@voltro/plugin-storage 0.67.0 → 0.69.0

package/dist/index.js

@@ -4,39 +4,39 @@ import { Chunk as y, Effect as b, Exit as x, Layer as S, Schedule as C, Stream a
 import { definePlugin as T, pluginInstanceName as re } from "@voltro/protocol";
 import { readCookie as E, resolveSessionSecret as ie, verifySession as ae } from "@voltro/protocol/session";
 import { and as D, bytes as oe, eq as O, generateId as k, id as A, integer as j, json as M, mixin as se, reference as ce, table as N, text as P, timestamp as F } from "@voltro/database";
-import { pluginEnv as le } from "@voltro/env";
-import { createHmac as I, randomBytes as ue, randomUUID as de, scryptSync as fe, timingSafeEqual as L } from "node:crypto";
-import { spawn as pe } from "node:child_process";
-import { mkdtemp as me, readFile as he, rm as R, writeFile as z } from "node:fs/promises";
-import { tmpdir as ge } from "node:os";
-import { join as B } from "node:path";
-import { statSync as _e } from "node:fs";
+import { pluginEnv as I } from "@voltro/env";
+import { createHmac as L, randomBytes as le, randomUUID as ue, scryptSync as R, timingSafeEqual as z } from "node:crypto";
+import { spawn as de } from "node:child_process";
+import { mkdtemp as fe, readFile as pe, rm as me, writeFile as B } from "node:fs/promises";
+import { tmpdir as V } from "node:os";
+import { join as he } from "node:path";
+import { statSync as ge } from "node:fs";
 //#region src/streamBridge.ts
-var ve = 1 << 20, ye = (e, n, r = !1) => new t({
+var _e = 1 << 20, ve = (e, n, r = !1) => new t({
 	provider: e,
 	message: n,
 	transient: r
-}), be = (e) => {
+}), ye = (e) => {
 	let t = 0;
 	for (let n of e) t += n.byteLength;
 	let n = new Uint8Array(t), r = 0;
 	for (let t of e) n.set(t, r), r += t.byteLength;
 	return n;
-}, xe = (e, t = ve) => {
+}, be = (e, t = _e) => {
 	let n = [];
 	for (let r = 0; r < e.byteLength; r += t) n.push(e.subarray(r, Math.min(r + t, e.byteLength)));
 	return w.fromIterable(n);
-}, Se = (e) => e.pipe(w.runCollect, b.map((e) => be(y.toReadonlyArray(e)))), Ce = (e, t) => w.suspend(() => w.fromAsyncIterable(t(), (t) => ye(e, `read stream failed: ${String(t?.message ?? t)}`, !0))).pipe(w.map((e) => e instanceof Uint8Array ? e : new Uint8Array(e))), V = async (e) => {
+}, xe = (e) => e.pipe(w.runCollect, b.map((e) => ye(y.toReadonlyArray(e)))), Se = (e, t) => w.suspend(() => w.fromAsyncIterable(t(), (t) => ve(e, `read stream failed: ${String(t?.message ?? t)}`, !0))).pipe(w.map((e) => e instanceof Uint8Array ? e : new Uint8Array(e))), Ce = async (e) => {
 	let { Readable: t } = await import("node:stream");
 	return t.fromWeb(w.toReadableStream(e));
 }, we = (e, t) => e.getStream ? e.getStream(t) : e.get(t).pipe(b.map((e) => ({
-	stream: xe(e.bytes),
+	stream: be(e.bytes),
 	contentType: e.contentType,
 	size: e.bytes.byteLength
-}))), Te = (e, t, n, r) => e.putStream ? e.putStream(t, n, r) : Se(n).pipe(b.flatMap((n) => e.put(t, n, {
+}))), Te = (e, t, n, r) => e.putStream ? e.putStream(t, n, r) : xe(n).pipe(b.flatMap((n) => e.put(t, n, {
 	contentType: r.contentType,
 	...r.public === void 0 ? {} : { public: r.public }
-}))), H = "_voltro_storage_refs", U = "_voltro_storage_grants", W = "_voltro_storage_blobs", G = "_voltro_storage_usage", Ee = N(H, {
+}))), H = "_voltro_storage_refs", U = "_voltro_storage_grants", W = "_voltro_storage_blobs", Ee = "_voltro_storage_usage", De = N(H, {
 	id: A({ prefix: "file" }),
 	tenantId: P().nullable(),
 	ownerId: P().nullable(),
@@ -59,7 +59,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 	derivedFrom: P().nullable(),
 	kind: P().nullable(),
 	createdAt: F()
-}).index(["key"]).index(["tenantId"]).index(["ownerId"]).index(["folder"]).index(["derivedFrom"]), De = N(U, {
+}).index(["key"]).index(["tenantId"]).index(["ownerId"]).index(["folder"]).index(["derivedFrom"]), Oe = N(U, {
 	id: A({ prefix: "sgrant" }),
 	refId: P(),
 	principalType: P(),
@@ -68,19 +68,19 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 	createdAt: F(),
 	expiresAt: F().nullable(),
 	createdBy: P().nullable()
-}).index(["refId"]).index(["principalId"]), Oe = N(G, {
+}).index(["refId"]).index(["principalId"]), ke = N(Ee, {
 	id: A({ prefix: "susage" }),
 	tenantId: P().maxLength(191),
 	bytes: j().default(0),
 	count: j().default(0),
 	updatedAt: F()
-}).unique("byStorageUsageTenant", ["tenantId"]), ke = N(W, {
+}).unique("byStorageUsageTenant", ["tenantId"]), Ae = N(W, {
 	id: A({ prefix: "blob" }),
 	key: P(),
 	data: oe(),
 	contentType: P(),
 	size: j()
-}).index(["key"]), K = le([
+}).index(["key"]), G = I([
 	{
 		name: "STORAGE_PROVIDER",
 		required: !1,
@@ -231,16 +231,16 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 		secret: !1,
 		description: "clamd port for the optional clamav virus scanner. Default 3310."
 	}
-]), q = (e, n, r, i) => new t({
+]), K = (e, n, r, i) => new t({
 	provider: e,
 	message: n,
 	transient: r,
 	...i === void 0 ? {} : { status: i }
-}), Ae = (e) => e === void 0 || e === 408 || e === 429 || e >= 500, je = /* @__PURE__ */ new Map(), Me = (e, t) => je.get(e)?.get(t)?.bytes, Ne = (e) => {
-	je.get(e)?.clear();
-}, Pe = (e = "default") => {
-	let t = je.get(e) ?? /* @__PURE__ */ new Map();
-	return je.set(e, t), {
+}), je = (e) => e === void 0 || e === 408 || e === 429 || e >= 500, Me = /* @__PURE__ */ new Map(), Ne = (e, t) => Me.get(e)?.get(t)?.bytes, Pe = (e) => {
+	Me.get(e)?.clear();
+}, Fe = (e = "default") => {
+	let t = Me.get(e) ?? /* @__PURE__ */ new Map();
+	return Me.set(e, t), {
 		name: "memory",
 		presigns: !1,
 		put: (e, n, r) => b.sync(() => (t.set(e, {
@@ -252,7 +252,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 			return n ? b.succeed({
 				bytes: n.bytes,
 				contentType: n.contentType
-			}) : b.fail(q("memory", `no object at key '${e}'`, !1, 404));
+			}) : b.fail(K("memory", `no object at key '${e}'`, !1, 404));
 		}),
 		delete: (e) => b.sync(() => {
 			t.delete(e);
@@ -264,14 +264,14 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 			return n ? { size: n.bytes.byteLength } : null;
 		})
 	};
-}, Fe = (e) => {
+}, Ie = (e) => {
 	let t = e.root, n = async (e) => {
 		let { join: n, resolve: r, sep: i } = await import("node:path"), a = r(t), o = r(a, e);
 		if (o !== a && !o.startsWith(a + i)) throw Error(`key '${e}' escapes the storage root`);
 		return n(o);
 	}, r = (e, t, n = !1) => b.tryPromise({
 		try: e,
-		catch: (e) => e?.code === "ENOENT" ? q("filesystem", `no object at key '${t}'`, !1, 404) : q("filesystem", String(e?.message ?? e), n)
+		catch: (e) => e?.code === "ENOENT" ? K("filesystem", `no object at key '${t}'`, !1, 404) : K("filesystem", String(e?.message ?? e), n)
 	});
 	return {
 		root: t,
@@ -310,12 +310,12 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 					throw e;
 				}
 			},
-			catch: (e) => q("filesystem", String(e?.message ?? e), !1)
+			catch: (e) => K("filesystem", String(e?.message ?? e), !1)
 		}),
 		getStream: (e) => r(async () => {
 			let t = await import("node:fs/promises"), { createReadStream: r } = await import("node:fs"), i = await n(e), a = await t.stat(i);
 			return {
-				stream: Ce("filesystem", () => r(i)),
+				stream: Se("filesystem", () => r(i)),
 				contentType: "application/octet-stream",
 				size: a.size
 			};
@@ -325,7 +325,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 			await r.mkdir(i(c), { recursive: !0 });
 			let l = `${c}.tmp-${a()}`;
 			try {
-				await s(await V(t), o(l));
+				await s(await Ce(t), o(l));
 				let e = await r.stat(l);
 				return await r.rename(l, c), { size: e.size };
 			} catch (e) {
@@ -340,10 +340,10 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 					end: i
 				});
 				s.on("data", (e) => o.push(e)), s.on("end", () => e()), s.on("error", n);
-			}), be(o);
+			}), ye(o);
 		}, e)
 	};
-}, Ie = (e) => {
+}, Le = (e) => {
 	let t = e.name ?? "s3", n = e.publicAcl ?? !0, r = null, i = () => r || (r = (async () => {
 		let t, n;
 		try {
@@ -368,7 +368,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 		try: e,
 		catch: (e) => {
 			let n = e?.$metadata?.httpStatusCode;
-			return q(t, String(e?.message ?? e), Ae(n), n);
+			return K(t, String(e?.message ?? e), je(n), n);
 		}
 	}), o = async (e) => {
 		let t = e;
@@ -483,7 +483,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 			},
 			catch: (e) => {
 				let n = e?.$metadata?.httpStatusCode;
-				return q(t, String(e?.message ?? e), Ae(n), n);
+				return K(t, String(e?.message ?? e), je(n), n);
 			}
 		}),
 		getStream: (n) => a(async () => {
@@ -492,7 +492,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 				Key: n
 			})), s = o.Body;
 			return {
-				stream: Ce(t, () => s),
+				stream: Se(t, () => s),
 				contentType: o.ContentType ?? "application/octet-stream",
 				...o.ContentLength === void 0 ? {} : { size: o.ContentLength }
 			};
@@ -504,7 +504,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 			} catch (e) {
 				throw Error("s3/minio `putStream` requires the '@aws-sdk/lib-storage' optional dependency (multipart upload). Install it to enable streamed uploads.", { cause: e });
 			}
-			let l = await V(r);
+			let l = await Ce(r);
 			return await new c.Upload({
 				client: a,
 				params: {
@@ -528,13 +528,13 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 			return o(c.Body);
 		})
 	};
-}, Le = (e) => e instanceof Uint8Array ? e : typeof e == "string" ? new Uint8Array(Buffer.from(e, "base64")) : new Uint8Array(e), Re = () => {
+}, Re = (e) => e instanceof Uint8Array ? e : typeof e == "string" ? new Uint8Array(Buffer.from(e, "base64")) : new Uint8Array(e), ze = () => {
 	let e = null, t = () => {
 		if (!e) throw Error("the 'database' storage provider isn't bound to a DataStore yet");
 		return e;
 	}, n = (e) => b.tryPromise({
 		try: e,
-		catch: (e) => q("database", String(e?.message ?? e), !0)
+		catch: (e) => K("database", String(e?.message ?? e), !0)
 	}), r = async (e) => (await t().query({
 		table: W,
 		predicate: {
@@ -571,9 +571,9 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 			}), { size: i.byteLength };
 		}),
 		get: (e) => b.suspend(() => n(() => r(e)).pipe(b.flatMap((t) => t ? b.succeed({
-			bytes: Le(t.data),
+			bytes: Re(t.data),
 			contentType: String(t.contentType)
-		}) : b.fail(q("database", `no object at key '${e}'`, !1, 404))))),
+		}) : b.fail(K("database", `no object at key '${e}'`, !1, 404))))),
 		delete: (e) => n(async () => {
 			let n = await r(e);
 			n && await t().delete(W, String(n.id));
@@ -585,7 +585,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 			return t ? { size: Number(t.size) } : null;
 		})
 	};
-}, ze = (e) => {
+}, Be = (e) => {
 	let t = null, n = () => t || (t = (async () => {
 		let t;
 		try {
@@ -593,7 +593,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 		} catch (e) {
 			throw Error("the 'azure' storage provider requires the '@azure/storage-blob' optional dependency. Install it to enable it.", { cause: e });
 		}
-		let n = K.read("AZURE_STORAGE_ACCOUNT", e.accountName), r = K.read("AZURE_STORAGE_KEY", e.accountKey), i = n && r ? new t.StorageSharedKeyCredential(n, r) : null, a = K.read("AZURE_STORAGE_CONNECTION_STRING", e.connectionString);
+		let n = G.read("AZURE_STORAGE_ACCOUNT", e.accountName), r = G.read("AZURE_STORAGE_KEY", e.accountKey), i = n && r ? new t.StorageSharedKeyCredential(n, r) : null, a = G.read("AZURE_STORAGE_CONNECTION_STRING", e.connectionString);
 		return {
 			container: (a ? t.BlobServiceClient.fromConnectionString(a) : new t.BlobServiceClient(e.endpoint ?? `https://${n}.blob.core.windows.net`, i ?? void 0)).getContainerClient(e.container),
 			sdk: t,
@@ -603,7 +603,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 		try: e,
 		catch: (e) => {
 			let t = e?.statusCode;
-			return q("azure", String(e?.message ?? e), Ae(t), t);
+			return K("azure", String(e?.message ?? e), je(t), t);
 		}
 	}), i = async (e) => {
 		if (!e) return /* @__PURE__ */ new Uint8Array();
@@ -661,19 +661,19 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 			},
 			catch: (e) => {
 				let t = e?.statusCode;
-				return q("azure", String(e?.message ?? e), Ae(t), t);
+				return K("azure", String(e?.message ?? e), je(t), t);
 			}
 		}),
 		getStream: (e) => r(async () => {
 			let { container: t } = await n(), r = await t.getBlockBlobClient(e).download();
 			return {
-				stream: Ce("azure", () => r.readableStreamBody),
+				stream: Se("azure", () => r.readableStreamBody),
 				contentType: r.contentType ?? "application/octet-stream",
 				...r.contentLength === void 0 ? {} : { size: r.contentLength }
 			};
 		}),
 		putStream: (e, t, i) => r(async () => {
-			let { container: r } = await n(), a = await V(t);
+			let { container: r } = await n(), a = await Ce(t);
 			return await r.getBlockBlobClient(e).uploadStream(a, 4194304, 5, { blobHTTPHeaders: { blobContentType: i.contentType } }), { size: i.totalSize ?? (await r.getBlockBlobClient(e).getProperties()).contentLength ?? 0 };
 		}),
 		getRange: (e, t, a) => r(async () => {
@@ -681,13 +681,13 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 			return i(o.readableStreamBody);
 		})
 	};
-}, Be = {
+}, Ve = {
 	webp: "image/webp",
 	avif: "image/avif",
 	jpeg: "image/jpeg",
 	jpg: "image/jpeg",
 	png: "image/png"
-}, Ve = (e) => {
+}, He = (e) => {
 	if (!e) return null;
 	let t = new URLSearchParams(e), n = (e) => {
 		let n = t.get(e);
@@ -702,18 +702,18 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 		...a === void 0 ? {} : { q: a },
 		...s ? { fit: s } : {}
 	};
-}, He = (e) => e.startsWith("image/") && !e.includes("svg"), J, Ue = async () => {
-	if (J !== void 0) return J;
+}, Ue = (e) => e.startsWith("image/") && !e.includes("svg"), q, We = async () => {
+	if (q !== void 0) return q;
 	try {
 		let e = await import("sharp");
-		J = e.default ?? e;
+		q = e.default ?? e;
 	} catch {
-		J = null;
+		q = null;
 	}
-	return J;
-}, We = async (e, t, n) => {
-	if (!He(t)) return null;
-	let r = await Ue();
+	return q;
+}, Ge = async (e, t, n) => {
+	if (!Ue(t)) return null;
+	let r = await We();
 	if (!r) return null;
 	try {
 		let i = r(Buffer.from(e), { failOn: "none" });
@@ -723,10 +723,10 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 			fit: n.fit ?? "cover",
 			withoutEnlargement: !0
 		}));
-		let a = n.format && Be[n.format] ? n.format : void 0, o = t;
+		let a = n.format && Ve[n.format] ? n.format : void 0, o = t;
 		if (a) {
 			let e = a === "jpg" ? "jpeg" : a;
-			i = i.toFormat(e, n.q === void 0 ? {} : { quality: n.q }), o = Be[a];
+			i = i.toFormat(e, n.q === void 0 ? {} : { quality: n.q }), o = Ve[a];
 		} else n.q !== void 0 && (t === "image/jpeg" || t === "image/webp") && (i = i.toFormat(t === "image/webp" ? "webp" : "jpeg", { quality: n.q }));
 		let s = await i.toBuffer();
 		return {
@@ -736,43 +736,43 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 	} catch {
 		return null;
 	}
-}, Ge = 200, Y = /* @__PURE__ */ new Map(), Ke = async (e, t, n, r) => {
-	let i = `${e}::${JSON.stringify(r)}`, a = Y.get(i);
+}, Ke = 200, J = /* @__PURE__ */ new Map(), qe = async (e, t, n, r) => {
+	let i = `${e}::${JSON.stringify(r)}`, a = J.get(i);
 	if (a) return a;
-	let o = await We(t, n, r);
-	if (o && (Y.set(i, o), Y.size > Ge)) {
-		let e = Y.keys().next().value;
-		e !== void 0 && Y.delete(e);
+	let o = await Ge(t, n, r);
+	if (o && (J.set(i, o), J.size > Ke)) {
+		let e = J.keys().next().value;
+		e !== void 0 && J.delete(e);
 	}
 	return o;
-}, qe = (e) => {
-	let t = ue(16).toString("hex");
-	return `${t}:${fe(e, t, 32).toString("hex")}`;
-}, Je = (e, t) => {
+}, Je = (e) => {
+	let t = le(16).toString("hex");
+	return `${t}:${R(e, t, 32).toString("hex")}`;
+}, Ye = (e, t) => {
 	if (!e || !t) return !1;
 	let [n, r] = t.split(":");
 	if (!n || !r) return !1;
-	let i = Buffer.from(r, "hex"), a = fe(e, n, i.length);
-	return a.length === i.length && L(a, i);
-}, Ye = (e) => Array.isArray(e) ? e.filter((e) => typeof e == "string") : [], Xe = (e) => Ye(e.metadata?.roles), Ze = (e) => Ye(e.scopes), Qe = (e, t) => e.some((e) => t.includes(e)), $e = (e) => Ye(e.metadata?.groups), et = (e) => typeof e == "boolean" ? b.succeed(e) : b.isEffect(e) ? e : b.promise(() => e), tt = (e, t, n = {}) => b.gen(function* () {
+	let i = Buffer.from(r, "hex"), a = R(e, n, i.length);
+	return a.length === i.length && z(a, i);
+}, Xe = (e) => Array.isArray(e) ? e.filter((e) => typeof e == "string") : [], Ze = (e) => Xe(e.metadata?.roles), Qe = (e) => Xe(e.scopes), $e = (e, t) => e.some((e) => t.includes(e)), et = (e) => Xe(e.metadata?.groups), tt = (e) => typeof e == "boolean" ? b.succeed(e) : b.isEffect(e) ? e : b.promise(() => e), nt = (e, t, n = {}) => b.gen(function* () {
 	if (t.id && e.ownerId && t.id === e.ownerId) return !0;
 	let r = e.accessPolicy ?? [];
 	if (r.length === 0) return !1;
-	let i = n.resolveGroups ? yield* b.promise(async () => await n.resolveGroups(t)) : $e(t);
-	for (let a of r) if (yield* nt(a, e, t, i, n)) return !0;
+	let i = n.resolveGroups ? yield* b.promise(async () => await n.resolveGroups(t)) : et(t);
+	for (let a of r) if (yield* rt(a, e, t, i, n)) return !0;
 	return !1;
-}), nt = (e, t, n, r, i) => b.gen(function* () {
+}), rt = (e, t, n, r, i) => b.gen(function* () {
 	let a = !1, o = (e) => (a = !0, e);
-	if (e.owner !== void 0 && e.owner && !o(!!n.id && !!t.ownerId && n.id === t.ownerId) || e.tenant !== void 0 && e.tenant && !o(!!n.tenantId && n.tenantId === t.tenantId) || e.apiKey !== void 0 && e.apiKey && !o(n.type === "apiKey") || e.roles && e.roles.length > 0 && !o(Qe(Xe(n), e.roles)) || e.groups && e.groups.length > 0 && !o(Qe(r, e.groups)) || e.scopes && e.scopes.length > 0 && !o(Qe(Ze(n), e.scopes)) || e.password !== void 0 && e.password && !o(Je(i.password, t.passwordHash))) return !1;
+	if (e.owner !== void 0 && e.owner && !o(!!n.id && !!t.ownerId && n.id === t.ownerId) || e.tenant !== void 0 && e.tenant && !o(!!n.tenantId && n.tenantId === t.tenantId) || e.apiKey !== void 0 && e.apiKey && !o(n.type === "apiKey") || e.roles && e.roles.length > 0 && !o($e(Ze(n), e.roles)) || e.groups && e.groups.length > 0 && !o($e(r, e.groups)) || e.scopes && e.scopes.length > 0 && !o($e(Qe(n), e.scopes)) || e.password !== void 0 && e.password && !o(Ye(i.password, t.passwordHash))) return !1;
 	if (e.guard) {
 		let r = i.guards?.[e.guard];
-		if (!o(r ? yield* et(r({
+		if (!o(r ? yield* tt(r({
 			subject: n,
 			ref: t
 		})) : !1)) return !1;
 	}
 	return a;
-}), rt = (e, t) => {
+}), it = (e, t) => {
 	let n = [];
 	e.id && n.push({
 		type: e.type === "apiKey" ? "apiKey" : "user",
@@ -783,115 +783,115 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 		id: e
 	});
 	return n;
-}, it = (e, t, n, r, i) => {
-	let a = rt(t, n);
+}, at = (e, t, n, r, i) => {
+	let a = it(t, n);
 	return e.some((e) => e.expiresAt && e.expiresAt.getTime() < i || r === "write" && e.permission !== "write" ? !1 : a.some((t) => t.type === e.principalType && t.id === e.principalId));
-}, at = (e, t) => t.resolveGroups ? b.promise(async () => await t.resolveGroups(e)) : b.succeed($e(e)), X = () => K.read("VOLTRO_STORAGE_SECRET") ?? ie(), Z = (e) => (typeof e == "string" ? Buffer.from(e, "utf8") : e).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, ""), Q = (e) => {
+}, ot = (e, t) => t.resolveGroups ? b.promise(async () => await t.resolveGroups(e)) : b.succeed(et(e)), Y = () => G.read("VOLTRO_STORAGE_SECRET") ?? ie(), X = (e) => (typeof e == "string" ? Buffer.from(e, "utf8") : e).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, ""), Z = (e) => {
 	let t = e.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - e.length % 4) % 4);
 	return Buffer.from(t, "base64");
-}, ot = (e, t, n = X()) => {
+}, st = (e, t, n = Y()) => {
 	if (!n) throw Error("signGrant: secret must be a non-empty string");
 	let r = {
 		refId: e,
 		exp: Math.floor(Date.now() / 1e3) + Math.floor(t)
-	}, i = Z(JSON.stringify(r));
-	return `${i}.${Z(I("sha256", n).update(i).digest())}`;
-}, st = (e, t = X()) => {
+	}, i = X(JSON.stringify(r));
+	return `${i}.${X(L("sha256", n).update(i).digest())}`;
+}, ct = (e, t = Y()) => {
 	if (!e || !t) return null;
 	let n = e.indexOf(".");
 	if (n <= 0 || n === e.length - 1) return null;
-	let r = e.slice(0, n), i = e.slice(n + 1), a = I("sha256", t).update(r).digest(), o = Q(i);
-	if (o.length !== a.length || !L(o, a)) return null;
+	let r = e.slice(0, n), i = e.slice(n + 1), a = L("sha256", t).update(r).digest(), o = Z(i);
+	if (o.length !== a.length || !z(o, a)) return null;
 	try {
-		let e = JSON.parse(Q(r).toString("utf8"));
+		let e = JSON.parse(Z(r).toString("utf8"));
 		return typeof e.refId != "string" || typeof e.exp != "number" || e.exp < Math.floor(Date.now() / 1e3) ? null : e;
 	} catch {
 		return null;
 	}
-}, ct = (e, t, n = X()) => {
+}, lt = (e, t, n = Y()) => {
 	if (!n) throw Error("signUploadTicket: secret must be a non-empty string");
 	let r = {
 		...e,
 		exp: Math.floor(Date.now() / 1e3) + Math.floor(t)
-	}, i = Z(JSON.stringify(r));
-	return `${i}.${Z(I("sha256", n).update(`u:${i}`).digest())}`;
-}, lt = (e, t = X()) => {
+	}, i = X(JSON.stringify(r));
+	return `${i}.${X(L("sha256", n).update(`u:${i}`).digest())}`;
+}, ut = (e, t = Y()) => {
 	if (!e || !t) return null;
 	let n = e.indexOf(".");
 	if (n <= 0 || n === e.length - 1) return null;
-	let r = e.slice(0, n), i = e.slice(n + 1), a = I("sha256", t).update(`u:${r}`).digest(), o = Q(i);
-	if (o.length !== a.length || !L(o, a)) return null;
+	let r = e.slice(0, n), i = e.slice(n + 1), a = L("sha256", t).update(`u:${r}`).digest(), o = Z(i);
+	if (o.length !== a.length || !z(o, a)) return null;
 	try {
-		let e = JSON.parse(Q(r).toString("utf8"));
+		let e = JSON.parse(Z(r).toString("utf8"));
 		return typeof e.ct != "string" || typeof e.exp != "number" || e.vis !== "public" && e.vis !== "private" || e.exp < Math.floor(Date.now() / 1e3) ? null : e;
 	} catch {
 		return null;
 	}
-}, ut = (e, t, n = X()) => {
+}, dt = (e, t, n = Y()) => {
 	if (!n) throw Error("signFinalizeTicket: secret must be a non-empty string");
 	let r = {
 		...e,
 		exp: Math.floor(Date.now() / 1e3) + Math.floor(t)
-	}, i = Z(JSON.stringify(r));
-	return `${i}.${Z(I("sha256", n).update(`f:${i}`).digest())}`;
-}, dt = (e, t = X()) => {
+	}, i = X(JSON.stringify(r));
+	return `${i}.${X(L("sha256", n).update(`f:${i}`).digest())}`;
+}, ft = (e, t = Y()) => {
 	if (!e || !t) return null;
 	let n = e.indexOf(".");
 	if (n <= 0 || n === e.length - 1) return null;
-	let r = e.slice(0, n), i = e.slice(n + 1), a = I("sha256", t).update(`f:${r}`).digest(), o = Q(i);
-	if (o.length !== a.length || !L(o, a)) return null;
+	let r = e.slice(0, n), i = e.slice(n + 1), a = L("sha256", t).update(`f:${r}`).digest(), o = Z(i);
+	if (o.length !== a.length || !z(o, a)) return null;
 	try {
-		let e = JSON.parse(Q(r).toString("utf8"));
+		let e = JSON.parse(Z(r).toString("utf8"));
 		return typeof e.key != "string" || e.key.length === 0 || typeof e.ct != "string" || typeof e.exp != "number" || e.vis !== "public" && e.vis !== "private" || e.exp < Math.floor(Date.now() / 1e3) ? null : e;
 	} catch {
 		return null;
 	}
-}, ft = (e, t, n = X()) => {
+}, pt = (e, t, n = Y()) => {
 	if (!n) throw Error("signResumableTicket: secret must be a non-empty string");
 	let r = {
 		...e,
 		exp: Math.floor(Date.now() / 1e3) + Math.floor(t)
-	}, i = Z(JSON.stringify(r));
-	return `${i}.${Z(I("sha256", n).update(`r:${i}`).digest())}`;
-}, pt = (e, t = X()) => {
+	}, i = X(JSON.stringify(r));
+	return `${i}.${X(L("sha256", n).update(`r:${i}`).digest())}`;
+}, mt = (e, t = Y()) => {
 	if (!e || !t) return null;
 	let n = e.indexOf(".");
 	if (n <= 0 || n === e.length - 1) return null;
-	let r = e.slice(0, n), i = e.slice(n + 1), a = I("sha256", t).update(`r:${r}`).digest(), o = Q(i);
-	if (o.length !== a.length || !L(o, a)) return null;
+	let r = e.slice(0, n), i = e.slice(n + 1), a = L("sha256", t).update(`r:${r}`).digest(), o = Z(i);
+	if (o.length !== a.length || !z(o, a)) return null;
 	try {
-		let e = JSON.parse(Q(r).toString("utf8"));
+		let e = JSON.parse(Z(r).toString("utf8"));
 		return typeof e.id != "string" || e.id.length === 0 || typeof e.size != "number" || e.size < 0 || typeof e.ct != "string" || typeof e.exp != "number" || e.vis !== "public" && e.vis !== "private" || e.exp < Math.floor(Date.now() / 1e3) ? null : e;
 	} catch {
 		return null;
 	}
-}, mt = (e, t, n = X()) => {
+}, ht = (e, t, n = Y()) => {
 	if (!n) throw Error("signMultipartTicket: secret must be a non-empty string");
 	let r = {
 		...e,
 		exp: Math.floor(Date.now() / 1e3) + Math.floor(t)
-	}, i = Z(JSON.stringify(r));
-	return `${i}.${Z(I("sha256", n).update(`m:${i}`).digest())}`;
-}, ht = (e, t = X()) => {
+	}, i = X(JSON.stringify(r));
+	return `${i}.${X(L("sha256", n).update(`m:${i}`).digest())}`;
+}, gt = (e, t = Y()) => {
 	if (!e || !t) return null;
 	let n = e.indexOf(".");
 	if (n <= 0 || n === e.length - 1) return null;
-	let r = e.slice(0, n), i = e.slice(n + 1), a = I("sha256", t).update(`m:${r}`).digest(), o = Q(i);
-	if (o.length !== a.length || !L(o, a)) return null;
+	let r = e.slice(0, n), i = e.slice(n + 1), a = L("sha256", t).update(`m:${r}`).digest(), o = Z(i);
+	if (o.length !== a.length || !z(o, a)) return null;
 	try {
-		let e = JSON.parse(Q(r).toString("utf8"));
+		let e = JSON.parse(Z(r).toString("utf8"));
 		return typeof e.key != "string" || e.key.length === 0 || typeof e.uploadId != "string" || e.uploadId.length === 0 || typeof e.ct != "string" || typeof e.exp != "number" || e.vis !== "public" && e.vis !== "private" || e.exp < Math.floor(Date.now() / 1e3) ? null : e;
 	} catch {
 		return null;
 	}
-}, gt = (e, t) => {
+}, _t = (e, t) => {
 	if (!t || t.length === 0) return !0;
 	let n = e.toLowerCase();
 	return t.some((e) => {
 		let t = e.toLowerCase();
 		return t.endsWith("/*") ? n.startsWith(t.slice(0, -1)) : n === t;
 	});
-}, _t = [
+}, vt = [
 	{
 		ct: /^image\/png$/,
 		offset: 0,
@@ -961,21 +961,21 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 		offset: 0,
 		magic: [31, 139]
 	}
-], vt = (e, t) => {
-	let n = t.toLowerCase(), r = _t.find((e) => e.ct.test(n));
+], yt = (e, t) => {
+	let n = t.toLowerCase(), r = vt.find((e) => e.ct.test(n));
 	return r ? e.length < r.offset + r.magic.length ? !1 : r.magic.every((t, n) => e[r.offset + n] === t) : !0;
-}, yt = (e, t, n) => n ? n.maxBytes !== void 0 && e.byteLength > n.maxBytes ? {
+}, bt = (e, t, n) => n ? n.maxBytes !== void 0 && e.byteLength > n.maxBytes ? {
 	reason: "too-large",
 	detail: `${e.byteLength} bytes exceeds the ${n.maxBytes}-byte limit`
-} : gt(t, n.allowedContentTypes) ? n.sniff && !vt(e, t) ? {
+} : _t(t, n.allowedContentTypes) ? n.sniff && !yt(e, t) ? {
 	reason: "content-mismatch",
 	detail: `bytes do not match the declared content type '${t}'`
 } : null : {
 	reason: "content-type-not-allowed",
 	detail: `content type '${t}' is not in the allow-list`
-} : null, bt = async (e, t, n) => {
-	if (!He(t)) return { bytes: e };
-	let r = await Ue();
+} : null, xt = async (e, t, n) => {
+	if (!Ue(t)) return { bytes: e };
+	let r = await We();
 	if (!r) return { bytes: e };
 	try {
 		let t = e;
@@ -998,10 +998,10 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 	} catch {
 		return { bytes: e };
 	}
-}, xt = async (e) => {
+}, St = async (e) => {
 	let { createHash: t } = await import("node:crypto");
 	return t("sha256").update(e).digest("hex");
-}, St = (e, t) => e ? `${e.replace(/\/+$/, "")}/_voltro/storage/${t}` : `/_voltro/storage/${t}`, Ct = (e, t) => {
+}, Ct = (e, t) => e ? `${e.replace(/\/+$/, "")}/_voltro/storage/${t}` : `/_voltro/storage/${t}`, wt = (e, t) => {
 	if (t.tenantId !== void 0 && (e.tenantId ?? null) !== (t.tenantId ?? null) || t.ownerId !== void 0 && e.ownerId !== t.ownerId || !t.includeDerived && e.derivedFrom != null) return !1;
 	if (t.folder !== void 0) {
 		let n = t.folder.replace(/\/+$/, ""), r = (e.folder ?? "").replace(/\/+$/, "");
@@ -1012,7 +1012,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 		if (!t.tags.every((e) => n.includes(e))) return !1;
 	}
 	return !0;
-}, wt = (e) => e ?? "global", Tt = () => {
+}, Tt = (e) => e ?? "global", Et = () => {
 	let e = /* @__PURE__ */ new Map(), t = /* @__PURE__ */ new Map();
 	return {
 		insert: (t) => b.sync(() => {
@@ -1031,7 +1031,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 			};
 		}),
 		consumeUsage: (e, n, r) => b.sync(() => {
-			let i = wt(e), a = t.get(i) ?? {
+			let i = Tt(e), a = t.get(i) ?? {
 				bytes: 0,
 				count: 0
 			}, o = (r?.maxBytes === void 0 || a.bytes + n.bytes <= r.maxBytes) && (r?.maxCount === void 0 || a.count + n.count <= r.maxCount);
@@ -1045,16 +1045,16 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 			};
 		}),
 		releaseUsage: (e, n) => b.sync(() => {
-			let r = wt(e), i = t.get(r);
+			let r = Tt(e), i = t.get(r);
 			i && t.set(r, {
 				bytes: Math.max(0, i.bytes - n.bytes),
 				count: Math.max(0, i.count - n.count)
 			});
 		}),
 		listByDerivedFrom: (t) => b.sync(() => [...e.values()].filter((e) => (e.derivedFrom ?? null) === t)),
-		listRefs: (t) => b.sync(() => [...e.values()].filter((e) => Ct(e, t)).sort((e, t) => t.createdAt.getTime() - e.createdAt.getTime()).slice(t.offset, t.offset + t.limit))
+		listRefs: (t) => b.sync(() => [...e.values()].filter((e) => wt(e, t)).sort((e, t) => t.createdAt.getTime() - e.createdAt.getTime()).slice(t.offset, t.offset + t.limit))
 	};
-}, Et = (e) => Array.isArray(e) && e.every((e) => typeof e == "string") ? e : null, Dt = (e) => ({
+}, Dt = (e) => Array.isArray(e) && e.every((e) => typeof e == "string") ? e : null, Ot = (e) => ({
 	id: String(e.id),
 	tenantId: e.tenantId ?? null,
 	ownerId: e.ownerId ?? null,
@@ -1072,19 +1072,19 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 	duration: e.duration ?? null,
 	placeholder: e.placeholder ?? null,
 	folder: e.folder ?? null,
-	tags: Et(e.tags),
+	tags: Dt(e.tags),
 	alt: e.alt ?? null,
 	caption: e.caption ?? null,
 	derivedFrom: e.derivedFrom ?? null,
 	kind: e.kind ?? null
-}), $ = (e) => b.tryPromise({
+}), Q = (e) => b.tryPromise({
 	try: e,
 	catch: (e) => new t({
 		provider: "refstore",
 		message: String(e?.message ?? e),
 		transient: !0
 	})
-}), Ot = async (e, t) => (await e.query({
+}), kt = async (e, t) => (await e.query({
 	table: "_voltro_storage_usage",
 	predicate: {
 		column: "tenantId",
@@ -1095,9 +1095,9 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 	take: 1,
 	skip: void 0,
 	projection: void 0
-}))[0] ?? null, kt = (e) => ({
-	insert: (t) => $(() => e.insert(H, { ...t })),
-	getById: (t) => $(async () => {
+}))[0] ?? null, At = (e) => ({
+	insert: (t) => Q(() => e.insert(H, { ...t })),
+	getById: (t) => Q(async () => {
 		let n = await e.query({
 			table: H,
 			predicate: {
@@ -1110,10 +1110,10 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 			skip: void 0,
 			projection: void 0
 		});
-		return n[0] ? Dt(n[0]) : null;
+		return n[0] ? Ot(n[0]) : null;
 	}),
-	delete: (t) => $(() => e.delete(H, t)),
-	listRecent: (t) => $(async () => (await e.query({
+	delete: (t) => Q(() => e.delete(H, t)),
+	listRecent: (t) => Q(async () => (await e.query({
 		table: H,
 		predicate: void 0,
 		order: [{
@@ -1123,8 +1123,8 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 		take: t,
 		skip: void 0,
 		projection: void 0
-	})).map(Dt)),
-	countByKey: (t, n) => $(async () => (await e.query({
+	})).map(Ot)),
+	countByKey: (t, n) => Q(async () => (await e.query({
 		table: H,
 		predicate: { and: [{
 			column: "bucket",
@@ -1140,7 +1140,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 		skip: void 0,
 		projection: void 0
 	})).length),
-	usageByTenant: (t) => $(async () => {
+	usageByTenant: (t) => Q(async () => {
 		let n = await e.query({
 			table: H,
 			predicate: {
@@ -1159,11 +1159,11 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 			count: n.length
 		};
 	}),
-	consumeUsage: (t, n, r) => $(async () => {
-		let i = wt(t);
+	consumeUsage: (t, n, r) => Q(async () => {
+		let i = Tt(t);
 		for (let t = 0; t < 32; t++) {
 			t > 0 && await new Promise((e) => setTimeout(e, t));
-			let a = await Ot(e, i), o = a ? Number(a.bytes ?? 0) : 0, s = a ? Number(a.count ?? 0) : 0;
+			let a = await kt(e, i), o = a ? Number(a.bytes ?? 0) : 0, s = a ? Number(a.count ?? 0) : 0;
 			if (!((r?.maxBytes === void 0 || o + n.bytes <= r.maxBytes) && (r?.maxCount === void 0 || s + n.count <= r.maxCount))) return {
 				allowed: !1,
 				bytes: o,
@@ -1183,7 +1183,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 				let t = k({
 					kind: "typeid",
 					prefix: "susage"
-				}, G), r = await e.insertIgnore(G, {
+				}, Ee), r = await e.insertIgnore(Ee, {
 					id: t,
 					tenantId: i,
 					bytes: n.bytes,
@@ -1199,11 +1199,11 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 		}
 		throw Error(`storage usage consume: contention on tenant '${i}' exceeded 32 attempts`);
 	}),
-	releaseUsage: (t, n) => $(async () => {
-		let r = wt(t);
+	releaseUsage: (t, n) => Q(async () => {
+		let r = Tt(t);
 		for (let t = 0; t < 32; t++) {
 			t > 0 && await new Promise((e) => setTimeout(e, t));
-			let i = await Ot(e, r);
+			let i = await kt(e, r);
 			if (!i) return;
 			let a = Number(i.bytes ?? 0), o = Number(i.count ?? 0);
 			if (await e.updateMany("_voltro_storage_usage", {
@@ -1214,7 +1214,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 		}
 		throw Error(`storage usage release: contention on tenant '${r}' exceeded 32 attempts`);
 	}),
-	listByDerivedFrom: (t) => $(async () => (await e.query({
+	listByDerivedFrom: (t) => Q(async () => (await e.query({
 		table: H,
 		predicate: {
 			column: "derivedFrom",
@@ -1228,8 +1228,8 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 		take: void 0,
 		skip: void 0,
 		projection: void 0
-	})).map(Dt)),
-	listRefs: (t) => $(async () => {
+	})).map(Ot)),
+	listRefs: (t) => Q(async () => {
 		let n = [];
 		t.tenantId !== void 0 && n.push({
 			column: "tenantId",
@@ -1251,9 +1251,9 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 			take: void 0,
 			skip: void 0,
 			projection: void 0
-		})).map(Dt).filter((e) => Ct(e, t)).slice(t.offset, t.offset + t.limit);
+		})).map(Ot).filter((e) => wt(e, t)).slice(t.offset, t.offset + t.limit);
 	})
-}), At = () => {
+}), jt = () => {
 	let e = /* @__PURE__ */ new Map();
 	return {
 		insert: (t) => b.sync(() => {
@@ -1268,7 +1268,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 			for (let [n, r] of e) r.refId === t && e.delete(n);
 		})
 	};
-}, jt = (e) => ({
+}, Mt = (e) => ({
 	id: String(e.id),
 	refId: String(e.refId),
 	principalType: e.principalType,
@@ -1277,10 +1277,10 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 	createdAt: e.createdAt instanceof Date ? e.createdAt : new Date(String(e.createdAt)),
 	expiresAt: e.expiresAt ? e.expiresAt instanceof Date ? e.expiresAt : new Date(String(e.expiresAt)) : null,
 	createdBy: e.createdBy ?? null
-}), Mt = (e) => ({
-	insert: (t) => $(() => e.insert(U, { ...t })),
-	delete: (t) => $(() => e.delete(U, t)),
-	getById: (t) => $(async () => {
+}), Nt = (e) => ({
+	insert: (t) => Q(() => e.insert(U, { ...t })),
+	delete: (t) => Q(() => e.delete(U, t)),
+	getById: (t) => Q(async () => {
 		let n = (await e.query({
 			table: U,
 			predicate: {
@@ -1293,9 +1293,9 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 			skip: void 0,
 			projection: void 0
 		}))[0];
-		return n ? jt(n) : null;
+		return n ? Mt(n) : null;
 	}),
-	listByRef: (t) => $(async () => (await e.query({
+	listByRef: (t) => Q(async () => (await e.query({
 		table: U,
 		predicate: {
 			column: "refId",
@@ -1309,8 +1309,8 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 		take: void 0,
 		skip: void 0,
 		projection: void 0
-	})).map(jt)),
-	deleteByRef: (t) => $(async () => {
+	})).map(Mt)),
+	deleteByRef: (t) => Q(async () => {
 		let n = await e.query({
 			table: U,
 			predicate: {
@@ -1325,14 +1325,14 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 		});
 		for (let t of n) await e.delete(U, String(t.id));
 	})
-}), Nt = () => k({
+}), Pt = () => k({
 	kind: "typeid",
 	prefix: "file"
-}, H), Pt = () => k({
+}, H), Ft = () => k({
 	kind: "typeid",
 	prefix: "grant"
-}, U), Ft = (i) => {
-	let { provider: a, refStore: o, grantStore: s, bucket: c } = i, l = i.access ?? {}, u = i.attempts ?? 3, d = i.urlExpiresInSec ?? 3600, f = (e) => St(i.publicBaseUrl, e), p = C.recurs(Math.max(0, u - 1)).pipe(C.intersect(C.exponential("100 millis")), C.whileInput((e) => e.transient)), m = (e, t, n) => [
+}, U), It = (i) => {
+	let { provider: a, refStore: o, grantStore: s, bucket: c } = i, l = i.access ?? {}, u = i.attempts ?? 3, d = i.urlExpiresInSec ?? 3600, f = (e) => Ct(i.publicBaseUrl, e), p = C.recurs(Math.max(0, u - 1)).pipe(C.intersect(C.exponential("100 millis")), C.whileInput((e) => e.transient)), m = (e, t, n) => [
 		i.tenantPrefix,
 		e ?? "global",
 		n ?? t
@@ -1385,7 +1385,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 			catch: () => null
 		}).pipe(b.catchAll(() => b.succeed(null)));
 	}), v = (e) => b.gen(function* () {
-		let t = yt(e.bytes, e.contentType, i.limits);
+		let t = bt(e.bytes, e.contentType, i.limits);
 		if (t) return yield* b.fail(new n(t));
 		if (i.scan) {
 			let t = yield* te({
@@ -1395,10 +1395,10 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 			});
 			if (!t.clean) return yield* b.fail(new r({ threat: t.threat ?? "unknown" }));
 		}
-		let s = yield* b.promise(() => bt(e.bytes, e.contentType, { normalize: i.normalizeImages ?? !1 })), l = s.bytes, u = yield* ne({
+		let s = yield* b.promise(() => xt(e.bytes, e.contentType, { normalize: i.normalizeImages ?? !1 })), l = s.bytes, u = yield* ne({
 			bytes: l,
 			contentType: e.contentType
-		}), d = s.width ?? u?.width, f = s.height ?? u?.height, h = s.placeholder ?? u?.poster, g = e.duration ?? u?.duration, _ = yield* b.promise(() => xt(l)), v = e.tenantId ?? null, y = e.visibility ?? "private", C = m(v, _, yield* ee(e.key)), w = {
+		}), d = s.width ?? u?.width, f = s.height ?? u?.height, h = s.placeholder ?? u?.poster, g = e.duration ?? u?.duration, _ = yield* b.promise(() => St(l)), v = e.tenantId ?? null, y = e.visibility ?? "private", C = m(v, _, yield* ee(e.key)), w = {
 			bytes: l.byteLength,
 			count: 1
 		}, T = yield* o.consumeUsage(v, w, i.quota);
@@ -1409,8 +1409,8 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 				detail: t
 			}));
 		}
-		let re = e.password ? yield* b.sync(() => qe(e.password)) : null, E = {
-			id: Nt(),
+		let re = e.password ? yield* b.sync(() => Je(e.password)) : null, E = {
+			id: Pt(),
 			tenantId: v,
 			ownerId: e.ownerId ?? null,
 			bucket: c,
@@ -1471,12 +1471,12 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 		}
 		return r;
 	}), w = (e, t, n) => b.gen(function* () {
-		if (e.visibility === "public" || (yield* tt(e, t, {
+		if (e.visibility === "public" || (yield* nt(e, t, {
 			...l,
 			...n?.password === void 0 ? {} : { password: n.password }
 		}))) return !0;
-		let r = yield* at(t, l);
-		return it(yield* s.listByRef(e.id), t, r, n?.permission ?? "read", Date.now());
+		let r = yield* ot(t, l);
+		return at(yield* s.listByRef(e.id), t, r, n?.permission ?? "read", Date.now());
 	}), T = (e) => {
 		if (e.visibility === "public") {
 			let t = a.publicUrl?.(e.key);
@@ -1530,7 +1530,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 			}));
 			let c = i?.expiresInSec ?? d;
 			if (a.presigns) return yield* a.getUrl(s.key, c);
-			let l = yield* b.sync(() => ot(s.id, c));
+			let l = yield* b.sync(() => st(s.id, c));
 			return `${f(s.id)}?t=${l}`;
 		}),
 		mintUploadUrl: (e) => b.gen(function* () {
@@ -1546,7 +1546,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 		checkAccess: w,
 		grant: (e) => b.gen(function* () {
 			let t = {
-				id: Pt(),
+				id: Ft(),
 				refId: e.refId,
 				principalType: e.principalType,
 				principalId: e.principalId,
@@ -1728,7 +1728,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 				detail: `multipart upload of ${l} bytes exceeds tenant quota`
 			}));
 			let m = {
-				id: Nt(),
+				id: Pt(),
 				tenantId: e.tenantId ?? null,
 				ownerId: e.ownerId ?? null,
 				bucket: c,
@@ -1749,7 +1749,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 		}),
 		abortMultipart: (e) => b.suspend(() => a.abortMultipartUpload ? a.abortMultipartUpload(e.key, e.uploadId).pipe(b.retry(p)) : b.void)
 	};
-}, It = (e) => S.succeed(i, Ft(e)), Lt = (e, t = 65536) => {
+}, Lt = (e) => S.succeed(i, It(e)), Rt = (e, t = 65536) => {
 	let n = [Buffer.from("zINSTREAM\0", "utf8")];
 	for (let r = 0; r < e.length; r += t) {
 		let i = e.subarray(r, Math.min(r + t, e.length)), a = Buffer.alloc(4);
@@ -1757,7 +1757,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 	}
 	let r = Buffer.alloc(4);
 	return r.writeUInt32BE(0, 0), n.push(r), Buffer.concat(n);
-}, Rt = (e) => {
+}, zt = (e) => {
 	let t = e.replace(/\0+$/, "").trim();
 	if (/\bOK$/.test(t)) return { clean: !0 };
 	let n = /:\s*(.+?)\s+FOUND$/.exec(t);
@@ -1766,8 +1766,8 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 		threat: n[1] ?? "unknown"
 	};
 	throw Error(`clamav: unexpected response: ${t}`);
-}, zt = async (e, t) => {
-	let n = await import("node:net"), r = K.read("CLAMAV_HOST", t.host) ?? "127.0.0.1", i = K.read("CLAMAV_PORT"), a = t.port ?? (i ? Number(i) : 3310), o = t.timeoutMs ?? 3e4;
+}, Bt = async (e, t) => {
+	let n = await import("node:net"), r = G.read("CLAMAV_HOST", t.host) ?? "127.0.0.1", i = G.read("CLAMAV_PORT"), a = t.port ?? (i ? Number(i) : 3310), o = t.timeoutMs ?? 3e4;
 	return new Promise((i, s) => {
 		let c = n.createConnection({
 			host: r,
@@ -1778,20 +1778,20 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 		c.on("error", (e) => {
 			clearTimeout(u), s(e);
 		}), c.on("connect", () => {
-			c.end(Lt(e, t.chunkSize));
+			c.end(Rt(e, t.chunkSize));
 		}), c.on("data", (e) => {
 			l += e.toString("utf8");
 		}), c.on("close", () => {
 			clearTimeout(u);
 			try {
-				i(Rt(l));
+				i(zt(l));
 			} catch (e) {
 				s(e);
 			}
 		});
 	});
-}, Bt = (e = {}) => (t) => zt(t.bytes, e), Vt = (e, t, n) => new Promise((r, i) => {
-	let a = pe(e, [...t], { stdio: [
+}, Vt = (e = {}) => (t) => Bt(t.bytes, e), Ht = (e, t, n) => new Promise((r, i) => {
+	let a = de(e, [...t], { stdio: [
 		"ignore",
 		"ignore",
 		"pipe"
@@ -1805,31 +1805,31 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 	}), a.on("close", (e) => {
 		clearTimeout(s), e === 0 ? r() : i(/* @__PURE__ */ Error(`ffmpeg exited ${String(e)}: ${o.slice(-400)}`));
 	});
-}), Ht = (e) => async ({ bytes: t }) => {
-	let n = e.ffmpegPath ?? "ffmpeg", r = e.timeoutMs ?? 3e5, i = await me(B(ge(), "voltro-tc-")), a = B(i, "in"), o = [];
+}), Ut = (e) => async ({ bytes: t }) => {
+	let n = e.ffmpegPath ?? "ffmpeg", r = e.timeoutMs ?? 3e5, i = await fe(he(V(), "voltro-tc-")), a = he(i, "in"), o = [];
 	try {
-		await z(a, t);
+		await B(a, t);
 		for (let t of e.renditions) {
-			let e = B(i, `out.${t.ext}`);
+			let e = he(i, `out.${t.ext}`);
 			try {
-				await Vt(n, [
+				await Ht(n, [
 					"-y",
 					"-i",
 					a,
 					...t.args,
 					e
 				], r);
-				let i = await he(e);
+				let i = await pe(e);
 				o.push({
 					bytes: new Uint8Array(i),
 					contentType: t.contentType,
 					kind: t.kind,
 					...t.label === void 0 ? {} : { label: t.label }
-				}), await R(e, { force: !0 });
+				}), await me(e, { force: !0 });
 			} catch {}
 		}
 	} finally {
-		await R(i, {
+		await me(i, {
 			recursive: !0,
 			force: !0
 		}).catch(() => void 0);
@@ -1838,21 +1838,21 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
 };
 //#endregion
 //#region src/assetRef.ts
-function Ut(e = {}) {
-	let t = e.nullable ?? !0, n = e.fk === !1 ? P().externalId() : ce(() => Ee, { onDelete: e.onDelete ?? "setNull" });
+function Wt(e = {}) {
+	let t = e.nullable ?? !0, n = e.fk === !1 ? P().externalId() : ce(() => De, { onDelete: e.onDelete ?? "setNull" });
 	return t ? n.nullable() : n;
 }
-var Wt = () => se({
+var Gt = () => se({
 	id: "@voltro/plugin-storage/withStorage",
-	fields: { asset: Ut() }
-}), Gt = {
+	fields: { asset: Wt() }
+}), Kt = {
 	"image/png": "png",
 	"image/jpeg": "jpg",
 	"image/jpg": "jpg",
 	"image/gif": "gif",
 	"image/webp": "webp",
 	"image/svg+xml": "svg"
-}, Kt = (e) => {
+}, qt = (e) => {
 	let t = /^data:([^;,]+)(;base64)?,(.*)$/s.exec(e);
 	if (!t) throw Error("not a data URI");
 	let n = t[1] || "application/octet-stream", r = !!t[2], i = t[3] ?? "";
@@ -1860,16 +1860,16 @@ var Wt = () => se({
 		bytes: r ? new Uint8Array(Buffer.from(i, "base64")) : new Uint8Array(Buffer.from(decodeURIComponent(i), "utf8")),
 		contentType: n
 	};
-}, qt = (e, n) => b.gen(function* () {
+}, Jt = (e, n) => b.gen(function* () {
 	let r = yield* b.try({
-		try: () => Kt(n.dataUri),
+		try: () => qt(n.dataUri),
 		catch: (e) => new t({
 			provider: "avatar",
 			message: String(e?.message ?? e),
 			transient: !1,
 			status: 400
 		})
-	}), i = Gt[r.contentType] ?? "bin";
+	}), i = Kt[r.contentType] ?? "bin";
 	return yield* e.put({
 		bytes: r.bytes,
 		contentType: r.contentType,
@@ -1878,27 +1878,27 @@ var Wt = () => se({
 		visibility: "public",
 		key: `avatars/${n.userId}/avatar.${i}`
 	});
-}), Jt = (e) => {
+}), Yt = (e) => {
 	try {
-		let t = _e(e), n = _e("/");
+		let t = ge(e), n = ge("/");
 		return typeof t.dev != "number" || typeof n.dev != "number" ? "unknown" : t.dev === n.dev ? "same-device-as-root" : "separate-mount";
 	} catch {
 		return "unknown";
 	}
-}, Yt = (e) => {
-	if (Jt(e) === "same-device-as-root") return `the capture is going to ${e}, which is on the SAME filesystem as \`/\`.\n  A mounted volume would be a separate one. If this process is a container, that means the capture
+}, Xt = (e) => {
+	if (Yt(e) === "same-device-as-root") return `the capture is going to ${e}, which is on the SAME filesystem as \`/\`.\n  A mounted volume would be a separate one. If this process is a container, that means the capture
   dies with it — which is the exact failure it exists for. On a development machine this is normal
   and can be ignored.`;
-}, Xt = K.read("VOLTRO_SESSION_COOKIE") ?? "voltro:session", Zt, Qt = (e) => {
-	Zt = e;
-}, $t = () => Zt ?? tn({}), en = () => Zt === void 0 ? K.read("STORAGE_PROVIDER") === void 0 ? void 0 : tn({}) : Zt, tn = (e) => {
+}, Zt = G.read("VOLTRO_SESSION_COOKIE") ?? "voltro:session", Qt, $t = (e) => {
+	Qt = e;
+}, en = () => Qt ?? nn({}), tn = () => Qt === void 0 ? G.read("STORAGE_PROVIDER") === void 0 ? void 0 : nn({}) : Qt, nn = (e) => {
 	if (e.provider && typeof e.provider == "object") return e.provider;
-	let t = (e.provider ?? K.read("STORAGE_PROVIDER") ?? "memory").toLowerCase(), n = K.read("S3_BUCKET", e.bucket) ?? K.read("STORAGE_BUCKET") ?? "voltro";
+	let t = (e.provider ?? G.read("STORAGE_PROVIDER") ?? "memory").toLowerCase(), n = G.read("S3_BUCKET", e.bucket) ?? G.read("STORAGE_BUCKET") ?? "voltro";
 	switch (t) {
 		case "s3":
 		case "minio": {
-			let r = K.read("S3_REGION", e.region) ?? K.read("AWS_REGION"), i = K.read("S3_ENDPOINT", e.endpoint) ?? K.read("MINIO_ENDPOINT"), a = K.read("S3_ACCESS_KEY_ID", e.accessKeyId) ?? K.read("AWS_ACCESS_KEY_ID"), o = K.read("S3_SECRET_ACCESS_KEY", e.secretAccessKey) ?? K.read("AWS_SECRET_ACCESS_KEY"), s = K.read("STORAGE_CDN_URL", e.cdnBaseUrl);
-			return Ie({
+			let r = G.read("S3_REGION", e.region) ?? G.read("AWS_REGION"), i = G.read("S3_ENDPOINT", e.endpoint) ?? G.read("MINIO_ENDPOINT"), a = G.read("S3_ACCESS_KEY_ID", e.accessKeyId) ?? G.read("AWS_ACCESS_KEY_ID"), o = G.read("S3_SECRET_ACCESS_KEY", e.secretAccessKey) ?? G.read("AWS_SECRET_ACCESS_KEY"), s = G.read("STORAGE_CDN_URL", e.cdnBaseUrl);
+			return Le({
 				bucket: n,
 				name: t,
 				...r ? { region: r } : {},
@@ -1907,13 +1907,13 @@ var Wt = () => se({
 				...o ? { secretAccessKey: o } : {},
 				...s ? { cdnBaseUrl: s } : {},
 				...e.publicAcl === void 0 ? {} : { publicAcl: e.publicAcl },
-				...t === "minio" || K.read("S3_FORCE_PATH_STYLE") === "1" ? { forcePathStyle: !0 } : {}
+				...t === "minio" || G.read("S3_FORCE_PATH_STYLE") === "1" ? { forcePathStyle: !0 } : {}
 			});
 		}
 		case "azure": {
-			let t = K.read("AZURE_STORAGE_ACCOUNT", e.accountName), r = K.read("AZURE_STORAGE_KEY", e.accountKey), i = K.read("AZURE_STORAGE_CONNECTION_STRING", e.connectionString), a = K.read("AZURE_STORAGE_ENDPOINT", e.endpoint), o = K.read("STORAGE_CDN_URL", e.cdnBaseUrl);
-			return ze({
-				container: K.read("AZURE_STORAGE_CONTAINER", e.bucket) ?? n,
+			let t = G.read("AZURE_STORAGE_ACCOUNT", e.accountName), r = G.read("AZURE_STORAGE_KEY", e.accountKey), i = G.read("AZURE_STORAGE_CONNECTION_STRING", e.connectionString), a = G.read("AZURE_STORAGE_ENDPOINT", e.endpoint), o = G.read("STORAGE_CDN_URL", e.cdnBaseUrl);
+			return Be({
+				container: G.read("AZURE_STORAGE_CONTAINER", e.bucket) ?? n,
 				...t ? { accountName: t } : {},
 				...r ? { accountKey: r } : {},
 				...i ? { connectionString: i } : {},
@@ -1921,15 +1921,15 @@ var Wt = () => se({
 				...o ? { cdnBaseUrl: o } : {}
 			});
 		}
-		case "database": return Re();
-		case "filesystem": return Fe({ root: K.read("STORAGE_ROOT", e.root) ?? ".voltro-storage" });
-		default: return Pe(e.name ?? "default");
+		case "database": return ze();
+		case "filesystem": return Ie({ root: G.read("STORAGE_ROOT", e.root) ?? ".voltro-storage" });
+		default: return Fe(e.name ?? "default");
 	}
-}, nn = (e) => {
+}, rn = (e) => {
 	if (e !== void 0) return e;
-	let t = K.read("STORAGE_ALLOWED_ORIGINS");
+	let t = G.read("STORAGE_ALLOWED_ORIGINS");
 	return t ? t.trim() === "*" ? "*" : t.split(",").map((e) => e.trim()).filter(Boolean) : [];
-}, rn = (e, t) => {
+}, an = (e, t) => {
 	if (!e || t !== "*" && !t.includes(e)) return {};
 	let n = {
 		"access-control-allow-origin": t === "*" ? "*" : e,
@@ -1939,7 +1939,7 @@ var Wt = () => se({
 		vary: "Origin"
 	};
 	return t !== "*" && (n["access-control-allow-credentials"] = "true"), n;
-}, an = (e) => ({
+}, on = (e) => ({
 	id: e.id,
 	tenantId: e.tenantId,
 	ownerId: e.ownerId,
@@ -1962,18 +1962,29 @@ var Wt = () => se({
 	caption: e.caption ?? null,
 	derivedFrom: e.derivedFrom ?? null,
 	kind: e.kind ?? null
-}), on = () => new t({
+}), sn = () => new t({
 	provider: "storage",
 	message: "not permitted to administer sharing for this object",
 	transient: !1,
 	status: 403
-}), sn = (e, t, n) => {
+}), cn = (e, t, n) => {
 	let r = n.request.subject;
-	return (r.scopes ?? []).includes("admin:full") ? b.void : e.head(t, { tenantId: r.tenantId ?? null }).pipe(b.catchAll(() => b.fail(on())), b.flatMap((e) => {
+	return (r.scopes ?? []).includes("admin:full") ? b.void : e.head(t, { tenantId: r.tenantId ?? null }).pipe(b.catchAll(() => b.fail(sn())), b.flatMap((e) => {
 		let t = e?.ownerId;
-		return t != null && t === r.id ? b.void : b.fail(on());
+		return t != null && t === r.id ? b.void : b.fail(sn());
 	}));
-}, cn = (e) => ({
+}, ln = () => new t({
+	provider: "storage",
+	message: "an upload needs an identified caller: this request carries no subject, and the app has not set `anonymousUploads: true` on storagePlugin. The ticket attributes the object to whoever minted it — with no subject there is nobody to attribute it to, so the finalized object would carry no owner and no tenant and no later owner check, tenant filter or quota could reach it.",
+	transient: !1,
+	status: 401
+}), $ = (e, t) => {
+	let n = e.request.subject.id ?? null, r = e.request.subject.tenantId ?? null;
+	return n === null && !t ? b.fail(ln()) : b.succeed({
+		id: n,
+		tenantId: r
+	});
+}, un = (e, t) => e !== null && e !== (t ?? null), dn = (e) => ({
 	id: e.id,
 	refId: e.refId,
 	principalType: e.principalType,
@@ -1982,30 +1993,30 @@ var Wt = () => se({
 	createdAt: e.createdAt.toISOString(),
 	expiresAt: e.expiresAt ? e.expiresAt.toISOString() : null,
 	createdBy: e.createdBy
-}), ln = "@voltro/plugin-storage", un = (i = {}) => {
-	let y = tn(i);
-	Qt(y);
-	let x = K.read("S3_BUCKET", i.bucket) ?? K.read("STORAGE_BUCKET") ?? "voltro", S = K.read("VOLTRO_PUBLIC_URL", i.publicBaseUrl), C = nn(i.allowedOrigins), w = i.limits?.maxBytes, D = 5242880, oe = 21600, O = i.refStore === void 0 || i.refStore === "memory", k = i.grantStore === void 0 || i.grantStore === "memory", A = { current: O ? Tt() : i.refStore }, j = { current: k ? At() : i.grantStore }, M = {
-		insert: (e) => A.current.insert(e),
-		getById: (e) => A.current.getById(e),
-		delete: (e) => A.current.delete(e),
-		listRecent: (e) => A.current.listRecent(e),
-		countByKey: (e, t) => A.current.countByKey(e, t),
-		usageByTenant: (e) => A.current.usageByTenant(e),
-		consumeUsage: (e, t, n) => A.current.consumeUsage(e, t, n),
-		releaseUsage: (e, t) => A.current.releaseUsage(e, t),
-		listByDerivedFrom: (e) => A.current.listByDerivedFrom(e),
-		listRefs: (e) => A.current.listRefs(e)
-	}, se = {
+}), fn = "@voltro/plugin-storage", pn = (i = {}) => {
+	let y = nn(i);
+	$t(y);
+	let x = G.read("S3_BUCKET", i.bucket) ?? G.read("STORAGE_BUCKET") ?? "voltro", S = G.read("VOLTRO_PUBLIC_URL", i.publicBaseUrl), C = rn(i.allowedOrigins), w = i.limits?.maxBytes, D = i.anonymousUploads === !0, oe = 5242880, O = 21600, k = i.refStore === void 0 || i.refStore === "memory", A = i.grantStore === void 0 || i.grantStore === "memory", j = { current: k ? Et() : i.refStore }, M = { current: A ? jt() : i.grantStore }, se = {
 		insert: (e) => j.current.insert(e),
-		delete: (e) => j.current.delete(e),
 		getById: (e) => j.current.getById(e),
-		listByRef: (e) => j.current.listByRef(e),
-		deleteByRef: (e) => j.current.deleteByRef(e)
+		delete: (e) => j.current.delete(e),
+		listRecent: (e) => j.current.listRecent(e),
+		countByKey: (e, t) => j.current.countByKey(e, t),
+		usageByTenant: (e) => j.current.usageByTenant(e),
+		consumeUsage: (e, t, n) => j.current.consumeUsage(e, t, n),
+		releaseUsage: (e, t) => j.current.releaseUsage(e, t),
+		listByDerivedFrom: (e) => j.current.listByDerivedFrom(e),
+		listRefs: (e) => j.current.listRefs(e)
 	}, ce = {
+		insert: (e) => M.current.insert(e),
+		delete: (e) => M.current.delete(e),
+		getById: (e) => M.current.getById(e),
+		listByRef: (e) => M.current.listByRef(e),
+		deleteByRef: (e) => M.current.deleteByRef(e)
+	}, N = {
 		provider: y,
-		refStore: M,
-		grantStore: se,
+		refStore: se,
+		grantStore: ce,
 		bucket: x,
 		...i.tenantPrefix === void 0 ? {} : { tenantPrefix: i.tenantPrefix },
 		...i.attempts === void 0 ? {} : { attempts: i.attempts },
@@ -2019,7 +2030,7 @@ var Wt = () => se({
 		...S ? { publicBaseUrl: S } : {},
 		...i.normalizeImages === void 0 ? {} : { normalizeImages: i.normalizeImages },
 		...i.quota === void 0 ? {} : { quota: i.quota }
-	}, N = It(ce), P = Ft(ce), F = (e) => b.runPromise(e.pipe(b.catchAll(() => b.succeed(null)))), le = (e, t) => {
+	}, P = Lt(N), F = It(N), I = (e) => b.runPromise(e.pipe(b.catchAll(() => b.succeed(null)))), L = (e, t) => {
 		if (!e) return "invalid";
 		let n = /^bytes=(\d*)-(\d*)$/.exec(e.trim());
 		if (!n) return "invalid";
@@ -2040,30 +2051,30 @@ var Wt = () => se({
 			start: a,
 			endInclusive: o
 		};
-	}, I = /^(?:image\/(?!svg)|video\/|audio\/|application\/pdf(?:;|$)|text\/plain(?:;|$))/i, ue = (e) => ({
+	}, le = /^(?:image\/(?!svg)|video\/|audio\/|application\/pdf(?:;|$)|text\/plain(?:;|$))/i, R = (e) => ({
 		"x-content-type-options": "nosniff",
-		"content-disposition": I.test(e) ? "inline" : "attachment"
-	}), fe = async (e, t, n, r) => {
+		"content-disposition": le.test(e) ? "inline" : "attachment"
+	}), z = async (e, t, n, r) => {
 		if (n) {
-			let r = await F(P.get(e.id));
+			let r = await I(F.get(e.id));
 			if (!r) return {
 				status: 404,
 				body: "not found",
 				contentType: "text/plain"
 			};
-			let i = await Ke(e.id, r.bytes, e.contentType, n).catch(() => null), a = i ? i.bytes : r.bytes, o = i ? i.contentType : e.contentType;
+			let i = await qe(e.id, r.bytes, e.contentType, n).catch(() => null), a = i ? i.bytes : r.bytes, o = i ? i.contentType : e.contentType;
 			return {
 				status: 200,
 				body: a,
 				contentType: o,
 				headers: {
-					...ue(o),
+					...R(o),
 					"cache-control": t,
 					"accept-ranges": "none"
 				}
 			};
 		}
-		let i = r === void 0 ? "invalid" : le(r, e.size);
+		let i = r === void 0 ? "invalid" : L(r, e.size);
 		if (i === "unsatisfiable") return {
 			status: 416,
 			body: "range not satisfiable",
@@ -2074,13 +2085,13 @@ var Wt = () => se({
 			}
 		};
 		if (i !== "invalid") {
-			let n = await F(P.getRange(e.id, i));
+			let n = await I(F.getRange(e.id, i));
 			return n ? {
 				status: 206,
 				body: n.bytes,
 				contentType: e.contentType,
 				headers: {
-					...ue(e.contentType),
+					...R(e.contentType),
 					"cache-control": t,
 					"accept-ranges": "bytes",
 					"content-range": `bytes ${i.start}-${i.endInclusive}/${n.totalSize}`
@@ -2091,7 +2102,7 @@ var Wt = () => se({
 				contentType: "text/plain"
 			};
 		}
-		let a = await F(P.get(e.id));
+		let a = await I(F.get(e.id));
 		if (!a) return {
 			status: 404,
 			body: "not found",
@@ -2102,7 +2113,7 @@ var Wt = () => se({
 			status: 200,
 			contentType: e.contentType,
 			headers: {
-				...ue(e.contentType),
+				...R(e.contentType),
 				"cache-control": t,
 				"accept-ranges": "bytes"
 			},
@@ -2120,20 +2131,20 @@ var Wt = () => se({
 				}
 			}
 		};
-	}, L = async (e) => {
+	}, de = async (e) => {
 		let t = e.path.startsWith("/_voltro/storage/") ? e.path.slice(17).split("/")[0] ?? "" : "";
 		if (!t) return {
 			status: 404,
 			body: "not found",
 			contentType: "text/plain"
 		};
-		let n = await F(P.head(t));
+		let n = await I(F.head(t));
 		if (!n) return {
 			status: 404,
 			body: "not found",
 			contentType: "text/plain"
 		};
-		let r = Ve(e.query), i = e.headers.range;
+		let r = He(e.query), i = e.headers.range;
 		if (n.visibility === "public") {
 			let e = y.publicUrl?.(n.key) ?? null;
 			return e && !r ? {
@@ -2142,16 +2153,16 @@ var Wt = () => se({
 					location: e,
 					"cache-control": "public, max-age=300"
 				}
-			} : fe(n, "public, max-age=31536000, immutable", r, i);
+			} : z(n, "public, max-age=31536000, immutable", r, i);
 		}
 		let a = !1, o = e.query ? new URLSearchParams(e.query).get("t") : null;
 		if (o) {
-			let e = st(o);
+			let e = ct(o);
 			a = !!e && e.refId === t;
 		}
 		if (!a) {
-			let t = E(e.headers.cookie, Xt), r = t ? ae(t, ie()) : null;
-			r && (a = await F(P.checkAccess(n, r)) === !0);
+			let t = E(e.headers.cookie, Zt), r = t ? ae(t, ie()) : null;
+			r && (a = await I(F.checkAccess(n, r)) === !0);
 		}
 		if (!a) return {
 			status: 403,
@@ -2159,7 +2170,7 @@ var Wt = () => se({
 			contentType: "text/plain"
 		};
 		if (y.presigns && !r) {
-			let e = await F(y.getUrl(n.key, 300));
+			let e = await I(y.getUrl(n.key, 300));
 			if (e && /^https?:/.test(e)) return {
 				status: 302,
 				headers: {
@@ -2168,12 +2179,12 @@ var Wt = () => se({
 				}
 			};
 		}
-		return fe(n, "private, no-store", r, i);
-	}, pe = {
+		return z(n, "private, no-store", r, i);
+	}, fe = {
 		method: "GET",
 		path: "/_voltro/storage",
 		handle: async (e) => {
-			let t = await L(e), n = rn(e.headers.origin, C);
+			let t = await de(e), n = an(e.headers.origin, C);
 			return Object.keys(n).length === 0 ? t : {
 				...t,
 				headers: {
@@ -2182,12 +2193,12 @@ var Wt = () => se({
 				}
 			};
 		}
-	}, me = {
+	}, pe = {
 		method: "*",
 		path: "/_voltro/storage/upload",
 		originGuard: "exempt",
 		handle: async (e) => {
-			let t = rn(e.headers.origin, C);
+			let t = an(e.headers.origin, C);
 			if (e.method === "OPTIONS") return {
 				status: 204,
 				headers: t
@@ -2198,7 +2209,7 @@ var Wt = () => se({
 				contentType: "text/plain",
 				headers: t
 			};
-			let n = e.query ? new URLSearchParams(e.query).get("ticket") : null, r = n ? lt(n) : null;
+			let n = e.query ? new URLSearchParams(e.query).get("ticket") : null, r = n ? ut(n) : null;
 			if (!r) return {
 				status: 401,
 				body: "invalid or expired upload ticket",
@@ -2217,7 +2228,7 @@ var Wt = () => se({
 				contentType: "text/plain",
 				headers: t
 			};
-			let i = await b.runPromise(P.put({
+			let i = await b.runPromise(F.put({
 				bytes: e.rawBody,
 				contentType: r.ct,
 				tenantId: r.tenant,
@@ -2228,7 +2239,7 @@ var Wt = () => se({
 				...r.tags === void 0 ? {} : { tags: r.tags },
 				...r.alt === void 0 ? {} : { alt: r.alt },
 				...r.caption === void 0 ? {} : { caption: r.caption }
-			}).pipe(b.flatMap((e) => P.getUrl(e.id).pipe(b.map((t) => ({
+			}).pipe(b.flatMap((e) => F.getUrl(e.id).pipe(b.map((t) => ({
 				kind: "ok",
 				ref: e,
 				url: t
@@ -2274,17 +2285,17 @@ var Wt = () => se({
 				headers: t
 			};
 		}
-	}, he = {
+	}, me = {
 		method: "*",
 		path: "/_voltro/storage/upload/resumable",
 		originGuard: "exempt",
 		handle: async (e) => {
-			let t = rn(e.headers.origin, C);
+			let t = an(e.headers.origin, C);
 			if (e.method === "OPTIONS") return {
 				status: 204,
 				headers: t
 			};
-			let n = new URLSearchParams(e.query || ""), r = pt(n.get("token") ?? "");
+			let n = new URLSearchParams(e.query || ""), r = mt(n.get("token") ?? "");
 			if (!r) return {
 				status: 401,
 				body: "invalid or expired resumable token",
@@ -2292,7 +2303,7 @@ var Wt = () => se({
 				headers: t
 			};
 			if (e.method === "GET" || e.method === "HEAD") {
-				let e = await b.runPromise(P.resumableStatus({
+				let e = await b.runPromise(F.resumableStatus({
 					uploadId: r.id,
 					tenantId: r.tenant
 				}).pipe(b.match({
@@ -2333,12 +2344,12 @@ var Wt = () => se({
 				contentType: "text/plain",
 				headers: t
 			};
-			let a = n.get("final") === "1", o = await b.runPromise(P.putResumableChunk({
+			let a = n.get("final") === "1", o = await b.runPromise(F.putResumableChunk({
 				uploadId: r.id,
 				tenantId: r.tenant,
 				index: i,
 				bytes: e.rawBody
-			}).pipe(b.flatMap(() => a ? P.finalizeResumable({
+			}).pipe(b.flatMap(() => a ? F.finalizeResumable({
 				uploadId: r.id,
 				count: i + 1,
 				contentType: r.ct,
@@ -2349,7 +2360,7 @@ var Wt = () => se({
 				...r.tags === void 0 ? {} : { tags: r.tags },
 				...r.alt === void 0 ? {} : { alt: r.alt },
 				...r.caption === void 0 ? {} : { caption: r.caption }
-			}).pipe(b.flatMap((e) => P.getUrl(e.id).pipe(b.map((t) => ({
+			}).pipe(b.flatMap((e) => F.getUrl(e.id).pipe(b.map((t) => ({
 				kind: "done",
 				ref: e,
 				url: t
@@ -2401,31 +2412,31 @@ var Wt = () => se({
 				headers: t
 			};
 		}
-	}, R = (e) => ({
+	}, B = (e) => ({
 		kind: "json",
 		data: e
-	}), z = (e, t) => ({
+	}), V = (e, t) => ({
 		kind: "json",
 		status: e,
 		data: { error: t }
-	}), ge = (e, t) => {
+	}), he = (e, t) => {
 		try {
 			return new URL(e, "http://localhost").searchParams.get(t);
 		} catch {
 			return null;
 		}
-	}, B = [
+	}, ge = [
 		{
 			method: "GET",
 			path: "/refs",
 			description: "Recent storage refs (newest first)",
-			handler: () => M.listRecent(100).pipe(b.map((e) => R({ refs: e.map(an) })), b.catchAll((e) => b.succeed(z(500, e.message))))
+			handler: () => se.listRecent(100).pipe(b.map((e) => B({ refs: e.map(on) })), b.catchAll((e) => b.succeed(V(500, e.message))))
 		},
 		{
 			method: "GET",
 			path: "/stats",
 			description: "Object count + total bytes per tenant + visibility split",
-			handler: () => M.listRecent(1e4).pipe(b.map((e) => {
+			handler: () => se.listRecent(1e4).pipe(b.map((e) => {
 				let t = {}, n = 0, r = 0;
 				for (let i of e) {
 					let e = i.tenantId ?? "(global)", a = t[e] ?? {
@@ -2434,7 +2445,7 @@ var Wt = () => se({
 					};
 					a.count++, a.bytes += i.size, t[e] = a, i.visibility === "public" ? n++ : r++;
 				}
-				return R({
+				return B({
 					provider: y.name,
 					bucket: x,
 					byTenant: t,
@@ -2443,15 +2454,15 @@ var Wt = () => se({
 						private: r
 					}
 				});
-			}), b.catchAll((e) => b.succeed(z(500, e.message))))
+			}), b.catchAll((e) => b.succeed(V(500, e.message))))
 		},
 		{
 			method: "GET",
 			path: "/grants",
 			description: "Grants for a ref (?refId=…)",
 			handler: (e) => {
-				let t = ge(e.url, "refId");
-				return t ? se.listByRef(t).pipe(b.map((e) => R({ grants: e.map(cn) })), b.catchAll((e) => b.succeed(z(500, e.message)))) : b.succeed(z(400, "refId query param required"));
+				let t = he(e.url, "refId");
+				return t ? ce.listByRef(t).pipe(b.map((e) => B({ grants: e.map(dn) })), b.catchAll((e) => b.succeed(V(500, e.message)))) : b.succeed(V(400, "refId query param required"));
 			}
 		},
 		{
@@ -2468,16 +2479,16 @@ var Wt = () => se({
 						status: 400
 					})
 				});
-				if (!n.refId || !n.principalType || !n.principalId) return z(400, "refId, principalType, principalId required");
-				let r = n.expiresInDays ? new Date(Date.now() + n.expiresInDays * 864e5) : null, i = yield* P.grant({
+				if (!n.refId || !n.principalType || !n.principalId) return V(400, "refId, principalType, principalId required");
+				let r = n.expiresInDays ? new Date(Date.now() + n.expiresInDays * 864e5) : null, i = yield* F.grant({
 					refId: n.refId,
 					principalType: n.principalType,
 					principalId: n.principalId,
 					...n.permission ? { permission: n.permission } : {},
 					expiresAt: r
 				});
-				return R({ grant: cn(i) });
-			}).pipe(b.catchAll((e) => b.succeed(z(e.status ?? 500, e.message ?? "share failed"))))
+				return B({ grant: dn(i) });
+			}).pipe(b.catchAll((e) => b.succeed(V(e.status ?? 500, e.message ?? "share failed"))))
 		},
 		{
 			method: "POST",
@@ -2493,15 +2504,15 @@ var Wt = () => se({
 						status: 400
 					})
 				});
-				return n.grantId ? (yield* P.revoke(n.grantId), R({ ok: !0 })) : z(400, "grantId required");
-			}).pipe(b.catchAll((e) => b.succeed(z(e.status ?? 500, e.message ?? "revoke failed"))))
+				return n.grantId ? (yield* F.revoke(n.grantId), B({ ok: !0 })) : V(400, "grantId required");
+			}).pipe(b.catchAll((e) => b.succeed(V(e.status ?? 500, e.message ?? "revoke failed"))))
 		}
 	], _e = [
 		{
 			...h,
 			execute: (e, t) => {
 				let n = e;
-				return P.mintUrl(n.id, t.request.subject, {
+				return F.mintUrl(n.id, t.request.subject, {
 					...n.password === void 0 ? {} : { password: n.password },
 					...n.expiresInSec === void 0 ? {} : { expiresInSec: n.expiresInSec }
 				}).pipe(b.map((e) => ({ url: e })));
@@ -2511,7 +2522,7 @@ var Wt = () => se({
 			...ee,
 			execute: (e, t) => {
 				let n = e;
-				return P.mintUploadUrl({
+				return F.mintUploadUrl({
 					key: n.key,
 					contentType: n.contentType,
 					tenantId: t.request.subject.tenantId,
@@ -2523,10 +2534,10 @@ var Wt = () => se({
 			...m,
 			execute: (e, t) => {
 				let n = e;
-				return b.sync(() => {
-					let e = n.expiresInSec ?? 900, r = ct({
-						sub: t.request.subject.id,
-						tenant: t.request.subject.tenantId,
+				return $(t, D).pipe(b.map((e) => {
+					let t = n.expiresInSec ?? 900, r = lt({
+						sub: e.id,
+						tenant: e.tenantId,
 						ct: n.contentType,
 						vis: n.visibility ?? "private",
 						...n.key === void 0 ? {} : { key: n.key },
@@ -2535,27 +2546,27 @@ var Wt = () => se({
 						...n.alt === void 0 ? {} : { alt: n.alt },
 						...n.caption === void 0 ? {} : { caption: n.caption },
 						...w === void 0 ? {} : { max: w }
-					}, e);
+					}, t);
 					return {
 						uploadUrl: `${S ? S.replace(/\/+$/, "") : ""}/_voltro/storage/upload?ticket=${encodeURIComponent(r)}`,
-						expiresInSec: e
+						expiresInSec: t
 					};
-				});
+				}));
 			}
 		},
 		{
 			...p,
 			execute: (e, t) => {
 				let n = e;
-				return P.mintPresignedUpload({
+				return $(t, D).pipe(b.flatMap((e) => F.mintPresignedUpload({
 					contentType: n.contentType,
-					tenantId: t.request.subject.tenantId,
+					tenantId: e.tenantId,
 					...n.expiresInSec === void 0 ? {} : { expiresInSec: n.expiresInSec }
-				}).pipe(b.map((e) => {
-					let r = ut({
-						key: e.key,
-						sub: t.request.subject.id,
-						tenant: t.request.subject.tenantId,
+				}).pipe(b.map((t) => {
+					let r = dt({
+						key: t.key,
+						sub: e.id,
+						tenant: e.tenantId,
 						ct: n.contentType,
 						vis: n.visibility ?? "private",
 						...n.folder === void 0 ? {} : { folder: n.folder },
@@ -2563,25 +2574,25 @@ var Wt = () => se({
 						...n.alt === void 0 ? {} : { alt: n.alt },
 						...n.caption === void 0 ? {} : { caption: n.caption },
 						...w === void 0 ? {} : { max: w }
-					}, e.expiresInSec);
+					}, t.expiresInSec);
 					return {
-						uploadUrl: e.uploadUrl,
+						uploadUrl: t.uploadUrl,
 						finalizeToken: r,
-						expiresInSec: e.expiresInSec
+						expiresInSec: t.expiresInSec
 					};
-				}));
+				}))));
 			}
 		},
 		{
 			...l,
 			execute: (e, n) => {
-				let r = dt(e.finalizeToken);
-				return r ? r.sub !== null && r.sub !== n.request.subject.id ? b.fail(new t({
+				let r = ft(e.finalizeToken);
+				return r ? un(r.sub, n.request.subject.id) ? b.fail(new t({
 					provider: "storage",
 					message: "finalize token belongs to another subject",
 					transient: !1,
 					status: 403
-				})) : P.finalizeUpload({
+				})) : F.finalizeUpload({
 					key: r.key,
 					contentType: r.ct,
 					tenantId: r.tenant,
@@ -2591,7 +2602,7 @@ var Wt = () => se({
 					...r.tags === void 0 ? {} : { tags: r.tags },
 					...r.alt === void 0 ? {} : { alt: r.alt },
 					...r.caption === void 0 ? {} : { caption: r.caption }
-				}).pipe(b.flatMap((e) => P.getUrl(e.id).pipe(b.map((t) => ({
+				}).pipe(b.flatMap((e) => F.getUrl(e.id).pipe(b.map((t) => ({
 					id: e.id,
 					url: t,
 					contentType: e.contentType,
@@ -2610,14 +2621,14 @@ var Wt = () => se({
 			...s,
 			execute: (e, t) => {
 				let n = e;
-				return b.sync(() => {
-					let e = n.expiresInSec ?? oe, r = de(), i = n.chunkSize && n.chunkSize > 0 ? n.chunkSize : D;
+				return $(t, D).pipe(b.map((e) => {
+					let t = n.expiresInSec ?? O, r = ue(), i = n.chunkSize && n.chunkSize > 0 ? n.chunkSize : oe;
 					return {
 						uploadId: r,
-						resumableToken: ft({
+						resumableToken: pt({
 							id: r,
-							sub: t.request.subject.id,
-							tenant: t.request.subject.tenantId,
+							sub: e.id,
+							tenant: e.tenantId,
 							ct: n.contentType,
 							vis: n.visibility ?? "private",
 							size: n.size,
@@ -2626,29 +2637,29 @@ var Wt = () => se({
 							...n.alt === void 0 ? {} : { alt: n.alt },
 							...n.caption === void 0 ? {} : { caption: n.caption },
 							...w === void 0 ? {} : { max: w }
-						}, e),
+						}, t),
 						uploadUrl: `${S ? S.replace(/\/+$/, "") : ""}/_voltro/storage/upload/resumable`,
 						chunkSize: i,
-						expiresInSec: e
+						expiresInSec: t
 					};
-				});
+				}));
 			}
 		},
 		{
 			...o,
 			execute: (e, t) => {
-				let n = e, r = n.expiresInSec ?? oe;
-				return P.beginMultipartUpload({
+				let n = e, r = n.expiresInSec ?? O;
+				return $(t, D).pipe(b.flatMap((e) => F.beginMultipartUpload({
 					contentType: n.contentType,
-					tenantId: t.request.subject.tenantId,
+					tenantId: e.tenantId,
 					visibility: n.visibility ?? "private",
 					expiresInSec: r
-				}).pipe(b.map((e) => ({
-					multipartToken: mt({
-						key: e.key,
-						uploadId: e.uploadId,
-						sub: t.request.subject.id,
-						tenant: t.request.subject.tenantId,
+				}).pipe(b.map((t) => ({
+					multipartToken: ht({
+						key: t.key,
+						uploadId: t.uploadId,
+						sub: e.id,
+						tenant: e.tenantId,
 						ct: n.contentType,
 						vis: n.visibility ?? "private",
 						size: n.size,
@@ -2657,21 +2668,21 @@ var Wt = () => se({
 						...n.alt === void 0 ? {} : { alt: n.alt },
 						...n.caption === void 0 ? {} : { caption: n.caption }
 					}, r),
-					partSize: n.partSize && n.partSize >= D ? n.partSize : D,
+					partSize: n.partSize && n.partSize >= oe ? n.partSize : oe,
 					expiresInSec: r
-				})));
+				})))));
 			}
 		},
 		{
 			...te,
 			execute: (e) => {
-				let n = e, r = ht(n.multipartToken);
+				let n = e, r = gt(n.multipartToken);
 				return r ? !Number.isInteger(n.partNumber) || n.partNumber < 1 ? b.fail(new t({
 					provider: "storage",
 					message: "partNumber must be a positive integer",
 					transient: !1,
 					status: 400
-				})) : P.signMultipartPart({
+				})) : F.signMultipartPart({
 					key: r.key,
 					uploadId: r.uploadId,
 					partNumber: n.partNumber
@@ -2686,13 +2697,13 @@ var Wt = () => se({
 		{
 			...c,
 			execute: (e, n) => {
-				let r = e, i = ht(r.multipartToken);
-				return i ? i.sub !== null && i.sub !== n.request.subject.id ? b.fail(new t({
+				let r = e, i = gt(r.multipartToken);
+				return i ? un(i.sub, n.request.subject.id) ? b.fail(new t({
 					provider: "storage",
 					message: "multipart token belongs to another subject",
 					transient: !1,
 					status: 403
-				})) : P.completeMultipart({
+				})) : F.completeMultipart({
 					key: i.key,
 					uploadId: i.uploadId,
 					parts: r.parts,
@@ -2704,7 +2715,7 @@ var Wt = () => se({
 					...i.tags === void 0 ? {} : { tags: i.tags },
 					...i.alt === void 0 ? {} : { alt: i.alt },
 					...i.caption === void 0 ? {} : { caption: i.caption }
-				}).pipe(b.flatMap((e) => P.getUrl(e.id).pipe(b.map((t) => ({
+				}).pipe(b.flatMap((e) => F.getUrl(e.id).pipe(b.map((t) => ({
 					id: e.id,
 					url: t,
 					size: e.size
@@ -2719,8 +2730,8 @@ var Wt = () => se({
 		{
 			...a,
 			execute: (e) => {
-				let n = ht(e.multipartToken);
-				return n ? P.abortMultipart({
+				let n = gt(e.multipartToken);
+				return n ? F.abortMultipart({
 					key: n.key,
 					uploadId: n.uploadId
 				}).pipe(b.as({ ok: !0 })) : b.fail(new t({
@@ -2735,15 +2746,15 @@ var Wt = () => se({
 			...v,
 			execute: (e, t) => {
 				let n = e, r = new Uint8Array(Buffer.from(n.bytesBase64, "base64"));
-				return P.put({
+				return $(t, D).pipe(b.flatMap((e) => F.put({
 					bytes: r,
 					contentType: n.contentType,
-					tenantId: t.request.subject.tenantId,
-					ownerId: t.request.subject.id,
+					tenantId: e.tenantId,
+					ownerId: e.id,
 					...n.visibility ? { visibility: n.visibility } : {},
 					...n.key ? { key: n.key } : {},
 					...n.password ? { password: n.password } : {}
-				}).pipe(b.flatMap((e) => P.getUrl(e.id).pipe(b.map((t) => ({
+				})), b.flatMap((e) => F.getUrl(e.id).pipe(b.map((t) => ({
 					id: e.id,
 					url: t
 				})))));
@@ -2753,16 +2764,16 @@ var Wt = () => se({
 			...u,
 			execute: (e, t) => {
 				let n = e;
-				return P.ingestUrl(n.url, {
-					tenantId: t.request.subject.tenantId,
-					ownerId: t.request.subject.id,
+				return $(t, D).pipe(b.flatMap((e) => F.ingestUrl(n.url, {
+					tenantId: e.tenantId,
+					ownerId: e.id,
 					...n.visibility ? { visibility: n.visibility } : {},
 					...n.folder === void 0 ? {} : { folder: n.folder },
 					...n.tags === void 0 ? {} : { tags: n.tags },
 					...n.alt === void 0 ? {} : { alt: n.alt },
 					...n.caption === void 0 ? {} : { caption: n.caption },
 					...n.key === void 0 ? {} : { key: n.key }
-				}).pipe(b.flatMap((e) => P.getUrl(e.id).pipe(b.map((t) => ({
+				})), b.flatMap((e) => F.getUrl(e.id).pipe(b.map((t) => ({
 					id: e.id,
 					url: t
 				})))));
@@ -2772,7 +2783,7 @@ var Wt = () => se({
 			..._,
 			execute: (e, t) => {
 				let n = e, r = n.expiresInDays ? new Date(Date.now() + n.expiresInDays * 864e5) : null;
-				return sn(P, n.refId, t).pipe(b.flatMap(() => P.grant({
+				return cn(F, n.refId, t).pipe(b.flatMap(() => F.grant({
 					refId: n.refId,
 					principalType: n.principalType,
 					principalId: n.principalId,
@@ -2786,21 +2797,21 @@ var Wt = () => se({
 			...g,
 			execute: (e, t) => {
 				let n = e;
-				return P.getGrant(n.grantId).pipe(b.flatMap((e) => e === null ? b.fail(on()) : sn(P, e.refId, t)), b.flatMap(() => P.revoke(n.grantId)), b.map(() => ({ ok: !0 })));
+				return F.getGrant(n.grantId).pipe(b.flatMap((e) => e === null ? b.fail(sn()) : cn(F, e.refId, t)), b.flatMap(() => F.revoke(n.grantId)), b.map(() => ({ ok: !0 })));
 			}
 		},
 		{
 			...d,
 			execute: (e, t) => {
 				let n = e;
-				return sn(P, n.refId, t).pipe(b.flatMap(() => P.listGrants(n.refId)), b.map((e) => ({ grants: e.map(cn) })));
+				return cn(F, n.refId, t).pipe(b.flatMap(() => F.listGrants(n.refId)), b.map((e) => ({ grants: e.map(dn) })));
 			}
 		},
 		{
 			...f,
 			execute: (e, t) => {
 				let n = e;
-				return P.listRefs({
+				return F.listRefs({
 					tenantId: t.request.subject.tenantId,
 					...n.folder === void 0 ? {} : { folder: n.folder },
 					...n.tags === void 0 ? {} : { tags: n.tags },
@@ -2809,7 +2820,7 @@ var Wt = () => se({
 					...n.limit === void 0 ? {} : { limit: n.limit },
 					...n.offset === void 0 ? {} : { offset: n.offset }
 				}).pipe(b.map((e) => ({
-					refs: e.refs.map(an),
+					refs: e.refs.map(on),
 					nextOffset: e.nextOffset
 				})));
 			}
@@ -2817,24 +2828,24 @@ var Wt = () => se({
 	];
 	return T({
 		name: re({
-			base: ln,
+			base: fn,
 			alias: i.alias,
 			instance: i.name
 		}),
-		baseName: ln,
+		baseName: fn,
 		description: "File storage — StorageService over S3 / MinIO / filesystem / memory. Public objects served direct from bucket/CDN; private objects gated by an access policy + per-object grants. Checksums, tenant key-prefixing, _voltro_storage_refs + _voltro_storage_grants, retry.",
 		permissions: [
 			"network:outbound:*",
 			"inspect:read",
 			"inspect:write"
 		],
-		declaredEnv: K.declared,
-		services: N,
-		inspectEndpoints: B,
+		declaredEnv: G.declared,
+		services: P,
+		inspectEndpoints: ge,
 		httpRoutes: [
+			fe,
 			pe,
-			me,
-			he
+			me
 		],
 		routes: _e,
 		rpcClientDescriptors: ne,
@@ -2869,18 +2880,18 @@ var Wt = () => se({
 			}
 		],
 		bindDataStore: (e) => {
-			O && (A.current = kt(e)), k && (j.current = Mt(e)), y.bindDataStore?.(e);
+			k && (j.current = At(e)), A && (M.current = Nt(e)), y.bindDataStore?.(e);
 		},
 		onActivate: (e) => b.sync(() => {
-			let t = !!S || !!K.read("STORAGE_CDN_URL", i.cdnBaseUrl);
+			let t = !!S || !!G.read("STORAGE_CDN_URL", i.cdnBaseUrl);
 			e.logger.info(`storage: provider=${y.name} presign=${y.presigns ? "yes" : "no"} publicUrl=${t ? "yes" : "no"} transforms=yes`, {
 				provider: y.name,
 				bucket: x,
-				refStore: O ? "memory" : "custom"
+				refStore: k ? "memory" : "custom"
 			}), y.name === "memory" && process.env.NODE_ENV !== "test" && e.logger.warn("storage: provider=memory — uploads are IN-MEMORY and LOST on restart. Set STORAGE_PROVIDER (filesystem / s3 / r2 / azure / gcs) for anything but throwaway dev. (Empty/placeholder storage env silently falls back to memory.)"), !t && !y.presigns && e.logger.warn("storage: no VOLTRO_PUBLIC_URL / STORAGE_CDN_URL and this provider can't presign — serve URLs are RELATIVE and will not resolve cross-origin (browser <img> / server-to-server AI fetches). Set VOLTRO_PUBLIC_URL to this api's absolute base URL.");
 		}),
 		onDeactivate: () => b.void
 	});
 };
 //#endregion
-export { W as STORAGE_BLOBS_TABLE, U as STORAGE_GRANTS_TABLE, H as STORAGE_REFS_TABLE, G as STORAGE_USAGE_TABLE, e as StorageAccessDenied, t as StorageError, n as StorageRejected, r as StorageScanRejected, i as StorageService, ke as _voltroStorageBlobsTable, De as _voltroStorageGrantsTable, Ee as _voltroStorageRefsTable, Oe as _voltroStorageUsageTable, $t as appStorageProvider, Ut as assetRef, ze as azureProvider, Ft as buildStorageService, xe as bytesToStream, yt as checkLimits, Bt as clamavScanner, Ne as clearStorageBuffer, Se as collectStream, be as concatBytes, en as configuredStorageProvider, gt as contentTypeAllowed, Mt as dataStoreGrantStore, kt as dataStoreRefStore, Re as databaseProvider, Kt as decodeDataUri, Yt as durabilityNotice, Lt as encodeInstream, Ht as ffmpegTranscoder, Fe as filesystemProvider, Ce as fromNodeReadable, we as getObjectStream, qe as hashPassword, At as memoryGrantStore, Pe as memoryProvider, Tt as memoryRefStore, Rt as parseClamavResponse, Ve as parseTransformParams, Jt as pathDurability, qt as putAvatar, Te as putObjectStream, Me as readStorageBuffer, Ct as refMatchesListQuery, tn as resolveStorageProvider, X as resolveStorageSecret, Ie as s3Provider, Qt as setActiveStorageProvider, ut as signFinalizeTicket, ot as signGrant, mt as signMultipartTicket, ft as signResumableTicket, ct as signUploadTicket, vt as sniffMatches, un as storagePlugin, It as storageServiceLayer, V as toNodeReadable, Ke as transformCached, We as transformImage, dt as verifyFinalizeTicket, st as verifyGrant, ht as verifyMultipartTicket, Je as verifyPassword, pt as verifyResumableTicket, lt as verifyUploadTicket, Wt as withStorage };
+export { W as STORAGE_BLOBS_TABLE, U as STORAGE_GRANTS_TABLE, H as STORAGE_REFS_TABLE, Ee as STORAGE_USAGE_TABLE, e as StorageAccessDenied, t as StorageError, n as StorageRejected, r as StorageScanRejected, i as StorageService, Ae as _voltroStorageBlobsTable, Oe as _voltroStorageGrantsTable, De as _voltroStorageRefsTable, ke as _voltroStorageUsageTable, en as appStorageProvider, Wt as assetRef, Be as azureProvider, It as buildStorageService, be as bytesToStream, bt as checkLimits, Vt as clamavScanner, Pe as clearStorageBuffer, xe as collectStream, ye as concatBytes, tn as configuredStorageProvider, _t as contentTypeAllowed, Nt as dataStoreGrantStore, At as dataStoreRefStore, ze as databaseProvider, qt as decodeDataUri, Xt as durabilityNotice, Rt as encodeInstream, Ut as ffmpegTranscoder, Ie as filesystemProvider, Se as fromNodeReadable, we as getObjectStream, Je as hashPassword, jt as memoryGrantStore, Fe as memoryProvider, Et as memoryRefStore, zt as parseClamavResponse, He as parseTransformParams, Yt as pathDurability, Jt as putAvatar, Te as putObjectStream, Ne as readStorageBuffer, wt as refMatchesListQuery, nn as resolveStorageProvider, Y as resolveStorageSecret, Le as s3Provider, $t as setActiveStorageProvider, dt as signFinalizeTicket, st as signGrant, ht as signMultipartTicket, pt as signResumableTicket, lt as signUploadTicket, yt as sniffMatches, pn as storagePlugin, Lt as storageServiceLayer, Ce as toNodeReadable, qe as transformCached, Ge as transformImage, ft as verifyFinalizeTicket, ct as verifyGrant, gt as verifyMultipartTicket, Ye as verifyPassword, mt as verifyResumableTicket, ut as verifyUploadTicket, Gt as withStorage };