memoryGrantStore, Pe as memoryProvider, Tt as memoryRefStore, Rt as parseClamavResponse, Ve as parseTransformParams, Jt as pathDurability, qt as putAvatar, Ee as putObjectStream, Me as readStorageBuffer, Ct as refMatchesListQuery, tn as resolveStorageProvider, X as resolveStorageSecret, Ie as s3Provider, Qt as setActiveStorageProvider, ut as signFinalizeTicket, ot as signGrant, mt as signMultipartTicket, ft as signResumableTicket, ct as signUploadTicket, vt as sniffMatches, un as storagePlugin, It as storageServiceLayer, we as toNodeReadable, Ke as transformCached, We as transformImage, dt as verifyFinalizeTicket, st as verifyGrant, ht as verifyMultipartTicket, Je as verifyPassword, pt as verifyResumableTicket, lt as verifyUploadTicket, Wt as withStorage };
+export { W as STORAGE_BLOBS_TABLE, U as STORAGE_GRANTS_TABLE, H as STORAGE_REFS_TABLE, G as STORAGE_USAGE_TABLE, e as StorageAccessDenied, t as StorageError, n as StorageRejected, r as StorageScanRejected, i as StorageService, ke as _voltroStorageBlobsTable, De as _voltroStorageGrantsTable, Ee as _voltroStorageRefsTable, Oe as _voltroStorageUsageTable, $t as appStorageProvider, Ut as assetRef, ze as azureProvider, Ft as buildStorageService, xe as bytesToStream, yt as checkLimits, Bt as clamavScanner, Ne as clearStorageBuffer, Se as collectStream, be as concatBytes, en as configuredStorageProvider, gt as contentTypeAllowed, Mt as dataStoreGrantStore, kt as dataStoreRefStore, Re as databaseProvider, Kt as decodeDataUri, Yt as durabilityNotice, Lt as encodeInstream, Ht as ffmpegTranscoder, Fe as filesystemProvider, Ce as fromNodeReadable, we as getObjectStream, qe as hashPassword, At as memoryGrantStore, Pe as memoryProvider, Tt as memoryRefStore, Rt as parseClamavResponse, Ve as parseTransformParams, Jt as pathDurability, qt as putAvatar, Te as putObjectStream, Me as readStorageBuffer, Ct as refMatchesListQuery, tn as resolveStorageProvider, X as resolveStorageSecret, Ie as s3Provider, Qt as setActiveStorageProvider, ut as signFinalizeTicket, ot as signGrant, mt as signMultipartTicket, ft as signResumableTicket, ct as signUploadTicket, vt as sniffMatches, un as storagePlugin, It as storageServiceLayer, V as toNodeReadable, Ke as transformCached, We as transformImage, dt as verifyFinalizeTicket, st as verifyGrant, ht as verifyMultipartTicket, Je as verifyPassword, pt as verifyResumableTicket, lt as verifyUploadTicket, Wt as withStorage };