@voltro/plugin-storage 0.84.0 → 0.86.0

package/dist/service.js

@@ -0,0 +1,1084 @@
+import { requireStorageReferenceScope as e, storageObjectNamespace as t, storageUploadTicketScope as n } from "./storageNamespaces.js";
+import { storageReferenceCatalogueId as r } from "./referenceCatalogue.js";
+import { STORAGE_GRANTS_TABLE as i, STORAGE_REFS_TABLE as a, STORAGE_USAGE_TABLE as o } from "./table.js";
+import "./storageReferenceInstances.js";
+import { StorageAccessDenied as s, StorageError as c, StorageRejected as l, StorageScanRejected as u, StorageService as d } from "./types.js";
+import { storageInteger as f, storageIntegerSum as p } from "./storageNumbers.js";
+import { getObjectStream as m } from "./streamBridge.js";
+import { storageMetadataError as h } from "./metadataError.js";
+import { evaluatePolicy as g, grantsAllow as _, hashPassword as v, resolveSubjectGroups as y } from "./access.js";
+import { signGrant as b } from "./grant.js";
+import { checkLimits as ee } from "./constraints.js";
+import { extractImageMetadata as te } from "./derivatives.js";
+import { fetchIngestBody as x, withIngestAbort as S } from "./ingest.js";
+import { makeStorageObjectWriter as C } from "./objectWriter.js";
+import { randomUUID as w } from "node:crypto";
+import { and as T, authoredError as E, column as D, contains as O, eq as k, generateId as A, isNull as j, or as M } from "@voltro/database";
+import { Effect as N, Exit as P, Layer as F, Schedule as I, Stream as L } from "effect";
+//#region src/service.ts
+var R = async (e) => {
+	let { createHash: t } = await import("node:crypto");
+	return t("sha256").update(e).digest("hex");
+}, z = (e, t, n) => `${e?.replace(/\/+$/, "") ?? ""}${n}/${t}`, B = (e) => {
+	let t = /* @__PURE__ */ new Map(), n = {
+		public: 0,
+		private: 0
+	};
+	for (let r of e) {
+		let e = r.tenantId ?? "(global)", i = t.get(e) ?? {
+			count: 0,
+			bytes: 0
+		};
+		i.count = p(i.count, r.count, "ref count"), i.bytes = p(i.bytes, r.bytes, "usage bytes"), t.set(e, i), r.visibility === "public" ? n.public = p(n.public, r.count, "public ref count") : n.private = p(n.private, r.count, "private ref count");
+	}
+	return {
+		byTenant: Object.fromEntries(t),
+		visibility: n
+	};
+}, V = (e, t) => {
+	if (t.search && ![
+		e.id,
+		e.key,
+		e.contentType,
+		e.ownerId,
+		e.tenantId
+	].some((e) => e?.toLowerCase().includes(t.search.toLowerCase())) || t.tenantId !== void 0 && (e.tenantId ?? null) !== (t.tenantId ?? null) || t.ownerId !== void 0 && e.ownerId !== t.ownerId || !t.includeDerived && e.derivedFrom != null) return !1;
+	if (t.folder !== void 0) {
+		let n = t.folder.replace(/\/+$/, ""), r = (e.folder ?? "").replace(/\/+$/, "");
+		if (r !== n && !r.startsWith(`${n}/`)) return !1;
+	}
+	if (t.tags.length > 0) {
+		let n = e.tags ?? [];
+		if (!t.tags.every((e) => n.includes(e))) return !1;
+	}
+	return !0;
+}, H = (e) => e ?? "global", U = () => {
+	let e = /* @__PURE__ */ new Map(), n = /* @__PURE__ */ new Map();
+	return {
+		catalogueId: N.succeed(t(["memory-reference-catalogue", w()])),
+		statistics: () => N.try({
+			try: () => B((function* () {
+				for (let t of e.values()) yield {
+					tenantId: t.tenantId,
+					visibility: t.visibility,
+					count: 1,
+					bytes: t.size
+				};
+			})()),
+			catch: (e) => h(e, "refstore")
+		}),
+		insert: (t) => N.try({
+			try: () => {
+				f(t.size, "ref size"), e.set(t.id, t);
+			},
+			catch: (e) => h(e, "refstore")
+		}),
+		getById: (t) => N.sync(() => e.get(t) ?? null),
+		delete: (t) => N.sync(() => e.delete(t)),
+		listRecent: (t) => N.sync(() => [...e.values()].sort((e, t) => t.createdAt.getTime() - e.createdAt.getTime() || t.id.localeCompare(e.id)).slice(0, t)),
+		countByKey: (t, n) => N.sync(() => [...e.values()].filter((e) => e.bucket === t && e.key === n).length),
+		countPublicByKey: (t, n) => N.sync(() => [...e.values()].filter((e) => e.bucket === t && e.key === n && e.visibility === "public").length),
+		setVisibility: (t, n) => N.sync(() => {
+			let r = e.get(t);
+			if (r === void 0) return null;
+			let i = {
+				...r,
+				visibility: n
+			};
+			return e.set(t, i), i;
+		}),
+		usageByTenant: (t) => N.try({
+			try: () => {
+				let n = 0, r = 0;
+				for (let i of e.values()) (i.tenantId ?? null) === (t ?? null) && (n = p(n, i.size, "usage bytes"), r++);
+				return {
+					bytes: n,
+					count: r
+				};
+			},
+			catch: (e) => h(e, "refstore")
+		}),
+		consumeUsage: (e, t, r) => N.try({
+			try: () => {
+				let i = H(e), a = n.get(i) ?? {
+					bytes: 0,
+					count: 0
+				};
+				f(t.bytes, "usage byte delta"), f(t.count, "usage count delta");
+				let o = Number.isSafeInteger(a.bytes + t.bytes) && Number.isSafeInteger(a.count + t.count) && (r?.maxBytes === void 0 || a.bytes + t.bytes <= r.maxBytes) && (r?.maxCount === void 0 || a.count + t.count <= r.maxCount);
+				return o && n.set(i, {
+					bytes: a.bytes + t.bytes,
+					count: a.count + t.count
+				}), {
+					allowed: o,
+					bytes: a.bytes,
+					count: a.count
+				};
+			},
+			catch: (e) => h(e, "refstore")
+		}),
+		releaseUsage: (e, t) => N.try({
+			try: () => {
+				let r = H(e), i = n.get(r);
+				f(t.bytes, "usage byte delta"), f(t.count, "usage count delta"), i && n.set(r, {
+					bytes: Math.max(0, i.bytes - t.bytes),
+					count: Math.max(0, i.count - t.count)
+				});
+			},
+			catch: (e) => h(e, "refstore")
+		}),
+		listByDerivedFrom: (t) => N.sync(() => [...e.values()].filter((e) => (e.derivedFrom ?? null) === t)),
+		listRefs: (t) => N.sync(() => [...e.values()].filter((e) => V(e, t)).sort((e, t) => t.createdAt.getTime() - e.createdAt.getTime() || t.id.localeCompare(e.id)).slice(t.offset, t.offset + t.limit))
+	};
+}, W = (e) => Array.isArray(e) && e.every((e) => typeof e == "string") ? e : null, G = (e) => ({
+	id: String(e.id),
+	tenantId: e.tenantId ?? null,
+	ownerId: e.ownerId ?? null,
+	bucket: String(e.bucket),
+	key: String(e.key),
+	contentType: String(e.contentType),
+	size: f(e.size, "ref size"),
+	checksum: String(e.checksum),
+	visibility: e.visibility === "public" ? "public" : "private",
+	accessPolicy: e.accessPolicy ?? null,
+	passwordHash: e.passwordHash ?? null,
+	createdAt: e.createdAt instanceof Date ? e.createdAt : new Date(String(e.createdAt)),
+	width: e.width ?? null,
+	height: e.height ?? null,
+	duration: e.duration ?? null,
+	placeholder: e.placeholder ?? null,
+	folder: e.folder ?? null,
+	tags: W(e.tags),
+	alt: e.alt ?? null,
+	caption: e.caption ?? null,
+	derivedFrom: e.derivedFrom ?? null,
+	kind: e.kind ?? null
+}), K = (e) => N.tryPromise({
+	try: e,
+	catch: (e) => h(e, "refstore", !0)
+}), q = async (e, t) => (await e.query({
+	table: "_voltro_storage_usage",
+	predicate: {
+		column: "tenantId",
+		op: "eq",
+		value: t
+	},
+	order: [],
+	take: 1,
+	skip: void 0,
+	projection: void 0
+}))[0] ?? null, J = (t, n) => {
+	let i = Object.freeze({ ...n });
+	return e(i), {
+		catalogueId: K(() => r(t, i)),
+		statistics: () => K(async () => B((await t.query({
+			table: a,
+			predicate: T(k("storageInstance", i.storageInstance), k("objectNamespace", i.objectNamespace)),
+			order: [],
+			take: void 0,
+			skip: void 0,
+			projection: void 0,
+			groupBy: ["tenantId", "visibility"],
+			aggregations: [
+				D("tenantId"),
+				D("visibility"),
+				{
+					op: "count",
+					alias: "count"
+				},
+				{
+					op: "sum",
+					column: "size",
+					alias: "bytes"
+				}
+			]
+		})).map((e) => ({
+			tenantId: e.tenantId == null ? null : String(e.tenantId),
+			visibility: String(e.visibility),
+			count: f(e.count, "ref count"),
+			bytes: f(e.bytes ?? 0, "usage bytes")
+		})))),
+		insert: (e) => K(() => t.insert(a, {
+			...e,
+			storageInstance: i.storageInstance,
+			objectNamespace: i.objectNamespace,
+			size: String(f(e.size, "ref size"))
+		})),
+		getById: (e) => K(async () => {
+			let n = await t.query({
+				table: a,
+				predicate: T(T(k("storageInstance", i.storageInstance), k("objectNamespace", i.objectNamespace)), k("id", e)),
+				order: [],
+				take: 1,
+				skip: void 0,
+				projection: void 0
+			});
+			return n[0] ? G(n[0]) : null;
+		}),
+		delete: (e) => K(async () => await t.deleteMany(a, { where: T(T(k("storageInstance", i.storageInstance), k("objectNamespace", i.objectNamespace)), k("id", e)) }) > 0),
+		listRecent: (e) => K(async () => (await t.query({
+			table: a,
+			predicate: T(k("storageInstance", i.storageInstance), k("objectNamespace", i.objectNamespace)),
+			order: [{
+				column: "createdAt",
+				direction: "desc"
+			}],
+			take: e,
+			skip: void 0,
+			projection: void 0
+		})).map(G)),
+		countByKey: (e, n) => K(async () => {
+			let e = await t.query({
+				table: a,
+				predicate: { and: [k("objectNamespace", i.objectNamespace), {
+					column: "key",
+					op: "eq",
+					value: n
+				}] },
+				order: [],
+				take: void 0,
+				skip: void 0,
+				projection: void 0,
+				aggregations: [{
+					op: "count",
+					alias: "count"
+				}]
+			}), r = f(e[0]?.count ?? 0, "ref count");
+			return r === 0 ? (await t.query({
+				table: "_voltro_storage_object_heads",
+				predicate: T(k("objectNamespace", i.objectNamespace), k("key", n)),
+				order: [],
+				take: 1,
+				skip: void 0,
+				projection: ["id"]
+			})).length : r;
+		}),
+		countPublicByKey: (e, n) => K(async () => {
+			let e = await t.query({
+				table: a,
+				predicate: { and: [
+					k("objectNamespace", i.objectNamespace),
+					{
+						column: "key",
+						op: "eq",
+						value: n
+					},
+					{
+						column: "visibility",
+						op: "eq",
+						value: "public"
+					}
+				] },
+				order: [],
+				take: void 0,
+				skip: void 0,
+				projection: void 0,
+				aggregations: [{
+					op: "count",
+					alias: "count"
+				}]
+			});
+			return f(e[0]?.count ?? 0, "ref count");
+		}),
+		setVisibility: (e, n) => K(() => t.transactional(async (t) => {
+			if ((await t.query({
+				table: "_voltro_storage_refs",
+				predicate: T(T(k("storageInstance", i.storageInstance), k("objectNamespace", i.objectNamespace)), k("id", e)),
+				lock: "update",
+				order: [],
+				take: 1,
+				skip: void 0,
+				projection: ["id"]
+			})).length === 0) return null;
+			let r = await t.update(a, e, { visibility: n });
+			return r ? G(r) : null;
+		})),
+		usageByTenant: (e) => K(async () => {
+			let n = await t.query({
+				table: a,
+				predicate: e === null ? j("tenantId") : k("tenantId", e),
+				order: [],
+				take: void 0,
+				skip: void 0,
+				projection: void 0,
+				aggregations: [
+					{
+						op: "count",
+						alias: "count"
+					},
+					{
+						op: "sum",
+						column: "size",
+						alias: "bytes"
+					},
+					{
+						op: "min",
+						column: "size",
+						alias: "minSize"
+					},
+					{
+						op: "max",
+						column: "size",
+						alias: "maxSize"
+					}
+				]
+			});
+			return f(n[0]?.count ?? 0, "ref count") > 0 && (f(n[0]?.minSize, "ref size"), f(n[0]?.maxSize, "ref size")), {
+				bytes: f(n[0]?.bytes ?? 0, "usage bytes"),
+				count: f(n[0]?.count ?? 0, "ref count")
+			};
+		}),
+		consumeUsage: (e, n, r) => K(async () => {
+			let i = H(e);
+			f(n.bytes, "usage byte delta"), f(n.count, "usage count delta");
+			for (let e = 0; e < 32; e++) {
+				e > 0 && await new Promise((t) => setTimeout(t, e));
+				let a = await q(t, i), s = a ? f(a.bytes, "usage bytes") : 0, c = a ? f(a.count, "ref count") : 0;
+				if (!(Number.isSafeInteger(s + n.bytes) && Number.isSafeInteger(c + n.count) && (r?.maxBytes === void 0 || s + n.bytes <= r.maxBytes) && (r?.maxCount === void 0 || c + n.count <= r.maxCount))) return {
+					allowed: !1,
+					bytes: s,
+					count: c
+				};
+				if (a) {
+					if (await t.updateMany("_voltro_storage_usage", {
+						bytes: String(s + n.bytes),
+						count: String(c + n.count),
+						updatedAt: /* @__PURE__ */ new Date()
+					}, { where: T(k("id", String(a.id)), k("bytes", a.bytes), k("count", a.count)) }) === 1) return {
+						allowed: !0,
+						bytes: s,
+						count: c
+					};
+				} else {
+					let e = A({
+						kind: "typeid",
+						prefix: "susage"
+					}, o), r = await t.insertIgnore(o, {
+						id: e,
+						tenantId: i,
+						bytes: String(n.bytes),
+						count: String(n.count),
+						updatedAt: /* @__PURE__ */ new Date()
+					}, { conflictColumns: ["tenantId"] });
+					if (String(r.id) === e) return {
+						allowed: !0,
+						bytes: 0,
+						count: 0
+					};
+				}
+			}
+			throw E("Storage quota reservation contended after 32 attempts; retry");
+		}),
+		releaseUsage: (e, n) => K(async () => {
+			let r = H(e);
+			f(n.bytes, "usage byte delta"), f(n.count, "usage count delta");
+			for (let e = 0; e < 32; e++) {
+				e > 0 && await new Promise((t) => setTimeout(t, e));
+				let i = await q(t, r);
+				if (!i) return;
+				let a = f(i.bytes, "usage bytes"), o = f(i.count, "ref count");
+				if (await t.updateMany("_voltro_storage_usage", {
+					bytes: String(Math.max(0, a - n.bytes)),
+					count: String(Math.max(0, o - n.count)),
+					updatedAt: /* @__PURE__ */ new Date()
+				}, { where: T(k("id", String(i.id)), k("bytes", i.bytes), k("count", i.count)) }) === 1) return;
+			}
+			throw E("Storage quota release contended after 32 attempts; retry");
+		}),
+		listByDerivedFrom: (e) => K(async () => (await t.query({
+			table: a,
+			predicate: T(T(k("storageInstance", i.storageInstance), k("objectNamespace", i.objectNamespace)), k("derivedFrom", e)),
+			order: [{
+				column: "createdAt",
+				direction: "asc"
+			}],
+			take: void 0,
+			skip: void 0,
+			projection: void 0
+		})).map(G)),
+		listRefs: (e) => K(async () => {
+			let n = [T(k("storageInstance", i.storageInstance), k("objectNamespace", i.objectNamespace))];
+			e.tenantId !== void 0 && n.push(e.tenantId === null ? j("tenantId") : k("tenantId", e.tenantId)), e.ownerId !== void 0 && n.push(k("ownerId", e.ownerId)), e.search && n.push(M(...[
+				"id",
+				"key",
+				"contentType",
+				"ownerId",
+				"tenantId"
+			].map((t) => O(t, e.search)))), e.includeDerived || n.push(j("derivedFrom"));
+			let r = e.folder === void 0 && e.tags.length === 0, o = n.length ? T(...n) : void 0, s = await t.query({
+				table: a,
+				predicate: o,
+				order: [{
+					column: "createdAt",
+					direction: "desc"
+				}, {
+					column: "id",
+					direction: "desc"
+				}],
+				take: r ? e.limit : void 0,
+				skip: r ? e.offset : void 0,
+				projection: void 0
+			});
+			return r ? s.map(G) : s.map(G).filter((t) => V(t, e)).slice(e.offset, e.offset + e.limit);
+		})
+	};
+}, Y = () => {
+	let e = /* @__PURE__ */ new Map();
+	return {
+		insert: (t) => N.sync(() => {
+			e.set(t.id, t);
+		}),
+		delete: (t) => N.sync(() => {
+			e.delete(t);
+		}),
+		getById: (t) => N.sync(() => e.get(t) ?? null),
+		listByRef: (t) => N.sync(() => [...e.values()].filter((e) => e.refId === t)),
+		deleteByRef: (t) => N.sync(() => {
+			for (let [n, r] of e) r.refId === t && e.delete(n);
+		})
+	};
+}, X = (e) => ({
+	id: String(e.id),
+	refId: String(e.refId),
+	principalType: e.principalType,
+	principalId: String(e.principalId),
+	permission: e.permission === "write" ? "write" : "read",
+	createdAt: e.createdAt instanceof Date ? e.createdAt : new Date(String(e.createdAt)),
+	expiresAt: e.expiresAt ? e.expiresAt instanceof Date ? e.expiresAt : new Date(String(e.expiresAt)) : null,
+	createdBy: e.createdBy ?? null
+}), Z = (t, n) => {
+	let r = Object.freeze({ ...n });
+	return e(r), {
+		insert: (e) => K(() => t.insert(i, {
+			...e,
+			...r
+		})),
+		delete: (e) => K(() => t.deleteMany(i, { where: T(T(k("storageInstance", r.storageInstance), k("objectNamespace", r.objectNamespace)), k("id", e)) })).pipe(N.asVoid),
+		getById: (e) => K(async () => {
+			let n = (await t.query({
+				table: i,
+				predicate: T(T(k("storageInstance", r.storageInstance), k("objectNamespace", r.objectNamespace)), k("id", e)),
+				order: [],
+				take: 1,
+				skip: void 0,
+				projection: void 0
+			}))[0];
+			return n ? X(n) : null;
+		}),
+		listByRef: (e) => K(async () => (await t.query({
+			table: i,
+			predicate: T(T(k("storageInstance", r.storageInstance), k("objectNamespace", r.objectNamespace)), k("refId", e)),
+			order: [{
+				column: "createdAt",
+				direction: "desc"
+			}],
+			take: void 0,
+			skip: void 0,
+			projection: void 0
+		})).map(X)),
+		deleteByRef: (e) => K(async () => {
+			let n = await t.query({
+				table: i,
+				predicate: T(T(k("storageInstance", r.storageInstance), k("objectNamespace", r.objectNamespace)), k("refId", e)),
+				order: [],
+				take: void 0,
+				skip: void 0,
+				projection: void 0
+			});
+			for (let e of n) await t.delete(i, String(e.id));
+		})
+	};
+}, Q = () => A({
+	kind: "typeid",
+	prefix: "file"
+}, a), ne = () => A({
+	kind: "typeid",
+	prefix: "grant"
+}, i), $ = (e) => {
+	let { provider: t, refStore: r, grantStore: i, bucket: o } = e, d = e.access ?? {}, f = e.attempts ?? 3, p = e.urlExpiresInSec ?? 3600, w = (t) => z(e.publicBaseUrl, t, e.httpPath ?? "/_voltro/storage"), T = I.max([I.recurs(Math.max(0, f - 1)), I.exponential("100 millis")]).pipe(I.while(({ input: e }) => e.transient)), E = (t, n, r) => [
+		e.tenantPrefix,
+		t ?? "global",
+		r ?? n
+	].filter(Boolean).join("/"), D = (e) => {
+		if (e === void 0) return N.succeed(void 0);
+		let n = e.length === 0 ? "empty" : e.includes("\0") ? "contains NUL" : e.startsWith("/") || e.startsWith("\\") ? "starts with a path separator" : e.includes("\\") ? "contains a backslash" : e.split("/").some((e) => e === "" || e === "." || e === "..") ? "contains an empty, \".\" or \"..\" segment" : void 0;
+		return n === void 0 ? N.succeed(e) : N.fail(new c({
+			provider: t.name,
+			message: `storage key rejected: ${n}`,
+			transient: !1,
+			status: 400
+		}));
+	}, O = (t, n, r) => [
+		e.tenantPrefix,
+		t ?? "global",
+		"_incoming",
+		n,
+		String(r).padStart(6, "0")
+	].filter(Boolean).join("/"), k = (e, t) => t === void 0 || e.tenantId === t, j = (e, n) => k(e, n) ? N.succeed(e) : N.fail(new c({
+		provider: t.name,
+		message: "cross-tenant access denied",
+		transient: !1,
+		status: 403
+	})), M = (n, r, i) => N.gen(function* () {
+		let a = e.objects?.(), o = (e) => new c({
+			provider: "metadata",
+			message: e,
+			transient: !1,
+			status: 409
+		});
+		if (a === void 0) return i === void 0 ? !1 : yield* N.fail(o(`claim '${i}' cannot be released: no data store is bound, so ref '${n}' holds no claims`));
+		let s = yield* N.tryPromise({
+			try: () => a.intent(n),
+			catch: (e) => new c({
+				provider: "metadata",
+				message: String(e?.message ?? e),
+				transient: !1
+			})
+		});
+		return s === void 0 ? i === void 0 ? !1 : yield* N.fail(o(`claim '${i}' cannot be released: ref '${n}' was not written through an operation and holds no claims`)) : (yield* j(s.ref, r), yield* C({
+			metadata: a,
+			provider: {
+				...t,
+				delete: (e) => t.delete(e).pipe(N.retry(T))
+			}
+		}).delete(n, r, i).pipe(N.catchTag("StorageRejected", (e) => N.fail(e.reason === "claim-not-held" ? o(e.detail) : new c({
+			provider: "metadata",
+			message: e.detail,
+			transient: !1
+		})))), !0);
+	}), F = (e, n) => r.getById(e).pipe(N.flatMap((r) => r ? j(r, n) : N.fail(new c({
+		provider: t.name,
+		message: `no ref '${e}'`,
+		transient: !1,
+		status: 404
+	})))), B = (t) => N.suspend(() => {
+		let n = e.scan(t);
+		return N.isEffect(n) ? n : N.tryPromise({
+			try: () => Promise.resolve(n),
+			catch: (e) => new c({
+				provider: "scan",
+				message: String(e?.message ?? e),
+				transient: !0
+			})
+		});
+	}), V = (t) => N.suspend(() => {
+		let n = t.contentType;
+		if (!e.videoProbe || !(n.startsWith("video/") || n.startsWith("audio/"))) return N.succeed(null);
+		let r;
+		try {
+			r = e.videoProbe(t);
+		} catch {
+			return N.succeed(null);
+		}
+		return N.isEffect(r) ? r.pipe(N.catch(() => N.succeed(null))) : N.tryPromise({
+			try: () => Promise.resolve(r),
+			catch: () => null
+		}).pipe(N.catch(() => N.succeed(null)));
+	}), H = (n) => N.gen(function* () {
+		let i = ee(n.bytes, n.contentType, e.limits);
+		if (i) return yield* N.fail(new l(i));
+		if (n.claim !== void 0 && n.operationId === void 0) return yield* N.fail(new l({
+			reason: "claim-without-operation",
+			detail: "a put with a claim needs an operationId; the claim names this caller's hold on that operation's object"
+		}));
+		if (e.scan) {
+			let e = yield* B({
+				bytes: n.bytes,
+				contentType: n.contentType,
+				...n.key ? { key: n.key } : {}
+			});
+			if (!e.clean) return yield* N.fail(new u({ threat: e.threat ?? "unknown" }));
+		}
+		let a = yield* N.promise(() => te(n.bytes, n.contentType, { normalize: e.normalizeImages ?? !1 })), s = a.bytes, c = yield* V({
+			bytes: s,
+			contentType: n.contentType
+		}), d = a.width ?? c?.width, f = a.height ?? c?.height, p = a.placeholder ?? c?.poster, m = n.duration ?? c?.duration, h = yield* N.promise(() => R(s)), g = n.tenantId ?? null, _ = n.visibility ?? "private", y = yield* D(n.key), b = E(g, h, y), x = n.operationId === void 0 ? E(g, h, `i-${yield* N.promise(() => R(new TextEncoder().encode(JSON.stringify([e.storageInstance ?? "@voltro/plugin-storage", o]))))}/plain/${y ?? h}`) : b, S = n.password ? yield* N.sync(() => v(n.password)) : null, w = {
+			id: Q(),
+			tenantId: g,
+			ownerId: n.ownerId ?? null,
+			bucket: o,
+			key: x,
+			contentType: n.contentType,
+			size: s.byteLength,
+			checksum: h,
+			visibility: _,
+			accessPolicy: n.access ?? null,
+			passwordHash: S,
+			createdAt: /* @__PURE__ */ new Date(),
+			...d === void 0 ? {} : { width: d },
+			...f === void 0 ? {} : { height: f },
+			...p === void 0 ? {} : { placeholder: p },
+			...m === void 0 ? {} : { duration: m },
+			...n.folder === void 0 ? {} : { folder: n.folder },
+			...n.tags === void 0 ? {} : { tags: n.tags },
+			...n.alt === void 0 ? {} : { alt: n.alt },
+			...n.caption === void 0 ? {} : { caption: n.caption },
+			...n.derivedFrom === void 0 ? {} : { derivedFrom: n.derivedFrom },
+			...n.kind === void 0 ? {} : { kind: n.kind }
+		}, O = e.transcode !== void 0 && e.autoTranscode !== !1, k = (e) => O && e.derivedFrom == null && (n.contentType.startsWith("video/") || n.contentType.startsWith("audio/")) ? N.forkDetach(W(e).pipe(N.ignore)) : N.void;
+		if (n.operationId !== void 0) {
+			let r = e.objects?.();
+			if (r === void 0) return yield* N.fail(new l({
+				reason: "operation-store-unbound",
+				detail: "a put with an operationId needs a bound data store; the in-memory ref store cannot hold operation intents"
+			}));
+			let i = {
+				tenantId: g,
+				bucket: o,
+				operationId: n.operationId,
+				checksum: h,
+				logicalKey: x,
+				fingerprint: yield* N.promise(() => R(new TextEncoder().encode(JSON.stringify([
+					h,
+					n.contentType,
+					_,
+					n.access ?? null,
+					n.key ?? null,
+					n.ownerId ?? null,
+					n.folder ?? null,
+					n.tags ?? null,
+					n.alt ?? null,
+					n.caption ?? null,
+					n.derivedFrom ?? null,
+					n.kind ?? null,
+					m ?? null,
+					n.password !== void 0
+				]))))
+			}, a = yield* C({
+				metadata: r,
+				provider: {
+					...t,
+					put: (e, n, r) => t.put(e, n, r).pipe(N.retry(T))
+				}
+			}).put({
+				identity: i,
+				ref: w,
+				bytes: s,
+				...e.quota === void 0 ? {} : { quota: e.quota },
+				...n.claim === void 0 ? {} : { claim: n.claim }
+			});
+			return yield* k(a.ref), {
+				...a.ref,
+				outcome: a.outcome
+			};
+		}
+		let A = {
+			bytes: s.byteLength,
+			count: 1
+		}, j = yield* r.consumeUsage(g, A, e.quota);
+		if (!j.allowed) {
+			let t = e.quota ?? {}, n = t.maxCount !== void 0 && j.count + 1 > t.maxCount ? `tenant object count ${j.count} + 1 exceeds max ${t.maxCount}` : `tenant usage ${j.bytes} + ${s.byteLength} bytes exceeds max ${t.maxBytes}`;
+			return yield* N.fail(new l({
+				reason: "quota-exceeded",
+				detail: n
+			}));
+		}
+		return yield* ((e) => e.pipe(N.onExit((e) => P.isSuccess(e) ? N.void : r.delete(w.id).pipe(N.andThen(r.releaseUsage(g, A)), N.ignore))))(r.insert(w).pipe(N.andThen(t.put(x, s, {
+			contentType: n.contentType,
+			public: _ === "public"
+		}).pipe(N.retry(T))))), yield* k(w), {
+			...w,
+			outcome: "created"
+		};
+	}), U = (t) => N.suspend(() => {
+		if (!e.transcode) return N.succeed([]);
+		let n;
+		try {
+			n = e.transcode(t);
+		} catch {
+			return N.succeed([]);
+		}
+		return N.isEffect(n) ? n.pipe(N.catch(() => N.succeed([]))) : N.tryPromise({
+			try: () => Promise.resolve(n),
+			catch: () => []
+		}).pipe(N.catch(() => N.succeed([])));
+	}), W = (n) => N.gen(function* () {
+		if (!e.transcode || n.derivedFrom != null) return [];
+		let r = yield* t.get(n.key).pipe(N.retry(T)), i = yield* U({
+			bytes: r.bytes,
+			contentType: n.contentType,
+			ref: n
+		}), a = [];
+		for (let e of i) {
+			let t = yield* H({
+				bytes: e.bytes,
+				contentType: e.contentType,
+				tenantId: n.tenantId,
+				ownerId: n.ownerId,
+				visibility: n.visibility,
+				derivedFrom: n.id,
+				kind: e.kind,
+				...e.label === void 0 ? {} : { caption: e.label }
+			});
+			a.push(t);
+		}
+		return a;
+	}), G = (e, t, n) => N.gen(function* () {
+		if (e.derivedFrom != null) {
+			let i = yield* r.getById(e.derivedFrom);
+			return i === null ? !1 : yield* G(i, t, n);
+		}
+		if (e.visibility === "public") return !0;
+		if (e.tenantId !== null && !k(e, t.tenantId ?? null)) return !1;
+		if (yield* g(e, t, {
+			...d,
+			...n?.password === void 0 ? {} : { password: n.password }
+		})) return !0;
+		let a = yield* y(t, d), o = yield* i.listByRef(e.id);
+		return _(o, t, a, n?.permission ?? "read", Date.now());
+	}), K = (e) => {
+		if (e.visibility === "public") {
+			let n = t.publicUrl?.(e.key);
+			if (n != null) return n;
+		}
+		return w(e.id);
+	};
+	return {
+		uploadTicketScope: () => N.gen(function* () {
+			let i = yield* r.catalogueId, a = yield* t.objectNamespace;
+			return yield* N.try({
+				try: () => n({
+					catalogueId: i,
+					objectNamespace: a,
+					storageInstance: e.storageInstance ?? "@voltro/plugin-storage"
+				}),
+				catch: (e) => h(e, "storage", !1)
+			});
+		}),
+		put: H,
+		get: (e, n) => F(e, n?.tenantId).pipe(N.flatMap((e) => t.get(e.key).pipe(N.retry(T), N.map((t) => ({
+			bytes: t.bytes,
+			ref: e
+		}))))),
+		getStream: (e, n) => F(e, n?.tenantId).pipe(N.flatMap((e) => m(t, e.key).pipe(N.retry(T), N.map((t) => ({
+			ref: e,
+			stream: t.stream
+		}))))),
+		getRange: (e, n, r) => F(e, r?.tenantId).pipe(N.flatMap((e) => {
+			let r = e.size, i = Math.max(0, Math.trunc(n.start));
+			if (r > 0 && i >= r) return N.fail(new c({
+				provider: t.name,
+				message: `range start ${i} past end ${r}`,
+				transient: !1,
+				status: 416
+			}));
+			let a = Math.min(Math.trunc(n.endInclusive), Math.max(0, r - 1));
+			return a < i ? N.fail(new c({
+				provider: t.name,
+				message: `empty range ${i}-${a}`,
+				transient: !1,
+				status: 416
+			})) : (t.getRange ? t.getRange(e.key, i, a).pipe(N.retry(T)) : t.get(e.key).pipe(N.retry(T), N.map((e) => e.bytes.subarray(i, a + 1)))).pipe(N.map((t) => ({
+				bytes: t,
+				ref: e,
+				totalSize: r
+			})));
+		})),
+		getUrl: (e, n) => F(e, n?.tenantId).pipe(N.flatMap((e) => e.visibility === "public" ? N.succeed(K(e)) : t.presigns ? t.getUrl(e.key, n?.expiresInSec ?? p) : N.succeed(w(e.id)))),
+		head: (e, t) => r.getById(e).pipe(N.flatMap((e) => e ? j(e, t?.tenantId).pipe(N.map((e) => e)) : N.succeed(null))),
+		delete: (e, n) => M(e, n?.tenantId, n?.claim).pipe(N.flatMap((a) => a ? N.void : F(e, n?.tenantId).pipe(N.flatMap((n) => i.deleteByRef(e).pipe(N.flatMap(() => r.delete(e)), N.flatMap((e) => e ? r.countByKey(n.bucket, n.key).pipe(N.flatMap((e) => e === 0 ? t.delete(n.key).pipe(N.retry(T)) : N.void), N.flatMap(() => r.releaseUsage(n.tenantId, {
+			bytes: n.size,
+			count: 1
+		}))) : N.void), N.asVoid))))),
+		signedUrl: (n, r) => F(n, r?.tenantId).pipe(N.flatMap((n) => {
+			if (n.visibility === "public") return N.succeed(K(n));
+			let i = r?.expiresInSec ?? p;
+			return t.presigns ? t.getUrl(n.key, i) : N.sync(() => `${w(n.id)}?t=${b(n.id, i, void 0, e.httpPath ?? "/_voltro/storage")}`);
+		})),
+		setVisibility: (e, n, i) => N.gen(function* () {
+			let a = yield* F(e, i?.tenantId);
+			if (a.visibility === n) return a;
+			let o = r.setVisibility;
+			if (o === void 0) return yield* N.fail(new l({
+				reason: "visibility-unsupported",
+				detail: "the ref store cannot change a stored object's visibility"
+			}));
+			if (n === "private" && t.publicUrl?.(a.key) != null) return yield* N.fail(new l({
+				reason: "visibility-unsupported",
+				detail: `objects are served from a public base (${t.name} cdnBaseUrl); a public object cannot be made private there`
+			}));
+			if (n === "private" && t.setObjectPublic !== void 0 && r.countPublicByKey === void 0) return yield* N.fail(new l({
+				reason: "visibility-unsupported",
+				detail: "the ref store cannot tell whether other refs keep these bytes public"
+			}));
+			let s = yield* o(a.id, n);
+			if (s === null) return yield* N.fail(new c({
+				provider: t.name,
+				message: `no ref '${e}'`,
+				transient: !1,
+				status: 404
+			}));
+			let u = a.derivedFrom == null ? yield* r.listByDerivedFrom(a.id) : [];
+			for (let e of u) e.visibility !== n && (yield* o(e.id, n));
+			if (t.setObjectPublic !== void 0) {
+				let e = r.countPublicByKey;
+				for (let r of [a, ...u]) {
+					let i = n === "public" || e !== void 0 && (yield* e(r.bucket, r.key)) > 0;
+					yield* t.setObjectPublic(r.key, i);
+				}
+			}
+			return s;
+		}),
+		mintUrl: (n, i, a) => N.gen(function* () {
+			let o = yield* r.getById(n).pipe(N.flatMap((e) => e ? N.succeed(e) : N.fail(new c({
+				provider: t.name,
+				message: `no ref '${n}'`,
+				transient: !1,
+				status: 404
+			}))));
+			if (o.visibility === "public" && o.derivedFrom == null) return K(o);
+			if (!(yield* G(o, i, a?.password === void 0 ? {} : { password: a.password }))) return yield* N.fail(new s({
+				refId: n,
+				reason: "access denied"
+			}));
+			let l = a?.expiresInSec ?? p;
+			if (t.presigns) return yield* t.getUrl(o.key, l);
+			let u = yield* N.sync(() => b(o.id, l, void 0, e.httpPath ?? "/_voltro/storage"));
+			return `${w(o.id)}?t=${u}`;
+		}),
+		mintUploadUrl: (e) => N.gen(function* () {
+			if (!t.getUploadUrl) return yield* N.fail(new c({
+				provider: t.name,
+				message: `provider '${t.name}' does not support presigned uploads`,
+				transient: !1,
+				status: 400
+			}));
+			let n = E(e.tenantId ?? null, "", yield* D(e.key));
+			return yield* t.getUploadUrl(n, e.expiresInSec ?? p, e.contentType);
+		}),
+		checkAccess: G,
+		grant: (e) => N.gen(function* () {
+			yield* F(e.refId);
+			let t = {
+				id: ne(),
+				refId: e.refId,
+				principalType: e.principalType,
+				principalId: e.principalId,
+				permission: e.permission ?? "read",
+				createdAt: /* @__PURE__ */ new Date(),
+				expiresAt: e.expiresAt ?? null,
+				createdBy: e.createdBy ?? null
+			};
+			return yield* i.insert(t), t;
+		}),
+		listRefs: (e) => N.suspend(() => {
+			let t = Math.min(500, Math.max(1, Math.trunc(e?.limit ?? 50))), n = Math.max(0, Math.trunc(e?.offset ?? 0)), i = {
+				tenantId: e && "tenantId" in e ? e.tenantId : void 0,
+				folder: e?.folder,
+				tags: e?.tags ?? [],
+				ownerId: e?.ownerId,
+				includeDerived: e?.includeDerived ?? !1,
+				limit: t + 1,
+				offset: n
+			};
+			return r.listRefs(i).pipe(N.map((e) => {
+				let r = e.length > t;
+				return {
+					refs: r ? e.slice(0, t) : e,
+					nextOffset: r ? n + t : null
+				};
+			}));
+		}),
+		revoke: (e) => i.delete(e),
+		getGrant: (e) => i.getById(e),
+		listGrants: (e) => i.listByRef(e),
+		usage: (e) => r.usageByTenant(e),
+		sweepOrphans: (e) => N.gen(function* () {
+			let n = e?.limit ?? 1e3, i = e?.dryRun ?? !1, a = yield* r.listRecent(n), o = [];
+			for (let e of a) if ((yield* t.head(e.key)) === null) {
+				if (!i) {
+					if (!(yield* r.delete(e.id))) continue;
+					yield* r.releaseUsage(e.tenantId, {
+						bytes: e.size,
+						count: 1
+					});
+				}
+				o.push(e.id);
+			}
+			return {
+				scanned: a.length,
+				removed: o
+			};
+		}),
+		ingestUrl: (t, n) => S(N.gen(function* () {
+			let r = yield* x(t, e.limits?.maxBytes, e.ingest);
+			return yield* H({
+				bytes: r.bytes,
+				contentType: n?.contentType ?? r.contentType,
+				...n?.tenantId === void 0 ? {} : { tenantId: n.tenantId },
+				...n?.operationId === void 0 ? {} : { operationId: n.operationId },
+				...n?.ownerId === void 0 ? {} : { ownerId: n.ownerId },
+				...n?.visibility === void 0 ? {} : { visibility: n.visibility },
+				...n?.access === void 0 ? {} : { access: n.access },
+				...n?.key === void 0 ? {} : { key: n.key },
+				...n?.folder === void 0 ? {} : { folder: n.folder },
+				...n?.tags === void 0 ? {} : { tags: n.tags },
+				...n?.alt === void 0 ? {} : { alt: n.alt },
+				...n?.caption === void 0 ? {} : { caption: n.caption }
+			});
+		}), n?.abortSignal),
+		mintPresignedUpload: (e) => N.gen(function* () {
+			if (!t.getUploadUrl) return yield* N.fail(new c({
+				provider: t.name,
+				message: `provider '${t.name}' does not support presigned uploads`,
+				transient: !1,
+				status: 400
+			}));
+			let n = e.expiresInSec ?? p, r = `_incoming/${A({
+				kind: "typeid",
+				prefix: "up"
+			}, a)}`, i = E(e.tenantId ?? null, "", r);
+			return {
+				uploadUrl: yield* t.getUploadUrl(i, n, e.contentType),
+				key: i,
+				expiresInSec: n
+			};
+		}),
+		finalizeUpload: (e) => t.get(e.key).pipe(N.retry(T), N.flatMap((t) => H({
+			bytes: t.bytes,
+			contentType: e.contentType,
+			...e.tenantId === void 0 ? {} : { tenantId: e.tenantId },
+			...e.ownerId === void 0 ? {} : { ownerId: e.ownerId },
+			...e.visibility === void 0 ? {} : { visibility: e.visibility },
+			...e.access === void 0 ? {} : { access: e.access },
+			...e.folder === void 0 ? {} : { folder: e.folder },
+			...e.tags === void 0 ? {} : { tags: e.tags },
+			...e.alt === void 0 ? {} : { alt: e.alt },
+			...e.caption === void 0 ? {} : { caption: e.caption }
+		})), N.ensuring(t.delete(e.key).pipe(N.retry(T), N.ignore))),
+		putResumableChunk: (e) => t.put(O(e.tenantId ?? null, e.uploadId, e.index), e.bytes, { contentType: "application/octet-stream" }).pipe(N.retry(T), N.asVoid),
+		resumableStatus: (e) => N.gen(function* () {
+			let n = 0, r = 0;
+			for (; n < 1e6;) {
+				let i = yield* t.head(O(e.tenantId ?? null, e.uploadId, n)).pipe(N.retry(T), N.catch(() => N.succeed(null)));
+				if (i === null) break;
+				r += i.size, n += 1;
+			}
+			return {
+				offset: r,
+				nextIndex: n
+			};
+		}),
+		finalizeResumable: (n) => N.gen(function* () {
+			let r = e.limits?.maxBytes ?? 2 ** 53 - 1;
+			if (!Number.isSafeInteger(r) || r < 0 || !Number.isSafeInteger(n.count) || n.count < 0) return yield* N.fail(new c({
+				provider: t.name,
+				message: "resumable count and limits.maxBytes must be non-negative safe integers",
+				transient: !1,
+				status: 400
+			}));
+			let i = (e) => O(n.tenantId ?? null, n.uploadId, e), a = N.gen(function* () {
+				for (let e = 0; e < n.count; e++) yield* t.delete(i(e)).pipe(N.retry(T), N.ignore);
+			}), o = () => new l({
+				reason: "too-large",
+				detail: `resumable upload exceeds ${r}-byte limit`
+			}), s = yield* N.gen(function* () {
+				let e = 0;
+				for (let a = 0; a < n.count; a++) {
+					let n = yield* t.head(i(a)).pipe(N.retry(T));
+					if (n === null) return yield* N.fail(new c({
+						provider: t.name,
+						message: `no resumable chunk at '${i(a)}'`,
+						transient: !1,
+						status: 404
+					}));
+					if (!Number.isSafeInteger(n.size) || n.size < 0) return yield* N.fail(new c({
+						provider: t.name,
+						message: "resumable chunk metadata has an invalid size",
+						transient: !1
+					}));
+					if (n.size > r - e) return yield* N.fail(o());
+					e += n.size;
+				}
+				let a = /* @__PURE__ */ new Uint8Array(), s = 0;
+				for (let e = 0; e < n.count; e++) {
+					let n = yield* m(t, i(e)).pipe(N.retry(T));
+					yield* L.runForEach(n.stream, (e) => N.gen(function* () {
+						if (e.byteLength > r - s) return yield* N.fail(o());
+						let t = s + e.byteLength;
+						if (t > a.byteLength) {
+							let e = new Uint8Array(Math.min(r, Math.max(65536, a.byteLength * 2, t)));
+							e.set(a.subarray(0, s)), a = e;
+						}
+						a.set(e, s), s = t;
+					}));
+				}
+				return a.subarray(0, s);
+			}).pipe(N.tapError((e) => e._tag === "StorageRejected" ? a : N.void));
+			return yield* H({
+				bytes: s,
+				contentType: n.contentType,
+				...n.tenantId === void 0 ? {} : { tenantId: n.tenantId },
+				...n.ownerId === void 0 ? {} : { ownerId: n.ownerId },
+				...n.visibility === void 0 ? {} : { visibility: n.visibility },
+				...n.access === void 0 ? {} : { access: n.access },
+				...n.folder === void 0 ? {} : { folder: n.folder },
+				...n.tags === void 0 ? {} : { tags: n.tags },
+				...n.alt === void 0 ? {} : { alt: n.alt },
+				...n.caption === void 0 ? {} : { caption: n.caption }
+			}).pipe(N.ensuring(a));
+		}),
+		transcode: (e, t) => F(e, t?.tenantId).pipe(N.flatMap((e) => W(e))),
+		renditions: (e, t) => F(e, t?.tenantId).pipe(N.flatMap(() => r.listByDerivedFrom(e))),
+		beginMultipartUpload: (e) => N.gen(function* () {
+			if (!t.createMultipartUpload || !t.presignUploadPart || !t.completeMultipartUpload) return yield* N.fail(new c({
+				provider: t.name,
+				message: `provider '${t.name}' does not support multipart uploads`,
+				transient: !1,
+				status: 400
+			}));
+			let n = E(e.tenantId ?? null, "", `multipart/${A({
+				kind: "typeid",
+				prefix: "mp"
+			}, a)}`);
+			return {
+				uploadId: (yield* t.createMultipartUpload(n, e.contentType, { public: (e.visibility ?? "private") === "public" })).uploadId,
+				key: n
+			};
+		}),
+		signMultipartPart: (e) => N.suspend(() => t.presignUploadPart ? t.presignUploadPart(e.key, e.uploadId, e.partNumber, e.expiresInSec ?? p) : N.fail(new c({
+			provider: t.name,
+			message: "provider does not support multipart uploads",
+			transient: !1,
+			status: 400
+		}))),
+		completeMultipart: (n) => N.gen(function* () {
+			if (!t.completeMultipartUpload) return yield* N.fail(new c({
+				provider: t.name,
+				message: "provider does not support multipart uploads",
+				transient: !1,
+				status: 400
+			}));
+			let i = yield* t.completeMultipartUpload(n.key, n.uploadId, n.parts), a = yield* t.head(n.key).pipe(N.retry(T)), s = a?.size ?? 0, u = (i.etag ?? a?.etag ?? "").replace(/"/g, ""), d = n.tenantId ?? null, f = {
+				bytes: s,
+				count: 1
+			};
+			if (!(yield* r.consumeUsage(d, f, e.quota)).allowed) return yield* t.delete(n.key).pipe(N.retry(T), N.ignore), yield* N.fail(new l({
+				reason: "quota-exceeded",
+				detail: `multipart upload of ${s} bytes exceeds tenant quota`
+			}));
+			let p = {
+				id: Q(),
+				tenantId: n.tenantId ?? null,
+				ownerId: n.ownerId ?? null,
+				bucket: o,
+				key: n.key,
+				contentType: n.contentType,
+				size: s,
+				checksum: u,
+				visibility: n.visibility ?? "private",
+				accessPolicy: n.access ?? null,
+				passwordHash: null,
+				createdAt: /* @__PURE__ */ new Date(),
+				...n.folder === void 0 ? {} : { folder: n.folder },
+				...n.tags === void 0 ? {} : { tags: n.tags },
+				...n.alt === void 0 ? {} : { alt: n.alt },
+				...n.caption === void 0 ? {} : { caption: n.caption }
+			};
+			return yield* r.insert(p).pipe(N.onExit((e) => P.isSuccess(e) ? N.void : r.releaseUsage(d, f).pipe(N.ignore))), p;
+		}),
+		abortMultipart: (e) => N.suspend(() => t.abortMultipartUpload ? t.abortMultipartUpload(e.key, e.uploadId).pipe(N.retry(T)) : N.void)
+	};
+}, re = (e) => F.succeed(d, $(e));
+//#endregion
+export { $ as buildStorageService, Z as dataStoreGrantStore, J as dataStoreRefStore, Y as memoryGrantStore, U as memoryRefStore, V as refMatchesListQuery, re as storageServiceLayer, G as toRef };