@voltro/plugin-storage 0.74.0 → 0.75.0

package/dist/index.js

@@ -1,86 +1,86 @@
 import { StorageAccessDenied as e, StorageError as t, StorageRejected as n, StorageScanRejected as r, StorageService as i } from "./types.js";
-import { abortMultipartUploadDescriptor as a, beginMultipartUploadDescriptor as o, beginResumableUploadDescriptor as s, completeMultipartUploadDescriptor as c, finalizeUploadDescriptor as l, ingestUrlDescriptor as u, listGrantsDescriptor as d, listRefsDescriptor as f, mintPresignedUploadDescriptor as p, mintUploadTicketDescriptor as m, mintUploadUrlDescriptor as ee, mintUrlDescriptor as h, revokeDescriptor as g, shareDescriptor as te, signMultipartPartDescriptor as _, storageRpcClientImports as ne, uploadDescriptor as re } from "./rpc.js";
-import { Chunk as v, Effect as y, Exit as b, Layer as x, Schedule as S, Schema as C, Stream as w } from "effect";
-import { definePlugin as ie, pluginInstanceName as T } from "@voltro/protocol";
-import { readCookie as ae, resolveSessionSecret as oe, verifySession as se } from "@voltro/protocol/session";
-import { and as E, bytes as ce, contains as D, eq as O, generateId as k, id as le, integer as A, json as j, mixin as M, or as N, reference as ue, table as P, text as F, timestamp as de } from "@voltro/database";
-import { pluginEnv as fe } from "@voltro/env";
-import { createHash as I, createHmac as L, randomBytes as R, randomUUID as pe, scryptSync as me, timingSafeEqual as z } from "node:crypto";
-import { spawn as he } from "node:child_process";
-import { mkdtemp as ge, readFile as _e, rm as ve, writeFile as ye } from "node:fs/promises";
-import { tmpdir as be } from "node:os";
-import { join as B } from "node:path";
-import { statSync as V } from "node:fs";
+import { abortMultipartUploadDescriptor as a, beginMultipartUploadDescriptor as o, beginResumableUploadDescriptor as s, completeMultipartUploadDescriptor as c, finalizeUploadDescriptor as l, ingestUrlDescriptor as u, listGrantsDescriptor as d, listRefsDescriptor as f, mintPresignedUploadDescriptor as p, mintUploadTicketDescriptor as m, mintUploadUrlDescriptor as ee, mintUrlDescriptor as h, revokeDescriptor as g, shareDescriptor as _, signMultipartPartDescriptor as v, storageRpcClientImports as te, uploadDescriptor as ne } from "./rpc.js";
+import { Chunk as y, Effect as b, Exit as x, Layer as S, Schedule as C, Schema as w, Stream as T } from "effect";
+import { definePlugin as re, pluginInstanceName as E } from "@voltro/protocol";
+import { readCookie as ie, resolveSessionSecret as ae, verifySession as oe } from "@voltro/protocol/session";
+import { and as D, bytes as se, contains as O, eq as k, generateId as A, id as ce, integer as j, json as M, mixin as N, neq as P, or as le, reference as ue, table as F, text as I, timestamp as de } from "@voltro/database";
+import { pluginEnv as L } from "@voltro/env";
+import { createHash as fe, createHmac as R, randomBytes as pe, randomUUID as me, scryptSync as he, timingSafeEqual as z } from "node:crypto";
+import { spawn as ge } from "node:child_process";
+import { mkdtemp as _e, readFile as ve, rm as ye, writeFile as be } from "node:fs/promises";
+import { tmpdir as B } from "node:os";
+import { join as V } from "node:path";
+import { statSync as xe } from "node:fs";
 //#region src/streamBridge.ts
-var xe = 1 << 20, Se = (e, n, r = !1) => new t({
+var Se = 1 << 20, Ce = (e, n, r = !1) => new t({
 	provider: e,
 	message: n,
 	transient: r
-}), Ce = (e) => {
+}), we = (e) => {
 	let t = 0;
 	for (let n of e) t += n.byteLength;
 	let n = new Uint8Array(t), r = 0;
 	for (let t of e) n.set(t, r), r += t.byteLength;
 	return n;
-}, we = (e, t = xe) => {
+}, Te = (e, t = Se) => {
 	let n = [];
 	for (let r = 0; r < e.byteLength; r += t) n.push(e.subarray(r, Math.min(r + t, e.byteLength)));
-	return w.fromIterable(n);
-}, Te = (e) => e.pipe(w.runCollect, y.map((e) => Ce(v.toReadonlyArray(e)))), Ee = (e, t) => w.suspend(() => w.fromAsyncIterable(t(), (t) => Se(e, `read stream failed: ${String(t?.message ?? t)}`, !0))).pipe(w.map((e) => e instanceof Uint8Array ? e : new Uint8Array(e))), De = async (e) => {
+	return T.fromIterable(n);
+}, Ee = (e) => e.pipe(T.runCollect, b.map((e) => we(y.toReadonlyArray(e)))), De = (e, t) => T.suspend(() => T.fromAsyncIterable(t(), (t) => Ce(e, `read stream failed: ${String(t?.message ?? t)}`, !0))).pipe(T.map((e) => e instanceof Uint8Array ? e : new Uint8Array(e))), Oe = async (e) => {
 	let { Readable: t } = await import("node:stream");
-	return t.fromWeb(w.toReadableStream(e));
-}, Oe = (e, t) => e.getStream ? e.getStream(t) : e.get(t).pipe(y.map((e) => ({
-	stream: we(e.bytes),
+	return t.fromWeb(T.toReadableStream(e));
+}, ke = (e, t) => e.getStream ? e.getStream(t) : e.get(t).pipe(b.map((e) => ({
+	stream: Te(e.bytes),
 	contentType: e.contentType,
 	size: e.bytes.byteLength
-}))), ke = (e, t, n, r) => e.putStream ? e.putStream(t, n, r) : Te(n).pipe(y.flatMap((n) => e.put(t, n, {
+}))), Ae = (e, t, n, r) => e.putStream ? e.putStream(t, n, r) : Ee(n).pipe(b.flatMap((n) => e.put(t, n, {
 	contentType: r.contentType,
 	...r.public === void 0 ? {} : { public: r.public }
-}))), H = "_voltro_storage_refs", U = "_voltro_storage_grants", W = "_voltro_storage_blobs", Ae = "_voltro_storage_usage", je = P(H, {
-	id: le({ prefix: "file" }),
-	tenantId: F().nullable(),
-	ownerId: F().nullable(),
-	bucket: F(),
-	key: F(),
-	contentType: F(),
-	size: A(),
-	checksum: F(),
-	visibility: F(),
-	accessPolicy: j().nullable(),
-	passwordHash: F().nullable(),
-	width: A().nullable(),
-	height: A().nullable(),
-	duration: A().nullable(),
-	placeholder: F().nullable(),
-	folder: F().nullable(),
-	tags: j().nullable(),
-	alt: F().nullable(),
-	caption: F().nullable(),
-	derivedFrom: F().nullable(),
-	kind: F().nullable(),
+}))), H = "_voltro_storage_refs", U = "_voltro_storage_grants", W = "_voltro_storage_blobs", je = "_voltro_storage_usage", Me = F(H, {
+	id: ce({ prefix: "file" }),
+	tenantId: I().nullable(),
+	ownerId: I().nullable(),
+	bucket: I(),
+	key: I(),
+	contentType: I(),
+	size: j(),
+	checksum: I(),
+	visibility: I(),
+	accessPolicy: M().nullable(),
+	passwordHash: I().nullable(),
+	width: j().nullable(),
+	height: j().nullable(),
+	duration: j().nullable(),
+	placeholder: I().nullable(),
+	folder: I().nullable(),
+	tags: M().nullable(),
+	alt: I().nullable(),
+	caption: I().nullable(),
+	derivedFrom: I().nullable(),
+	kind: I().nullable(),
 	createdAt: de()
-}).index(["key"]).index(["tenantId"]).index(["ownerId"]).index(["folder"]).index(["derivedFrom"]), Me = P(U, {
-	id: le({ prefix: "sgrant" }),
-	refId: F(),
-	principalType: F(),
-	principalId: F(),
-	permission: F(),
+}).index(["key"]).index(["tenantId"]).index(["ownerId"]).index(["folder"]).index(["derivedFrom"]), Ne = F(U, {
+	id: ce({ prefix: "sgrant" }),
+	refId: I(),
+	principalType: I(),
+	principalId: I(),
+	permission: I(),
 	createdAt: de(),
 	expiresAt: de().nullable(),
-	createdBy: F().nullable()
-}).index(["refId"]).index(["principalId"]), Ne = P(Ae, {
-	id: le({ prefix: "susage" }),
-	tenantId: F().maxLength(191),
-	bytes: A().default(0),
-	count: A().default(0),
+	createdBy: I().nullable()
+}).index(["refId"]).index(["principalId"]), Pe = F(je, {
+	id: ce({ prefix: "susage" }),
+	tenantId: I().maxLength(191),
+	bytes: j().default(0),
+	count: j().default(0),
 	updatedAt: de()
-}).unique("byStorageUsageTenant", ["tenantId"]), Pe = P(W, {
-	id: le({ prefix: "blob" }),
-	key: F(),
-	data: ce(),
-	contentType: F(),
-	size: A()
-}).index(["key"]), G = fe([
+}).unique("byStorageUsageTenant", ["tenantId"]), Fe = F(W, {
+	id: ce({ prefix: "blob" }),
+	key: I(),
+	data: se(),
+	contentType: I(),
+	size: j()
+}).index(["key"]), G = L([
 	{
 		name: "STORAGE_PROVIDER",
 		required: !1,
@@ -236,40 +236,40 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 	message: n,
 	transient: r,
 	...i === void 0 ? {} : { status: i }
-}), Fe = (e) => e === void 0 || e === 408 || e === 429 || e >= 500, Ie = /* @__PURE__ */ new Map(), Le = (e, t) => Ie.get(e)?.get(t)?.bytes, Re = (e) => {
-	Ie.get(e)?.clear();
-}, ze = (e = "default") => {
-	let t = Ie.get(e) ?? /* @__PURE__ */ new Map();
-	return Ie.set(e, t), {
+}), Ie = (e) => e === void 0 || e === 408 || e === 429 || e >= 500, Le = /* @__PURE__ */ new Map(), Re = (e, t) => Le.get(e)?.get(t)?.bytes, ze = (e) => {
+	Le.get(e)?.clear();
+}, Be = (e = "default") => {
+	let t = Le.get(e) ?? /* @__PURE__ */ new Map();
+	return Le.set(e, t), {
 		name: "memory",
 		presigns: !1,
-		put: (e, n, r) => y.sync(() => (t.set(e, {
+		put: (e, n, r) => b.sync(() => (t.set(e, {
 			bytes: n,
 			contentType: r.contentType
 		}), { size: n.byteLength })),
-		get: (e) => y.suspend(() => {
+		get: (e) => b.suspend(() => {
 			let n = t.get(e);
-			return n ? y.succeed({
+			return n ? b.succeed({
 				bytes: n.bytes,
 				contentType: n.contentType
-			}) : y.fail(K("memory", `no object at key '${e}'`, !1, 404));
+			}) : b.fail(K("memory", `no object at key '${e}'`, !1, 404));
 		}),
-		delete: (e) => y.sync(() => {
+		delete: (e) => b.sync(() => {
 			t.delete(e);
 		}),
 		publicUrl: () => null,
-		getUrl: () => y.succeed(""),
-		head: (e) => y.sync(() => {
+		getUrl: () => b.succeed(""),
+		head: (e) => b.sync(() => {
 			let n = t.get(e);
 			return n ? { size: n.bytes.byteLength } : null;
 		})
 	};
-}, Be = (e) => {
+}, Ve = (e) => {
 	let t = e.root, n = async (e) => {
 		let { join: n, resolve: r, sep: i } = await import("node:path"), a = r(t), o = r(a, e);
 		if (o !== a && !o.startsWith(a + i)) throw Error(`key '${e}' escapes the storage root`);
 		return n(o);
-	}, r = (e, t, n = !1) => y.tryPromise({
+	}, r = (e, t, n = !1) => b.tryPromise({
 		try: e,
 		catch: (e) => e?.code === "ENOENT" ? K("filesystem", `no object at key '${t}'`, !1, 404) : K("filesystem", String(e?.message ?? e), n)
 	});
@@ -299,8 +299,8 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 			await (await import("node:fs/promises")).rm(await n(e), { force: !0 });
 		}, e),
 		publicUrl: () => null,
-		getUrl: () => y.succeed(""),
-		head: (e) => y.tryPromise({
+		getUrl: () => b.succeed(""),
+		head: (e) => b.tryPromise({
 			try: async () => {
 				let t = await import("node:fs/promises");
 				try {
@@ -315,7 +315,7 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 		getStream: (e) => r(async () => {
 			let t = await import("node:fs/promises"), { createReadStream: r } = await import("node:fs"), i = await n(e), a = await t.stat(i);
 			return {
-				stream: Ee("filesystem", () => r(i)),
+				stream: De("filesystem", () => r(i)),
 				contentType: "application/octet-stream",
 				size: a.size
 			};
@@ -325,7 +325,7 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 			await r.mkdir(i(c), { recursive: !0 });
 			let l = `${c}.tmp-${a()}`;
 			try {
-				await s(await De(t), o(l));
+				await s(await Oe(t), o(l));
 				let e = await r.stat(l);
 				return await r.rename(l, c), { size: e.size };
 			} catch (e) {
@@ -340,10 +340,10 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 					end: i
 				});
 				s.on("data", (e) => o.push(e)), s.on("end", () => e()), s.on("error", n);
-			}), Ce(o);
+			}), we(o);
 		}, e)
 	};
-}, Ve = (e) => {
+}, He = (e) => {
 	let t = e.name ?? "s3", n = e.publicAcl ?? !0, r = null, i = () => r || (r = (async () => {
 		let t, n;
 		try {
@@ -364,11 +364,11 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 			cmds: t,
 			presign: n.getSignedUrl
 		};
-	})(), r), a = (e) => y.tryPromise({
+	})(), r), a = (e) => b.tryPromise({
 		try: e,
 		catch: (e) => {
 			let n = e?.$metadata?.httpStatusCode;
-			return K(t, String(e?.message ?? e), Fe(n), n);
+			return K(t, String(e?.message ?? e), Ie(n), n);
 		}
 	}), o = async (e) => {
 		let t = e;
@@ -464,7 +464,7 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 				UploadId: n
 			}));
 		}),
-		head: (n) => y.tryPromise({
+		head: (n) => b.tryPromise({
 			try: async () => {
 				let { client: t, cmds: r } = await i();
 				try {
@@ -483,7 +483,7 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 			},
 			catch: (e) => {
 				let n = e?.$metadata?.httpStatusCode;
-				return K(t, String(e?.message ?? e), Fe(n), n);
+				return K(t, String(e?.message ?? e), Ie(n), n);
 			}
 		}),
 		getStream: (n) => a(async () => {
@@ -492,7 +492,7 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 				Key: n
 			})), s = o.Body;
 			return {
-				stream: Ee(t, () => s),
+				stream: De(t, () => s),
 				contentType: o.ContentType ?? "application/octet-stream",
 				...o.ContentLength === void 0 ? {} : { size: o.ContentLength }
 			};
@@ -504,7 +504,7 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 			} catch (e) {
 				throw Error("s3/minio `putStream` requires the '@aws-sdk/lib-storage' optional dependency (multipart upload). Install it to enable streamed uploads.", { cause: e });
 			}
-			let l = await De(r);
+			let l = await Oe(r);
 			return await new c.Upload({
 				client: a,
 				params: {
@@ -528,11 +528,11 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 			return o(c.Body);
 		})
 	};
-}, He = (e) => e instanceof Uint8Array ? e : typeof e == "string" ? new Uint8Array(Buffer.from(e, "base64")) : new Uint8Array(e), Ue = () => {
+}, Ue = (e) => e instanceof Uint8Array ? e : typeof e == "string" ? new Uint8Array(Buffer.from(e, "base64")) : new Uint8Array(e), We = () => {
 	let e = null, t = () => {
 		if (!e) throw Error("the 'database' storage provider isn't bound to a DataStore yet");
 		return e;
-	}, n = (e) => y.tryPromise({
+	}, n = (e) => b.tryPromise({
 		try: e,
 		catch: (e) => K("database", String(e?.message ?? e), !0)
 	}), r = async (e) => (await t().query({
@@ -560,7 +560,7 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 				contentType: a.contentType,
 				size: i.byteLength
 			}) : await t().insert(W, {
-				id: k({
+				id: A({
 					kind: "typeid",
 					prefix: "blob"
 				}, W),
@@ -570,22 +570,22 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 				size: i.byteLength
 			}), { size: i.byteLength };
 		}),
-		get: (e) => y.suspend(() => n(() => r(e)).pipe(y.flatMap((t) => t ? y.succeed({
-			bytes: He(t.data),
+		get: (e) => b.suspend(() => n(() => r(e)).pipe(b.flatMap((t) => t ? b.succeed({
+			bytes: Ue(t.data),
 			contentType: String(t.contentType)
-		}) : y.fail(K("database", `no object at key '${e}'`, !1, 404))))),
+		}) : b.fail(K("database", `no object at key '${e}'`, !1, 404))))),
 		delete: (e) => n(async () => {
 			let n = await r(e);
 			n && await t().delete(W, String(n.id));
 		}),
 		publicUrl: () => null,
-		getUrl: () => y.succeed(""),
+		getUrl: () => b.succeed(""),
 		head: (e) => n(async () => {
 			let t = await r(e);
 			return t ? { size: Number(t.size) } : null;
 		})
 	};
-}, We = (e) => {
+}, Ge = (e) => {
 	let t = null, n = () => t || (t = (async () => {
 		let t;
 		try {
@@ -599,11 +599,11 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 			sdk: t,
 			cred: i
 		};
-	})(), t), r = (e) => y.tryPromise({
+	})(), t), r = (e) => b.tryPromise({
 		try: e,
 		catch: (e) => {
 			let t = e?.statusCode;
-			return K("azure", String(e?.message ?? e), Fe(t), t);
+			return K("azure", String(e?.message ?? e), Ie(t), t);
 		}
 	}), i = async (e) => {
 		if (!e) return /* @__PURE__ */ new Uint8Array();
@@ -645,7 +645,7 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 		publicUrl: (t) => e.cdnBaseUrl ? `${e.cdnBaseUrl.replace(/\/$/, "")}/${t}` : null,
 		getUrl: (e, t) => r(() => a(e, "r", t)),
 		getUploadUrl: (e, t, n) => r(() => a(e, "cw", t)),
-		head: (e) => y.tryPromise({
+		head: (e) => b.tryPromise({
 			try: async () => {
 				let { container: t } = await n();
 				try {
@@ -661,19 +661,19 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 			},
 			catch: (e) => {
 				let t = e?.statusCode;
-				return K("azure", String(e?.message ?? e), Fe(t), t);
+				return K("azure", String(e?.message ?? e), Ie(t), t);
 			}
 		}),
 		getStream: (e) => r(async () => {
 			let { container: t } = await n(), r = await t.getBlockBlobClient(e).download();
 			return {
-				stream: Ee("azure", () => r.readableStreamBody),
+				stream: De("azure", () => r.readableStreamBody),
 				contentType: r.contentType ?? "application/octet-stream",
 				...r.contentLength === void 0 ? {} : { size: r.contentLength }
 			};
 		}),
 		putStream: (e, t, i) => r(async () => {
-			let { container: r } = await n(), a = await De(t);
+			let { container: r } = await n(), a = await Oe(t);
 			return await r.getBlockBlobClient(e).uploadStream(a, 4194304, 5, { blobHTTPHeaders: { blobContentType: i.contentType } }), { size: i.totalSize ?? (await r.getBlockBlobClient(e).getProperties()).contentLength ?? 0 };
 		}),
 		getRange: (e, t, a) => r(async () => {
@@ -681,13 +681,13 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 			return i(o.readableStreamBody);
 		})
 	};
-}, Ge = {
+}, Ke = {
 	webp: "image/webp",
 	avif: "image/avif",
 	jpeg: "image/jpeg",
 	jpg: "image/jpeg",
 	png: "image/png"
-}, Ke = (e) => {
+}, qe = (e) => {
 	if (!e) return null;
 	let t = new URLSearchParams(e), n = (e) => {
 		let n = t.get(e);
@@ -702,18 +702,18 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 		...a === void 0 ? {} : { q: a },
 		...s ? { fit: s } : {}
 	};
-}, qe = (e) => e.startsWith("image/") && !e.includes("svg"), Je, Ye = async () => {
-	if (Je !== void 0) return Je;
+}, Je = (e) => e.startsWith("image/") && !e.includes("svg"), Ye, Xe = async () => {
+	if (Ye !== void 0) return Ye;
 	try {
 		let e = await import("sharp");
-		Je = e.default ?? e;
+		Ye = e.default ?? e;
 	} catch {
-		Je = null;
+		Ye = null;
 	}
-	return Je;
-}, Xe = async (e, t, n) => {
-	if (!qe(t)) return null;
-	let r = await Ye();
+	return Ye;
+}, Ze = async (e, t, n) => {
+	if (!Je(t)) return null;
+	let r = await Xe();
 	if (!r) return null;
 	try {
 		let i = r(Buffer.from(e), { failOn: "none" });
@@ -723,10 +723,10 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 			fit: n.fit ?? "cover",
 			withoutEnlargement: !0
 		}));
-		let a = n.format && Ge[n.format] ? n.format : void 0, o = t;
+		let a = n.format && Ke[n.format] ? n.format : void 0, o = t;
 		if (a) {
 			let e = a === "jpg" ? "jpeg" : a;
-			i = i.toFormat(e, n.q === void 0 ? {} : { quality: n.q }), o = Ge[a];
+			i = i.toFormat(e, n.q === void 0 ? {} : { quality: n.q }), o = Ke[a];
 		} else n.q !== void 0 && (t === "image/jpeg" || t === "image/webp") && (i = i.toFormat(t === "image/webp" ? "webp" : "jpeg", { quality: n.q }));
 		let s = await i.toBuffer();
 		return {
@@ -736,43 +736,43 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 	} catch {
 		return null;
 	}
-}, Ze = 200, Qe = /* @__PURE__ */ new Map(), $e = async (e, t, n, r) => {
-	let i = `${e}::${JSON.stringify(r)}`, a = Qe.get(i);
+}, Qe = 200, $e = /* @__PURE__ */ new Map(), et = async (e, t, n, r) => {
+	let i = `${e}::${JSON.stringify(r)}`, a = $e.get(i);
 	if (a) return a;
-	let o = await Xe(t, n, r);
-	if (o && (Qe.set(i, o), Qe.size > Ze)) {
-		let e = Qe.keys().next().value;
-		e !== void 0 && Qe.delete(e);
+	let o = await Ze(t, n, r);
+	if (o && ($e.set(i, o), $e.size > Qe)) {
+		let e = $e.keys().next().value;
+		e !== void 0 && $e.delete(e);
 	}
 	return o;
-}, et = (e) => {
-	let t = R(16).toString("hex");
-	return `${t}:${me(e, t, 32).toString("hex")}`;
-}, tt = (e, t) => {
+}, tt = (e) => {
+	let t = pe(16).toString("hex");
+	return `${t}:${he(e, t, 32).toString("hex")}`;
+}, nt = (e, t) => {
 	if (!e || !t) return !1;
 	let [n, r] = t.split(":");
 	if (!n || !r) return !1;
-	let i = Buffer.from(r, "hex"), a = me(e, n, i.length);
+	let i = Buffer.from(r, "hex"), a = he(e, n, i.length);
 	return a.length === i.length && z(a, i);
-}, nt = (e) => Array.isArray(e) ? e.filter((e) => typeof e == "string") : [], rt = (e) => nt(e.metadata?.roles), it = (e) => nt(e.scopes), at = (e, t) => e.some((e) => t.includes(e)), ot = (e) => nt(e.metadata?.groups), st = (e) => typeof e == "boolean" ? y.succeed(e) : y.isEffect(e) ? e : y.promise(() => e), ct = (e, t, n = {}) => y.gen(function* () {
+}, rt = (e) => Array.isArray(e) ? e.filter((e) => typeof e == "string") : [], it = (e) => rt(e.metadata?.roles), at = (e) => rt(e.scopes), ot = (e, t) => e.some((e) => t.includes(e)), st = (e) => rt(e.metadata?.groups), ct = (e) => typeof e == "boolean" ? b.succeed(e) : b.isEffect(e) ? e : b.promise(() => e), lt = (e, t, n = {}) => b.gen(function* () {
 	if (t.id && e.ownerId && t.id === e.ownerId) return !0;
 	let r = e.accessPolicy ?? [];
 	if (r.length === 0) return !1;
-	let i = n.resolveGroups ? yield* y.promise(async () => await n.resolveGroups(t)) : ot(t);
-	for (let a of r) if (yield* lt(a, e, t, i, n)) return !0;
+	let i = n.resolveGroups ? yield* b.promise(async () => await n.resolveGroups(t)) : st(t);
+	for (let a of r) if (yield* ut(a, e, t, i, n)) return !0;
 	return !1;
-}), lt = (e, t, n, r, i) => y.gen(function* () {
+}), ut = (e, t, n, r, i) => b.gen(function* () {
 	let a = !1, o = (e) => (a = !0, e);
-	if (e.owner !== void 0 && e.owner && !o(!!n.id && !!t.ownerId && n.id === t.ownerId) || e.tenant !== void 0 && e.tenant && !o(!!n.tenantId && n.tenantId === t.tenantId) || e.apiKey !== void 0 && e.apiKey && !o(n.type === "apiKey") || e.roles && e.roles.length > 0 && !o(at(rt(n), e.roles)) || e.groups && e.groups.length > 0 && !o(at(r, e.groups)) || e.scopes && e.scopes.length > 0 && !o(at(it(n), e.scopes)) || e.password !== void 0 && e.password && !o(tt(i.password, t.passwordHash))) return !1;
+	if (e.owner !== void 0 && e.owner && !o(!!n.id && !!t.ownerId && n.id === t.ownerId) || e.tenant !== void 0 && e.tenant && !o(!!n.tenantId && n.tenantId === t.tenantId) || e.apiKey !== void 0 && e.apiKey && !o(n.type === "apiKey") || e.roles && e.roles.length > 0 && !o(ot(it(n), e.roles)) || e.groups && e.groups.length > 0 && !o(ot(r, e.groups)) || e.scopes && e.scopes.length > 0 && !o(ot(at(n), e.scopes)) || e.password !== void 0 && e.password && !o(nt(i.password, t.passwordHash))) return !1;
 	if (e.guard) {
 		let r = i.guards?.[e.guard];
-		if (!o(r ? yield* st(r({
+		if (!o(r ? yield* ct(r({
 			subject: n,
 			ref: t
 		})) : !1)) return !1;
 	}
 	return a;
-}), ut = (e, t) => {
+}), dt = (e, t) => {
 	let n = [];
 	e.id && n.push({
 		type: e.type === "apiKey" ? "apiKey" : "user",
@@ -783,24 +783,24 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 		id: e
 	});
 	return n;
-}, dt = (e, t, n, r, i) => {
-	let a = ut(t, n);
+}, ft = (e, t, n, r, i) => {
+	let a = dt(t, n);
 	return e.some((e) => e.expiresAt && e.expiresAt.getTime() < i || r === "write" && e.permission !== "write" ? !1 : a.some((t) => t.type === e.principalType && t.id === e.principalId));
-}, ft = (e, t) => t.resolveGroups ? y.promise(async () => await t.resolveGroups(e)) : y.succeed(ot(e)), q = () => G.read("VOLTRO_STORAGE_SECRET") ?? oe(), J = (e) => (typeof e == "string" ? Buffer.from(e, "utf8") : e).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, ""), Y = (e) => {
+}, pt = (e, t) => t.resolveGroups ? b.promise(async () => await t.resolveGroups(e)) : b.succeed(st(e)), q = () => G.read("VOLTRO_STORAGE_SECRET") ?? ae(), J = (e) => (typeof e == "string" ? Buffer.from(e, "utf8") : e).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, ""), Y = (e) => {
 	let t = e.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - e.length % 4) % 4);
 	return Buffer.from(t, "base64");
-}, pt = (e, t, n = q()) => {
+}, mt = (e, t, n = q()) => {
 	if (!n) throw Error("signGrant: secret must be a non-empty string");
 	let r = {
 		refId: e,
 		exp: Math.floor(Date.now() / 1e3) + Math.floor(t)
 	}, i = J(JSON.stringify(r));
-	return `${i}.${J(L("sha256", n).update(i).digest())}`;
-}, mt = (e, t = q()) => {
+	return `${i}.${J(R("sha256", n).update(i).digest())}`;
+}, ht = (e, t = q()) => {
 	if (!e || !t) return null;
 	let n = e.indexOf(".");
 	if (n <= 0 || n === e.length - 1) return null;
-	let r = e.slice(0, n), i = e.slice(n + 1), a = L("sha256", t).update(r).digest(), o = Y(i);
+	let r = e.slice(0, n), i = e.slice(n + 1), a = R("sha256", t).update(r).digest(), o = Y(i);
 	if (o.length !== a.length || !z(o, a)) return null;
 	try {
 		let e = JSON.parse(Y(r).toString("utf8"));
@@ -808,18 +808,18 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 	} catch {
 		return null;
 	}
-}, ht = (e, t, n = q()) => {
+}, gt = (e, t, n = q()) => {
 	if (!n) throw Error("signUploadTicket: secret must be a non-empty string");
 	let r = {
 		...e,
 		exp: Math.floor(Date.now() / 1e3) + Math.floor(t)
 	}, i = J(JSON.stringify(r));
-	return `${i}.${J(L("sha256", n).update(`u:${i}`).digest())}`;
-}, gt = (e, t = q()) => {
+	return `${i}.${J(R("sha256", n).update(`u:${i}`).digest())}`;
+}, _t = (e, t = q()) => {
 	if (!e || !t) return null;
 	let n = e.indexOf(".");
 	if (n <= 0 || n === e.length - 1) return null;
-	let r = e.slice(0, n), i = e.slice(n + 1), a = L("sha256", t).update(`u:${r}`).digest(), o = Y(i);
+	let r = e.slice(0, n), i = e.slice(n + 1), a = R("sha256", t).update(`u:${r}`).digest(), o = Y(i);
 	if (o.length !== a.length || !z(o, a)) return null;
 	try {
 		let e = JSON.parse(Y(r).toString("utf8"));
@@ -827,18 +827,18 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 	} catch {
 		return null;
 	}
-}, _t = (e, t, n = q()) => {
+}, vt = (e, t, n = q()) => {
 	if (!n) throw Error("signFinalizeTicket: secret must be a non-empty string");
 	let r = {
 		...e,
 		exp: Math.floor(Date.now() / 1e3) + Math.floor(t)
 	}, i = J(JSON.stringify(r));
-	return `${i}.${J(L("sha256", n).update(`f:${i}`).digest())}`;
-}, vt = (e, t = q()) => {
+	return `${i}.${J(R("sha256", n).update(`f:${i}`).digest())}`;
+}, yt = (e, t = q()) => {
 	if (!e || !t) return null;
 	let n = e.indexOf(".");
 	if (n <= 0 || n === e.length - 1) return null;
-	let r = e.slice(0, n), i = e.slice(n + 1), a = L("sha256", t).update(`f:${r}`).digest(), o = Y(i);
+	let r = e.slice(0, n), i = e.slice(n + 1), a = R("sha256", t).update(`f:${r}`).digest(), o = Y(i);
 	if (o.length !== a.length || !z(o, a)) return null;
 	try {
 		let e = JSON.parse(Y(r).toString("utf8"));
@@ -846,18 +846,18 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 	} catch {
 		return null;
 	}
-}, yt = (e, t, n = q()) => {
+}, bt = (e, t, n = q()) => {
 	if (!n) throw Error("signResumableTicket: secret must be a non-empty string");
 	let r = {
 		...e,
 		exp: Math.floor(Date.now() / 1e3) + Math.floor(t)
 	}, i = J(JSON.stringify(r));
-	return `${i}.${J(L("sha256", n).update(`r:${i}`).digest())}`;
-}, bt = (e, t = q()) => {
+	return `${i}.${J(R("sha256", n).update(`r:${i}`).digest())}`;
+}, xt = (e, t = q()) => {
 	if (!e || !t) return null;
 	let n = e.indexOf(".");
 	if (n <= 0 || n === e.length - 1) return null;
-	let r = e.slice(0, n), i = e.slice(n + 1), a = L("sha256", t).update(`r:${r}`).digest(), o = Y(i);
+	let r = e.slice(0, n), i = e.slice(n + 1), a = R("sha256", t).update(`r:${r}`).digest(), o = Y(i);
 	if (o.length !== a.length || !z(o, a)) return null;
 	try {
 		let e = JSON.parse(Y(r).toString("utf8"));
@@ -865,18 +865,18 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 	} catch {
 		return null;
 	}
-}, xt = (e, t, n = q()) => {
+}, St = (e, t, n = q()) => {
 	if (!n) throw Error("signMultipartTicket: secret must be a non-empty string");
 	let r = {
 		...e,
 		exp: Math.floor(Date.now() / 1e3) + Math.floor(t)
 	}, i = J(JSON.stringify(r));
-	return `${i}.${J(L("sha256", n).update(`m:${i}`).digest())}`;
-}, St = (e, t = q()) => {
+	return `${i}.${J(R("sha256", n).update(`m:${i}`).digest())}`;
+}, Ct = (e, t = q()) => {
 	if (!e || !t) return null;
 	let n = e.indexOf(".");
 	if (n <= 0 || n === e.length - 1) return null;
-	let r = e.slice(0, n), i = e.slice(n + 1), a = L("sha256", t).update(`m:${r}`).digest(), o = Y(i);
+	let r = e.slice(0, n), i = e.slice(n + 1), a = R("sha256", t).update(`m:${r}`).digest(), o = Y(i);
 	if (o.length !== a.length || !z(o, a)) return null;
 	try {
 		let e = JSON.parse(Y(r).toString("utf8"));
@@ -884,14 +884,14 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 	} catch {
 		return null;
 	}
-}, Ct = (e, t) => {
+}, wt = (e, t) => {
 	if (!t || t.length === 0) return !0;
 	let n = e.toLowerCase();
 	return t.some((e) => {
 		let t = e.toLowerCase();
 		return t.endsWith("/*") ? n.startsWith(t.slice(0, -1)) : n === t;
 	});
-}, wt = [
+}, Tt = [
 	{
 		ct: /^image\/png$/,
 		offset: 0,
@@ -961,21 +961,21 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 		offset: 0,
 		magic: [31, 139]
 	}
-], Tt = (e, t) => {
-	let n = t.toLowerCase(), r = wt.find((e) => e.ct.test(n));
+], Et = (e, t) => {
+	let n = t.toLowerCase(), r = Tt.find((e) => e.ct.test(n));
 	return r ? e.length < r.offset + r.magic.length ? !1 : r.magic.every((t, n) => e[r.offset + n] === t) : !0;
-}, Et = (e, t, n) => n ? n.maxBytes !== void 0 && e.byteLength > n.maxBytes ? {
+}, Dt = (e, t, n) => n ? n.maxBytes !== void 0 && e.byteLength > n.maxBytes ? {
 	reason: "too-large",
 	detail: `${e.byteLength} bytes exceeds the ${n.maxBytes}-byte limit`
-} : Ct(t, n.allowedContentTypes) ? n.sniff && !Tt(e, t) ? {
+} : wt(t, n.allowedContentTypes) ? n.sniff && !Et(e, t) ? {
 	reason: "content-mismatch",
 	detail: `bytes do not match the declared content type '${t}'`
 } : null : {
 	reason: "content-type-not-allowed",
 	detail: `content type '${t}' is not in the allow-list`
-} : null, Dt = async (e, t, n) => {
-	if (!qe(t)) return { bytes: e };
-	let r = await Ye();
+} : null, Ot = async (e, t, n) => {
+	if (!Je(t)) return { bytes: e };
+	let r = await Xe();
 	if (!r) return { bytes: e };
 	try {
 		let t = e;
@@ -998,16 +998,16 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 	} catch {
 		return { bytes: e };
 	}
-}, Ot = 67108864, kt = (e) => new n({
+}, kt = 67108864, At = (e) => new n({
 	reason: "too-large",
 	detail: `remote body exceeds the ${e}-byte ingest limit`
-}), At = (e, r) => y.suspend(() => {
-	let i = r ?? Ot;
-	return !Number.isSafeInteger(i) || i < 0 ? y.fail(new t({
+}), jt = (e, r) => b.suspend(() => {
+	let i = r ?? kt;
+	return !Number.isSafeInteger(i) || i < 0 ? b.fail(new t({
 		provider: "ingest",
 		message: "limits.maxBytes must be a non-negative safe integer",
 		transient: !1
-	})) : y.tryPromise({
+	})) : b.tryPromise({
 		try: async (n) => {
 			let r = await fetch(e, { signal: n }), a;
 			try {
@@ -1018,12 +1018,12 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 					status: r.status
 				});
 				let e = r.headers.get("content-length"), n = r.headers.get("content-encoding")?.trim().toLowerCase();
-				if ((!n || n === "identity") && e !== null && /^\d+$/.test(e) && BigInt(e) > BigInt(i)) throw kt(i);
+				if ((!n || n === "identity") && e !== null && /^\d+$/.test(e) && BigInt(e) > BigInt(i)) throw At(i);
 				let o = /* @__PURE__ */ new Uint8Array(), s = 0;
 				if (r.body !== null) for (a = r.body.getReader();;) {
 					let e = await a.read();
 					if (e.done) break;
-					if (e.value.byteLength > i - s) throw kt(i);
+					if (e.value.byteLength > i - s) throw At(i);
 					if (e.value.byteLength !== 0) {
 						let t = s + e.value.byteLength;
 						if (t > o.byteLength) {
@@ -1047,44 +1047,50 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 			transient: !0
 		})
 	});
-}), jt = (e, t) => y.suspend(() => {
+}), Mt = (e, t) => b.suspend(() => {
 	if (t === void 0) return e;
-	if (t.aborted) return y.interrupt;
-	let n = y.async((e) => {
-		let n = () => e(y.interrupt);
-		return t.addEventListener("abort", n, { once: !0 }), t.aborted && n(), y.sync(() => t.removeEventListener("abort", n));
+	if (t.aborted) return b.interrupt;
+	let n = b.async((e) => {
+		let n = () => e(b.interrupt);
+		return t.addEventListener("abort", n, { once: !0 }), t.aborted && n(), b.sync(() => t.removeEventListener("abort", n));
 	});
-	return y.raceFirst(e, n);
-}), Mt = (e) => {
-	let r = (e, r) => y.tryPromise({
+	return b.raceFirst(e, n);
+}), Nt = (e) => {
+	let r = (e, r) => b.tryPromise({
 		try: r,
-		catch: (r) => C.is(n)(r) ? r : new t({
+		catch: (r) => w.is(n)(r) ? r : new t({
 			provider: "metadata",
 			message: `Storage ${e} was not confirmed; retain the operation identity for recovery`,
 			transient: !1
 		})
 	});
 	return {
-		put: (t) => y.gen(function* () {
-			if (t.bytes.byteLength !== t.ref.size || I("sha256").update(t.bytes).digest("hex") !== t.identity.checksum) return yield* y.fail(new n({
+		put: (t) => b.gen(function* () {
+			if (t.bytes.byteLength !== t.ref.size || fe("sha256").update(t.bytes).digest("hex") !== t.identity.checksum) return yield* b.fail(new n({
 				reason: "operation-content-mismatch",
 				detail: "Storage operation bytes do not match their reserved identity"
 			}));
-			let i = yield* r("put reservation", () => e.metadata.reserve(t.identity, t.ref, t.quota));
-			return i.ready ? i.ref : (yield* e.provider.put(i.ref.key, t.bytes, {
+			let i = yield* r("put reservation", () => e.metadata.reserve(t.identity, t.ref, t.quota, t.claim)), a = i.outcome;
+			return i.ready ? {
+				ref: i.ref,
+				outcome: a
+			} : (yield* e.provider.put(i.ref.key, t.bytes, {
 				contentType: i.ref.contentType,
 				public: i.ref.visibility === "public"
-			}), yield* r("put confirmation", () => e.metadata.confirm(t.identity)));
+			}), {
+				ref: yield* r("put confirmation", () => e.metadata.confirm(t.identity, t.claim)),
+				outcome: a
+			});
 		}),
-		delete: (t, n) => y.gen(function* () {
-			let i = yield* r("delete acceptance", () => e.metadata.beginDelete(t, n));
-			i.operation.deleteKey !== null && (yield* e.provider.delete(i.operation.deleteKey)), yield* r("delete confirmation", () => e.metadata.confirmDelete(i.identity));
+		delete: (t, n, i) => b.gen(function* () {
+			let a = yield* r("delete acceptance", () => e.metadata.beginDelete(t, n, i));
+			"operation" in a && (a.operation.deleteKey !== null && (yield* e.provider.delete(a.operation.deleteKey)), yield* r("delete confirmation", () => e.metadata.confirmDelete(a.identity)));
 		})
 	};
-}, Nt = async (e) => {
+}, Pt = async (e) => {
 	let { createHash: t } = await import("node:crypto");
 	return t("sha256").update(e).digest("hex");
-}, Pt = (e, t, n) => `${e?.replace(/\/+$/, "") ?? ""}${n}/${t}`, Ft = (e) => {
+}, Ft = (e, t, n) => `${e?.replace(/\/+$/, "") ?? ""}${n}/${t}`, It = (e) => {
 	let t = /* @__PURE__ */ new Map(), n = {
 		public: 0,
 		private: 0
@@ -1100,7 +1106,7 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 		byTenant: Object.fromEntries(t),
 		visibility: n
 	};
-}, It = (e, t) => {
+}, Lt = (e, t) => {
 	if (t.search && ![
 		e.id,
 		e.key,
@@ -1117,10 +1123,10 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 		if (!t.tags.every((e) => n.includes(e))) return !1;
 	}
 	return !0;
-}, Lt = (e) => e ?? "global", Rt = () => {
+}, Rt = (e) => e ?? "global", zt = () => {
 	let e = /* @__PURE__ */ new Map(), t = /* @__PURE__ */ new Map();
 	return {
-		statistics: () => y.sync(() => Ft((function* () {
+		statistics: () => b.sync(() => It((function* () {
 			for (let t of e.values()) yield {
 				tenantId: t.tenantId,
 				visibility: t.visibility,
@@ -1128,14 +1134,14 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 				bytes: t.size
 			};
 		})())),
-		insert: (t) => y.sync(() => {
+		insert: (t) => b.sync(() => {
 			e.set(t.id, t);
 		}),
-		getById: (t) => y.sync(() => e.get(t) ?? null),
-		delete: (t) => y.sync(() => e.delete(t)),
-		listRecent: (t) => y.sync(() => [...e.values()].sort((e, t) => t.createdAt.getTime() - e.createdAt.getTime() || t.id.localeCompare(e.id)).slice(0, t)),
-		countByKey: (t, n) => y.sync(() => [...e.values()].filter((e) => e.bucket === t && e.key === n).length),
-		usageByTenant: (t) => y.sync(() => {
+		getById: (t) => b.sync(() => e.get(t) ?? null),
+		delete: (t) => b.sync(() => e.delete(t)),
+		listRecent: (t) => b.sync(() => [...e.values()].sort((e, t) => t.createdAt.getTime() - e.createdAt.getTime() || t.id.localeCompare(e.id)).slice(0, t)),
+		countByKey: (t, n) => b.sync(() => [...e.values()].filter((e) => e.bucket === t && e.key === n).length),
+		usageByTenant: (t) => b.sync(() => {
 			let n = 0, r = 0;
 			for (let i of e.values()) (i.tenantId ?? null) === (t ?? null) && (n += i.size, r++);
 			return {
@@ -1143,8 +1149,8 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 				count: r
 			};
 		}),
-		consumeUsage: (e, n, r) => y.sync(() => {
-			let i = Lt(e), a = t.get(i) ?? {
+		consumeUsage: (e, n, r) => b.sync(() => {
+			let i = Rt(e), a = t.get(i) ?? {
 				bytes: 0,
 				count: 0
 			}, o = (r?.maxBytes === void 0 || a.bytes + n.bytes <= r.maxBytes) && (r?.maxCount === void 0 || a.count + n.count <= r.maxCount);
@@ -1157,17 +1163,17 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 				count: a.count
 			};
 		}),
-		releaseUsage: (e, n) => y.sync(() => {
-			let r = Lt(e), i = t.get(r);
+		releaseUsage: (e, n) => b.sync(() => {
+			let r = Rt(e), i = t.get(r);
 			i && t.set(r, {
 				bytes: Math.max(0, i.bytes - n.bytes),
 				count: Math.max(0, i.count - n.count)
 			});
 		}),
-		listByDerivedFrom: (t) => y.sync(() => [...e.values()].filter((e) => (e.derivedFrom ?? null) === t)),
-		listRefs: (t) => y.sync(() => [...e.values()].filter((e) => It(e, t)).sort((e, t) => t.createdAt.getTime() - e.createdAt.getTime() || t.id.localeCompare(e.id)).slice(t.offset, t.offset + t.limit))
+		listByDerivedFrom: (t) => b.sync(() => [...e.values()].filter((e) => (e.derivedFrom ?? null) === t)),
+		listRefs: (t) => b.sync(() => [...e.values()].filter((e) => Lt(e, t)).sort((e, t) => t.createdAt.getTime() - e.createdAt.getTime() || t.id.localeCompare(e.id)).slice(t.offset, t.offset + t.limit))
 	};
-}, zt = (e) => Array.isArray(e) && e.every((e) => typeof e == "string") ? e : null, X = (e) => ({
+}, Bt = (e) => Array.isArray(e) && e.every((e) => typeof e == "string") ? e : null, X = (e) => ({
 	id: String(e.id),
 	tenantId: e.tenantId ?? null,
 	ownerId: e.ownerId ?? null,
@@ -1185,19 +1191,19 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 	duration: e.duration ?? null,
 	placeholder: e.placeholder ?? null,
 	folder: e.folder ?? null,
-	tags: zt(e.tags),
+	tags: Bt(e.tags),
 	alt: e.alt ?? null,
 	caption: e.caption ?? null,
 	derivedFrom: e.derivedFrom ?? null,
 	kind: e.kind ?? null
-}), Z = (e) => y.tryPromise({
+}), Z = (e) => b.tryPromise({
 	try: e,
 	catch: (e) => new t({
 		provider: "refstore",
 		message: String(e?.message ?? e),
 		transient: !0
 	})
-}), Bt = async (e, t) => (await e.query({
+}), Vt = async (e, t) => (await e.query({
 	table: "_voltro_storage_usage",
 	predicate: {
 		column: "tenantId",
@@ -1208,8 +1214,8 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 	take: 1,
 	skip: void 0,
 	projection: void 0
-}))[0] ?? null, Vt = (e) => ({
-	statistics: () => Z(async () => Ft((await e.query({
+}))[0] ?? null, Ht = (e) => ({
+	statistics: () => Z(async () => It((await e.query({
 		table: H,
 		predicate: void 0,
 		order: [],
@@ -1295,10 +1301,10 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 		};
 	}),
 	consumeUsage: (t, n, r) => Z(async () => {
-		let i = Lt(t);
+		let i = Rt(t);
 		for (let t = 0; t < 32; t++) {
 			t > 0 && await new Promise((e) => setTimeout(e, t));
-			let a = await Bt(e, i), o = a ? Number(a.bytes ?? 0) : 0, s = a ? Number(a.count ?? 0) : 0;
+			let a = await Vt(e, i), o = a ? Number(a.bytes ?? 0) : 0, s = a ? Number(a.count ?? 0) : 0;
 			if (!((r?.maxBytes === void 0 || o + n.bytes <= r.maxBytes) && (r?.maxCount === void 0 || s + n.count <= r.maxCount))) return {
 				allowed: !1,
 				bytes: o,
@@ -1309,16 +1315,16 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 					bytes: o + n.bytes,
 					count: s + n.count,
 					updatedAt: /* @__PURE__ */ new Date()
-				}, { where: E(O("id", String(a.id)), O("bytes", o), O("count", s)) }) === 1) return {
+				}, { where: D(k("id", String(a.id)), k("bytes", o), k("count", s)) }) === 1) return {
 					allowed: !0,
 					bytes: o,
 					count: s
 				};
 			} else {
-				let t = k({
+				let t = A({
 					kind: "typeid",
 					prefix: "susage"
-				}, Ae), r = await e.insertIgnore(Ae, {
+				}, je), r = await e.insertIgnore(je, {
 					id: t,
 					tenantId: i,
 					bytes: n.bytes,
@@ -1335,17 +1341,17 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 		throw Error(`storage usage consume: contention on tenant '${i}' exceeded 32 attempts`);
 	}),
 	releaseUsage: (t, n) => Z(async () => {
-		let r = Lt(t);
+		let r = Rt(t);
 		for (let t = 0; t < 32; t++) {
 			t > 0 && await new Promise((e) => setTimeout(e, t));
-			let i = await Bt(e, r);
+			let i = await Vt(e, r);
 			if (!i) return;
 			let a = Number(i.bytes ?? 0), o = Number(i.count ?? 0);
 			if (await e.updateMany("_voltro_storage_usage", {
 				bytes: Math.max(0, a - n.bytes),
 				count: Math.max(0, o - n.count),
 				updatedAt: /* @__PURE__ */ new Date()
-			}, { where: E(O("id", String(i.id)), O("bytes", a), O("count", o)) }) === 1) return;
+			}, { where: D(k("id", String(i.id)), k("bytes", a), k("count", o)) }) === 1) return;
 		}
 		throw Error(`storage usage release: contention on tenant '${r}' exceeded 32 attempts`);
 	}),
@@ -1366,14 +1372,14 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 	})).map(X)),
 	listRefs: (t) => Z(async () => {
 		let n = [];
-		t.tenantId !== void 0 && n.push(O("tenantId", t.tenantId)), t.ownerId !== void 0 && n.push(O("ownerId", t.ownerId)), t.search && n.push(N(...[
+		t.tenantId !== void 0 && n.push(k("tenantId", t.tenantId)), t.ownerId !== void 0 && n.push(k("ownerId", t.ownerId)), t.search && n.push(le(...[
 			"id",
 			"key",
 			"contentType",
 			"ownerId",
 			"tenantId"
-		].map((e) => D(e, t.search))));
-		let r = t.folder === void 0 && t.tags.length === 0 && t.includeDerived, i = n.length ? E(...n) : void 0, a = await e.query({
+		].map((e) => O(e, t.search))));
+		let r = t.folder === void 0 && t.tags.length === 0 && t.includeDerived, i = n.length ? D(...n) : void 0, a = await e.query({
 			table: H,
 			predicate: i,
 			order: [{
@@ -1387,24 +1393,24 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 			skip: r ? t.offset : void 0,
 			projection: void 0
 		});
-		return r ? a.map(X) : a.map(X).filter((e) => It(e, t)).slice(t.offset, t.offset + t.limit);
+		return r ? a.map(X) : a.map(X).filter((e) => Lt(e, t)).slice(t.offset, t.offset + t.limit);
 	})
-}), Ht = () => {
+}), Ut = () => {
 	let e = /* @__PURE__ */ new Map();
 	return {
-		insert: (t) => y.sync(() => {
+		insert: (t) => b.sync(() => {
 			e.set(t.id, t);
 		}),
-		delete: (t) => y.sync(() => {
+		delete: (t) => b.sync(() => {
 			e.delete(t);
 		}),
-		getById: (t) => y.sync(() => e.get(t) ?? null),
-		listByRef: (t) => y.sync(() => [...e.values()].filter((e) => e.refId === t)),
-		deleteByRef: (t) => y.sync(() => {
+		getById: (t) => b.sync(() => e.get(t) ?? null),
+		listByRef: (t) => b.sync(() => [...e.values()].filter((e) => e.refId === t)),
+		deleteByRef: (t) => b.sync(() => {
 			for (let [n, r] of e) r.refId === t && e.delete(n);
 		})
 	};
-}, Ut = (e) => ({
+}, Wt = (e) => ({
 	id: String(e.id),
 	refId: String(e.refId),
 	principalType: e.principalType,
@@ -1413,7 +1419,7 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 	createdAt: e.createdAt instanceof Date ? e.createdAt : new Date(String(e.createdAt)),
 	expiresAt: e.expiresAt ? e.expiresAt instanceof Date ? e.expiresAt : new Date(String(e.expiresAt)) : null,
 	createdBy: e.createdBy ?? null
-}), Wt = (e) => ({
+}), Gt = (e) => ({
 	insert: (t) => Z(() => e.insert(U, { ...t })),
 	delete: (t) => Z(() => e.delete(U, t)),
 	getById: (t) => Z(async () => {
@@ -1429,7 +1435,7 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 			skip: void 0,
 			projection: void 0
 		}))[0];
-		return n ? Ut(n) : null;
+		return n ? Wt(n) : null;
 	}),
 	listByRef: (t) => Z(async () => (await e.query({
 		table: U,
@@ -1445,7 +1451,7 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 		take: void 0,
 		skip: void 0,
 		projection: void 0
-	})).map(Ut)),
+	})).map(Wt)),
 	deleteByRef: (t) => Z(async () => {
 		let n = await e.query({
 			table: U,
@@ -1461,21 +1467,21 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 		});
 		for (let t of n) await e.delete(U, String(t.id));
 	})
-}), Gt = () => k({
+}), Kt = () => A({
 	kind: "typeid",
 	prefix: "file"
-}, H), Kt = () => k({
+}, H), qt = () => A({
 	kind: "typeid",
 	prefix: "grant"
-}, U), qt = (i) => {
-	let { provider: a, refStore: o, grantStore: s, bucket: c } = i, l = i.access ?? {}, u = i.attempts ?? 3, d = i.urlExpiresInSec ?? 3600, f = (e) => Pt(i.publicBaseUrl, e, i.httpPath ?? "/_voltro/storage"), p = S.recurs(Math.max(0, u - 1)).pipe(S.intersect(S.exponential("100 millis")), S.whileInput((e) => e.transient)), m = (e, t, n) => [
+}, U), Jt = (i) => {
+	let { provider: a, refStore: o, grantStore: s, bucket: c } = i, l = i.access ?? {}, u = i.attempts ?? 3, d = i.urlExpiresInSec ?? 3600, f = (e) => Ft(i.publicBaseUrl, e, i.httpPath ?? "/_voltro/storage"), p = C.recurs(Math.max(0, u - 1)).pipe(C.intersect(C.exponential("100 millis")), C.whileInput((e) => e.transient)), m = (e, t, n) => [
 		i.tenantPrefix,
 		e ?? "global",
 		n ?? t
 	].filter(Boolean).join("/"), ee = (e) => {
-		if (e === void 0) return y.succeed(void 0);
+		if (e === void 0) return b.succeed(void 0);
 		let n = e.length === 0 ? "empty" : e.includes("\0") ? "contains NUL" : e.startsWith("/") || e.startsWith("\\") ? "starts with a path separator" : e.includes("\\") ? "contains a backslash" : e.split("/").some((e) => e === "" || e === "." || e === "..") ? "contains an empty, \".\" or \"..\" segment" : void 0;
-		return n === void 0 ? y.succeed(e) : y.fail(new t({
+		return n === void 0 ? b.succeed(e) : b.fail(new t({
 			provider: a.name,
 			message: `storage key rejected: ${n}`,
 			transient: !1,
@@ -1487,41 +1493,46 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 		"_incoming",
 		t,
 		String(n).padStart(6, "0")
-	].filter(Boolean).join("/"), g = (e, n) => n !== void 0 && e.tenantId !== n ? y.fail(new t({
+	].filter(Boolean).join("/"), g = (e, n) => n !== void 0 && e.tenantId !== n ? b.fail(new t({
 		provider: a.name,
 		message: "cross-tenant access denied",
 		transient: !1,
 		status: 403
-	})) : y.succeed(e), te = (e, n) => y.gen(function* () {
-		let r = i.objects?.();
-		if (r === void 0) return !1;
-		let o = yield* y.tryPromise({
-			try: () => r.intent(e),
+	})) : b.succeed(e), _ = (e, n, r) => b.gen(function* () {
+		let o = i.objects?.(), s = (e) => new t({
+			provider: "metadata",
+			message: e,
+			transient: !1,
+			status: 409
+		});
+		if (o === void 0) return r === void 0 ? !1 : yield* b.fail(s(`claim '${r}' cannot be released: no data store is bound, so ref '${e}' holds no claims`));
+		let c = yield* b.tryPromise({
+			try: () => o.intent(e),
 			catch: (e) => new t({
 				provider: "metadata",
 				message: String(e?.message ?? e),
 				transient: !1
 			})
 		});
-		return o !== void 0 && (yield* g(o.ref, n), yield* Mt({
-			metadata: r,
+		return c === void 0 ? r === void 0 ? !1 : yield* b.fail(s(`claim '${r}' cannot be released: ref '${e}' was not written through an operation and holds no claims`)) : (yield* g(c.ref, n), yield* Nt({
+			metadata: o,
 			provider: {
 				...a,
-				delete: (e) => a.delete(e).pipe(y.retry(p))
+				delete: (e) => a.delete(e).pipe(b.retry(p))
 			}
-		}).delete(e, n).pipe(y.catchTag("StorageRejected", (e) => y.fail(new t({
+		}).delete(e, n, r).pipe(b.catchTag("StorageRejected", (e) => b.fail(e.reason === "claim-not-held" ? s(e.detail) : new t({
 			provider: "metadata",
 			message: e.detail,
 			transient: !1
 		})))), !0);
-	}), _ = (e, n) => o.getById(e).pipe(y.flatMap((r) => r ? g(r, n) : y.fail(new t({
+	}), v = (e, n) => o.getById(e).pipe(b.flatMap((r) => r ? g(r, n) : b.fail(new t({
 		provider: a.name,
 		message: `no ref '${e}'`,
 		transient: !1,
 		status: 404
-	})))), ne = (e) => y.suspend(() => {
+	})))), te = (e) => b.suspend(() => {
 		let n = i.scan(e);
-		return y.isEffect(n) ? n : y.tryPromise({
+		return b.isEffect(n) ? n : b.tryPromise({
 			try: () => Promise.resolve(n),
 			catch: (e) => new t({
 				provider: "scan",
@@ -1529,45 +1540,49 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 				transient: !0
 			})
 		});
-	}), re = (e) => y.suspend(() => {
+	}), ne = (e) => b.suspend(() => {
 		let t = e.contentType;
-		if (!i.videoProbe || !(t.startsWith("video/") || t.startsWith("audio/"))) return y.succeed(null);
+		if (!i.videoProbe || !(t.startsWith("video/") || t.startsWith("audio/"))) return b.succeed(null);
 		let n;
 		try {
 			n = i.videoProbe(e);
 		} catch {
-			return y.succeed(null);
+			return b.succeed(null);
 		}
-		return y.isEffect(n) ? n.pipe(y.catchAll(() => y.succeed(null))) : y.tryPromise({
+		return b.isEffect(n) ? n.pipe(b.catchAll(() => b.succeed(null))) : b.tryPromise({
 			try: () => Promise.resolve(n),
 			catch: () => null
-		}).pipe(y.catchAll(() => y.succeed(null)));
-	}), v = (e) => y.gen(function* () {
-		let t = Et(e.bytes, e.contentType, i.limits);
-		if (t) return yield* y.fail(new n(t));
+		}).pipe(b.catchAll(() => b.succeed(null)));
+	}), y = (e) => b.gen(function* () {
+		let t = Dt(e.bytes, e.contentType, i.limits);
+		if (t) return yield* b.fail(new n(t));
+		if (e.claim !== void 0 && e.operationId === void 0) return yield* b.fail(new n({
+			reason: "claim-without-operation",
+			detail: "a put with a claim needs an operationId; the claim names this caller's hold on that operation's object"
+		}));
 		if (i.scan) {
-			let t = yield* ne({
+			let t = yield* te({
 				bytes: e.bytes,
 				contentType: e.contentType,
 				...e.key ? { key: e.key } : {}
 			});
-			if (!t.clean) return yield* y.fail(new r({ threat: t.threat ?? "unknown" }));
+			if (!t.clean) return yield* b.fail(new r({ threat: t.threat ?? "unknown" }));
 		}
-		let s = yield* y.promise(() => Dt(e.bytes, e.contentType, { normalize: i.normalizeImages ?? !1 })), l = s.bytes, u = yield* re({
+		let s = yield* b.promise(() => Ot(e.bytes, e.contentType, { normalize: i.normalizeImages ?? !1 })), l = s.bytes, u = yield* ne({
 			bytes: l,
 			contentType: e.contentType
-		}), d = s.width ?? u?.width, f = s.height ?? u?.height, h = s.placeholder ?? u?.poster, g = e.duration ?? u?.duration, te = yield* y.promise(() => Nt(l)), _ = e.tenantId ?? null, v = e.visibility ?? "private", x = m(_, te, yield* ee(e.key)), S = e.password ? yield* y.sync(() => et(e.password)) : null, w = {
-			id: Gt(),
-			tenantId: _,
+		}), d = s.width ?? u?.width, f = s.height ?? u?.height, h = s.placeholder ?? u?.poster, g = e.duration ?? u?.duration, _ = yield* b.promise(() => Pt(l)), v = e.tenantId ?? null, y = e.visibility ?? "private", S = m(v, _, yield* ee(e.key)), C = e.password ? yield* b.sync(() => tt(e.password)) : null, T = {
+			id: Kt(),
+			tenantId: v,
 			ownerId: e.ownerId ?? null,
 			bucket: c,
-			key: x,
+			key: S,
 			contentType: e.contentType,
 			size: l.byteLength,
-			checksum: te,
-			visibility: v,
+			checksum: _,
+			visibility: y,
 			accessPolicy: e.access ?? null,
-			passwordHash: S,
+			passwordHash: C,
 			createdAt: /* @__PURE__ */ new Date(),
 			...d === void 0 ? {} : { width: d },
 			...f === void 0 ? {} : { height: f },
@@ -1579,23 +1594,23 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 			...e.caption === void 0 ? {} : { caption: e.caption },
 			...e.derivedFrom === void 0 ? {} : { derivedFrom: e.derivedFrom },
 			...e.kind === void 0 ? {} : { kind: e.kind }
-		}, ie = i.transcode !== void 0 && i.autoTranscode !== !1, T = (t) => ie && t.derivedFrom == null && (e.contentType.startsWith("video/") || e.contentType.startsWith("audio/")) ? y.forkDaemon(C(t).pipe(y.ignore)) : y.void;
+		}, re = i.transcode !== void 0 && i.autoTranscode !== !1, E = (t) => re && t.derivedFrom == null && (e.contentType.startsWith("video/") || e.contentType.startsWith("audio/")) ? b.forkDaemon(w(t).pipe(b.ignore)) : b.void;
 		if (e.operationId !== void 0) {
 			let t = i.objects?.();
-			if (t === void 0) return yield* y.fail(new n({
+			if (t === void 0) return yield* b.fail(new n({
 				reason: "operation-store-unbound",
 				detail: "a put with an operationId needs a bound data store; the in-memory ref store cannot hold operation intents"
 			}));
 			let r = {
-				tenantId: _,
+				tenantId: v,
 				bucket: c,
 				operationId: e.operationId,
-				checksum: te,
-				logicalKey: x,
-				fingerprint: yield* y.promise(() => Nt(new TextEncoder().encode(JSON.stringify([
-					te,
+				checksum: _,
+				logicalKey: S,
+				fingerprint: yield* b.promise(() => Pt(new TextEncoder().encode(JSON.stringify([
+					_,
 					e.contentType,
-					v,
+					y,
 					e.access ?? null,
 					e.key ?? null,
 					e.ownerId ?? null,
@@ -1608,56 +1623,63 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 					g ?? null,
 					e.password !== void 0
 				]))))
-			}, o = yield* Mt({
+			}, o = yield* Nt({
 				metadata: t,
 				provider: {
 					...a,
-					put: (e, t, n) => a.put(e, t, n).pipe(y.retry(p))
+					put: (e, t, n) => a.put(e, t, n).pipe(b.retry(p))
 				}
 			}).put({
 				identity: r,
-				ref: w,
+				ref: T,
 				bytes: l,
-				...i.quota === void 0 ? {} : { quota: i.quota }
+				...i.quota === void 0 ? {} : { quota: i.quota },
+				...e.claim === void 0 ? {} : { claim: e.claim }
 			});
-			return yield* T(o), o;
+			return yield* E(o.ref), {
+				...o.ref,
+				outcome: o.outcome
+			};
 		}
-		let ae = {
+		let ie = {
 			bytes: l.byteLength,
 			count: 1
-		}, oe = yield* o.consumeUsage(_, ae, i.quota);
-		if (!oe.allowed) {
-			let e = i.quota ?? {}, t = e.maxCount !== void 0 && oe.count + 1 > e.maxCount ? `tenant object count ${oe.count} + 1 exceeds max ${e.maxCount}` : `tenant usage ${oe.bytes} + ${l.byteLength} bytes exceeds max ${e.maxBytes}`;
-			return yield* y.fail(new n({
+		}, ae = yield* o.consumeUsage(v, ie, i.quota);
+		if (!ae.allowed) {
+			let e = i.quota ?? {}, t = e.maxCount !== void 0 && ae.count + 1 > e.maxCount ? `tenant object count ${ae.count} + 1 exceeds max ${e.maxCount}` : `tenant usage ${ae.bytes} + ${l.byteLength} bytes exceeds max ${e.maxBytes}`;
+			return yield* b.fail(new n({
 				reason: "quota-exceeded",
 				detail: t
 			}));
 		}
-		return yield* ((e) => e.pipe(y.onExit((e) => b.isSuccess(e) ? y.void : o.delete(w.id).pipe(y.zipRight(o.releaseUsage(_, ae)), y.ignore))))(o.insert(w).pipe(y.zipRight(a.put(x, l, {
+		return yield* ((e) => e.pipe(b.onExit((e) => x.isSuccess(e) ? b.void : o.delete(T.id).pipe(b.zipRight(o.releaseUsage(v, ie)), b.ignore))))(o.insert(T).pipe(b.zipRight(a.put(S, l, {
 			contentType: e.contentType,
-			public: v === "public"
-		}).pipe(y.retry(p))))), yield* T(w), w;
-	}), x = (e) => y.suspend(() => {
-		if (!i.transcode) return y.succeed([]);
+			public: y === "public"
+		}).pipe(b.retry(p))))), yield* E(T), {
+			...T,
+			outcome: "created"
+		};
+	}), S = (e) => b.suspend(() => {
+		if (!i.transcode) return b.succeed([]);
 		let t;
 		try {
 			t = i.transcode(e);
 		} catch {
-			return y.succeed([]);
+			return b.succeed([]);
 		}
-		return y.isEffect(t) ? t.pipe(y.catchAll(() => y.succeed([]))) : y.tryPromise({
+		return b.isEffect(t) ? t.pipe(b.catchAll(() => b.succeed([]))) : b.tryPromise({
 			try: () => Promise.resolve(t),
 			catch: () => []
-		}).pipe(y.catchAll(() => y.succeed([])));
-	}), C = (e) => y.gen(function* () {
+		}).pipe(b.catchAll(() => b.succeed([])));
+	}), w = (e) => b.gen(function* () {
 		if (!i.transcode || e.derivedFrom != null) return [];
-		let t = yield* a.get(e.key).pipe(y.retry(p)), n = yield* x({
+		let t = yield* a.get(e.key).pipe(b.retry(p)), n = yield* S({
 			bytes: t.bytes,
 			contentType: e.contentType,
 			ref: e
 		}), r = [];
 		for (let t of n) {
-			let n = yield* v({
+			let n = yield* y({
 				bytes: t.bytes,
 				contentType: t.contentType,
 				tenantId: e.tenantId,
@@ -1670,14 +1692,14 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 			r.push(n);
 		}
 		return r;
-	}), ie = (e, t, n) => y.gen(function* () {
-		if (e.visibility === "public" || (yield* ct(e, t, {
+	}), re = (e, t, n) => b.gen(function* () {
+		if (e.visibility === "public" || (yield* lt(e, t, {
 			...l,
 			...n?.password === void 0 ? {} : { password: n.password }
 		}))) return !0;
-		let r = yield* ft(t, l);
-		return dt(yield* s.listByRef(e.id), t, r, n?.permission ?? "read", Date.now());
-	}), T = (e) => {
+		let r = yield* pt(t, l);
+		return ft(yield* s.listByRef(e.id), t, r, n?.permission ?? "read", Date.now());
+	}), E = (e) => {
 		if (e.visibility === "public") {
 			let t = a.publicUrl?.(e.key);
 			if (t != null) return t;
@@ -1685,60 +1707,60 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 		return f(e.id);
 	};
 	return {
-		put: v,
-		get: (e, t) => _(e, t?.tenantId).pipe(y.flatMap((e) => a.get(e.key).pipe(y.retry(p), y.map((t) => ({
+		put: y,
+		get: (e, t) => v(e, t?.tenantId).pipe(b.flatMap((e) => a.get(e.key).pipe(b.retry(p), b.map((t) => ({
 			bytes: t.bytes,
 			ref: e
 		}))))),
-		getStream: (e, t) => _(e, t?.tenantId).pipe(y.map((e) => ({
+		getStream: (e, t) => v(e, t?.tenantId).pipe(b.map((e) => ({
 			ref: e,
-			stream: w.unwrap(y.suspend(() => a.getStream ? a.getStream(e.key).pipe(y.retry(p), y.map((e) => e.stream)) : a.get(e.key).pipe(y.retry(p), y.map((e) => w.make(e.bytes)))))
+			stream: T.unwrap(b.suspend(() => a.getStream ? a.getStream(e.key).pipe(b.retry(p), b.map((e) => e.stream)) : a.get(e.key).pipe(b.retry(p), b.map((e) => T.make(e.bytes)))))
 		}))),
-		getRange: (e, n, r) => _(e, r?.tenantId).pipe(y.flatMap((e) => {
+		getRange: (e, n, r) => v(e, r?.tenantId).pipe(b.flatMap((e) => {
 			let r = e.size, i = Math.max(0, Math.trunc(n.start));
-			if (r > 0 && i >= r) return y.fail(new t({
+			if (r > 0 && i >= r) return b.fail(new t({
 				provider: a.name,
 				message: `range start ${i} past end ${r}`,
 				transient: !1,
 				status: 416
 			}));
 			let o = Math.min(Math.trunc(n.endInclusive), Math.max(0, r - 1));
-			return o < i ? y.fail(new t({
+			return o < i ? b.fail(new t({
 				provider: a.name,
 				message: `empty range ${i}-${o}`,
 				transient: !1,
 				status: 416
-			})) : (a.getRange ? a.getRange(e.key, i, o).pipe(y.retry(p)) : a.get(e.key).pipe(y.retry(p), y.map((e) => e.bytes.subarray(i, o + 1)))).pipe(y.map((t) => ({
+			})) : (a.getRange ? a.getRange(e.key, i, o).pipe(b.retry(p)) : a.get(e.key).pipe(b.retry(p), b.map((e) => e.bytes.subarray(i, o + 1)))).pipe(b.map((t) => ({
 				bytes: t,
 				ref: e,
 				totalSize: r
 			})));
 		})),
-		getUrl: (e, t) => _(e, t?.tenantId).pipe(y.flatMap((e) => e.visibility === "public" ? y.succeed(T(e)) : a.presigns ? a.getUrl(e.key, t?.expiresInSec ?? d) : y.succeed(f(e.id)))),
-		head: (e, t) => o.getById(e).pipe(y.flatMap((e) => e ? g(e, t?.tenantId).pipe(y.map((e) => e)) : y.succeed(null))),
-		delete: (e, t) => te(e, t?.tenantId).pipe(y.flatMap((n) => n ? y.void : _(e, t?.tenantId).pipe(y.flatMap((t) => s.deleteByRef(e).pipe(y.flatMap(() => o.delete(e)), y.flatMap((e) => e ? o.countByKey(t.bucket, t.key).pipe(y.flatMap((e) => e === 0 ? a.delete(t.key).pipe(y.retry(p)) : y.void), y.flatMap(() => o.releaseUsage(t.tenantId, {
+		getUrl: (e, t) => v(e, t?.tenantId).pipe(b.flatMap((e) => e.visibility === "public" ? b.succeed(E(e)) : a.presigns ? a.getUrl(e.key, t?.expiresInSec ?? d) : b.succeed(f(e.id)))),
+		head: (e, t) => o.getById(e).pipe(b.flatMap((e) => e ? g(e, t?.tenantId).pipe(b.map((e) => e)) : b.succeed(null))),
+		delete: (e, t) => _(e, t?.tenantId, t?.claim).pipe(b.flatMap((n) => n ? b.void : v(e, t?.tenantId).pipe(b.flatMap((t) => s.deleteByRef(e).pipe(b.flatMap(() => o.delete(e)), b.flatMap((e) => e ? o.countByKey(t.bucket, t.key).pipe(b.flatMap((e) => e === 0 ? a.delete(t.key).pipe(b.retry(p)) : b.void), b.flatMap(() => o.releaseUsage(t.tenantId, {
 			bytes: t.size,
 			count: 1
-		}))) : y.void), y.asVoid))))),
-		mintUrl: (n, r, i) => y.gen(function* () {
-			let s = yield* o.getById(n).pipe(y.flatMap((e) => e ? y.succeed(e) : y.fail(new t({
+		}))) : b.void), b.asVoid))))),
+		mintUrl: (n, r, i) => b.gen(function* () {
+			let s = yield* o.getById(n).pipe(b.flatMap((e) => e ? b.succeed(e) : b.fail(new t({
 				provider: a.name,
 				message: `no ref '${n}'`,
 				transient: !1,
 				status: 404
 			}))));
-			if (s.visibility === "public") return T(s);
-			if (!(yield* ie(s, r, i?.password === void 0 ? {} : { password: i.password }))) return yield* y.fail(new e({
+			if (s.visibility === "public") return E(s);
+			if (!(yield* re(s, r, i?.password === void 0 ? {} : { password: i.password }))) return yield* b.fail(new e({
 				refId: n,
 				reason: "access denied"
 			}));
 			let c = i?.expiresInSec ?? d;
 			if (a.presigns) return yield* a.getUrl(s.key, c);
-			let l = yield* y.sync(() => pt(s.id, c));
+			let l = yield* b.sync(() => mt(s.id, c));
 			return `${f(s.id)}?t=${l}`;
 		}),
-		mintUploadUrl: (e) => y.gen(function* () {
-			if (!a.getUploadUrl) return yield* y.fail(new t({
+		mintUploadUrl: (e) => b.gen(function* () {
+			if (!a.getUploadUrl) return yield* b.fail(new t({
 				provider: a.name,
 				message: `provider '${a.name}' does not support presigned uploads`,
 				transient: !1,
@@ -1747,10 +1769,10 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 			let n = m(e.tenantId ?? null, "", yield* ee(e.key));
 			return yield* a.getUploadUrl(n, e.expiresInSec ?? d, e.contentType);
 		}),
-		checkAccess: ie,
-		grant: (e) => y.gen(function* () {
+		checkAccess: re,
+		grant: (e) => b.gen(function* () {
 			let t = {
-				id: Kt(),
+				id: qt(),
 				refId: e.refId,
 				principalType: e.principalType,
 				principalId: e.principalId,
@@ -1761,7 +1783,7 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 			};
 			return yield* s.insert(t), t;
 		}),
-		listRefs: (e) => y.suspend(() => {
+		listRefs: (e) => b.suspend(() => {
 			let t = Math.min(500, Math.max(1, Math.trunc(e?.limit ?? 50))), n = Math.max(0, Math.trunc(e?.offset ?? 0)), r = {
 				tenantId: e && "tenantId" in e ? e.tenantId : void 0,
 				folder: e?.folder,
@@ -1771,7 +1793,7 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 				limit: t + 1,
 				offset: n
 			};
-			return o.listRefs(r).pipe(y.map((e) => {
+			return o.listRefs(r).pipe(b.map((e) => {
 				let r = e.length > t;
 				return {
 					refs: r ? e.slice(0, t) : e,
@@ -1783,7 +1805,7 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 		getGrant: (e) => s.getById(e),
 		listGrants: (e) => s.listByRef(e),
 		usage: (e) => o.usageByTenant(e),
-		sweepOrphans: (e) => y.gen(function* () {
+		sweepOrphans: (e) => b.gen(function* () {
 			let t = e?.limit ?? 1e3, n = e?.dryRun ?? !1, r = yield* o.listRecent(t), i = [];
 			for (let e of r) if ((yield* a.head(e.key)) === null) {
 				if (!n) {
@@ -1800,9 +1822,9 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 				removed: i
 			};
 		}),
-		ingestUrl: (e, t) => jt(y.gen(function* () {
-			let n = yield* At(e, i.limits?.maxBytes);
-			return yield* v({
+		ingestUrl: (e, t) => Mt(b.gen(function* () {
+			let n = yield* jt(e, i.limits?.maxBytes);
+			return yield* y({
 				bytes: n.bytes,
 				contentType: t?.contentType ?? n.contentType,
 				...t?.tenantId === void 0 ? {} : { tenantId: t.tenantId },
@@ -1816,14 +1838,14 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 				...t?.caption === void 0 ? {} : { caption: t.caption }
 			});
 		}), t?.abortSignal),
-		mintPresignedUpload: (e) => y.gen(function* () {
-			if (!a.getUploadUrl) return yield* y.fail(new t({
+		mintPresignedUpload: (e) => b.gen(function* () {
+			if (!a.getUploadUrl) return yield* b.fail(new t({
 				provider: a.name,
 				message: `provider '${a.name}' does not support presigned uploads`,
 				transient: !1,
 				status: 400
 			}));
-			let n = e.expiresInSec ?? d, r = `_incoming/${k({
+			let n = e.expiresInSec ?? d, r = `_incoming/${A({
 				kind: "typeid",
 				prefix: "up"
 			}, H)}`, i = m(e.tenantId ?? null, "", r);
@@ -1833,7 +1855,7 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 				expiresInSec: n
 			};
 		}),
-		finalizeUpload: (e) => a.get(e.key).pipe(y.retry(p), y.flatMap((t) => v({
+		finalizeUpload: (e) => a.get(e.key).pipe(b.retry(p), b.flatMap((t) => y({
 			bytes: t.bytes,
 			contentType: e.contentType,
 			...e.tenantId === void 0 ? {} : { tenantId: e.tenantId },
@@ -1843,12 +1865,12 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 			...e.tags === void 0 ? {} : { tags: e.tags },
 			...e.alt === void 0 ? {} : { alt: e.alt },
 			...e.caption === void 0 ? {} : { caption: e.caption }
-		})), y.ensuring(a.delete(e.key).pipe(y.retry(p), y.ignore))),
-		putResumableChunk: (e) => a.put(h(e.tenantId ?? null, e.uploadId, e.index), e.bytes, { contentType: "application/octet-stream" }).pipe(y.retry(p), y.asVoid),
-		resumableStatus: (e) => y.gen(function* () {
+		})), b.ensuring(a.delete(e.key).pipe(b.retry(p), b.ignore))),
+		putResumableChunk: (e) => a.put(h(e.tenantId ?? null, e.uploadId, e.index), e.bytes, { contentType: "application/octet-stream" }).pipe(b.retry(p), b.asVoid),
+		resumableStatus: (e) => b.gen(function* () {
 			let t = 0, n = 0;
 			for (; t < 1e6;) {
-				let r = yield* a.head(h(e.tenantId ?? null, e.uploadId, t)).pipe(y.retry(p), y.catchAll(() => y.succeed(null)));
+				let r = yield* a.head(h(e.tenantId ?? null, e.uploadId, t)).pipe(b.retry(p), b.catchAll(() => b.succeed(null)));
 				if (r === null) break;
 				n += r.size, t += 1;
 			}
@@ -1857,16 +1879,16 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 				nextIndex: t
 			};
 		}),
-		finalizeResumable: (e) => y.gen(function* () {
+		finalizeResumable: (e) => b.gen(function* () {
 			let t = [];
 			for (let n = 0; n < e.count; n++) {
-				let r = yield* a.get(h(e.tenantId ?? null, e.uploadId, n)).pipe(y.retry(p));
+				let r = yield* a.get(h(e.tenantId ?? null, e.uploadId, n)).pipe(b.retry(p));
 				t.push(r.bytes);
 			}
 			let n = t.reduce((e, t) => e + t.byteLength, 0), r = new Uint8Array(n), i = 0;
 			for (let e of t) r.set(e, i), i += e.byteLength;
-			let o = y.forEach(Array.from({ length: e.count }, (e, t) => t), (t) => a.delete(h(e.tenantId ?? null, e.uploadId, t)).pipe(y.retry(p), y.ignore), { discard: !0 });
-			return yield* v({
+			let o = b.forEach(Array.from({ length: e.count }, (e, t) => t), (t) => a.delete(h(e.tenantId ?? null, e.uploadId, t)).pipe(b.retry(p), b.ignore), { discard: !0 });
+			return yield* y({
 				bytes: r,
 				contentType: e.contentType,
 				...e.tenantId === void 0 ? {} : { tenantId: e.tenantId },
@@ -1876,18 +1898,18 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 				...e.tags === void 0 ? {} : { tags: e.tags },
 				...e.alt === void 0 ? {} : { alt: e.alt },
 				...e.caption === void 0 ? {} : { caption: e.caption }
-			}).pipe(y.ensuring(o));
+			}).pipe(b.ensuring(o));
 		}),
-		transcode: (e, t) => _(e, t?.tenantId).pipe(y.flatMap((e) => C(e))),
-		renditions: (e, t) => _(e, t?.tenantId).pipe(y.flatMap(() => o.listByDerivedFrom(e))),
-		beginMultipartUpload: (e) => y.gen(function* () {
-			if (!a.createMultipartUpload || !a.presignUploadPart || !a.completeMultipartUpload) return yield* y.fail(new t({
+		transcode: (e, t) => v(e, t?.tenantId).pipe(b.flatMap((e) => w(e))),
+		renditions: (e, t) => v(e, t?.tenantId).pipe(b.flatMap(() => o.listByDerivedFrom(e))),
+		beginMultipartUpload: (e) => b.gen(function* () {
+			if (!a.createMultipartUpload || !a.presignUploadPart || !a.completeMultipartUpload) return yield* b.fail(new t({
 				provider: a.name,
 				message: `provider '${a.name}' does not support multipart uploads`,
 				transient: !1,
 				status: 400
 			}));
-			let n = m(e.tenantId ?? null, "", `multipart/${k({
+			let n = m(e.tenantId ?? null, "", `multipart/${A({
 				kind: "typeid",
 				prefix: "mp"
 			}, H)}`);
@@ -1896,29 +1918,29 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 				key: n
 			};
 		}),
-		signMultipartPart: (e) => y.suspend(() => a.presignUploadPart ? a.presignUploadPart(e.key, e.uploadId, e.partNumber, e.expiresInSec ?? d) : y.fail(new t({
+		signMultipartPart: (e) => b.suspend(() => a.presignUploadPart ? a.presignUploadPart(e.key, e.uploadId, e.partNumber, e.expiresInSec ?? d) : b.fail(new t({
 			provider: a.name,
 			message: "provider does not support multipart uploads",
 			transient: !1,
 			status: 400
 		}))),
-		completeMultipart: (e) => y.gen(function* () {
-			if (!a.completeMultipartUpload) return yield* y.fail(new t({
+		completeMultipart: (e) => b.gen(function* () {
+			if (!a.completeMultipartUpload) return yield* b.fail(new t({
 				provider: a.name,
 				message: "provider does not support multipart uploads",
 				transient: !1,
 				status: 400
 			}));
-			let r = yield* a.completeMultipartUpload(e.key, e.uploadId, e.parts), s = yield* a.head(e.key).pipe(y.retry(p)), l = s?.size ?? 0, u = (r.etag ?? s?.etag ?? "").replace(/"/g, ""), d = e.tenantId ?? null, f = {
+			let r = yield* a.completeMultipartUpload(e.key, e.uploadId, e.parts), s = yield* a.head(e.key).pipe(b.retry(p)), l = s?.size ?? 0, u = (r.etag ?? s?.etag ?? "").replace(/"/g, ""), d = e.tenantId ?? null, f = {
 				bytes: l,
 				count: 1
 			};
-			if (!(yield* o.consumeUsage(d, f, i.quota)).allowed) return yield* a.delete(e.key).pipe(y.retry(p), y.ignore), yield* y.fail(new n({
+			if (!(yield* o.consumeUsage(d, f, i.quota)).allowed) return yield* a.delete(e.key).pipe(b.retry(p), b.ignore), yield* b.fail(new n({
 				reason: "quota-exceeded",
 				detail: `multipart upload of ${l} bytes exceeds tenant quota`
 			}));
 			let m = {
-				id: Gt(),
+				id: Kt(),
 				tenantId: e.tenantId ?? null,
 				ownerId: e.ownerId ?? null,
 				bucket: c,
@@ -1935,105 +1957,110 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 				...e.alt === void 0 ? {} : { alt: e.alt },
 				...e.caption === void 0 ? {} : { caption: e.caption }
 			};
-			return yield* o.insert(m).pipe(y.onExit((e) => b.isSuccess(e) ? y.void : o.releaseUsage(d, f).pipe(y.ignore))), m;
+			return yield* o.insert(m).pipe(b.onExit((e) => x.isSuccess(e) ? b.void : o.releaseUsage(d, f).pipe(b.ignore))), m;
 		}),
-		abortMultipart: (e) => y.suspend(() => a.abortMultipartUpload ? a.abortMultipartUpload(e.key, e.uploadId).pipe(y.retry(p)) : y.void)
+		abortMultipart: (e) => b.suspend(() => a.abortMultipartUpload ? a.abortMultipartUpload(e.key, e.uploadId).pipe(b.retry(p)) : b.void)
 	};
-}, Jt = (e) => x.succeed(i, qt(e)), Yt = "_voltro_storage_operation_locks", Q = "_voltro_storage_object_heads", Xt = "_voltro_storage_operations", Zt = [
-	P(Yt, {
-		id: F().maxLength(64),
-		nonce: F()
+}, Yt = (e) => S.succeed(i, Jt(e)), Xt = "_voltro_storage_operation_locks", Q = "_voltro_storage_object_heads", Zt = "_voltro_storage_operations", Qt = "_voltro_storage_object_claims", $t = [
+	F(Xt, {
+		id: I().maxLength(64),
+		nonce: I()
+	}).primaryKey(["id"]).nonReactive(),
+	F(Q, {
+		id: I().maxLength(64),
+		generation: I(),
+		key: I(),
+		reservations: j()
 	}).primaryKey(["id"]).nonReactive(),
-	P(Q, {
-		id: F().maxLength(64),
-		generation: F(),
-		key: F(),
-		reservations: A()
+	F(Zt, {
+		id: I().maxLength(64),
+		objectId: I().maxLength(64),
+		fingerprint: I().maxLength(64),
+		generation: I(),
+		key: I(),
+		refId: I(),
+		state: I(),
+		deleteKey: I().nullable()
 	}).primaryKey(["id"]).nonReactive(),
-	P(Xt, {
-		id: F().maxLength(64),
-		objectId: F().maxLength(64),
-		fingerprint: F().maxLength(64),
-		generation: F(),
-		key: F(),
-		refId: F(),
-		state: F(),
-		deleteKey: F().nullable()
+	F(Qt, {
+		id: I().maxLength(64),
+		operationId: I().maxLength(64),
+		claim: I()
 	}).primaryKey(["id"]).nonReactive()
-], Qt = C.Struct({
-	id: C.String,
-	objectId: C.String,
-	fingerprint: C.String,
-	generation: C.String,
-	key: C.String,
-	refId: C.String,
-	state: C.Literal("reserved", "ready", "deleting", "deleted"),
-	deleteKey: C.NullOr(C.String)
-}), $t = C.Struct({
-	id: C.String,
-	generation: C.String,
-	key: C.String,
-	reservations: C.Int.pipe(C.nonNegative())
-}), en = (e) => I("sha256").update(JSON.stringify(e)).digest("hex"), tn = (e) => {
+], en = w.Struct({
+	id: w.String,
+	objectId: w.String,
+	fingerprint: w.String,
+	generation: w.String,
+	key: w.String,
+	refId: w.String,
+	state: w.Literal("reserved", "ready", "deleting", "deleted"),
+	deleteKey: w.NullOr(w.String)
+}), tn = w.Struct({
+	id: w.String,
+	generation: w.String,
+	key: w.String,
+	reservations: w.Int.pipe(w.nonNegative())
+}), nn = (e) => fe("sha256").update(JSON.stringify(e)).digest("hex"), rn = (e, t) => nn([e, t]), an = (e) => {
 	if (!e.bucket || !e.operationId || !e.logicalKey || !/^[a-f0-9]{64}$/.test(e.fingerprint) || !/^[a-f0-9]{64}$/.test(e.checksum)) throw Error("Storage operation requires a bucket, operation identity, key and SHA-256 fingerprint");
 	return {
-		id: en([
+		id: nn([
 			e.bucket,
 			e.tenantId,
 			e.operationId
 		]),
-		objectId: en([
+		objectId: nn([
 			e.bucket,
 			e.tenantId,
 			e.logicalKey,
 			e.checksum
 		]),
-		lockId: en([e.tenantId])
+		lockId: nn([e.tenantId])
 	};
-}, nn = async (e, t, n) => {
-	let { lockId: r } = tn(t);
-	return await e.insertIgnoreWithOutcome(Yt, {
+}, on = async (e, t, n) => {
+	let { lockId: r } = an(t);
+	return await e.insertIgnoreWithOutcome(Xt, {
 		id: r,
-		nonce: pe()
+		nonce: me()
 	}, { conflictColumns: ["id"] }), e.transactional(async (e) => {
 		if ((await e.query({
-			table: Yt,
-			predicate: O("id", r),
+			table: Xt,
+			predicate: k("id", r),
 			lock: "update",
 			order: [],
 			take: 1,
 			skip: void 0,
 			projection: void 0
-		})).length !== 1 || await e.update(Yt, r, { nonce: pe() }) === null) throw Error("Storage operation lock is unavailable");
+		})).length !== 1 || await e.update(Xt, r, { nonce: me() }) === null) throw Error("Storage operation lock is unavailable");
 		return n(e);
 	});
 }, $ = async (e, t) => {
-	let r = tn(t), i = await e.query({
-		table: Xt,
-		predicate: O("id", r.id),
+	let r = an(t), i = await e.query({
+		table: Zt,
+		predicate: k("id", r.id),
 		order: [],
 		take: 1,
 		skip: void 0,
 		projection: void 0
 	});
 	if (!i[0]) return;
-	let a = C.decodeUnknownSync(Qt)(i[0]);
+	let a = w.decodeUnknownSync(en)(i[0]);
 	if (a.fingerprint !== t.fingerprint || a.objectId !== r.objectId) throw new n({
 		reason: "operation-identity-reused",
 		detail: `storage operation '${t.operationId}' was already used with different inputs`
 	});
 	return a;
-}, rn = async (e, t) => {
+}, sn = async (e, t) => {
 	let n = await $(e, t);
 	if (n) return n;
-	let { id: r, objectId: i } = tn(t), a = await e.query({
+	let { id: r, objectId: i } = an(t), a = await e.query({
 		table: Q,
-		predicate: O("id", i),
+		predicate: k("id", i),
 		order: [],
 		take: 1,
 		skip: void 0,
 		projection: void 0
-	}), o = a[0] ? C.decodeUnknownSync($t)(a[0]) : void 0, s = o?.generation ?? pe(), c = o?.key ?? `${t.logicalKey}/g-${s}`;
+	}), o = a[0] ? w.decodeUnknownSync(tn)(a[0]) : void 0, s = o?.generation ?? me(), c = o?.key ?? `${t.logicalKey}/g-${s}`;
 	o ? await e.update(Q, i, { reservations: o.reservations + 1 }) : await e.insert(Q, {
 		id: i,
 		generation: s,
@@ -2046,35 +2073,35 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 		fingerprint: t.fingerprint,
 		generation: s,
 		key: c,
-		refId: `file_${pe()}`,
+		refId: `file_${me()}`,
 		state: "reserved",
 		deleteKey: null
 	};
-	return await e.insert(Xt, l), l;
-}, an = async (e, t) => {
+	return await e.insert(Zt, l), l;
+}, cn = async (e, t) => {
 	let n = await $(e, t);
 	if (!n) throw Error("Storage operation is missing");
 	if (n.state === "deleting" || n.state === "deleted") throw Error("Deleted storage operation cannot be confirmed by a late put");
-	return await e.update(Xt, n.id, { state: "ready" }), {
+	return await e.update(Zt, n.id, { state: "ready" }), {
 		...n,
 		state: "ready"
 	};
-}, on = async (e, t) => {
+}, ln = async (e, t) => {
 	let n = await $(e, t);
 	if (!n) throw Error("Storage operation is missing");
 	if (n.state === "deleting" || n.state === "deleted") return n;
 	if (n.state !== "ready") throw Error("An unconfirmed put cannot be deleted");
 	let r = await e.query({
 		table: Q,
-		predicate: O("id", n.objectId),
+		predicate: k("id", n.objectId),
 		order: [],
 		take: 1,
 		skip: void 0,
 		projection: void 0
-	}), i = r[0] ? C.decodeUnknownSync($t)(r[0]) : void 0;
+	}), i = r[0] ? w.decodeUnknownSync(tn)(r[0]) : void 0;
 	if (!i || i.generation !== n.generation || i.reservations < 1) throw Error("Storage object generation does not own its reservation");
 	let a = i.reservations === 1 ? i.key : null;
-	return a === null ? await e.update(Q, i.id, { reservations: i.reservations - 1 }) : await e.delete(Q, i.id), await e.update(Xt, n.id, {
+	return a === null ? await e.update(Q, i.id, { reservations: i.reservations - 1 }) : await e.delete(Q, i.id), await e.update(Zt, n.id, {
 		state: "deleting",
 		deleteKey: a
 	}), {
@@ -2082,26 +2109,46 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 		state: "deleting",
 		deleteKey: a
 	};
-}, sn = async (e, t) => {
+}, un = async (e, t) => {
 	let n = await $(e, t);
 	if (!n || n.state !== "deleting" && n.state !== "deleted") throw Error("Storage deletion has not been accepted");
-	return n.state !== "deleted" && (await e.update(Xt, n.id, { state: "deleted" }), !0);
-}, cn = "_voltro_storage_put_intents", ln = P(cn, {
-	id: F().maxLength(64),
-	refId: F().maxLength(64),
-	identity: j(),
-	ref: j()
-}).primaryKey(["id"]).unique("storagePutRef", ["refId"]).nonReactive(), un = C.Struct({
-	tenantId: C.NullOr(C.String),
-	bucket: C.String,
-	operationId: C.String,
-	fingerprint: C.String,
-	checksum: C.String,
-	logicalKey: C.String
-}), dn = async (e, t) => {
+	return n.state !== "deleted" && (await e.update(Zt, n.id, { state: "deleted" }), !0);
+}, dn = async (e, t, n) => {
+	if (!n) throw Error("Storage object claim must be a non-empty string");
+	await e.insertIgnoreWithOutcome(Qt, {
+		id: rn(t, n),
+		operationId: t,
+		claim: n
+	}, { conflictColumns: ["id"] });
+}, fn = async (e, t, n) => {
+	let r = rn(t, n);
+	return {
+		held: await e.delete(Qt, r),
+		others: (await e.query({
+			table: Qt,
+			predicate: D(k("operationId", t), P("claim", n)),
+			order: [],
+			take: 1,
+			skip: void 0,
+			projection: void 0
+		})).length > 0
+	};
+}, pn = (e, t) => e.deleteMany(Qt, { where: k("operationId", t) }), mn = "_voltro_storage_put_intents", hn = F(mn, {
+	id: I().maxLength(64),
+	refId: I().maxLength(64),
+	identity: M(),
+	ref: M()
+}).primaryKey(["id"]).unique("storagePutRef", ["refId"]).nonReactive(), gn = w.Struct({
+	tenantId: w.NullOr(w.String),
+	bucket: w.String,
+	operationId: w.String,
+	fingerprint: w.String,
+	checksum: w.String,
+	logicalKey: w.String
+}), _n = async (e, t) => {
 	let n = await e.query({
-		table: cn,
-		predicate: O("refId", t),
+		table: mn,
+		predicate: k("refId", t),
 		order: [],
 		take: 2,
 		skip: void 0,
@@ -2109,7 +2156,7 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 	});
 	if (n.length === 0) return;
 	if (n.length !== 1) throw Error("Storage reference has ambiguous operation ownership");
-	let r = n[0], i = C.decodeUnknownSync(un)(r.identity);
+	let r = n[0], i = w.decodeUnknownSync(gn)(r.identity);
 	if (typeof r.ref != "object" || r.ref === null || Array.isArray(r.ref)) throw Error("Storage operation reference is unreadable");
 	let a = X(r.ref);
 	if (a.id !== t || a.bucket !== i.bucket || a.tenantId !== i.tenantId || a.checksum !== i.checksum || !Number.isSafeInteger(a.size) || a.size < 0 || !Number.isFinite(a.createdAt.getTime())) throw Error("Storage operation reference does not match its identity");
@@ -2117,81 +2164,98 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 		identity: i,
 		ref: a
 	};
-}, fn = (e) => ({
-	intent: (t) => dn(e, t),
-	reserve: (t, r, i) => nn(e, t, async (e) => {
+}, vn = (e) => ({
+	intent: (t) => _n(e, t),
+	reserve: (t, r, i, a) => on(e, t, async (e) => {
 		if (r.tenantId !== t.tenantId || r.bucket !== t.bucket || r.checksum !== t.checksum || !Number.isSafeInteger(r.size) || r.size < 0) throw Error("Storage put metadata does not match its identity");
-		let a = await $(e, t);
-		if (a) {
-			if (a.state === "deleting" || a.state === "deleted") throw Error("Storage put identity has already been deleted");
-			let t = await dn(e, a.refId);
+		let o = await $(e, t);
+		if (o) {
+			if (o.state === "deleting" || o.state === "deleted") throw Error("Storage put identity has already been deleted");
+			let t = await _n(e, o.refId);
 			if (!t) throw Error("Storage operation lost its put intent");
-			return {
+			let n = o.state === "ready";
+			return n && a !== void 0 && await dn(e, o.id, a), {
 				ref: t.ref,
-				ready: a.state === "ready"
+				ready: n,
+				outcome: n ? "joined" : "resumed"
 			};
 		}
-		let o = await rn(e, t), s = Vt(e);
-		if (!(await y.runPromise(s.consumeUsage(t.tenantId, {
+		let s = await sn(e, t), c = Ht(e);
+		if (!(await b.runPromise(c.consumeUsage(t.tenantId, {
 			bytes: r.size,
 			count: 1
 		}, i))).allowed) throw new n({
 			reason: "quota-exceeded",
 			detail: "Storage operation exceeds tenant quota"
 		});
-		let c = X({
+		let l = X({
 			...r,
-			id: o.refId,
-			key: o.key
+			id: s.refId,
+			key: s.key
 		});
-		return await e.insert(cn, {
-			id: o.id,
-			refId: c.id,
+		return await e.insert(mn, {
+			id: s.id,
+			refId: l.id,
 			identity: t,
-			ref: c
+			ref: l
 		}), {
-			ref: c,
-			ready: !1
+			ref: l,
+			ready: !1,
+			outcome: "created"
 		};
 	}),
-	confirm: (t) => nn(e, t, async (e) => {
-		let n = await $(e, t);
-		if (!n) throw Error("Storage put operation is missing");
-		let r = await dn(e, n.refId);
-		if (!r) throw Error("Storage put intent is missing");
-		if (n.state === "ready") {
-			let r = await y.runPromise(Vt(e).getById(n.refId));
-			if (!r || r.key !== n.key || r.checksum !== t.checksum) throw Error("Confirmed storage operation lost its reference");
-			return r;
+	confirm: (t, n) => on(e, t, async (e) => {
+		let r = await $(e, t);
+		if (!r) throw Error("Storage put operation is missing");
+		let i = await _n(e, r.refId);
+		if (!i) throw Error("Storage put intent is missing");
+		if (n !== void 0 && await dn(e, r.id, n), r.state === "ready") {
+			let n = await b.runPromise(Ht(e).getById(r.refId));
+			if (!n || n.key !== r.key || n.checksum !== t.checksum) throw Error("Confirmed storage operation lost its reference");
+			return n;
 		}
-		return await an(e, t), await y.runPromise(Vt(e).insert(r.ref)), r.ref;
+		return await cn(e, t), await b.runPromise(Ht(e).insert(i.ref)), i.ref;
 	}),
-	beginDelete: async (t, n) => {
-		let r = await dn(e, t);
-		if (!r) throw Error("Storage delete operation is missing");
-		if (n !== void 0 && r.identity.tenantId !== n) throw Error("Storage delete tenant mismatch");
-		return nn(e, r.identity, async (e) => {
-			let n = await dn(e, t);
-			if (!n) throw Error("Storage delete intent disappeared");
-			let r = await $(e, n.identity);
-			if (!r) throw Error("Storage delete lost its operation");
-			let i = await on(e, n.identity);
-			if (r.state === "ready") {
-				let r = Vt(e);
-				if (await y.runPromise(Wt(e).deleteByRef(t)), !await y.runPromise(r.delete(t))) throw Error("Storage deletion lost its confirmed reference");
-				await y.runPromise(r.releaseUsage(n.identity.tenantId, {
-					bytes: n.ref.size,
+	beginDelete: async (t, r, i) => {
+		let a = await _n(e, t);
+		if (!a) throw Error("Storage delete operation is missing");
+		if (r !== void 0 && a.identity.tenantId !== r) throw Error("Storage delete tenant mismatch");
+		return on(e, a.identity, async (e) => {
+			let r = await _n(e, t);
+			if (!r) throw Error("Storage delete intent disappeared");
+			let a = await $(e, r.identity);
+			if (!a) throw Error("Storage delete lost its operation");
+			let o = a.state !== "deleting" && a.state !== "deleted";
+			if (i === void 0) o && await pn(e, a.id);
+			else if (o) {
+				let o = await fn(e, a.id, i);
+				if (o.others) return {
+					released: !0,
+					identity: r.identity
+				};
+				if (!o.held) throw new n({
+					reason: "claim-not-held",
+					detail: `claim '${i}' is not held on storage reference '${t}'; a reference put without a claim is deleted as a whole by a delete that names none`
+				});
+			}
+			let s = await ln(e, r.identity);
+			if (a.state === "ready") {
+				let n = Ht(e);
+				if (await b.runPromise(Gt(e).deleteByRef(t)), !await b.runPromise(n.delete(t))) throw Error("Storage deletion lost its confirmed reference");
+				await b.runPromise(n.releaseUsage(r.identity.tenantId, {
+					bytes: r.ref.size,
 					count: 1
 				}));
 			}
 			return {
-				operation: i,
-				identity: n.identity
+				released: !0,
+				operation: s,
+				identity: r.identity
 			};
 		});
 	},
-	confirmDelete: (t) => nn(e, t, (e) => sn(e, t))
-}), pn = (e, t = 65536) => {
+	confirmDelete: (t) => on(e, t, (e) => un(e, t))
+}), yn = (e, t = 65536) => {
 	let n = [Buffer.from("zINSTREAM\0", "utf8")];
 	for (let r = 0; r < e.length; r += t) {
 		let i = e.subarray(r, Math.min(r + t, e.length)), a = Buffer.alloc(4);
@@ -2199,7 +2263,7 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 	}
 	let r = Buffer.alloc(4);
 	return r.writeUInt32BE(0, 0), n.push(r), Buffer.concat(n);
-}, mn = (e) => {
+}, bn = (e) => {
 	let t = e.replace(/\0+$/, "").trim();
 	if (/\bOK$/.test(t)) return { clean: !0 };
 	let n = /:\s*(.+?)\s+FOUND$/.exec(t);
@@ -2208,7 +2272,7 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 		threat: n[1] ?? "unknown"
 	};
 	throw Error(`clamav: unexpected response: ${t}`);
-}, hn = async (e, t) => {
+}, xn = async (e, t) => {
 	let n = await import("node:net"), r = G.read("CLAMAV_HOST", t.host) ?? "127.0.0.1", i = G.read("CLAMAV_PORT"), a = t.port ?? (i ? Number(i) : 3310), o = t.timeoutMs ?? 3e4;
 	return new Promise((i, s) => {
 		let c = n.createConnection({
@@ -2220,20 +2284,20 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 		c.on("error", (e) => {
 			clearTimeout(u), s(e);
 		}), c.on("connect", () => {
-			c.end(pn(e, t.chunkSize));
+			c.end(yn(e, t.chunkSize));
 		}), c.on("data", (e) => {
 			l += e.toString("utf8");
 		}), c.on("close", () => {
 			clearTimeout(u);
 			try {
-				i(mn(l));
+				i(bn(l));
 			} catch (e) {
 				s(e);
 			}
 		});
 	});
-}, gn = (e = {}) => (t) => hn(t.bytes, e), _n = (e, t, n) => new Promise((r, i) => {
-	let a = he(e, [...t], { stdio: [
+}, Sn = (e = {}) => (t) => xn(t.bytes, e), Cn = (e, t, n) => new Promise((r, i) => {
+	let a = ge(e, [...t], { stdio: [
 		"ignore",
 		"ignore",
 		"pipe"
@@ -2247,31 +2311,31 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 	}), a.on("close", (e) => {
 		clearTimeout(s), e === 0 ? r() : i(/* @__PURE__ */ Error(`ffmpeg exited ${String(e)}: ${o.slice(-400)}`));
 	});
-}), vn = (e) => async ({ bytes: t }) => {
-	let n = e.ffmpegPath ?? "ffmpeg", r = e.timeoutMs ?? 3e5, i = await ge(B(be(), "voltro-tc-")), a = B(i, "in"), o = [];
+}), wn = (e) => async ({ bytes: t }) => {
+	let n = e.ffmpegPath ?? "ffmpeg", r = e.timeoutMs ?? 3e5, i = await _e(V(B(), "voltro-tc-")), a = V(i, "in"), o = [];
 	try {
-		await ye(a, t);
+		await be(a, t);
 		for (let t of e.renditions) {
-			let e = B(i, `out.${t.ext}`);
+			let e = V(i, `out.${t.ext}`);
 			try {
-				await _n(n, [
+				await Cn(n, [
 					"-y",
 					"-i",
 					a,
 					...t.args,
 					e
 				], r);
-				let i = await _e(e);
+				let i = await ve(e);
 				o.push({
 					bytes: new Uint8Array(i),
 					contentType: t.contentType,
 					kind: t.kind,
 					...t.label === void 0 ? {} : { label: t.label }
-				}), await ve(e, { force: !0 });
+				}), await ye(e, { force: !0 });
 			} catch {}
 		}
 	} finally {
-		await ve(i, {
+		await ye(i, {
 			recursive: !0,
 			force: !0
 		}).catch(() => void 0);
@@ -2280,21 +2344,21 @@ var xe = 1 << 20, Se = (e, n, r = !1) => new t({
 };
 //#endregion
 //#region src/assetRef.ts
-function yn(e = {}) {
-	let t = e.nullable ?? !0, n = e.fk === !1 ? F().externalId() : ue(() => je, { onDelete: e.onDelete ?? "setNull" });
+function Tn(e = {}) {
+	let t = e.nullable ?? !0, n = e.fk === !1 ? I().externalId() : ue(() => Me, { onDelete: e.onDelete ?? "setNull" });
 	return t ? n.nullable() : n;
 }
-var bn = () => M({
+var En = () => N({
 	id: "@voltro/plugin-storage/withStorage",
-	fields: { asset: yn() }
-}), xn = {
+	fields: { asset: Tn() }
+}), Dn = {
 	"image/png": "png",
 	"image/jpeg": "jpg",
 	"image/jpg": "jpg",
 	"image/gif": "gif",
 	"image/webp": "webp",
 	"image/svg+xml": "svg"
-}, Sn = (e) => {
+}, On = (e) => {
 	let t = /^data:([^;,]+)(;base64)?,(.*)$/s.exec(e);
 	if (!t) throw Error("not a data URI");
 	let n = t[1] || "application/octet-stream", r = !!t[2], i = t[3] ?? "";
@@ -2302,16 +2366,16 @@ var bn = () => M({
 		bytes: r ? new Uint8Array(Buffer.from(i, "base64")) : new Uint8Array(Buffer.from(decodeURIComponent(i), "utf8")),
 		contentType: n
 	};
-}, Cn = (e, n) => y.gen(function* () {
-	let r = yield* y.try({
-		try: () => Sn(n.dataUri),
+}, kn = (e, n) => b.gen(function* () {
+	let r = yield* b.try({
+		try: () => On(n.dataUri),
 		catch: (e) => new t({
 			provider: "avatar",
 			message: String(e?.message ?? e),
 			transient: !1,
 			status: 400
 		})
-	}), i = xn[r.contentType] ?? "bin";
+	}), i = Dn[r.contentType] ?? "bin";
 	return yield* e.put({
 		bytes: r.bytes,
 		contentType: r.contentType,
@@ -2320,27 +2384,27 @@ var bn = () => M({
 		visibility: "public",
 		key: `avatars/${n.userId}/avatar.${i}`
 	});
-}), wn = (e) => {
+}), An = (e) => {
 	try {
-		let t = V(e), n = V("/");
+		let t = xe(e), n = xe("/");
 		return typeof t.dev != "number" || typeof n.dev != "number" ? "unknown" : t.dev === n.dev ? "same-device-as-root" : "separate-mount";
 	} catch {
 		return "unknown";
 	}
-}, Tn = (e) => {
-	if (wn(e) === "same-device-as-root") return `the capture is going to ${e}, which is on the SAME filesystem as \`/\`.\n  A mounted volume would be a separate one. If this process is a container, that means the capture
+}, jn = (e) => {
+	if (An(e) === "same-device-as-root") return `the capture is going to ${e}, which is on the SAME filesystem as \`/\`.\n  A mounted volume would be a separate one. If this process is a container, that means the capture
   dies with it — which is the exact failure it exists for. On a development machine this is normal
   and can be ignored.`;
-}, En = G.read("VOLTRO_SESSION_COOKIE") ?? "voltro:session", Dn, On = (e) => {
-	Dn = e;
-}, kn = () => Dn ?? jn({}), An = () => Dn === void 0 ? G.read("STORAGE_PROVIDER") === void 0 ? void 0 : jn({}) : Dn, jn = (e) => {
+}, Mn = G.read("VOLTRO_SESSION_COOKIE") ?? "voltro:session", Nn, Pn = (e) => {
+	Nn = e;
+}, Fn = () => Nn ?? Ln({}), In = () => Nn === void 0 ? G.read("STORAGE_PROVIDER") === void 0 ? void 0 : Ln({}) : Nn, Ln = (e) => {
 	if (e.provider && typeof e.provider == "object") return e.provider;
 	let t = (e.provider ?? G.read("STORAGE_PROVIDER") ?? "memory").toLowerCase(), n = G.read("S3_BUCKET", e.bucket) ?? G.read("STORAGE_BUCKET") ?? "voltro";
 	switch (t) {
 		case "s3":
 		case "minio": {
 			let r = G.read("S3_REGION", e.region) ?? G.read("AWS_REGION"), i = G.read("S3_ENDPOINT", e.endpoint) ?? G.read("MINIO_ENDPOINT"), a = G.read("S3_ACCESS_KEY_ID", e.accessKeyId) ?? G.read("AWS_ACCESS_KEY_ID"), o = G.read("S3_SECRET_ACCESS_KEY", e.secretAccessKey) ?? G.read("AWS_SECRET_ACCESS_KEY"), s = G.read("STORAGE_CDN_URL", e.cdnBaseUrl);
-			return Ve({
+			return He({
 				bucket: n,
 				name: t,
 				...r ? { region: r } : {},
@@ -2354,7 +2418,7 @@ var bn = () => M({
 		}
 		case "azure": {
 			let t = G.read("AZURE_STORAGE_ACCOUNT", e.accountName), r = G.read("AZURE_STORAGE_KEY", e.accountKey), i = G.read("AZURE_STORAGE_CONNECTION_STRING", e.connectionString), a = G.read("AZURE_STORAGE_ENDPOINT", e.endpoint), o = G.read("STORAGE_CDN_URL", e.cdnBaseUrl);
-			return We({
+			return Ge({
 				container: G.read("AZURE_STORAGE_CONTAINER", e.bucket) ?? n,
 				...t ? { accountName: t } : {},
 				...r ? { accountKey: r } : {},
@@ -2363,15 +2427,15 @@ var bn = () => M({
 				...o ? { cdnBaseUrl: o } : {}
 			});
 		}
-		case "database": return Ue();
-		case "filesystem": return Be({ root: G.read("STORAGE_ROOT", e.root) ?? ".voltro-storage" });
-		default: return ze(e.name ?? "default");
+		case "database": return We();
+		case "filesystem": return Ve({ root: G.read("STORAGE_ROOT", e.root) ?? ".voltro-storage" });
+		default: return Be(e.name ?? "default");
 	}
-}, Mn = (e) => {
+}, Rn = (e) => {
 	if (e !== void 0) return e;
 	let t = G.read("STORAGE_ALLOWED_ORIGINS");
 	return t ? t.trim() === "*" ? "*" : t.split(",").map((e) => e.trim()).filter(Boolean) : [];
-}, Nn = (e, t) => {
+}, zn = (e, t) => {
 	if (!e || t !== "*" && !t.includes(e)) return {};
 	let n = {
 		"access-control-allow-origin": t === "*" ? "*" : e,
@@ -2381,7 +2445,7 @@ var bn = () => M({
 		vary: "Origin"
 	};
 	return t !== "*" && (n["access-control-allow-credentials"] = "true"), n;
-}, Pn = (e) => ({
+}, Bn = (e) => ({
 	id: e.id,
 	tenantId: e.tenantId,
 	ownerId: e.ownerId,
@@ -2404,29 +2468,29 @@ var bn = () => M({
 	caption: e.caption ?? null,
 	derivedFrom: e.derivedFrom ?? null,
 	kind: e.kind ?? null
-}), Fn = () => new t({
+}), Vn = () => new t({
 	provider: "storage",
 	message: "not permitted to administer sharing for this object",
 	transient: !1,
 	status: 403
-}), In = (e, t, n) => {
+}), Hn = (e, t, n) => {
 	let r = n.request.subject;
-	return (r.scopes ?? []).includes("admin:full") ? y.void : e.head(t, { tenantId: r.tenantId ?? null }).pipe(y.catchAll(() => y.fail(Fn())), y.flatMap((e) => {
+	return (r.scopes ?? []).includes("admin:full") ? b.void : e.head(t, { tenantId: r.tenantId ?? null }).pipe(b.catchAll(() => b.fail(Vn())), b.flatMap((e) => {
 		let t = e?.ownerId;
-		return t != null && t === r.id ? y.void : y.fail(Fn());
+		return t != null && t === r.id ? b.void : b.fail(Vn());
 	}));
-}, Ln = () => new t({
+}, Un = () => new t({
 	provider: "storage",
 	message: "an upload needs an identified caller: this request carries no subject, and the app has not set `anonymousUploads: true` on storagePlugin. The ticket attributes the object to whoever minted it — with no subject there is nobody to attribute it to, so the finalized object would carry no owner and no tenant and no later owner check, tenant filter or quota could reach it.",
 	transient: !1,
 	status: 401
-}), Rn = (e, t) => {
+}), Wn = (e, t) => {
 	let n = e.request.subject.id ?? null, r = e.request.subject.tenantId ?? null;
-	return n === null && !t ? y.fail(Ln()) : y.succeed({
+	return n === null && !t ? b.fail(Un()) : b.succeed({
 		id: n,
 		tenantId: r
 	});
-}, zn = (e, t) => e !== null && e !== (t ?? null), Bn = (e) => ({
+}, Gn = (e, t) => e !== null && e !== (t ?? null), Kn = (e) => ({
 	id: e.id,
 	refId: e.refId,
 	principalType: e.principalType,
@@ -2435,41 +2499,41 @@ var bn = () => M({
 	createdAt: e.createdAt.toISOString(),
 	expiresAt: e.expiresAt ? e.expiresAt.toISOString() : null,
 	createdBy: e.createdBy
-}), Vn = "@voltro/plugin-storage", Hn = (e = {}) => T({
-	base: Vn,
+}), qn = "@voltro/plugin-storage", Jn = (e = {}) => E({
+	base: qn,
 	alias: e.alias,
 	instance: e.name
-}), Un = (i = {}) => {
-	let v = T({
-		base: Vn,
+}), Yn = (i = {}) => {
+	let y = E({
+		base: qn,
 		alias: i.alias,
 		instance: i.name
-	}), b = v === Vn ? "/_voltro/storage" : `/_voltro/storage/i/${Buffer.from(v).toString("hex")}`, x = jn(i);
-	On(x);
-	let S = G.read("S3_BUCKET", i.bucket) ?? G.read("STORAGE_BUCKET") ?? "voltro", E = G.read("VOLTRO_PUBLIC_URL", i.publicBaseUrl), ce = Mn(i.allowedOrigins), D = i.limits?.maxBytes, O = i.anonymousUploads === !0, k = 5242880, le = 21600, A = i.refStore === void 0 || i.refStore === "memory", j = i.grantStore === void 0 || i.grantStore === "memory", M = { current: A ? Rt() : i.refStore }, N = { current: j ? Ht() : i.grantStore }, ue = { current: void 0 }, P = {
-		insert: (e) => M.current.insert(e),
-		getById: (e) => M.current.getById(e),
-		delete: (e) => M.current.delete(e),
-		statistics: () => M.current.statistics(),
-		listRecent: (e) => M.current.listRecent(e),
-		countByKey: (e, t) => M.current.countByKey(e, t),
-		usageByTenant: (e) => M.current.usageByTenant(e),
-		consumeUsage: (e, t, n) => M.current.consumeUsage(e, t, n),
-		releaseUsage: (e, t) => M.current.releaseUsage(e, t),
-		listByDerivedFrom: (e) => M.current.listByDerivedFrom(e),
-		listRefs: (e) => M.current.listRefs(e)
-	}, F = {
+	}), x = y === qn ? "/_voltro/storage" : `/_voltro/storage/i/${Buffer.from(y).toString("hex")}`, S = Ln(i);
+	Pn(S);
+	let C = G.read("S3_BUCKET", i.bucket) ?? G.read("STORAGE_BUCKET") ?? "voltro", D = G.read("VOLTRO_PUBLIC_URL", i.publicBaseUrl), se = Rn(i.allowedOrigins), O = i.limits?.maxBytes, k = i.anonymousUploads === !0, A = 5242880, ce = 21600, j = i.refStore === void 0 || i.refStore === "memory", M = i.grantStore === void 0 || i.grantStore === "memory", N = { current: j ? zt() : i.refStore }, P = { current: M ? Ut() : i.grantStore }, le = { current: void 0 }, ue = {
 		insert: (e) => N.current.insert(e),
-		delete: (e) => N.current.delete(e),
 		getById: (e) => N.current.getById(e),
-		listByRef: (e) => N.current.listByRef(e),
-		deleteByRef: (e) => N.current.deleteByRef(e)
-	}, de = {
-		httpPath: b,
-		provider: x,
-		refStore: P,
+		delete: (e) => N.current.delete(e),
+		statistics: () => N.current.statistics(),
+		listRecent: (e) => N.current.listRecent(e),
+		countByKey: (e, t) => N.current.countByKey(e, t),
+		usageByTenant: (e) => N.current.usageByTenant(e),
+		consumeUsage: (e, t, n) => N.current.consumeUsage(e, t, n),
+		releaseUsage: (e, t) => N.current.releaseUsage(e, t),
+		listByDerivedFrom: (e) => N.current.listByDerivedFrom(e),
+		listRefs: (e) => N.current.listRefs(e)
+	}, F = {
+		insert: (e) => P.current.insert(e),
+		delete: (e) => P.current.delete(e),
+		getById: (e) => P.current.getById(e),
+		listByRef: (e) => P.current.listByRef(e),
+		deleteByRef: (e) => P.current.deleteByRef(e)
+	}, I = {
+		httpPath: x,
+		provider: S,
+		refStore: ue,
 		grantStore: F,
-		bucket: S,
+		bucket: C,
 		...i.tenantPrefix === void 0 ? {} : { tenantPrefix: i.tenantPrefix },
 		...i.attempts === void 0 ? {} : { attempts: i.attempts },
 		...i.urlExpiresInSec === void 0 ? {} : { urlExpiresInSec: i.urlExpiresInSec },
@@ -2479,11 +2543,11 @@ var bn = () => M({
 		...i.videoProbe === void 0 ? {} : { videoProbe: i.videoProbe },
 		...i.transcode === void 0 ? {} : { transcode: i.transcode },
 		...i.autoTranscode === void 0 ? {} : { autoTranscode: i.autoTranscode },
-		...E ? { publicBaseUrl: E } : {},
+		...D ? { publicBaseUrl: D } : {},
 		...i.normalizeImages === void 0 ? {} : { normalizeImages: i.normalizeImages },
 		...i.quota === void 0 ? {} : { quota: i.quota },
-		objects: () => ue.current
-	}, fe = Jt(de), I = qt(de), L = `${b}/`, R = (e) => y.runPromise(e.pipe(y.catchAll(() => y.succeed(null)))), me = (e, t) => {
+		objects: () => le.current
+	}, de = Yt(I), L = Jt(I), fe = `${x}/`, R = (e) => b.runPromise(e.pipe(b.catchAll(() => b.succeed(null)))), pe = (e, t) => {
 		if (!e) return "invalid";
 		let n = /^bytes=(\d*)-(\d*)$/.exec(e.trim());
 		if (!n) return "invalid";
@@ -2504,30 +2568,30 @@ var bn = () => M({
 			start: a,
 			endInclusive: o
 		};
-	}, z = /^(?:image\/(?!svg)|video\/|audio\/|application\/pdf(?:;|$)|text\/plain(?:;|$))/i, he = (e) => ({
+	}, he = /^(?:image\/(?!svg)|video\/|audio\/|application\/pdf(?:;|$)|text\/plain(?:;|$))/i, z = (e) => ({
 		"x-content-type-options": "nosniff",
-		"content-disposition": z.test(e) ? "inline" : "attachment"
+		"content-disposition": he.test(e) ? "inline" : "attachment"
 	}), ge = async (e, t, n, r) => {
 		if (n) {
-			let r = await R(I.get(e.id));
+			let r = await R(L.get(e.id));
 			if (!r) return {
 				status: 404,
 				body: "not found",
 				contentType: "text/plain"
 			};
-			let i = await $e(e.id, r.bytes, e.contentType, n).catch(() => null), a = i ? i.bytes : r.bytes, o = i ? i.contentType : e.contentType;
+			let i = await et(e.id, r.bytes, e.contentType, n).catch(() => null), a = i ? i.bytes : r.bytes, o = i ? i.contentType : e.contentType;
 			return {
 				status: 200,
 				body: a,
 				contentType: o,
 				headers: {
-					...he(o),
+					...z(o),
 					"cache-control": t,
 					"accept-ranges": "none"
 				}
 			};
 		}
-		let i = r === void 0 ? "invalid" : me(r, e.size);
+		let i = r === void 0 ? "invalid" : pe(r, e.size);
 		if (i === "unsatisfiable") return {
 			status: 416,
 			body: "range not satisfiable",
@@ -2538,13 +2602,13 @@ var bn = () => M({
 			}
 		};
 		if (i !== "invalid") {
-			let n = await R(I.getRange(e.id, i));
+			let n = await R(L.getRange(e.id, i));
 			return n ? {
 				status: 206,
 				body: n.bytes,
 				contentType: e.contentType,
 				headers: {
-					...he(e.contentType),
+					...z(e.contentType),
 					"cache-control": t,
 					"accept-ranges": "bytes",
 					"content-range": `bytes ${i.start}-${i.endInclusive}/${n.totalSize}`
@@ -2555,18 +2619,18 @@ var bn = () => M({
 				contentType: "text/plain"
 			};
 		}
-		let a = await R(I.getStream(e.id));
+		let a = await R(L.getStream(e.id));
 		return a ? {
 			status: 200,
 			contentType: e.contentType,
 			headers: {
-				...he(e.contentType),
+				...z(e.contentType),
 				"cache-control": t,
 				"accept-ranges": "bytes"
 			},
 			byteStream: {
 				contentLength: e.size,
-				stream: () => w.toReadableStream(a.stream)
+				stream: () => T.toReadableStream(a.stream)
 			}
 		} : {
 			status: 404,
@@ -2574,21 +2638,21 @@ var bn = () => M({
 			contentType: "text/plain"
 		};
 	}, _e = async (e) => {
-		let t = e.path.startsWith(L) ? e.path.slice(L.length).split("/")[0] ?? "" : "";
+		let t = e.path.startsWith(fe) ? e.path.slice(fe.length).split("/")[0] ?? "" : "";
 		if (!t) return {
 			status: 404,
 			body: "not found",
 			contentType: "text/plain"
 		};
-		let n = await R(I.head(t));
+		let n = await R(L.head(t));
 		if (!n) return {
 			status: 404,
 			body: "not found",
 			contentType: "text/plain"
 		};
-		let r = Ke(e.query), i = e.headers.range;
+		let r = qe(e.query), i = e.headers.range;
 		if (n.visibility === "public") {
-			let e = x.publicUrl?.(n.key) ?? null;
+			let e = S.publicUrl?.(n.key) ?? null;
 			return e && !r ? {
 				status: 302,
 				headers: {
@@ -2599,20 +2663,20 @@ var bn = () => M({
 		}
 		let a = !1, o = e.query ? new URLSearchParams(e.query).get("t") : null;
 		if (o) {
-			let e = mt(o);
+			let e = ht(o);
 			a = !!e && e.refId === t;
 		}
 		if (!a) {
-			let t = ae(e.headers.cookie, En), r = t ? se(t, oe()) : null;
-			r && (a = await R(I.checkAccess(n, r)) === !0);
+			let t = ie(e.headers.cookie, Mn), r = t ? oe(t, ae()) : null;
+			r && (a = await R(L.checkAccess(n, r)) === !0);
 		}
 		if (!a) return {
 			status: 403,
 			body: "forbidden",
 			contentType: "text/plain"
 		};
-		if (x.presigns && !r) {
-			let e = await R(x.getUrl(n.key, 300));
+		if (S.presigns && !r) {
+			let e = await R(S.getUrl(n.key, 300));
 			if (e && /^https?:/.test(e)) return {
 				status: 302,
 				headers: {
@@ -2624,9 +2688,9 @@ var bn = () => M({
 		return ge(n, "private, no-store", r, i);
 	}, ve = {
 		method: "GET",
-		path: b,
+		path: x,
 		handle: async (e) => {
-			let t = await _e(e), n = Nn(e.headers.origin, ce);
+			let t = await _e(e), n = zn(e.headers.origin, se);
 			return Object.keys(n).length === 0 ? t : {
 				...t,
 				headers: {
@@ -2637,10 +2701,10 @@ var bn = () => M({
 		}
 	}, ye = {
 		method: "*",
-		path: `${b}/upload`,
+		path: `${x}/upload`,
 		originGuard: "exempt",
 		handle: async (e) => {
-			let t = Nn(e.headers.origin, ce);
+			let t = zn(e.headers.origin, se);
 			if (e.method === "OPTIONS") return {
 				status: 204,
 				headers: t
@@ -2651,8 +2715,8 @@ var bn = () => M({
 				contentType: "text/plain",
 				headers: t
 			};
-			let n = e.query ? new URLSearchParams(e.query).get("ticket") : null, r = n ? gt(n) : null;
-			if (!r || r.instance !== v) return {
+			let n = e.query ? new URLSearchParams(e.query).get("ticket") : null, r = n ? _t(n) : null;
+			if (!r || r.instance !== y) return {
 				status: 401,
 				body: "invalid or expired upload ticket",
 				contentType: "text/plain",
@@ -2670,7 +2734,7 @@ var bn = () => M({
 				contentType: "text/plain",
 				headers: t
 			};
-			let i = await y.runPromise(I.put({
+			let i = await b.runPromise(L.put({
 				bytes: e.rawBody,
 				contentType: r.ct,
 				tenantId: r.tenant,
@@ -2681,21 +2745,21 @@ var bn = () => M({
 				...r.tags === void 0 ? {} : { tags: r.tags },
 				...r.alt === void 0 ? {} : { alt: r.alt },
 				...r.caption === void 0 ? {} : { caption: r.caption }
-			}).pipe(y.flatMap((e) => I.getUrl(e.id).pipe(y.map((t) => ({
+			}).pipe(b.flatMap((e) => L.getUrl(e.id).pipe(b.map((t) => ({
 				kind: "ok",
 				ref: e,
 				url: t
-			})))), y.catchTags({
-				StorageRejected: (e) => y.succeed({
+			})))), b.catchTags({
+				StorageRejected: (e) => b.succeed({
 					kind: "rejected",
 					status: e.reason === "too-large" ? 413 : 415,
 					detail: e.detail
 				}),
-				StorageScanRejected: (e) => y.succeed({
+				StorageScanRejected: (e) => b.succeed({
 					kind: "scan",
 					threat: e.threat
 				}),
-				StorageError: (e) => y.succeed({
+				StorageError: (e) => b.succeed({
 					kind: "error",
 					message: e.message
 				})
@@ -2729,26 +2793,26 @@ var bn = () => M({
 		}
 	}, be = {
 		method: "*",
-		path: `${b}/upload/resumable`,
+		path: `${x}/upload/resumable`,
 		originGuard: "exempt",
 		handle: async (e) => {
-			let t = Nn(e.headers.origin, ce);
+			let t = zn(e.headers.origin, se);
 			if (e.method === "OPTIONS") return {
 				status: 204,
 				headers: t
 			};
-			let n = new URLSearchParams(e.query || ""), r = bt(n.get("token") ?? "");
-			if (!r || r.instance !== v) return {
+			let n = new URLSearchParams(e.query || ""), r = xt(n.get("token") ?? "");
+			if (!r || r.instance !== y) return {
 				status: 401,
 				body: "invalid or expired resumable token",
 				contentType: "text/plain",
 				headers: t
 			};
 			if (e.method === "GET" || e.method === "HEAD") {
-				let e = await y.runPromise(I.resumableStatus({
+				let e = await b.runPromise(L.resumableStatus({
 					uploadId: r.id,
 					tenantId: r.tenant
-				}).pipe(y.match({
+				}).pipe(b.match({
 					onFailure: (e) => ({ error: e.message }),
 					onSuccess: (e) => e
 				})));
@@ -2786,12 +2850,12 @@ var bn = () => M({
 				contentType: "text/plain",
 				headers: t
 			};
-			let a = n.get("final") === "1", o = await y.runPromise(I.putResumableChunk({
+			let a = n.get("final") === "1", o = await b.runPromise(L.putResumableChunk({
 				uploadId: r.id,
 				tenantId: r.tenant,
 				index: i,
 				bytes: e.rawBody
-			}).pipe(y.flatMap(() => a ? I.finalizeResumable({
+			}).pipe(b.flatMap(() => a ? L.finalizeResumable({
 				uploadId: r.id,
 				count: i + 1,
 				contentType: r.ct,
@@ -2802,21 +2866,21 @@ var bn = () => M({
 				...r.tags === void 0 ? {} : { tags: r.tags },
 				...r.alt === void 0 ? {} : { alt: r.alt },
 				...r.caption === void 0 ? {} : { caption: r.caption }
-			}).pipe(y.flatMap((e) => I.getUrl(e.id).pipe(y.map((t) => ({
+			}).pipe(b.flatMap((e) => L.getUrl(e.id).pipe(b.map((t) => ({
 				kind: "done",
 				ref: e,
 				url: t
-			}))))) : y.succeed({ kind: "chunk" })), y.catchTags({
-				StorageRejected: (e) => y.succeed({
+			}))))) : b.succeed({ kind: "chunk" })), b.catchTags({
+				StorageRejected: (e) => b.succeed({
 					kind: "rejected",
 					status: e.reason === "too-large" ? 413 : 415,
 					detail: e.detail
 				}),
-				StorageScanRejected: (e) => y.succeed({
+				StorageScanRejected: (e) => b.succeed({
 					kind: "scan",
 					threat: e.threat
 				}),
-				StorageError: (e) => y.succeed({
+				StorageError: (e) => b.succeed({
 					kind: "error",
 					message: e.message
 				})
@@ -2872,23 +2936,23 @@ var bn = () => M({
 			method: "POST",
 			path: "/upload-ticket",
 			description: "Authorize a binary upload with explicit tenant and owner attribution",
-			handler: (e) => y.gen(function* () {
-				let n = C.String.pipe(C.filter((e) => e.trim().length > 0)), r = yield* C.decodeUnknown(C.parseJson(C.Struct({
-					tenantId: C.NullOr(n),
-					ownerId: C.NullOr(n),
-					key: n.pipe(C.maxLength(1024)),
-					contentType: n.pipe(C.maxLength(255), C.filter((e) => !/[\r\n]/.test(e))),
-					size: C.Number.pipe(C.int(), C.positive(), C.filter(Number.isSafeInteger)),
-					visibility: C.optional(C.Literal("public", "private"))
-				})))(e.body).pipe(y.mapError(() => new t({
+			handler: (e) => b.gen(function* () {
+				let n = w.String.pipe(w.filter((e) => e.trim().length > 0)), r = yield* w.decodeUnknown(w.parseJson(w.Struct({
+					tenantId: w.NullOr(n),
+					ownerId: w.NullOr(n),
+					key: n.pipe(w.maxLength(1024)),
+					contentType: n.pipe(w.maxLength(255), w.filter((e) => !/[\r\n]/.test(e))),
+					size: w.Number.pipe(w.int(), w.positive(), w.filter(Number.isSafeInteger)),
+					visibility: w.optional(w.Literal("public", "private"))
+				})))(e.body).pipe(b.mapError(() => new t({
 					provider: "inspect",
 					message: "Provide explicit tenantId and ownerId (or null), key, contentType and a positive file size",
 					transient: !1,
 					status: 400
 				})));
-				if (D !== void 0 && r.size > D) return V(413, "File exceeds the configured upload limit");
-				let i = ht({
-					instance: v,
+				if (O !== void 0 && r.size > O) return V(413, "File exceeds the configured upload limit");
+				let i = gt({
+					instance: y,
 					sub: r.ownerId,
 					tenant: r.tenantId,
 					ct: r.contentType,
@@ -2897,31 +2961,31 @@ var bn = () => M({
 					max: r.size
 				}, 300);
 				return B({
-					uploadPath: `${b}/upload?ticket=${encodeURIComponent(i)}`,
+					uploadPath: `${x}/upload?ticket=${encodeURIComponent(i)}`,
 					expiresInSec: 300,
 					maxBytes: r.size
 				});
-			}).pipe(y.catchAll((e) => y.succeed(V(e.status ?? 500, e.message))))
+			}).pipe(b.catchAll((e) => b.succeed(V(e.status ?? 500, e.message))))
 		},
 		{
 			method: "GET",
 			path: "/download",
 			description: "Stream a stored file as an attachment for authorized inspect readers",
-			handler: (e) => y.gen(function* () {
+			handler: (e) => b.gen(function* () {
 				let t = xe(e.url, "refId");
 				if (!t?.trim()) return V(400, "A non-empty refId is required");
-				let { ref: n, stream: r } = yield* I.getStream(t), i = n.key.split("/").pop() || n.id, a = encodeURIComponent(i).replace(/[!'()*]/g, (e) => `%${e.charCodeAt(0).toString(16).toUpperCase()}`);
+				let { ref: n, stream: r } = yield* L.getStream(t), i = n.key.split("/").pop() || n.id, a = encodeURIComponent(i).replace(/[!'()*]/g, (e) => `%${e.charCodeAt(0).toString(16).toUpperCase()}`);
 				return {
 					kind: "bytes",
 					contentType: n.contentType,
 					byteStream: {
-						stream: () => w.toReadableStream(r),
+						stream: () => T.toReadableStream(r),
 						contentLength: n.size,
 						contentDisposition: `attachment; filename="download"; filename*=UTF-8''${a}`
 					},
 					headers: { "cache-control": "no-store" }
 				};
-			}).pipe(y.catchAll((e) => y.succeed(V(e.status ?? 500, e.message))))
+			}).pipe(b.catchAll((e) => b.succeed(V(e.status ?? 500, e.message))))
 		},
 		{
 			method: "GET",
@@ -2929,7 +2993,7 @@ var bn = () => M({
 			description: "Searchable storage refs, newest first, paginated",
 			handler: (e) => {
 				let t = Number(xe(e.url, "offset") ?? 0), n = Number.isSafeInteger(t) && t >= 0 ? t : 0, r = (xe(e.url, "search") ?? "").trim().slice(0, 200);
-				return P.listRefs({
+				return ue.listRefs({
 					tenantId: void 0,
 					ownerId: void 0,
 					folder: void 0,
@@ -2938,25 +3002,25 @@ var bn = () => M({
 					search: r,
 					limit: 51,
 					offset: n
-				}).pipe(y.map((e) => B({
-					refs: e.slice(0, 50).map(Pn),
+				}).pipe(b.map((e) => B({
+					refs: e.slice(0, 50).map(Bn),
 					page: {
 						search: r,
 						offset: n,
 						nextOffset: e.length > 50 ? n + 50 : null
 					}
-				})), y.catchAll((e) => y.succeed(V(500, e.message))));
+				})), b.catchAll((e) => b.succeed(V(500, e.message))));
 			}
 		},
 		{
 			method: "GET",
 			path: "/stats",
 			description: "Object count + total bytes per tenant + visibility split",
-			handler: () => P.statistics().pipe(y.map((e) => B({
-				provider: x.name,
-				bucket: S,
+			handler: () => ue.statistics().pipe(b.map((e) => B({
+				provider: S.name,
+				bucket: C,
 				...e
-			})), y.catchAll((e) => y.succeed(V(500, e.message))))
+			})), b.catchAll((e) => b.succeed(V(500, e.message))))
 		},
 		{
 			method: "GET",
@@ -2964,95 +3028,95 @@ var bn = () => M({
 			description: "Grants for a ref (?refId=…)",
 			handler: (e) => {
 				let t = xe(e.url, "refId");
-				return t ? F.listByRef(t).pipe(y.map((e) => B({ grants: e.map(Bn) })), y.catchAll((e) => y.succeed(V(500, e.message)))) : y.succeed(V(400, "refId query param required"));
+				return t ? F.listByRef(t).pipe(b.map((e) => B({ grants: e.map(Kn) })), b.catchAll((e) => b.succeed(V(500, e.message)))) : b.succeed(V(400, "refId query param required"));
 			}
 		},
 		{
 			method: "POST",
 			path: "/share",
 			description: "Grant a principal access to a ref",
-			handler: (e) => y.gen(function* () {
-				let n = yield* C.decodeUnknown(C.parseJson(C.Struct({
-					refId: C.String.pipe(C.filter((e) => e.trim().length > 0)),
-					principalType: C.Literal("user", "group", "apiKey"),
-					principalId: C.String.pipe(C.filter((e) => e.trim().length > 0)),
-					permission: C.optional(C.Literal("read", "write")),
-					expiresInDays: C.optional(C.Number.pipe(C.finite(), C.positive()))
-				})))(e.body).pipe(y.mapError(() => new t({
+			handler: (e) => b.gen(function* () {
+				let n = yield* w.decodeUnknown(w.parseJson(w.Struct({
+					refId: w.String.pipe(w.filter((e) => e.trim().length > 0)),
+					principalType: w.Literal("user", "group", "apiKey"),
+					principalId: w.String.pipe(w.filter((e) => e.trim().length > 0)),
+					permission: w.optional(w.Literal("read", "write")),
+					expiresInDays: w.optional(w.Number.pipe(w.finite(), w.positive()))
+				})))(e.body).pipe(b.mapError(() => new t({
 					provider: "inspect",
 					message: "Invalid share input: provide refId, principalType, principalId, read/write permission and a positive finite expiry if set",
 					transient: !1,
 					status: 400
 				}))), r = n.expiresInDays === void 0 ? null : new Date(Date.now() + n.expiresInDays * 864e5);
 				if (r !== null && !Number.isFinite(r.getTime())) return V(400, "Expiry exceeds the supported date range");
-				let i = yield* I.grant({
+				let i = yield* L.grant({
 					refId: n.refId,
 					principalType: n.principalType,
 					principalId: n.principalId,
 					...n.permission ? { permission: n.permission } : {},
 					expiresAt: r
 				});
-				return B({ grant: Bn(i) });
-			}).pipe(y.catchAll((e) => y.succeed(V(e.status ?? 500, e.message ?? "share failed"))))
+				return B({ grant: Kn(i) });
+			}).pipe(b.catchAll((e) => b.succeed(V(e.status ?? 500, e.message ?? "share failed"))))
 		},
 		{
 			method: "POST",
 			path: "/delete",
 			description: "Delete an object reference and its grants; release unreferenced bytes",
-			handler: (e) => y.gen(function* () {
-				let n = yield* C.decodeUnknown(C.parseJson(C.Struct({ refId: C.String.pipe(C.filter((e) => e.trim().length > 0)) })))(e.body).pipe(y.mapError(() => new t({
+			handler: (e) => b.gen(function* () {
+				let n = yield* w.decodeUnknown(w.parseJson(w.Struct({ refId: w.String.pipe(w.filter((e) => e.trim().length > 0)) })))(e.body).pipe(b.mapError(() => new t({
 					provider: "inspect",
 					message: "A non-empty refId is required",
 					transient: !1,
 					status: 400
 				})));
-				return yield* I.delete(n.refId), B({ ok: !0 });
-			}).pipe(y.catchAll((e) => y.succeed(V(e.status ?? 500, e.message))))
+				return yield* L.delete(n.refId), B({ ok: !0 });
+			}).pipe(b.catchAll((e) => b.succeed(V(e.status ?? 500, e.message))))
 		},
 		{
 			method: "POST",
 			path: "/revoke",
 			description: "Revoke a grant by id",
-			handler: (e) => y.gen(function* () {
-				let n = yield* C.decodeUnknown(C.parseJson(C.Struct({ grantId: C.String.pipe(C.filter((e) => e.trim().length > 0)) })))(e.body).pipe(y.mapError(() => new t({
+			handler: (e) => b.gen(function* () {
+				let n = yield* w.decodeUnknown(w.parseJson(w.Struct({ grantId: w.String.pipe(w.filter((e) => e.trim().length > 0)) })))(e.body).pipe(b.mapError(() => new t({
 					provider: "inspect",
 					message: "A non-empty grantId is required",
 					transient: !1,
 					status: 400
 				})));
-				return yield* I.revoke(n.grantId), B({ ok: !0 });
-			}).pipe(y.catchAll((e) => y.succeed(V(e.status ?? 500, e.message ?? "revoke failed"))))
+				return yield* L.revoke(n.grantId), B({ ok: !0 });
+			}).pipe(b.catchAll((e) => b.succeed(V(e.status ?? 500, e.message ?? "revoke failed"))))
 		}
 	], Ce = [
 		{
 			...h,
 			execute: (e, t) => {
 				let n = e;
-				return I.mintUrl(n.id, t.request.subject, {
+				return L.mintUrl(n.id, t.request.subject, {
 					...n.password === void 0 ? {} : { password: n.password },
 					...n.expiresInSec === void 0 ? {} : { expiresInSec: n.expiresInSec }
-				}).pipe(y.map((e) => ({ url: e })));
+				}).pipe(b.map((e) => ({ url: e })));
 			}
 		},
 		{
 			...ee,
 			execute: (e, t) => {
 				let n = e;
-				return I.mintUploadUrl({
+				return L.mintUploadUrl({
 					key: n.key,
 					contentType: n.contentType,
 					tenantId: t.request.subject.tenantId,
 					...n.expiresInSec === void 0 ? {} : { expiresInSec: n.expiresInSec }
-				}).pipe(y.map((e) => ({ url: e })));
+				}).pipe(b.map((e) => ({ url: e })));
 			}
 		},
 		{
 			...m,
 			execute: (e, t) => {
 				let n = e;
-				return Rn(t, O).pipe(y.map((e) => {
-					let t = n.expiresInSec ?? 900, r = ht({
-						instance: v,
+				return Wn(t, k).pipe(b.map((e) => {
+					let t = n.expiresInSec ?? 900, r = gt({
+						instance: y,
 						sub: e.id,
 						tenant: e.tenantId,
 						ct: n.contentType,
@@ -3062,10 +3126,10 @@ var bn = () => M({
 						...n.tags === void 0 ? {} : { tags: n.tags },
 						...n.alt === void 0 ? {} : { alt: n.alt },
 						...n.caption === void 0 ? {} : { caption: n.caption },
-						...D === void 0 ? {} : { max: D }
+						...O === void 0 ? {} : { max: O }
 					}, t);
 					return {
-						uploadUrl: `${E ? E.replace(/\/+$/, "") : ""}${b}/upload?ticket=${encodeURIComponent(r)}`,
+						uploadUrl: `${D ? D.replace(/\/+$/, "") : ""}${x}/upload?ticket=${encodeURIComponent(r)}`,
 						expiresInSec: t
 					};
 				}));
@@ -3075,13 +3139,13 @@ var bn = () => M({
 			...p,
 			execute: (e, t) => {
 				let n = e;
-				return Rn(t, O).pipe(y.flatMap((e) => I.mintPresignedUpload({
+				return Wn(t, k).pipe(b.flatMap((e) => L.mintPresignedUpload({
 					contentType: n.contentType,
 					tenantId: e.tenantId,
 					...n.expiresInSec === void 0 ? {} : { expiresInSec: n.expiresInSec }
-				}).pipe(y.map((t) => {
-					let r = _t({
-						instance: v,
+				}).pipe(b.map((t) => {
+					let r = vt({
+						instance: y,
 						key: t.key,
 						sub: e.id,
 						tenant: e.tenantId,
@@ -3091,7 +3155,7 @@ var bn = () => M({
 						...n.tags === void 0 ? {} : { tags: n.tags },
 						...n.alt === void 0 ? {} : { alt: n.alt },
 						...n.caption === void 0 ? {} : { caption: n.caption },
-						...D === void 0 ? {} : { max: D }
+						...O === void 0 ? {} : { max: O }
 					}, t.expiresInSec);
 					return {
 						uploadUrl: t.uploadUrl,
@@ -3104,18 +3168,18 @@ var bn = () => M({
 		{
 			...l,
 			execute: (e, n) => {
-				let r = vt(e.finalizeToken);
-				return !r || r.instance !== v ? y.fail(new t({
+				let r = yt(e.finalizeToken);
+				return !r || r.instance !== y ? b.fail(new t({
 					provider: "storage",
 					message: "invalid or expired finalize token",
 					transient: !1,
 					status: 401
-				})) : zn(r.sub, n.request.subject.id) ? y.fail(new t({
+				})) : Gn(r.sub, n.request.subject.id) ? b.fail(new t({
 					provider: "storage",
 					message: "finalize token belongs to another subject",
 					transient: !1,
 					status: 403
-				})) : I.finalizeUpload({
+				})) : L.finalizeUpload({
 					key: r.key,
 					contentType: r.ct,
 					tenantId: r.tenant,
@@ -3125,7 +3189,7 @@ var bn = () => M({
 					...r.tags === void 0 ? {} : { tags: r.tags },
 					...r.alt === void 0 ? {} : { alt: r.alt },
 					...r.caption === void 0 ? {} : { caption: r.caption }
-				}).pipe(y.flatMap((e) => I.getUrl(e.id).pipe(y.map((t) => ({
+				}).pipe(b.flatMap((e) => L.getUrl(e.id).pipe(b.map((t) => ({
 					id: e.id,
 					url: t,
 					contentType: e.contentType,
@@ -3139,12 +3203,12 @@ var bn = () => M({
 			...s,
 			execute: (e, t) => {
 				let n = e;
-				return Rn(t, O).pipe(y.map((e) => {
-					let t = n.expiresInSec ?? le, r = pe(), i = n.chunkSize && n.chunkSize > 0 ? n.chunkSize : k;
+				return Wn(t, k).pipe(b.map((e) => {
+					let t = n.expiresInSec ?? ce, r = me(), i = n.chunkSize && n.chunkSize > 0 ? n.chunkSize : A;
 					return {
 						uploadId: r,
-						resumableToken: yt({
-							instance: v,
+						resumableToken: bt({
+							instance: y,
 							id: r,
 							sub: e.id,
 							tenant: e.tenantId,
@@ -3155,9 +3219,9 @@ var bn = () => M({
 							...n.tags === void 0 ? {} : { tags: n.tags },
 							...n.alt === void 0 ? {} : { alt: n.alt },
 							...n.caption === void 0 ? {} : { caption: n.caption },
-							...D === void 0 ? {} : { max: D }
+							...O === void 0 ? {} : { max: O }
 						}, t),
-						uploadUrl: `${E ? E.replace(/\/+$/, "") : ""}${b}/upload/resumable`,
+						uploadUrl: `${D ? D.replace(/\/+$/, "") : ""}${x}/upload/resumable`,
 						chunkSize: i,
 						expiresInSec: t
 					};
@@ -3167,15 +3231,15 @@ var bn = () => M({
 		{
 			...o,
 			execute: (e, t) => {
-				let n = e, r = n.expiresInSec ?? le;
-				return Rn(t, O).pipe(y.flatMap((e) => I.beginMultipartUpload({
+				let n = e, r = n.expiresInSec ?? ce;
+				return Wn(t, k).pipe(b.flatMap((e) => L.beginMultipartUpload({
 					contentType: n.contentType,
 					tenantId: e.tenantId,
 					visibility: n.visibility ?? "private",
 					expiresInSec: r
-				}).pipe(y.map((t) => ({
-					multipartToken: xt({
-						instance: v,
+				}).pipe(b.map((t) => ({
+					multipartToken: St({
+						instance: y,
 						key: t.key,
 						uploadId: t.uploadId,
 						sub: e.id,
@@ -3188,47 +3252,47 @@ var bn = () => M({
 						...n.alt === void 0 ? {} : { alt: n.alt },
 						...n.caption === void 0 ? {} : { caption: n.caption }
 					}, r),
-					partSize: n.partSize && n.partSize >= k ? n.partSize : k,
+					partSize: n.partSize && n.partSize >= A ? n.partSize : A,
 					expiresInSec: r
 				})))));
 			}
 		},
 		{
-			..._,
+			...v,
 			execute: (e) => {
-				let n = e, r = St(n.multipartToken);
-				return !r || r.instance !== v ? y.fail(new t({
+				let n = e, r = Ct(n.multipartToken);
+				return !r || r.instance !== y ? b.fail(new t({
 					provider: "storage",
 					message: "invalid or expired multipart token",
 					transient: !1,
 					status: 401
-				})) : !Number.isInteger(n.partNumber) || n.partNumber < 1 ? y.fail(new t({
+				})) : !Number.isInteger(n.partNumber) || n.partNumber < 1 ? b.fail(new t({
 					provider: "storage",
 					message: "partNumber must be a positive integer",
 					transient: !1,
 					status: 400
-				})) : I.signMultipartPart({
+				})) : L.signMultipartPart({
 					key: r.key,
 					uploadId: r.uploadId,
 					partNumber: n.partNumber
-				}).pipe(y.map((e) => ({ url: e })));
+				}).pipe(b.map((e) => ({ url: e })));
 			}
 		},
 		{
 			...c,
 			execute: (e, n) => {
-				let r = e, i = St(r.multipartToken);
-				return !i || i.instance !== v ? y.fail(new t({
+				let r = e, i = Ct(r.multipartToken);
+				return !i || i.instance !== y ? b.fail(new t({
 					provider: "storage",
 					message: "invalid or expired multipart token",
 					transient: !1,
 					status: 401
-				})) : zn(i.sub, n.request.subject.id) ? y.fail(new t({
+				})) : Gn(i.sub, n.request.subject.id) ? b.fail(new t({
 					provider: "storage",
 					message: "multipart token belongs to another subject",
 					transient: !1,
 					status: 403
-				})) : I.completeMultipart({
+				})) : L.completeMultipart({
 					key: i.key,
 					uploadId: i.uploadId,
 					parts: r.parts,
@@ -3240,7 +3304,7 @@ var bn = () => M({
 					...i.tags === void 0 ? {} : { tags: i.tags },
 					...i.alt === void 0 ? {} : { alt: i.alt },
 					...i.caption === void 0 ? {} : { caption: i.caption }
-				}).pipe(y.flatMap((e) => I.getUrl(e.id).pipe(y.map((t) => ({
+				}).pipe(b.flatMap((e) => L.getUrl(e.id).pipe(b.map((t) => ({
 					id: e.id,
 					url: t,
 					size: e.size
@@ -3250,23 +3314,23 @@ var bn = () => M({
 		{
 			...a,
 			execute: (e) => {
-				let n = St(e.multipartToken);
-				return !n || n.instance !== v ? y.fail(new t({
+				let n = Ct(e.multipartToken);
+				return !n || n.instance !== y ? b.fail(new t({
 					provider: "storage",
 					message: "invalid or expired multipart token",
 					transient: !1,
 					status: 401
-				})) : I.abortMultipart({
+				})) : L.abortMultipart({
 					key: n.key,
 					uploadId: n.uploadId
-				}).pipe(y.as({ ok: !0 }));
+				}).pipe(b.as({ ok: !0 }));
 			}
 		},
 		{
-			...re,
+			...ne,
 			execute: (e, t) => {
 				let n = e, r = new Uint8Array(Buffer.from(n.bytesBase64, "base64"));
-				return Rn(t, O).pipe(y.flatMap((e) => I.put({
+				return Wn(t, k).pipe(b.flatMap((e) => L.put({
 					bytes: r,
 					contentType: n.contentType,
 					tenantId: e.tenantId,
@@ -3274,7 +3338,7 @@ var bn = () => M({
 					...n.visibility ? { visibility: n.visibility } : {},
 					...n.key ? { key: n.key } : {},
 					...n.password ? { password: n.password } : {}
-				})), y.flatMap((e) => I.getUrl(e.id).pipe(y.map((t) => ({
+				})), b.flatMap((e) => L.getUrl(e.id).pipe(b.map((t) => ({
 					id: e.id,
 					url: t
 				})))));
@@ -3284,7 +3348,7 @@ var bn = () => M({
 			...u,
 			execute: (e, t) => {
 				let n = e;
-				return Rn(t, O).pipe(y.flatMap((e) => I.ingestUrl(n.url, {
+				return Wn(t, k).pipe(b.flatMap((e) => L.ingestUrl(n.url, {
 					tenantId: e.tenantId,
 					ownerId: e.id,
 					...n.visibility ? { visibility: n.visibility } : {},
@@ -3293,45 +3357,45 @@ var bn = () => M({
 					...n.alt === void 0 ? {} : { alt: n.alt },
 					...n.caption === void 0 ? {} : { caption: n.caption },
 					...n.key === void 0 ? {} : { key: n.key }
-				})), y.flatMap((e) => I.getUrl(e.id).pipe(y.map((t) => ({
+				})), b.flatMap((e) => L.getUrl(e.id).pipe(b.map((t) => ({
 					id: e.id,
 					url: t
 				})))));
 			}
 		},
 		{
-			...te,
+			..._,
 			execute: (e, t) => {
 				let n = e, r = n.expiresInDays ? new Date(Date.now() + n.expiresInDays * 864e5) : null;
-				return In(I, n.refId, t).pipe(y.flatMap(() => I.grant({
+				return Hn(L, n.refId, t).pipe(b.flatMap(() => L.grant({
 					refId: n.refId,
 					principalType: n.principalType,
 					principalId: n.principalId,
 					...n.permission ? { permission: n.permission } : {},
 					expiresAt: r,
 					createdBy: t.request.subject.id
-				})), y.map((e) => ({ grantId: e.id })));
+				})), b.map((e) => ({ grantId: e.id })));
 			}
 		},
 		{
 			...g,
 			execute: (e, t) => {
 				let n = e;
-				return I.getGrant(n.grantId).pipe(y.flatMap((e) => e === null ? y.fail(Fn()) : In(I, e.refId, t)), y.flatMap(() => I.revoke(n.grantId)), y.map(() => ({ ok: !0 })));
+				return L.getGrant(n.grantId).pipe(b.flatMap((e) => e === null ? b.fail(Vn()) : Hn(L, e.refId, t)), b.flatMap(() => L.revoke(n.grantId)), b.map(() => ({ ok: !0 })));
 			}
 		},
 		{
 			...d,
 			execute: (e, t) => {
 				let n = e;
-				return In(I, n.refId, t).pipe(y.flatMap(() => I.listGrants(n.refId)), y.map((e) => ({ grants: e.map(Bn) })));
+				return Hn(L, n.refId, t).pipe(b.flatMap(() => L.listGrants(n.refId)), b.map((e) => ({ grants: e.map(Kn) })));
 			}
 		},
 		{
 			...f,
 			execute: (e, t) => {
 				let n = e;
-				return I.listRefs({
+				return L.listRefs({
 					tenantId: t.request.subject.tenantId,
 					...n.folder === void 0 ? {} : { folder: n.folder },
 					...n.tags === void 0 ? {} : { tags: n.tags },
@@ -3339,20 +3403,20 @@ var bn = () => M({
 					...n.includeDerived === void 0 ? {} : { includeDerived: n.includeDerived },
 					...n.limit === void 0 ? {} : { limit: n.limit },
 					...n.offset === void 0 ? {} : { offset: n.offset }
-				}).pipe(y.map((e) => ({
-					refs: e.refs.map(Pn),
+				}).pipe(b.map((e) => ({
+					refs: e.refs.map(Bn),
 					nextOffset: e.nextOffset
 				})));
 			}
 		}
 	];
-	return ie({
-		name: T({
-			base: Vn,
+	return re({
+		name: E({
+			base: qn,
 			alias: i.alias,
 			instance: i.name
 		}),
-		baseName: Vn,
+		baseName: qn,
 		description: "File storage — StorageService over S3 / MinIO / filesystem / memory. Public objects served direct from bucket/CDN; private objects gated by an access policy + per-object grants. Checksums, tenant key-prefixing, _voltro_storage_refs + _voltro_storage_grants, retry.",
 		permissions: [
 			"network:outbound:*",
@@ -3360,7 +3424,7 @@ var bn = () => M({
 			"inspect:write"
 		],
 		declaredEnv: G.declared,
-		services: fe,
+		services: de,
 		inspectEndpoints: Se,
 		httpRoutes: [
 			ve,
@@ -3368,7 +3432,7 @@ var bn = () => M({
 			be
 		],
 		routes: Ce,
-		rpcClientDescriptors: ne,
+		rpcClientDescriptors: te,
 		errorSchemas: [
 			{
 				schema: t,
@@ -3400,43 +3464,49 @@ var bn = () => M({
 			}
 		],
 		capabilities: { mediaPersist: {
-			put: async ({ bytes: e, mediaType: t, tenantId: n, operationId: r }) => {
-				let i = await y.runPromise(I.put({
+			put: async ({ bytes: e, mediaType: t, tenantId: n, operationId: r, ownerId: i, visibility: a, tags: o }) => {
+				let s = await b.runPromise(L.put({
 					bytes: e,
 					contentType: t,
 					tenantId: n,
 					kind: "media",
-					...ue.current === void 0 ? {} : { operationId: r }
+					...i === void 0 ? {} : { ownerId: i },
+					...a === void 0 ? {} : { visibility: a },
+					...o === void 0 ? {} : { tags: o },
+					...le.current === void 0 ? {} : { operationId: r }
 				}));
 				return {
-					url: await y.runPromise(I.getUrl(i.id, { tenantId: n })),
-					refId: i.id
+					url: await b.runPromise(L.getUrl(s.id, { tenantId: n })),
+					refId: s.id
 				};
 			},
-			ingestUrl: async ({ url: e, tenantId: t, operationId: n }) => {
-				let r = await y.runPromise(I.ingestUrl(e, {
+			ingestUrl: async ({ url: e, tenantId: t, operationId: n, ownerId: r, visibility: i, tags: a }) => {
+				let o = await b.runPromise(L.ingestUrl(e, {
 					tenantId: t,
-					...ue.current === void 0 ? {} : { operationId: n }
+					...r === void 0 ? {} : { ownerId: r },
+					...i === void 0 ? {} : { visibility: i },
+					...a === void 0 ? {} : { tags: a },
+					...le.current === void 0 ? {} : { operationId: n }
 				}));
 				return {
-					url: await y.runPromise(I.getUrl(r.id, { tenantId: t })),
-					refId: r.id
+					url: await b.runPromise(L.getUrl(o.id, { tenantId: t })),
+					refId: o.id
 				};
 			}
 		} },
 		bindDataStore: (e) => {
-			A && (M.current = Vt(e)), j && (N.current = Wt(e)), A && j && (ue.current = fn(e)), x.bindDataStore?.(e);
+			j && (N.current = Ht(e)), M && (P.current = Gt(e)), j && M && (le.current = vn(e)), S.bindDataStore?.(e);
 		},
-		onActivate: (e) => y.sync(() => {
-			let t = !!E || !!G.read("STORAGE_CDN_URL", i.cdnBaseUrl);
-			e.logger.info(`storage: provider=${x.name} presign=${x.presigns ? "yes" : "no"} publicUrl=${t ? "yes" : "no"} transforms=yes`, {
-				provider: x.name,
-				bucket: S,
-				refStore: A ? "memory" : "custom"
-			}), x.name === "memory" && process.env.NODE_ENV !== "test" && e.logger.warn("storage: provider=memory — uploads are IN-MEMORY and LOST on restart. Set STORAGE_PROVIDER (filesystem / s3 / r2 / azure / gcs) for anything but throwaway dev. (Empty/placeholder storage env silently falls back to memory.)"), !t && !x.presigns && e.logger.warn("storage: no VOLTRO_PUBLIC_URL / STORAGE_CDN_URL and this provider can't presign — serve URLs are RELATIVE and will not resolve cross-origin (browser <img> / server-to-server AI fetches). Set VOLTRO_PUBLIC_URL to this api's absolute base URL.");
+		onActivate: (e) => b.sync(() => {
+			let t = !!D || !!G.read("STORAGE_CDN_URL", i.cdnBaseUrl);
+			e.logger.info(`storage: provider=${S.name} presign=${S.presigns ? "yes" : "no"} publicUrl=${t ? "yes" : "no"} transforms=yes`, {
+				provider: S.name,
+				bucket: C,
+				refStore: j ? "memory" : "custom"
+			}), S.name === "memory" && process.env.NODE_ENV !== "test" && e.logger.warn("storage: provider=memory — uploads are IN-MEMORY and LOST on restart. Set STORAGE_PROVIDER (filesystem / s3 / r2 / azure / gcs) for anything but throwaway dev. (Empty/placeholder storage env silently falls back to memory.)"), !t && !S.presigns && e.logger.warn("storage: no VOLTRO_PUBLIC_URL / STORAGE_CDN_URL and this provider can't presign — serve URLs are RELATIVE and will not resolve cross-origin (browser <img> / server-to-server AI fetches). Set VOLTRO_PUBLIC_URL to this api's absolute base URL.");
 		}),
-		onDeactivate: () => y.void
+		onDeactivate: () => b.void
 	});
 };
 //#endregion
-export { W as STORAGE_BLOBS_TABLE, U as STORAGE_GRANTS_TABLE, H as STORAGE_REFS_TABLE, Ae as STORAGE_USAGE_TABLE, e as StorageAccessDenied, t as StorageError, n as StorageRejected, r as StorageScanRejected, i as StorageService, Pe as _voltroStorageBlobsTable, Me as _voltroStorageGrantsTable, je as _voltroStorageRefsTable, Ne as _voltroStorageUsageTable, kn as appStorageProvider, yn as assetRef, We as azureProvider, qt as buildStorageService, we as bytesToStream, Et as checkLimits, gn as clamavScanner, Re as clearStorageBuffer, Te as collectStream, Ce as concatBytes, An as configuredStorageProvider, Ct as contentTypeAllowed, Wt as dataStoreGrantStore, Vt as dataStoreRefStore, Ue as databaseProvider, Sn as decodeDataUri, Tn as durabilityNotice, pn as encodeInstream, vn as ffmpegTranscoder, Be as filesystemProvider, Ee as fromNodeReadable, Oe as getObjectStream, et as hashPassword, fn as makeStorageObjectMetadata, Ht as memoryGrantStore, ze as memoryProvider, Rt as memoryRefStore, mn as parseClamavResponse, Ke as parseTransformParams, wn as pathDurability, Cn as putAvatar, ke as putObjectStream, Le as readStorageBuffer, It as refMatchesListQuery, jn as resolveStorageProvider, q as resolveStorageSecret, Ve as s3Provider, On as setActiveStorageProvider, _t as signFinalizeTicket, pt as signGrant, xt as signMultipartTicket, yt as signResumableTicket, ht as signUploadTicket, Tt as sniffMatches, Hn as storageInstanceName, Zt as storageObjectLifecycleTables, Un as storagePlugin, ln as storagePutIntentsTable, Jt as storageServiceLayer, De as toNodeReadable, $e as transformCached, Xe as transformImage, vt as verifyFinalizeTicket, mt as verifyGrant, St as verifyMultipartTicket, tt as verifyPassword, bt as verifyResumableTicket, gt as verifyUploadTicket, bn as withStorage };
+export { W as STORAGE_BLOBS_TABLE, U as STORAGE_GRANTS_TABLE, H as STORAGE_REFS_TABLE, je as STORAGE_USAGE_TABLE, e as StorageAccessDenied, t as StorageError, n as StorageRejected, r as StorageScanRejected, i as StorageService, Fe as _voltroStorageBlobsTable, Ne as _voltroStorageGrantsTable, Me as _voltroStorageRefsTable, Pe as _voltroStorageUsageTable, Fn as appStorageProvider, Tn as assetRef, Ge as azureProvider, Jt as buildStorageService, Te as bytesToStream, Dt as checkLimits, Sn as clamavScanner, ze as clearStorageBuffer, Ee as collectStream, we as concatBytes, In as configuredStorageProvider, wt as contentTypeAllowed, Gt as dataStoreGrantStore, Ht as dataStoreRefStore, We as databaseProvider, On as decodeDataUri, jn as durabilityNotice, yn as encodeInstream, wn as ffmpegTranscoder, Ve as filesystemProvider, De as fromNodeReadable, ke as getObjectStream, tt as hashPassword, vn as makeStorageObjectMetadata, Ut as memoryGrantStore, Be as memoryProvider, zt as memoryRefStore, bn as parseClamavResponse, qe as parseTransformParams, An as pathDurability, kn as putAvatar, Ae as putObjectStream, Re as readStorageBuffer, Lt as refMatchesListQuery, Ln as resolveStorageProvider, q as resolveStorageSecret, He as s3Provider, Pn as setActiveStorageProvider, vt as signFinalizeTicket, mt as signGrant, St as signMultipartTicket, bt as signResumableTicket, gt as signUploadTicket, Et as sniffMatches, Jn as storageInstanceName, $t as storageObjectLifecycleTables, Yn as storagePlugin, hn as storagePutIntentsTable, Yt as storageServiceLayer, Oe as toNodeReadable, et as transformCached, Ze as transformImage, yt as verifyFinalizeTicket, ht as verifyGrant, Ct as verifyMultipartTicket, nt as verifyPassword, xt as verifyResumableTicket, _t as verifyUploadTicket, En as withStorage };