@voltro/plugin-storage 0.81.0 → 0.83.0

package/dist/index.js

@@ -2,86 +2,87 @@ import { StorageAccessDenied as e, StorageError as t, StorageRejected as n, Stor
 import { abortMultipartUploadDescriptor as a, beginMultipartUploadDescriptor as o, beginResumableUploadDescriptor as s, completeMultipartUploadDescriptor as c, finalizeUploadDescriptor as l, ingestUrlDescriptor as u, listGrantsDescriptor as d, listRefsDescriptor as f, mintPresignedUploadDescriptor as p, mintUploadTicketDescriptor as m, mintUploadUrlDescriptor as ee, mintUrlDescriptor as te, revokeDescriptor as h, shareDescriptor as ne, signMultipartPartDescriptor as g, storageRpcClientImports as re, uploadDescriptor as ie } from "./rpc.js";
 import { processIdentity as _ } from "@voltro/protocol/identity";
 import { Chunk as v, Effect as y, Exit as b, Layer as x, Schedule as S, Schema as C, Stream as w } from "effect";
-import { definePlugin as ae, pluginInstanceName as oe } from "@voltro/protocol";
-import { readCookie as se, resolveSessionSecret as ce, verifySession as le } from "@voltro/protocol/session";
-import { and as T, bytes as ue, contains as E, eq as D, generateId as O, id as de, integer as k, json as A, mixin as j, neq as M, or as fe, reference as pe, table as N, text as P, timestamp as me } from "@voltro/database";
-import { pluginEnv as F } from "@voltro/env";
-import { createHash as he, createHmac as I, randomBytes as L, randomUUID as ge, scryptSync as _e, timingSafeEqual as R } from "node:crypto";
-import { spawn as ve } from "node:child_process";
-import { mkdtemp as ye, readFile as be, rm as xe, writeFile as Se } from "node:fs/promises";
-import { tmpdir as Ce } from "node:os";
+import { definePlugin as T, pluginInstanceName as ae } from "@voltro/protocol";
+import { readCookie as oe, resolveSessionSecret as se, verifySession as ce } from "@voltro/protocol/session";
+import { and as E, bytes as le, contains as D, eq as O, generateId as k, id as ue, integer as A, json as j, mixin as de, neq as M, or as N, reference as fe, table as P, text as F, timestamp as pe } from "@voltro/database";
+import { pluginEnv as me } from "@voltro/env";
+import { createHash as he, createHmac as I, randomBytes as ge, randomUUID as _e, scryptSync as L, timingSafeEqual as R } from "node:crypto";
+import { ssrfReason as ve } from "@voltro/runtime";
+import { spawn as ye } from "node:child_process";
+import { mkdtemp as be, readFile as xe, rm as Se, writeFile as Ce } from "node:fs/promises";
+import { tmpdir as we } from "node:os";
 import { join as z } from "node:path";
 import { statSync as B } from "node:fs";
 //#region src/streamBridge.ts
-var we = 1 << 20, Te = (e, n, r = !1) => new t({
+var Te = 1 << 20, Ee = (e, n, r = !1) => new t({
 	provider: e,
 	message: n,
 	transient: r
-}), Ee = (e) => {
+}), De = (e) => {
 	let t = 0;
 	for (let n of e) t += n.byteLength;
 	let n = new Uint8Array(t), r = 0;
 	for (let t of e) n.set(t, r), r += t.byteLength;
 	return n;
-}, De = (e, t = we) => {
+}, Oe = (e, t = Te) => {
 	let n = [];
 	for (let r = 0; r < e.byteLength; r += t) n.push(e.subarray(r, Math.min(r + t, e.byteLength)));
 	return w.fromIterable(n);
-}, Oe = (e) => e.pipe(w.runCollect, y.map((e) => Ee(v.toReadonlyArray(e)))), ke = (e, t) => w.suspend(() => w.fromAsyncIterable(t(), (t) => Te(e, `read stream failed: ${String(t?.message ?? t)}`, !0))).pipe(w.map((e) => e instanceof Uint8Array ? e : new Uint8Array(e))), Ae = async (e) => {
+}, ke = (e) => e.pipe(w.runCollect, y.map((e) => De(v.toReadonlyArray(e)))), Ae = (e, t) => w.suspend(() => w.fromAsyncIterable(t(), (t) => Ee(e, `read stream failed: ${String(t?.message ?? t)}`, !0))).pipe(w.map((e) => e instanceof Uint8Array ? e : new Uint8Array(e))), je = async (e) => {
 	let { Readable: t } = await import("node:stream");
 	return t.fromWeb(w.toReadableStream(e));
-}, je = (e, t) => e.getStream ? e.getStream(t) : e.get(t).pipe(y.map((e) => ({
-	stream: De(e.bytes),
+}, Me = (e, t) => e.getStream ? e.getStream(t) : e.get(t).pipe(y.map((e) => ({
+	stream: Oe(e.bytes),
 	contentType: e.contentType,
 	size: e.bytes.byteLength
-}))), Me = (e, t, n, r) => e.putStream ? e.putStream(t, n, r) : Oe(n).pipe(y.flatMap((n) => e.put(t, n, {
+}))), Ne = (e, t, n, r) => e.putStream ? e.putStream(t, n, r) : ke(n).pipe(y.flatMap((n) => e.put(t, n, {
 	contentType: r.contentType,
 	...r.public === void 0 ? {} : { public: r.public }
-}))), V = "_voltro_storage_refs", H = "_voltro_storage_grants", U = "_voltro_storage_blobs", Ne = "_voltro_storage_usage", Pe = N(V, {
-	id: de({ prefix: "file" }),
-	tenantId: P().nullable(),
-	ownerId: P().nullable(),
-	bucket: P(),
-	key: P(),
-	contentType: P(),
-	size: k(),
-	checksum: P(),
-	visibility: P(),
-	accessPolicy: A().nullable(),
-	passwordHash: P().nullable(),
-	width: k().nullable(),
-	height: k().nullable(),
-	duration: k().nullable(),
-	placeholder: P().nullable(),
-	folder: P().nullable(),
-	tags: A().nullable(),
-	alt: P().nullable(),
-	caption: P().nullable(),
-	derivedFrom: P().nullable(),
-	kind: P().nullable(),
-	createdAt: me()
-}).index(["key"]).index(["tenantId"]).index(["ownerId"]).index(["folder"]).index(["derivedFrom"]), Fe = N(H, {
-	id: de({ prefix: "sgrant" }),
-	refId: P(),
-	principalType: P(),
-	principalId: P(),
-	permission: P(),
-	createdAt: me(),
-	expiresAt: me().nullable(),
-	createdBy: P().nullable()
-}).index(["refId"]).index(["principalId"]), Ie = N(Ne, {
-	id: de({ prefix: "susage" }),
-	tenantId: P().maxLength(191),
-	bytes: k().default(0),
-	count: k().default(0),
-	updatedAt: me()
-}).unique("byStorageUsageTenant", ["tenantId"]), Le = N(U, {
-	id: de({ prefix: "blob" }),
-	key: P(),
-	data: ue(),
-	contentType: P(),
-	size: k()
-}).index(["key"]), W = F([
+}))), V = "_voltro_storage_refs", H = "_voltro_storage_grants", U = "_voltro_storage_blobs", Pe = "_voltro_storage_usage", Fe = P(V, {
+	id: ue({ prefix: "file" }),
+	tenantId: F().nullable(),
+	ownerId: F().nullable(),
+	bucket: F(),
+	key: F(),
+	contentType: F(),
+	size: A(),
+	checksum: F(),
+	visibility: F(),
+	accessPolicy: j().nullable(),
+	passwordHash: F().nullable(),
+	width: A().nullable(),
+	height: A().nullable(),
+	duration: A().nullable(),
+	placeholder: F().nullable(),
+	folder: F().nullable(),
+	tags: j().nullable(),
+	alt: F().nullable(),
+	caption: F().nullable(),
+	derivedFrom: F().nullable(),
+	kind: F().nullable(),
+	createdAt: pe()
+}).index(["key"]).index(["tenantId"]).index(["ownerId"]).index(["folder"]).index(["derivedFrom"]), Ie = P(H, {
+	id: ue({ prefix: "sgrant" }),
+	refId: F(),
+	principalType: F(),
+	principalId: F(),
+	permission: F(),
+	createdAt: pe(),
+	expiresAt: pe().nullable(),
+	createdBy: F().nullable()
+}).index(["refId"]).index(["principalId"]), Le = P(Pe, {
+	id: ue({ prefix: "susage" }),
+	tenantId: F().maxLength(191),
+	bytes: A().default(0),
+	count: A().default(0),
+	updatedAt: pe()
+}).unique("byStorageUsageTenant", ["tenantId"]), Re = P(U, {
+	id: ue({ prefix: "blob" }),
+	key: F(),
+	data: le(),
+	contentType: F(),
+	size: A()
+}).index(["key"]), W = me([
 	{
 		name: "STORAGE_PROVIDER",
 		required: !1,
@@ -237,11 +238,11 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 	message: n,
 	transient: r,
 	...i === void 0 ? {} : { status: i }
-}), Re = (e) => e === void 0 || e === 408 || e === 429 || e >= 500, ze = /* @__PURE__ */ new Map(), Be = (e, t) => ze.get(e)?.get(t)?.bytes, Ve = (e) => {
-	ze.get(e)?.clear();
-}, He = (e = "default") => {
-	let t = ze.get(e) ?? /* @__PURE__ */ new Map();
-	return ze.set(e, t), {
+}), ze = (e) => e === void 0 || e === 408 || e === 429 || e >= 500, Be = /* @__PURE__ */ new Map(), Ve = (e, t) => Be.get(e)?.get(t)?.bytes, He = (e) => {
+	Be.get(e)?.clear();
+}, Ue = (e = "default") => {
+	let t = Be.get(e) ?? /* @__PURE__ */ new Map();
+	return Be.set(e, t), {
 		name: "memory",
 		presigns: !1,
 		put: (e, n, r) => y.sync(() => (t.set(e, {
@@ -265,7 +266,7 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 			return n ? { size: n.bytes.byteLength } : null;
 		})
 	};
-}, Ue = (e) => {
+}, We = (e) => {
 	let t = e.root, n = async (e) => {
 		let { join: n, resolve: r, sep: i } = await import("node:path"), a = r(t), o = r(a, e);
 		if (o !== a && !o.startsWith(a + i)) throw Error(`key '${e}' escapes the storage root`);
@@ -316,7 +317,7 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 		getStream: (e) => r(async () => {
 			let t = await import("node:fs/promises"), { createReadStream: r } = await import("node:fs"), i = await n(e), a = await t.stat(i);
 			return {
-				stream: ke("filesystem", () => r(i)),
+				stream: Ae("filesystem", () => r(i)),
 				contentType: "application/octet-stream",
 				size: a.size
 			};
@@ -326,7 +327,7 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 			await r.mkdir(i(c), { recursive: !0 });
 			let l = `${c}.tmp-${a()}`;
 			try {
-				await s(await Ae(t), o(l));
+				await s(await je(t), o(l));
 				let e = await r.stat(l);
 				return await r.rename(l, c), { size: e.size };
 			} catch (e) {
@@ -341,10 +342,10 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 					end: i
 				});
 				s.on("data", (e) => o.push(e)), s.on("end", () => e()), s.on("error", n);
-			}), Ee(o);
+			}), De(o);
 		}, e)
 	};
-}, We = (e) => {
+}, Ge = (e) => {
 	let t = e.name ?? "s3", n = e.publicAcl ?? !0, r = null, i = () => r || (r = (async () => {
 		let t, n;
 		try {
@@ -369,7 +370,7 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 		try: e,
 		catch: (e) => {
 			let n = e?.$metadata?.httpStatusCode;
-			return G(t, String(e?.message ?? e), Re(n), n);
+			return G(t, String(e?.message ?? e), ze(n), n);
 		}
 	}), o = async (e) => {
 		let t = e;
@@ -411,6 +412,14 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 			}));
 		}),
 		publicUrl: (t) => e.cdnBaseUrl ? `${e.cdnBaseUrl.replace(/\/$/, "")}/${t}` : null,
+		...n ? { setObjectPublic: (t, n) => a(async () => {
+			let { client: r, cmds: a } = await i();
+			await r.send(new a.PutObjectAclCommand({
+				Bucket: e.bucket,
+				Key: t,
+				ACL: n ? "public-read" : "private"
+			}));
+		}) } : {},
 		getUrl: (t, n) => a(async () => {
 			let { client: r, cmds: a, presign: o } = await i();
 			return o(r, new a.GetObjectCommand({
@@ -484,7 +493,7 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 			},
 			catch: (e) => {
 				let n = e?.$metadata?.httpStatusCode;
-				return G(t, String(e?.message ?? e), Re(n), n);
+				return G(t, String(e?.message ?? e), ze(n), n);
 			}
 		}),
 		getStream: (n) => a(async () => {
@@ -493,7 +502,7 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 				Key: n
 			})), s = o.Body;
 			return {
-				stream: ke(t, () => s),
+				stream: Ae(t, () => s),
 				contentType: o.ContentType ?? "application/octet-stream",
 				...o.ContentLength === void 0 ? {} : { size: o.ContentLength }
 			};
@@ -505,7 +514,7 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 			} catch (e) {
 				throw Error("s3/minio `putStream` requires the '@aws-sdk/lib-storage' optional dependency (multipart upload). Install it to enable streamed uploads.", { cause: e });
 			}
-			let l = await Ae(r);
+			let l = await je(r);
 			return await new c.Upload({
 				client: a,
 				params: {
@@ -529,7 +538,7 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 			return o(c.Body);
 		})
 	};
-}, Ge = (e) => e instanceof Uint8Array ? e : typeof e == "string" ? new Uint8Array(Buffer.from(e, "base64")) : new Uint8Array(e), Ke = () => {
+}, Ke = (e) => e instanceof Uint8Array ? e : typeof e == "string" ? new Uint8Array(Buffer.from(e, "base64")) : new Uint8Array(e), qe = () => {
 	let e = null, t = () => {
 		if (!e) throw Error("the 'database' storage provider isn't bound to a DataStore yet");
 		return e;
@@ -561,7 +570,7 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 				contentType: a.contentType,
 				size: i.byteLength
 			}) : await t().insert(U, {
-				id: O({
+				id: k({
 					kind: "typeid",
 					prefix: "blob"
 				}, U),
@@ -572,7 +581,7 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 			}), { size: i.byteLength };
 		}),
 		get: (e) => y.suspend(() => n(() => r(e)).pipe(y.flatMap((t) => t ? y.succeed({
-			bytes: Ge(t.data),
+			bytes: Ke(t.data),
 			contentType: String(t.contentType)
 		}) : y.fail(G("database", `no object at key '${e}'`, !1, 404))))),
 		delete: (e) => n(async () => {
@@ -586,7 +595,7 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 			return t ? { size: Number(t.size) } : null;
 		})
 	};
-}, qe = (e) => {
+}, Je = (e) => {
 	let t = null, n = () => t || (t = (async () => {
 		let t;
 		try {
@@ -604,7 +613,7 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 		try: e,
 		catch: (e) => {
 			let t = e?.statusCode;
-			return G("azure", String(e?.message ?? e), Re(t), t);
+			return G("azure", String(e?.message ?? e), ze(t), t);
 		}
 	}), i = async (e) => {
 		if (!e) return /* @__PURE__ */ new Uint8Array();
@@ -662,19 +671,19 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 			},
 			catch: (e) => {
 				let t = e?.statusCode;
-				return G("azure", String(e?.message ?? e), Re(t), t);
+				return G("azure", String(e?.message ?? e), ze(t), t);
 			}
 		}),
 		getStream: (e) => r(async () => {
 			let { container: t } = await n(), r = await t.getBlockBlobClient(e).download();
 			return {
-				stream: ke("azure", () => r.readableStreamBody),
+				stream: Ae("azure", () => r.readableStreamBody),
 				contentType: r.contentType ?? "application/octet-stream",
 				...r.contentLength === void 0 ? {} : { size: r.contentLength }
 			};
 		}),
 		putStream: (e, t, i) => r(async () => {
-			let { container: r } = await n(), a = await Ae(t);
+			let { container: r } = await n(), a = await je(t);
 			return await r.getBlockBlobClient(e).uploadStream(a, 4194304, 5, { blobHTTPHeaders: { blobContentType: i.contentType } }), { size: i.totalSize ?? (await r.getBlockBlobClient(e).getProperties()).contentLength ?? 0 };
 		}),
 		getRange: (e, t, a) => r(async () => {
@@ -682,98 +691,114 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 			return i(o.readableStreamBody);
 		})
 	};
-}, Je = {
+}, Ye = (e, t, n, r, i, a) => {
+	let o = n / r, s = Math.min(e, Math.round(t * o)), c = Math.min(t, Math.round(s / o)), l = (e, t) => Math.max(0, Math.min(t, e));
+	return {
+		left: l(Math.round(i * e - s / 2), e - s),
+		top: l(Math.round(a * t - c / 2), t - c),
+		width: s,
+		height: c
+	};
+}, Xe = {
 	webp: "image/webp",
 	avif: "image/avif",
 	jpeg: "image/jpeg",
 	jpg: "image/jpeg",
 	png: "image/png"
-}, Ye = (e) => {
+}, Ze = (e) => {
 	if (!e) return null;
 	let t = new URLSearchParams(e), n = (e) => {
 		let n = t.get(e);
 		if (n == null) return;
 		let r = Number(n);
 		return Number.isFinite(r) && r > 0 ? Math.floor(r) : void 0;
-	}, r = n("w"), i = n("h"), a = n("q"), o = (t.get("format") ?? t.get("fm") ?? void 0)?.toLowerCase(), s = t.get("fit") ?? void 0;
+	}, r = n("w"), i = n("h"), a = n("q"), o = (t.get("format") ?? t.get("fm") ?? void 0)?.toLowerCase(), s = t.get("fit") ?? void 0, c = (t.get("fp") ?? "").split(",").map(Number), l = c.length === 2 && c.every((e) => Number.isFinite(e) && e >= 0 && e <= 1) ? {
+		x: c[0],
+		y: c[1]
+	} : void 0;
 	return r === void 0 && i === void 0 && !o && a === void 0 ? null : {
 		...r === void 0 ? {} : { w: r },
 		...i === void 0 ? {} : { h: i },
 		...o ? { format: o } : {},
 		...a === void 0 ? {} : { q: a },
-		...s ? { fit: s } : {}
+		...s ? { fit: s } : {},
+		...l ? { fp: l } : {}
 	};
-}, Xe = (e) => e.startsWith("image/") && !e.includes("svg"), Ze, Qe = async () => {
-	if (Ze !== void 0) return Ze;
+}, Qe = (e) => e.startsWith("image/") && !e.includes("svg"), $e, et = async () => {
+	if ($e !== void 0) return $e;
 	try {
 		let e = await import("sharp");
-		Ze = e.default ?? e;
+		$e = e.default ?? e;
 	} catch {
-		Ze = null;
+		$e = null;
 	}
-	return Ze;
-}, $e = async (e, t, n) => {
-	if (!Xe(t)) return null;
-	let r = await Qe();
+	return $e;
+}, tt = async (e, t) => t ? null : Qe(e) ? await et() === null ? "no-sharp" : "failed" : "not-an-image", nt = async (e, t, n) => {
+	if (!Qe(t)) return null;
+	let r = await et();
 	if (!r) return null;
 	try {
-		let i = r(Buffer.from(e), { failOn: "none" });
+		let i = r(Buffer.from(e), { failOn: "none" }), a = n.fit ?? "cover";
+		if (n.fp !== void 0 && n.w !== void 0 && n.h !== void 0 && a === "cover") {
+			let e = await i.metadata();
+			e.width !== void 0 && e.height !== void 0 && (i = i.extract(Ye(e.width, e.height, n.w, n.h, n.fp.x, n.fp.y)));
+		}
 		(n.w !== void 0 || n.h !== void 0) && (i = i.resize({
 			...n.w === void 0 ? {} : { width: n.w },
 			...n.h === void 0 ? {} : { height: n.h },
 			fit: n.fit ?? "cover",
 			withoutEnlargement: !0
 		}));
-		let a = n.format && Je[n.format] ? n.format : void 0, o = t;
-		if (a) {
-			let e = a === "jpg" ? "jpeg" : a;
-			i = i.toFormat(e, n.q === void 0 ? {} : { quality: n.q }), o = Je[a];
+		let o = n.format && Xe[n.format] ? n.format : void 0, s = t;
+		if (o) {
+			let e = o === "jpg" ? "jpeg" : o;
+			i = i.toFormat(e, n.q === void 0 ? {} : { quality: n.q }), s = Xe[o];
 		} else n.q !== void 0 && (t === "image/jpeg" || t === "image/webp") && (i = i.toFormat(t === "image/webp" ? "webp" : "jpeg", { quality: n.q }));
-		let s = await i.toBuffer();
+		let c = await i.toBuffer();
 		return {
-			bytes: new Uint8Array(s),
-			contentType: o
+			bytes: new Uint8Array(c),
+			contentType: s
 		};
 	} catch {
 		return null;
 	}
-}, et = 200, tt = /* @__PURE__ */ new Map(), nt = async (e, t, n, r) => {
-	let i = `${e}::${JSON.stringify(r)}`, a = tt.get(i);
+}, rt = 200, it = /* @__PURE__ */ new Map(), at = async (e, t, n, r) => {
+	let i = `${e}::${JSON.stringify(r)}`, a = it.get(i);
 	if (a) return a;
-	let o = await $e(t, n, r);
-	if (o && (tt.set(i, o), tt.size > et)) {
-		let e = tt.keys().next().value;
-		e !== void 0 && tt.delete(e);
+	let o = await nt(t, n, r);
+	if (o && (it.set(i, o), it.size > rt)) {
+		let e = it.keys().next().value;
+		e !== void 0 && it.delete(e);
 	}
 	return o;
-}, rt = (e) => {
-	let t = L(16).toString("hex");
-	return `${t}:${_e(e, t, 32).toString("hex")}`;
-}, it = (e, t) => {
+}, ot = (e) => {
+	let t = ge(16).toString("hex");
+	return `${t}:${L(e, t, 32).toString("hex")}`;
+}, st = (e, t) => {
 	if (!e || !t) return !1;
 	let [n, r] = t.split(":");
 	if (!n || !r) return !1;
-	let i = Buffer.from(r, "hex"), a = _e(e, n, i.length);
+	let i = Buffer.from(r, "hex"), a = L(e, n, i.length);
 	return a.length === i.length && R(a, i);
-}, at = (e) => Array.isArray(e) ? e.filter((e) => typeof e == "string") : [], ot = (e) => at(e.metadata?.roles), st = (e) => at(e.scopes), ct = (e, t) => e.some((e) => t.includes(e)), lt = (e) => at(e.metadata?.groups), ut = (e) => typeof e == "boolean" ? y.succeed(e) : y.isEffect(e) ? e : y.promise(() => e), dt = (e, t, n = {}) => y.gen(function* () {
+}, ct = (e) => Array.isArray(e) ? e.filter((e) => typeof e == "string") : [], lt = (e) => ct(e.metadata?.roles), ut = (e) => ct(e.scopes), dt = (e, t) => e.some((e) => t.includes(e)), ft = (e) => ct(e.metadata?.groups), pt = (e) => typeof e == "boolean" ? y.succeed(e) : y.isEffect(e) ? e : y.promise(() => e), mt = (e, t, n = {}) => y.gen(function* () {
 	if (t.id && e.ownerId && t.id === e.ownerId) return !0;
 	let r = e.accessPolicy ?? [];
 	if (r.length === 0) return !1;
-	let i = n.resolveGroups ? yield* y.promise(async () => await n.resolveGroups(t)) : lt(t);
-	for (let a of r) if (yield* ft(a, e, t, i, n)) return !0;
+	let i = n.resolveGroups ? yield* y.promise(async () => await n.resolveGroups(t)) : ft(t);
+	for (let a of r) if (yield* ht(a, e, t, i, n)) return !0;
 	return !1;
-}), ft = (e, t, n, r, i) => y.gen(function* () {
+}), ht = (e, t, n, r, i) => y.gen(function* () {
 	let a = !1, o = (e) => (a = !0, e);
-	if (e.owner !== void 0 && e.owner && !o(!!n.id && !!t.ownerId && n.id === t.ownerId) || e.tenant !== void 0 && e.tenant && !o(!!n.tenantId && n.tenantId === t.tenantId) || e.apiKey !== void 0 && e.apiKey && !o(n.type === "apiKey") || e.roles && e.roles.length > 0 && !o(ct(ot(n), e.roles)) || e.groups && e.groups.length > 0 && !o(ct(r, e.groups)) || e.scopes && e.scopes.length > 0 && !o(ct(st(n), e.scopes)) || e.password !== void 0 && e.password && !o(it(i.password, t.passwordHash))) return !1;
+	if (e.owner !== void 0 && e.owner && !o(!!n.id && !!t.ownerId && n.id === t.ownerId) || e.tenant !== void 0 && e.tenant && !o(!!n.tenantId && n.tenantId === t.tenantId) || e.apiKey !== void 0 && e.apiKey && !o(n.type === "apiKey") || e.roles && e.roles.length > 0 && !o(dt(lt(n), e.roles)) || e.groups && e.groups.length > 0 && !o(dt(r, e.groups)) || e.scopes && e.scopes.length > 0 && !o(dt(ut(n), e.scopes)) || e.password !== void 0 && e.password && !o(st(i.password, t.passwordHash))) return !1;
 	if (e.guard) {
 		let r = i.guards?.[e.guard];
-		if (!o(r ? yield* ut(r({
+		if (!o(r ? yield* pt(r({
 			subject: n,
 			ref: t
 		})) : !1)) return !1;
 	}
 	return a;
-}), pt = (e, t) => {
+}), gt = (e, t) => {
 	let n = [];
 	e.id && n.push({
 		type: e.type === "apiKey" ? "apiKey" : "user",
@@ -784,13 +809,13 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 		id: e
 	});
 	return n;
-}, mt = (e, t, n, r, i) => {
-	let a = pt(t, n);
+}, _t = (e, t, n, r, i) => {
+	let a = gt(t, n);
 	return e.some((e) => e.expiresAt && e.expiresAt.getTime() < i || r === "write" && e.permission !== "write" ? !1 : a.some((t) => t.type === e.principalType && t.id === e.principalId));
-}, ht = (e, t) => t.resolveGroups ? y.promise(async () => await t.resolveGroups(e)) : y.succeed(lt(e)), K = () => W.read("VOLTRO_STORAGE_SECRET") ?? ce(), q = (e) => (typeof e == "string" ? Buffer.from(e, "utf8") : e).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, ""), J = (e) => {
+}, vt = (e, t) => t.resolveGroups ? y.promise(async () => await t.resolveGroups(e)) : y.succeed(ft(e)), K = () => W.read("VOLTRO_STORAGE_SECRET") ?? se(), q = (e) => (typeof e == "string" ? Buffer.from(e, "utf8") : e).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, ""), J = (e) => {
 	let t = e.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - e.length % 4) % 4);
 	return Buffer.from(t, "base64");
-}, gt = (e, t, n = K(), r = "/_voltro/storage") => {
+}, yt = (e, t, n = K(), r = "/_voltro/storage") => {
 	if (!n) throw Error("signGrant: secret must be a non-empty string");
 	let i = {
 		refId: e,
@@ -798,7 +823,7 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 		exp: Math.floor(Date.now() / 1e3) + Math.floor(t)
 	}, a = q(JSON.stringify(i));
 	return `${a}.${q(I("sha256", n).update(a).digest())}`;
-}, _t = (e, t = K()) => {
+}, bt = (e, t = K()) => {
 	if (!e || !t) return null;
 	let n = e.indexOf(".");
 	if (n <= 0 || n === e.length - 1) return null;
@@ -810,14 +835,14 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 	} catch {
 		return null;
 	}
-}, vt = (e, t, n = K()) => {
+}, xt = (e, t, n = K()) => {
 	if (!n) throw Error("signUploadTicket: secret must be a non-empty string");
 	let r = {
 		...e,
 		exp: Math.floor(Date.now() / 1e3) + Math.floor(t)
 	}, i = q(JSON.stringify(r));
 	return `${i}.${q(I("sha256", n).update(`u:${i}`).digest())}`;
-}, yt = (e, t = K()) => {
+}, St = (e, t = K()) => {
 	if (!e || !t) return null;
 	let n = e.indexOf(".");
 	if (n <= 0 || n === e.length - 1) return null;
@@ -829,14 +854,14 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 	} catch {
 		return null;
 	}
-}, bt = (e, t, n = K()) => {
+}, Ct = (e, t, n = K()) => {
 	if (!n) throw Error("signFinalizeTicket: secret must be a non-empty string");
 	let r = {
 		...e,
 		exp: Math.floor(Date.now() / 1e3) + Math.floor(t)
 	}, i = q(JSON.stringify(r));
 	return `${i}.${q(I("sha256", n).update(`f:${i}`).digest())}`;
-}, xt = (e, t = K()) => {
+}, wt = (e, t = K()) => {
 	if (!e || !t) return null;
 	let n = e.indexOf(".");
 	if (n <= 0 || n === e.length - 1) return null;
@@ -848,14 +873,14 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 	} catch {
 		return null;
 	}
-}, St = (e, t, n = K()) => {
+}, Tt = (e, t, n = K()) => {
 	if (!n) throw Error("signResumableTicket: secret must be a non-empty string");
 	let r = {
 		...e,
 		exp: Math.floor(Date.now() / 1e3) + Math.floor(t)
 	}, i = q(JSON.stringify(r));
 	return `${i}.${q(I("sha256", n).update(`r:${i}`).digest())}`;
-}, Ct = (e, t = K()) => {
+}, Et = (e, t = K()) => {
 	if (!e || !t) return null;
 	let n = e.indexOf(".");
 	if (n <= 0 || n === e.length - 1) return null;
@@ -867,14 +892,14 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 	} catch {
 		return null;
 	}
-}, wt = (e, t, n = K()) => {
+}, Dt = (e, t, n = K()) => {
 	if (!n) throw Error("signMultipartTicket: secret must be a non-empty string");
 	let r = {
 		...e,
 		exp: Math.floor(Date.now() / 1e3) + Math.floor(t)
 	}, i = q(JSON.stringify(r));
 	return `${i}.${q(I("sha256", n).update(`m:${i}`).digest())}`;
-}, Tt = (e, t = K()) => {
+}, Ot = (e, t = K()) => {
 	if (!e || !t) return null;
 	let n = e.indexOf(".");
 	if (n <= 0 || n === e.length - 1) return null;
@@ -886,14 +911,14 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 	} catch {
 		return null;
 	}
-}, Et = (e, t) => {
+}, kt = (e, t) => {
 	if (!t || t.length === 0) return !0;
 	let n = e.toLowerCase();
 	return t.some((e) => {
 		let t = e.toLowerCase();
 		return t.endsWith("/*") ? n.startsWith(t.slice(0, -1)) : n === t;
 	});
-}, Dt = [
+}, At = [
 	{
 		ct: /^image\/png$/,
 		offset: 0,
@@ -963,21 +988,21 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 		offset: 0,
 		magic: [31, 139]
 	}
-], Ot = (e, t) => {
-	let n = t.toLowerCase(), r = Dt.find((e) => e.ct.test(n));
+], jt = (e, t) => {
+	let n = t.toLowerCase(), r = At.find((e) => e.ct.test(n));
 	return r ? e.length < r.offset + r.magic.length ? !1 : r.magic.every((t, n) => e[r.offset + n] === t) : !0;
-}, kt = (e, t, n) => n ? n.maxBytes !== void 0 && e.byteLength > n.maxBytes ? {
+}, Mt = (e, t, n) => n ? n.maxBytes !== void 0 && e.byteLength > n.maxBytes ? {
 	reason: "too-large",
 	detail: `${e.byteLength} bytes exceeds the ${n.maxBytes}-byte limit`
-} : Et(t, n.allowedContentTypes) ? n.sniff && !Ot(e, t) ? {
+} : kt(t, n.allowedContentTypes) ? n.sniff && !jt(e, t) ? {
 	reason: "content-mismatch",
 	detail: `bytes do not match the declared content type '${t}'`
 } : null : {
 	reason: "content-type-not-allowed",
 	detail: `content type '${t}' is not in the allow-list`
-} : null, At = async (e, t, n) => {
-	if (!Xe(t)) return { bytes: e };
-	let r = await Qe();
+} : null, Nt = async (e, t, n) => {
+	if (!Qe(t)) return { bytes: e };
+	let r = await et();
 	if (!r) return { bytes: e };
 	try {
 		let t = e;
@@ -1000,47 +1025,63 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 	} catch {
 		return { bytes: e };
 	}
-}, jt = 67108864, Mt = (e) => new n({
+}, Pt = 67108864, Ft = (e) => new n({
 	reason: "too-large",
 	detail: `remote body exceeds the ${e}-byte ingest limit`
-}), Nt = (e, r) => y.suspend(() => {
-	let i = r ?? jt;
-	return !Number.isSafeInteger(i) || i < 0 ? y.fail(new t({
+}), It = (e, t) => new n({
+	reason: "blocked-source",
+	detail: `will not fetch ${e}: ${t}`
+}), Lt = (e, r, i = {}) => y.suspend(() => {
+	let a = r ?? Pt;
+	return !Number.isSafeInteger(a) || a < 0 ? y.fail(new t({
 		provider: "ingest",
 		message: "limits.maxBytes must be a non-negative safe integer",
 		transient: !1
 	})) : y.tryPromise({
 		try: async (n) => {
-			let r = await fetch(e, { signal: n }), a;
+			let r = e, o;
+			for (let e = 0;; e++) {
+				let t = ve(r, { ...i.allowHosts === void 0 ? {} : { allowHosts: i.allowHosts } });
+				if (t !== null) throw It(r, t);
+				o = await fetch(r, {
+					signal: n,
+					redirect: "manual"
+				});
+				let a = o.headers.get("location");
+				if (o.status < 300 || o.status >= 400 || a === null) break;
+				if (await o.body?.cancel().catch(() => {}), e >= (i.maxRedirects ?? 5)) throw It(r, "too many redirects");
+				r = new URL(a, r).toString();
+			}
+			let s;
 			try {
-				if (!r.ok) throw new t({
+				if (!o.ok) throw new t({
 					provider: "ingest",
-					message: `remote server returned HTTP ${r.status}`,
-					transient: r.status === 429 || r.status >= 500,
-					status: r.status
+					message: `remote server returned HTTP ${o.status}`,
+					transient: o.status === 429 || o.status >= 500,
+					status: o.status
 				});
-				let e = r.headers.get("content-length"), n = r.headers.get("content-encoding")?.trim().toLowerCase();
-				if ((!n || n === "identity") && e !== null && /^\d+$/.test(e) && BigInt(e) > BigInt(i)) throw Mt(i);
-				let o = /* @__PURE__ */ new Uint8Array(), s = 0;
-				if (r.body !== null) for (a = r.body.getReader();;) {
-					let e = await a.read();
+				let e = o.headers.get("content-length"), n = o.headers.get("content-encoding")?.trim().toLowerCase();
+				if ((!n || n === "identity") && e !== null && /^\d+$/.test(e) && BigInt(e) > BigInt(a)) throw Ft(a);
+				let r = /* @__PURE__ */ new Uint8Array(), i = 0;
+				if (o.body !== null) for (s = o.body.getReader();;) {
+					let e = await s.read();
 					if (e.done) break;
-					if (e.value.byteLength > i - s) throw Mt(i);
+					if (e.value.byteLength > a - i) throw Ft(a);
 					if (e.value.byteLength !== 0) {
-						let t = s + e.value.byteLength;
-						if (t > o.byteLength) {
-							let e = Math.min(i, Math.max(65536, o.byteLength * 2, t)), n = new Uint8Array(e);
-							n.set(o), o = n;
+						let t = i + e.value.byteLength;
+						if (t > r.byteLength) {
+							let e = Math.min(a, Math.max(65536, r.byteLength * 2, t)), n = new Uint8Array(e);
+							n.set(r), r = n;
 						}
-						o.set(e.value, s), s = t;
+						r.set(e.value, i), i = t;
 					}
 				}
 				return {
-					bytes: s === o.byteLength ? o : o.slice(0, s),
-					contentType: r.headers.get("content-type")?.split(";")[0]?.trim() || "application/octet-stream"
+					bytes: i === r.byteLength ? r : r.slice(0, i),
+					contentType: o.headers.get("content-type")?.split(";")[0]?.trim() || "application/octet-stream"
 				};
 			} finally {
-				a === void 0 ? await r.body?.cancel().catch(() => {}) : (await a.cancel().catch(() => {}), a.releaseLock());
+				s === void 0 ? await o.body?.cancel().catch(() => {}) : (await s.cancel().catch(() => {}), s.releaseLock());
 			}
 		},
 		catch: (e) => e instanceof n || e instanceof t ? e : new t({
@@ -1049,7 +1090,7 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 			transient: !0
 		})
 	});
-}), Pt = (e, t) => y.suspend(() => {
+}), Rt = (e, t) => y.suspend(() => {
 	if (t === void 0) return e;
 	if (t.aborted) return y.interrupt;
 	let n = y.async((e) => {
@@ -1057,7 +1098,7 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 		return t.addEventListener("abort", n, { once: !0 }), t.aborted && n(), y.sync(() => t.removeEventListener("abort", n));
 	});
 	return y.raceFirst(e, n);
-}), Ft = (e) => {
+}), zt = (e) => {
 	let r = (e, r) => y.tryPromise({
 		try: r,
 		catch: (r) => C.is(n)(r) ? r : new t({
@@ -1089,10 +1130,10 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 			"operation" in a && (a.operation.deleteKey !== null && (yield* e.provider.delete(a.operation.deleteKey)), yield* r("delete confirmation", () => e.metadata.confirmDelete(a.identity)));
 		})
 	};
-}, It = async (e) => {
+}, Bt = async (e) => {
 	let { createHash: t } = await import("node:crypto");
 	return t("sha256").update(e).digest("hex");
-}, Lt = (e, t, n) => `${e?.replace(/\/+$/, "") ?? ""}${n}/${t}`, Rt = (e) => {
+}, Vt = (e, t, n) => `${e?.replace(/\/+$/, "") ?? ""}${n}/${t}`, Ht = (e) => {
 	let t = /* @__PURE__ */ new Map(), n = {
 		public: 0,
 		private: 0
@@ -1108,7 +1149,7 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 		byTenant: Object.fromEntries(t),
 		visibility: n
 	};
-}, zt = (e, t) => {
+}, Ut = (e, t) => {
 	if (t.search && ![
 		e.id,
 		e.key,
@@ -1125,10 +1166,10 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 		if (!t.tags.every((e) => n.includes(e))) return !1;
 	}
 	return !0;
-}, Bt = (e) => e ?? "global", Vt = () => {
+}, Wt = (e) => e ?? "global", Gt = () => {
 	let e = /* @__PURE__ */ new Map(), t = /* @__PURE__ */ new Map();
 	return {
-		statistics: () => y.sync(() => Rt((function* () {
+		statistics: () => y.sync(() => Ht((function* () {
 			for (let t of e.values()) yield {
 				tenantId: t.tenantId,
 				visibility: t.visibility,
@@ -1143,6 +1184,16 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 		delete: (t) => y.sync(() => e.delete(t)),
 		listRecent: (t) => y.sync(() => [...e.values()].sort((e, t) => t.createdAt.getTime() - e.createdAt.getTime() || t.id.localeCompare(e.id)).slice(0, t)),
 		countByKey: (t, n) => y.sync(() => [...e.values()].filter((e) => e.bucket === t && e.key === n).length),
+		countPublicByKey: (t, n) => y.sync(() => [...e.values()].filter((e) => e.bucket === t && e.key === n && e.visibility === "public").length),
+		setVisibility: (t, n) => y.sync(() => {
+			let r = e.get(t);
+			if (r === void 0) return null;
+			let i = {
+				...r,
+				visibility: n
+			};
+			return e.set(t, i), i;
+		}),
 		usageByTenant: (t) => y.sync(() => {
 			let n = 0, r = 0;
 			for (let i of e.values()) (i.tenantId ?? null) === (t ?? null) && (n += i.size, r++);
@@ -1152,7 +1203,7 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 			};
 		}),
 		consumeUsage: (e, n, r) => y.sync(() => {
-			let i = Bt(e), a = t.get(i) ?? {
+			let i = Wt(e), a = t.get(i) ?? {
 				bytes: 0,
 				count: 0
 			}, o = (r?.maxBytes === void 0 || a.bytes + n.bytes <= r.maxBytes) && (r?.maxCount === void 0 || a.count + n.count <= r.maxCount);
@@ -1166,16 +1217,16 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 			};
 		}),
 		releaseUsage: (e, n) => y.sync(() => {
-			let r = Bt(e), i = t.get(r);
+			let r = Wt(e), i = t.get(r);
 			i && t.set(r, {
 				bytes: Math.max(0, i.bytes - n.bytes),
 				count: Math.max(0, i.count - n.count)
 			});
 		}),
 		listByDerivedFrom: (t) => y.sync(() => [...e.values()].filter((e) => (e.derivedFrom ?? null) === t)),
-		listRefs: (t) => y.sync(() => [...e.values()].filter((e) => zt(e, t)).sort((e, t) => t.createdAt.getTime() - e.createdAt.getTime() || t.id.localeCompare(e.id)).slice(t.offset, t.offset + t.limit))
+		listRefs: (t) => y.sync(() => [...e.values()].filter((e) => Ut(e, t)).sort((e, t) => t.createdAt.getTime() - e.createdAt.getTime() || t.id.localeCompare(e.id)).slice(t.offset, t.offset + t.limit))
 	};
-}, Ht = (e) => Array.isArray(e) && e.every((e) => typeof e == "string") ? e : null, Y = (e) => ({
+}, Kt = (e) => Array.isArray(e) && e.every((e) => typeof e == "string") ? e : null, Y = (e) => ({
 	id: String(e.id),
 	tenantId: e.tenantId ?? null,
 	ownerId: e.ownerId ?? null,
@@ -1193,7 +1244,7 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 	duration: e.duration ?? null,
 	placeholder: e.placeholder ?? null,
 	folder: e.folder ?? null,
-	tags: Ht(e.tags),
+	tags: Kt(e.tags),
 	alt: e.alt ?? null,
 	caption: e.caption ?? null,
 	derivedFrom: e.derivedFrom ?? null,
@@ -1205,7 +1256,7 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 		message: String(e?.message ?? e),
 		transient: !0
 	})
-}), Ut = async (e, t) => (await e.query({
+}), qt = async (e, t) => (await e.query({
 	table: "_voltro_storage_usage",
 	predicate: {
 		column: "tenantId",
@@ -1216,8 +1267,8 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 	take: 1,
 	skip: void 0,
 	projection: void 0
-}))[0] ?? null, Wt = (e) => ({
-	statistics: () => X(async () => Rt((await e.query({
+}))[0] ?? null, Jt = (e) => ({
+	statistics: () => X(async () => Ht((await e.query({
 		table: V,
 		predicate: void 0,
 		order: [],
@@ -1283,6 +1334,34 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 		skip: void 0,
 		projection: void 0
 	})).length),
+	countPublicByKey: (t, n) => X(async () => (await e.query({
+		table: V,
+		predicate: { and: [
+			{
+				column: "bucket",
+				op: "eq",
+				value: t
+			},
+			{
+				column: "key",
+				op: "eq",
+				value: n
+			},
+			{
+				column: "visibility",
+				op: "eq",
+				value: "public"
+			}
+		] },
+		order: [],
+		take: void 0,
+		skip: void 0,
+		projection: ["id"]
+	})).length),
+	setVisibility: (t, n) => X(async () => {
+		let r = await e.update(V, t, { visibility: n });
+		return r ? Y(r) : null;
+	}),
 	usageByTenant: (t) => X(async () => {
 		let n = await e.query({
 			table: V,
@@ -1303,10 +1382,10 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 		};
 	}),
 	consumeUsage: (t, n, r) => X(async () => {
-		let i = Bt(t);
+		let i = Wt(t);
 		for (let t = 0; t < 32; t++) {
 			t > 0 && await new Promise((e) => setTimeout(e, t));
-			let a = await Ut(e, i), o = a ? Number(a.bytes ?? 0) : 0, s = a ? Number(a.count ?? 0) : 0;
+			let a = await qt(e, i), o = a ? Number(a.bytes ?? 0) : 0, s = a ? Number(a.count ?? 0) : 0;
 			if (!((r?.maxBytes === void 0 || o + n.bytes <= r.maxBytes) && (r?.maxCount === void 0 || s + n.count <= r.maxCount))) return {
 				allowed: !1,
 				bytes: o,
@@ -1317,16 +1396,16 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 					bytes: o + n.bytes,
 					count: s + n.count,
 					updatedAt: /* @__PURE__ */ new Date()
-				}, { where: T(D("id", String(a.id)), D("bytes", o), D("count", s)) }) === 1) return {
+				}, { where: E(O("id", String(a.id)), O("bytes", o), O("count", s)) }) === 1) return {
 					allowed: !0,
 					bytes: o,
 					count: s
 				};
 			} else {
-				let t = O({
+				let t = k({
 					kind: "typeid",
 					prefix: "susage"
-				}, Ne), r = await e.insertIgnore(Ne, {
+				}, Pe), r = await e.insertIgnore(Pe, {
 					id: t,
 					tenantId: i,
 					bytes: n.bytes,
@@ -1343,17 +1422,17 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 		throw Error(`storage usage consume: contention on tenant '${i}' exceeded 32 attempts`);
 	}),
 	releaseUsage: (t, n) => X(async () => {
-		let r = Bt(t);
+		let r = Wt(t);
 		for (let t = 0; t < 32; t++) {
 			t > 0 && await new Promise((e) => setTimeout(e, t));
-			let i = await Ut(e, r);
+			let i = await qt(e, r);
 			if (!i) return;
 			let a = Number(i.bytes ?? 0), o = Number(i.count ?? 0);
 			if (await e.updateMany("_voltro_storage_usage", {
 				bytes: Math.max(0, a - n.bytes),
 				count: Math.max(0, o - n.count),
 				updatedAt: /* @__PURE__ */ new Date()
-			}, { where: T(D("id", String(i.id)), D("bytes", a), D("count", o)) }) === 1) return;
+			}, { where: E(O("id", String(i.id)), O("bytes", a), O("count", o)) }) === 1) return;
 		}
 		throw Error(`storage usage release: contention on tenant '${r}' exceeded 32 attempts`);
 	}),
@@ -1374,14 +1453,14 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 	})).map(Y)),
 	listRefs: (t) => X(async () => {
 		let n = [];
-		t.tenantId !== void 0 && n.push(D("tenantId", t.tenantId)), t.ownerId !== void 0 && n.push(D("ownerId", t.ownerId)), t.search && n.push(fe(...[
+		t.tenantId !== void 0 && n.push(O("tenantId", t.tenantId)), t.ownerId !== void 0 && n.push(O("ownerId", t.ownerId)), t.search && n.push(N(...[
 			"id",
 			"key",
 			"contentType",
 			"ownerId",
 			"tenantId"
-		].map((e) => E(e, t.search))));
-		let r = t.folder === void 0 && t.tags.length === 0 && t.includeDerived, i = n.length ? T(...n) : void 0, a = await e.query({
+		].map((e) => D(e, t.search))));
+		let r = t.folder === void 0 && t.tags.length === 0 && t.includeDerived, i = n.length ? E(...n) : void 0, a = await e.query({
 			table: V,
 			predicate: i,
 			order: [{
@@ -1395,9 +1474,9 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 			skip: r ? t.offset : void 0,
 			projection: void 0
 		});
-		return r ? a.map(Y) : a.map(Y).filter((e) => zt(e, t)).slice(t.offset, t.offset + t.limit);
+		return r ? a.map(Y) : a.map(Y).filter((e) => Ut(e, t)).slice(t.offset, t.offset + t.limit);
 	})
-}), Gt = () => {
+}), Yt = () => {
 	let e = /* @__PURE__ */ new Map();
 	return {
 		insert: (t) => y.sync(() => {
@@ -1412,7 +1491,7 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 			for (let [n, r] of e) r.refId === t && e.delete(n);
 		})
 	};
-}, Kt = (e) => ({
+}, Xt = (e) => ({
 	id: String(e.id),
 	refId: String(e.refId),
 	principalType: e.principalType,
@@ -1421,7 +1500,7 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 	createdAt: e.createdAt instanceof Date ? e.createdAt : new Date(String(e.createdAt)),
 	expiresAt: e.expiresAt ? e.expiresAt instanceof Date ? e.expiresAt : new Date(String(e.expiresAt)) : null,
 	createdBy: e.createdBy ?? null
-}), qt = (e) => ({
+}), Zt = (e) => ({
 	insert: (t) => X(() => e.insert(H, { ...t })),
 	delete: (t) => X(() => e.delete(H, t)),
 	getById: (t) => X(async () => {
@@ -1437,7 +1516,7 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 			skip: void 0,
 			projection: void 0
 		}))[0];
-		return n ? Kt(n) : null;
+		return n ? Xt(n) : null;
 	}),
 	listByRef: (t) => X(async () => (await e.query({
 		table: H,
@@ -1453,7 +1532,7 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 		take: void 0,
 		skip: void 0,
 		projection: void 0
-	})).map(Kt)),
+	})).map(Xt)),
 	deleteByRef: (t) => X(async () => {
 		let n = await e.query({
 			table: H,
@@ -1469,14 +1548,14 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 		});
 		for (let t of n) await e.delete(H, String(t.id));
 	})
-}), Jt = () => O({
+}), Qt = () => k({
 	kind: "typeid",
 	prefix: "file"
-}, V), Yt = () => O({
+}, V), $t = () => k({
 	kind: "typeid",
 	prefix: "grant"
-}, H), Xt = (i) => {
-	let { provider: a, refStore: o, grantStore: s, bucket: c } = i, l = i.access ?? {}, u = i.attempts ?? 3, d = i.urlExpiresInSec ?? 3600, f = (e) => Lt(i.publicBaseUrl, e, i.httpPath ?? "/_voltro/storage"), p = S.recurs(Math.max(0, u - 1)).pipe(S.intersect(S.exponential("100 millis")), S.whileInput((e) => e.transient)), m = (e, t, n) => [
+}, H), en = (i) => {
+	let { provider: a, refStore: o, grantStore: s, bucket: c } = i, l = i.access ?? {}, u = i.attempts ?? 3, d = i.urlExpiresInSec ?? 3600, f = (e) => Vt(i.publicBaseUrl, e, i.httpPath ?? "/_voltro/storage"), p = S.recurs(Math.max(0, u - 1)).pipe(S.intersect(S.exponential("100 millis")), S.whileInput((e) => e.transient)), m = (e, t, n) => [
 		i.tenantPrefix,
 		e ?? "global",
 		n ?? t
@@ -1516,7 +1595,7 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 				transient: !1
 			})
 		});
-		return c === void 0 ? r === void 0 ? !1 : yield* y.fail(s(`claim '${r}' cannot be released: ref '${e}' was not written through an operation and holds no claims`)) : (yield* h(c.ref, n), yield* Ft({
+		return c === void 0 ? r === void 0 ? !1 : yield* y.fail(s(`claim '${r}' cannot be released: ref '${e}' was not written through an operation and holds no claims`)) : (yield* h(c.ref, n), yield* zt({
 			metadata: o,
 			provider: {
 				...a,
@@ -1556,7 +1635,7 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 			catch: () => null
 		}).pipe(y.catchAll(() => y.succeed(null)));
 	}), _ = (e) => y.gen(function* () {
-		let t = kt(e.bytes, e.contentType, i.limits);
+		let t = Mt(e.bytes, e.contentType, i.limits);
 		if (t) return yield* y.fail(new n(t));
 		if (e.claim !== void 0 && e.operationId === void 0) return yield* y.fail(new n({
 			reason: "claim-without-operation",
@@ -1570,11 +1649,11 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 			});
 			if (!t.clean) return yield* y.fail(new r({ threat: t.threat ?? "unknown" }));
 		}
-		let s = yield* y.promise(() => At(e.bytes, e.contentType, { normalize: i.normalizeImages ?? !1 })), l = s.bytes, u = yield* ie({
+		let s = yield* y.promise(() => Nt(e.bytes, e.contentType, { normalize: i.normalizeImages ?? !1 })), l = s.bytes, u = yield* ie({
 			bytes: l,
 			contentType: e.contentType
-		}), d = s.width ?? u?.width, f = s.height ?? u?.height, te = s.placeholder ?? u?.poster, h = e.duration ?? u?.duration, ne = yield* y.promise(() => It(l)), g = e.tenantId ?? null, _ = e.visibility ?? "private", v = m(g, ne, yield* ee(e.key)), S = e.password ? yield* y.sync(() => rt(e.password)) : null, C = {
-			id: Jt(),
+		}), d = s.width ?? u?.width, f = s.height ?? u?.height, te = s.placeholder ?? u?.poster, h = e.duration ?? u?.duration, ne = yield* y.promise(() => Bt(l)), g = e.tenantId ?? null, _ = e.visibility ?? "private", v = m(g, ne, yield* ee(e.key)), S = e.password ? yield* y.sync(() => ot(e.password)) : null, C = {
+			id: Qt(),
 			tenantId: g,
 			ownerId: e.ownerId ?? null,
 			bucket: c,
@@ -1596,7 +1675,7 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 			...e.caption === void 0 ? {} : { caption: e.caption },
 			...e.derivedFrom === void 0 ? {} : { derivedFrom: e.derivedFrom },
 			...e.kind === void 0 ? {} : { kind: e.kind }
-		}, w = i.transcode !== void 0 && i.autoTranscode !== !1, ae = (t) => w && t.derivedFrom == null && (e.contentType.startsWith("video/") || e.contentType.startsWith("audio/")) ? y.forkDaemon(x(t).pipe(y.ignore)) : y.void;
+		}, w = i.transcode !== void 0 && i.autoTranscode !== !1, T = (t) => w && t.derivedFrom == null && (e.contentType.startsWith("video/") || e.contentType.startsWith("audio/")) ? y.forkDaemon(x(t).pipe(y.ignore)) : y.void;
 		if (e.operationId !== void 0) {
 			let t = i.objects?.();
 			if (t === void 0) return yield* y.fail(new n({
@@ -1609,7 +1688,7 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 				operationId: e.operationId,
 				checksum: ne,
 				logicalKey: v,
-				fingerprint: yield* y.promise(() => It(new TextEncoder().encode(JSON.stringify([
+				fingerprint: yield* y.promise(() => Bt(new TextEncoder().encode(JSON.stringify([
 					ne,
 					e.contentType,
 					_,
@@ -1625,7 +1704,7 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 					h ?? null,
 					e.password !== void 0
 				]))))
-			}, o = yield* Ft({
+			}, o = yield* zt({
 				metadata: t,
 				provider: {
 					...a,
@@ -1638,26 +1717,26 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 				...i.quota === void 0 ? {} : { quota: i.quota },
 				...e.claim === void 0 ? {} : { claim: e.claim }
 			});
-			return yield* ae(o.ref), {
+			return yield* T(o.ref), {
 				...o.ref,
 				outcome: o.outcome
 			};
 		}
-		let oe = {
+		let ae = {
 			bytes: l.byteLength,
 			count: 1
-		}, se = yield* o.consumeUsage(g, oe, i.quota);
-		if (!se.allowed) {
-			let e = i.quota ?? {}, t = e.maxCount !== void 0 && se.count + 1 > e.maxCount ? `tenant object count ${se.count} + 1 exceeds max ${e.maxCount}` : `tenant usage ${se.bytes} + ${l.byteLength} bytes exceeds max ${e.maxBytes}`;
+		}, oe = yield* o.consumeUsage(g, ae, i.quota);
+		if (!oe.allowed) {
+			let e = i.quota ?? {}, t = e.maxCount !== void 0 && oe.count + 1 > e.maxCount ? `tenant object count ${oe.count} + 1 exceeds max ${e.maxCount}` : `tenant usage ${oe.bytes} + ${l.byteLength} bytes exceeds max ${e.maxBytes}`;
 			return yield* y.fail(new n({
 				reason: "quota-exceeded",
 				detail: t
 			}));
 		}
-		return yield* ((e) => e.pipe(y.onExit((e) => b.isSuccess(e) ? y.void : o.delete(C.id).pipe(y.zipRight(o.releaseUsage(g, oe)), y.ignore))))(o.insert(C).pipe(y.zipRight(a.put(v, l, {
+		return yield* ((e) => e.pipe(y.onExit((e) => b.isSuccess(e) ? y.void : o.delete(C.id).pipe(y.zipRight(o.releaseUsage(g, ae)), y.ignore))))(o.insert(C).pipe(y.zipRight(a.put(v, l, {
 			contentType: e.contentType,
 			public: _ === "public"
-		}).pipe(y.retry(p))))), yield* ae(C), {
+		}).pipe(y.retry(p))))), yield* T(C), {
 			...C,
 			outcome: "created"
 		};
@@ -1695,13 +1774,13 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 		}
 		return r;
 	}), C = (e, t, n) => y.gen(function* () {
-		if (e.visibility === "public" || (yield* dt(e, t, {
+		if (e.visibility === "public" || (yield* mt(e, t, {
 			...l,
 			...n?.password === void 0 ? {} : { password: n.password }
 		}))) return !0;
-		let r = yield* ht(t, l);
-		return mt(yield* s.listByRef(e.id), t, r, n?.permission ?? "read", Date.now());
-	}), ae = (e) => {
+		let r = yield* vt(t, l);
+		return _t(yield* s.listByRef(e.id), t, r, n?.permission ?? "read", Date.now());
+	}), T = (e) => {
 		if (e.visibility === "public") {
 			let t = a.publicUrl?.(e.key);
 			if (t != null) return t;
@@ -1738,12 +1817,46 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 				totalSize: r
 			})));
 		})),
-		getUrl: (e, t) => g(e, t?.tenantId).pipe(y.flatMap((e) => e.visibility === "public" ? y.succeed(ae(e)) : a.presigns ? a.getUrl(e.key, t?.expiresInSec ?? d) : y.succeed(f(e.id)))),
+		getUrl: (e, t) => g(e, t?.tenantId).pipe(y.flatMap((e) => e.visibility === "public" ? y.succeed(T(e)) : a.presigns ? a.getUrl(e.key, t?.expiresInSec ?? d) : y.succeed(f(e.id)))),
 		head: (e, t) => o.getById(e).pipe(y.flatMap((e) => e ? h(e, t?.tenantId).pipe(y.map((e) => e)) : y.succeed(null))),
 		delete: (e, t) => ne(e, t?.tenantId, t?.claim).pipe(y.flatMap((n) => n ? y.void : g(e, t?.tenantId).pipe(y.flatMap((t) => s.deleteByRef(e).pipe(y.flatMap(() => o.delete(e)), y.flatMap((e) => e ? o.countByKey(t.bucket, t.key).pipe(y.flatMap((e) => e === 0 ? a.delete(t.key).pipe(y.retry(p)) : y.void), y.flatMap(() => o.releaseUsage(t.tenantId, {
 			bytes: t.size,
 			count: 1
 		}))) : y.void), y.asVoid))))),
+		signedUrl: (e, t) => g(e, t?.tenantId).pipe(y.flatMap((e) => {
+			if (e.visibility === "public") return y.succeed(T(e));
+			let n = t?.expiresInSec ?? d;
+			return a.presigns ? a.getUrl(e.key, n) : y.sync(() => `${f(e.id)}?t=${yt(e.id, n, void 0, i.httpPath ?? "/_voltro/storage")}`);
+		})),
+		setVisibility: (e, r, i) => y.gen(function* () {
+			let s = yield* g(e, i?.tenantId);
+			if (s.visibility === r) return s;
+			let c = o.setVisibility;
+			if (c === void 0) return yield* y.fail(new n({
+				reason: "visibility-unsupported",
+				detail: "the ref store cannot change a stored object's visibility"
+			}));
+			if (r === "private" && a.publicUrl?.(s.key) != null) return yield* y.fail(new n({
+				reason: "visibility-unsupported",
+				detail: `objects are served from a public base (${a.name} cdnBaseUrl); a public object cannot be made private there`
+			}));
+			if (r === "private" && a.setObjectPublic !== void 0 && o.countPublicByKey === void 0) return yield* y.fail(new n({
+				reason: "visibility-unsupported",
+				detail: "the ref store cannot tell whether other refs keep these bytes public"
+			}));
+			let l = yield* c(s.id, r);
+			if (l === null) return yield* y.fail(new t({
+				provider: a.name,
+				message: `no ref '${e}'`,
+				transient: !1,
+				status: 404
+			}));
+			if (a.setObjectPublic !== void 0) {
+				let e = o.countPublicByKey, t = r === "public" || e !== void 0 && (yield* e(s.bucket, s.key)) > 0;
+				yield* a.setObjectPublic(s.key, t);
+			}
+			return l;
+		}),
 		mintUrl: (n, r, s) => y.gen(function* () {
 			let c = yield* o.getById(n).pipe(y.flatMap((e) => e ? y.succeed(e) : y.fail(new t({
 				provider: a.name,
@@ -1751,14 +1864,14 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 				transient: !1,
 				status: 404
 			}))));
-			if (c.visibility === "public") return ae(c);
+			if (c.visibility === "public") return T(c);
 			if (!(yield* C(c, r, s?.password === void 0 ? {} : { password: s.password }))) return yield* y.fail(new e({
 				refId: n,
 				reason: "access denied"
 			}));
 			let l = s?.expiresInSec ?? d;
 			if (a.presigns) return yield* a.getUrl(c.key, l);
-			let u = yield* y.sync(() => gt(c.id, l, void 0, i.httpPath ?? "/_voltro/storage"));
+			let u = yield* y.sync(() => yt(c.id, l, void 0, i.httpPath ?? "/_voltro/storage"));
 			return `${f(c.id)}?t=${u}`;
 		}),
 		mintUploadUrl: (e) => y.gen(function* () {
@@ -1774,7 +1887,7 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 		checkAccess: C,
 		grant: (e) => y.gen(function* () {
 			let t = {
-				id: Yt(),
+				id: $t(),
 				refId: e.refId,
 				principalType: e.principalType,
 				principalId: e.principalId,
@@ -1824,8 +1937,8 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 				removed: i
 			};
 		}),
-		ingestUrl: (e, t) => Pt(y.gen(function* () {
-			let n = yield* Nt(e, i.limits?.maxBytes);
+		ingestUrl: (e, t) => Rt(y.gen(function* () {
+			let n = yield* Lt(e, i.limits?.maxBytes, i.ingest);
 			return yield* _({
 				bytes: n.bytes,
 				contentType: t?.contentType ?? n.contentType,
@@ -1833,6 +1946,7 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 				...t?.operationId === void 0 ? {} : { operationId: t.operationId },
 				...t?.ownerId === void 0 ? {} : { ownerId: t.ownerId },
 				...t?.visibility === void 0 ? {} : { visibility: t.visibility },
+				...t?.access === void 0 ? {} : { access: t.access },
 				...t?.key === void 0 ? {} : { key: t.key },
 				...t?.folder === void 0 ? {} : { folder: t.folder },
 				...t?.tags === void 0 ? {} : { tags: t.tags },
@@ -1847,7 +1961,7 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 				transient: !1,
 				status: 400
 			}));
-			let n = e.expiresInSec ?? d, r = `_incoming/${O({
+			let n = e.expiresInSec ?? d, r = `_incoming/${k({
 				kind: "typeid",
 				prefix: "up"
 			}, V)}`, i = m(e.tenantId ?? null, "", r);
@@ -1914,7 +2028,7 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 				}
 				let i = /* @__PURE__ */ new Uint8Array(), s = 0;
 				for (let t = 0; t < e.count; t++) {
-					let e = yield* je(a, o(t)).pipe(y.retry(p));
+					let e = yield* Me(a, o(t)).pipe(y.retry(p));
 					yield* w.runForEach(e.stream, (e) => y.gen(function* () {
 						if (e.byteLength > r - s) return yield* y.fail(c());
 						let t = s + e.byteLength;
@@ -1948,7 +2062,7 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 				transient: !1,
 				status: 400
 			}));
-			let n = m(e.tenantId ?? null, "", `multipart/${O({
+			let n = m(e.tenantId ?? null, "", `multipart/${k({
 				kind: "typeid",
 				prefix: "mp"
 			}, V)}`);
@@ -1979,7 +2093,7 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 				detail: `multipart upload of ${l} bytes exceeds tenant quota`
 			}));
 			let m = {
-				id: Jt(),
+				id: Qt(),
 				tenantId: e.tenantId ?? null,
 				ownerId: e.ownerId ?? null,
 				bucket: c,
@@ -2000,33 +2114,33 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 		}),
 		abortMultipart: (e) => y.suspend(() => a.abortMultipartUpload ? a.abortMultipartUpload(e.key, e.uploadId).pipe(y.retry(p)) : y.void)
 	};
-}, Zt = (e) => x.succeed(i, Xt(e)), Qt = "_voltro_storage_operation_locks", Z = "_voltro_storage_object_heads", Q = "_voltro_storage_operations", $t = "_voltro_storage_object_claims", en = [
-	N(Qt, {
-		id: P().maxLength(64),
-		nonce: P()
+}, tn = (e) => x.succeed(i, en(e)), nn = "_voltro_storage_operation_locks", Z = "_voltro_storage_object_heads", rn = "_voltro_storage_operations", an = "_voltro_storage_object_claims", on = [
+	P(nn, {
+		id: F().maxLength(64),
+		nonce: F()
 	}).primaryKey(["id"]).nonReactive(),
-	N(Z, {
-		id: P().maxLength(64),
-		generation: P(),
-		key: P(),
-		reservations: k()
+	P(Z, {
+		id: F().maxLength(64),
+		generation: F(),
+		key: F(),
+		reservations: A()
 	}).primaryKey(["id"]).nonReactive(),
-	N(Q, {
-		id: P().maxLength(64),
-		objectId: P().maxLength(64),
-		fingerprint: P().maxLength(64),
-		generation: P(),
-		key: P(),
-		refId: P(),
-		state: P(),
-		deleteKey: P().nullable()
+	P(rn, {
+		id: F().maxLength(64),
+		objectId: F().maxLength(64),
+		fingerprint: F().maxLength(64),
+		generation: F(),
+		key: F(),
+		refId: F(),
+		state: F(),
+		deleteKey: F().nullable()
 	}).primaryKey(["id"]).nonReactive(),
-	N($t, {
-		id: P().maxLength(64),
-		operationId: P().maxLength(64),
-		claim: P()
+	P(an, {
+		id: F().maxLength(64),
+		operationId: F().maxLength(64),
+		claim: F()
 	}).primaryKey(["id"]).nonReactive()
-], tn = C.Struct({
+], sn = C.Struct({
 	id: C.String,
 	objectId: C.String,
 	fingerprint: C.String,
@@ -2035,71 +2149,71 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 	refId: C.String,
 	state: C.Literal("reserved", "ready", "deleting", "deleted"),
 	deleteKey: C.NullOr(C.String)
-}), nn = C.Struct({
+}), cn = C.Struct({
 	id: C.String,
 	generation: C.String,
 	key: C.String,
 	reservations: C.Int.pipe(C.nonNegative())
-}), rn = (e) => he("sha256").update(JSON.stringify(e)).digest("hex"), an = (e, t) => rn([e, t]), on = (e) => {
+}), ln = (e) => he("sha256").update(JSON.stringify(e)).digest("hex"), un = (e, t) => ln([e, t]), dn = (e) => {
 	if (!e.bucket || !e.operationId || !e.logicalKey || !/^[a-f0-9]{64}$/.test(e.fingerprint) || !/^[a-f0-9]{64}$/.test(e.checksum)) throw Error("Storage operation requires a bucket, operation identity, key and SHA-256 fingerprint");
 	return {
-		id: rn([
+		id: ln([
 			e.bucket,
 			e.tenantId,
 			e.operationId
 		]),
-		objectId: rn([
+		objectId: ln([
 			e.bucket,
 			e.tenantId,
 			e.logicalKey,
 			e.checksum
 		]),
-		lockId: rn([e.tenantId])
+		lockId: ln([e.tenantId])
 	};
-}, sn = async (e, t, n) => {
-	let { lockId: r } = on(t);
-	return await e.insertIgnoreWithOutcome(Qt, {
+}, fn = async (e, t, n) => {
+	let { lockId: r } = dn(t);
+	return await e.insertIgnoreWithOutcome(nn, {
 		id: r,
-		nonce: ge()
+		nonce: _e()
 	}, { conflictColumns: ["id"] }), e.transactional(async (e) => {
 		if ((await e.query({
-			table: Qt,
-			predicate: D("id", r),
+			table: nn,
+			predicate: O("id", r),
 			lock: "update",
 			order: [],
 			take: 1,
 			skip: void 0,
 			projection: void 0
-		})).length !== 1 || await e.update(Qt, r, { nonce: ge() }) === null) throw Error("Storage operation lock is unavailable");
+		})).length !== 1 || await e.update(nn, r, { nonce: _e() }) === null) throw Error("Storage operation lock is unavailable");
 		return n(e);
 	});
-}, $ = async (e, t) => {
-	let r = on(t), i = await e.query({
-		table: Q,
-		predicate: D("id", r.id),
+}, Q = async (e, t) => {
+	let r = dn(t), i = await e.query({
+		table: rn,
+		predicate: O("id", r.id),
 		order: [],
 		take: 1,
 		skip: void 0,
 		projection: void 0
 	});
 	if (!i[0]) return;
-	let a = C.decodeUnknownSync(tn)(i[0]);
+	let a = C.decodeUnknownSync(sn)(i[0]);
 	if (a.fingerprint !== t.fingerprint || a.objectId !== r.objectId) throw new n({
 		reason: "operation-identity-reused",
 		detail: `storage operation '${t.operationId}' was already used with different inputs`
 	});
 	return a;
-}, cn = async (e, t) => {
-	let n = await $(e, t);
+}, pn = async (e, t) => {
+	let n = await Q(e, t);
 	if (n) return n;
-	let { id: r, objectId: i } = on(t), a = await e.query({
+	let { id: r, objectId: i } = dn(t), a = await e.query({
 		table: Z,
-		predicate: D("id", i),
+		predicate: O("id", i),
 		order: [],
 		take: 1,
 		skip: void 0,
 		projection: void 0
-	}), o = a[0] ? C.decodeUnknownSync(nn)(a[0]) : void 0, s = o?.generation ?? ge(), c = o?.key ?? `${t.logicalKey}/g-${s}`;
+	}), o = a[0] ? C.decodeUnknownSync(cn)(a[0]) : void 0, s = o?.generation ?? _e(), c = o?.key ?? `${t.logicalKey}/g-${s}`;
 	o ? await e.update(Z, i, { reservations: o.reservations + 1 }) : await e.insert(Z, {
 		id: i,
 		generation: s,
@@ -2112,35 +2226,35 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 		fingerprint: t.fingerprint,
 		generation: s,
 		key: c,
-		refId: `file_${ge()}`,
+		refId: `file_${_e()}`,
 		state: "reserved",
 		deleteKey: null
 	};
-	return await e.insert(Q, l), l;
-}, ln = async (e, t) => {
-	let n = await $(e, t);
+	return await e.insert(rn, l), l;
+}, mn = async (e, t) => {
+	let n = await Q(e, t);
 	if (!n) throw Error("Storage operation is missing");
 	if (n.state === "deleting" || n.state === "deleted") throw Error("Deleted storage operation cannot be confirmed by a late put");
-	return await e.update(Q, n.id, { state: "ready" }), {
+	return await e.update(rn, n.id, { state: "ready" }), {
 		...n,
 		state: "ready"
 	};
-}, un = async (e, t) => {
-	let n = await $(e, t);
+}, hn = async (e, t) => {
+	let n = await Q(e, t);
 	if (!n) throw Error("Storage operation is missing");
 	if (n.state === "deleting" || n.state === "deleted") return n;
 	if (n.state !== "ready") throw Error("An unconfirmed put cannot be deleted");
 	let r = await e.query({
 		table: Z,
-		predicate: D("id", n.objectId),
+		predicate: O("id", n.objectId),
 		order: [],
 		take: 1,
 		skip: void 0,
 		projection: void 0
-	}), i = r[0] ? C.decodeUnknownSync(nn)(r[0]) : void 0;
+	}), i = r[0] ? C.decodeUnknownSync(cn)(r[0]) : void 0;
 	if (!i || i.generation !== n.generation || i.reservations < 1) throw Error("Storage object generation does not own its reservation");
 	let a = i.reservations === 1 ? i.key : null;
-	return a === null ? await e.update(Z, i.id, { reservations: i.reservations - 1 }) : await e.delete(Z, i.id), await e.update(Q, n.id, {
+	return a === null ? await e.update(Z, i.id, { reservations: i.reservations - 1 }) : await e.delete(Z, i.id), await e.update(rn, n.id, {
 		state: "deleting",
 		deleteKey: a
 	}), {
@@ -2148,46 +2262,46 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 		state: "deleting",
 		deleteKey: a
 	};
-}, dn = async (e, t) => {
-	let n = await $(e, t);
+}, gn = async (e, t) => {
+	let n = await Q(e, t);
 	if (!n || n.state !== "deleting" && n.state !== "deleted") throw Error("Storage deletion has not been accepted");
-	return n.state !== "deleted" && (await e.update(Q, n.id, { state: "deleted" }), !0);
-}, fn = async (e, t, n) => {
+	return n.state !== "deleted" && (await e.update(rn, n.id, { state: "deleted" }), !0);
+}, _n = async (e, t, n) => {
 	if (!n) throw Error("Storage object claim must be a non-empty string");
-	await e.insertIgnoreWithOutcome($t, {
-		id: an(t, n),
+	await e.insertIgnoreWithOutcome(an, {
+		id: un(t, n),
 		operationId: t,
 		claim: n
 	}, { conflictColumns: ["id"] });
-}, pn = async (e, t, n) => {
-	let r = an(t, n);
+}, vn = async (e, t, n) => {
+	let r = un(t, n);
 	return {
-		held: await e.delete($t, r),
+		held: await e.delete(an, r),
 		others: (await e.query({
-			table: $t,
-			predicate: T(D("operationId", t), M("claim", n)),
+			table: an,
+			predicate: E(O("operationId", t), M("claim", n)),
 			order: [],
 			take: 1,
 			skip: void 0,
 			projection: void 0
 		})).length > 0
 	};
-}, mn = (e, t) => e.deleteMany($t, { where: D("operationId", t) }), hn = "_voltro_storage_put_intents", gn = N(hn, {
-	id: P().maxLength(64),
-	refId: P().maxLength(64),
-	identity: A(),
-	ref: A()
-}).primaryKey(["id"]).unique("storagePutRef", ["refId"]).nonReactive(), _n = C.Struct({
+}, yn = (e, t) => e.deleteMany(an, { where: O("operationId", t) }), bn = "_voltro_storage_put_intents", xn = P(bn, {
+	id: F().maxLength(64),
+	refId: F().maxLength(64),
+	identity: j(),
+	ref: j()
+}).primaryKey(["id"]).unique("storagePutRef", ["refId"]).nonReactive(), Sn = C.Struct({
 	tenantId: C.NullOr(C.String),
 	bucket: C.String,
 	operationId: C.String,
 	fingerprint: C.String,
 	checksum: C.String,
 	logicalKey: C.String
-}), vn = async (e, t) => {
+}), Cn = async (e, t) => {
 	let n = await e.query({
-		table: hn,
-		predicate: D("refId", t),
+		table: bn,
+		predicate: O("refId", t),
 		order: [],
 		take: 2,
 		skip: void 0,
@@ -2195,7 +2309,7 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 	});
 	if (n.length === 0) return;
 	if (n.length !== 1) throw Error("Storage reference has ambiguous operation ownership");
-	let r = n[0], i = C.decodeUnknownSync(_n)(r.identity);
+	let r = n[0], i = C.decodeUnknownSync(Sn)(r.identity);
 	if (typeof r.ref != "object" || r.ref === null || Array.isArray(r.ref)) throw Error("Storage operation reference is unreadable");
 	let a = Y(r.ref);
 	if (a.id !== t || a.bucket !== i.bucket || a.tenantId !== i.tenantId || a.checksum !== i.checksum || !Number.isSafeInteger(a.size) || a.size < 0 || !Number.isFinite(a.createdAt.getTime())) throw Error("Storage operation reference does not match its identity");
@@ -2203,23 +2317,23 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 		identity: i,
 		ref: a
 	};
-}, yn = (e) => ({
-	intent: (t) => vn(e, t),
-	reserve: (t, r, i, a) => sn(e, t, async (e) => {
+}, wn = (e) => ({
+	intent: (t) => Cn(e, t),
+	reserve: (t, r, i, a) => fn(e, t, async (e) => {
 		if (r.tenantId !== t.tenantId || r.bucket !== t.bucket || r.checksum !== t.checksum || !Number.isSafeInteger(r.size) || r.size < 0) throw Error("Storage put metadata does not match its identity");
-		let o = await $(e, t);
+		let o = await Q(e, t);
 		if (o) {
 			if (o.state === "deleting" || o.state === "deleted") throw Error("Storage put identity has already been deleted");
-			let t = await vn(e, o.refId);
+			let t = await Cn(e, o.refId);
 			if (!t) throw Error("Storage operation lost its put intent");
 			let n = o.state === "ready";
-			return n && a !== void 0 && await fn(e, o.id, a), {
+			return n && a !== void 0 && await _n(e, o.id, a), {
 				ref: t.ref,
 				ready: n,
 				outcome: n ? "joined" : "resumed"
 			};
 		}
-		let s = await cn(e, t), c = Wt(e);
+		let s = await pn(e, t), c = Jt(e);
 		if (!(await y.runPromise(c.consumeUsage(t.tenantId, {
 			bytes: r.size,
 			count: 1
@@ -2232,7 +2346,7 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 			id: s.refId,
 			key: s.key
 		});
-		return await e.insert(hn, {
+		return await e.insert(bn, {
 			id: s.id,
 			refId: l.id,
 			identity: t,
@@ -2243,31 +2357,31 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 			outcome: "created"
 		};
 	}),
-	confirm: (t, n) => sn(e, t, async (e) => {
-		let r = await $(e, t);
+	confirm: (t, n) => fn(e, t, async (e) => {
+		let r = await Q(e, t);
 		if (!r) throw Error("Storage put operation is missing");
-		let i = await vn(e, r.refId);
+		let i = await Cn(e, r.refId);
 		if (!i) throw Error("Storage put intent is missing");
-		if (n !== void 0 && await fn(e, r.id, n), r.state === "ready") {
-			let n = await y.runPromise(Wt(e).getById(r.refId));
+		if (n !== void 0 && await _n(e, r.id, n), r.state === "ready") {
+			let n = await y.runPromise(Jt(e).getById(r.refId));
 			if (!n || n.key !== r.key || n.checksum !== t.checksum) throw Error("Confirmed storage operation lost its reference");
 			return n;
 		}
-		return await ln(e, t), await y.runPromise(Wt(e).insert(i.ref)), i.ref;
+		return await mn(e, t), await y.runPromise(Jt(e).insert(i.ref)), i.ref;
 	}),
 	beginDelete: async (t, r, i) => {
-		let a = await vn(e, t);
+		let a = await Cn(e, t);
 		if (!a) throw Error("Storage delete operation is missing");
 		if (r !== void 0 && a.identity.tenantId !== r) throw Error("Storage delete tenant mismatch");
-		return sn(e, a.identity, async (e) => {
-			let r = await vn(e, t);
+		return fn(e, a.identity, async (e) => {
+			let r = await Cn(e, t);
 			if (!r) throw Error("Storage delete intent disappeared");
-			let a = await $(e, r.identity);
+			let a = await Q(e, r.identity);
 			if (!a) throw Error("Storage delete lost its operation");
 			let o = a.state !== "deleting" && a.state !== "deleted";
-			if (i === void 0) o && await mn(e, a.id);
+			if (i === void 0) o && await yn(e, a.id);
 			else if (o) {
-				let o = await pn(e, a.id, i);
+				let o = await vn(e, a.id, i);
 				if (o.others) return {
 					released: !0,
 					identity: r.identity
@@ -2277,10 +2391,10 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 					detail: `claim '${i}' is not held on storage reference '${t}'; a reference put without a claim is deleted as a whole by a delete that names none`
 				});
 			}
-			let s = await un(e, r.identity);
+			let s = await hn(e, r.identity);
 			if (a.state === "ready") {
-				let n = Wt(e);
-				if (await y.runPromise(qt(e).deleteByRef(t)), !await y.runPromise(n.delete(t))) throw Error("Storage deletion lost its confirmed reference");
+				let n = Jt(e);
+				if (await y.runPromise(Zt(e).deleteByRef(t)), !await y.runPromise(n.delete(t))) throw Error("Storage deletion lost its confirmed reference");
 				await y.runPromise(n.releaseUsage(r.identity.tenantId, {
 					bytes: r.ref.size,
 					count: 1
@@ -2293,8 +2407,8 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 			};
 		});
 	},
-	confirmDelete: (t) => sn(e, t, (e) => dn(e, t))
-}), bn = (e, t = 65536) => {
+	confirmDelete: (t) => fn(e, t, (e) => gn(e, t))
+}), Tn = (e, t = 65536) => {
 	let n = [Buffer.from("zINSTREAM\0", "utf8")];
 	for (let r = 0; r < e.length; r += t) {
 		let i = e.subarray(r, Math.min(r + t, e.length)), a = Buffer.alloc(4);
@@ -2302,7 +2416,7 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 	}
 	let r = Buffer.alloc(4);
 	return r.writeUInt32BE(0, 0), n.push(r), Buffer.concat(n);
-}, xn = (e) => {
+}, En = (e) => {
 	let t = e.replace(/\0+$/, "").trim();
 	if (/\bOK$/.test(t)) return { clean: !0 };
 	let n = /:\s*(.+?)\s+FOUND$/.exec(t);
@@ -2311,7 +2425,7 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 		threat: n[1] ?? "unknown"
 	};
 	throw Error(`clamav: unexpected response: ${t}`);
-}, Sn = async (e, t) => {
+}, Dn = async (e, t) => {
 	let n = await import("node:net"), r = W.read("CLAMAV_HOST", t.host) ?? "127.0.0.1", i = W.read("CLAMAV_PORT"), a = t.port ?? (i ? Number(i) : 3310), o = t.timeoutMs ?? 3e4;
 	return new Promise((i, s) => {
 		let c = n.createConnection({
@@ -2323,20 +2437,20 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 		c.on("error", (e) => {
 			clearTimeout(u), s(e);
 		}), c.on("connect", () => {
-			c.end(bn(e, t.chunkSize));
+			c.end(Tn(e, t.chunkSize));
 		}), c.on("data", (e) => {
 			l += e.toString("utf8");
 		}), c.on("close", () => {
 			clearTimeout(u);
 			try {
-				i(xn(l));
+				i(En(l));
 			} catch (e) {
 				s(e);
 			}
 		});
 	});
-}, Cn = (e = {}) => (t) => Sn(t.bytes, e), wn = (e, t, n) => new Promise((r, i) => {
-	let a = ve(e, [...t], { stdio: [
+}, On = (e = {}) => (t) => Dn(t.bytes, e), kn = (e, t, n) => new Promise((r, i) => {
+	let a = ye(e, [...t], { stdio: [
 		"ignore",
 		"ignore",
 		"pipe"
@@ -2350,31 +2464,31 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 	}), a.on("close", (e) => {
 		clearTimeout(s), e === 0 ? r() : i(/* @__PURE__ */ Error(`ffmpeg exited ${String(e)}: ${o.slice(-400)}`));
 	});
-}), Tn = (e) => async ({ bytes: t }) => {
-	let n = e.ffmpegPath ?? "ffmpeg", r = e.timeoutMs ?? 3e5, i = await ye(z(Ce(), "voltro-tc-")), a = z(i, "in"), o = [];
+}), An = (e) => async ({ bytes: t }) => {
+	let n = e.ffmpegPath ?? "ffmpeg", r = e.timeoutMs ?? 3e5, i = await be(z(we(), "voltro-tc-")), a = z(i, "in"), o = [];
 	try {
-		await Se(a, t);
+		await Ce(a, t);
 		for (let t of e.renditions) {
 			let e = z(i, `out.${t.ext}`);
 			try {
-				await wn(n, [
+				await kn(n, [
 					"-y",
 					"-i",
 					a,
 					...t.args,
 					e
 				], r);
-				let i = await be(e);
+				let i = await xe(e);
 				o.push({
 					bytes: new Uint8Array(i),
 					contentType: t.contentType,
 					kind: t.kind,
 					...t.label === void 0 ? {} : { label: t.label }
-				}), await xe(e, { force: !0 });
+				}), await Se(e, { force: !0 });
 			} catch {}
 		}
 	} finally {
-		await xe(i, {
+		await Se(i, {
 			recursive: !0,
 			force: !0
 		}).catch(() => void 0);
@@ -2383,21 +2497,21 @@ var we = 1 << 20, Te = (e, n, r = !1) => new t({
 };
 //#endregion
 //#region src/assetRef.ts
-function En(e = {}) {
-	let t = e.nullable ?? !0, n = e.fk === !1 ? P().externalId() : pe(() => Pe, { onDelete: e.onDelete ?? "setNull" });
+function jn(e = {}) {
+	let t = e.nullable ?? !0, n = e.fk === !1 ? F().externalId() : fe(() => Fe, { onDelete: e.onDelete ?? "setNull" });
 	return t ? n.nullable() : n;
 }
-var Dn = () => j({
+var Mn = () => de({
 	id: "@voltro/plugin-storage/withStorage",
-	fields: { asset: En() }
-}), On = {
+	fields: { asset: jn() }
+}), Nn = {
 	"image/png": "png",
 	"image/jpeg": "jpg",
 	"image/jpg": "jpg",
 	"image/gif": "gif",
 	"image/webp": "webp",
 	"image/svg+xml": "svg"
-}, kn = (e) => {
+}, Pn = (e) => {
 	let t = /^data:([^;,]+)(;base64)?,(.*)$/s.exec(e);
 	if (!t) throw Error("not a data URI");
 	let n = t[1] || "application/octet-stream", r = !!t[2], i = t[3] ?? "";
@@ -2405,16 +2519,16 @@ var Dn = () => j({
 		bytes: r ? new Uint8Array(Buffer.from(i, "base64")) : new Uint8Array(Buffer.from(decodeURIComponent(i), "utf8")),
 		contentType: n
 	};
-}, An = (e, n) => y.gen(function* () {
+}, Fn = (e, n) => y.gen(function* () {
 	let r = yield* y.try({
-		try: () => kn(n.dataUri),
+		try: () => Pn(n.dataUri),
 		catch: (e) => new t({
 			provider: "avatar",
 			message: String(e?.message ?? e),
 			transient: !1,
 			status: 400
 		})
-	}), i = On[r.contentType] ?? "bin";
+	}), i = Nn[r.contentType] ?? "bin";
 	return yield* e.put({
 		bytes: r.bytes,
 		contentType: r.contentType,
@@ -2423,27 +2537,27 @@ var Dn = () => j({
 		visibility: "public",
 		key: `avatars/${n.userId}/avatar.${i}`
 	});
-}), jn = (e) => {
+}), In = (e) => {
 	try {
 		let t = B(e), n = B("/");
 		return typeof t.dev != "number" || typeof n.dev != "number" ? "unknown" : t.dev === n.dev ? "same-device-as-root" : "separate-mount";
 	} catch {
 		return "unknown";
 	}
-}, Mn = (e) => {
-	if (jn(e) === "same-device-as-root") return `the capture is going to ${e}, which is on the SAME filesystem as \`/\`.\n  A mounted volume would be a separate one. If this process is a container, that means the capture
+}, Ln = (e) => {
+	if (In(e) === "same-device-as-root") return `the capture is going to ${e}, which is on the SAME filesystem as \`/\`.\n  A mounted volume would be a separate one. If this process is a container, that means the capture
   dies with it — which is the exact failure it exists for. On a development machine this is normal
   and can be ignored.`;
-}, Nn = W.read("VOLTRO_SESSION_COOKIE") ?? "voltro:session", Pn, Fn = (e) => {
-	Pn = e;
-}, In = () => Pn ?? Rn({}), Ln = () => Pn === void 0 ? W.read("STORAGE_PROVIDER") === void 0 ? void 0 : Rn({}) : Pn, Rn = (e) => {
+}, Rn = W.read("VOLTRO_SESSION_COOKIE") ?? "voltro:session", zn, Bn = (e) => {
+	zn = e;
+}, Vn = () => zn ?? Un({}), Hn = () => zn === void 0 ? W.read("STORAGE_PROVIDER") === void 0 ? void 0 : Un({}) : zn, Un = (e) => {
 	if (e.provider && typeof e.provider == "object") return e.provider;
 	let t = (e.provider ?? W.read("STORAGE_PROVIDER") ?? "memory").toLowerCase(), n = W.read("S3_BUCKET", e.bucket) ?? W.read("STORAGE_BUCKET") ?? "voltro";
 	switch (t) {
 		case "s3":
 		case "minio": {
 			let r = W.read("S3_REGION", e.region) ?? W.read("AWS_REGION"), i = W.read("S3_ENDPOINT", e.endpoint) ?? W.read("MINIO_ENDPOINT"), a = W.read("S3_ACCESS_KEY_ID", e.accessKeyId) ?? W.read("AWS_ACCESS_KEY_ID"), o = W.read("S3_SECRET_ACCESS_KEY", e.secretAccessKey) ?? W.read("AWS_SECRET_ACCESS_KEY"), s = W.read("STORAGE_CDN_URL", e.cdnBaseUrl);
-			return We({
+			return Ge({
 				bucket: n,
 				name: t,
 				...r ? { region: r } : {},
@@ -2457,7 +2571,7 @@ var Dn = () => j({
 		}
 		case "azure": {
 			let t = W.read("AZURE_STORAGE_ACCOUNT", e.accountName), r = W.read("AZURE_STORAGE_KEY", e.accountKey), i = W.read("AZURE_STORAGE_CONNECTION_STRING", e.connectionString), a = W.read("AZURE_STORAGE_ENDPOINT", e.endpoint), o = W.read("STORAGE_CDN_URL", e.cdnBaseUrl);
-			return qe({
+			return Je({
 				container: W.read("AZURE_STORAGE_CONTAINER", e.bucket) ?? n,
 				...t ? { accountName: t } : {},
 				...r ? { accountKey: r } : {},
@@ -2466,15 +2580,43 @@ var Dn = () => j({
 				...o ? { cdnBaseUrl: o } : {}
 			});
 		}
-		case "database": return Ke();
-		case "filesystem": return Ue({ root: W.read("STORAGE_ROOT", e.root) ?? ".voltro-storage" });
-		default: return He(e.name ?? "default");
+		case "database": return qe();
+		case "filesystem": return We({ root: W.read("STORAGE_ROOT", e.root) ?? ".voltro-storage" });
+		default: return Ue(e.name ?? "default");
+	}
+}, Wn = (e) => {
+	let t = "stored files (uploads, renditions) and their reads", n = "provider 'database' or 'filesystem' keeps the bytes inside the installation";
+	if (e.provider && typeof e.provider == "object") return [{
+		destination: `runtime:the '${e.provider.name}' storage provider`,
+		purpose: t,
+		data: ["files"],
+		disable: n
+	}];
+	let r = (e.provider ?? W.read("STORAGE_PROVIDER") ?? "memory").toLowerCase();
+	if (r === "s3" || r === "minio") {
+		let r = W.read("S3_ENDPOINT", e.endpoint) ?? W.read("MINIO_ENDPOINT"), i = W.read("S3_REGION", e.region) ?? W.read("AWS_REGION") ?? "us-east-1";
+		return [{
+			destination: r ?? `s3.${i}.amazonaws.com`,
+			purpose: t,
+			data: ["files"],
+			disable: n
+		}];
 	}
-}, zn = (e) => {
+	if (r === "azure") {
+		let r = W.read("AZURE_STORAGE_ENDPOINT", e.endpoint), i = W.read("AZURE_STORAGE_ACCOUNT", e.accountName);
+		return [{
+			destination: r ?? (i === void 0 ? "runtime:the Azure storage connection string" : `${i}.blob.core.windows.net`),
+			purpose: t,
+			data: ["files"],
+			disable: n
+		}];
+	}
+	return [];
+}, Gn = (e) => {
 	if (e !== void 0) return e;
 	let t = W.read("STORAGE_ALLOWED_ORIGINS");
 	return t ? t.trim() === "*" ? "*" : t.split(",").map((e) => e.trim()).filter(Boolean) : [];
-}, Bn = (e, t) => {
+}, Kn = (e, t) => {
 	if (!e || t !== "*" && !t.includes(e)) return {};
 	let n = {
 		"access-control-allow-origin": t === "*" ? "*" : e,
@@ -2484,7 +2626,7 @@ var Dn = () => j({
 		vary: "Origin"
 	};
 	return t !== "*" && (n["access-control-allow-credentials"] = "true"), n;
-}, Vn = (e) => ({
+}, qn = (e) => ({
 	id: e.id,
 	tenantId: e.tenantId,
 	ownerId: e.ownerId,
@@ -2507,29 +2649,29 @@ var Dn = () => j({
 	caption: e.caption ?? null,
 	derivedFrom: e.derivedFrom ?? null,
 	kind: e.kind ?? null
-}), Hn = () => new t({
+}), Jn = () => new t({
 	provider: "storage",
 	message: "not permitted to administer sharing for this object",
 	transient: !1,
 	status: 403
-}), Un = (e, t, n) => {
+}), Yn = (e, t, n) => {
 	let r = n.request.subject;
-	return (r.scopes ?? []).includes("admin:full") ? y.void : e.head(t, { tenantId: r.tenantId ?? null }).pipe(y.catchAll(() => y.fail(Hn())), y.flatMap((e) => {
+	return (r.scopes ?? []).includes("admin:full") ? y.void : e.head(t, { tenantId: r.tenantId ?? null }).pipe(y.catchAll(() => y.fail(Jn())), y.flatMap((e) => {
 		let t = e?.ownerId;
-		return t != null && t === r.id ? y.void : y.fail(Hn());
+		return t != null && t === r.id ? y.void : y.fail(Jn());
 	}));
-}, Wn = () => new t({
+}, Xn = () => new t({
 	provider: "storage",
 	message: "an upload needs an identified caller: this request carries no subject, and the app has not set `anonymousUploads: true` on storagePlugin. The ticket attributes the object to whoever minted it — with no subject there is nobody to attribute it to, so the finalized object would carry no owner and no tenant and no later owner check, tenant filter or quota could reach it.",
 	transient: !1,
 	status: 401
-}), Gn = (e, t) => {
+}), $ = (e, t) => {
 	let n = e.request.subject.id ?? null, r = e.request.subject.tenantId ?? null;
-	return n === null && !t ? y.fail(Wn()) : y.succeed({
+	return n === null && !t ? y.fail(Xn()) : y.succeed({
 		id: n,
 		tenantId: r
 	});
-}, Kn = (e, t) => e !== null && e !== (t ?? null), qn = (e) => ({
+}, Zn = (e, t) => e !== null && e !== (t ?? null), Qn = (e) => ({
 	id: e.id,
 	refId: e.refId,
 	principalType: e.principalType,
@@ -2538,55 +2680,62 @@ var Dn = () => j({
 	createdAt: e.createdAt.toISOString(),
 	expiresAt: e.expiresAt ? e.expiresAt.toISOString() : null,
 	createdBy: e.createdBy
-}), Jn = "@voltro/plugin-storage", Yn = (e = {}) => oe({
-	base: Jn,
+}), $n = "@voltro/plugin-storage", er = (e = {}) => ae({
+	base: $n,
 	alias: e.alias,
 	instance: e.name
-}), Xn = (i = {}) => {
-	let v = oe({
-		base: Jn,
+}), tr = (i = {}) => {
+	let v = ae({
+		base: $n,
 		alias: i.alias,
 		instance: i.name
-	}), b = v === Jn ? "/_voltro/storage" : `/_voltro/storage/i/${Buffer.from(v).toString("hex")}`, x = Rn(i);
-	Fn(x);
-	let S = W.read("S3_BUCKET", i.bucket) ?? W.read("STORAGE_BUCKET") ?? "voltro", T = W.read("VOLTRO_PUBLIC_URL", i.publicBaseUrl), ue = zn(i.allowedOrigins), E = i.limits?.maxBytes, D = i.anonymousUploads === !0, O = 5242880, de = 21600, k = i.refStore === void 0 || i.refStore === "memory", A = i.grantStore === void 0 || i.grantStore === "memory", j = { current: k ? Vt() : i.refStore }, M = { current: A ? Gt() : i.grantStore }, fe = { current: void 0 }, pe = {
-		insert: (e) => j.current.insert(e),
-		getById: (e) => j.current.getById(e),
-		delete: (e) => j.current.delete(e),
-		statistics: () => j.current.statistics(),
-		listRecent: (e) => j.current.listRecent(e),
-		countByKey: (e, t) => j.current.countByKey(e, t),
-		usageByTenant: (e) => j.current.usageByTenant(e),
-		consumeUsage: (e, t, n) => j.current.consumeUsage(e, t, n),
-		releaseUsage: (e, t) => j.current.releaseUsage(e, t),
-		listByDerivedFrom: (e) => j.current.listByDerivedFrom(e),
-		listRefs: (e) => j.current.listRefs(e)
-	}, N = {
+	}), b = v === $n ? "/_voltro/storage" : `/_voltro/storage/i/${Buffer.from(v).toString("hex")}`, x = Un(i);
+	Bn(x);
+	let S = W.read("S3_BUCKET", i.bucket) ?? W.read("STORAGE_BUCKET") ?? "voltro", E = W.read("VOLTRO_PUBLIC_URL", i.publicBaseUrl), le = Gn(i.allowedOrigins), D = i.limits?.maxBytes, O = i.anonymousUploads === !0, k = 5242880, ue = 21600, A = i.refStore === void 0 || i.refStore === "memory", j = i.grantStore === void 0 || i.grantStore === "memory", de = (e) => e !== "public" && i.uploadAccess !== void 0 ? { access: i.uploadAccess } : {}, M = { current: A ? Gt() : i.refStore }, N = { current: j ? Yt() : i.grantStore }, fe = { current: void 0 }, P = {
 		insert: (e) => M.current.insert(e),
-		delete: (e) => M.current.delete(e),
 		getById: (e) => M.current.getById(e),
-		listByRef: (e) => M.current.listByRef(e),
-		deleteByRef: (e) => M.current.deleteByRef(e)
-	}, P = {
+		delete: (e) => M.current.delete(e),
+		statistics: () => M.current.statistics(),
+		listRecent: (e) => M.current.listRecent(e),
+		countByKey: (e, t) => M.current.countByKey(e, t),
+		usageByTenant: (e) => M.current.usageByTenant(e),
+		consumeUsage: (e, t, n) => M.current.consumeUsage(e, t, n),
+		releaseUsage: (e, t) => M.current.releaseUsage(e, t),
+		listByDerivedFrom: (e) => M.current.listByDerivedFrom(e),
+		listRefs: (e) => M.current.listRefs(e),
+		get setVisibility() {
+			return M.current.setVisibility;
+		},
+		get countPublicByKey() {
+			return M.current.countPublicByKey;
+		}
+	}, F = {
+		insert: (e) => N.current.insert(e),
+		delete: (e) => N.current.delete(e),
+		getById: (e) => N.current.getById(e),
+		listByRef: (e) => N.current.listByRef(e),
+		deleteByRef: (e) => N.current.deleteByRef(e)
+	}, pe = {
 		httpPath: b,
 		provider: x,
-		refStore: pe,
-		grantStore: N,
+		refStore: P,
+		grantStore: F,
 		bucket: S,
 		...i.tenantPrefix === void 0 ? {} : { tenantPrefix: i.tenantPrefix },
 		...i.attempts === void 0 ? {} : { attempts: i.attempts },
 		...i.urlExpiresInSec === void 0 ? {} : { urlExpiresInSec: i.urlExpiresInSec },
 		...i.access === void 0 ? {} : { access: i.access },
 		...i.limits === void 0 ? {} : { limits: i.limits },
+		...i.ingest === void 0 ? {} : { ingest: i.ingest },
 		...i.scan === void 0 ? {} : { scan: i.scan },
 		...i.videoProbe === void 0 ? {} : { videoProbe: i.videoProbe },
 		...i.transcode === void 0 ? {} : { transcode: i.transcode },
 		...i.autoTranscode === void 0 ? {} : { autoTranscode: i.autoTranscode },
-		...T ? { publicBaseUrl: T } : {},
+		...E ? { publicBaseUrl: E } : {},
 		...i.normalizeImages === void 0 ? {} : { normalizeImages: i.normalizeImages },
 		...i.quota === void 0 ? {} : { quota: i.quota },
 		objects: () => fe.current
-	}, me = Zt(P), F = Xt(P), I = `${b}/`, L = (e) => y.runPromise(e.pipe(y.catchAll(() => y.succeed(null)))), _e = (e, t) => {
+	}, me = tn(pe), I = en(pe), ge = `${b}/`, L = (e) => y.runPromise(e.pipe(y.catchAll(() => y.succeed(null)))), R = (e, t) => {
 		if (!e) return "invalid";
 		let n = /^bytes=(\d*)-(\d*)$/.exec(e.trim());
 		if (!n) return "invalid";
@@ -2607,30 +2756,31 @@ var Dn = () => j({
 			start: a,
 			endInclusive: o
 		};
-	}, R = /^(?:image\/(?!svg)|video\/|audio\/|application\/pdf(?:;|$)|text\/plain(?:;|$))/i, ve = (e) => ({
+	}, ve = /^(?:image\/(?!svg)|video\/|audio\/|application\/pdf(?:;|$)|text\/plain(?:;|$))/i, ye = (e) => ({
 		"x-content-type-options": "nosniff",
-		"content-disposition": R.test(e) ? "inline" : "attachment"
-	}), ye = async (e, t, n, r) => {
+		"content-disposition": ve.test(e) ? "inline" : "attachment"
+	}), be = async (e, t, n, r) => {
 		if (n) {
-			let r = await L(F.get(e.id));
+			let r = await L(I.get(e.id));
 			if (!r) return {
 				status: 404,
 				body: "not found",
 				contentType: "text/plain"
 			};
-			let i = await nt(e.id, r.bytes, e.contentType, n).catch(() => null), a = i ? i.bytes : r.bytes, o = i ? i.contentType : e.contentType;
+			let i = await at(e.id, r.bytes, e.contentType, n).catch(() => null), a = i ? i.bytes : r.bytes, o = i ? i.contentType : e.contentType, s = await tt(e.contentType, i !== null);
 			return {
 				status: 200,
 				body: a,
 				contentType: o,
 				headers: {
-					...ve(o),
+					...ye(o),
 					"cache-control": t,
-					"accept-ranges": "none"
+					"accept-ranges": "none",
+					...s === null ? {} : { "x-voltro-transform": `original; reason=${s}` }
 				}
 			};
 		}
-		let i = r === void 0 ? "invalid" : _e(r, e.size);
+		let i = r === void 0 ? "invalid" : R(r, e.size);
 		if (i === "unsatisfiable") return {
 			status: 416,
 			body: "range not satisfiable",
@@ -2641,13 +2791,13 @@ var Dn = () => j({
 			}
 		};
 		if (i !== "invalid") {
-			let n = await L(F.getRange(e.id, i));
+			let n = await L(I.getRange(e.id, i));
 			return n ? {
 				status: 206,
 				body: n.bytes,
 				contentType: e.contentType,
 				headers: {
-					...ve(e.contentType),
+					...ye(e.contentType),
 					"cache-control": t,
 					"accept-ranges": "bytes",
 					"content-range": `bytes ${i.start}-${i.endInclusive}/${n.totalSize}`
@@ -2658,12 +2808,12 @@ var Dn = () => j({
 				contentType: "text/plain"
 			};
 		}
-		let a = await L(F.getStream(e.id));
+		let a = await L(I.getStream(e.id));
 		return a ? {
 			status: 200,
 			contentType: e.contentType,
 			headers: {
-				...ve(e.contentType),
+				...ye(e.contentType),
 				"cache-control": t,
 				"accept-ranges": "bytes"
 			},
@@ -2676,20 +2826,20 @@ var Dn = () => j({
 			body: "not found",
 			contentType: "text/plain"
 		};
-	}, be = async (e) => {
-		let t = e.path.startsWith(I) ? e.path.slice(I.length).split("/")[0] ?? "" : "";
+	}, xe = async (e) => {
+		let t = e.path.startsWith(ge) ? e.path.slice(ge.length).split("/")[0] ?? "" : "";
 		if (!t) return {
 			status: 404,
 			body: "not found",
 			contentType: "text/plain"
 		};
-		let n = await L(F.head(t));
+		let n = await L(I.head(t));
 		if (!n) return {
 			status: 404,
 			body: "not found",
 			contentType: "text/plain"
 		};
-		let r = Ye(e.query), i = e.headers.range;
+		let r = Ze(e.query), i = e.headers.range;
 		if (n.visibility === "public") {
 			let e = x.publicUrl?.(n.key) ?? null;
 			return e && !r ? {
@@ -2698,16 +2848,16 @@ var Dn = () => j({
 					location: e,
 					"cache-control": "public, max-age=300"
 				}
-			} : ye(n, "public, max-age=31536000, immutable", r, i);
+			} : be(n, "public, max-age=31536000, immutable", r, i);
 		}
 		let a = !1, o = e.query ? new URLSearchParams(e.query).get("t") : null;
 		if (o) {
-			let e = _t(o);
+			let e = bt(o);
 			a = !!e && e.refId === t && e.audience === b;
 		}
 		if (!a) {
-			let t = se(e.headers.cookie, Nn), r = t ? le(t, ce()) : null;
-			r && (a = await L(F.checkAccess(n, r)) === !0);
+			let t = oe(e.headers.cookie, Rn), r = t ? ce(t, se()) : null;
+			r && (a = await L(I.checkAccess(n, r)) === !0);
 		}
 		if (!a) return {
 			status: 403,
@@ -2724,12 +2874,12 @@ var Dn = () => j({
 				}
 			};
 		}
-		return ye(n, "private, no-store", r, i);
-	}, xe = {
+		return be(n, "private, no-store", r, i);
+	}, Se = {
 		method: "GET",
 		path: b,
 		handle: async (e) => {
-			let t = await be(e), n = Bn(e.headers.origin, ue);
+			let t = await xe(e), n = Kn(e.headers.origin, le);
 			return Object.keys(n).length === 0 ? t : {
 				...t,
 				headers: {
@@ -2738,12 +2888,12 @@ var Dn = () => j({
 				}
 			};
 		}
-	}, Se = {
+	}, Ce = {
 		method: "*",
 		path: `${b}/upload`,
 		originGuard: "exempt",
 		handle: async (e) => {
-			let t = Bn(e.headers.origin, ue);
+			let t = Kn(e.headers.origin, le);
 			if (e.method === "OPTIONS") return {
 				status: 204,
 				headers: t
@@ -2754,7 +2904,7 @@ var Dn = () => j({
 				contentType: "text/plain",
 				headers: t
 			};
-			let n = e.query ? new URLSearchParams(e.query).get("ticket") : null, r = n ? yt(n) : null;
+			let n = e.query ? new URLSearchParams(e.query).get("ticket") : null, r = n ? St(n) : null;
 			if (!r || r.instance !== v) return {
 				status: 401,
 				body: "invalid or expired upload ticket",
@@ -2779,19 +2929,20 @@ var Dn = () => j({
 				contentType: "text/plain",
 				headers: t
 			};
-			let i = await y.runPromise(F.put({
+			let i = await y.runPromise(I.put({
 				bytes: e.rawBody,
 				contentType: r.ct,
 				tenantId: r.tenant,
 				ownerId: r.sub,
 				visibility: r.vis,
+				...de(r.vis),
 				...r.operationId === void 0 ? {} : { operationId: r.operationId },
 				...r.key === void 0 ? {} : { key: r.key },
 				...r.folder === void 0 ? {} : { folder: r.folder },
 				...r.tags === void 0 ? {} : { tags: r.tags },
 				...r.alt === void 0 ? {} : { alt: r.alt },
 				...r.caption === void 0 ? {} : { caption: r.caption }
-			}).pipe(y.flatMap((e) => F.getUrl(e.id).pipe(y.map((t) => ({
+			}).pipe(y.flatMap((e) => I.getUrl(e.id).pipe(y.map((t) => ({
 				kind: "ok",
 				ref: e,
 				url: t
@@ -2837,17 +2988,17 @@ var Dn = () => j({
 				headers: t
 			};
 		}
-	}, Ce = {
+	}, we = {
 		method: "*",
 		path: `${b}/upload/resumable`,
 		originGuard: "exempt",
 		handle: async (e) => {
-			let t = Bn(e.headers.origin, ue);
+			let t = Kn(e.headers.origin, le);
 			if (e.method === "OPTIONS") return {
 				status: 204,
 				headers: t
 			};
-			let n = new URLSearchParams(e.query || ""), r = Ct(n.get("token") ?? "");
+			let n = new URLSearchParams(e.query || ""), r = Et(n.get("token") ?? "");
 			if (!r || r.instance !== v) return {
 				status: 401,
 				body: "invalid or expired resumable token",
@@ -2855,7 +3006,7 @@ var Dn = () => j({
 				headers: t
 			};
 			if (e.method === "GET" || e.method === "HEAD") {
-				let e = await y.runPromise(F.resumableStatus({
+				let e = await y.runPromise(I.resumableStatus({
 					uploadId: r.id,
 					tenantId: r.tenant
 				}).pipe(y.match({
@@ -2896,23 +3047,24 @@ var Dn = () => j({
 				contentType: "text/plain",
 				headers: t
 			};
-			let a = n.get("final") === "1", o = await y.runPromise(F.putResumableChunk({
+			let a = n.get("final") === "1", o = await y.runPromise(I.putResumableChunk({
 				uploadId: r.id,
 				tenantId: r.tenant,
 				index: i,
 				bytes: e.rawBody
-			}).pipe(y.flatMap(() => a ? F.finalizeResumable({
+			}).pipe(y.flatMap(() => a ? I.finalizeResumable({
 				uploadId: r.id,
 				count: i + 1,
 				contentType: r.ct,
 				tenantId: r.tenant,
 				ownerId: r.sub,
 				visibility: r.vis,
+				...de(r.vis),
 				...r.folder === void 0 ? {} : { folder: r.folder },
 				...r.tags === void 0 ? {} : { tags: r.tags },
 				...r.alt === void 0 ? {} : { alt: r.alt },
 				...r.caption === void 0 ? {} : { caption: r.caption }
-			}).pipe(y.flatMap((e) => F.getUrl(e.id).pipe(y.map((t) => ({
+			}).pipe(y.flatMap((e) => I.getUrl(e.id).pipe(y.map((t) => ({
 				kind: "done",
 				ref: e,
 				url: t
@@ -2971,13 +3123,13 @@ var Dn = () => j({
 		kind: "json",
 		status: e,
 		data: { error: t }
-	}), we = (e, t) => {
+	}), Te = (e, t) => {
 		try {
 			return new URL(e, "http://localhost").searchParams.get(t);
 		} catch {
 			return null;
 		}
-	}, Te = [
+	}, Ee = [
 		{
 			method: "POST",
 			path: "/upload-ticket",
@@ -2998,8 +3150,8 @@ var Dn = () => j({
 					status: 400
 				})));
 				if (r.operationId !== void 0 && fe.current === void 0) return B(409, "Durable uploads require a bound operation store with default reference and grant stores");
-				if (E !== void 0 && r.size > E) return B(413, "File exceeds the configured upload limit");
-				let i = vt({
+				if (D !== void 0 && r.size > D) return B(413, "File exceeds the configured upload limit");
+				let i = xt({
 					instance: v,
 					...r.operationId === void 0 ? {} : { operationId: `inspect-upload:${he("sha256").update(JSON.stringify([v, r.operationId])).digest("hex")}` },
 					replicaId: _().replicaId,
@@ -3022,9 +3174,9 @@ var Dn = () => j({
 			path: "/download",
 			description: "Stream a stored file as an attachment for authorized inspect readers",
 			handler: (e) => y.gen(function* () {
-				let t = we(e.url, "refId");
+				let t = Te(e.url, "refId");
 				if (!t?.trim()) return B(400, "A non-empty refId is required");
-				let { ref: n, stream: r } = yield* F.getStream(t), i = n.key.split("/").pop() || n.id, a = encodeURIComponent(i).replace(/[!'()*]/g, (e) => `%${e.charCodeAt(0).toString(16).toUpperCase()}`);
+				let { ref: n, stream: r } = yield* I.getStream(t), i = n.key.split("/").pop() || n.id, a = encodeURIComponent(i).replace(/[!'()*]/g, (e) => `%${e.charCodeAt(0).toString(16).toUpperCase()}`);
 				return {
 					kind: "bytes",
 					contentType: n.contentType,
@@ -3043,8 +3195,8 @@ var Dn = () => j({
 			scope: "process",
 			description: "Searchable storage refs, newest first, paginated",
 			handler: (e) => {
-				let t = Number(we(e.url, "offset") ?? 0), n = Number.isSafeInteger(t) && t >= 0 ? t : 0, r = (we(e.url, "search") ?? "").trim().slice(0, 200);
-				return pe.listRefs({
+				let t = Number(Te(e.url, "offset") ?? 0), n = Number.isSafeInteger(t) && t >= 0 ? t : 0, r = (Te(e.url, "search") ?? "").trim().slice(0, 200);
+				return P.listRefs({
 					tenantId: void 0,
 					ownerId: void 0,
 					folder: void 0,
@@ -3054,7 +3206,7 @@ var Dn = () => j({
 					limit: 51,
 					offset: n
 				}).pipe(y.map((e) => z({
-					refs: e.slice(0, 50).map(Vn),
+					refs: e.slice(0, 50).map(qn),
 					page: {
 						search: r,
 						offset: n,
@@ -3068,7 +3220,7 @@ var Dn = () => j({
 			path: "/stats",
 			scope: "process",
 			description: "Object count + total bytes per tenant + visibility split",
-			handler: () => pe.statistics().pipe(y.map((e) => z({
+			handler: () => P.statistics().pipe(y.map((e) => z({
 				provider: x.name,
 				bucket: S,
 				...e
@@ -3080,8 +3232,8 @@ var Dn = () => j({
 			scope: "process",
 			description: "Grants for a ref (?refId=…)",
 			handler: (e) => {
-				let t = we(e.url, "refId");
-				return t ? N.listByRef(t).pipe(y.map((e) => z({ grants: e.map(qn) })), y.catchAll((e) => y.succeed(B(500, e.message)))) : y.succeed(B(400, "refId query param required"));
+				let t = Te(e.url, "refId");
+				return t ? F.listByRef(t).pipe(y.map((e) => z({ grants: e.map(Qn) })), y.catchAll((e) => y.succeed(B(500, e.message)))) : y.succeed(B(400, "refId query param required"));
 			}
 		},
 		{
@@ -3102,14 +3254,14 @@ var Dn = () => j({
 					status: 400
 				}))), r = n.expiresInDays === void 0 ? null : new Date(Date.now() + n.expiresInDays * 864e5);
 				if (r !== null && !Number.isFinite(r.getTime())) return B(400, "Expiry exceeds the supported date range");
-				let i = yield* F.grant({
+				let i = yield* I.grant({
 					refId: n.refId,
 					principalType: n.principalType,
 					principalId: n.principalId,
 					...n.permission ? { permission: n.permission } : {},
 					expiresAt: r
 				});
-				return z({ grant: qn(i) });
+				return z({ grant: Qn(i) });
 			}).pipe(y.catchAll((e) => y.succeed(B(e.status ?? 500, e.message ?? "share failed"))))
 		},
 		{
@@ -3123,7 +3275,7 @@ var Dn = () => j({
 					transient: !1,
 					status: 400
 				})));
-				return yield* F.delete(n.refId), z({ ok: !0 });
+				return yield* I.delete(n.refId), z({ ok: !0 });
 			}).pipe(y.catchAll((e) => y.succeed(B(e.status ?? 500, e.message))))
 		},
 		{
@@ -3137,15 +3289,15 @@ var Dn = () => j({
 					transient: !1,
 					status: 400
 				})));
-				return yield* F.revoke(n.grantId), z({ ok: !0 });
+				return yield* I.revoke(n.grantId), z({ ok: !0 });
 			}).pipe(y.catchAll((e) => y.succeed(B(e.status ?? 500, e.message ?? "revoke failed"))))
 		}
-	], Ee = [
+	], De = [
 		{
 			...te,
 			execute: (e, t) => {
 				let n = e;
-				return F.mintUrl(n.id, t.request.subject, {
+				return I.mintUrl(n.id, t.request.subject, {
 					...n.password === void 0 ? {} : { password: n.password },
 					...n.expiresInSec === void 0 ? {} : { expiresInSec: n.expiresInSec }
 				}).pipe(y.map((e) => ({ url: e })));
@@ -3155,7 +3307,7 @@ var Dn = () => j({
 			...ee,
 			execute: (e, t) => {
 				let n = e;
-				return F.mintUploadUrl({
+				return I.mintUploadUrl({
 					key: n.key,
 					contentType: n.contentType,
 					tenantId: t.request.subject.tenantId,
@@ -3167,8 +3319,8 @@ var Dn = () => j({
 			...m,
 			execute: (e, t) => {
 				let n = e;
-				return Gn(t, D).pipe(y.map((e) => {
-					let t = n.expiresInSec ?? 900, r = vt({
+				return $(t, O).pipe(y.map((e) => {
+					let t = n.expiresInSec ?? 900, r = xt({
 						instance: v,
 						sub: e.id,
 						tenant: e.tenantId,
@@ -3179,10 +3331,10 @@ var Dn = () => j({
 						...n.tags === void 0 ? {} : { tags: n.tags },
 						...n.alt === void 0 ? {} : { alt: n.alt },
 						...n.caption === void 0 ? {} : { caption: n.caption },
-						...E === void 0 ? {} : { max: E }
+						...D === void 0 ? {} : { max: D }
 					}, t);
 					return {
-						uploadUrl: `${T ? T.replace(/\/+$/, "") : ""}${b}/upload?ticket=${encodeURIComponent(r)}`,
+						uploadUrl: `${E ? E.replace(/\/+$/, "") : ""}${b}/upload?ticket=${encodeURIComponent(r)}`,
 						expiresInSec: t
 					};
 				}));
@@ -3192,12 +3344,12 @@ var Dn = () => j({
 			...p,
 			execute: (e, t) => {
 				let n = e;
-				return Gn(t, D).pipe(y.flatMap((e) => F.mintPresignedUpload({
+				return $(t, O).pipe(y.flatMap((e) => I.mintPresignedUpload({
 					contentType: n.contentType,
 					tenantId: e.tenantId,
 					...n.expiresInSec === void 0 ? {} : { expiresInSec: n.expiresInSec }
 				}).pipe(y.map((t) => {
-					let r = bt({
+					let r = Ct({
 						instance: v,
 						key: t.key,
 						sub: e.id,
@@ -3208,7 +3360,7 @@ var Dn = () => j({
 						...n.tags === void 0 ? {} : { tags: n.tags },
 						...n.alt === void 0 ? {} : { alt: n.alt },
 						...n.caption === void 0 ? {} : { caption: n.caption },
-						...E === void 0 ? {} : { max: E }
+						...D === void 0 ? {} : { max: D }
 					}, t.expiresInSec);
 					return {
 						uploadUrl: t.uploadUrl,
@@ -3221,28 +3373,29 @@ var Dn = () => j({
 		{
 			...l,
 			execute: (e, n) => {
-				let r = xt(e.finalizeToken);
+				let r = wt(e.finalizeToken);
 				return !r || r.instance !== v ? y.fail(new t({
 					provider: "storage",
 					message: "invalid or expired finalize token",
 					transient: !1,
 					status: 401
-				})) : Kn(r.sub, n.request.subject.id) ? y.fail(new t({
+				})) : Zn(r.sub, n.request.subject.id) ? y.fail(new t({
 					provider: "storage",
 					message: "finalize token belongs to another subject",
 					transient: !1,
 					status: 403
-				})) : F.finalizeUpload({
+				})) : I.finalizeUpload({
 					key: r.key,
 					contentType: r.ct,
 					tenantId: r.tenant,
 					ownerId: r.sub,
 					visibility: r.vis,
+					...de(r.vis),
 					...r.folder === void 0 ? {} : { folder: r.folder },
 					...r.tags === void 0 ? {} : { tags: r.tags },
 					...r.alt === void 0 ? {} : { alt: r.alt },
 					...r.caption === void 0 ? {} : { caption: r.caption }
-				}).pipe(y.flatMap((e) => F.getUrl(e.id).pipe(y.map((t) => ({
+				}).pipe(y.flatMap((e) => I.getUrl(e.id).pipe(y.map((t) => ({
 					id: e.id,
 					url: t,
 					contentType: e.contentType,
@@ -3256,11 +3409,11 @@ var Dn = () => j({
 			...s,
 			execute: (e, t) => {
 				let n = e;
-				return Gn(t, D).pipe(y.map((e) => {
-					let t = n.expiresInSec ?? de, r = ge(), i = n.chunkSize && n.chunkSize > 0 ? n.chunkSize : O;
+				return $(t, O).pipe(y.map((e) => {
+					let t = n.expiresInSec ?? ue, r = _e(), i = n.chunkSize && n.chunkSize > 0 ? n.chunkSize : k;
 					return {
 						uploadId: r,
-						resumableToken: St({
+						resumableToken: Tt({
 							instance: v,
 							id: r,
 							sub: e.id,
@@ -3272,9 +3425,9 @@ var Dn = () => j({
 							...n.tags === void 0 ? {} : { tags: n.tags },
 							...n.alt === void 0 ? {} : { alt: n.alt },
 							...n.caption === void 0 ? {} : { caption: n.caption },
-							...E === void 0 ? {} : { max: E }
+							...D === void 0 ? {} : { max: D }
 						}, t),
-						uploadUrl: `${T ? T.replace(/\/+$/, "") : ""}${b}/upload/resumable`,
+						uploadUrl: `${E ? E.replace(/\/+$/, "") : ""}${b}/upload/resumable`,
 						chunkSize: i,
 						expiresInSec: t
 					};
@@ -3284,14 +3437,14 @@ var Dn = () => j({
 		{
 			...o,
 			execute: (e, t) => {
-				let n = e, r = n.expiresInSec ?? de;
-				return Gn(t, D).pipe(y.flatMap((e) => F.beginMultipartUpload({
+				let n = e, r = n.expiresInSec ?? ue;
+				return $(t, O).pipe(y.flatMap((e) => I.beginMultipartUpload({
 					contentType: n.contentType,
 					tenantId: e.tenantId,
 					visibility: n.visibility ?? "private",
 					expiresInSec: r
 				}).pipe(y.map((t) => ({
-					multipartToken: wt({
+					multipartToken: Dt({
 						instance: v,
 						key: t.key,
 						uploadId: t.uploadId,
@@ -3305,7 +3458,7 @@ var Dn = () => j({
 						...n.alt === void 0 ? {} : { alt: n.alt },
 						...n.caption === void 0 ? {} : { caption: n.caption }
 					}, r),
-					partSize: n.partSize && n.partSize >= O ? n.partSize : O,
+					partSize: n.partSize && n.partSize >= k ? n.partSize : k,
 					expiresInSec: r
 				})))));
 			}
@@ -3313,7 +3466,7 @@ var Dn = () => j({
 		{
 			...g,
 			execute: (e) => {
-				let n = e, r = Tt(n.multipartToken);
+				let n = e, r = Ot(n.multipartToken);
 				return !r || r.instance !== v ? y.fail(new t({
 					provider: "storage",
 					message: "invalid or expired multipart token",
@@ -3324,7 +3477,7 @@ var Dn = () => j({
 					message: "partNumber must be a positive integer",
 					transient: !1,
 					status: 400
-				})) : F.signMultipartPart({
+				})) : I.signMultipartPart({
 					key: r.key,
 					uploadId: r.uploadId,
 					partNumber: n.partNumber
@@ -3334,18 +3487,18 @@ var Dn = () => j({
 		{
 			...c,
 			execute: (e, n) => {
-				let r = e, i = Tt(r.multipartToken);
+				let r = e, i = Ot(r.multipartToken);
 				return !i || i.instance !== v ? y.fail(new t({
 					provider: "storage",
 					message: "invalid or expired multipart token",
 					transient: !1,
 					status: 401
-				})) : Kn(i.sub, n.request.subject.id) ? y.fail(new t({
+				})) : Zn(i.sub, n.request.subject.id) ? y.fail(new t({
 					provider: "storage",
 					message: "multipart token belongs to another subject",
 					transient: !1,
 					status: 403
-				})) : F.completeMultipart({
+				})) : I.completeMultipart({
 					key: i.key,
 					uploadId: i.uploadId,
 					parts: r.parts,
@@ -3353,11 +3506,12 @@ var Dn = () => j({
 					tenantId: i.tenant,
 					ownerId: i.sub,
 					visibility: i.vis,
+					...de(i.vis),
 					...i.folder === void 0 ? {} : { folder: i.folder },
 					...i.tags === void 0 ? {} : { tags: i.tags },
 					...i.alt === void 0 ? {} : { alt: i.alt },
 					...i.caption === void 0 ? {} : { caption: i.caption }
-				}).pipe(y.flatMap((e) => F.getUrl(e.id).pipe(y.map((t) => ({
+				}).pipe(y.flatMap((e) => I.getUrl(e.id).pipe(y.map((t) => ({
 					id: e.id,
 					url: t,
 					size: e.size
@@ -3367,13 +3521,13 @@ var Dn = () => j({
 		{
 			...a,
 			execute: (e) => {
-				let n = Tt(e.multipartToken);
+				let n = Ot(e.multipartToken);
 				return !n || n.instance !== v ? y.fail(new t({
 					provider: "storage",
 					message: "invalid or expired multipart token",
 					transient: !1,
 					status: 401
-				})) : F.abortMultipart({
+				})) : I.abortMultipart({
 					key: n.key,
 					uploadId: n.uploadId
 				}).pipe(y.as({ ok: !0 }));
@@ -3383,7 +3537,7 @@ var Dn = () => j({
 			...ie,
 			execute: (e, t) => {
 				let n = e, r = new Uint8Array(Buffer.from(n.bytesBase64, "base64"));
-				return Gn(t, D).pipe(y.flatMap((e) => F.put({
+				return $(t, O).pipe(y.flatMap((e) => I.put({
 					bytes: r,
 					contentType: n.contentType,
 					tenantId: e.tenantId,
@@ -3391,7 +3545,7 @@ var Dn = () => j({
 					...n.visibility ? { visibility: n.visibility } : {},
 					...n.key ? { key: n.key } : {},
 					...n.password ? { password: n.password } : {}
-				})), y.flatMap((e) => F.getUrl(e.id).pipe(y.map((t) => ({
+				})), y.flatMap((e) => I.getUrl(e.id).pipe(y.map((t) => ({
 					id: e.id,
 					url: t
 				})))));
@@ -3401,7 +3555,7 @@ var Dn = () => j({
 			...u,
 			execute: (e, t) => {
 				let n = e;
-				return Gn(t, D).pipe(y.flatMap((e) => F.ingestUrl(n.url, {
+				return $(t, O).pipe(y.flatMap((e) => I.ingestUrl(n.url, {
 					tenantId: e.tenantId,
 					ownerId: e.id,
 					...n.visibility ? { visibility: n.visibility } : {},
@@ -3410,7 +3564,7 @@ var Dn = () => j({
 					...n.alt === void 0 ? {} : { alt: n.alt },
 					...n.caption === void 0 ? {} : { caption: n.caption },
 					...n.key === void 0 ? {} : { key: n.key }
-				})), y.flatMap((e) => F.getUrl(e.id).pipe(y.map((t) => ({
+				})), y.flatMap((e) => I.getUrl(e.id).pipe(y.map((t) => ({
 					id: e.id,
 					url: t
 				})))));
@@ -3420,7 +3574,7 @@ var Dn = () => j({
 			...ne,
 			execute: (e, t) => {
 				let n = e, r = n.expiresInDays ? new Date(Date.now() + n.expiresInDays * 864e5) : null;
-				return Un(F, n.refId, t).pipe(y.flatMap(() => F.grant({
+				return Yn(I, n.refId, t).pipe(y.flatMap(() => I.grant({
 					refId: n.refId,
 					principalType: n.principalType,
 					principalId: n.principalId,
@@ -3434,21 +3588,21 @@ var Dn = () => j({
 			...h,
 			execute: (e, t) => {
 				let n = e;
-				return F.getGrant(n.grantId).pipe(y.flatMap((e) => e === null ? y.fail(Hn()) : Un(F, e.refId, t)), y.flatMap(() => F.revoke(n.grantId)), y.map(() => ({ ok: !0 })));
+				return I.getGrant(n.grantId).pipe(y.flatMap((e) => e === null ? y.fail(Jn()) : Yn(I, e.refId, t)), y.flatMap(() => I.revoke(n.grantId)), y.map(() => ({ ok: !0 })));
 			}
 		},
 		{
 			...d,
 			execute: (e, t) => {
 				let n = e;
-				return Un(F, n.refId, t).pipe(y.flatMap(() => F.listGrants(n.refId)), y.map((e) => ({ grants: e.map(qn) })));
+				return Yn(I, n.refId, t).pipe(y.flatMap(() => I.listGrants(n.refId)), y.map((e) => ({ grants: e.map(Qn) })));
 			}
 		},
 		{
 			...f,
 			execute: (e, t) => {
 				let n = e;
-				return F.listRefs({
+				return I.listRefs({
 					tenantId: t.request.subject.tenantId,
 					...n.folder === void 0 ? {} : { folder: n.folder },
 					...n.tags === void 0 ? {} : { tags: n.tags },
@@ -3457,19 +3611,19 @@ var Dn = () => j({
 					...n.limit === void 0 ? {} : { limit: n.limit },
 					...n.offset === void 0 ? {} : { offset: n.offset }
 				}).pipe(y.map((e) => ({
-					refs: e.refs.map(Vn),
+					refs: e.refs.map(qn),
 					nextOffset: e.nextOffset
 				})));
 			}
 		}
 	];
-	return ae({
-		name: oe({
-			base: Jn,
+	return T({
+		name: ae({
+			base: $n,
 			alias: i.alias,
 			instance: i.name
 		}),
-		baseName: Jn,
+		baseName: $n,
 		description: "File storage — StorageService over S3 / MinIO / filesystem / memory. Public objects served direct from bucket/CDN; private objects gated by an access policy + per-object grants. Checksums, tenant key-prefixing, _voltro_storage_refs + _voltro_storage_grants, retry.",
 		permissions: [
 			"network:outbound:*",
@@ -3477,14 +3631,15 @@ var Dn = () => j({
 			"inspect:write"
 		],
 		declaredEnv: W.declared,
+		egress: Wn(i),
 		services: me,
-		inspectEndpoints: Te,
+		inspectEndpoints: Ee,
 		httpRoutes: [
-			xe,
 			Se,
-			Ce
+			Ce,
+			we
 		],
-		routes: Ee,
+		routes: De,
 		rpcClientDescriptors: re,
 		errorSchemas: [
 			{
@@ -3518,7 +3673,7 @@ var Dn = () => j({
 		],
 		capabilities: { mediaPersist: {
 			put: async ({ bytes: e, mediaType: t, tenantId: n, operationId: r, ownerId: i, visibility: a, tags: o }) => {
-				let s = await y.runPromise(F.put({
+				let s = await y.runPromise(I.put({
 					bytes: e,
 					contentType: t,
 					tenantId: n,
@@ -3529,12 +3684,12 @@ var Dn = () => j({
 					...fe.current === void 0 ? {} : { operationId: r }
 				}));
 				return {
-					url: await y.runPromise(F.getUrl(s.id, { tenantId: n })),
+					url: await y.runPromise(I.getUrl(s.id, { tenantId: n })),
 					refId: s.id
 				};
 			},
 			ingestUrl: async ({ url: e, tenantId: t, operationId: n, ownerId: r, visibility: i, tags: a }) => {
-				let o = await y.runPromise(F.ingestUrl(e, {
+				let o = await y.runPromise(I.ingestUrl(e, {
 					tenantId: t,
 					...r === void 0 ? {} : { ownerId: r },
 					...i === void 0 ? {} : { visibility: i },
@@ -3542,24 +3697,24 @@ var Dn = () => j({
 					...fe.current === void 0 ? {} : { operationId: n }
 				}));
 				return {
-					url: await y.runPromise(F.getUrl(o.id, { tenantId: t })),
+					url: await y.runPromise(I.getUrl(o.id, { tenantId: t })),
 					refId: o.id
 				};
 			}
 		} },
 		bindDataStore: (e) => {
-			k && (j.current = Wt(e)), A && (M.current = qt(e)), k && A && (fe.current = yn(e)), x.bindDataStore?.(e);
+			A && (M.current = Jt(e)), j && (N.current = Zt(e)), A && j && (fe.current = wn(e)), x.bindDataStore?.(e);
 		},
 		onActivate: (e) => y.sync(() => {
-			let t = !!T || !!W.read("STORAGE_CDN_URL", i.cdnBaseUrl);
+			let t = !!E || !!W.read("STORAGE_CDN_URL", i.cdnBaseUrl);
 			e.logger.info(`storage: provider=${x.name} presign=${x.presigns ? "yes" : "no"} publicUrl=${t ? "yes" : "no"} transforms=yes`, {
 				provider: x.name,
 				bucket: S,
-				refStore: k ? "memory" : "custom"
+				refStore: A ? "memory" : "custom"
 			}), x.name === "memory" && process.env.NODE_ENV !== "test" && e.logger.warn("storage: provider=memory — uploads are IN-MEMORY and LOST on restart. Set STORAGE_PROVIDER (filesystem / s3 / r2 / azure / gcs) for anything but throwaway dev. (Empty/placeholder storage env silently falls back to memory.)"), !t && !x.presigns && e.logger.warn("storage: no VOLTRO_PUBLIC_URL / STORAGE_CDN_URL and this provider can't presign — serve URLs are RELATIVE and will not resolve cross-origin (browser <img> / server-to-server AI fetches). Set VOLTRO_PUBLIC_URL to this api's absolute base URL.");
 		}),
 		onDeactivate: () => y.void
 	});
 };
 //#endregion
-export { U as STORAGE_BLOBS_TABLE, H as STORAGE_GRANTS_TABLE, V as STORAGE_REFS_TABLE, Ne as STORAGE_USAGE_TABLE, e as StorageAccessDenied, t as StorageError, n as StorageRejected, r as StorageScanRejected, i as StorageService, Le as _voltroStorageBlobsTable, Fe as _voltroStorageGrantsTable, Pe as _voltroStorageRefsTable, Ie as _voltroStorageUsageTable, In as appStorageProvider, En as assetRef, qe as azureProvider, Xt as buildStorageService, De as bytesToStream, kt as checkLimits, Cn as clamavScanner, Ve as clearStorageBuffer, Oe as collectStream, Ee as concatBytes, Ln as configuredStorageProvider, Et as contentTypeAllowed, qt as dataStoreGrantStore, Wt as dataStoreRefStore, Ke as databaseProvider, kn as decodeDataUri, Mn as durabilityNotice, bn as encodeInstream, Tn as ffmpegTranscoder, Ue as filesystemProvider, ke as fromNodeReadable, je as getObjectStream, rt as hashPassword, yn as makeStorageObjectMetadata, Gt as memoryGrantStore, He as memoryProvider, Vt as memoryRefStore, xn as parseClamavResponse, Ye as parseTransformParams, jn as pathDurability, An as putAvatar, Me as putObjectStream, Be as readStorageBuffer, zt as refMatchesListQuery, Rn as resolveStorageProvider, K as resolveStorageSecret, We as s3Provider, Fn as setActiveStorageProvider, bt as signFinalizeTicket, gt as signGrant, wt as signMultipartTicket, St as signResumableTicket, vt as signUploadTicket, Ot as sniffMatches, Yn as storageInstanceName, en as storageObjectLifecycleTables, Xn as storagePlugin, gn as storagePutIntentsTable, Zt as storageServiceLayer, Ae as toNodeReadable, nt as transformCached, $e as transformImage, xt as verifyFinalizeTicket, _t as verifyGrant, Tt as verifyMultipartTicket, it as verifyPassword, Ct as verifyResumableTicket, yt as verifyUploadTicket, Dn as withStorage };
+export { U as STORAGE_BLOBS_TABLE, H as STORAGE_GRANTS_TABLE, V as STORAGE_REFS_TABLE, Pe as STORAGE_USAGE_TABLE, e as StorageAccessDenied, t as StorageError, n as StorageRejected, r as StorageScanRejected, i as StorageService, Re as _voltroStorageBlobsTable, Ie as _voltroStorageGrantsTable, Fe as _voltroStorageRefsTable, Le as _voltroStorageUsageTable, Vn as appStorageProvider, jn as assetRef, Je as azureProvider, en as buildStorageService, Oe as bytesToStream, Mt as checkLimits, On as clamavScanner, He as clearStorageBuffer, ke as collectStream, De as concatBytes, Hn as configuredStorageProvider, kt as contentTypeAllowed, Zt as dataStoreGrantStore, Jt as dataStoreRefStore, qe as databaseProvider, Pn as decodeDataUri, Ln as durabilityNotice, Tn as encodeInstream, An as ffmpegTranscoder, We as filesystemProvider, Ae as fromNodeReadable, Me as getObjectStream, ot as hashPassword, wn as makeStorageObjectMetadata, Yt as memoryGrantStore, Ue as memoryProvider, Gt as memoryRefStore, En as parseClamavResponse, Ze as parseTransformParams, In as pathDurability, Fn as putAvatar, Ne as putObjectStream, Ve as readStorageBuffer, Ut as refMatchesListQuery, Un as resolveStorageProvider, K as resolveStorageSecret, Ge as s3Provider, Bn as setActiveStorageProvider, Ct as signFinalizeTicket, yt as signGrant, Dt as signMultipartTicket, Tt as signResumableTicket, xt as signUploadTicket, jt as sniffMatches, Wn as storageEgressOf, er as storageInstanceName, on as storageObjectLifecycleTables, tr as storagePlugin, xn as storagePutIntentsTable, tn as storageServiceLayer, je as toNodeReadable, at as transformCached, tt as transformFallbackReason, nt as transformImage, wt as verifyFinalizeTicket, bt as verifyGrant, Ot as verifyMultipartTicket, st as verifyPassword, Et as verifyResumableTicket, St as verifyUploadTicket, Mn as withStorage };