@voltro/plugin-storage 0.71.0 → 0.71.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/CHANGELOG.md +52 -0
  2. package/dist/index.d.ts +21 -0
  3. package/dist/index.js +542 -538
  4. package/package.json +4 -4
package/dist/index.js CHANGED
@@ -1,86 +1,86 @@
1
1
  import { StorageAccessDenied as e, StorageError as t, StorageRejected as n, StorageScanRejected as r, StorageService as i } from "./types.js";
2
- import { abortMultipartUploadDescriptor as a, beginMultipartUploadDescriptor as o, beginResumableUploadDescriptor as s, completeMultipartUploadDescriptor as c, finalizeUploadDescriptor as l, ingestUrlDescriptor as u, listGrantsDescriptor as d, listRefsDescriptor as f, mintPresignedUploadDescriptor as p, mintUploadTicketDescriptor as m, mintUploadUrlDescriptor as ee, mintUrlDescriptor as h, revokeDescriptor as g, shareDescriptor as _, signMultipartPartDescriptor as te, storageRpcClientImports as ne, uploadDescriptor as v } from "./rpc.js";
3
- import { Chunk as y, Effect as b, Exit as x, Layer as S, Schedule as C, Schema as w, Stream as T } from "effect";
4
- import { definePlugin as re, pluginInstanceName as E } from "@voltro/protocol";
5
- import { readCookie as ie, resolveSessionSecret as ae, verifySession as oe } from "@voltro/protocol/session";
6
- import { and as D, bytes as se, contains as O, eq as k, generateId as A, id as j, integer as M, json as N, mixin as P, or as F, reference as ce, table as I, text as L, timestamp as le } from "@voltro/database";
7
- import { pluginEnv as R } from "@voltro/env";
8
- import { createHmac as z, randomBytes as B, randomUUID as ue, scryptSync as de, timingSafeEqual as V } from "node:crypto";
9
- import { spawn as fe } from "node:child_process";
10
- import { mkdtemp as pe, readFile as me, rm as he, writeFile as ge } from "node:fs/promises";
11
- import { tmpdir as _e } from "node:os";
12
- import { join as H } from "node:path";
13
- import { statSync as U } from "node:fs";
2
+ import { abortMultipartUploadDescriptor as a, beginMultipartUploadDescriptor as o, beginResumableUploadDescriptor as s, completeMultipartUploadDescriptor as c, finalizeUploadDescriptor as l, ingestUrlDescriptor as u, listGrantsDescriptor as d, listRefsDescriptor as f, mintPresignedUploadDescriptor as p, mintUploadTicketDescriptor as m, mintUploadUrlDescriptor as ee, mintUrlDescriptor as h, revokeDescriptor as te, shareDescriptor as g, signMultipartPartDescriptor as ne, storageRpcClientImports as re, uploadDescriptor as _ } from "./rpc.js";
3
+ import { Chunk as v, Effect as y, Exit as b, Layer as x, Schedule as S, Schema as C, Stream as w } from "effect";
4
+ import { definePlugin as ie, pluginInstanceName as T } from "@voltro/protocol";
5
+ import { readCookie as ae, resolveSessionSecret as oe, verifySession as se } from "@voltro/protocol/session";
6
+ import { and as E, bytes as ce, contains as D, eq as O, generateId as k, id as A, integer as j, json as M, mixin as N, or as P, reference as le, table as F, text as I, timestamp as ue } from "@voltro/database";
7
+ import { pluginEnv as L } from "@voltro/env";
8
+ import { createHmac as R, randomBytes as z, randomUUID as de, scryptSync as fe, timingSafeEqual as B } from "node:crypto";
9
+ import { spawn as pe } from "node:child_process";
10
+ import { mkdtemp as me, readFile as he, rm as ge, writeFile as _e } from "node:fs/promises";
11
+ import { tmpdir as ve } from "node:os";
12
+ import { join as V } from "node:path";
13
+ import { statSync as H } from "node:fs";
14
14
  //#region src/streamBridge.ts
15
- var ve = 1 << 20, ye = (e, n, r = !1) => new t({
15
+ var ye = 1 << 20, be = (e, n, r = !1) => new t({
16
16
  provider: e,
17
17
  message: n,
18
18
  transient: r
19
- }), be = (e) => {
19
+ }), xe = (e) => {
20
20
  let t = 0;
21
21
  for (let n of e) t += n.byteLength;
22
22
  let n = new Uint8Array(t), r = 0;
23
23
  for (let t of e) n.set(t, r), r += t.byteLength;
24
24
  return n;
25
- }, xe = (e, t = ve) => {
25
+ }, Se = (e, t = ye) => {
26
26
  let n = [];
27
27
  for (let r = 0; r < e.byteLength; r += t) n.push(e.subarray(r, Math.min(r + t, e.byteLength)));
28
- return T.fromIterable(n);
29
- }, Se = (e) => e.pipe(T.runCollect, b.map((e) => be(y.toReadonlyArray(e)))), Ce = (e, t) => T.suspend(() => T.fromAsyncIterable(t(), (t) => ye(e, `read stream failed: ${String(t?.message ?? t)}`, !0))).pipe(T.map((e) => e instanceof Uint8Array ? e : new Uint8Array(e))), we = async (e) => {
28
+ return w.fromIterable(n);
29
+ }, Ce = (e) => e.pipe(w.runCollect, y.map((e) => xe(v.toReadonlyArray(e)))), we = (e, t) => w.suspend(() => w.fromAsyncIterable(t(), (t) => be(e, `read stream failed: ${String(t?.message ?? t)}`, !0))).pipe(w.map((e) => e instanceof Uint8Array ? e : new Uint8Array(e))), Te = async (e) => {
30
30
  let { Readable: t } = await import("node:stream");
31
- return t.fromWeb(T.toReadableStream(e));
32
- }, Te = (e, t) => e.getStream ? e.getStream(t) : e.get(t).pipe(b.map((e) => ({
33
- stream: xe(e.bytes),
31
+ return t.fromWeb(w.toReadableStream(e));
32
+ }, Ee = (e, t) => e.getStream ? e.getStream(t) : e.get(t).pipe(y.map((e) => ({
33
+ stream: Se(e.bytes),
34
34
  contentType: e.contentType,
35
35
  size: e.bytes.byteLength
36
- }))), Ee = (e, t, n, r) => e.putStream ? e.putStream(t, n, r) : Se(n).pipe(b.flatMap((n) => e.put(t, n, {
36
+ }))), De = (e, t, n, r) => e.putStream ? e.putStream(t, n, r) : Ce(n).pipe(y.flatMap((n) => e.put(t, n, {
37
37
  contentType: r.contentType,
38
38
  ...r.public === void 0 ? {} : { public: r.public }
39
- }))), W = "_voltro_storage_refs", G = "_voltro_storage_grants", K = "_voltro_storage_blobs", De = "_voltro_storage_usage", Oe = I(W, {
40
- id: j({ prefix: "file" }),
41
- tenantId: L().nullable(),
42
- ownerId: L().nullable(),
43
- bucket: L(),
44
- key: L(),
45
- contentType: L(),
46
- size: M(),
47
- checksum: L(),
48
- visibility: L(),
49
- accessPolicy: N().nullable(),
50
- passwordHash: L().nullable(),
51
- width: M().nullable(),
52
- height: M().nullable(),
53
- duration: M().nullable(),
54
- placeholder: L().nullable(),
55
- folder: L().nullable(),
56
- tags: N().nullable(),
57
- alt: L().nullable(),
58
- caption: L().nullable(),
59
- derivedFrom: L().nullable(),
60
- kind: L().nullable(),
61
- createdAt: le()
62
- }).index(["key"]).index(["tenantId"]).index(["ownerId"]).index(["folder"]).index(["derivedFrom"]), ke = I(G, {
63
- id: j({ prefix: "sgrant" }),
64
- refId: L(),
65
- principalType: L(),
66
- principalId: L(),
67
- permission: L(),
68
- createdAt: le(),
69
- expiresAt: le().nullable(),
70
- createdBy: L().nullable()
71
- }).index(["refId"]).index(["principalId"]), Ae = I(De, {
72
- id: j({ prefix: "susage" }),
73
- tenantId: L().maxLength(191),
74
- bytes: M().default(0),
75
- count: M().default(0),
76
- updatedAt: le()
77
- }).unique("byStorageUsageTenant", ["tenantId"]), je = I(K, {
78
- id: j({ prefix: "blob" }),
79
- key: L(),
80
- data: se(),
81
- contentType: L(),
82
- size: M()
83
- }).index(["key"]), q = R([
39
+ }))), U = "_voltro_storage_refs", W = "_voltro_storage_grants", G = "_voltro_storage_blobs", Oe = "_voltro_storage_usage", ke = F(U, {
40
+ id: A({ prefix: "file" }),
41
+ tenantId: I().nullable(),
42
+ ownerId: I().nullable(),
43
+ bucket: I(),
44
+ key: I(),
45
+ contentType: I(),
46
+ size: j(),
47
+ checksum: I(),
48
+ visibility: I(),
49
+ accessPolicy: M().nullable(),
50
+ passwordHash: I().nullable(),
51
+ width: j().nullable(),
52
+ height: j().nullable(),
53
+ duration: j().nullable(),
54
+ placeholder: I().nullable(),
55
+ folder: I().nullable(),
56
+ tags: M().nullable(),
57
+ alt: I().nullable(),
58
+ caption: I().nullable(),
59
+ derivedFrom: I().nullable(),
60
+ kind: I().nullable(),
61
+ createdAt: ue()
62
+ }).index(["key"]).index(["tenantId"]).index(["ownerId"]).index(["folder"]).index(["derivedFrom"]), Ae = F(W, {
63
+ id: A({ prefix: "sgrant" }),
64
+ refId: I(),
65
+ principalType: I(),
66
+ principalId: I(),
67
+ permission: I(),
68
+ createdAt: ue(),
69
+ expiresAt: ue().nullable(),
70
+ createdBy: I().nullable()
71
+ }).index(["refId"]).index(["principalId"]), je = F(Oe, {
72
+ id: A({ prefix: "susage" }),
73
+ tenantId: I().maxLength(191),
74
+ bytes: j().default(0),
75
+ count: j().default(0),
76
+ updatedAt: ue()
77
+ }).unique("byStorageUsageTenant", ["tenantId"]), Me = F(G, {
78
+ id: A({ prefix: "blob" }),
79
+ key: I(),
80
+ data: ce(),
81
+ contentType: I(),
82
+ size: j()
83
+ }).index(["key"]), K = L([
84
84
  {
85
85
  name: "STORAGE_PROVIDER",
86
86
  required: !1,
@@ -231,47 +231,47 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
231
231
  secret: !1,
232
232
  description: "clamd port for the optional clamav virus scanner. Default 3310."
233
233
  }
234
- ]), J = (e, n, r, i) => new t({
234
+ ]), q = (e, n, r, i) => new t({
235
235
  provider: e,
236
236
  message: n,
237
237
  transient: r,
238
238
  ...i === void 0 ? {} : { status: i }
239
- }), Me = (e) => e === void 0 || e === 408 || e === 429 || e >= 500, Ne = /* @__PURE__ */ new Map(), Pe = (e, t) => Ne.get(e)?.get(t)?.bytes, Fe = (e) => {
240
- Ne.get(e)?.clear();
241
- }, Ie = (e = "default") => {
242
- let t = Ne.get(e) ?? /* @__PURE__ */ new Map();
243
- return Ne.set(e, t), {
239
+ }), Ne = (e) => e === void 0 || e === 408 || e === 429 || e >= 500, Pe = /* @__PURE__ */ new Map(), Fe = (e, t) => Pe.get(e)?.get(t)?.bytes, Ie = (e) => {
240
+ Pe.get(e)?.clear();
241
+ }, Le = (e = "default") => {
242
+ let t = Pe.get(e) ?? /* @__PURE__ */ new Map();
243
+ return Pe.set(e, t), {
244
244
  name: "memory",
245
245
  presigns: !1,
246
- put: (e, n, r) => b.sync(() => (t.set(e, {
246
+ put: (e, n, r) => y.sync(() => (t.set(e, {
247
247
  bytes: n,
248
248
  contentType: r.contentType
249
249
  }), { size: n.byteLength })),
250
- get: (e) => b.suspend(() => {
250
+ get: (e) => y.suspend(() => {
251
251
  let n = t.get(e);
252
- return n ? b.succeed({
252
+ return n ? y.succeed({
253
253
  bytes: n.bytes,
254
254
  contentType: n.contentType
255
- }) : b.fail(J("memory", `no object at key '${e}'`, !1, 404));
255
+ }) : y.fail(q("memory", `no object at key '${e}'`, !1, 404));
256
256
  }),
257
- delete: (e) => b.sync(() => {
257
+ delete: (e) => y.sync(() => {
258
258
  t.delete(e);
259
259
  }),
260
260
  publicUrl: () => null,
261
- getUrl: () => b.succeed(""),
262
- head: (e) => b.sync(() => {
261
+ getUrl: () => y.succeed(""),
262
+ head: (e) => y.sync(() => {
263
263
  let n = t.get(e);
264
264
  return n ? { size: n.bytes.byteLength } : null;
265
265
  })
266
266
  };
267
- }, Le = (e) => {
267
+ }, Re = (e) => {
268
268
  let t = e.root, n = async (e) => {
269
269
  let { join: n, resolve: r, sep: i } = await import("node:path"), a = r(t), o = r(a, e);
270
270
  if (o !== a && !o.startsWith(a + i)) throw Error(`key '${e}' escapes the storage root`);
271
271
  return n(o);
272
- }, r = (e, t, n = !1) => b.tryPromise({
272
+ }, r = (e, t, n = !1) => y.tryPromise({
273
273
  try: e,
274
- catch: (e) => e?.code === "ENOENT" ? J("filesystem", `no object at key '${t}'`, !1, 404) : J("filesystem", String(e?.message ?? e), n)
274
+ catch: (e) => e?.code === "ENOENT" ? q("filesystem", `no object at key '${t}'`, !1, 404) : q("filesystem", String(e?.message ?? e), n)
275
275
  });
276
276
  return {
277
277
  root: t,
@@ -299,8 +299,8 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
299
299
  await (await import("node:fs/promises")).rm(await n(e), { force: !0 });
300
300
  }, e),
301
301
  publicUrl: () => null,
302
- getUrl: () => b.succeed(""),
303
- head: (e) => b.tryPromise({
302
+ getUrl: () => y.succeed(""),
303
+ head: (e) => y.tryPromise({
304
304
  try: async () => {
305
305
  let t = await import("node:fs/promises");
306
306
  try {
@@ -310,12 +310,12 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
310
310
  throw e;
311
311
  }
312
312
  },
313
- catch: (e) => J("filesystem", String(e?.message ?? e), !1)
313
+ catch: (e) => q("filesystem", String(e?.message ?? e), !1)
314
314
  }),
315
315
  getStream: (e) => r(async () => {
316
316
  let t = await import("node:fs/promises"), { createReadStream: r } = await import("node:fs"), i = await n(e), a = await t.stat(i);
317
317
  return {
318
- stream: Ce("filesystem", () => r(i)),
318
+ stream: we("filesystem", () => r(i)),
319
319
  contentType: "application/octet-stream",
320
320
  size: a.size
321
321
  };
@@ -325,7 +325,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
325
325
  await r.mkdir(i(c), { recursive: !0 });
326
326
  let l = `${c}.tmp-${a()}`;
327
327
  try {
328
- await s(await we(t), o(l));
328
+ await s(await Te(t), o(l));
329
329
  let e = await r.stat(l);
330
330
  return await r.rename(l, c), { size: e.size };
331
331
  } catch (e) {
@@ -340,10 +340,10 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
340
340
  end: i
341
341
  });
342
342
  s.on("data", (e) => o.push(e)), s.on("end", () => e()), s.on("error", n);
343
- }), be(o);
343
+ }), xe(o);
344
344
  }, e)
345
345
  };
346
- }, Re = (e) => {
346
+ }, ze = (e) => {
347
347
  let t = e.name ?? "s3", n = e.publicAcl ?? !0, r = null, i = () => r || (r = (async () => {
348
348
  let t, n;
349
349
  try {
@@ -364,11 +364,11 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
364
364
  cmds: t,
365
365
  presign: n.getSignedUrl
366
366
  };
367
- })(), r), a = (e) => b.tryPromise({
367
+ })(), r), a = (e) => y.tryPromise({
368
368
  try: e,
369
369
  catch: (e) => {
370
370
  let n = e?.$metadata?.httpStatusCode;
371
- return J(t, String(e?.message ?? e), Me(n), n);
371
+ return q(t, String(e?.message ?? e), Ne(n), n);
372
372
  }
373
373
  }), o = async (e) => {
374
374
  let t = e;
@@ -464,7 +464,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
464
464
  UploadId: n
465
465
  }));
466
466
  }),
467
- head: (n) => b.tryPromise({
467
+ head: (n) => y.tryPromise({
468
468
  try: async () => {
469
469
  let { client: t, cmds: r } = await i();
470
470
  try {
@@ -483,7 +483,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
483
483
  },
484
484
  catch: (e) => {
485
485
  let n = e?.$metadata?.httpStatusCode;
486
- return J(t, String(e?.message ?? e), Me(n), n);
486
+ return q(t, String(e?.message ?? e), Ne(n), n);
487
487
  }
488
488
  }),
489
489
  getStream: (n) => a(async () => {
@@ -492,7 +492,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
492
492
  Key: n
493
493
  })), s = o.Body;
494
494
  return {
495
- stream: Ce(t, () => s),
495
+ stream: we(t, () => s),
496
496
  contentType: o.ContentType ?? "application/octet-stream",
497
497
  ...o.ContentLength === void 0 ? {} : { size: o.ContentLength }
498
498
  };
@@ -504,7 +504,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
504
504
  } catch (e) {
505
505
  throw Error("s3/minio `putStream` requires the '@aws-sdk/lib-storage' optional dependency (multipart upload). Install it to enable streamed uploads.", { cause: e });
506
506
  }
507
- let l = await we(r);
507
+ let l = await Te(r);
508
508
  return await new c.Upload({
509
509
  client: a,
510
510
  params: {
@@ -528,15 +528,15 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
528
528
  return o(c.Body);
529
529
  })
530
530
  };
531
- }, ze = (e) => e instanceof Uint8Array ? e : typeof e == "string" ? new Uint8Array(Buffer.from(e, "base64")) : new Uint8Array(e), Be = () => {
531
+ }, Be = (e) => e instanceof Uint8Array ? e : typeof e == "string" ? new Uint8Array(Buffer.from(e, "base64")) : new Uint8Array(e), Ve = () => {
532
532
  let e = null, t = () => {
533
533
  if (!e) throw Error("the 'database' storage provider isn't bound to a DataStore yet");
534
534
  return e;
535
- }, n = (e) => b.tryPromise({
535
+ }, n = (e) => y.tryPromise({
536
536
  try: e,
537
- catch: (e) => J("database", String(e?.message ?? e), !0)
537
+ catch: (e) => q("database", String(e?.message ?? e), !0)
538
538
  }), r = async (e) => (await t().query({
539
- table: K,
539
+ table: G,
540
540
  predicate: {
541
541
  column: "key",
542
542
  op: "eq",
@@ -555,37 +555,37 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
555
555
  },
556
556
  put: (e, i, a) => n(async () => {
557
557
  let n = await r(e);
558
- return n ? await t().update(K, String(n.id), {
558
+ return n ? await t().update(G, String(n.id), {
559
559
  data: i,
560
560
  contentType: a.contentType,
561
561
  size: i.byteLength
562
- }) : await t().insert(K, {
563
- id: A({
562
+ }) : await t().insert(G, {
563
+ id: k({
564
564
  kind: "typeid",
565
565
  prefix: "blob"
566
- }, K),
566
+ }, G),
567
567
  key: e,
568
568
  data: i,
569
569
  contentType: a.contentType,
570
570
  size: i.byteLength
571
571
  }), { size: i.byteLength };
572
572
  }),
573
- get: (e) => b.suspend(() => n(() => r(e)).pipe(b.flatMap((t) => t ? b.succeed({
574
- bytes: ze(t.data),
573
+ get: (e) => y.suspend(() => n(() => r(e)).pipe(y.flatMap((t) => t ? y.succeed({
574
+ bytes: Be(t.data),
575
575
  contentType: String(t.contentType)
576
- }) : b.fail(J("database", `no object at key '${e}'`, !1, 404))))),
576
+ }) : y.fail(q("database", `no object at key '${e}'`, !1, 404))))),
577
577
  delete: (e) => n(async () => {
578
578
  let n = await r(e);
579
- n && await t().delete(K, String(n.id));
579
+ n && await t().delete(G, String(n.id));
580
580
  }),
581
581
  publicUrl: () => null,
582
- getUrl: () => b.succeed(""),
582
+ getUrl: () => y.succeed(""),
583
583
  head: (e) => n(async () => {
584
584
  let t = await r(e);
585
585
  return t ? { size: Number(t.size) } : null;
586
586
  })
587
587
  };
588
- }, Ve = (e) => {
588
+ }, He = (e) => {
589
589
  let t = null, n = () => t || (t = (async () => {
590
590
  let t;
591
591
  try {
@@ -593,17 +593,17 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
593
593
  } catch (e) {
594
594
  throw Error("the 'azure' storage provider requires the '@azure/storage-blob' optional dependency. Install it to enable it.", { cause: e });
595
595
  }
596
- let n = q.read("AZURE_STORAGE_ACCOUNT", e.accountName), r = q.read("AZURE_STORAGE_KEY", e.accountKey), i = n && r ? new t.StorageSharedKeyCredential(n, r) : null, a = q.read("AZURE_STORAGE_CONNECTION_STRING", e.connectionString);
596
+ let n = K.read("AZURE_STORAGE_ACCOUNT", e.accountName), r = K.read("AZURE_STORAGE_KEY", e.accountKey), i = n && r ? new t.StorageSharedKeyCredential(n, r) : null, a = K.read("AZURE_STORAGE_CONNECTION_STRING", e.connectionString);
597
597
  return {
598
598
  container: (a ? t.BlobServiceClient.fromConnectionString(a) : new t.BlobServiceClient(e.endpoint ?? `https://${n}.blob.core.windows.net`, i ?? void 0)).getContainerClient(e.container),
599
599
  sdk: t,
600
600
  cred: i
601
601
  };
602
- })(), t), r = (e) => b.tryPromise({
602
+ })(), t), r = (e) => y.tryPromise({
603
603
  try: e,
604
604
  catch: (e) => {
605
605
  let t = e?.statusCode;
606
- return J("azure", String(e?.message ?? e), Me(t), t);
606
+ return q("azure", String(e?.message ?? e), Ne(t), t);
607
607
  }
608
608
  }), i = async (e) => {
609
609
  if (!e) return /* @__PURE__ */ new Uint8Array();
@@ -645,7 +645,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
645
645
  publicUrl: (t) => e.cdnBaseUrl ? `${e.cdnBaseUrl.replace(/\/$/, "")}/${t}` : null,
646
646
  getUrl: (e, t) => r(() => a(e, "r", t)),
647
647
  getUploadUrl: (e, t, n) => r(() => a(e, "cw", t)),
648
- head: (e) => b.tryPromise({
648
+ head: (e) => y.tryPromise({
649
649
  try: async () => {
650
650
  let { container: t } = await n();
651
651
  try {
@@ -661,19 +661,19 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
661
661
  },
662
662
  catch: (e) => {
663
663
  let t = e?.statusCode;
664
- return J("azure", String(e?.message ?? e), Me(t), t);
664
+ return q("azure", String(e?.message ?? e), Ne(t), t);
665
665
  }
666
666
  }),
667
667
  getStream: (e) => r(async () => {
668
668
  let { container: t } = await n(), r = await t.getBlockBlobClient(e).download();
669
669
  return {
670
- stream: Ce("azure", () => r.readableStreamBody),
670
+ stream: we("azure", () => r.readableStreamBody),
671
671
  contentType: r.contentType ?? "application/octet-stream",
672
672
  ...r.contentLength === void 0 ? {} : { size: r.contentLength }
673
673
  };
674
674
  }),
675
675
  putStream: (e, t, i) => r(async () => {
676
- let { container: r } = await n(), a = await we(t);
676
+ let { container: r } = await n(), a = await Te(t);
677
677
  return await r.getBlockBlobClient(e).uploadStream(a, 4194304, 5, { blobHTTPHeaders: { blobContentType: i.contentType } }), { size: i.totalSize ?? (await r.getBlockBlobClient(e).getProperties()).contentLength ?? 0 };
678
678
  }),
679
679
  getRange: (e, t, a) => r(async () => {
@@ -681,13 +681,13 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
681
681
  return i(o.readableStreamBody);
682
682
  })
683
683
  };
684
- }, He = {
684
+ }, Ue = {
685
685
  webp: "image/webp",
686
686
  avif: "image/avif",
687
687
  jpeg: "image/jpeg",
688
688
  jpg: "image/jpeg",
689
689
  png: "image/png"
690
- }, Ue = (e) => {
690
+ }, We = (e) => {
691
691
  if (!e) return null;
692
692
  let t = new URLSearchParams(e), n = (e) => {
693
693
  let n = t.get(e);
@@ -702,17 +702,17 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
702
702
  ...a === void 0 ? {} : { q: a },
703
703
  ...s ? { fit: s } : {}
704
704
  };
705
- }, We = (e) => e.startsWith("image/") && !e.includes("svg"), Ge, Ke = async () => {
706
- if (Ge !== void 0) return Ge;
705
+ }, Ge = (e) => e.startsWith("image/") && !e.includes("svg"), J, Ke = async () => {
706
+ if (J !== void 0) return J;
707
707
  try {
708
708
  let e = await import("sharp");
709
- Ge = e.default ?? e;
709
+ J = e.default ?? e;
710
710
  } catch {
711
- Ge = null;
711
+ J = null;
712
712
  }
713
- return Ge;
713
+ return J;
714
714
  }, qe = async (e, t, n) => {
715
- if (!We(t)) return null;
715
+ if (!Ge(t)) return null;
716
716
  let r = await Ke();
717
717
  if (!r) return null;
718
718
  try {
@@ -723,10 +723,10 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
723
723
  fit: n.fit ?? "cover",
724
724
  withoutEnlargement: !0
725
725
  }));
726
- let a = n.format && He[n.format] ? n.format : void 0, o = t;
726
+ let a = n.format && Ue[n.format] ? n.format : void 0, o = t;
727
727
  if (a) {
728
728
  let e = a === "jpg" ? "jpeg" : a;
729
- i = i.toFormat(e, n.q === void 0 ? {} : { quality: n.q }), o = He[a];
729
+ i = i.toFormat(e, n.q === void 0 ? {} : { quality: n.q }), o = Ue[a];
730
730
  } else n.q !== void 0 && (t === "image/jpeg" || t === "image/webp") && (i = i.toFormat(t === "image/webp" ? "webp" : "jpeg", { quality: n.q }));
731
731
  let s = await i.toBuffer();
732
732
  return {
@@ -746,22 +746,22 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
746
746
  }
747
747
  return o;
748
748
  }, Ze = (e) => {
749
- let t = B(16).toString("hex");
750
- return `${t}:${de(e, t, 32).toString("hex")}`;
749
+ let t = z(16).toString("hex");
750
+ return `${t}:${fe(e, t, 32).toString("hex")}`;
751
751
  }, Qe = (e, t) => {
752
752
  if (!e || !t) return !1;
753
753
  let [n, r] = t.split(":");
754
754
  if (!n || !r) return !1;
755
- let i = Buffer.from(r, "hex"), a = de(e, n, i.length);
756
- return a.length === i.length && V(a, i);
757
- }, $e = (e) => Array.isArray(e) ? e.filter((e) => typeof e == "string") : [], et = (e) => $e(e.metadata?.roles), tt = (e) => $e(e.scopes), nt = (e, t) => e.some((e) => t.includes(e)), rt = (e) => $e(e.metadata?.groups), it = (e) => typeof e == "boolean" ? b.succeed(e) : b.isEffect(e) ? e : b.promise(() => e), at = (e, t, n = {}) => b.gen(function* () {
755
+ let i = Buffer.from(r, "hex"), a = fe(e, n, i.length);
756
+ return a.length === i.length && B(a, i);
757
+ }, $e = (e) => Array.isArray(e) ? e.filter((e) => typeof e == "string") : [], et = (e) => $e(e.metadata?.roles), tt = (e) => $e(e.scopes), nt = (e, t) => e.some((e) => t.includes(e)), rt = (e) => $e(e.metadata?.groups), it = (e) => typeof e == "boolean" ? y.succeed(e) : y.isEffect(e) ? e : y.promise(() => e), at = (e, t, n = {}) => y.gen(function* () {
758
758
  if (t.id && e.ownerId && t.id === e.ownerId) return !0;
759
759
  let r = e.accessPolicy ?? [];
760
760
  if (r.length === 0) return !1;
761
- let i = n.resolveGroups ? yield* b.promise(async () => await n.resolveGroups(t)) : rt(t);
761
+ let i = n.resolveGroups ? yield* y.promise(async () => await n.resolveGroups(t)) : rt(t);
762
762
  for (let a of r) if (yield* ot(a, e, t, i, n)) return !0;
763
763
  return !1;
764
- }), ot = (e, t, n, r, i) => b.gen(function* () {
764
+ }), ot = (e, t, n, r, i) => y.gen(function* () {
765
765
  let a = !1, o = (e) => (a = !0, e);
766
766
  if (e.owner !== void 0 && e.owner && !o(!!n.id && !!t.ownerId && n.id === t.ownerId) || e.tenant !== void 0 && e.tenant && !o(!!n.tenantId && n.tenantId === t.tenantId) || e.apiKey !== void 0 && e.apiKey && !o(n.type === "apiKey") || e.roles && e.roles.length > 0 && !o(nt(et(n), e.roles)) || e.groups && e.groups.length > 0 && !o(nt(r, e.groups)) || e.scopes && e.scopes.length > 0 && !o(nt(tt(n), e.scopes)) || e.password !== void 0 && e.password && !o(Qe(i.password, t.passwordHash))) return !1;
767
767
  if (e.guard) {
@@ -786,7 +786,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
786
786
  }, ct = (e, t, n, r, i) => {
787
787
  let a = st(t, n);
788
788
  return e.some((e) => e.expiresAt && e.expiresAt.getTime() < i || r === "write" && e.permission !== "write" ? !1 : a.some((t) => t.type === e.principalType && t.id === e.principalId));
789
- }, lt = (e, t) => t.resolveGroups ? b.promise(async () => await t.resolveGroups(e)) : b.succeed(rt(e)), Y = () => q.read("VOLTRO_STORAGE_SECRET") ?? ae(), X = (e) => (typeof e == "string" ? Buffer.from(e, "utf8") : e).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, ""), Z = (e) => {
789
+ }, lt = (e, t) => t.resolveGroups ? y.promise(async () => await t.resolveGroups(e)) : y.succeed(rt(e)), Y = () => K.read("VOLTRO_STORAGE_SECRET") ?? oe(), X = (e) => (typeof e == "string" ? Buffer.from(e, "utf8") : e).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, ""), Z = (e) => {
790
790
  let t = e.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - e.length % 4) % 4);
791
791
  return Buffer.from(t, "base64");
792
792
  }, ut = (e, t, n = Y()) => {
@@ -795,13 +795,13 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
795
795
  refId: e,
796
796
  exp: Math.floor(Date.now() / 1e3) + Math.floor(t)
797
797
  }, i = X(JSON.stringify(r));
798
- return `${i}.${X(z("sha256", n).update(i).digest())}`;
798
+ return `${i}.${X(R("sha256", n).update(i).digest())}`;
799
799
  }, dt = (e, t = Y()) => {
800
800
  if (!e || !t) return null;
801
801
  let n = e.indexOf(".");
802
802
  if (n <= 0 || n === e.length - 1) return null;
803
- let r = e.slice(0, n), i = e.slice(n + 1), a = z("sha256", t).update(r).digest(), o = Z(i);
804
- if (o.length !== a.length || !V(o, a)) return null;
803
+ let r = e.slice(0, n), i = e.slice(n + 1), a = R("sha256", t).update(r).digest(), o = Z(i);
804
+ if (o.length !== a.length || !B(o, a)) return null;
805
805
  try {
806
806
  let e = JSON.parse(Z(r).toString("utf8"));
807
807
  return typeof e.refId != "string" || typeof e.exp != "number" || e.exp < Math.floor(Date.now() / 1e3) ? null : e;
@@ -814,13 +814,13 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
814
814
  ...e,
815
815
  exp: Math.floor(Date.now() / 1e3) + Math.floor(t)
816
816
  }, i = X(JSON.stringify(r));
817
- return `${i}.${X(z("sha256", n).update(`u:${i}`).digest())}`;
817
+ return `${i}.${X(R("sha256", n).update(`u:${i}`).digest())}`;
818
818
  }, pt = (e, t = Y()) => {
819
819
  if (!e || !t) return null;
820
820
  let n = e.indexOf(".");
821
821
  if (n <= 0 || n === e.length - 1) return null;
822
- let r = e.slice(0, n), i = e.slice(n + 1), a = z("sha256", t).update(`u:${r}`).digest(), o = Z(i);
823
- if (o.length !== a.length || !V(o, a)) return null;
822
+ let r = e.slice(0, n), i = e.slice(n + 1), a = R("sha256", t).update(`u:${r}`).digest(), o = Z(i);
823
+ if (o.length !== a.length || !B(o, a)) return null;
824
824
  try {
825
825
  let e = JSON.parse(Z(r).toString("utf8"));
826
826
  return typeof e.instance != "string" || !e.instance || typeof e.ct != "string" || typeof e.exp != "number" || e.vis !== "public" && e.vis !== "private" || e.exp < Math.floor(Date.now() / 1e3) ? null : e;
@@ -833,13 +833,13 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
833
833
  ...e,
834
834
  exp: Math.floor(Date.now() / 1e3) + Math.floor(t)
835
835
  }, i = X(JSON.stringify(r));
836
- return `${i}.${X(z("sha256", n).update(`f:${i}`).digest())}`;
836
+ return `${i}.${X(R("sha256", n).update(`f:${i}`).digest())}`;
837
837
  }, ht = (e, t = Y()) => {
838
838
  if (!e || !t) return null;
839
839
  let n = e.indexOf(".");
840
840
  if (n <= 0 || n === e.length - 1) return null;
841
- let r = e.slice(0, n), i = e.slice(n + 1), a = z("sha256", t).update(`f:${r}`).digest(), o = Z(i);
842
- if (o.length !== a.length || !V(o, a)) return null;
841
+ let r = e.slice(0, n), i = e.slice(n + 1), a = R("sha256", t).update(`f:${r}`).digest(), o = Z(i);
842
+ if (o.length !== a.length || !B(o, a)) return null;
843
843
  try {
844
844
  let e = JSON.parse(Z(r).toString("utf8"));
845
845
  return typeof e.key != "string" || e.key.length === 0 || typeof e.instance != "string" || !e.instance || typeof e.ct != "string" || typeof e.exp != "number" || e.vis !== "public" && e.vis !== "private" || e.exp < Math.floor(Date.now() / 1e3) ? null : e;
@@ -852,13 +852,13 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
852
852
  ...e,
853
853
  exp: Math.floor(Date.now() / 1e3) + Math.floor(t)
854
854
  }, i = X(JSON.stringify(r));
855
- return `${i}.${X(z("sha256", n).update(`r:${i}`).digest())}`;
855
+ return `${i}.${X(R("sha256", n).update(`r:${i}`).digest())}`;
856
856
  }, _t = (e, t = Y()) => {
857
857
  if (!e || !t) return null;
858
858
  let n = e.indexOf(".");
859
859
  if (n <= 0 || n === e.length - 1) return null;
860
- let r = e.slice(0, n), i = e.slice(n + 1), a = z("sha256", t).update(`r:${r}`).digest(), o = Z(i);
861
- if (o.length !== a.length || !V(o, a)) return null;
860
+ let r = e.slice(0, n), i = e.slice(n + 1), a = R("sha256", t).update(`r:${r}`).digest(), o = Z(i);
861
+ if (o.length !== a.length || !B(o, a)) return null;
862
862
  try {
863
863
  let e = JSON.parse(Z(r).toString("utf8"));
864
864
  return typeof e.id != "string" || e.id.length === 0 || typeof e.size != "number" || e.size < 0 || typeof e.instance != "string" || !e.instance || typeof e.ct != "string" || typeof e.exp != "number" || e.vis !== "public" && e.vis !== "private" || e.exp < Math.floor(Date.now() / 1e3) ? null : e;
@@ -871,13 +871,13 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
871
871
  ...e,
872
872
  exp: Math.floor(Date.now() / 1e3) + Math.floor(t)
873
873
  }, i = X(JSON.stringify(r));
874
- return `${i}.${X(z("sha256", n).update(`m:${i}`).digest())}`;
874
+ return `${i}.${X(R("sha256", n).update(`m:${i}`).digest())}`;
875
875
  }, yt = (e, t = Y()) => {
876
876
  if (!e || !t) return null;
877
877
  let n = e.indexOf(".");
878
878
  if (n <= 0 || n === e.length - 1) return null;
879
- let r = e.slice(0, n), i = e.slice(n + 1), a = z("sha256", t).update(`m:${r}`).digest(), o = Z(i);
880
- if (o.length !== a.length || !V(o, a)) return null;
879
+ let r = e.slice(0, n), i = e.slice(n + 1), a = R("sha256", t).update(`m:${r}`).digest(), o = Z(i);
880
+ if (o.length !== a.length || !B(o, a)) return null;
881
881
  try {
882
882
  let e = JSON.parse(Z(r).toString("utf8"));
883
883
  return typeof e.key != "string" || e.key.length === 0 || typeof e.uploadId != "string" || e.uploadId.length === 0 || typeof e.instance != "string" || !e.instance || typeof e.ct != "string" || typeof e.exp != "number" || e.vis !== "public" && e.vis !== "private" || e.exp < Math.floor(Date.now() / 1e3) ? null : e;
@@ -974,7 +974,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
974
974
  reason: "content-type-not-allowed",
975
975
  detail: `content type '${t}' is not in the allow-list`
976
976
  } : null, wt = async (e, t, n) => {
977
- if (!We(t)) return { bytes: e };
977
+ if (!Ge(t)) return { bytes: e };
978
978
  let r = await Ke();
979
979
  if (!r) return { bytes: e };
980
980
  try {
@@ -1001,13 +1001,13 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
1001
1001
  }, Tt = 67108864, Et = (e) => new n({
1002
1002
  reason: "too-large",
1003
1003
  detail: `remote body exceeds the ${e}-byte ingest limit`
1004
- }), Dt = (e, r) => b.suspend(() => {
1004
+ }), Dt = (e, r) => y.suspend(() => {
1005
1005
  let i = r ?? Tt;
1006
- return !Number.isSafeInteger(i) || i < 0 ? b.fail(new t({
1006
+ return !Number.isSafeInteger(i) || i < 0 ? y.fail(new t({
1007
1007
  provider: "ingest",
1008
1008
  message: "limits.maxBytes must be a non-negative safe integer",
1009
1009
  transient: !1
1010
- })) : b.tryPromise({
1010
+ })) : y.tryPromise({
1011
1011
  try: async (n) => {
1012
1012
  let r = await fetch(e, { signal: n }), a;
1013
1013
  try {
@@ -1047,14 +1047,14 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
1047
1047
  transient: !0
1048
1048
  })
1049
1049
  });
1050
- }), Ot = (e, t) => b.suspend(() => {
1050
+ }), Ot = (e, t) => y.suspend(() => {
1051
1051
  if (t === void 0) return e;
1052
- if (t.aborted) return b.interrupt;
1053
- let n = b.async((e) => {
1054
- let n = () => e(b.interrupt);
1055
- return t.addEventListener("abort", n, { once: !0 }), t.aborted && n(), b.sync(() => t.removeEventListener("abort", n));
1052
+ if (t.aborted) return y.interrupt;
1053
+ let n = y.async((e) => {
1054
+ let n = () => e(y.interrupt);
1055
+ return t.addEventListener("abort", n, { once: !0 }), t.aborted && n(), y.sync(() => t.removeEventListener("abort", n));
1056
1056
  });
1057
- return b.raceFirst(e, n);
1057
+ return y.raceFirst(e, n);
1058
1058
  }), kt = async (e) => {
1059
1059
  let { createHash: t } = await import("node:crypto");
1060
1060
  return t("sha256").update(e).digest("hex");
@@ -1094,7 +1094,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
1094
1094
  }, Nt = (e) => e ?? "global", Pt = () => {
1095
1095
  let e = /* @__PURE__ */ new Map(), t = /* @__PURE__ */ new Map();
1096
1096
  return {
1097
- statistics: () => b.sync(() => jt((function* () {
1097
+ statistics: () => y.sync(() => jt((function* () {
1098
1098
  for (let t of e.values()) yield {
1099
1099
  tenantId: t.tenantId,
1100
1100
  visibility: t.visibility,
@@ -1102,14 +1102,14 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
1102
1102
  bytes: t.size
1103
1103
  };
1104
1104
  })())),
1105
- insert: (t) => b.sync(() => {
1105
+ insert: (t) => y.sync(() => {
1106
1106
  e.set(t.id, t);
1107
1107
  }),
1108
- getById: (t) => b.sync(() => e.get(t) ?? null),
1109
- delete: (t) => b.sync(() => e.delete(t)),
1110
- listRecent: (t) => b.sync(() => [...e.values()].sort((e, t) => t.createdAt.getTime() - e.createdAt.getTime() || t.id.localeCompare(e.id)).slice(0, t)),
1111
- countByKey: (t, n) => b.sync(() => [...e.values()].filter((e) => e.bucket === t && e.key === n).length),
1112
- usageByTenant: (t) => b.sync(() => {
1108
+ getById: (t) => y.sync(() => e.get(t) ?? null),
1109
+ delete: (t) => y.sync(() => e.delete(t)),
1110
+ listRecent: (t) => y.sync(() => [...e.values()].sort((e, t) => t.createdAt.getTime() - e.createdAt.getTime() || t.id.localeCompare(e.id)).slice(0, t)),
1111
+ countByKey: (t, n) => y.sync(() => [...e.values()].filter((e) => e.bucket === t && e.key === n).length),
1112
+ usageByTenant: (t) => y.sync(() => {
1113
1113
  let n = 0, r = 0;
1114
1114
  for (let i of e.values()) (i.tenantId ?? null) === (t ?? null) && (n += i.size, r++);
1115
1115
  return {
@@ -1117,7 +1117,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
1117
1117
  count: r
1118
1118
  };
1119
1119
  }),
1120
- consumeUsage: (e, n, r) => b.sync(() => {
1120
+ consumeUsage: (e, n, r) => y.sync(() => {
1121
1121
  let i = Nt(e), a = t.get(i) ?? {
1122
1122
  bytes: 0,
1123
1123
  count: 0
@@ -1131,15 +1131,15 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
1131
1131
  count: a.count
1132
1132
  };
1133
1133
  }),
1134
- releaseUsage: (e, n) => b.sync(() => {
1134
+ releaseUsage: (e, n) => y.sync(() => {
1135
1135
  let r = Nt(e), i = t.get(r);
1136
1136
  i && t.set(r, {
1137
1137
  bytes: Math.max(0, i.bytes - n.bytes),
1138
1138
  count: Math.max(0, i.count - n.count)
1139
1139
  });
1140
1140
  }),
1141
- listByDerivedFrom: (t) => b.sync(() => [...e.values()].filter((e) => (e.derivedFrom ?? null) === t)),
1142
- listRefs: (t) => b.sync(() => [...e.values()].filter((e) => Mt(e, t)).sort((e, t) => t.createdAt.getTime() - e.createdAt.getTime() || t.id.localeCompare(e.id)).slice(t.offset, t.offset + t.limit))
1141
+ listByDerivedFrom: (t) => y.sync(() => [...e.values()].filter((e) => (e.derivedFrom ?? null) === t)),
1142
+ listRefs: (t) => y.sync(() => [...e.values()].filter((e) => Mt(e, t)).sort((e, t) => t.createdAt.getTime() - e.createdAt.getTime() || t.id.localeCompare(e.id)).slice(t.offset, t.offset + t.limit))
1143
1143
  };
1144
1144
  }, Ft = (e) => Array.isArray(e) && e.every((e) => typeof e == "string") ? e : null, It = (e) => ({
1145
1145
  id: String(e.id),
@@ -1164,7 +1164,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
1164
1164
  caption: e.caption ?? null,
1165
1165
  derivedFrom: e.derivedFrom ?? null,
1166
1166
  kind: e.kind ?? null
1167
- }), Q = (e) => b.tryPromise({
1167
+ }), Q = (e) => y.tryPromise({
1168
1168
  try: e,
1169
1169
  catch: (e) => new t({
1170
1170
  provider: "refstore",
@@ -1184,7 +1184,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
1184
1184
  projection: void 0
1185
1185
  }))[0] ?? null, Rt = (e) => ({
1186
1186
  statistics: () => Q(async () => jt((await e.query({
1187
- table: W,
1187
+ table: U,
1188
1188
  predicate: void 0,
1189
1189
  order: [],
1190
1190
  take: void 0,
@@ -1205,10 +1205,10 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
1205
1205
  count: Number(e.count),
1206
1206
  bytes: Number(e.bytes ?? 0)
1207
1207
  })))),
1208
- insert: (t) => Q(() => e.insert(W, { ...t })),
1208
+ insert: (t) => Q(() => e.insert(U, { ...t })),
1209
1209
  getById: (t) => Q(async () => {
1210
1210
  let n = await e.query({
1211
- table: W,
1211
+ table: U,
1212
1212
  predicate: {
1213
1213
  column: "id",
1214
1214
  op: "eq",
@@ -1221,9 +1221,9 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
1221
1221
  });
1222
1222
  return n[0] ? It(n[0]) : null;
1223
1223
  }),
1224
- delete: (t) => Q(() => e.delete(W, t)),
1224
+ delete: (t) => Q(() => e.delete(U, t)),
1225
1225
  listRecent: (t) => Q(async () => (await e.query({
1226
- table: W,
1226
+ table: U,
1227
1227
  predicate: void 0,
1228
1228
  order: [{
1229
1229
  column: "createdAt",
@@ -1234,7 +1234,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
1234
1234
  projection: void 0
1235
1235
  })).map(It)),
1236
1236
  countByKey: (t, n) => Q(async () => (await e.query({
1237
- table: W,
1237
+ table: U,
1238
1238
  predicate: { and: [{
1239
1239
  column: "bucket",
1240
1240
  op: "eq",
@@ -1251,7 +1251,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
1251
1251
  })).length),
1252
1252
  usageByTenant: (t) => Q(async () => {
1253
1253
  let n = await e.query({
1254
- table: W,
1254
+ table: U,
1255
1255
  predicate: {
1256
1256
  column: "tenantId",
1257
1257
  op: "eq",
@@ -1283,16 +1283,16 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
1283
1283
  bytes: o + n.bytes,
1284
1284
  count: s + n.count,
1285
1285
  updatedAt: /* @__PURE__ */ new Date()
1286
- }, { where: D(k("id", String(a.id)), k("bytes", o), k("count", s)) }) === 1) return {
1286
+ }, { where: E(O("id", String(a.id)), O("bytes", o), O("count", s)) }) === 1) return {
1287
1287
  allowed: !0,
1288
1288
  bytes: o,
1289
1289
  count: s
1290
1290
  };
1291
1291
  } else {
1292
- let t = A({
1292
+ let t = k({
1293
1293
  kind: "typeid",
1294
1294
  prefix: "susage"
1295
- }, De), r = await e.insertIgnore(De, {
1295
+ }, Oe), r = await e.insertIgnore(Oe, {
1296
1296
  id: t,
1297
1297
  tenantId: i,
1298
1298
  bytes: n.bytes,
@@ -1319,12 +1319,12 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
1319
1319
  bytes: Math.max(0, a - n.bytes),
1320
1320
  count: Math.max(0, o - n.count),
1321
1321
  updatedAt: /* @__PURE__ */ new Date()
1322
- }, { where: D(k("id", String(i.id)), k("bytes", a), k("count", o)) }) === 1) return;
1322
+ }, { where: E(O("id", String(i.id)), O("bytes", a), O("count", o)) }) === 1) return;
1323
1323
  }
1324
1324
  throw Error(`storage usage release: contention on tenant '${r}' exceeded 32 attempts`);
1325
1325
  }),
1326
1326
  listByDerivedFrom: (t) => Q(async () => (await e.query({
1327
- table: W,
1327
+ table: U,
1328
1328
  predicate: {
1329
1329
  column: "derivedFrom",
1330
1330
  op: "eq",
@@ -1340,15 +1340,15 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
1340
1340
  })).map(It)),
1341
1341
  listRefs: (t) => Q(async () => {
1342
1342
  let n = [];
1343
- t.tenantId !== void 0 && n.push(k("tenantId", t.tenantId)), t.ownerId !== void 0 && n.push(k("ownerId", t.ownerId)), t.search && n.push(F(...[
1343
+ t.tenantId !== void 0 && n.push(O("tenantId", t.tenantId)), t.ownerId !== void 0 && n.push(O("ownerId", t.ownerId)), t.search && n.push(P(...[
1344
1344
  "id",
1345
1345
  "key",
1346
1346
  "contentType",
1347
1347
  "ownerId",
1348
1348
  "tenantId"
1349
- ].map((e) => O(e, t.search))));
1350
- let r = t.folder === void 0 && t.tags.length === 0 && t.includeDerived, i = n.length ? D(...n) : void 0, a = await e.query({
1351
- table: W,
1349
+ ].map((e) => D(e, t.search))));
1350
+ let r = t.folder === void 0 && t.tags.length === 0 && t.includeDerived, i = n.length ? E(...n) : void 0, a = await e.query({
1351
+ table: U,
1352
1352
  predicate: i,
1353
1353
  order: [{
1354
1354
  column: "createdAt",
@@ -1366,15 +1366,15 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
1366
1366
  }), zt = () => {
1367
1367
  let e = /* @__PURE__ */ new Map();
1368
1368
  return {
1369
- insert: (t) => b.sync(() => {
1369
+ insert: (t) => y.sync(() => {
1370
1370
  e.set(t.id, t);
1371
1371
  }),
1372
- delete: (t) => b.sync(() => {
1372
+ delete: (t) => y.sync(() => {
1373
1373
  e.delete(t);
1374
1374
  }),
1375
- getById: (t) => b.sync(() => e.get(t) ?? null),
1376
- listByRef: (t) => b.sync(() => [...e.values()].filter((e) => e.refId === t)),
1377
- deleteByRef: (t) => b.sync(() => {
1375
+ getById: (t) => y.sync(() => e.get(t) ?? null),
1376
+ listByRef: (t) => y.sync(() => [...e.values()].filter((e) => e.refId === t)),
1377
+ deleteByRef: (t) => y.sync(() => {
1378
1378
  for (let [n, r] of e) r.refId === t && e.delete(n);
1379
1379
  })
1380
1380
  };
@@ -1388,11 +1388,11 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
1388
1388
  expiresAt: e.expiresAt ? e.expiresAt instanceof Date ? e.expiresAt : new Date(String(e.expiresAt)) : null,
1389
1389
  createdBy: e.createdBy ?? null
1390
1390
  }), Vt = (e) => ({
1391
- insert: (t) => Q(() => e.insert(G, { ...t })),
1392
- delete: (t) => Q(() => e.delete(G, t)),
1391
+ insert: (t) => Q(() => e.insert(W, { ...t })),
1392
+ delete: (t) => Q(() => e.delete(W, t)),
1393
1393
  getById: (t) => Q(async () => {
1394
1394
  let n = (await e.query({
1395
- table: G,
1395
+ table: W,
1396
1396
  predicate: {
1397
1397
  column: "id",
1398
1398
  op: "eq",
@@ -1406,7 +1406,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
1406
1406
  return n ? Bt(n) : null;
1407
1407
  }),
1408
1408
  listByRef: (t) => Q(async () => (await e.query({
1409
- table: G,
1409
+ table: W,
1410
1410
  predicate: {
1411
1411
  column: "refId",
1412
1412
  op: "eq",
@@ -1422,7 +1422,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
1422
1422
  })).map(Bt)),
1423
1423
  deleteByRef: (t) => Q(async () => {
1424
1424
  let n = await e.query({
1425
- table: G,
1425
+ table: W,
1426
1426
  predicate: {
1427
1427
  column: "refId",
1428
1428
  op: "eq",
@@ -1433,23 +1433,23 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
1433
1433
  skip: void 0,
1434
1434
  projection: void 0
1435
1435
  });
1436
- for (let t of n) await e.delete(G, String(t.id));
1436
+ for (let t of n) await e.delete(W, String(t.id));
1437
1437
  })
1438
- }), Ht = () => A({
1438
+ }), Ht = () => k({
1439
1439
  kind: "typeid",
1440
1440
  prefix: "file"
1441
- }, W), Ut = () => A({
1441
+ }, U), Ut = () => k({
1442
1442
  kind: "typeid",
1443
1443
  prefix: "grant"
1444
- }, G), Wt = (i) => {
1445
- let { provider: a, refStore: o, grantStore: s, bucket: c } = i, l = i.access ?? {}, u = i.attempts ?? 3, d = i.urlExpiresInSec ?? 3600, f = (e) => At(i.publicBaseUrl, e, i.httpPath ?? "/_voltro/storage"), p = C.recurs(Math.max(0, u - 1)).pipe(C.intersect(C.exponential("100 millis")), C.whileInput((e) => e.transient)), m = (e, t, n) => [
1444
+ }, W), Wt = (i) => {
1445
+ let { provider: a, refStore: o, grantStore: s, bucket: c } = i, l = i.access ?? {}, u = i.attempts ?? 3, d = i.urlExpiresInSec ?? 3600, f = (e) => At(i.publicBaseUrl, e, i.httpPath ?? "/_voltro/storage"), p = S.recurs(Math.max(0, u - 1)).pipe(S.intersect(S.exponential("100 millis")), S.whileInput((e) => e.transient)), m = (e, t, n) => [
1446
1446
  i.tenantPrefix,
1447
1447
  e ?? "global",
1448
1448
  n ?? t
1449
1449
  ].filter(Boolean).join("/"), ee = (e) => {
1450
- if (e === void 0) return b.succeed(void 0);
1450
+ if (e === void 0) return y.succeed(void 0);
1451
1451
  let n = e.length === 0 ? "empty" : e.includes("\0") ? "contains NUL" : e.startsWith("/") || e.startsWith("\\") ? "starts with a path separator" : e.includes("\\") ? "contains a backslash" : e.split("/").some((e) => e === "" || e === "." || e === "..") ? "contains an empty, \".\" or \"..\" segment" : void 0;
1452
- return n === void 0 ? b.succeed(e) : b.fail(new t({
1452
+ return n === void 0 ? y.succeed(e) : y.fail(new t({
1453
1453
  provider: a.name,
1454
1454
  message: `storage key rejected: ${n}`,
1455
1455
  transient: !1,
@@ -1461,19 +1461,19 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
1461
1461
  "_incoming",
1462
1462
  t,
1463
1463
  String(n).padStart(6, "0")
1464
- ].filter(Boolean).join("/"), g = (e, n) => n !== void 0 && e.tenantId !== n ? b.fail(new t({
1464
+ ].filter(Boolean).join("/"), te = (e, n) => n !== void 0 && e.tenantId !== n ? y.fail(new t({
1465
1465
  provider: a.name,
1466
1466
  message: "cross-tenant access denied",
1467
1467
  transient: !1,
1468
1468
  status: 403
1469
- })) : b.succeed(e), _ = (e, n) => o.getById(e).pipe(b.flatMap((r) => r ? g(r, n) : b.fail(new t({
1469
+ })) : y.succeed(e), g = (e, n) => o.getById(e).pipe(y.flatMap((r) => r ? te(r, n) : y.fail(new t({
1470
1470
  provider: a.name,
1471
1471
  message: `no ref '${e}'`,
1472
1472
  transient: !1,
1473
1473
  status: 404
1474
- })))), te = (e) => b.suspend(() => {
1474
+ })))), ne = (e) => y.suspend(() => {
1475
1475
  let n = i.scan(e);
1476
- return b.isEffect(n) ? n : b.tryPromise({
1476
+ return y.isEffect(n) ? n : y.tryPromise({
1477
1477
  try: () => Promise.resolve(n),
1478
1478
  catch: (e) => new t({
1479
1479
  provider: "scan",
@@ -1481,61 +1481,61 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
1481
1481
  transient: !0
1482
1482
  })
1483
1483
  });
1484
- }), ne = (e) => b.suspend(() => {
1484
+ }), re = (e) => y.suspend(() => {
1485
1485
  let t = e.contentType;
1486
- if (!i.videoProbe || !(t.startsWith("video/") || t.startsWith("audio/"))) return b.succeed(null);
1486
+ if (!i.videoProbe || !(t.startsWith("video/") || t.startsWith("audio/"))) return y.succeed(null);
1487
1487
  let n;
1488
1488
  try {
1489
1489
  n = i.videoProbe(e);
1490
1490
  } catch {
1491
- return b.succeed(null);
1491
+ return y.succeed(null);
1492
1492
  }
1493
- return b.isEffect(n) ? n.pipe(b.catchAll(() => b.succeed(null))) : b.tryPromise({
1493
+ return y.isEffect(n) ? n.pipe(y.catchAll(() => y.succeed(null))) : y.tryPromise({
1494
1494
  try: () => Promise.resolve(n),
1495
1495
  catch: () => null
1496
- }).pipe(b.catchAll(() => b.succeed(null)));
1497
- }), v = (e) => b.gen(function* () {
1496
+ }).pipe(y.catchAll(() => y.succeed(null)));
1497
+ }), _ = (e) => y.gen(function* () {
1498
1498
  let t = Ct(e.bytes, e.contentType, i.limits);
1499
- if (t) return yield* b.fail(new n(t));
1499
+ if (t) return yield* y.fail(new n(t));
1500
1500
  if (i.scan) {
1501
- let t = yield* te({
1501
+ let t = yield* ne({
1502
1502
  bytes: e.bytes,
1503
1503
  contentType: e.contentType,
1504
1504
  ...e.key ? { key: e.key } : {}
1505
1505
  });
1506
- if (!t.clean) return yield* b.fail(new r({ threat: t.threat ?? "unknown" }));
1506
+ if (!t.clean) return yield* y.fail(new r({ threat: t.threat ?? "unknown" }));
1507
1507
  }
1508
- let s = yield* b.promise(() => wt(e.bytes, e.contentType, { normalize: i.normalizeImages ?? !1 })), l = s.bytes, u = yield* ne({
1508
+ let s = yield* y.promise(() => wt(e.bytes, e.contentType, { normalize: i.normalizeImages ?? !1 })), l = s.bytes, u = yield* re({
1509
1509
  bytes: l,
1510
1510
  contentType: e.contentType
1511
- }), d = s.width ?? u?.width, f = s.height ?? u?.height, h = s.placeholder ?? u?.poster, g = e.duration ?? u?.duration, _ = yield* b.promise(() => kt(l)), v = e.tenantId ?? null, y = e.visibility ?? "private", C = m(v, _, yield* ee(e.key)), w = {
1511
+ }), d = s.width ?? u?.width, f = s.height ?? u?.height, h = s.placeholder ?? u?.poster, te = e.duration ?? u?.duration, g = yield* y.promise(() => kt(l)), _ = e.tenantId ?? null, v = e.visibility ?? "private", S = m(_, g, yield* ee(e.key)), C = {
1512
1512
  bytes: l.byteLength,
1513
1513
  count: 1
1514
- }, T = yield* o.consumeUsage(v, w, i.quota);
1515
- if (!T.allowed) {
1516
- let e = i.quota ?? {}, t = e.maxCount !== void 0 && T.count + 1 > e.maxCount ? `tenant object count ${T.count} + 1 exceeds max ${e.maxCount}` : `tenant usage ${T.bytes} + ${l.byteLength} bytes exceeds max ${e.maxBytes}`;
1517
- return yield* b.fail(new n({
1514
+ }, w = yield* o.consumeUsage(_, C, i.quota);
1515
+ if (!w.allowed) {
1516
+ let e = i.quota ?? {}, t = e.maxCount !== void 0 && w.count + 1 > e.maxCount ? `tenant object count ${w.count} + 1 exceeds max ${e.maxCount}` : `tenant usage ${w.bytes} + ${l.byteLength} bytes exceeds max ${e.maxBytes}`;
1517
+ return yield* y.fail(new n({
1518
1518
  reason: "quota-exceeded",
1519
1519
  detail: t
1520
1520
  }));
1521
1521
  }
1522
- let re = e.password ? yield* b.sync(() => Ze(e.password)) : null, E = {
1522
+ let ie = e.password ? yield* y.sync(() => Ze(e.password)) : null, T = {
1523
1523
  id: Ht(),
1524
- tenantId: v,
1524
+ tenantId: _,
1525
1525
  ownerId: e.ownerId ?? null,
1526
1526
  bucket: c,
1527
- key: C,
1527
+ key: S,
1528
1528
  contentType: e.contentType,
1529
1529
  size: l.byteLength,
1530
- checksum: _,
1531
- visibility: y,
1530
+ checksum: g,
1531
+ visibility: v,
1532
1532
  accessPolicy: e.access ?? null,
1533
- passwordHash: re,
1533
+ passwordHash: ie,
1534
1534
  createdAt: /* @__PURE__ */ new Date(),
1535
1535
  ...d === void 0 ? {} : { width: d },
1536
1536
  ...f === void 0 ? {} : { height: f },
1537
1537
  ...h === void 0 ? {} : { placeholder: h },
1538
- ...g === void 0 ? {} : { duration: g },
1538
+ ...te === void 0 ? {} : { duration: te },
1539
1539
  ...e.folder === void 0 ? {} : { folder: e.folder },
1540
1540
  ...e.tags === void 0 ? {} : { tags: e.tags },
1541
1541
  ...e.alt === void 0 ? {} : { alt: e.alt },
@@ -1543,31 +1543,31 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
1543
1543
  ...e.derivedFrom === void 0 ? {} : { derivedFrom: e.derivedFrom },
1544
1544
  ...e.kind === void 0 ? {} : { kind: e.kind }
1545
1545
  };
1546
- return yield* ((e) => e.pipe(b.onExit((e) => x.isSuccess(e) ? b.void : o.delete(E.id).pipe(b.zipRight(o.releaseUsage(v, w)), b.ignore))))(o.insert(E).pipe(b.zipRight(a.put(C, l, {
1546
+ return yield* ((e) => e.pipe(y.onExit((e) => b.isSuccess(e) ? y.void : o.delete(T.id).pipe(y.zipRight(o.releaseUsage(_, C)), y.ignore))))(o.insert(T).pipe(y.zipRight(a.put(S, l, {
1547
1547
  contentType: e.contentType,
1548
- public: y === "public"
1549
- }).pipe(b.retry(p))))), i.transcode !== void 0 && i.autoTranscode !== !1 && E.derivedFrom == null && (e.contentType.startsWith("video/") || e.contentType.startsWith("audio/")) && (yield* b.forkDaemon(S(E).pipe(b.ignore))), E;
1550
- }), y = (e) => b.suspend(() => {
1551
- if (!i.transcode) return b.succeed([]);
1548
+ public: v === "public"
1549
+ }).pipe(y.retry(p))))), i.transcode !== void 0 && i.autoTranscode !== !1 && T.derivedFrom == null && (e.contentType.startsWith("video/") || e.contentType.startsWith("audio/")) && (yield* y.forkDaemon(x(T).pipe(y.ignore))), T;
1550
+ }), v = (e) => y.suspend(() => {
1551
+ if (!i.transcode) return y.succeed([]);
1552
1552
  let t;
1553
1553
  try {
1554
1554
  t = i.transcode(e);
1555
1555
  } catch {
1556
- return b.succeed([]);
1556
+ return y.succeed([]);
1557
1557
  }
1558
- return b.isEffect(t) ? t.pipe(b.catchAll(() => b.succeed([]))) : b.tryPromise({
1558
+ return y.isEffect(t) ? t.pipe(y.catchAll(() => y.succeed([]))) : y.tryPromise({
1559
1559
  try: () => Promise.resolve(t),
1560
1560
  catch: () => []
1561
- }).pipe(b.catchAll(() => b.succeed([])));
1562
- }), S = (e) => b.gen(function* () {
1561
+ }).pipe(y.catchAll(() => y.succeed([])));
1562
+ }), x = (e) => y.gen(function* () {
1563
1563
  if (!i.transcode || e.derivedFrom != null) return [];
1564
- let t = yield* a.get(e.key).pipe(b.retry(p)), n = yield* y({
1564
+ let t = yield* a.get(e.key).pipe(y.retry(p)), n = yield* v({
1565
1565
  bytes: t.bytes,
1566
1566
  contentType: e.contentType,
1567
1567
  ref: e
1568
1568
  }), r = [];
1569
1569
  for (let t of n) {
1570
- let n = yield* v({
1570
+ let n = yield* _({
1571
1571
  bytes: t.bytes,
1572
1572
  contentType: t.contentType,
1573
1573
  tenantId: e.tenantId,
@@ -1580,14 +1580,14 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
1580
1580
  r.push(n);
1581
1581
  }
1582
1582
  return r;
1583
- }), w = (e, t, n) => b.gen(function* () {
1583
+ }), C = (e, t, n) => y.gen(function* () {
1584
1584
  if (e.visibility === "public" || (yield* at(e, t, {
1585
1585
  ...l,
1586
1586
  ...n?.password === void 0 ? {} : { password: n.password }
1587
1587
  }))) return !0;
1588
1588
  let r = yield* lt(t, l);
1589
1589
  return ct(yield* s.listByRef(e.id), t, r, n?.permission ?? "read", Date.now());
1590
- }), re = (e) => {
1590
+ }), ie = (e) => {
1591
1591
  if (e.visibility === "public") {
1592
1592
  let t = a.publicUrl?.(e.key);
1593
1593
  if (t != null) return t;
@@ -1595,60 +1595,60 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
1595
1595
  return f(e.id);
1596
1596
  };
1597
1597
  return {
1598
- put: v,
1599
- get: (e, t) => _(e, t?.tenantId).pipe(b.flatMap((e) => a.get(e.key).pipe(b.retry(p), b.map((t) => ({
1598
+ put: _,
1599
+ get: (e, t) => g(e, t?.tenantId).pipe(y.flatMap((e) => a.get(e.key).pipe(y.retry(p), y.map((t) => ({
1600
1600
  bytes: t.bytes,
1601
1601
  ref: e
1602
1602
  }))))),
1603
- getStream: (e, t) => _(e, t?.tenantId).pipe(b.map((e) => ({
1603
+ getStream: (e, t) => g(e, t?.tenantId).pipe(y.map((e) => ({
1604
1604
  ref: e,
1605
- stream: T.unwrap(b.suspend(() => a.getStream ? a.getStream(e.key).pipe(b.retry(p), b.map((e) => e.stream)) : a.get(e.key).pipe(b.retry(p), b.map((e) => T.make(e.bytes)))))
1605
+ stream: w.unwrap(y.suspend(() => a.getStream ? a.getStream(e.key).pipe(y.retry(p), y.map((e) => e.stream)) : a.get(e.key).pipe(y.retry(p), y.map((e) => w.make(e.bytes)))))
1606
1606
  }))),
1607
- getRange: (e, n, r) => _(e, r?.tenantId).pipe(b.flatMap((e) => {
1607
+ getRange: (e, n, r) => g(e, r?.tenantId).pipe(y.flatMap((e) => {
1608
1608
  let r = e.size, i = Math.max(0, Math.trunc(n.start));
1609
- if (r > 0 && i >= r) return b.fail(new t({
1609
+ if (r > 0 && i >= r) return y.fail(new t({
1610
1610
  provider: a.name,
1611
1611
  message: `range start ${i} past end ${r}`,
1612
1612
  transient: !1,
1613
1613
  status: 416
1614
1614
  }));
1615
1615
  let o = Math.min(Math.trunc(n.endInclusive), Math.max(0, r - 1));
1616
- return o < i ? b.fail(new t({
1616
+ return o < i ? y.fail(new t({
1617
1617
  provider: a.name,
1618
1618
  message: `empty range ${i}-${o}`,
1619
1619
  transient: !1,
1620
1620
  status: 416
1621
- })) : (a.getRange ? a.getRange(e.key, i, o).pipe(b.retry(p)) : a.get(e.key).pipe(b.retry(p), b.map((e) => e.bytes.subarray(i, o + 1)))).pipe(b.map((t) => ({
1621
+ })) : (a.getRange ? a.getRange(e.key, i, o).pipe(y.retry(p)) : a.get(e.key).pipe(y.retry(p), y.map((e) => e.bytes.subarray(i, o + 1)))).pipe(y.map((t) => ({
1622
1622
  bytes: t,
1623
1623
  ref: e,
1624
1624
  totalSize: r
1625
1625
  })));
1626
1626
  })),
1627
- getUrl: (e, t) => _(e, t?.tenantId).pipe(b.flatMap((e) => e.visibility === "public" ? b.succeed(re(e)) : a.presigns ? a.getUrl(e.key, t?.expiresInSec ?? d) : b.succeed(f(e.id)))),
1628
- head: (e, t) => o.getById(e).pipe(b.flatMap((e) => e ? g(e, t?.tenantId).pipe(b.map((e) => e)) : b.succeed(null))),
1629
- delete: (e, t) => _(e, t?.tenantId).pipe(b.flatMap((t) => s.deleteByRef(e).pipe(b.flatMap(() => o.delete(e)), b.flatMap((e) => e ? o.countByKey(t.bucket, t.key).pipe(b.flatMap((e) => e === 0 ? a.delete(t.key).pipe(b.retry(p)) : b.void), b.flatMap(() => o.releaseUsage(t.tenantId, {
1627
+ getUrl: (e, t) => g(e, t?.tenantId).pipe(y.flatMap((e) => e.visibility === "public" ? y.succeed(ie(e)) : a.presigns ? a.getUrl(e.key, t?.expiresInSec ?? d) : y.succeed(f(e.id)))),
1628
+ head: (e, t) => o.getById(e).pipe(y.flatMap((e) => e ? te(e, t?.tenantId).pipe(y.map((e) => e)) : y.succeed(null))),
1629
+ delete: (e, t) => g(e, t?.tenantId).pipe(y.flatMap((t) => s.deleteByRef(e).pipe(y.flatMap(() => o.delete(e)), y.flatMap((e) => e ? o.countByKey(t.bucket, t.key).pipe(y.flatMap((e) => e === 0 ? a.delete(t.key).pipe(y.retry(p)) : y.void), y.flatMap(() => o.releaseUsage(t.tenantId, {
1630
1630
  bytes: t.size,
1631
1631
  count: 1
1632
- }))) : b.void), b.asVoid))),
1633
- mintUrl: (n, r, i) => b.gen(function* () {
1634
- let s = yield* o.getById(n).pipe(b.flatMap((e) => e ? b.succeed(e) : b.fail(new t({
1632
+ }))) : y.void), y.asVoid))),
1633
+ mintUrl: (n, r, i) => y.gen(function* () {
1634
+ let s = yield* o.getById(n).pipe(y.flatMap((e) => e ? y.succeed(e) : y.fail(new t({
1635
1635
  provider: a.name,
1636
1636
  message: `no ref '${n}'`,
1637
1637
  transient: !1,
1638
1638
  status: 404
1639
1639
  }))));
1640
- if (s.visibility === "public") return re(s);
1641
- if (!(yield* w(s, r, i?.password === void 0 ? {} : { password: i.password }))) return yield* b.fail(new e({
1640
+ if (s.visibility === "public") return ie(s);
1641
+ if (!(yield* C(s, r, i?.password === void 0 ? {} : { password: i.password }))) return yield* y.fail(new e({
1642
1642
  refId: n,
1643
1643
  reason: "access denied"
1644
1644
  }));
1645
1645
  let c = i?.expiresInSec ?? d;
1646
1646
  if (a.presigns) return yield* a.getUrl(s.key, c);
1647
- let l = yield* b.sync(() => ut(s.id, c));
1647
+ let l = yield* y.sync(() => ut(s.id, c));
1648
1648
  return `${f(s.id)}?t=${l}`;
1649
1649
  }),
1650
- mintUploadUrl: (e) => b.gen(function* () {
1651
- if (!a.getUploadUrl) return yield* b.fail(new t({
1650
+ mintUploadUrl: (e) => y.gen(function* () {
1651
+ if (!a.getUploadUrl) return yield* y.fail(new t({
1652
1652
  provider: a.name,
1653
1653
  message: `provider '${a.name}' does not support presigned uploads`,
1654
1654
  transient: !1,
@@ -1657,8 +1657,8 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
1657
1657
  let n = m(e.tenantId ?? null, "", yield* ee(e.key));
1658
1658
  return yield* a.getUploadUrl(n, e.expiresInSec ?? d, e.contentType);
1659
1659
  }),
1660
- checkAccess: w,
1661
- grant: (e) => b.gen(function* () {
1660
+ checkAccess: C,
1661
+ grant: (e) => y.gen(function* () {
1662
1662
  let t = {
1663
1663
  id: Ut(),
1664
1664
  refId: e.refId,
@@ -1671,7 +1671,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
1671
1671
  };
1672
1672
  return yield* s.insert(t), t;
1673
1673
  }),
1674
- listRefs: (e) => b.suspend(() => {
1674
+ listRefs: (e) => y.suspend(() => {
1675
1675
  let t = Math.min(500, Math.max(1, Math.trunc(e?.limit ?? 50))), n = Math.max(0, Math.trunc(e?.offset ?? 0)), r = {
1676
1676
  tenantId: e && "tenantId" in e ? e.tenantId : void 0,
1677
1677
  folder: e?.folder,
@@ -1681,7 +1681,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
1681
1681
  limit: t + 1,
1682
1682
  offset: n
1683
1683
  };
1684
- return o.listRefs(r).pipe(b.map((e) => {
1684
+ return o.listRefs(r).pipe(y.map((e) => {
1685
1685
  let r = e.length > t;
1686
1686
  return {
1687
1687
  refs: r ? e.slice(0, t) : e,
@@ -1693,7 +1693,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
1693
1693
  getGrant: (e) => s.getById(e),
1694
1694
  listGrants: (e) => s.listByRef(e),
1695
1695
  usage: (e) => o.usageByTenant(e),
1696
- sweepOrphans: (e) => b.gen(function* () {
1696
+ sweepOrphans: (e) => y.gen(function* () {
1697
1697
  let t = e?.limit ?? 1e3, n = e?.dryRun ?? !1, r = yield* o.listRecent(t), i = [];
1698
1698
  for (let e of r) if ((yield* a.head(e.key)) === null) {
1699
1699
  if (!n) {
@@ -1710,9 +1710,9 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
1710
1710
  removed: i
1711
1711
  };
1712
1712
  }),
1713
- ingestUrl: (e, t) => Ot(b.gen(function* () {
1713
+ ingestUrl: (e, t) => Ot(y.gen(function* () {
1714
1714
  let n = yield* Dt(e, i.limits?.maxBytes);
1715
- return yield* v({
1715
+ return yield* _({
1716
1716
  bytes: n.bytes,
1717
1717
  contentType: t?.contentType ?? n.contentType,
1718
1718
  ...t?.tenantId === void 0 ? {} : { tenantId: t.tenantId },
@@ -1725,24 +1725,24 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
1725
1725
  ...t?.caption === void 0 ? {} : { caption: t.caption }
1726
1726
  });
1727
1727
  }), t?.abortSignal),
1728
- mintPresignedUpload: (e) => b.gen(function* () {
1729
- if (!a.getUploadUrl) return yield* b.fail(new t({
1728
+ mintPresignedUpload: (e) => y.gen(function* () {
1729
+ if (!a.getUploadUrl) return yield* y.fail(new t({
1730
1730
  provider: a.name,
1731
1731
  message: `provider '${a.name}' does not support presigned uploads`,
1732
1732
  transient: !1,
1733
1733
  status: 400
1734
1734
  }));
1735
- let n = e.expiresInSec ?? d, r = `_incoming/${A({
1735
+ let n = e.expiresInSec ?? d, r = `_incoming/${k({
1736
1736
  kind: "typeid",
1737
1737
  prefix: "up"
1738
- }, W)}`, i = m(e.tenantId ?? null, "", r);
1738
+ }, U)}`, i = m(e.tenantId ?? null, "", r);
1739
1739
  return {
1740
1740
  uploadUrl: yield* a.getUploadUrl(i, n, e.contentType),
1741
1741
  key: i,
1742
1742
  expiresInSec: n
1743
1743
  };
1744
1744
  }),
1745
- finalizeUpload: (e) => a.get(e.key).pipe(b.retry(p), b.flatMap((t) => v({
1745
+ finalizeUpload: (e) => a.get(e.key).pipe(y.retry(p), y.flatMap((t) => _({
1746
1746
  bytes: t.bytes,
1747
1747
  contentType: e.contentType,
1748
1748
  ...e.tenantId === void 0 ? {} : { tenantId: e.tenantId },
@@ -1752,12 +1752,12 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
1752
1752
  ...e.tags === void 0 ? {} : { tags: e.tags },
1753
1753
  ...e.alt === void 0 ? {} : { alt: e.alt },
1754
1754
  ...e.caption === void 0 ? {} : { caption: e.caption }
1755
- })), b.ensuring(a.delete(e.key).pipe(b.retry(p), b.ignore))),
1756
- putResumableChunk: (e) => a.put(h(e.tenantId ?? null, e.uploadId, e.index), e.bytes, { contentType: "application/octet-stream" }).pipe(b.retry(p), b.asVoid),
1757
- resumableStatus: (e) => b.gen(function* () {
1755
+ })), y.ensuring(a.delete(e.key).pipe(y.retry(p), y.ignore))),
1756
+ putResumableChunk: (e) => a.put(h(e.tenantId ?? null, e.uploadId, e.index), e.bytes, { contentType: "application/octet-stream" }).pipe(y.retry(p), y.asVoid),
1757
+ resumableStatus: (e) => y.gen(function* () {
1758
1758
  let t = 0, n = 0;
1759
1759
  for (; t < 1e6;) {
1760
- let r = yield* a.head(h(e.tenantId ?? null, e.uploadId, t)).pipe(b.retry(p), b.catchAll(() => b.succeed(null)));
1760
+ let r = yield* a.head(h(e.tenantId ?? null, e.uploadId, t)).pipe(y.retry(p), y.catchAll(() => y.succeed(null)));
1761
1761
  if (r === null) break;
1762
1762
  n += r.size, t += 1;
1763
1763
  }
@@ -1766,16 +1766,16 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
1766
1766
  nextIndex: t
1767
1767
  };
1768
1768
  }),
1769
- finalizeResumable: (e) => b.gen(function* () {
1769
+ finalizeResumable: (e) => y.gen(function* () {
1770
1770
  let t = [];
1771
1771
  for (let n = 0; n < e.count; n++) {
1772
- let r = yield* a.get(h(e.tenantId ?? null, e.uploadId, n)).pipe(b.retry(p));
1772
+ let r = yield* a.get(h(e.tenantId ?? null, e.uploadId, n)).pipe(y.retry(p));
1773
1773
  t.push(r.bytes);
1774
1774
  }
1775
1775
  let n = t.reduce((e, t) => e + t.byteLength, 0), r = new Uint8Array(n), i = 0;
1776
1776
  for (let e of t) r.set(e, i), i += e.byteLength;
1777
- let o = b.forEach(Array.from({ length: e.count }, (e, t) => t), (t) => a.delete(h(e.tenantId ?? null, e.uploadId, t)).pipe(b.retry(p), b.ignore), { discard: !0 });
1778
- return yield* v({
1777
+ let o = y.forEach(Array.from({ length: e.count }, (e, t) => t), (t) => a.delete(h(e.tenantId ?? null, e.uploadId, t)).pipe(y.retry(p), y.ignore), { discard: !0 });
1778
+ return yield* _({
1779
1779
  bytes: r,
1780
1780
  contentType: e.contentType,
1781
1781
  ...e.tenantId === void 0 ? {} : { tenantId: e.tenantId },
@@ -1785,44 +1785,44 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
1785
1785
  ...e.tags === void 0 ? {} : { tags: e.tags },
1786
1786
  ...e.alt === void 0 ? {} : { alt: e.alt },
1787
1787
  ...e.caption === void 0 ? {} : { caption: e.caption }
1788
- }).pipe(b.ensuring(o));
1788
+ }).pipe(y.ensuring(o));
1789
1789
  }),
1790
- transcode: (e, t) => _(e, t?.tenantId).pipe(b.flatMap((e) => S(e))),
1791
- renditions: (e, t) => _(e, t?.tenantId).pipe(b.flatMap(() => o.listByDerivedFrom(e))),
1792
- beginMultipartUpload: (e) => b.gen(function* () {
1793
- if (!a.createMultipartUpload || !a.presignUploadPart || !a.completeMultipartUpload) return yield* b.fail(new t({
1790
+ transcode: (e, t) => g(e, t?.tenantId).pipe(y.flatMap((e) => x(e))),
1791
+ renditions: (e, t) => g(e, t?.tenantId).pipe(y.flatMap(() => o.listByDerivedFrom(e))),
1792
+ beginMultipartUpload: (e) => y.gen(function* () {
1793
+ if (!a.createMultipartUpload || !a.presignUploadPart || !a.completeMultipartUpload) return yield* y.fail(new t({
1794
1794
  provider: a.name,
1795
1795
  message: `provider '${a.name}' does not support multipart uploads`,
1796
1796
  transient: !1,
1797
1797
  status: 400
1798
1798
  }));
1799
- let n = m(e.tenantId ?? null, "", `multipart/${A({
1799
+ let n = m(e.tenantId ?? null, "", `multipart/${k({
1800
1800
  kind: "typeid",
1801
1801
  prefix: "mp"
1802
- }, W)}`);
1802
+ }, U)}`);
1803
1803
  return {
1804
1804
  uploadId: (yield* a.createMultipartUpload(n, e.contentType, { public: (e.visibility ?? "private") === "public" })).uploadId,
1805
1805
  key: n
1806
1806
  };
1807
1807
  }),
1808
- signMultipartPart: (e) => b.suspend(() => a.presignUploadPart ? a.presignUploadPart(e.key, e.uploadId, e.partNumber, e.expiresInSec ?? d) : b.fail(new t({
1808
+ signMultipartPart: (e) => y.suspend(() => a.presignUploadPart ? a.presignUploadPart(e.key, e.uploadId, e.partNumber, e.expiresInSec ?? d) : y.fail(new t({
1809
1809
  provider: a.name,
1810
1810
  message: "provider does not support multipart uploads",
1811
1811
  transient: !1,
1812
1812
  status: 400
1813
1813
  }))),
1814
- completeMultipart: (e) => b.gen(function* () {
1815
- if (!a.completeMultipartUpload) return yield* b.fail(new t({
1814
+ completeMultipart: (e) => y.gen(function* () {
1815
+ if (!a.completeMultipartUpload) return yield* y.fail(new t({
1816
1816
  provider: a.name,
1817
1817
  message: "provider does not support multipart uploads",
1818
1818
  transient: !1,
1819
1819
  status: 400
1820
1820
  }));
1821
- let r = yield* a.completeMultipartUpload(e.key, e.uploadId, e.parts), s = yield* a.head(e.key).pipe(b.retry(p)), l = s?.size ?? 0, u = (r.etag ?? s?.etag ?? "").replace(/"/g, ""), d = e.tenantId ?? null, f = {
1821
+ let r = yield* a.completeMultipartUpload(e.key, e.uploadId, e.parts), s = yield* a.head(e.key).pipe(y.retry(p)), l = s?.size ?? 0, u = (r.etag ?? s?.etag ?? "").replace(/"/g, ""), d = e.tenantId ?? null, f = {
1822
1822
  bytes: l,
1823
1823
  count: 1
1824
1824
  };
1825
- if (!(yield* o.consumeUsage(d, f, i.quota)).allowed) return yield* a.delete(e.key).pipe(b.retry(p), b.ignore), yield* b.fail(new n({
1825
+ if (!(yield* o.consumeUsage(d, f, i.quota)).allowed) return yield* a.delete(e.key).pipe(y.retry(p), y.ignore), yield* y.fail(new n({
1826
1826
  reason: "quota-exceeded",
1827
1827
  detail: `multipart upload of ${l} bytes exceeds tenant quota`
1828
1828
  }));
@@ -1844,11 +1844,11 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
1844
1844
  ...e.alt === void 0 ? {} : { alt: e.alt },
1845
1845
  ...e.caption === void 0 ? {} : { caption: e.caption }
1846
1846
  };
1847
- return yield* o.insert(m).pipe(b.onExit((e) => x.isSuccess(e) ? b.void : o.releaseUsage(d, f).pipe(b.ignore))), m;
1847
+ return yield* o.insert(m).pipe(y.onExit((e) => b.isSuccess(e) ? y.void : o.releaseUsage(d, f).pipe(y.ignore))), m;
1848
1848
  }),
1849
- abortMultipart: (e) => b.suspend(() => a.abortMultipartUpload ? a.abortMultipartUpload(e.key, e.uploadId).pipe(b.retry(p)) : b.void)
1849
+ abortMultipart: (e) => y.suspend(() => a.abortMultipartUpload ? a.abortMultipartUpload(e.key, e.uploadId).pipe(y.retry(p)) : y.void)
1850
1850
  };
1851
- }, Gt = (e) => S.succeed(i, Wt(e)), Kt = (e, t = 65536) => {
1851
+ }, Gt = (e) => x.succeed(i, Wt(e)), Kt = (e, t = 65536) => {
1852
1852
  let n = [Buffer.from("zINSTREAM\0", "utf8")];
1853
1853
  for (let r = 0; r < e.length; r += t) {
1854
1854
  let i = e.subarray(r, Math.min(r + t, e.length)), a = Buffer.alloc(4);
@@ -1866,7 +1866,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
1866
1866
  };
1867
1867
  throw Error(`clamav: unexpected response: ${t}`);
1868
1868
  }, Jt = async (e, t) => {
1869
- let n = await import("node:net"), r = q.read("CLAMAV_HOST", t.host) ?? "127.0.0.1", i = q.read("CLAMAV_PORT"), a = t.port ?? (i ? Number(i) : 3310), o = t.timeoutMs ?? 3e4;
1869
+ let n = await import("node:net"), r = K.read("CLAMAV_HOST", t.host) ?? "127.0.0.1", i = K.read("CLAMAV_PORT"), a = t.port ?? (i ? Number(i) : 3310), o = t.timeoutMs ?? 3e4;
1870
1870
  return new Promise((i, s) => {
1871
1871
  let c = n.createConnection({
1872
1872
  host: r,
@@ -1890,7 +1890,7 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
1890
1890
  });
1891
1891
  });
1892
1892
  }, Yt = (e = {}) => (t) => Jt(t.bytes, e), Xt = (e, t, n) => new Promise((r, i) => {
1893
- let a = fe(e, [...t], { stdio: [
1893
+ let a = pe(e, [...t], { stdio: [
1894
1894
  "ignore",
1895
1895
  "ignore",
1896
1896
  "pipe"
@@ -1905,11 +1905,11 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
1905
1905
  clearTimeout(s), e === 0 ? r() : i(/* @__PURE__ */ Error(`ffmpeg exited ${String(e)}: ${o.slice(-400)}`));
1906
1906
  });
1907
1907
  }), Zt = (e) => async ({ bytes: t }) => {
1908
- let n = e.ffmpegPath ?? "ffmpeg", r = e.timeoutMs ?? 3e5, i = await pe(H(_e(), "voltro-tc-")), a = H(i, "in"), o = [];
1908
+ let n = e.ffmpegPath ?? "ffmpeg", r = e.timeoutMs ?? 3e5, i = await me(V(ve(), "voltro-tc-")), a = V(i, "in"), o = [];
1909
1909
  try {
1910
- await ge(a, t);
1910
+ await _e(a, t);
1911
1911
  for (let t of e.renditions) {
1912
- let e = H(i, `out.${t.ext}`);
1912
+ let e = V(i, `out.${t.ext}`);
1913
1913
  try {
1914
1914
  await Xt(n, [
1915
1915
  "-y",
@@ -1918,17 +1918,17 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
1918
1918
  ...t.args,
1919
1919
  e
1920
1920
  ], r);
1921
- let i = await me(e);
1921
+ let i = await he(e);
1922
1922
  o.push({
1923
1923
  bytes: new Uint8Array(i),
1924
1924
  contentType: t.contentType,
1925
1925
  kind: t.kind,
1926
1926
  ...t.label === void 0 ? {} : { label: t.label }
1927
- }), await he(e, { force: !0 });
1927
+ }), await ge(e, { force: !0 });
1928
1928
  } catch {}
1929
1929
  }
1930
1930
  } finally {
1931
- await he(i, {
1931
+ await ge(i, {
1932
1932
  recursive: !0,
1933
1933
  force: !0
1934
1934
  }).catch(() => void 0);
@@ -1938,10 +1938,10 @@ var ve = 1 << 20, ye = (e, n, r = !1) => new t({
1938
1938
  //#endregion
1939
1939
  //#region src/assetRef.ts
1940
1940
  function Qt(e = {}) {
1941
- let t = e.nullable ?? !0, n = e.fk === !1 ? L().externalId() : ce(() => Oe, { onDelete: e.onDelete ?? "setNull" });
1941
+ let t = e.nullable ?? !0, n = e.fk === !1 ? I().externalId() : le(() => ke, { onDelete: e.onDelete ?? "setNull" });
1942
1942
  return t ? n.nullable() : n;
1943
1943
  }
1944
- var $t = () => P({
1944
+ var $t = () => N({
1945
1945
  id: "@voltro/plugin-storage/withStorage",
1946
1946
  fields: { asset: Qt() }
1947
1947
  }), en = {
@@ -1959,8 +1959,8 @@ var $t = () => P({
1959
1959
  bytes: r ? new Uint8Array(Buffer.from(i, "base64")) : new Uint8Array(Buffer.from(decodeURIComponent(i), "utf8")),
1960
1960
  contentType: n
1961
1961
  };
1962
- }, nn = (e, n) => b.gen(function* () {
1963
- let r = yield* b.try({
1962
+ }, nn = (e, n) => y.gen(function* () {
1963
+ let r = yield* y.try({
1964
1964
  try: () => tn(n.dataUri),
1965
1965
  catch: (e) => new t({
1966
1966
  provider: "avatar",
@@ -1977,25 +1977,25 @@ var $t = () => P({
1977
1977
  visibility: "public",
1978
1978
  key: `avatars/${n.userId}/avatar.${i}`
1979
1979
  });
1980
- }), rn = I("_voltro_storage_put_intents", {
1981
- id: L().maxLength(64),
1982
- refId: L().maxLength(64),
1983
- identity: N(),
1984
- ref: N()
1980
+ }), rn = F("_voltro_storage_put_intents", {
1981
+ id: I().maxLength(64),
1982
+ refId: I().maxLength(64),
1983
+ identity: M(),
1984
+ ref: M()
1985
1985
  }).primaryKey(["id"]).unique("storagePutRef", ["refId"]).nonReactive();
1986
- w.Struct({
1987
- tenantId: w.NullOr(w.String),
1988
- bucket: w.String,
1989
- operationId: w.String,
1990
- fingerprint: w.String,
1991
- checksum: w.String,
1992
- logicalKey: w.String
1986
+ C.Struct({
1987
+ tenantId: C.NullOr(C.String),
1988
+ bucket: C.String,
1989
+ operationId: C.String,
1990
+ fingerprint: C.String,
1991
+ checksum: C.String,
1992
+ logicalKey: C.String
1993
1993
  });
1994
1994
  //#endregion
1995
1995
  //#region src/pathDurability.ts
1996
1996
  var an = (e) => {
1997
1997
  try {
1998
- let t = U(e), n = U("/");
1998
+ let t = H(e), n = H("/");
1999
1999
  return typeof t.dev != "number" || typeof n.dev != "number" ? "unknown" : t.dev === n.dev ? "same-device-as-root" : "separate-mount";
2000
2000
  } catch {
2001
2001
  return "unknown";
@@ -2004,16 +2004,16 @@ var an = (e) => {
2004
2004
  if (an(e) === "same-device-as-root") return `the capture is going to ${e}, which is on the SAME filesystem as \`/\`.\n A mounted volume would be a separate one. If this process is a container, that means the capture
2005
2005
  dies with it — which is the exact failure it exists for. On a development machine this is normal
2006
2006
  and can be ignored.`;
2007
- }, sn = q.read("VOLTRO_SESSION_COOKIE") ?? "voltro:session", cn, ln = (e) => {
2007
+ }, sn = K.read("VOLTRO_SESSION_COOKIE") ?? "voltro:session", cn, ln = (e) => {
2008
2008
  cn = e;
2009
- }, un = () => cn ?? fn({}), dn = () => cn === void 0 ? q.read("STORAGE_PROVIDER") === void 0 ? void 0 : fn({}) : cn, fn = (e) => {
2009
+ }, un = () => cn ?? fn({}), dn = () => cn === void 0 ? K.read("STORAGE_PROVIDER") === void 0 ? void 0 : fn({}) : cn, fn = (e) => {
2010
2010
  if (e.provider && typeof e.provider == "object") return e.provider;
2011
- let t = (e.provider ?? q.read("STORAGE_PROVIDER") ?? "memory").toLowerCase(), n = q.read("S3_BUCKET", e.bucket) ?? q.read("STORAGE_BUCKET") ?? "voltro";
2011
+ let t = (e.provider ?? K.read("STORAGE_PROVIDER") ?? "memory").toLowerCase(), n = K.read("S3_BUCKET", e.bucket) ?? K.read("STORAGE_BUCKET") ?? "voltro";
2012
2012
  switch (t) {
2013
2013
  case "s3":
2014
2014
  case "minio": {
2015
- let r = q.read("S3_REGION", e.region) ?? q.read("AWS_REGION"), i = q.read("S3_ENDPOINT", e.endpoint) ?? q.read("MINIO_ENDPOINT"), a = q.read("S3_ACCESS_KEY_ID", e.accessKeyId) ?? q.read("AWS_ACCESS_KEY_ID"), o = q.read("S3_SECRET_ACCESS_KEY", e.secretAccessKey) ?? q.read("AWS_SECRET_ACCESS_KEY"), s = q.read("STORAGE_CDN_URL", e.cdnBaseUrl);
2016
- return Re({
2015
+ let r = K.read("S3_REGION", e.region) ?? K.read("AWS_REGION"), i = K.read("S3_ENDPOINT", e.endpoint) ?? K.read("MINIO_ENDPOINT"), a = K.read("S3_ACCESS_KEY_ID", e.accessKeyId) ?? K.read("AWS_ACCESS_KEY_ID"), o = K.read("S3_SECRET_ACCESS_KEY", e.secretAccessKey) ?? K.read("AWS_SECRET_ACCESS_KEY"), s = K.read("STORAGE_CDN_URL", e.cdnBaseUrl);
2016
+ return ze({
2017
2017
  bucket: n,
2018
2018
  name: t,
2019
2019
  ...r ? { region: r } : {},
@@ -2022,13 +2022,13 @@ var an = (e) => {
2022
2022
  ...o ? { secretAccessKey: o } : {},
2023
2023
  ...s ? { cdnBaseUrl: s } : {},
2024
2024
  ...e.publicAcl === void 0 ? {} : { publicAcl: e.publicAcl },
2025
- ...t === "minio" || q.read("S3_FORCE_PATH_STYLE") === "1" ? { forcePathStyle: !0 } : {}
2025
+ ...t === "minio" || K.read("S3_FORCE_PATH_STYLE") === "1" ? { forcePathStyle: !0 } : {}
2026
2026
  });
2027
2027
  }
2028
2028
  case "azure": {
2029
- let t = q.read("AZURE_STORAGE_ACCOUNT", e.accountName), r = q.read("AZURE_STORAGE_KEY", e.accountKey), i = q.read("AZURE_STORAGE_CONNECTION_STRING", e.connectionString), a = q.read("AZURE_STORAGE_ENDPOINT", e.endpoint), o = q.read("STORAGE_CDN_URL", e.cdnBaseUrl);
2030
- return Ve({
2031
- container: q.read("AZURE_STORAGE_CONTAINER", e.bucket) ?? n,
2029
+ let t = K.read("AZURE_STORAGE_ACCOUNT", e.accountName), r = K.read("AZURE_STORAGE_KEY", e.accountKey), i = K.read("AZURE_STORAGE_CONNECTION_STRING", e.connectionString), a = K.read("AZURE_STORAGE_ENDPOINT", e.endpoint), o = K.read("STORAGE_CDN_URL", e.cdnBaseUrl);
2030
+ return He({
2031
+ container: K.read("AZURE_STORAGE_CONTAINER", e.bucket) ?? n,
2032
2032
  ...t ? { accountName: t } : {},
2033
2033
  ...r ? { accountKey: r } : {},
2034
2034
  ...i ? { connectionString: i } : {},
@@ -2036,13 +2036,13 @@ var an = (e) => {
2036
2036
  ...o ? { cdnBaseUrl: o } : {}
2037
2037
  });
2038
2038
  }
2039
- case "database": return Be();
2040
- case "filesystem": return Le({ root: q.read("STORAGE_ROOT", e.root) ?? ".voltro-storage" });
2041
- default: return Ie(e.name ?? "default");
2039
+ case "database": return Ve();
2040
+ case "filesystem": return Re({ root: K.read("STORAGE_ROOT", e.root) ?? ".voltro-storage" });
2041
+ default: return Le(e.name ?? "default");
2042
2042
  }
2043
2043
  }, pn = (e) => {
2044
2044
  if (e !== void 0) return e;
2045
- let t = q.read("STORAGE_ALLOWED_ORIGINS");
2045
+ let t = K.read("STORAGE_ALLOWED_ORIGINS");
2046
2046
  return t ? t.trim() === "*" ? "*" : t.split(",").map((e) => e.trim()).filter(Boolean) : [];
2047
2047
  }, mn = (e, t) => {
2048
2048
  if (!e || t !== "*" && !t.includes(e)) return {};
@@ -2084,9 +2084,9 @@ var an = (e) => {
2084
2084
  status: 403
2085
2085
  }), _n = (e, t, n) => {
2086
2086
  let r = n.request.subject;
2087
- return (r.scopes ?? []).includes("admin:full") ? b.void : e.head(t, { tenantId: r.tenantId ?? null }).pipe(b.catchAll(() => b.fail(gn())), b.flatMap((e) => {
2087
+ return (r.scopes ?? []).includes("admin:full") ? y.void : e.head(t, { tenantId: r.tenantId ?? null }).pipe(y.catchAll(() => y.fail(gn())), y.flatMap((e) => {
2088
2088
  let t = e?.ownerId;
2089
- return t != null && t === r.id ? b.void : b.fail(gn());
2089
+ return t != null && t === r.id ? y.void : y.fail(gn());
2090
2090
  }));
2091
2091
  }, vn = () => new t({
2092
2092
  provider: "storage",
@@ -2095,7 +2095,7 @@ var an = (e) => {
2095
2095
  status: 401
2096
2096
  }), $ = (e, t) => {
2097
2097
  let n = e.request.subject.id ?? null, r = e.request.subject.tenantId ?? null;
2098
- return n === null && !t ? b.fail(vn()) : b.succeed({
2098
+ return n === null && !t ? y.fail(vn()) : y.succeed({
2099
2099
  id: n,
2100
2100
  tenantId: r
2101
2101
  });
@@ -2108,37 +2108,41 @@ var an = (e) => {
2108
2108
  createdAt: e.createdAt.toISOString(),
2109
2109
  expiresAt: e.expiresAt ? e.expiresAt.toISOString() : null,
2110
2110
  createdBy: e.createdBy
2111
- }), xn = "@voltro/plugin-storage", Sn = (i = {}) => {
2112
- let y = E({
2111
+ }), xn = "@voltro/plugin-storage", Sn = (e = {}) => T({
2112
+ base: xn,
2113
+ alias: e.alias,
2114
+ instance: e.name
2115
+ }), Cn = (i = {}) => {
2116
+ let v = T({
2113
2117
  base: xn,
2114
2118
  alias: i.alias,
2115
2119
  instance: i.name
2116
- }), x = y === xn ? "/_voltro/storage" : `/_voltro/storage/i/${Buffer.from(y).toString("hex")}`, S = fn(i);
2117
- ln(S);
2118
- let C = q.read("S3_BUCKET", i.bucket) ?? q.read("STORAGE_BUCKET") ?? "voltro", D = q.read("VOLTRO_PUBLIC_URL", i.publicBaseUrl), se = pn(i.allowedOrigins), O = i.limits?.maxBytes, k = i.anonymousUploads === !0, A = 5242880, j = 21600, M = i.refStore === void 0 || i.refStore === "memory", N = i.grantStore === void 0 || i.grantStore === "memory", P = { current: M ? Pt() : i.refStore }, F = { current: N ? zt() : i.grantStore }, ce = {
2120
+ }), b = v === xn ? "/_voltro/storage" : `/_voltro/storage/i/${Buffer.from(v).toString("hex")}`, x = fn(i);
2121
+ ln(x);
2122
+ let S = K.read("S3_BUCKET", i.bucket) ?? K.read("STORAGE_BUCKET") ?? "voltro", E = K.read("VOLTRO_PUBLIC_URL", i.publicBaseUrl), ce = pn(i.allowedOrigins), D = i.limits?.maxBytes, O = i.anonymousUploads === !0, k = 5242880, A = 21600, j = i.refStore === void 0 || i.refStore === "memory", M = i.grantStore === void 0 || i.grantStore === "memory", N = { current: j ? Pt() : i.refStore }, P = { current: M ? zt() : i.grantStore }, le = {
2123
+ insert: (e) => N.current.insert(e),
2124
+ getById: (e) => N.current.getById(e),
2125
+ delete: (e) => N.current.delete(e),
2126
+ statistics: () => N.current.statistics(),
2127
+ listRecent: (e) => N.current.listRecent(e),
2128
+ countByKey: (e, t) => N.current.countByKey(e, t),
2129
+ usageByTenant: (e) => N.current.usageByTenant(e),
2130
+ consumeUsage: (e, t, n) => N.current.consumeUsage(e, t, n),
2131
+ releaseUsage: (e, t) => N.current.releaseUsage(e, t),
2132
+ listByDerivedFrom: (e) => N.current.listByDerivedFrom(e),
2133
+ listRefs: (e) => N.current.listRefs(e)
2134
+ }, F = {
2119
2135
  insert: (e) => P.current.insert(e),
2120
- getById: (e) => P.current.getById(e),
2121
2136
  delete: (e) => P.current.delete(e),
2122
- statistics: () => P.current.statistics(),
2123
- listRecent: (e) => P.current.listRecent(e),
2124
- countByKey: (e, t) => P.current.countByKey(e, t),
2125
- usageByTenant: (e) => P.current.usageByTenant(e),
2126
- consumeUsage: (e, t, n) => P.current.consumeUsage(e, t, n),
2127
- releaseUsage: (e, t) => P.current.releaseUsage(e, t),
2128
- listByDerivedFrom: (e) => P.current.listByDerivedFrom(e),
2129
- listRefs: (e) => P.current.listRefs(e)
2137
+ getById: (e) => P.current.getById(e),
2138
+ listByRef: (e) => P.current.listByRef(e),
2139
+ deleteByRef: (e) => P.current.deleteByRef(e)
2130
2140
  }, I = {
2131
- insert: (e) => F.current.insert(e),
2132
- delete: (e) => F.current.delete(e),
2133
- getById: (e) => F.current.getById(e),
2134
- listByRef: (e) => F.current.listByRef(e),
2135
- deleteByRef: (e) => F.current.deleteByRef(e)
2136
- }, L = {
2137
- httpPath: x,
2138
- provider: S,
2139
- refStore: ce,
2140
- grantStore: I,
2141
- bucket: C,
2141
+ httpPath: b,
2142
+ provider: x,
2143
+ refStore: le,
2144
+ grantStore: F,
2145
+ bucket: S,
2142
2146
  ...i.tenantPrefix === void 0 ? {} : { tenantPrefix: i.tenantPrefix },
2143
2147
  ...i.attempts === void 0 ? {} : { attempts: i.attempts },
2144
2148
  ...i.urlExpiresInSec === void 0 ? {} : { urlExpiresInSec: i.urlExpiresInSec },
@@ -2148,10 +2152,10 @@ var an = (e) => {
2148
2152
  ...i.videoProbe === void 0 ? {} : { videoProbe: i.videoProbe },
2149
2153
  ...i.transcode === void 0 ? {} : { transcode: i.transcode },
2150
2154
  ...i.autoTranscode === void 0 ? {} : { autoTranscode: i.autoTranscode },
2151
- ...D ? { publicBaseUrl: D } : {},
2155
+ ...E ? { publicBaseUrl: E } : {},
2152
2156
  ...i.normalizeImages === void 0 ? {} : { normalizeImages: i.normalizeImages },
2153
2157
  ...i.quota === void 0 ? {} : { quota: i.quota }
2154
- }, le = Gt(L), R = Wt(L), z = `${x}/`, B = (e) => b.runPromise(e.pipe(b.catchAll(() => b.succeed(null)))), de = (e, t) => {
2158
+ }, ue = Gt(I), L = Wt(I), R = `${b}/`, z = (e) => y.runPromise(e.pipe(y.catchAll(() => y.succeed(null)))), fe = (e, t) => {
2155
2159
  if (!e) return "invalid";
2156
2160
  let n = /^bytes=(\d*)-(\d*)$/.exec(e.trim());
2157
2161
  if (!n) return "invalid";
@@ -2172,12 +2176,12 @@ var an = (e) => {
2172
2176
  start: a,
2173
2177
  endInclusive: o
2174
2178
  };
2175
- }, V = /^(?:image\/(?!svg)|video\/|audio\/|application\/pdf(?:;|$)|text\/plain(?:;|$))/i, fe = (e) => ({
2179
+ }, B = /^(?:image\/(?!svg)|video\/|audio\/|application\/pdf(?:;|$)|text\/plain(?:;|$))/i, pe = (e) => ({
2176
2180
  "x-content-type-options": "nosniff",
2177
- "content-disposition": V.test(e) ? "inline" : "attachment"
2178
- }), pe = async (e, t, n, r) => {
2181
+ "content-disposition": B.test(e) ? "inline" : "attachment"
2182
+ }), me = async (e, t, n, r) => {
2179
2183
  if (n) {
2180
- let r = await B(R.get(e.id));
2184
+ let r = await z(L.get(e.id));
2181
2185
  if (!r) return {
2182
2186
  status: 404,
2183
2187
  body: "not found",
@@ -2189,13 +2193,13 @@ var an = (e) => {
2189
2193
  body: a,
2190
2194
  contentType: o,
2191
2195
  headers: {
2192
- ...fe(o),
2196
+ ...pe(o),
2193
2197
  "cache-control": t,
2194
2198
  "accept-ranges": "none"
2195
2199
  }
2196
2200
  };
2197
2201
  }
2198
- let i = r === void 0 ? "invalid" : de(r, e.size);
2202
+ let i = r === void 0 ? "invalid" : fe(r, e.size);
2199
2203
  if (i === "unsatisfiable") return {
2200
2204
  status: 416,
2201
2205
  body: "range not satisfiable",
@@ -2206,13 +2210,13 @@ var an = (e) => {
2206
2210
  }
2207
2211
  };
2208
2212
  if (i !== "invalid") {
2209
- let n = await B(R.getRange(e.id, i));
2213
+ let n = await z(L.getRange(e.id, i));
2210
2214
  return n ? {
2211
2215
  status: 206,
2212
2216
  body: n.bytes,
2213
2217
  contentType: e.contentType,
2214
2218
  headers: {
2215
- ...fe(e.contentType),
2219
+ ...pe(e.contentType),
2216
2220
  "cache-control": t,
2217
2221
  "accept-ranges": "bytes",
2218
2222
  "content-range": `bytes ${i.start}-${i.endInclusive}/${n.totalSize}`
@@ -2223,47 +2227,47 @@ var an = (e) => {
2223
2227
  contentType: "text/plain"
2224
2228
  };
2225
2229
  }
2226
- let a = await B(R.getStream(e.id));
2230
+ let a = await z(L.getStream(e.id));
2227
2231
  return a ? {
2228
2232
  status: 200,
2229
2233
  contentType: e.contentType,
2230
2234
  headers: {
2231
- ...fe(e.contentType),
2235
+ ...pe(e.contentType),
2232
2236
  "cache-control": t,
2233
2237
  "accept-ranges": "bytes"
2234
2238
  },
2235
2239
  byteStream: {
2236
2240
  contentLength: e.size,
2237
- stream: () => T.toReadableStream(a.stream)
2241
+ stream: () => w.toReadableStream(a.stream)
2238
2242
  }
2239
2243
  } : {
2240
2244
  status: 404,
2241
2245
  body: "not found",
2242
2246
  contentType: "text/plain"
2243
2247
  };
2244
- }, me = async (e) => {
2245
- let t = e.path.startsWith(z) ? e.path.slice(z.length).split("/")[0] ?? "" : "";
2248
+ }, he = async (e) => {
2249
+ let t = e.path.startsWith(R) ? e.path.slice(R.length).split("/")[0] ?? "" : "";
2246
2250
  if (!t) return {
2247
2251
  status: 404,
2248
2252
  body: "not found",
2249
2253
  contentType: "text/plain"
2250
2254
  };
2251
- let n = await B(R.head(t));
2255
+ let n = await z(L.head(t));
2252
2256
  if (!n) return {
2253
2257
  status: 404,
2254
2258
  body: "not found",
2255
2259
  contentType: "text/plain"
2256
2260
  };
2257
- let r = Ue(e.query), i = e.headers.range;
2261
+ let r = We(e.query), i = e.headers.range;
2258
2262
  if (n.visibility === "public") {
2259
- let e = S.publicUrl?.(n.key) ?? null;
2263
+ let e = x.publicUrl?.(n.key) ?? null;
2260
2264
  return e && !r ? {
2261
2265
  status: 302,
2262
2266
  headers: {
2263
2267
  location: e,
2264
2268
  "cache-control": "public, max-age=300"
2265
2269
  }
2266
- } : pe(n, "public, max-age=31536000, immutable", r, i);
2270
+ } : me(n, "public, max-age=31536000, immutable", r, i);
2267
2271
  }
2268
2272
  let a = !1, o = e.query ? new URLSearchParams(e.query).get("t") : null;
2269
2273
  if (o) {
@@ -2271,16 +2275,16 @@ var an = (e) => {
2271
2275
  a = !!e && e.refId === t;
2272
2276
  }
2273
2277
  if (!a) {
2274
- let t = ie(e.headers.cookie, sn), r = t ? oe(t, ae()) : null;
2275
- r && (a = await B(R.checkAccess(n, r)) === !0);
2278
+ let t = ae(e.headers.cookie, sn), r = t ? se(t, oe()) : null;
2279
+ r && (a = await z(L.checkAccess(n, r)) === !0);
2276
2280
  }
2277
2281
  if (!a) return {
2278
2282
  status: 403,
2279
2283
  body: "forbidden",
2280
2284
  contentType: "text/plain"
2281
2285
  };
2282
- if (S.presigns && !r) {
2283
- let e = await B(S.getUrl(n.key, 300));
2286
+ if (x.presigns && !r) {
2287
+ let e = await z(x.getUrl(n.key, 300));
2284
2288
  if (e && /^https?:/.test(e)) return {
2285
2289
  status: 302,
2286
2290
  headers: {
@@ -2289,12 +2293,12 @@ var an = (e) => {
2289
2293
  }
2290
2294
  };
2291
2295
  }
2292
- return pe(n, "private, no-store", r, i);
2293
- }, he = {
2296
+ return me(n, "private, no-store", r, i);
2297
+ }, ge = {
2294
2298
  method: "GET",
2295
- path: x,
2299
+ path: b,
2296
2300
  handle: async (e) => {
2297
- let t = await me(e), n = mn(e.headers.origin, se);
2301
+ let t = await he(e), n = mn(e.headers.origin, ce);
2298
2302
  return Object.keys(n).length === 0 ? t : {
2299
2303
  ...t,
2300
2304
  headers: {
@@ -2303,12 +2307,12 @@ var an = (e) => {
2303
2307
  }
2304
2308
  };
2305
2309
  }
2306
- }, ge = {
2310
+ }, _e = {
2307
2311
  method: "*",
2308
- path: `${x}/upload`,
2312
+ path: `${b}/upload`,
2309
2313
  originGuard: "exempt",
2310
2314
  handle: async (e) => {
2311
- let t = mn(e.headers.origin, se);
2315
+ let t = mn(e.headers.origin, ce);
2312
2316
  if (e.method === "OPTIONS") return {
2313
2317
  status: 204,
2314
2318
  headers: t
@@ -2320,7 +2324,7 @@ var an = (e) => {
2320
2324
  headers: t
2321
2325
  };
2322
2326
  let n = e.query ? new URLSearchParams(e.query).get("ticket") : null, r = n ? pt(n) : null;
2323
- if (!r || r.instance !== y) return {
2327
+ if (!r || r.instance !== v) return {
2324
2328
  status: 401,
2325
2329
  body: "invalid or expired upload ticket",
2326
2330
  contentType: "text/plain",
@@ -2338,7 +2342,7 @@ var an = (e) => {
2338
2342
  contentType: "text/plain",
2339
2343
  headers: t
2340
2344
  };
2341
- let i = await b.runPromise(R.put({
2345
+ let i = await y.runPromise(L.put({
2342
2346
  bytes: e.rawBody,
2343
2347
  contentType: r.ct,
2344
2348
  tenantId: r.tenant,
@@ -2349,21 +2353,21 @@ var an = (e) => {
2349
2353
  ...r.tags === void 0 ? {} : { tags: r.tags },
2350
2354
  ...r.alt === void 0 ? {} : { alt: r.alt },
2351
2355
  ...r.caption === void 0 ? {} : { caption: r.caption }
2352
- }).pipe(b.flatMap((e) => R.getUrl(e.id).pipe(b.map((t) => ({
2356
+ }).pipe(y.flatMap((e) => L.getUrl(e.id).pipe(y.map((t) => ({
2353
2357
  kind: "ok",
2354
2358
  ref: e,
2355
2359
  url: t
2356
- })))), b.catchTags({
2357
- StorageRejected: (e) => b.succeed({
2360
+ })))), y.catchTags({
2361
+ StorageRejected: (e) => y.succeed({
2358
2362
  kind: "rejected",
2359
2363
  status: e.reason === "too-large" ? 413 : 415,
2360
2364
  detail: e.detail
2361
2365
  }),
2362
- StorageScanRejected: (e) => b.succeed({
2366
+ StorageScanRejected: (e) => y.succeed({
2363
2367
  kind: "scan",
2364
2368
  threat: e.threat
2365
2369
  }),
2366
- StorageError: (e) => b.succeed({
2370
+ StorageError: (e) => y.succeed({
2367
2371
  kind: "error",
2368
2372
  message: e.message
2369
2373
  })
@@ -2395,28 +2399,28 @@ var an = (e) => {
2395
2399
  headers: t
2396
2400
  };
2397
2401
  }
2398
- }, _e = {
2402
+ }, ve = {
2399
2403
  method: "*",
2400
- path: `${x}/upload/resumable`,
2404
+ path: `${b}/upload/resumable`,
2401
2405
  originGuard: "exempt",
2402
2406
  handle: async (e) => {
2403
- let t = mn(e.headers.origin, se);
2407
+ let t = mn(e.headers.origin, ce);
2404
2408
  if (e.method === "OPTIONS") return {
2405
2409
  status: 204,
2406
2410
  headers: t
2407
2411
  };
2408
2412
  let n = new URLSearchParams(e.query || ""), r = _t(n.get("token") ?? "");
2409
- if (!r || r.instance !== y) return {
2413
+ if (!r || r.instance !== v) return {
2410
2414
  status: 401,
2411
2415
  body: "invalid or expired resumable token",
2412
2416
  contentType: "text/plain",
2413
2417
  headers: t
2414
2418
  };
2415
2419
  if (e.method === "GET" || e.method === "HEAD") {
2416
- let e = await b.runPromise(R.resumableStatus({
2420
+ let e = await y.runPromise(L.resumableStatus({
2417
2421
  uploadId: r.id,
2418
2422
  tenantId: r.tenant
2419
- }).pipe(b.match({
2423
+ }).pipe(y.match({
2420
2424
  onFailure: (e) => ({ error: e.message }),
2421
2425
  onSuccess: (e) => e
2422
2426
  })));
@@ -2454,12 +2458,12 @@ var an = (e) => {
2454
2458
  contentType: "text/plain",
2455
2459
  headers: t
2456
2460
  };
2457
- let a = n.get("final") === "1", o = await b.runPromise(R.putResumableChunk({
2461
+ let a = n.get("final") === "1", o = await y.runPromise(L.putResumableChunk({
2458
2462
  uploadId: r.id,
2459
2463
  tenantId: r.tenant,
2460
2464
  index: i,
2461
2465
  bytes: e.rawBody
2462
- }).pipe(b.flatMap(() => a ? R.finalizeResumable({
2466
+ }).pipe(y.flatMap(() => a ? L.finalizeResumable({
2463
2467
  uploadId: r.id,
2464
2468
  count: i + 1,
2465
2469
  contentType: r.ct,
@@ -2470,21 +2474,21 @@ var an = (e) => {
2470
2474
  ...r.tags === void 0 ? {} : { tags: r.tags },
2471
2475
  ...r.alt === void 0 ? {} : { alt: r.alt },
2472
2476
  ...r.caption === void 0 ? {} : { caption: r.caption }
2473
- }).pipe(b.flatMap((e) => R.getUrl(e.id).pipe(b.map((t) => ({
2477
+ }).pipe(y.flatMap((e) => L.getUrl(e.id).pipe(y.map((t) => ({
2474
2478
  kind: "done",
2475
2479
  ref: e,
2476
2480
  url: t
2477
- }))))) : b.succeed({ kind: "chunk" })), b.catchTags({
2478
- StorageRejected: (e) => b.succeed({
2481
+ }))))) : y.succeed({ kind: "chunk" })), y.catchTags({
2482
+ StorageRejected: (e) => y.succeed({
2479
2483
  kind: "rejected",
2480
2484
  status: e.reason === "too-large" ? 413 : 415,
2481
2485
  detail: e.detail
2482
2486
  }),
2483
- StorageScanRejected: (e) => b.succeed({
2487
+ StorageScanRejected: (e) => y.succeed({
2484
2488
  kind: "scan",
2485
2489
  threat: e.threat
2486
2490
  }),
2487
- StorageError: (e) => b.succeed({
2491
+ StorageError: (e) => y.succeed({
2488
2492
  kind: "error",
2489
2493
  message: e.message
2490
2494
  })
@@ -2522,41 +2526,41 @@ var an = (e) => {
2522
2526
  headers: t
2523
2527
  };
2524
2528
  }
2525
- }, H = (e) => ({
2529
+ }, V = (e) => ({
2526
2530
  kind: "json",
2527
2531
  data: e
2528
- }), U = (e, t) => ({
2532
+ }), H = (e, t) => ({
2529
2533
  kind: "json",
2530
2534
  status: e,
2531
2535
  data: { error: t }
2532
- }), ve = (e, t) => {
2536
+ }), ye = (e, t) => {
2533
2537
  try {
2534
2538
  return new URL(e, "http://localhost").searchParams.get(t);
2535
2539
  } catch {
2536
2540
  return null;
2537
2541
  }
2538
- }, ye = [
2542
+ }, be = [
2539
2543
  {
2540
2544
  method: "POST",
2541
2545
  path: "/upload-ticket",
2542
2546
  description: "Authorize a binary upload with explicit tenant and owner attribution",
2543
- handler: (e) => b.gen(function* () {
2544
- let n = w.String.pipe(w.filter((e) => e.trim().length > 0)), r = yield* w.decodeUnknown(w.parseJson(w.Struct({
2545
- tenantId: w.NullOr(n),
2546
- ownerId: w.NullOr(n),
2547
- key: n.pipe(w.maxLength(1024)),
2548
- contentType: n.pipe(w.maxLength(255), w.filter((e) => !/[\r\n]/.test(e))),
2549
- size: w.Number.pipe(w.int(), w.positive(), w.filter(Number.isSafeInteger)),
2550
- visibility: w.optional(w.Literal("public", "private"))
2551
- })))(e.body).pipe(b.mapError(() => new t({
2547
+ handler: (e) => y.gen(function* () {
2548
+ let n = C.String.pipe(C.filter((e) => e.trim().length > 0)), r = yield* C.decodeUnknown(C.parseJson(C.Struct({
2549
+ tenantId: C.NullOr(n),
2550
+ ownerId: C.NullOr(n),
2551
+ key: n.pipe(C.maxLength(1024)),
2552
+ contentType: n.pipe(C.maxLength(255), C.filter((e) => !/[\r\n]/.test(e))),
2553
+ size: C.Number.pipe(C.int(), C.positive(), C.filter(Number.isSafeInteger)),
2554
+ visibility: C.optional(C.Literal("public", "private"))
2555
+ })))(e.body).pipe(y.mapError(() => new t({
2552
2556
  provider: "inspect",
2553
2557
  message: "Provide explicit tenantId and ownerId (or null), key, contentType and a positive file size",
2554
2558
  transient: !1,
2555
2559
  status: 400
2556
2560
  })));
2557
- if (O !== void 0 && r.size > O) return U(413, "File exceeds the configured upload limit");
2561
+ if (D !== void 0 && r.size > D) return H(413, "File exceeds the configured upload limit");
2558
2562
  let i = ft({
2559
- instance: y,
2563
+ instance: v,
2560
2564
  sub: r.ownerId,
2561
2565
  tenant: r.tenantId,
2562
2566
  ct: r.contentType,
@@ -2564,40 +2568,40 @@ var an = (e) => {
2564
2568
  vis: r.visibility ?? "private",
2565
2569
  max: r.size
2566
2570
  }, 300);
2567
- return H({
2568
- uploadPath: `${x}/upload?ticket=${encodeURIComponent(i)}`,
2571
+ return V({
2572
+ uploadPath: `${b}/upload?ticket=${encodeURIComponent(i)}`,
2569
2573
  expiresInSec: 300,
2570
2574
  maxBytes: r.size
2571
2575
  });
2572
- }).pipe(b.catchAll((e) => b.succeed(U(e.status ?? 500, e.message))))
2576
+ }).pipe(y.catchAll((e) => y.succeed(H(e.status ?? 500, e.message))))
2573
2577
  },
2574
2578
  {
2575
2579
  method: "GET",
2576
2580
  path: "/download",
2577
2581
  description: "Stream a stored file as an attachment for authorized inspect readers",
2578
- handler: (e) => b.gen(function* () {
2579
- let t = ve(e.url, "refId");
2580
- if (!t?.trim()) return U(400, "A non-empty refId is required");
2581
- let { ref: n, stream: r } = yield* R.getStream(t), i = n.key.split("/").pop() || n.id, a = encodeURIComponent(i).replace(/[!'()*]/g, (e) => `%${e.charCodeAt(0).toString(16).toUpperCase()}`);
2582
+ handler: (e) => y.gen(function* () {
2583
+ let t = ye(e.url, "refId");
2584
+ if (!t?.trim()) return H(400, "A non-empty refId is required");
2585
+ let { ref: n, stream: r } = yield* L.getStream(t), i = n.key.split("/").pop() || n.id, a = encodeURIComponent(i).replace(/[!'()*]/g, (e) => `%${e.charCodeAt(0).toString(16).toUpperCase()}`);
2582
2586
  return {
2583
2587
  kind: "bytes",
2584
2588
  contentType: n.contentType,
2585
2589
  byteStream: {
2586
- stream: () => T.toReadableStream(r),
2590
+ stream: () => w.toReadableStream(r),
2587
2591
  contentLength: n.size,
2588
2592
  contentDisposition: `attachment; filename="download"; filename*=UTF-8''${a}`
2589
2593
  },
2590
2594
  headers: { "cache-control": "no-store" }
2591
2595
  };
2592
- }).pipe(b.catchAll((e) => b.succeed(U(e.status ?? 500, e.message))))
2596
+ }).pipe(y.catchAll((e) => y.succeed(H(e.status ?? 500, e.message))))
2593
2597
  },
2594
2598
  {
2595
2599
  method: "GET",
2596
2600
  path: "/refs",
2597
2601
  description: "Searchable storage refs, newest first, paginated",
2598
2602
  handler: (e) => {
2599
- let t = Number(ve(e.url, "offset") ?? 0), n = Number.isSafeInteger(t) && t >= 0 ? t : 0, r = (ve(e.url, "search") ?? "").trim().slice(0, 200);
2600
- return ce.listRefs({
2603
+ let t = Number(ye(e.url, "offset") ?? 0), n = Number.isSafeInteger(t) && t >= 0 ? t : 0, r = (ye(e.url, "search") ?? "").trim().slice(0, 200);
2604
+ return le.listRefs({
2601
2605
  tenantId: void 0,
2602
2606
  ownerId: void 0,
2603
2607
  folder: void 0,
@@ -2606,121 +2610,121 @@ var an = (e) => {
2606
2610
  search: r,
2607
2611
  limit: 51,
2608
2612
  offset: n
2609
- }).pipe(b.map((e) => H({
2613
+ }).pipe(y.map((e) => V({
2610
2614
  refs: e.slice(0, 50).map(hn),
2611
2615
  page: {
2612
2616
  search: r,
2613
2617
  offset: n,
2614
2618
  nextOffset: e.length > 50 ? n + 50 : null
2615
2619
  }
2616
- })), b.catchAll((e) => b.succeed(U(500, e.message))));
2620
+ })), y.catchAll((e) => y.succeed(H(500, e.message))));
2617
2621
  }
2618
2622
  },
2619
2623
  {
2620
2624
  method: "GET",
2621
2625
  path: "/stats",
2622
2626
  description: "Object count + total bytes per tenant + visibility split",
2623
- handler: () => ce.statistics().pipe(b.map((e) => H({
2624
- provider: S.name,
2625
- bucket: C,
2627
+ handler: () => le.statistics().pipe(y.map((e) => V({
2628
+ provider: x.name,
2629
+ bucket: S,
2626
2630
  ...e
2627
- })), b.catchAll((e) => b.succeed(U(500, e.message))))
2631
+ })), y.catchAll((e) => y.succeed(H(500, e.message))))
2628
2632
  },
2629
2633
  {
2630
2634
  method: "GET",
2631
2635
  path: "/grants",
2632
2636
  description: "Grants for a ref (?refId=…)",
2633
2637
  handler: (e) => {
2634
- let t = ve(e.url, "refId");
2635
- return t ? I.listByRef(t).pipe(b.map((e) => H({ grants: e.map(bn) })), b.catchAll((e) => b.succeed(U(500, e.message)))) : b.succeed(U(400, "refId query param required"));
2638
+ let t = ye(e.url, "refId");
2639
+ return t ? F.listByRef(t).pipe(y.map((e) => V({ grants: e.map(bn) })), y.catchAll((e) => y.succeed(H(500, e.message)))) : y.succeed(H(400, "refId query param required"));
2636
2640
  }
2637
2641
  },
2638
2642
  {
2639
2643
  method: "POST",
2640
2644
  path: "/share",
2641
2645
  description: "Grant a principal access to a ref",
2642
- handler: (e) => b.gen(function* () {
2643
- let n = yield* w.decodeUnknown(w.parseJson(w.Struct({
2644
- refId: w.String.pipe(w.filter((e) => e.trim().length > 0)),
2645
- principalType: w.Literal("user", "group", "apiKey"),
2646
- principalId: w.String.pipe(w.filter((e) => e.trim().length > 0)),
2647
- permission: w.optional(w.Literal("read", "write")),
2648
- expiresInDays: w.optional(w.Number.pipe(w.finite(), w.positive()))
2649
- })))(e.body).pipe(b.mapError(() => new t({
2646
+ handler: (e) => y.gen(function* () {
2647
+ let n = yield* C.decodeUnknown(C.parseJson(C.Struct({
2648
+ refId: C.String.pipe(C.filter((e) => e.trim().length > 0)),
2649
+ principalType: C.Literal("user", "group", "apiKey"),
2650
+ principalId: C.String.pipe(C.filter((e) => e.trim().length > 0)),
2651
+ permission: C.optional(C.Literal("read", "write")),
2652
+ expiresInDays: C.optional(C.Number.pipe(C.finite(), C.positive()))
2653
+ })))(e.body).pipe(y.mapError(() => new t({
2650
2654
  provider: "inspect",
2651
2655
  message: "Invalid share input: provide refId, principalType, principalId, read/write permission and a positive finite expiry if set",
2652
2656
  transient: !1,
2653
2657
  status: 400
2654
2658
  }))), r = n.expiresInDays === void 0 ? null : new Date(Date.now() + n.expiresInDays * 864e5);
2655
- if (r !== null && !Number.isFinite(r.getTime())) return U(400, "Expiry exceeds the supported date range");
2656
- let i = yield* R.grant({
2659
+ if (r !== null && !Number.isFinite(r.getTime())) return H(400, "Expiry exceeds the supported date range");
2660
+ let i = yield* L.grant({
2657
2661
  refId: n.refId,
2658
2662
  principalType: n.principalType,
2659
2663
  principalId: n.principalId,
2660
2664
  ...n.permission ? { permission: n.permission } : {},
2661
2665
  expiresAt: r
2662
2666
  });
2663
- return H({ grant: bn(i) });
2664
- }).pipe(b.catchAll((e) => b.succeed(U(e.status ?? 500, e.message ?? "share failed"))))
2667
+ return V({ grant: bn(i) });
2668
+ }).pipe(y.catchAll((e) => y.succeed(H(e.status ?? 500, e.message ?? "share failed"))))
2665
2669
  },
2666
2670
  {
2667
2671
  method: "POST",
2668
2672
  path: "/delete",
2669
2673
  description: "Delete an object reference and its grants; release unreferenced bytes",
2670
- handler: (e) => b.gen(function* () {
2671
- let n = yield* w.decodeUnknown(w.parseJson(w.Struct({ refId: w.String.pipe(w.filter((e) => e.trim().length > 0)) })))(e.body).pipe(b.mapError(() => new t({
2674
+ handler: (e) => y.gen(function* () {
2675
+ let n = yield* C.decodeUnknown(C.parseJson(C.Struct({ refId: C.String.pipe(C.filter((e) => e.trim().length > 0)) })))(e.body).pipe(y.mapError(() => new t({
2672
2676
  provider: "inspect",
2673
2677
  message: "A non-empty refId is required",
2674
2678
  transient: !1,
2675
2679
  status: 400
2676
2680
  })));
2677
- return yield* R.delete(n.refId), H({ ok: !0 });
2678
- }).pipe(b.catchAll((e) => b.succeed(U(e.status ?? 500, e.message))))
2681
+ return yield* L.delete(n.refId), V({ ok: !0 });
2682
+ }).pipe(y.catchAll((e) => y.succeed(H(e.status ?? 500, e.message))))
2679
2683
  },
2680
2684
  {
2681
2685
  method: "POST",
2682
2686
  path: "/revoke",
2683
2687
  description: "Revoke a grant by id",
2684
- handler: (e) => b.gen(function* () {
2685
- let n = yield* w.decodeUnknown(w.parseJson(w.Struct({ grantId: w.String.pipe(w.filter((e) => e.trim().length > 0)) })))(e.body).pipe(b.mapError(() => new t({
2688
+ handler: (e) => y.gen(function* () {
2689
+ let n = yield* C.decodeUnknown(C.parseJson(C.Struct({ grantId: C.String.pipe(C.filter((e) => e.trim().length > 0)) })))(e.body).pipe(y.mapError(() => new t({
2686
2690
  provider: "inspect",
2687
2691
  message: "A non-empty grantId is required",
2688
2692
  transient: !1,
2689
2693
  status: 400
2690
2694
  })));
2691
- return yield* R.revoke(n.grantId), H({ ok: !0 });
2692
- }).pipe(b.catchAll((e) => b.succeed(U(e.status ?? 500, e.message ?? "revoke failed"))))
2695
+ return yield* L.revoke(n.grantId), V({ ok: !0 });
2696
+ }).pipe(y.catchAll((e) => y.succeed(H(e.status ?? 500, e.message ?? "revoke failed"))))
2693
2697
  }
2694
- ], be = [
2698
+ ], xe = [
2695
2699
  {
2696
2700
  ...h,
2697
2701
  execute: (e, t) => {
2698
2702
  let n = e;
2699
- return R.mintUrl(n.id, t.request.subject, {
2703
+ return L.mintUrl(n.id, t.request.subject, {
2700
2704
  ...n.password === void 0 ? {} : { password: n.password },
2701
2705
  ...n.expiresInSec === void 0 ? {} : { expiresInSec: n.expiresInSec }
2702
- }).pipe(b.map((e) => ({ url: e })));
2706
+ }).pipe(y.map((e) => ({ url: e })));
2703
2707
  }
2704
2708
  },
2705
2709
  {
2706
2710
  ...ee,
2707
2711
  execute: (e, t) => {
2708
2712
  let n = e;
2709
- return R.mintUploadUrl({
2713
+ return L.mintUploadUrl({
2710
2714
  key: n.key,
2711
2715
  contentType: n.contentType,
2712
2716
  tenantId: t.request.subject.tenantId,
2713
2717
  ...n.expiresInSec === void 0 ? {} : { expiresInSec: n.expiresInSec }
2714
- }).pipe(b.map((e) => ({ url: e })));
2718
+ }).pipe(y.map((e) => ({ url: e })));
2715
2719
  }
2716
2720
  },
2717
2721
  {
2718
2722
  ...m,
2719
2723
  execute: (e, t) => {
2720
2724
  let n = e;
2721
- return $(t, k).pipe(b.map((e) => {
2725
+ return $(t, O).pipe(y.map((e) => {
2722
2726
  let t = n.expiresInSec ?? 900, r = ft({
2723
- instance: y,
2727
+ instance: v,
2724
2728
  sub: e.id,
2725
2729
  tenant: e.tenantId,
2726
2730
  ct: n.contentType,
@@ -2730,10 +2734,10 @@ var an = (e) => {
2730
2734
  ...n.tags === void 0 ? {} : { tags: n.tags },
2731
2735
  ...n.alt === void 0 ? {} : { alt: n.alt },
2732
2736
  ...n.caption === void 0 ? {} : { caption: n.caption },
2733
- ...O === void 0 ? {} : { max: O }
2737
+ ...D === void 0 ? {} : { max: D }
2734
2738
  }, t);
2735
2739
  return {
2736
- uploadUrl: `${D ? D.replace(/\/+$/, "") : ""}${x}/upload?ticket=${encodeURIComponent(r)}`,
2740
+ uploadUrl: `${E ? E.replace(/\/+$/, "") : ""}${b}/upload?ticket=${encodeURIComponent(r)}`,
2737
2741
  expiresInSec: t
2738
2742
  };
2739
2743
  }));
@@ -2743,13 +2747,13 @@ var an = (e) => {
2743
2747
  ...p,
2744
2748
  execute: (e, t) => {
2745
2749
  let n = e;
2746
- return $(t, k).pipe(b.flatMap((e) => R.mintPresignedUpload({
2750
+ return $(t, O).pipe(y.flatMap((e) => L.mintPresignedUpload({
2747
2751
  contentType: n.contentType,
2748
2752
  tenantId: e.tenantId,
2749
2753
  ...n.expiresInSec === void 0 ? {} : { expiresInSec: n.expiresInSec }
2750
- }).pipe(b.map((t) => {
2754
+ }).pipe(y.map((t) => {
2751
2755
  let r = mt({
2752
- instance: y,
2756
+ instance: v,
2753
2757
  key: t.key,
2754
2758
  sub: e.id,
2755
2759
  tenant: e.tenantId,
@@ -2759,7 +2763,7 @@ var an = (e) => {
2759
2763
  ...n.tags === void 0 ? {} : { tags: n.tags },
2760
2764
  ...n.alt === void 0 ? {} : { alt: n.alt },
2761
2765
  ...n.caption === void 0 ? {} : { caption: n.caption },
2762
- ...O === void 0 ? {} : { max: O }
2766
+ ...D === void 0 ? {} : { max: D }
2763
2767
  }, t.expiresInSec);
2764
2768
  return {
2765
2769
  uploadUrl: t.uploadUrl,
@@ -2773,17 +2777,17 @@ var an = (e) => {
2773
2777
  ...l,
2774
2778
  execute: (e, n) => {
2775
2779
  let r = ht(e.finalizeToken);
2776
- return !r || r.instance !== y ? b.fail(new t({
2780
+ return !r || r.instance !== v ? y.fail(new t({
2777
2781
  provider: "storage",
2778
2782
  message: "invalid or expired finalize token",
2779
2783
  transient: !1,
2780
2784
  status: 401
2781
- })) : yn(r.sub, n.request.subject.id) ? b.fail(new t({
2785
+ })) : yn(r.sub, n.request.subject.id) ? y.fail(new t({
2782
2786
  provider: "storage",
2783
2787
  message: "finalize token belongs to another subject",
2784
2788
  transient: !1,
2785
2789
  status: 403
2786
- })) : R.finalizeUpload({
2790
+ })) : L.finalizeUpload({
2787
2791
  key: r.key,
2788
2792
  contentType: r.ct,
2789
2793
  tenantId: r.tenant,
@@ -2793,7 +2797,7 @@ var an = (e) => {
2793
2797
  ...r.tags === void 0 ? {} : { tags: r.tags },
2794
2798
  ...r.alt === void 0 ? {} : { alt: r.alt },
2795
2799
  ...r.caption === void 0 ? {} : { caption: r.caption }
2796
- }).pipe(b.flatMap((e) => R.getUrl(e.id).pipe(b.map((t) => ({
2800
+ }).pipe(y.flatMap((e) => L.getUrl(e.id).pipe(y.map((t) => ({
2797
2801
  id: e.id,
2798
2802
  url: t,
2799
2803
  contentType: e.contentType,
@@ -2807,12 +2811,12 @@ var an = (e) => {
2807
2811
  ...s,
2808
2812
  execute: (e, t) => {
2809
2813
  let n = e;
2810
- return $(t, k).pipe(b.map((e) => {
2811
- let t = n.expiresInSec ?? j, r = ue(), i = n.chunkSize && n.chunkSize > 0 ? n.chunkSize : A;
2814
+ return $(t, O).pipe(y.map((e) => {
2815
+ let t = n.expiresInSec ?? A, r = de(), i = n.chunkSize && n.chunkSize > 0 ? n.chunkSize : k;
2812
2816
  return {
2813
2817
  uploadId: r,
2814
2818
  resumableToken: gt({
2815
- instance: y,
2819
+ instance: v,
2816
2820
  id: r,
2817
2821
  sub: e.id,
2818
2822
  tenant: e.tenantId,
@@ -2823,9 +2827,9 @@ var an = (e) => {
2823
2827
  ...n.tags === void 0 ? {} : { tags: n.tags },
2824
2828
  ...n.alt === void 0 ? {} : { alt: n.alt },
2825
2829
  ...n.caption === void 0 ? {} : { caption: n.caption },
2826
- ...O === void 0 ? {} : { max: O }
2830
+ ...D === void 0 ? {} : { max: D }
2827
2831
  }, t),
2828
- uploadUrl: `${D ? D.replace(/\/+$/, "") : ""}${x}/upload/resumable`,
2832
+ uploadUrl: `${E ? E.replace(/\/+$/, "") : ""}${b}/upload/resumable`,
2829
2833
  chunkSize: i,
2830
2834
  expiresInSec: t
2831
2835
  };
@@ -2835,15 +2839,15 @@ var an = (e) => {
2835
2839
  {
2836
2840
  ...o,
2837
2841
  execute: (e, t) => {
2838
- let n = e, r = n.expiresInSec ?? j;
2839
- return $(t, k).pipe(b.flatMap((e) => R.beginMultipartUpload({
2842
+ let n = e, r = n.expiresInSec ?? A;
2843
+ return $(t, O).pipe(y.flatMap((e) => L.beginMultipartUpload({
2840
2844
  contentType: n.contentType,
2841
2845
  tenantId: e.tenantId,
2842
2846
  visibility: n.visibility ?? "private",
2843
2847
  expiresInSec: r
2844
- }).pipe(b.map((t) => ({
2848
+ }).pipe(y.map((t) => ({
2845
2849
  multipartToken: vt({
2846
- instance: y,
2850
+ instance: v,
2847
2851
  key: t.key,
2848
2852
  uploadId: t.uploadId,
2849
2853
  sub: e.id,
@@ -2856,47 +2860,47 @@ var an = (e) => {
2856
2860
  ...n.alt === void 0 ? {} : { alt: n.alt },
2857
2861
  ...n.caption === void 0 ? {} : { caption: n.caption }
2858
2862
  }, r),
2859
- partSize: n.partSize && n.partSize >= A ? n.partSize : A,
2863
+ partSize: n.partSize && n.partSize >= k ? n.partSize : k,
2860
2864
  expiresInSec: r
2861
2865
  })))));
2862
2866
  }
2863
2867
  },
2864
2868
  {
2865
- ...te,
2869
+ ...ne,
2866
2870
  execute: (e) => {
2867
2871
  let n = e, r = yt(n.multipartToken);
2868
- return !r || r.instance !== y ? b.fail(new t({
2872
+ return !r || r.instance !== v ? y.fail(new t({
2869
2873
  provider: "storage",
2870
2874
  message: "invalid or expired multipart token",
2871
2875
  transient: !1,
2872
2876
  status: 401
2873
- })) : !Number.isInteger(n.partNumber) || n.partNumber < 1 ? b.fail(new t({
2877
+ })) : !Number.isInteger(n.partNumber) || n.partNumber < 1 ? y.fail(new t({
2874
2878
  provider: "storage",
2875
2879
  message: "partNumber must be a positive integer",
2876
2880
  transient: !1,
2877
2881
  status: 400
2878
- })) : R.signMultipartPart({
2882
+ })) : L.signMultipartPart({
2879
2883
  key: r.key,
2880
2884
  uploadId: r.uploadId,
2881
2885
  partNumber: n.partNumber
2882
- }).pipe(b.map((e) => ({ url: e })));
2886
+ }).pipe(y.map((e) => ({ url: e })));
2883
2887
  }
2884
2888
  },
2885
2889
  {
2886
2890
  ...c,
2887
2891
  execute: (e, n) => {
2888
2892
  let r = e, i = yt(r.multipartToken);
2889
- return !i || i.instance !== y ? b.fail(new t({
2893
+ return !i || i.instance !== v ? y.fail(new t({
2890
2894
  provider: "storage",
2891
2895
  message: "invalid or expired multipart token",
2892
2896
  transient: !1,
2893
2897
  status: 401
2894
- })) : yn(i.sub, n.request.subject.id) ? b.fail(new t({
2898
+ })) : yn(i.sub, n.request.subject.id) ? y.fail(new t({
2895
2899
  provider: "storage",
2896
2900
  message: "multipart token belongs to another subject",
2897
2901
  transient: !1,
2898
2902
  status: 403
2899
- })) : R.completeMultipart({
2903
+ })) : L.completeMultipart({
2900
2904
  key: i.key,
2901
2905
  uploadId: i.uploadId,
2902
2906
  parts: r.parts,
@@ -2908,7 +2912,7 @@ var an = (e) => {
2908
2912
  ...i.tags === void 0 ? {} : { tags: i.tags },
2909
2913
  ...i.alt === void 0 ? {} : { alt: i.alt },
2910
2914
  ...i.caption === void 0 ? {} : { caption: i.caption }
2911
- }).pipe(b.flatMap((e) => R.getUrl(e.id).pipe(b.map((t) => ({
2915
+ }).pipe(y.flatMap((e) => L.getUrl(e.id).pipe(y.map((t) => ({
2912
2916
  id: e.id,
2913
2917
  url: t,
2914
2918
  size: e.size
@@ -2919,22 +2923,22 @@ var an = (e) => {
2919
2923
  ...a,
2920
2924
  execute: (e) => {
2921
2925
  let n = yt(e.multipartToken);
2922
- return !n || n.instance !== y ? b.fail(new t({
2926
+ return !n || n.instance !== v ? y.fail(new t({
2923
2927
  provider: "storage",
2924
2928
  message: "invalid or expired multipart token",
2925
2929
  transient: !1,
2926
2930
  status: 401
2927
- })) : R.abortMultipart({
2931
+ })) : L.abortMultipart({
2928
2932
  key: n.key,
2929
2933
  uploadId: n.uploadId
2930
- }).pipe(b.as({ ok: !0 }));
2934
+ }).pipe(y.as({ ok: !0 }));
2931
2935
  }
2932
2936
  },
2933
2937
  {
2934
- ...v,
2938
+ ..._,
2935
2939
  execute: (e, t) => {
2936
2940
  let n = e, r = new Uint8Array(Buffer.from(n.bytesBase64, "base64"));
2937
- return $(t, k).pipe(b.flatMap((e) => R.put({
2941
+ return $(t, O).pipe(y.flatMap((e) => L.put({
2938
2942
  bytes: r,
2939
2943
  contentType: n.contentType,
2940
2944
  tenantId: e.tenantId,
@@ -2942,7 +2946,7 @@ var an = (e) => {
2942
2946
  ...n.visibility ? { visibility: n.visibility } : {},
2943
2947
  ...n.key ? { key: n.key } : {},
2944
2948
  ...n.password ? { password: n.password } : {}
2945
- })), b.flatMap((e) => R.getUrl(e.id).pipe(b.map((t) => ({
2949
+ })), y.flatMap((e) => L.getUrl(e.id).pipe(y.map((t) => ({
2946
2950
  id: e.id,
2947
2951
  url: t
2948
2952
  })))));
@@ -2952,7 +2956,7 @@ var an = (e) => {
2952
2956
  ...u,
2953
2957
  execute: (e, t) => {
2954
2958
  let n = e;
2955
- return $(t, k).pipe(b.flatMap((e) => R.ingestUrl(n.url, {
2959
+ return $(t, O).pipe(y.flatMap((e) => L.ingestUrl(n.url, {
2956
2960
  tenantId: e.tenantId,
2957
2961
  ownerId: e.id,
2958
2962
  ...n.visibility ? { visibility: n.visibility } : {},
@@ -2961,45 +2965,45 @@ var an = (e) => {
2961
2965
  ...n.alt === void 0 ? {} : { alt: n.alt },
2962
2966
  ...n.caption === void 0 ? {} : { caption: n.caption },
2963
2967
  ...n.key === void 0 ? {} : { key: n.key }
2964
- })), b.flatMap((e) => R.getUrl(e.id).pipe(b.map((t) => ({
2968
+ })), y.flatMap((e) => L.getUrl(e.id).pipe(y.map((t) => ({
2965
2969
  id: e.id,
2966
2970
  url: t
2967
2971
  })))));
2968
2972
  }
2969
2973
  },
2970
2974
  {
2971
- ..._,
2975
+ ...g,
2972
2976
  execute: (e, t) => {
2973
2977
  let n = e, r = n.expiresInDays ? new Date(Date.now() + n.expiresInDays * 864e5) : null;
2974
- return _n(R, n.refId, t).pipe(b.flatMap(() => R.grant({
2978
+ return _n(L, n.refId, t).pipe(y.flatMap(() => L.grant({
2975
2979
  refId: n.refId,
2976
2980
  principalType: n.principalType,
2977
2981
  principalId: n.principalId,
2978
2982
  ...n.permission ? { permission: n.permission } : {},
2979
2983
  expiresAt: r,
2980
2984
  createdBy: t.request.subject.id
2981
- })), b.map((e) => ({ grantId: e.id })));
2985
+ })), y.map((e) => ({ grantId: e.id })));
2982
2986
  }
2983
2987
  },
2984
2988
  {
2985
- ...g,
2989
+ ...te,
2986
2990
  execute: (e, t) => {
2987
2991
  let n = e;
2988
- return R.getGrant(n.grantId).pipe(b.flatMap((e) => e === null ? b.fail(gn()) : _n(R, e.refId, t)), b.flatMap(() => R.revoke(n.grantId)), b.map(() => ({ ok: !0 })));
2992
+ return L.getGrant(n.grantId).pipe(y.flatMap((e) => e === null ? y.fail(gn()) : _n(L, e.refId, t)), y.flatMap(() => L.revoke(n.grantId)), y.map(() => ({ ok: !0 })));
2989
2993
  }
2990
2994
  },
2991
2995
  {
2992
2996
  ...d,
2993
2997
  execute: (e, t) => {
2994
2998
  let n = e;
2995
- return _n(R, n.refId, t).pipe(b.flatMap(() => R.listGrants(n.refId)), b.map((e) => ({ grants: e.map(bn) })));
2999
+ return _n(L, n.refId, t).pipe(y.flatMap(() => L.listGrants(n.refId)), y.map((e) => ({ grants: e.map(bn) })));
2996
3000
  }
2997
3001
  },
2998
3002
  {
2999
3003
  ...f,
3000
3004
  execute: (e, t) => {
3001
3005
  let n = e;
3002
- return R.listRefs({
3006
+ return L.listRefs({
3003
3007
  tenantId: t.request.subject.tenantId,
3004
3008
  ...n.folder === void 0 ? {} : { folder: n.folder },
3005
3009
  ...n.tags === void 0 ? {} : { tags: n.tags },
@@ -3007,15 +3011,15 @@ var an = (e) => {
3007
3011
  ...n.includeDerived === void 0 ? {} : { includeDerived: n.includeDerived },
3008
3012
  ...n.limit === void 0 ? {} : { limit: n.limit },
3009
3013
  ...n.offset === void 0 ? {} : { offset: n.offset }
3010
- }).pipe(b.map((e) => ({
3014
+ }).pipe(y.map((e) => ({
3011
3015
  refs: e.refs.map(hn),
3012
3016
  nextOffset: e.nextOffset
3013
3017
  })));
3014
3018
  }
3015
3019
  }
3016
3020
  ];
3017
- return re({
3018
- name: E({
3021
+ return ie({
3022
+ name: T({
3019
3023
  base: xn,
3020
3024
  alias: i.alias,
3021
3025
  instance: i.name
@@ -3027,16 +3031,16 @@ var an = (e) => {
3027
3031
  "inspect:read",
3028
3032
  "inspect:write"
3029
3033
  ],
3030
- declaredEnv: q.declared,
3031
- services: le,
3032
- inspectEndpoints: ye,
3034
+ declaredEnv: K.declared,
3035
+ services: ue,
3036
+ inspectEndpoints: be,
3033
3037
  httpRoutes: [
3034
- he,
3035
3038
  ge,
3036
- _e
3039
+ _e,
3040
+ ve
3037
3041
  ],
3038
- routes: be,
3039
- rpcClientDescriptors: ne,
3042
+ routes: xe,
3043
+ rpcClientDescriptors: re,
3040
3044
  errorSchemas: [
3041
3045
  {
3042
3046
  schema: t,
@@ -3068,18 +3072,18 @@ var an = (e) => {
3068
3072
  }
3069
3073
  ],
3070
3074
  bindDataStore: (e) => {
3071
- M && (P.current = Rt(e)), N && (F.current = Vt(e)), S.bindDataStore?.(e);
3075
+ j && (N.current = Rt(e)), M && (P.current = Vt(e)), x.bindDataStore?.(e);
3072
3076
  },
3073
- onActivate: (e) => b.sync(() => {
3074
- let t = !!D || !!q.read("STORAGE_CDN_URL", i.cdnBaseUrl);
3075
- e.logger.info(`storage: provider=${S.name} presign=${S.presigns ? "yes" : "no"} publicUrl=${t ? "yes" : "no"} transforms=yes`, {
3076
- provider: S.name,
3077
- bucket: C,
3078
- refStore: M ? "memory" : "custom"
3079
- }), S.name === "memory" && process.env.NODE_ENV !== "test" && e.logger.warn("storage: provider=memory — uploads are IN-MEMORY and LOST on restart. Set STORAGE_PROVIDER (filesystem / s3 / r2 / azure / gcs) for anything but throwaway dev. (Empty/placeholder storage env silently falls back to memory.)"), !t && !S.presigns && e.logger.warn("storage: no VOLTRO_PUBLIC_URL / STORAGE_CDN_URL and this provider can't presign — serve URLs are RELATIVE and will not resolve cross-origin (browser <img> / server-to-server AI fetches). Set VOLTRO_PUBLIC_URL to this api's absolute base URL.");
3077
+ onActivate: (e) => y.sync(() => {
3078
+ let t = !!E || !!K.read("STORAGE_CDN_URL", i.cdnBaseUrl);
3079
+ e.logger.info(`storage: provider=${x.name} presign=${x.presigns ? "yes" : "no"} publicUrl=${t ? "yes" : "no"} transforms=yes`, {
3080
+ provider: x.name,
3081
+ bucket: S,
3082
+ refStore: j ? "memory" : "custom"
3083
+ }), x.name === "memory" && process.env.NODE_ENV !== "test" && e.logger.warn("storage: provider=memory — uploads are IN-MEMORY and LOST on restart. Set STORAGE_PROVIDER (filesystem / s3 / r2 / azure / gcs) for anything but throwaway dev. (Empty/placeholder storage env silently falls back to memory.)"), !t && !x.presigns && e.logger.warn("storage: no VOLTRO_PUBLIC_URL / STORAGE_CDN_URL and this provider can't presign — serve URLs are RELATIVE and will not resolve cross-origin (browser <img> / server-to-server AI fetches). Set VOLTRO_PUBLIC_URL to this api's absolute base URL.");
3080
3084
  }),
3081
- onDeactivate: () => b.void
3085
+ onDeactivate: () => y.void
3082
3086
  });
3083
3087
  };
3084
3088
  //#endregion
3085
- export { K as STORAGE_BLOBS_TABLE, G as STORAGE_GRANTS_TABLE, W as STORAGE_REFS_TABLE, De as STORAGE_USAGE_TABLE, e as StorageAccessDenied, t as StorageError, n as StorageRejected, r as StorageScanRejected, i as StorageService, je as _voltroStorageBlobsTable, ke as _voltroStorageGrantsTable, Oe as _voltroStorageRefsTable, Ae as _voltroStorageUsageTable, un as appStorageProvider, Qt as assetRef, Ve as azureProvider, Wt as buildStorageService, xe as bytesToStream, Ct as checkLimits, Yt as clamavScanner, Fe as clearStorageBuffer, Se as collectStream, be as concatBytes, dn as configuredStorageProvider, bt as contentTypeAllowed, Vt as dataStoreGrantStore, Rt as dataStoreRefStore, Be as databaseProvider, tn as decodeDataUri, on as durabilityNotice, Kt as encodeInstream, Zt as ffmpegTranscoder, Le as filesystemProvider, Ce as fromNodeReadable, Te as getObjectStream, Ze as hashPassword, zt as memoryGrantStore, Ie as memoryProvider, Pt as memoryRefStore, qt as parseClamavResponse, Ue as parseTransformParams, an as pathDurability, nn as putAvatar, Ee as putObjectStream, Pe as readStorageBuffer, Mt as refMatchesListQuery, fn as resolveStorageProvider, Y as resolveStorageSecret, Re as s3Provider, ln as setActiveStorageProvider, mt as signFinalizeTicket, ut as signGrant, vt as signMultipartTicket, gt as signResumableTicket, ft as signUploadTicket, St as sniffMatches, Sn as storagePlugin, rn as storagePutIntentsTable, Gt as storageServiceLayer, we as toNodeReadable, Xe as transformCached, qe as transformImage, ht as verifyFinalizeTicket, dt as verifyGrant, yt as verifyMultipartTicket, Qe as verifyPassword, _t as verifyResumableTicket, pt as verifyUploadTicket, $t as withStorage };
3089
+ export { G as STORAGE_BLOBS_TABLE, W as STORAGE_GRANTS_TABLE, U as STORAGE_REFS_TABLE, Oe as STORAGE_USAGE_TABLE, e as StorageAccessDenied, t as StorageError, n as StorageRejected, r as StorageScanRejected, i as StorageService, Me as _voltroStorageBlobsTable, Ae as _voltroStorageGrantsTable, ke as _voltroStorageRefsTable, je as _voltroStorageUsageTable, un as appStorageProvider, Qt as assetRef, He as azureProvider, Wt as buildStorageService, Se as bytesToStream, Ct as checkLimits, Yt as clamavScanner, Ie as clearStorageBuffer, Ce as collectStream, xe as concatBytes, dn as configuredStorageProvider, bt as contentTypeAllowed, Vt as dataStoreGrantStore, Rt as dataStoreRefStore, Ve as databaseProvider, tn as decodeDataUri, on as durabilityNotice, Kt as encodeInstream, Zt as ffmpegTranscoder, Re as filesystemProvider, we as fromNodeReadable, Ee as getObjectStream, Ze as hashPassword, zt as memoryGrantStore, Le as memoryProvider, Pt as memoryRefStore, qt as parseClamavResponse, We as parseTransformParams, an as pathDurability, nn as putAvatar, De as putObjectStream, Fe as readStorageBuffer, Mt as refMatchesListQuery, fn as resolveStorageProvider, Y as resolveStorageSecret, ze as s3Provider, ln as setActiveStorageProvider, mt as signFinalizeTicket, ut as signGrant, vt as signMultipartTicket, gt as signResumableTicket, ft as signUploadTicket, St as sniffMatches, Sn as storageInstanceName, Cn as storagePlugin, rn as storagePutIntentsTable, Gt as storageServiceLayer, Te as toNodeReadable, Xe as transformCached, qe as transformImage, ht as verifyFinalizeTicket, dt as verifyGrant, yt as verifyMultipartTicket, Qe as verifyPassword, _t as verifyResumableTicket, pt as verifyUploadTicket, $t as withStorage };