@voltro/plugin-storage 0.84.0 → 0.86.0

package/dist/index.js

@@ -1,2618 +1,42 @@
-import { StorageAccessDenied as e, StorageError as t, StorageRejected as n, StorageScanRejected as r, StorageService as i } from "./types.js";
-import { abortMultipartUploadDescriptor as a, beginMultipartUploadDescriptor as o, beginResumableUploadDescriptor as s, completeMultipartUploadDescriptor as c, finalizeUploadDescriptor as l, ingestUrlDescriptor as u, listGrantsDescriptor as d, listRefsDescriptor as f, mintPresignedUploadDescriptor as p, mintUploadTicketDescriptor as m, mintUploadUrlDescriptor as ee, mintUrlDescriptor as te, revokeDescriptor as h, shareDescriptor as ne, signMultipartPartDescriptor as g, storageRpcClientImports as re, uploadDescriptor as ie } from "./rpc.js";
-import { processIdentity as _ } from "@voltro/protocol/identity";
-import { Chunk as v, Effect as y, Exit as b, Layer as x, Schedule as S, Schema as C, Stream as w } from "effect";
-import { definePlugin as ae, pluginInstanceName as oe } from "@voltro/protocol";
-import { readCookie as se, resolveSessionSecret as ce, verifySession as le } from "@voltro/protocol/session";
-import { and as T, authoredError as ue, bigint as E, bytes as D, causeBranches as de, column as fe, contains as pe, eq as O, extractDbCause as me, generateId as k, id as A, integer as j, isTransientContention as he, json as ge, mixin as _e, neq as ve, or as M, reference as ye, table as N, text as P, timestamp as be, wireSafeCause as xe } from "@voltro/database";
-import { pluginEnv as Se } from "@voltro/env";
-import { createHash as Ce, createHmac as F, randomBytes as we, randomUUID as Te, scryptSync as Ee, timingSafeEqual as I } from "node:crypto";
-import { ssrfReason as L } from "@voltro/runtime";
-import { spawn as R } from "node:child_process";
-import { mkdtemp as De, readFile as Oe, rm as ke, writeFile as Ae } from "node:fs/promises";
-import { tmpdir as je } from "node:os";
-import { join as Me } from "node:path";
-import { statSync as Ne } from "node:fs";
-//#region src/streamBridge.ts
-var Pe = 1 << 20, Fe = (e, n, r = !1) => new t({
-	provider: e,
-	message: n,
-	transient: r
-}), Ie = (e) => {
-	let t = 0;
-	for (let n of e) t += n.byteLength;
-	let n = new Uint8Array(t), r = 0;
-	for (let t of e) n.set(t, r), r += t.byteLength;
-	return n;
-}, Le = (e, t = Pe) => {
-	let n = [];
-	for (let r = 0; r < e.byteLength; r += t) n.push(e.subarray(r, Math.min(r + t, e.byteLength)));
-	return w.fromIterable(n);
-}, Re = (e) => e.pipe(w.runCollect, y.map((e) => Ie(v.toReadonlyArray(e)))), ze = (e, t) => w.suspend(() => w.fromAsyncIterable(t(), (t) => Fe(e, `read stream failed: ${String(t?.message ?? t)}`, !0))).pipe(w.map((e) => e instanceof Uint8Array ? e : new Uint8Array(e))), Be = async (e) => {
-	let { Readable: t } = await import("node:stream");
-	return t.fromWeb(w.toReadableStream(e));
-}, Ve = (e, t) => e.getStream ? e.getStream(t) : e.get(t).pipe(y.map((e) => ({
-	stream: Le(e.bytes),
-	contentType: e.contentType,
-	size: e.bytes.byteLength
-}))), He = (e, t, n, r) => e.putStream ? e.putStream(t, n, r) : Re(n).pipe(y.flatMap((n) => e.put(t, n, {
-	contentType: r.contentType,
-	...r.public === void 0 ? {} : { public: r.public }
-}))), z = "_voltro_storage_refs", B = "_voltro_storage_grants", V = "_voltro_storage_blobs", Ue = "_voltro_storage_usage", We = N(z, {
-	id: A({ prefix: "file" }),
-	tenantId: P().nullable(),
-	ownerId: P().nullable(),
-	bucket: P(),
-	key: P(),
-	contentType: P(),
-	size: E(),
-	checksum: P(),
-	visibility: P(),
-	accessPolicy: ge().nullable(),
-	passwordHash: P().nullable(),
-	width: j().nullable(),
-	height: j().nullable(),
-	duration: j().nullable(),
-	placeholder: P().nullable(),
-	folder: P().nullable(),
-	tags: ge().nullable(),
-	alt: P().nullable(),
-	caption: P().nullable(),
-	derivedFrom: P().nullable(),
-	kind: P().nullable(),
-	createdAt: be()
-}).index(["key"]).index(["tenantId"]).index(["ownerId"]).index(["folder"]).index(["derivedFrom"]), Ge = N(B, {
-	id: A({ prefix: "sgrant" }),
-	refId: P(),
-	principalType: P(),
-	principalId: P(),
-	permission: P(),
-	createdAt: be(),
-	expiresAt: be().nullable(),
-	createdBy: P().nullable()
-}).index(["refId"]).index(["principalId"]), Ke = N(Ue, {
-	id: A({ prefix: "susage" }),
-	tenantId: P().maxLength(191),
-	bytes: E().default("0"),
-	count: E().default("0"),
-	updatedAt: be()
-}).unique("byStorageUsageTenant", ["tenantId"]), qe = N(V, {
-	id: A({ prefix: "blob" }),
-	key: P(),
-	data: D(),
-	contentType: P(),
-	size: E()
-}).index(["key"]), H = Se([
-	{
-		name: "STORAGE_PROVIDER",
-		required: !1,
-		secret: !1,
-		description: "Provider name: 's3' | 'minio' | 'azure' | 'database' | 'filesystem' | 'memory'. Default 'memory'."
-	},
-	{
-		name: "S3_BUCKET",
-		required: !1,
-		secret: !1,
-		description: "S3/MinIO bucket name. Default STORAGE_BUCKET, else \"voltro\"."
-	},
-	{
-		name: "STORAGE_BUCKET",
-		required: !1,
-		secret: !1,
-		description: "Fallback bucket name when S3_BUCKET is unset."
-	},
-	{
-		name: "S3_REGION",
-		required: !1,
-		secret: !1,
-		description: "S3 region. Falls back to AWS_REGION."
-	},
-	{
-		name: "AWS_REGION",
-		required: !1,
-		secret: !1,
-		description: "AWS region fallback for the S3 provider."
-	},
-	{
-		name: "S3_ENDPOINT",
-		required: !1,
-		secret: !1,
-		description: "Custom S3 endpoint URL. Falls back to MINIO_ENDPOINT."
-	},
-	{
-		name: "MINIO_ENDPOINT",
-		required: !1,
-		secret: !1,
-		description: "MinIO endpoint URL fallback for the S3 provider."
-	},
-	{
-		name: "S3_ACCESS_KEY_ID",
-		required: !1,
-		secret: !0,
-		description: "S3 access key id. Falls back to AWS_ACCESS_KEY_ID."
-	},
-	{
-		name: "AWS_ACCESS_KEY_ID",
-		required: !1,
-		secret: !0,
-		description: "AWS access key id fallback for the S3 provider."
-	},
-	{
-		name: "S3_SECRET_ACCESS_KEY",
-		required: !1,
-		secret: !0,
-		description: "S3 secret access key. Falls back to AWS_SECRET_ACCESS_KEY."
-	},
-	{
-		name: "AWS_SECRET_ACCESS_KEY",
-		required: !1,
-		secret: !0,
-		description: "AWS secret access key fallback for the S3 provider."
-	},
-	{
-		name: "S3_FORCE_PATH_STYLE",
-		required: !1,
-		secret: !1,
-		description: "Set to \"1\" to force path-style S3 addressing."
-	},
-	{
-		name: "STORAGE_CDN_URL",
-		required: !1,
-		secret: !1,
-		description: "Public base URL (CDN) served in front of the bucket for public objects."
-	},
-	{
-		name: "VOLTRO_PUBLIC_URL",
-		required: !1,
-		secret: !1,
-		description: "Absolute public base URL of THIS api (scheme://host[:port]) — prepended to the /_voltro/storage/:id serve URL so getUrl/mintUrl/the upload route emit ABSOLUTE URLs. Required when the api is a different origin than the app."
-	},
-	{
-		name: "STORAGE_ALLOWED_ORIGINS",
-		required: !1,
-		secret: !1,
-		description: "Comma-separated origins allowed to read the serve route + POST the upload route cross-origin (CORS). Use '*' for any. Omit for same-origin only."
-	},
-	{
-		name: "AZURE_STORAGE_ACCOUNT",
-		required: !1,
-		secret: !1,
-		description: "Azure storage account name (provider \"azure\")."
-	},
-	{
-		name: "AZURE_STORAGE_KEY",
-		required: !1,
-		secret: !0,
-		description: "Azure account key — needed to mint SAS URLs."
-	},
-	{
-		name: "AZURE_STORAGE_CONNECTION_STRING",
-		required: !1,
-		secret: !0,
-		description: "Azure connection string (carries the account key)."
-	},
-	{
-		name: "AZURE_STORAGE_ENDPOINT",
-		required: !1,
-		secret: !1,
-		description: "Custom Azure blob endpoint (e.g. Azurite)."
-	},
-	{
-		name: "AZURE_STORAGE_CONTAINER",
-		required: !1,
-		secret: !1,
-		description: "Azure blob container name (the \"bucket\")."
-	},
-	{
-		name: "STORAGE_ROOT",
-		required: !1,
-		secret: !1,
-		description: "Filesystem provider root directory. Default \".voltro-storage\"."
-	},
-	{
-		name: "VOLTRO_STORAGE_SECRET",
-		required: !1,
-		secret: !0,
-		description: "HMAC secret for signed grant tokens. Falls back to the session secret."
-	},
-	{
-		name: "VOLTRO_SESSION_COOKIE",
-		required: !1,
-		secret: !1,
-		description: "Session cookie name used to resolve private-object access. Default \"voltro:session\"."
-	},
-	{
-		name: "CLAMAV_HOST",
-		required: !1,
-		secret: !1,
-		description: "clamd host for the optional clamav virus scanner. Default 127.0.0.1."
-	},
-	{
-		name: "CLAMAV_PORT",
-		required: !1,
-		secret: !1,
-		description: "clamd port for the optional clamav virus scanner. Default 3310."
-	}
-]), U = (e, n) => {
-	let r = typeof e == "number" ? e : typeof e == "bigint" || typeof e == "string" && /^\d+$/.test(e) ? Number(e) : NaN;
-	if (!Number.isSafeInteger(r) || r < 0) throw new t({
-		provider: "metadata",
-		message: `Storage ${n} must be a non-negative safe integer at most Number.MAX_SAFE_INTEGER`,
-		transient: !1
-	});
-	return r;
-}, W = (e, t, n) => U(e + t, n), G = (e, n, r = !1) => {
-	let i = de(e).find(C.is(t));
-	if (i !== void 0) return i;
-	let a = me(e), o = a.dbCode === "22003" || a.dbSqlState === "22003" || a.dbCode === "ER_WARN_DATA_OUT_OF_RANGE" || a.dbErrno === 1264 || a.dbNumber === 8115 || a.dbNumber === 248, s = new t({
-		provider: n,
-		message: `${o ? "Storage metadata numeric value out of range: " : ""}${xe(e)}`,
-		transient: o ? !1 : he(e) || r
-	});
-	return Object.defineProperty(s, "cause", {
-		value: e,
-		configurable: !0
-	}), s;
-}, Je = (e) => de(e).find(C.is(n)), K = (e, n, r, i) => new t({
-	provider: e,
-	message: n,
-	transient: r,
-	...i === void 0 ? {} : { status: i }
-}), Ye = (e) => e === void 0 || e === 408 || e === 429 || e >= 500, Xe = /* @__PURE__ */ new Map(), Ze = (e, t) => Xe.get(e)?.get(t)?.bytes, Qe = (e) => {
-	Xe.get(e)?.clear();
-}, $e = (e = "default") => {
-	let t = Xe.get(e) ?? /* @__PURE__ */ new Map();
-	return Xe.set(e, t), {
-		name: "memory",
-		presigns: !1,
-		put: (e, n, r) => y.sync(() => (t.set(e, {
-			bytes: n,
-			contentType: r.contentType
-		}), { size: n.byteLength })),
-		get: (e) => y.suspend(() => {
-			let n = t.get(e);
-			return n ? y.succeed({
-				bytes: n.bytes,
-				contentType: n.contentType
-			}) : y.fail(K("memory", `no object at key '${e}'`, !1, 404));
-		}),
-		delete: (e) => y.sync(() => {
-			t.delete(e);
-		}),
-		publicUrl: () => null,
-		getUrl: () => y.succeed(""),
-		head: (e) => y.sync(() => {
-			let n = t.get(e);
-			return n ? { size: n.bytes.byteLength } : null;
-		})
-	};
-}, et = (e) => {
-	let t = e.root, n = async (e) => {
-		let { join: n, resolve: r, sep: i } = await import("node:path"), a = r(t), o = r(a, e);
-		if (o !== a && !o.startsWith(a + i)) throw Error(`key '${e}' escapes the storage root`);
-		return n(o);
-	}, r = (e, t, n = !1) => y.tryPromise({
-		try: e,
-		catch: (e) => e?.code === "ENOENT" ? K("filesystem", `no object at key '${t}'`, !1, 404) : K("filesystem", String(e?.message ?? e), n)
-	});
-	return {
-		root: t,
-		name: "filesystem",
-		presigns: !1,
-		put: (e, t, i) => r(async () => {
-			let r = await import("node:fs/promises"), { dirname: i } = await import("node:path"), { randomUUID: a } = await import("node:crypto"), o = await n(e), s = i(o);
-			await r.mkdir(s, { recursive: !0 });
-			let c = `${o}.tmp-${a()}`;
-			try {
-				await r.writeFile(c, t), await r.rename(c, o);
-			} catch (e) {
-				throw await r.rm(c, { force: !0 }).catch(() => {}), e;
-			}
-			return { size: t.byteLength };
-		}, e, !0),
-		get: (e) => r(async () => {
-			let t = await (await import("node:fs/promises")).readFile(await n(e));
-			return {
-				bytes: new Uint8Array(t),
-				contentType: "application/octet-stream"
-			};
-		}, e),
-		delete: (e) => r(async () => {
-			await (await import("node:fs/promises")).rm(await n(e), { force: !0 });
-		}, e),
-		publicUrl: () => null,
-		getUrl: () => y.succeed(""),
-		head: (e) => y.tryPromise({
-			try: async () => {
-				let t = await import("node:fs/promises");
-				try {
-					return { size: (await t.stat(await n(e))).size };
-				} catch (e) {
-					if (e?.code === "ENOENT") return null;
-					throw e;
-				}
-			},
-			catch: (e) => K("filesystem", String(e?.message ?? e), !1)
-		}),
-		getStream: (e) => r(async () => {
-			let t = await import("node:fs/promises"), { createReadStream: r } = await import("node:fs"), i = await n(e), a = await t.stat(i);
-			return {
-				stream: ze("filesystem", () => r(i)),
-				contentType: "application/octet-stream",
-				size: a.size
-			};
-		}, e),
-		putStream: (e, t, i) => r(async () => {
-			let r = await import("node:fs/promises"), { dirname: i } = await import("node:path"), { randomUUID: a } = await import("node:crypto"), { createWriteStream: o } = await import("node:fs"), { pipeline: s } = await import("node:stream/promises"), c = await n(e);
-			await r.mkdir(i(c), { recursive: !0 });
-			let l = `${c}.tmp-${a()}`;
-			try {
-				await s(await Be(t), o(l));
-				let e = await r.stat(l);
-				return await r.rename(l, c), { size: e.size };
-			} catch (e) {
-				throw await r.rm(l, { force: !0 }).catch(() => {}), e;
-			}
-		}, e, !0),
-		getRange: (e, t, i) => r(async () => {
-			let { createReadStream: r } = await import("node:fs"), a = await n(e), o = [];
-			return await new Promise((e, n) => {
-				let s = r(a, {
-					start: t,
-					end: i
-				});
-				s.on("data", (e) => o.push(e)), s.on("end", () => e()), s.on("error", n);
-			}), Ie(o);
-		}, e)
-	};
-}, tt = (e) => {
-	let t = e.name ?? "s3", n = e.publicAcl ?? !0, r = null, i = () => r || (r = (async () => {
-		let t, n;
-		try {
-			t = await import("@aws-sdk/client-s3"), n = await import("@aws-sdk/s3-request-presigner");
-		} catch (e) {
-			throw Error("the 's3'/'minio' storage provider requires the '@aws-sdk/client-s3' + '@aws-sdk/s3-request-presigner' optional dependencies. Install them to enable it.", { cause: e });
-		}
-		return {
-			client: new t.S3Client({
-				...e.region ? { region: e.region } : { region: "us-east-1" },
-				...e.endpoint ? { endpoint: e.endpoint } : {},
-				...e.forcePathStyle ? { forcePathStyle: !0 } : {},
-				...e.accessKeyId && e.secretAccessKey ? { credentials: {
-					accessKeyId: e.accessKeyId,
-					secretAccessKey: e.secretAccessKey
-				} } : {}
-			}),
-			cmds: t,
-			presign: n.getSignedUrl
-		};
-	})(), r), a = (e) => y.tryPromise({
-		try: e,
-		catch: (e) => {
-			let n = e?.$metadata?.httpStatusCode;
-			return K(t, String(e?.message ?? e), Ye(n), n);
-		}
-	}), o = async (e) => {
-		let t = e;
-		if (typeof t.transformToByteArray == "function") return t.transformToByteArray();
-		let n = [];
-		for await (let e of t) n.push(e);
-		let r = n.reduce((e, t) => e + t.byteLength, 0), i = new Uint8Array(r), a = 0;
-		for (let e of n) i.set(e, a), a += e.byteLength;
-		return i;
-	};
-	return {
-		name: t,
-		presigns: !0,
-		put: (t, r, o) => a(async () => {
-			let { client: a, cmds: s } = await i();
-			return await a.send(new s.PutObjectCommand({
-				Bucket: e.bucket,
-				Key: t,
-				Body: r,
-				ContentType: o.contentType,
-				...o.public && n ? { ACL: "public-read" } : {}
-			})), { size: r.byteLength };
-		}),
-		get: (t) => a(async () => {
-			let { client: n, cmds: r } = await i(), a = await n.send(new r.GetObjectCommand({
-				Bucket: e.bucket,
-				Key: t
-			}));
-			return {
-				bytes: await o(a.Body),
-				contentType: a.ContentType ?? "application/octet-stream"
-			};
-		}),
-		delete: (t) => a(async () => {
-			let { client: n, cmds: r } = await i();
-			await n.send(new r.DeleteObjectCommand({
-				Bucket: e.bucket,
-				Key: t
-			}));
-		}),
-		publicUrl: (t) => e.cdnBaseUrl ? `${e.cdnBaseUrl.replace(/\/$/, "")}/${t}` : null,
-		...n ? { setObjectPublic: (t, n) => a(async () => {
-			let { client: r, cmds: a } = await i();
-			await r.send(new a.PutObjectAclCommand({
-				Bucket: e.bucket,
-				Key: t,
-				ACL: n ? "public-read" : "private"
-			}));
-		}) } : {},
-		getUrl: (t, n) => a(async () => {
-			let { client: r, cmds: a, presign: o } = await i();
-			return o(r, new a.GetObjectCommand({
-				Bucket: e.bucket,
-				Key: t
-			}), { expiresIn: n });
-		}),
-		getUploadUrl: (t, n, r) => a(async () => {
-			let { client: a, cmds: o, presign: s } = await i();
-			return s(a, new o.PutObjectCommand({
-				Bucket: e.bucket,
-				Key: t,
-				ContentType: r
-			}), { expiresIn: n });
-		}),
-		createMultipartUpload: (t, r, o) => a(async () => {
-			let { client: a, cmds: s } = await i(), c = await a.send(new s.CreateMultipartUploadCommand({
-				Bucket: e.bucket,
-				Key: t,
-				ContentType: r,
-				...o?.public && n ? { ACL: "public-read" } : {}
-			}));
-			if (!c.UploadId) throw Error("s3 createMultipartUpload returned no UploadId");
-			return { uploadId: c.UploadId };
-		}),
-		presignUploadPart: (t, n, r, o) => a(async () => {
-			let { client: a, cmds: s, presign: c } = await i();
-			return c(a, new s.UploadPartCommand({
-				Bucket: e.bucket,
-				Key: t,
-				UploadId: n,
-				PartNumber: r
-			}), { expiresIn: o });
-		}),
-		completeMultipartUpload: (t, n, r) => a(async () => {
-			let { client: a, cmds: o } = await i(), s = await a.send(new o.CompleteMultipartUploadCommand({
-				Bucket: e.bucket,
-				Key: t,
-				UploadId: n,
-				MultipartUpload: { Parts: r.map((e) => ({
-					PartNumber: e.partNumber,
-					ETag: e.etag
-				})) }
-			}));
-			return s.ETag === void 0 ? {} : { etag: s.ETag };
-		}),
-		abortMultipartUpload: (t, n) => a(async () => {
-			let { client: r, cmds: a } = await i();
-			await r.send(new a.AbortMultipartUploadCommand({
-				Bucket: e.bucket,
-				Key: t,
-				UploadId: n
-			}));
-		}),
-		head: (n) => y.tryPromise({
-			try: async () => {
-				let { client: t, cmds: r } = await i();
-				try {
-					let i = await t.send(new r.HeadObjectCommand({
-						Bucket: e.bucket,
-						Key: n
-					}));
-					return {
-						size: i.ContentLength ?? 0,
-						...i.ETag === void 0 ? {} : { etag: i.ETag }
-					};
-				} catch (e) {
-					if (e?.$metadata?.httpStatusCode === 404) return null;
-					throw e;
-				}
-			},
-			catch: (e) => {
-				let n = e?.$metadata?.httpStatusCode;
-				return K(t, String(e?.message ?? e), Ye(n), n);
-			}
-		}),
-		getStream: (n) => a(async () => {
-			let { client: r, cmds: a } = await i(), o = await r.send(new a.GetObjectCommand({
-				Bucket: e.bucket,
-				Key: n
-			})), s = o.Body;
-			return {
-				stream: ze(t, () => s),
-				contentType: o.ContentType ?? "application/octet-stream",
-				...o.ContentLength === void 0 ? {} : { size: o.ContentLength }
-			};
-		}),
-		putStream: (t, r, o) => a(async () => {
-			let { client: a, cmds: s } = await i(), c;
-			try {
-				c = await import("@aws-sdk/lib-storage");
-			} catch (e) {
-				throw Error("s3/minio `putStream` requires the '@aws-sdk/lib-storage' optional dependency (multipart upload). Install it to enable streamed uploads.", { cause: e });
-			}
-			let l = await Be(r);
-			return await new c.Upload({
-				client: a,
-				params: {
-					Bucket: e.bucket,
-					Key: t,
-					Body: l,
-					ContentType: o.contentType,
-					...o.public && n ? { ACL: "public-read" } : {}
-				}
-			}).done(), { size: o.totalSize ?? (await a.send(new s.HeadObjectCommand({
-				Bucket: e.bucket,
-				Key: t
-			}))).ContentLength ?? 0 };
-		}),
-		getRange: (t, n, r) => a(async () => {
-			let { client: a, cmds: s } = await i(), c = await a.send(new s.GetObjectCommand({
-				Bucket: e.bucket,
-				Key: t,
-				Range: `bytes=${n}-${r}`
-			}));
-			return o(c.Body);
-		})
-	};
-}, nt = (e) => e instanceof Uint8Array ? e : typeof e == "string" ? new Uint8Array(Buffer.from(e, "base64")) : new Uint8Array(e), rt = () => {
-	let e = null, t = () => {
-		if (!e) throw ue("the 'database' storage provider isn't bound to a DataStore yet");
-		return e;
-	}, n = (e) => y.tryPromise({
-		try: e,
-		catch: (e) => G(e, "database", !0)
-	}), r = async (e, n) => (await t().query({
-		table: V,
-		predicate: {
-			column: "key",
-			op: "eq",
-			value: e
-		},
-		order: [],
-		take: 1,
-		skip: void 0,
-		projection: n
-	}))[0];
-	return {
-		name: "database",
-		presigns: !1,
-		bindDataStore: (t) => {
-			e = t;
-		},
-		put: (e, i, a) => n(async () => {
-			let n = await r(e);
-			return n ? await t().update(V, String(n.id), {
-				data: i,
-				contentType: a.contentType,
-				size: String(i.byteLength)
-			}) : await t().insert(V, {
-				id: k({
-					kind: "typeid",
-					prefix: "blob"
-				}, V),
-				key: e,
-				data: i,
-				contentType: a.contentType,
-				size: String(i.byteLength)
-			}), { size: i.byteLength };
-		}),
-		get: (e) => y.suspend(() => n(() => r(e)).pipe(y.flatMap((t) => t ? y.succeed({
-			bytes: nt(t.data),
-			contentType: String(t.contentType)
-		}) : y.fail(K("database", `no object at key '${e}'`, !1, 404))))),
-		delete: (e) => n(async () => {
-			let n = await r(e, ["id"]);
-			n && await t().delete(V, String(n.id));
-		}),
-		publicUrl: () => null,
-		getUrl: () => y.succeed(""),
-		head: (e) => n(async () => {
-			let t = await r(e, ["size"]);
-			return t ? { size: U(t.size, "blob size") } : null;
-		})
-	};
-}, it = (e) => {
-	let t = null, n = () => t || (t = (async () => {
-		let t;
-		try {
-			t = await import("@azure/storage-blob");
-		} catch (e) {
-			throw Error("the 'azure' storage provider requires the '@azure/storage-blob' optional dependency. Install it to enable it.", { cause: e });
-		}
-		let n = H.read("AZURE_STORAGE_ACCOUNT", e.accountName), r = H.read("AZURE_STORAGE_KEY", e.accountKey), i = n && r ? new t.StorageSharedKeyCredential(n, r) : null, a = H.read("AZURE_STORAGE_CONNECTION_STRING", e.connectionString);
-		return {
-			container: (a ? t.BlobServiceClient.fromConnectionString(a) : new t.BlobServiceClient(e.endpoint ?? `https://${n}.blob.core.windows.net`, i ?? void 0)).getContainerClient(e.container),
-			sdk: t,
-			cred: i
-		};
-	})(), t), r = (e) => y.tryPromise({
-		try: e,
-		catch: (e) => {
-			let t = e?.statusCode;
-			return K("azure", String(e?.message ?? e), Ye(t), t);
-		}
-	}), i = async (e) => {
-		if (!e) return /* @__PURE__ */ new Uint8Array();
-		let t = [];
-		for await (let n of e) t.push(typeof n == "string" ? new TextEncoder().encode(n) : new Uint8Array(n));
-		let n = t.reduce((e, t) => e + t.byteLength, 0), r = new Uint8Array(n), i = 0;
-		for (let e of t) r.set(e, i), i += e.byteLength;
-		return r;
-	}, a = async (t, r, i) => {
-		let { container: a, sdk: o, cred: s } = await n();
-		if (!s) throw Error("azure SAS requires accountName + accountKey (set them or AZURE_STORAGE_ACCOUNT/AZURE_STORAGE_KEY)");
-		let c = a.getBlockBlobClient(t), l = o.generateBlobSASQueryParameters({
-			containerName: e.container,
-			blobName: t,
-			permissions: o.BlobSASPermissions.parse(r),
-			startsOn: /* @__PURE__ */ new Date(Date.now() - 6e4),
-			expiresOn: new Date(Date.now() + i * 1e3)
-		}, s).toString();
-		return `${c.url}?${l}`;
-	};
-	return {
-		name: "azure",
-		presigns: !0,
-		put: (e, t, i) => r(async () => {
-			let { container: r } = await n();
-			return await r.getBlockBlobClient(e).uploadData(Buffer.from(t), { blobHTTPHeaders: { blobContentType: i.contentType } }), { size: t.byteLength };
-		}),
-		get: (e) => r(async () => {
-			let { container: t } = await n(), r = await t.getBlockBlobClient(e).download();
-			return {
-				bytes: await i(r.readableStreamBody),
-				contentType: r.contentType ?? "application/octet-stream"
-			};
-		}),
-		delete: (e) => r(async () => {
-			let { container: t } = await n();
-			await t.getBlockBlobClient(e).deleteIfExists();
-		}),
-		publicUrl: (t) => e.cdnBaseUrl ? `${e.cdnBaseUrl.replace(/\/$/, "")}/${t}` : null,
-		getUrl: (e, t) => r(() => a(e, "r", t)),
-		getUploadUrl: (e, t, n) => r(() => a(e, "cw", t)),
-		head: (e) => y.tryPromise({
-			try: async () => {
-				let { container: t } = await n();
-				try {
-					let n = await t.getBlockBlobClient(e).getProperties();
-					return {
-						size: n.contentLength ?? 0,
-						...n.etag === void 0 ? {} : { etag: n.etag }
-					};
-				} catch (e) {
-					if (e?.statusCode === 404) return null;
-					throw e;
-				}
-			},
-			catch: (e) => {
-				let t = e?.statusCode;
-				return K("azure", String(e?.message ?? e), Ye(t), t);
-			}
-		}),
-		getStream: (e) => r(async () => {
-			let { container: t } = await n(), r = await t.getBlockBlobClient(e).download();
-			return {
-				stream: ze("azure", () => r.readableStreamBody),
-				contentType: r.contentType ?? "application/octet-stream",
-				...r.contentLength === void 0 ? {} : { size: r.contentLength }
-			};
-		}),
-		putStream: (e, t, i) => r(async () => {
-			let { container: r } = await n(), a = await Be(t);
-			return await r.getBlockBlobClient(e).uploadStream(a, 4194304, 5, { blobHTTPHeaders: { blobContentType: i.contentType } }), { size: i.totalSize ?? (await r.getBlockBlobClient(e).getProperties()).contentLength ?? 0 };
-		}),
-		getRange: (e, t, a) => r(async () => {
-			let { container: r } = await n(), o = await r.getBlockBlobClient(e).download(t, a - t + 1);
-			return i(o.readableStreamBody);
-		})
-	};
-}, at = (e, t, n, r, i, a) => {
-	let o = n / r, s = Math.min(e, Math.round(t * o)), c = Math.min(t, Math.round(s / o)), l = (e, t) => Math.max(0, Math.min(t, e));
-	return {
-		left: l(Math.round(i * e - s / 2), e - s),
-		top: l(Math.round(a * t - c / 2), t - c),
-		width: s,
-		height: c
-	};
-}, ot = {
-	webp: "image/webp",
-	avif: "image/avif",
-	jpeg: "image/jpeg",
-	jpg: "image/jpeg",
-	png: "image/png"
-}, st = (e) => {
-	if (!e) return null;
-	let t = new URLSearchParams(e), n = (e) => {
-		let n = t.get(e);
-		if (n == null) return;
-		let r = Number(n);
-		return Number.isFinite(r) && r > 0 ? Math.floor(r) : void 0;
-	}, r = n("w"), i = n("h"), a = n("q"), o = (t.get("format") ?? t.get("fm") ?? void 0)?.toLowerCase(), s = t.get("fit") ?? void 0, c = (t.get("fp") ?? "").split(",").map(Number), l = c.length === 2 && c.every((e) => Number.isFinite(e) && e >= 0 && e <= 1) ? {
-		x: c[0],
-		y: c[1]
-	} : void 0;
-	return r === void 0 && i === void 0 && !o && a === void 0 ? null : {
-		...r === void 0 ? {} : { w: r },
-		...i === void 0 ? {} : { h: i },
-		...o ? { format: o } : {},
-		...a === void 0 ? {} : { q: a },
-		...s ? { fit: s } : {},
-		...l ? { fp: l } : {}
-	};
-}, ct = (e) => e.startsWith("image/") && !e.includes("svg"), lt, ut = async () => {
-	if (lt !== void 0) return lt;
-	try {
-		let e = await import("sharp");
-		lt = e.default ?? e;
-	} catch {
-		lt = null;
-	}
-	return lt;
-}, dt = async (e, t) => t ? null : ct(e) ? await ut() === null ? "no-sharp" : "failed" : "not-an-image", ft = async (e, t, n) => {
-	if (!ct(t)) return null;
-	let r = await ut();
-	if (!r) return null;
-	try {
-		let i = r(Buffer.from(e), { failOn: "none" }), a = n.fit ?? "cover";
-		if (n.fp !== void 0 && n.w !== void 0 && n.h !== void 0 && a === "cover") {
-			let e = await i.metadata();
-			e.width !== void 0 && e.height !== void 0 && (i = i.extract(at(e.width, e.height, n.w, n.h, n.fp.x, n.fp.y)));
-		}
-		(n.w !== void 0 || n.h !== void 0) && (i = i.resize({
-			...n.w === void 0 ? {} : { width: n.w },
-			...n.h === void 0 ? {} : { height: n.h },
-			fit: n.fit ?? "cover",
-			withoutEnlargement: !0
-		}));
-		let o = n.format && ot[n.format] ? n.format : void 0, s = t;
-		if (o) {
-			let e = o === "jpg" ? "jpeg" : o;
-			i = i.toFormat(e, n.q === void 0 ? {} : { quality: n.q }), s = ot[o];
-		} else n.q !== void 0 && (t === "image/jpeg" || t === "image/webp") && (i = i.toFormat(t === "image/webp" ? "webp" : "jpeg", { quality: n.q }));
-		let c = await i.toBuffer();
-		return {
-			bytes: new Uint8Array(c),
-			contentType: s
-		};
-	} catch {
-		return null;
-	}
-}, pt = 200, mt = /* @__PURE__ */ new Map(), ht = async (e, t, n, r) => {
-	let i = `${e}::${JSON.stringify(r)}`, a = mt.get(i);
-	if (a) return a;
-	let o = await ft(t, n, r);
-	if (o && (mt.set(i, o), mt.size > pt)) {
-		let e = mt.keys().next().value;
-		e !== void 0 && mt.delete(e);
-	}
-	return o;
-}, gt = (e) => {
-	let t = we(16).toString("hex");
-	return `${t}:${Ee(e, t, 32).toString("hex")}`;
-}, _t = (e, t) => {
-	if (!e || !t) return !1;
-	let [n, r] = t.split(":");
-	if (!n || !r) return !1;
-	let i = Buffer.from(r, "hex"), a = Ee(e, n, i.length);
-	return a.length === i.length && I(a, i);
-}, vt = (e) => Array.isArray(e) ? e.filter((e) => typeof e == "string") : [], yt = (e) => vt(e.metadata?.roles), bt = (e) => vt(e.scopes), xt = (e, t) => e.some((e) => t.includes(e)), St = (e) => vt(e.metadata?.groups), Ct = (e) => typeof e == "boolean" ? y.succeed(e) : y.isEffect(e) ? e : y.promise(() => e), wt = (e, t, n = {}) => y.gen(function* () {
-	if (t.id && e.ownerId && t.id === e.ownerId) return !0;
-	let r = e.accessPolicy ?? [];
-	if (r.length === 0) return !1;
-	let i = n.resolveGroups ? yield* y.promise(async () => await n.resolveGroups(t)) : St(t);
-	for (let a of r) if (yield* Tt(a, e, t, i, n)) return !0;
-	return !1;
-}), Tt = (e, t, n, r, i) => y.gen(function* () {
-	let a = !1, o = (e) => (a = !0, e);
-	if (e.owner !== void 0 && e.owner && !o(!!n.id && !!t.ownerId && n.id === t.ownerId) || e.tenant !== void 0 && e.tenant && !o(!!n.tenantId && n.tenantId === t.tenantId) || e.apiKey !== void 0 && e.apiKey && !o(n.type === "apiKey") || e.roles && e.roles.length > 0 && !o(xt(yt(n), e.roles)) || e.groups && e.groups.length > 0 && !o(xt(r, e.groups)) || e.scopes && e.scopes.length > 0 && !o(xt(bt(n), e.scopes)) || e.password !== void 0 && e.password && !o(_t(i.password, t.passwordHash))) return !1;
-	if (e.guard) {
-		let r = i.guards?.[e.guard];
-		if (!o(r ? yield* Ct(r({
-			subject: n,
-			ref: t
-		})) : !1)) return !1;
-	}
-	return a;
-}), Et = (e, t) => {
-	let n = [];
-	e.id && n.push({
-		type: e.type === "apiKey" ? "apiKey" : "user",
-		id: e.id
-	});
-	for (let e of t) n.push({
-		type: "group",
-		id: e
-	});
-	return n;
-}, Dt = (e, t, n, r, i) => {
-	let a = Et(t, n);
-	return e.some((e) => e.expiresAt && e.expiresAt.getTime() < i || r === "write" && e.permission !== "write" ? !1 : a.some((t) => t.type === e.principalType && t.id === e.principalId));
-}, Ot = (e, t) => t.resolveGroups ? y.promise(async () => await t.resolveGroups(e)) : y.succeed(St(e)), q = () => H.read("VOLTRO_STORAGE_SECRET") ?? ce(), J = (e) => (typeof e == "string" ? Buffer.from(e, "utf8") : e).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, ""), Y = (e) => {
-	let t = e.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - e.length % 4) % 4);
-	return Buffer.from(t, "base64");
-}, kt = (e, t, n = q(), r = "/_voltro/storage") => {
-	if (!n) throw Error("signGrant: secret must be a non-empty string");
-	let i = {
-		refId: e,
-		audience: r,
-		exp: Math.floor(Date.now() / 1e3) + Math.floor(t)
-	}, a = J(JSON.stringify(i));
-	return `${a}.${J(F("sha256", n).update(a).digest())}`;
-}, At = (e, t = q()) => {
-	if (!e || !t) return null;
-	let n = e.indexOf(".");
-	if (n <= 0 || n === e.length - 1) return null;
-	let r = e.slice(0, n), i = e.slice(n + 1), a = F("sha256", t).update(r).digest(), o = Y(i);
-	if (o.length !== a.length || !I(o, a)) return null;
-	try {
-		let e = JSON.parse(Y(r).toString("utf8"));
-		return typeof e.audience != "string" || !e.audience || typeof e.refId != "string" || typeof e.exp != "number" || e.exp < Math.floor(Date.now() / 1e3) ? null : e;
-	} catch {
-		return null;
-	}
-}, jt = (e, t, n = q()) => {
-	if (!n) throw Error("signUploadTicket: secret must be a non-empty string");
-	let r = {
-		...e,
-		exp: Math.floor(Date.now() / 1e3) + Math.floor(t)
-	}, i = J(JSON.stringify(r));
-	return `${i}.${J(F("sha256", n).update(`u:${i}`).digest())}`;
-}, Mt = (e, t = q()) => {
-	if (!e || !t) return null;
-	let n = e.indexOf(".");
-	if (n <= 0 || n === e.length - 1) return null;
-	let r = e.slice(0, n), i = e.slice(n + 1), a = F("sha256", t).update(`u:${r}`).digest(), o = Y(i);
-	if (o.length !== a.length || !I(o, a)) return null;
-	try {
-		let e = JSON.parse(Y(r).toString("utf8"));
-		return e.operationId !== void 0 && (typeof e.operationId != "string" || !e.operationId.trim() || e.operationId.length > 200) || typeof e.instance != "string" || !e.instance || typeof e.ct != "string" || typeof e.exp != "number" || e.vis !== "public" && e.vis !== "private" || e.replicaId !== void 0 && (typeof e.replicaId != "string" || !e.replicaId.trim()) || e.exp < Math.floor(Date.now() / 1e3) ? null : e;
-	} catch {
-		return null;
-	}
-}, Nt = (e, t, n = q()) => {
-	if (!n) throw Error("signFinalizeTicket: secret must be a non-empty string");
-	let r = {
-		...e,
-		exp: Math.floor(Date.now() / 1e3) + Math.floor(t)
-	}, i = J(JSON.stringify(r));
-	return `${i}.${J(F("sha256", n).update(`f:${i}`).digest())}`;
-}, Pt = (e, t = q()) => {
-	if (!e || !t) return null;
-	let n = e.indexOf(".");
-	if (n <= 0 || n === e.length - 1) return null;
-	let r = e.slice(0, n), i = e.slice(n + 1), a = F("sha256", t).update(`f:${r}`).digest(), o = Y(i);
-	if (o.length !== a.length || !I(o, a)) return null;
-	try {
-		let e = JSON.parse(Y(r).toString("utf8"));
-		return typeof e.key != "string" || e.key.length === 0 || typeof e.instance != "string" || !e.instance || typeof e.ct != "string" || typeof e.exp != "number" || e.vis !== "public" && e.vis !== "private" || e.exp < Math.floor(Date.now() / 1e3) ? null : e;
-	} catch {
-		return null;
-	}
-}, Ft = (e, t, n = q()) => {
-	if (!n) throw Error("signResumableTicket: secret must be a non-empty string");
-	let r = {
-		...e,
-		exp: Math.floor(Date.now() / 1e3) + Math.floor(t)
-	}, i = J(JSON.stringify(r));
-	return `${i}.${J(F("sha256", n).update(`r:${i}`).digest())}`;
-}, It = (e, t = q()) => {
-	if (!e || !t) return null;
-	let n = e.indexOf(".");
-	if (n <= 0 || n === e.length - 1) return null;
-	let r = e.slice(0, n), i = e.slice(n + 1), a = F("sha256", t).update(`r:${r}`).digest(), o = Y(i);
-	if (o.length !== a.length || !I(o, a)) return null;
-	try {
-		let e = JSON.parse(Y(r).toString("utf8"));
-		return typeof e.id != "string" || e.id.length === 0 || typeof e.size != "number" || e.size < 0 || typeof e.instance != "string" || !e.instance || typeof e.ct != "string" || typeof e.exp != "number" || e.vis !== "public" && e.vis !== "private" || e.exp < Math.floor(Date.now() / 1e3) ? null : e;
-	} catch {
-		return null;
-	}
-}, Lt = (e, t, n = q()) => {
-	if (!n) throw Error("signMultipartTicket: secret must be a non-empty string");
-	let r = {
-		...e,
-		exp: Math.floor(Date.now() / 1e3) + Math.floor(t)
-	}, i = J(JSON.stringify(r));
-	return `${i}.${J(F("sha256", n).update(`m:${i}`).digest())}`;
-}, Rt = (e, t = q()) => {
-	if (!e || !t) return null;
-	let n = e.indexOf(".");
-	if (n <= 0 || n === e.length - 1) return null;
-	let r = e.slice(0, n), i = e.slice(n + 1), a = F("sha256", t).update(`m:${r}`).digest(), o = Y(i);
-	if (o.length !== a.length || !I(o, a)) return null;
-	try {
-		let e = JSON.parse(Y(r).toString("utf8"));
-		return typeof e.key != "string" || e.key.length === 0 || typeof e.uploadId != "string" || e.uploadId.length === 0 || typeof e.instance != "string" || !e.instance || typeof e.ct != "string" || typeof e.exp != "number" || e.vis !== "public" && e.vis !== "private" || e.exp < Math.floor(Date.now() / 1e3) ? null : e;
-	} catch {
-		return null;
-	}
-}, zt = (e, t) => {
-	if (!t || t.length === 0) return !0;
-	let n = e.toLowerCase();
-	return t.some((e) => {
-		let t = e.toLowerCase();
-		return t.endsWith("/*") ? n.startsWith(t.slice(0, -1)) : n === t;
-	});
-}, Bt = [
-	{
-		ct: /^image\/png$/,
-		offset: 0,
-		magic: [
-			137,
-			80,
-			78,
-			71
-		]
-	},
-	{
-		ct: /^image\/jpe?g$/,
-		offset: 0,
-		magic: [
-			255,
-			216,
-			255
-		]
-	},
-	{
-		ct: /^image\/gif$/,
-		offset: 0,
-		magic: [
-			71,
-			73,
-			70,
-			56
-		]
-	},
-	{
-		ct: /^image\/webp$/,
-		offset: 0,
-		magic: [
-			82,
-			73,
-			70,
-			70
-		]
-	},
-	{
-		ct: /^image\/bmp$/,
-		offset: 0,
-		magic: [66, 77]
-	},
-	{
-		ct: /^application\/pdf$/,
-		offset: 0,
-		magic: [
-			37,
-			80,
-			68,
-			70
-		]
-	},
-	{
-		ct: /^application\/zip$/,
-		offset: 0,
-		magic: [
-			80,
-			75,
-			3,
-			4
-		]
-	},
-	{
-		ct: /^application\/gzip$/,
-		offset: 0,
-		magic: [31, 139]
-	}
-], Vt = (e, t) => {
-	let n = t.toLowerCase(), r = Bt.find((e) => e.ct.test(n));
-	return r ? e.length < r.offset + r.magic.length ? !1 : r.magic.every((t, n) => e[r.offset + n] === t) : !0;
-}, Ht = (e, t, n) => n ? n.maxBytes !== void 0 && e.byteLength > n.maxBytes ? {
-	reason: "too-large",
-	detail: `${e.byteLength} bytes exceeds the ${n.maxBytes}-byte limit`
-} : zt(t, n.allowedContentTypes) ? n.sniff && !Vt(e, t) ? {
-	reason: "content-mismatch",
-	detail: `bytes do not match the declared content type '${t}'`
-} : null : {
-	reason: "content-type-not-allowed",
-	detail: `content type '${t}' is not in the allow-list`
-} : null, Ut = async (e, t, n) => {
-	if (!ct(t)) return { bytes: e };
-	let r = await ut();
-	if (!r) return { bytes: e };
-	try {
-		let t = e;
-		if (n?.normalize) {
-			let n = await r(Buffer.from(e), { failOn: "none" }).rotate().toBuffer();
-			t = new Uint8Array(n);
-		}
-		let i = await r(Buffer.from(t), { failOn: "none" }).metadata(), a = await r(Buffer.from(t), { failOn: "none" }).resize({
-			width: 24,
-			height: 24,
-			fit: "inside",
-			withoutEnlargement: !0
-		}).webp({ quality: 40 }).toBuffer().catch(() => null);
-		return {
-			bytes: t,
-			...typeof i.width == "number" ? { width: i.width } : {},
-			...typeof i.height == "number" ? { height: i.height } : {},
-			...a ? { placeholder: `data:image/webp;base64,${a.toString("base64")}` } : {}
-		};
-	} catch {
-		return { bytes: e };
-	}
-}, Wt = 67108864, Gt = (e) => new n({
-	reason: "too-large",
-	detail: `remote body exceeds the ${e}-byte ingest limit`
-}), Kt = (e, t) => new n({
-	reason: "blocked-source",
-	detail: `will not fetch ${e}: ${t}`
-}), qt = (e, r, i = {}) => y.suspend(() => {
-	let a = r ?? Wt;
-	return !Number.isSafeInteger(a) || a < 0 ? y.fail(new t({
-		provider: "ingest",
-		message: "limits.maxBytes must be a non-negative safe integer",
-		transient: !1
-	})) : y.tryPromise({
-		try: async (n) => {
-			let r = e, o;
-			for (let e = 0;; e++) {
-				let t = L(r, { ...i.allowHosts === void 0 ? {} : { allowHosts: i.allowHosts } });
-				if (t !== null) throw Kt(r, t);
-				o = await fetch(r, {
-					signal: n,
-					redirect: "manual"
-				});
-				let a = o.headers.get("location");
-				if (o.status < 300 || o.status >= 400 || a === null) break;
-				if (await o.body?.cancel().catch(() => {}), e >= (i.maxRedirects ?? 5)) throw Kt(r, "too many redirects");
-				r = new URL(a, r).toString();
-			}
-			let s;
-			try {
-				if (!o.ok) throw new t({
-					provider: "ingest",
-					message: `remote server returned HTTP ${o.status}`,
-					transient: o.status === 429 || o.status >= 500,
-					status: o.status
-				});
-				let e = o.headers.get("content-length"), n = o.headers.get("content-encoding")?.trim().toLowerCase();
-				if ((!n || n === "identity") && e !== null && /^\d+$/.test(e) && BigInt(e) > BigInt(a)) throw Gt(a);
-				let r = /* @__PURE__ */ new Uint8Array(), i = 0;
-				if (o.body !== null) for (s = o.body.getReader();;) {
-					let e = await s.read();
-					if (e.done) break;
-					if (e.value.byteLength > a - i) throw Gt(a);
-					if (e.value.byteLength !== 0) {
-						let t = i + e.value.byteLength;
-						if (t > r.byteLength) {
-							let e = Math.min(a, Math.max(65536, r.byteLength * 2, t)), n = new Uint8Array(e);
-							n.set(r), r = n;
-						}
-						r.set(e.value, i), i = t;
-					}
-				}
-				return {
-					bytes: i === r.byteLength ? r : r.slice(0, i),
-					contentType: o.headers.get("content-type")?.split(";")[0]?.trim() || "application/octet-stream"
-				};
-			} finally {
-				s === void 0 ? await o.body?.cancel().catch(() => {}) : (await s.cancel().catch(() => {}), s.releaseLock());
-			}
-		},
-		catch: (e) => e instanceof n || e instanceof t ? e : new t({
-			provider: "ingest",
-			message: "remote fetch or body read failed",
-			transient: !0
-		})
-	});
-}), Jt = (e, t) => y.suspend(() => {
-	if (t === void 0) return e;
-	if (t.aborted) return y.interrupt;
-	let n = y.async((e) => {
-		let n = () => e(y.interrupt);
-		return t.addEventListener("abort", n, { once: !0 }), t.aborted && n(), y.sync(() => t.removeEventListener("abort", n));
-	});
-	return y.raceFirst(e, n);
-}), Yt = (e) => {
-	let r = (e, n) => y.tryPromise({
-		try: n,
-		catch: (n) => {
-			let r = Je(n);
-			if (r !== void 0) return r;
-			let i = G(n, "metadata"), a = new t({
-				provider: "metadata",
-				message: `Storage ${e} was not confirmed: ${i.message}; retain the operation identity for recovery`,
-				transient: i.transient,
-				...i.status === void 0 ? {} : { status: i.status }
-			});
-			return Object.defineProperty(a, "cause", {
-				value: n,
-				configurable: !0
-			}), a;
-		}
-	});
-	return {
-		put: (t) => y.gen(function* () {
-			if (t.bytes.byteLength !== t.ref.size || Ce("sha256").update(t.bytes).digest("hex") !== t.identity.checksum) return yield* y.fail(new n({
-				reason: "operation-content-mismatch",
-				detail: "Storage operation bytes do not match their reserved identity"
-			}));
-			let i = yield* r("put reservation", () => e.metadata.reserve(t.identity, t.ref, t.quota, t.claim)), a = i.outcome;
-			return i.ready ? {
-				ref: i.ref,
-				outcome: a
-			} : (yield* e.provider.put(i.ref.key, t.bytes, {
-				contentType: i.ref.contentType,
-				public: i.ref.visibility === "public"
-			}), {
-				ref: yield* r("put confirmation", () => e.metadata.confirm(t.identity, t.claim)),
-				outcome: a
-			});
-		}),
-		delete: (t, n, i) => y.gen(function* () {
-			let a = yield* r("delete acceptance", () => e.metadata.beginDelete(t, n, i));
-			"operation" in a && (a.operation.deleteKey !== null && (yield* e.provider.delete(a.operation.deleteKey)), yield* r("delete confirmation", () => e.metadata.confirmDelete(a.identity)));
-		})
-	};
-}, Xt = async (e) => {
-	let { createHash: t } = await import("node:crypto");
-	return t("sha256").update(e).digest("hex");
-}, Zt = (e, t, n) => `${e?.replace(/\/+$/, "") ?? ""}${n}/${t}`, Qt = (e) => {
-	let t = /* @__PURE__ */ new Map(), n = {
-		public: 0,
-		private: 0
-	};
-	for (let r of e) {
-		let e = r.tenantId ?? "(global)", i = t.get(e) ?? {
-			count: 0,
-			bytes: 0
-		};
-		i.count = W(i.count, r.count, "ref count"), i.bytes = W(i.bytes, r.bytes, "usage bytes"), t.set(e, i), r.visibility === "public" ? n.public = W(n.public, r.count, "public ref count") : n.private = W(n.private, r.count, "private ref count");
-	}
-	return {
-		byTenant: Object.fromEntries(t),
-		visibility: n
-	};
-}, $t = (e, t) => {
-	if (t.search && ![
-		e.id,
-		e.key,
-		e.contentType,
-		e.ownerId,
-		e.tenantId
-	].some((e) => e?.toLowerCase().includes(t.search.toLowerCase())) || t.tenantId !== void 0 && (e.tenantId ?? null) !== (t.tenantId ?? null) || t.ownerId !== void 0 && e.ownerId !== t.ownerId || !t.includeDerived && e.derivedFrom != null) return !1;
-	if (t.folder !== void 0) {
-		let n = t.folder.replace(/\/+$/, ""), r = (e.folder ?? "").replace(/\/+$/, "");
-		if (r !== n && !r.startsWith(`${n}/`)) return !1;
-	}
-	if (t.tags.length > 0) {
-		let n = e.tags ?? [];
-		if (!t.tags.every((e) => n.includes(e))) return !1;
-	}
-	return !0;
-}, en = (e) => e ?? "global", tn = () => {
-	let e = /* @__PURE__ */ new Map(), t = /* @__PURE__ */ new Map();
-	return {
-		statistics: () => y.try({
-			try: () => Qt((function* () {
-				for (let t of e.values()) yield {
-					tenantId: t.tenantId,
-					visibility: t.visibility,
-					count: 1,
-					bytes: t.size
-				};
-			})()),
-			catch: (e) => G(e, "refstore")
-		}),
-		insert: (t) => y.try({
-			try: () => {
-				U(t.size, "ref size"), e.set(t.id, t);
-			},
-			catch: (e) => G(e, "refstore")
-		}),
-		getById: (t) => y.sync(() => e.get(t) ?? null),
-		delete: (t) => y.sync(() => e.delete(t)),
-		listRecent: (t) => y.sync(() => [...e.values()].sort((e, t) => t.createdAt.getTime() - e.createdAt.getTime() || t.id.localeCompare(e.id)).slice(0, t)),
-		countByKey: (t, n) => y.sync(() => [...e.values()].filter((e) => e.bucket === t && e.key === n).length),
-		countPublicByKey: (t, n) => y.sync(() => [...e.values()].filter((e) => e.bucket === t && e.key === n && e.visibility === "public").length),
-		setVisibility: (t, n) => y.sync(() => {
-			let r = e.get(t);
-			if (r === void 0) return null;
-			let i = {
-				...r,
-				visibility: n
-			};
-			return e.set(t, i), i;
-		}),
-		usageByTenant: (t) => y.try({
-			try: () => {
-				let n = 0, r = 0;
-				for (let i of e.values()) (i.tenantId ?? null) === (t ?? null) && (n = W(n, i.size, "usage bytes"), r++);
-				return {
-					bytes: n,
-					count: r
-				};
-			},
-			catch: (e) => G(e, "refstore")
-		}),
-		consumeUsage: (e, n, r) => y.try({
-			try: () => {
-				let i = en(e), a = t.get(i) ?? {
-					bytes: 0,
-					count: 0
-				};
-				U(n.bytes, "usage byte delta"), U(n.count, "usage count delta");
-				let o = Number.isSafeInteger(a.bytes + n.bytes) && Number.isSafeInteger(a.count + n.count) && (r?.maxBytes === void 0 || a.bytes + n.bytes <= r.maxBytes) && (r?.maxCount === void 0 || a.count + n.count <= r.maxCount);
-				return o && t.set(i, {
-					bytes: a.bytes + n.bytes,
-					count: a.count + n.count
-				}), {
-					allowed: o,
-					bytes: a.bytes,
-					count: a.count
-				};
-			},
-			catch: (e) => G(e, "refstore")
-		}),
-		releaseUsage: (e, n) => y.try({
-			try: () => {
-				let r = en(e), i = t.get(r);
-				U(n.bytes, "usage byte delta"), U(n.count, "usage count delta"), i && t.set(r, {
-					bytes: Math.max(0, i.bytes - n.bytes),
-					count: Math.max(0, i.count - n.count)
-				});
-			},
-			catch: (e) => G(e, "refstore")
-		}),
-		listByDerivedFrom: (t) => y.sync(() => [...e.values()].filter((e) => (e.derivedFrom ?? null) === t)),
-		listRefs: (t) => y.sync(() => [...e.values()].filter((e) => $t(e, t)).sort((e, t) => t.createdAt.getTime() - e.createdAt.getTime() || t.id.localeCompare(e.id)).slice(t.offset, t.offset + t.limit))
-	};
-}, nn = (e) => Array.isArray(e) && e.every((e) => typeof e == "string") ? e : null, X = (e) => ({
-	id: String(e.id),
-	tenantId: e.tenantId ?? null,
-	ownerId: e.ownerId ?? null,
-	bucket: String(e.bucket),
-	key: String(e.key),
-	contentType: String(e.contentType),
-	size: U(e.size, "ref size"),
-	checksum: String(e.checksum),
-	visibility: e.visibility === "public" ? "public" : "private",
-	accessPolicy: e.accessPolicy ?? null,
-	passwordHash: e.passwordHash ?? null,
-	createdAt: e.createdAt instanceof Date ? e.createdAt : new Date(String(e.createdAt)),
-	width: e.width ?? null,
-	height: e.height ?? null,
-	duration: e.duration ?? null,
-	placeholder: e.placeholder ?? null,
-	folder: e.folder ?? null,
-	tags: nn(e.tags),
-	alt: e.alt ?? null,
-	caption: e.caption ?? null,
-	derivedFrom: e.derivedFrom ?? null,
-	kind: e.kind ?? null
-}), Z = (e) => y.tryPromise({
-	try: e,
-	catch: (e) => G(e, "refstore", !0)
-}), rn = async (e, t) => (await e.query({
-	table: "_voltro_storage_usage",
-	predicate: {
-		column: "tenantId",
-		op: "eq",
-		value: t
-	},
-	order: [],
-	take: 1,
-	skip: void 0,
-	projection: void 0
-}))[0] ?? null, an = (e) => ({
-	statistics: () => Z(async () => Qt((await e.query({
-		table: z,
-		predicate: void 0,
-		order: [],
-		take: void 0,
-		skip: void 0,
-		projection: void 0,
-		groupBy: ["tenantId", "visibility"],
-		aggregations: [
-			fe("tenantId"),
-			fe("visibility"),
-			{
-				op: "count",
-				alias: "count"
-			},
-			{
-				op: "sum",
-				column: "size",
-				alias: "bytes"
-			}
-		]
-	})).map((e) => ({
-		tenantId: e.tenantId == null ? null : String(e.tenantId),
-		visibility: String(e.visibility),
-		count: U(e.count, "ref count"),
-		bytes: U(e.bytes ?? 0, "usage bytes")
-	})))),
-	insert: (t) => Z(() => e.insert(z, {
-		...t,
-		size: String(U(t.size, "ref size"))
-	})),
-	getById: (t) => Z(async () => {
-		let n = await e.query({
-			table: z,
-			predicate: {
-				column: "id",
-				op: "eq",
-				value: t
-			},
-			order: [],
-			take: 1,
-			skip: void 0,
-			projection: void 0
-		});
-		return n[0] ? X(n[0]) : null;
-	}),
-	delete: (t) => Z(() => e.delete(z, t)),
-	listRecent: (t) => Z(async () => (await e.query({
-		table: z,
-		predicate: void 0,
-		order: [{
-			column: "createdAt",
-			direction: "desc"
-		}],
-		take: t,
-		skip: void 0,
-		projection: void 0
-	})).map(X)),
-	countByKey: (t, n) => Z(async () => (await e.query({
-		table: z,
-		predicate: { and: [{
-			column: "bucket",
-			op: "eq",
-			value: t
-		}, {
-			column: "key",
-			op: "eq",
-			value: n
-		}] },
-		order: [],
-		take: void 0,
-		skip: void 0,
-		projection: void 0
-	})).length),
-	countPublicByKey: (t, n) => Z(async () => (await e.query({
-		table: z,
-		predicate: { and: [
-			{
-				column: "bucket",
-				op: "eq",
-				value: t
-			},
-			{
-				column: "key",
-				op: "eq",
-				value: n
-			},
-			{
-				column: "visibility",
-				op: "eq",
-				value: "public"
-			}
-		] },
-		order: [],
-		take: void 0,
-		skip: void 0,
-		projection: ["id"]
-	})).length),
-	setVisibility: (t, n) => Z(async () => {
-		let r = await e.update(z, t, { visibility: n });
-		return r ? X(r) : null;
-	}),
-	usageByTenant: (t) => Z(async () => {
-		let n = await e.query({
-			table: z,
-			predicate: {
-				column: "tenantId",
-				op: "eq",
-				value: t
-			},
-			order: [],
-			take: void 0,
-			skip: void 0,
-			projection: void 0
-		}), r = 0;
-		for (let e of n) r = W(r, U(e.size, "ref size"), "usage bytes");
-		return {
-			bytes: r,
-			count: n.length
-		};
-	}),
-	consumeUsage: (t, n, r) => Z(async () => {
-		let i = en(t);
-		U(n.bytes, "usage byte delta"), U(n.count, "usage count delta");
-		for (let t = 0; t < 32; t++) {
-			t > 0 && await new Promise((e) => setTimeout(e, t));
-			let a = await rn(e, i), o = a ? U(a.bytes, "usage bytes") : 0, s = a ? U(a.count, "ref count") : 0;
-			if (!(Number.isSafeInteger(o + n.bytes) && Number.isSafeInteger(s + n.count) && (r?.maxBytes === void 0 || o + n.bytes <= r.maxBytes) && (r?.maxCount === void 0 || s + n.count <= r.maxCount))) return {
-				allowed: !1,
-				bytes: o,
-				count: s
-			};
-			if (a) {
-				if (await e.updateMany("_voltro_storage_usage", {
-					bytes: String(o + n.bytes),
-					count: String(s + n.count),
-					updatedAt: /* @__PURE__ */ new Date()
-				}, { where: T(O("id", String(a.id)), O("bytes", a.bytes), O("count", a.count)) }) === 1) return {
-					allowed: !0,
-					bytes: o,
-					count: s
-				};
-			} else {
-				let t = k({
-					kind: "typeid",
-					prefix: "susage"
-				}, Ue), r = await e.insertIgnore(Ue, {
-					id: t,
-					tenantId: i,
-					bytes: String(n.bytes),
-					count: String(n.count),
-					updatedAt: /* @__PURE__ */ new Date()
-				}, { conflictColumns: ["tenantId"] });
-				if (String(r.id) === t) return {
-					allowed: !0,
-					bytes: 0,
-					count: 0
-				};
-			}
-		}
-		throw ue("Storage quota reservation contended after 32 attempts; retry");
-	}),
-	releaseUsage: (t, n) => Z(async () => {
-		let r = en(t);
-		U(n.bytes, "usage byte delta"), U(n.count, "usage count delta");
-		for (let t = 0; t < 32; t++) {
-			t > 0 && await new Promise((e) => setTimeout(e, t));
-			let i = await rn(e, r);
-			if (!i) return;
-			let a = U(i.bytes, "usage bytes"), o = U(i.count, "ref count");
-			if (await e.updateMany("_voltro_storage_usage", {
-				bytes: String(Math.max(0, a - n.bytes)),
-				count: String(Math.max(0, o - n.count)),
-				updatedAt: /* @__PURE__ */ new Date()
-			}, { where: T(O("id", String(i.id)), O("bytes", i.bytes), O("count", i.count)) }) === 1) return;
-		}
-		throw ue("Storage quota release contended after 32 attempts; retry");
-	}),
-	listByDerivedFrom: (t) => Z(async () => (await e.query({
-		table: z,
-		predicate: {
-			column: "derivedFrom",
-			op: "eq",
-			value: t
-		},
-		order: [{
-			column: "createdAt",
-			direction: "asc"
-		}],
-		take: void 0,
-		skip: void 0,
-		projection: void 0
-	})).map(X)),
-	listRefs: (t) => Z(async () => {
-		let n = [];
-		t.tenantId !== void 0 && n.push(O("tenantId", t.tenantId)), t.ownerId !== void 0 && n.push(O("ownerId", t.ownerId)), t.search && n.push(M(...[
-			"id",
-			"key",
-			"contentType",
-			"ownerId",
-			"tenantId"
-		].map((e) => pe(e, t.search))));
-		let r = t.folder === void 0 && t.tags.length === 0 && t.includeDerived, i = n.length ? T(...n) : void 0, a = await e.query({
-			table: z,
-			predicate: i,
-			order: [{
-				column: "createdAt",
-				direction: "desc"
-			}, {
-				column: "id",
-				direction: "desc"
-			}],
-			take: r ? t.limit : void 0,
-			skip: r ? t.offset : void 0,
-			projection: void 0
-		});
-		return r ? a.map(X) : a.map(X).filter((e) => $t(e, t)).slice(t.offset, t.offset + t.limit);
-	})
-}), on = () => {
-	let e = /* @__PURE__ */ new Map();
-	return {
-		insert: (t) => y.sync(() => {
-			e.set(t.id, t);
-		}),
-		delete: (t) => y.sync(() => {
-			e.delete(t);
-		}),
-		getById: (t) => y.sync(() => e.get(t) ?? null),
-		listByRef: (t) => y.sync(() => [...e.values()].filter((e) => e.refId === t)),
-		deleteByRef: (t) => y.sync(() => {
-			for (let [n, r] of e) r.refId === t && e.delete(n);
-		})
-	};
-}, sn = (e) => ({
-	id: String(e.id),
-	refId: String(e.refId),
-	principalType: e.principalType,
-	principalId: String(e.principalId),
-	permission: e.permission === "write" ? "write" : "read",
-	createdAt: e.createdAt instanceof Date ? e.createdAt : new Date(String(e.createdAt)),
-	expiresAt: e.expiresAt ? e.expiresAt instanceof Date ? e.expiresAt : new Date(String(e.expiresAt)) : null,
-	createdBy: e.createdBy ?? null
-}), cn = (e) => ({
-	insert: (t) => Z(() => e.insert(B, { ...t })),
-	delete: (t) => Z(() => e.delete(B, t)),
-	getById: (t) => Z(async () => {
-		let n = (await e.query({
-			table: B,
-			predicate: {
-				column: "id",
-				op: "eq",
-				value: t
-			},
-			order: [],
-			take: 1,
-			skip: void 0,
-			projection: void 0
-		}))[0];
-		return n ? sn(n) : null;
-	}),
-	listByRef: (t) => Z(async () => (await e.query({
-		table: B,
-		predicate: {
-			column: "refId",
-			op: "eq",
-			value: t
-		},
-		order: [{
-			column: "createdAt",
-			direction: "desc"
-		}],
-		take: void 0,
-		skip: void 0,
-		projection: void 0
-	})).map(sn)),
-	deleteByRef: (t) => Z(async () => {
-		let n = await e.query({
-			table: B,
-			predicate: {
-				column: "refId",
-				op: "eq",
-				value: t
-			},
-			order: [],
-			take: void 0,
-			skip: void 0,
-			projection: void 0
-		});
-		for (let t of n) await e.delete(B, String(t.id));
-	})
-}), ln = () => k({
-	kind: "typeid",
-	prefix: "file"
-}, z), un = () => k({
-	kind: "typeid",
-	prefix: "grant"
-}, B), dn = (i) => {
-	let { provider: a, refStore: o, grantStore: s, bucket: c } = i, l = i.access ?? {}, u = i.attempts ?? 3, d = i.urlExpiresInSec ?? 3600, f = (e) => Zt(i.publicBaseUrl, e, i.httpPath ?? "/_voltro/storage"), p = S.recurs(Math.max(0, u - 1)).pipe(S.intersect(S.exponential("100 millis")), S.whileInput((e) => e.transient)), m = (e, t, n) => [
-		i.tenantPrefix,
-		e ?? "global",
-		n ?? t
-	].filter(Boolean).join("/"), ee = (e) => {
-		if (e === void 0) return y.succeed(void 0);
-		let n = e.length === 0 ? "empty" : e.includes("\0") ? "contains NUL" : e.startsWith("/") || e.startsWith("\\") ? "starts with a path separator" : e.includes("\\") ? "contains a backslash" : e.split("/").some((e) => e === "" || e === "." || e === "..") ? "contains an empty, \".\" or \"..\" segment" : void 0;
-		return n === void 0 ? y.succeed(e) : y.fail(new t({
-			provider: a.name,
-			message: `storage key rejected: ${n}`,
-			transient: !1,
-			status: 400
-		}));
-	}, te = (e, t, n) => [
-		i.tenantPrefix,
-		e ?? "global",
-		"_incoming",
-		t,
-		String(n).padStart(6, "0")
-	].filter(Boolean).join("/"), h = (e, n) => n !== void 0 && e.tenantId !== n ? y.fail(new t({
-		provider: a.name,
-		message: "cross-tenant access denied",
-		transient: !1,
-		status: 403
-	})) : y.succeed(e), ne = (e, n, r) => y.gen(function* () {
-		let o = i.objects?.(), s = (e) => new t({
-			provider: "metadata",
-			message: e,
-			transient: !1,
-			status: 409
-		});
-		if (o === void 0) return r === void 0 ? !1 : yield* y.fail(s(`claim '${r}' cannot be released: no data store is bound, so ref '${e}' holds no claims`));
-		let c = yield* y.tryPromise({
-			try: () => o.intent(e),
-			catch: (e) => new t({
-				provider: "metadata",
-				message: String(e?.message ?? e),
-				transient: !1
-			})
-		});
-		return c === void 0 ? r === void 0 ? !1 : yield* y.fail(s(`claim '${r}' cannot be released: ref '${e}' was not written through an operation and holds no claims`)) : (yield* h(c.ref, n), yield* Yt({
-			metadata: o,
-			provider: {
-				...a,
-				delete: (e) => a.delete(e).pipe(y.retry(p))
-			}
-		}).delete(e, n, r).pipe(y.catchTag("StorageRejected", (e) => y.fail(e.reason === "claim-not-held" ? s(e.detail) : new t({
-			provider: "metadata",
-			message: e.detail,
-			transient: !1
-		})))), !0);
-	}), g = (e, n) => o.getById(e).pipe(y.flatMap((r) => r ? h(r, n) : y.fail(new t({
-		provider: a.name,
-		message: `no ref '${e}'`,
-		transient: !1,
-		status: 404
-	})))), re = (e) => y.suspend(() => {
-		let n = i.scan(e);
-		return y.isEffect(n) ? n : y.tryPromise({
-			try: () => Promise.resolve(n),
-			catch: (e) => new t({
-				provider: "scan",
-				message: String(e?.message ?? e),
-				transient: !0
-			})
-		});
-	}), ie = (e) => y.suspend(() => {
-		let t = e.contentType;
-		if (!i.videoProbe || !(t.startsWith("video/") || t.startsWith("audio/"))) return y.succeed(null);
-		let n;
-		try {
-			n = i.videoProbe(e);
-		} catch {
-			return y.succeed(null);
-		}
-		return y.isEffect(n) ? n.pipe(y.catchAll(() => y.succeed(null))) : y.tryPromise({
-			try: () => Promise.resolve(n),
-			catch: () => null
-		}).pipe(y.catchAll(() => y.succeed(null)));
-	}), _ = (e) => y.gen(function* () {
-		let t = Ht(e.bytes, e.contentType, i.limits);
-		if (t) return yield* y.fail(new n(t));
-		if (e.claim !== void 0 && e.operationId === void 0) return yield* y.fail(new n({
-			reason: "claim-without-operation",
-			detail: "a put with a claim needs an operationId; the claim names this caller's hold on that operation's object"
-		}));
-		if (i.scan) {
-			let t = yield* re({
-				bytes: e.bytes,
-				contentType: e.contentType,
-				...e.key ? { key: e.key } : {}
-			});
-			if (!t.clean) return yield* y.fail(new r({ threat: t.threat ?? "unknown" }));
-		}
-		let s = yield* y.promise(() => Ut(e.bytes, e.contentType, { normalize: i.normalizeImages ?? !1 })), l = s.bytes, u = yield* ie({
-			bytes: l,
-			contentType: e.contentType
-		}), d = s.width ?? u?.width, f = s.height ?? u?.height, te = s.placeholder ?? u?.poster, h = e.duration ?? u?.duration, ne = yield* y.promise(() => Xt(l)), g = e.tenantId ?? null, _ = e.visibility ?? "private", v = m(g, ne, yield* ee(e.key)), S = e.password ? yield* y.sync(() => gt(e.password)) : null, C = {
-			id: ln(),
-			tenantId: g,
-			ownerId: e.ownerId ?? null,
-			bucket: c,
-			key: v,
-			contentType: e.contentType,
-			size: l.byteLength,
-			checksum: ne,
-			visibility: _,
-			accessPolicy: e.access ?? null,
-			passwordHash: S,
-			createdAt: /* @__PURE__ */ new Date(),
-			...d === void 0 ? {} : { width: d },
-			...f === void 0 ? {} : { height: f },
-			...te === void 0 ? {} : { placeholder: te },
-			...h === void 0 ? {} : { duration: h },
-			...e.folder === void 0 ? {} : { folder: e.folder },
-			...e.tags === void 0 ? {} : { tags: e.tags },
-			...e.alt === void 0 ? {} : { alt: e.alt },
-			...e.caption === void 0 ? {} : { caption: e.caption },
-			...e.derivedFrom === void 0 ? {} : { derivedFrom: e.derivedFrom },
-			...e.kind === void 0 ? {} : { kind: e.kind }
-		}, w = i.transcode !== void 0 && i.autoTranscode !== !1, ae = (t) => w && t.derivedFrom == null && (e.contentType.startsWith("video/") || e.contentType.startsWith("audio/")) ? y.forkDaemon(x(t).pipe(y.ignore)) : y.void;
-		if (e.operationId !== void 0) {
-			let t = i.objects?.();
-			if (t === void 0) return yield* y.fail(new n({
-				reason: "operation-store-unbound",
-				detail: "a put with an operationId needs a bound data store; the in-memory ref store cannot hold operation intents"
-			}));
-			let r = {
-				tenantId: g,
-				bucket: c,
-				operationId: e.operationId,
-				checksum: ne,
-				logicalKey: v,
-				fingerprint: yield* y.promise(() => Xt(new TextEncoder().encode(JSON.stringify([
-					ne,
-					e.contentType,
-					_,
-					e.access ?? null,
-					e.key ?? null,
-					e.ownerId ?? null,
-					e.folder ?? null,
-					e.tags ?? null,
-					e.alt ?? null,
-					e.caption ?? null,
-					e.derivedFrom ?? null,
-					e.kind ?? null,
-					h ?? null,
-					e.password !== void 0
-				]))))
-			}, o = yield* Yt({
-				metadata: t,
-				provider: {
-					...a,
-					put: (e, t, n) => a.put(e, t, n).pipe(y.retry(p))
-				}
-			}).put({
-				identity: r,
-				ref: C,
-				bytes: l,
-				...i.quota === void 0 ? {} : { quota: i.quota },
-				...e.claim === void 0 ? {} : { claim: e.claim }
-			});
-			return yield* ae(o.ref), {
-				...o.ref,
-				outcome: o.outcome
-			};
-		}
-		let oe = {
-			bytes: l.byteLength,
-			count: 1
-		}, se = yield* o.consumeUsage(g, oe, i.quota);
-		if (!se.allowed) {
-			let e = i.quota ?? {}, t = e.maxCount !== void 0 && se.count + 1 > e.maxCount ? `tenant object count ${se.count} + 1 exceeds max ${e.maxCount}` : `tenant usage ${se.bytes} + ${l.byteLength} bytes exceeds max ${e.maxBytes}`;
-			return yield* y.fail(new n({
-				reason: "quota-exceeded",
-				detail: t
-			}));
-		}
-		return yield* ((e) => e.pipe(y.onExit((e) => b.isSuccess(e) ? y.void : o.delete(C.id).pipe(y.zipRight(o.releaseUsage(g, oe)), y.ignore))))(o.insert(C).pipe(y.zipRight(a.put(v, l, {
-			contentType: e.contentType,
-			public: _ === "public"
-		}).pipe(y.retry(p))))), yield* ae(C), {
-			...C,
-			outcome: "created"
-		};
-	}), v = (e) => y.suspend(() => {
-		if (!i.transcode) return y.succeed([]);
-		let t;
-		try {
-			t = i.transcode(e);
-		} catch {
-			return y.succeed([]);
-		}
-		return y.isEffect(t) ? t.pipe(y.catchAll(() => y.succeed([]))) : y.tryPromise({
-			try: () => Promise.resolve(t),
-			catch: () => []
-		}).pipe(y.catchAll(() => y.succeed([])));
-	}), x = (e) => y.gen(function* () {
-		if (!i.transcode || e.derivedFrom != null) return [];
-		let t = yield* a.get(e.key).pipe(y.retry(p)), n = yield* v({
-			bytes: t.bytes,
-			contentType: e.contentType,
-			ref: e
-		}), r = [];
-		for (let t of n) {
-			let n = yield* _({
-				bytes: t.bytes,
-				contentType: t.contentType,
-				tenantId: e.tenantId,
-				ownerId: e.ownerId,
-				visibility: e.visibility,
-				derivedFrom: e.id,
-				kind: t.kind,
-				...t.label === void 0 ? {} : { caption: t.label }
-			});
-			r.push(n);
-		}
-		return r;
-	}), C = (e, t, n) => y.gen(function* () {
-		if (e.visibility === "public" || (yield* wt(e, t, {
-			...l,
-			...n?.password === void 0 ? {} : { password: n.password }
-		}))) return !0;
-		let r = yield* Ot(t, l);
-		return Dt(yield* s.listByRef(e.id), t, r, n?.permission ?? "read", Date.now());
-	}), ae = (e) => {
-		if (e.visibility === "public") {
-			let t = a.publicUrl?.(e.key);
-			if (t != null) return t;
-		}
-		return f(e.id);
-	};
-	return {
-		put: _,
-		get: (e, t) => g(e, t?.tenantId).pipe(y.flatMap((e) => a.get(e.key).pipe(y.retry(p), y.map((t) => ({
-			bytes: t.bytes,
-			ref: e
-		}))))),
-		getStream: (e, t) => g(e, t?.tenantId).pipe(y.map((e) => ({
-			ref: e,
-			stream: w.unwrap(y.suspend(() => a.getStream ? a.getStream(e.key).pipe(y.retry(p), y.map((e) => e.stream)) : a.get(e.key).pipe(y.retry(p), y.map((e) => w.make(e.bytes)))))
-		}))),
-		getRange: (e, n, r) => g(e, r?.tenantId).pipe(y.flatMap((e) => {
-			let r = e.size, i = Math.max(0, Math.trunc(n.start));
-			if (r > 0 && i >= r) return y.fail(new t({
-				provider: a.name,
-				message: `range start ${i} past end ${r}`,
-				transient: !1,
-				status: 416
-			}));
-			let o = Math.min(Math.trunc(n.endInclusive), Math.max(0, r - 1));
-			return o < i ? y.fail(new t({
-				provider: a.name,
-				message: `empty range ${i}-${o}`,
-				transient: !1,
-				status: 416
-			})) : (a.getRange ? a.getRange(e.key, i, o).pipe(y.retry(p)) : a.get(e.key).pipe(y.retry(p), y.map((e) => e.bytes.subarray(i, o + 1)))).pipe(y.map((t) => ({
-				bytes: t,
-				ref: e,
-				totalSize: r
-			})));
-		})),
-		getUrl: (e, t) => g(e, t?.tenantId).pipe(y.flatMap((e) => e.visibility === "public" ? y.succeed(ae(e)) : a.presigns ? a.getUrl(e.key, t?.expiresInSec ?? d) : y.succeed(f(e.id)))),
-		head: (e, t) => o.getById(e).pipe(y.flatMap((e) => e ? h(e, t?.tenantId).pipe(y.map((e) => e)) : y.succeed(null))),
-		delete: (e, t) => ne(e, t?.tenantId, t?.claim).pipe(y.flatMap((n) => n ? y.void : g(e, t?.tenantId).pipe(y.flatMap((t) => s.deleteByRef(e).pipe(y.flatMap(() => o.delete(e)), y.flatMap((e) => e ? o.countByKey(t.bucket, t.key).pipe(y.flatMap((e) => e === 0 ? a.delete(t.key).pipe(y.retry(p)) : y.void), y.flatMap(() => o.releaseUsage(t.tenantId, {
-			bytes: t.size,
-			count: 1
-		}))) : y.void), y.asVoid))))),
-		signedUrl: (e, t) => g(e, t?.tenantId).pipe(y.flatMap((e) => {
-			if (e.visibility === "public") return y.succeed(ae(e));
-			let n = t?.expiresInSec ?? d;
-			return a.presigns ? a.getUrl(e.key, n) : y.sync(() => `${f(e.id)}?t=${kt(e.id, n, void 0, i.httpPath ?? "/_voltro/storage")}`);
-		})),
-		setVisibility: (e, r, i) => y.gen(function* () {
-			let s = yield* g(e, i?.tenantId);
-			if (s.visibility === r) return s;
-			let c = o.setVisibility;
-			if (c === void 0) return yield* y.fail(new n({
-				reason: "visibility-unsupported",
-				detail: "the ref store cannot change a stored object's visibility"
-			}));
-			if (r === "private" && a.publicUrl?.(s.key) != null) return yield* y.fail(new n({
-				reason: "visibility-unsupported",
-				detail: `objects are served from a public base (${a.name} cdnBaseUrl); a public object cannot be made private there`
-			}));
-			if (r === "private" && a.setObjectPublic !== void 0 && o.countPublicByKey === void 0) return yield* y.fail(new n({
-				reason: "visibility-unsupported",
-				detail: "the ref store cannot tell whether other refs keep these bytes public"
-			}));
-			let l = yield* c(s.id, r);
-			if (l === null) return yield* y.fail(new t({
-				provider: a.name,
-				message: `no ref '${e}'`,
-				transient: !1,
-				status: 404
-			}));
-			if (a.setObjectPublic !== void 0) {
-				let e = o.countPublicByKey, t = r === "public" || e !== void 0 && (yield* e(s.bucket, s.key)) > 0;
-				yield* a.setObjectPublic(s.key, t);
-			}
-			return l;
-		}),
-		mintUrl: (n, r, s) => y.gen(function* () {
-			let c = yield* o.getById(n).pipe(y.flatMap((e) => e ? y.succeed(e) : y.fail(new t({
-				provider: a.name,
-				message: `no ref '${n}'`,
-				transient: !1,
-				status: 404
-			}))));
-			if (c.visibility === "public") return ae(c);
-			if (!(yield* C(c, r, s?.password === void 0 ? {} : { password: s.password }))) return yield* y.fail(new e({
-				refId: n,
-				reason: "access denied"
-			}));
-			let l = s?.expiresInSec ?? d;
-			if (a.presigns) return yield* a.getUrl(c.key, l);
-			let u = yield* y.sync(() => kt(c.id, l, void 0, i.httpPath ?? "/_voltro/storage"));
-			return `${f(c.id)}?t=${u}`;
-		}),
-		mintUploadUrl: (e) => y.gen(function* () {
-			if (!a.getUploadUrl) return yield* y.fail(new t({
-				provider: a.name,
-				message: `provider '${a.name}' does not support presigned uploads`,
-				transient: !1,
-				status: 400
-			}));
-			let n = m(e.tenantId ?? null, "", yield* ee(e.key));
-			return yield* a.getUploadUrl(n, e.expiresInSec ?? d, e.contentType);
-		}),
-		checkAccess: C,
-		grant: (e) => y.gen(function* () {
-			let t = {
-				id: un(),
-				refId: e.refId,
-				principalType: e.principalType,
-				principalId: e.principalId,
-				permission: e.permission ?? "read",
-				createdAt: /* @__PURE__ */ new Date(),
-				expiresAt: e.expiresAt ?? null,
-				createdBy: e.createdBy ?? null
-			};
-			return yield* s.insert(t), t;
-		}),
-		listRefs: (e) => y.suspend(() => {
-			let t = Math.min(500, Math.max(1, Math.trunc(e?.limit ?? 50))), n = Math.max(0, Math.trunc(e?.offset ?? 0)), r = {
-				tenantId: e && "tenantId" in e ? e.tenantId : void 0,
-				folder: e?.folder,
-				tags: e?.tags ?? [],
-				ownerId: e?.ownerId,
-				includeDerived: e?.includeDerived ?? !1,
-				limit: t + 1,
-				offset: n
-			};
-			return o.listRefs(r).pipe(y.map((e) => {
-				let r = e.length > t;
-				return {
-					refs: r ? e.slice(0, t) : e,
-					nextOffset: r ? n + t : null
-				};
-			}));
-		}),
-		revoke: (e) => s.delete(e),
-		getGrant: (e) => s.getById(e),
-		listGrants: (e) => s.listByRef(e),
-		usage: (e) => o.usageByTenant(e),
-		sweepOrphans: (e) => y.gen(function* () {
-			let t = e?.limit ?? 1e3, n = e?.dryRun ?? !1, r = yield* o.listRecent(t), i = [];
-			for (let e of r) if ((yield* a.head(e.key)) === null) {
-				if (!n) {
-					if (!(yield* o.delete(e.id))) continue;
-					yield* o.releaseUsage(e.tenantId, {
-						bytes: e.size,
-						count: 1
-					});
-				}
-				i.push(e.id);
-			}
-			return {
-				scanned: r.length,
-				removed: i
-			};
-		}),
-		ingestUrl: (e, t) => Jt(y.gen(function* () {
-			let n = yield* qt(e, i.limits?.maxBytes, i.ingest);
-			return yield* _({
-				bytes: n.bytes,
-				contentType: t?.contentType ?? n.contentType,
-				...t?.tenantId === void 0 ? {} : { tenantId: t.tenantId },
-				...t?.operationId === void 0 ? {} : { operationId: t.operationId },
-				...t?.ownerId === void 0 ? {} : { ownerId: t.ownerId },
-				...t?.visibility === void 0 ? {} : { visibility: t.visibility },
-				...t?.access === void 0 ? {} : { access: t.access },
-				...t?.key === void 0 ? {} : { key: t.key },
-				...t?.folder === void 0 ? {} : { folder: t.folder },
-				...t?.tags === void 0 ? {} : { tags: t.tags },
-				...t?.alt === void 0 ? {} : { alt: t.alt },
-				...t?.caption === void 0 ? {} : { caption: t.caption }
-			});
-		}), t?.abortSignal),
-		mintPresignedUpload: (e) => y.gen(function* () {
-			if (!a.getUploadUrl) return yield* y.fail(new t({
-				provider: a.name,
-				message: `provider '${a.name}' does not support presigned uploads`,
-				transient: !1,
-				status: 400
-			}));
-			let n = e.expiresInSec ?? d, r = `_incoming/${k({
-				kind: "typeid",
-				prefix: "up"
-			}, z)}`, i = m(e.tenantId ?? null, "", r);
-			return {
-				uploadUrl: yield* a.getUploadUrl(i, n, e.contentType),
-				key: i,
-				expiresInSec: n
-			};
-		}),
-		finalizeUpload: (e) => a.get(e.key).pipe(y.retry(p), y.flatMap((t) => _({
-			bytes: t.bytes,
-			contentType: e.contentType,
-			...e.tenantId === void 0 ? {} : { tenantId: e.tenantId },
-			...e.ownerId === void 0 ? {} : { ownerId: e.ownerId },
-			...e.visibility === void 0 ? {} : { visibility: e.visibility },
-			...e.folder === void 0 ? {} : { folder: e.folder },
-			...e.tags === void 0 ? {} : { tags: e.tags },
-			...e.alt === void 0 ? {} : { alt: e.alt },
-			...e.caption === void 0 ? {} : { caption: e.caption }
-		})), y.ensuring(a.delete(e.key).pipe(y.retry(p), y.ignore))),
-		putResumableChunk: (e) => a.put(te(e.tenantId ?? null, e.uploadId, e.index), e.bytes, { contentType: "application/octet-stream" }).pipe(y.retry(p), y.asVoid),
-		resumableStatus: (e) => y.gen(function* () {
-			let t = 0, n = 0;
-			for (; t < 1e6;) {
-				let r = yield* a.head(te(e.tenantId ?? null, e.uploadId, t)).pipe(y.retry(p), y.catchAll(() => y.succeed(null)));
-				if (r === null) break;
-				n += r.size, t += 1;
-			}
-			return {
-				offset: n,
-				nextIndex: t
-			};
-		}),
-		finalizeResumable: (e) => y.gen(function* () {
-			let r = i.limits?.maxBytes ?? 2 ** 53 - 1;
-			if (!Number.isSafeInteger(r) || r < 0 || !Number.isSafeInteger(e.count) || e.count < 0) return yield* y.fail(new t({
-				provider: a.name,
-				message: "resumable count and limits.maxBytes must be non-negative safe integers",
-				transient: !1,
-				status: 400
-			}));
-			let o = (t) => te(e.tenantId ?? null, e.uploadId, t), s = y.gen(function* () {
-				for (let t = 0; t < e.count; t++) yield* a.delete(o(t)).pipe(y.retry(p), y.ignore);
-			}), c = () => new n({
-				reason: "too-large",
-				detail: `resumable upload exceeds ${r}-byte limit`
-			}), l = yield* y.gen(function* () {
-				let n = 0;
-				for (let i = 0; i < e.count; i++) {
-					let e = yield* a.head(o(i)).pipe(y.retry(p));
-					if (e === null) return yield* y.fail(new t({
-						provider: a.name,
-						message: `no resumable chunk at '${o(i)}'`,
-						transient: !1,
-						status: 404
-					}));
-					if (!Number.isSafeInteger(e.size) || e.size < 0) return yield* y.fail(new t({
-						provider: a.name,
-						message: "resumable chunk metadata has an invalid size",
-						transient: !1
-					}));
-					if (e.size > r - n) return yield* y.fail(c());
-					n += e.size;
-				}
-				let i = /* @__PURE__ */ new Uint8Array(), s = 0;
-				for (let t = 0; t < e.count; t++) {
-					let e = yield* Ve(a, o(t)).pipe(y.retry(p));
-					yield* w.runForEach(e.stream, (e) => y.gen(function* () {
-						if (e.byteLength > r - s) return yield* y.fail(c());
-						let t = s + e.byteLength;
-						if (t > i.byteLength) {
-							let e = new Uint8Array(Math.min(r, Math.max(65536, i.byteLength * 2, t)));
-							e.set(i.subarray(0, s)), i = e;
-						}
-						i.set(e, s), s = t;
-					}));
-				}
-				return i.subarray(0, s);
-			}).pipe(y.tapError((e) => e._tag === "StorageRejected" ? s : y.void));
-			return yield* _({
-				bytes: l,
-				contentType: e.contentType,
-				...e.tenantId === void 0 ? {} : { tenantId: e.tenantId },
-				...e.ownerId === void 0 ? {} : { ownerId: e.ownerId },
-				...e.visibility === void 0 ? {} : { visibility: e.visibility },
-				...e.folder === void 0 ? {} : { folder: e.folder },
-				...e.tags === void 0 ? {} : { tags: e.tags },
-				...e.alt === void 0 ? {} : { alt: e.alt },
-				...e.caption === void 0 ? {} : { caption: e.caption }
-			}).pipe(y.ensuring(s));
-		}),
-		transcode: (e, t) => g(e, t?.tenantId).pipe(y.flatMap((e) => x(e))),
-		renditions: (e, t) => g(e, t?.tenantId).pipe(y.flatMap(() => o.listByDerivedFrom(e))),
-		beginMultipartUpload: (e) => y.gen(function* () {
-			if (!a.createMultipartUpload || !a.presignUploadPart || !a.completeMultipartUpload) return yield* y.fail(new t({
-				provider: a.name,
-				message: `provider '${a.name}' does not support multipart uploads`,
-				transient: !1,
-				status: 400
-			}));
-			let n = m(e.tenantId ?? null, "", `multipart/${k({
-				kind: "typeid",
-				prefix: "mp"
-			}, z)}`);
-			return {
-				uploadId: (yield* a.createMultipartUpload(n, e.contentType, { public: (e.visibility ?? "private") === "public" })).uploadId,
-				key: n
-			};
-		}),
-		signMultipartPart: (e) => y.suspend(() => a.presignUploadPart ? a.presignUploadPart(e.key, e.uploadId, e.partNumber, e.expiresInSec ?? d) : y.fail(new t({
-			provider: a.name,
-			message: "provider does not support multipart uploads",
-			transient: !1,
-			status: 400
-		}))),
-		completeMultipart: (e) => y.gen(function* () {
-			if (!a.completeMultipartUpload) return yield* y.fail(new t({
-				provider: a.name,
-				message: "provider does not support multipart uploads",
-				transient: !1,
-				status: 400
-			}));
-			let r = yield* a.completeMultipartUpload(e.key, e.uploadId, e.parts), s = yield* a.head(e.key).pipe(y.retry(p)), l = s?.size ?? 0, u = (r.etag ?? s?.etag ?? "").replace(/"/g, ""), d = e.tenantId ?? null, f = {
-				bytes: l,
-				count: 1
-			};
-			if (!(yield* o.consumeUsage(d, f, i.quota)).allowed) return yield* a.delete(e.key).pipe(y.retry(p), y.ignore), yield* y.fail(new n({
-				reason: "quota-exceeded",
-				detail: `multipart upload of ${l} bytes exceeds tenant quota`
-			}));
-			let m = {
-				id: ln(),
-				tenantId: e.tenantId ?? null,
-				ownerId: e.ownerId ?? null,
-				bucket: c,
-				key: e.key,
-				contentType: e.contentType,
-				size: l,
-				checksum: u,
-				visibility: e.visibility ?? "private",
-				accessPolicy: null,
-				passwordHash: null,
-				createdAt: /* @__PURE__ */ new Date(),
-				...e.folder === void 0 ? {} : { folder: e.folder },
-				...e.tags === void 0 ? {} : { tags: e.tags },
-				...e.alt === void 0 ? {} : { alt: e.alt },
-				...e.caption === void 0 ? {} : { caption: e.caption }
-			};
-			return yield* o.insert(m).pipe(y.onExit((e) => b.isSuccess(e) ? y.void : o.releaseUsage(d, f).pipe(y.ignore))), m;
-		}),
-		abortMultipart: (e) => y.suspend(() => a.abortMultipartUpload ? a.abortMultipartUpload(e.key, e.uploadId).pipe(y.retry(p)) : y.void)
-	};
-}, fn = (e) => x.succeed(i, dn(e)), pn = "_voltro_storage_operation_locks", Q = "_voltro_storage_object_heads", mn = "_voltro_storage_operations", hn = "_voltro_storage_object_claims", gn = [
-	N(pn, {
-		id: P().maxLength(64),
-		nonce: P()
-	}).primaryKey(["id"]).nonReactive(),
-	N(Q, {
-		id: P().maxLength(64),
-		generation: P(),
-		key: P(),
-		reservations: E()
-	}).primaryKey(["id"]).nonReactive(),
-	N(mn, {
-		id: P().maxLength(64),
-		objectId: P().maxLength(64),
-		fingerprint: P().maxLength(64),
-		generation: P(),
-		key: P(),
-		refId: P(),
-		state: P(),
-		deleteKey: P().nullable()
-	}).primaryKey(["id"]).nonReactive(),
-	N(hn, {
-		id: P().maxLength(64),
-		operationId: P().maxLength(64),
-		claim: P()
-	}).primaryKey(["id"]).nonReactive()
-], _n = C.Struct({
-	id: C.String,
-	objectId: C.String,
-	fingerprint: C.String,
-	generation: C.String,
-	key: C.String,
-	refId: C.String,
-	state: C.Literal("reserved", "ready", "deleting", "deleted"),
-	deleteKey: C.NullOr(C.String)
-}), vn = C.Struct({
-	id: C.String,
-	generation: C.String,
-	key: C.String,
-	reservations: C.Int.pipe(C.nonNegative())
-}), yn = (e) => C.decodeUnknownSync(vn)({
-	...e,
-	reservations: U(e.reservations, "shared-object reservation count")
-}), bn = (e) => Ce("sha256").update(JSON.stringify(e)).digest("hex"), xn = (e, t) => bn([e, t]), Sn = (e) => {
-	if (!e.bucket || !e.operationId || !e.logicalKey || !/^[a-f0-9]{64}$/.test(e.fingerprint) || !/^[a-f0-9]{64}$/.test(e.checksum)) throw Error("Storage operation requires a bucket, operation identity, key and SHA-256 fingerprint");
-	return {
-		id: bn([
-			e.bucket,
-			e.tenantId,
-			e.operationId
-		]),
-		objectId: bn([
-			e.bucket,
-			e.tenantId,
-			e.logicalKey,
-			e.checksum
-		]),
-		lockId: bn([e.tenantId])
-	};
-}, Cn = async (e, t, n) => {
-	let { lockId: r } = Sn(t);
-	return await e.insertIgnoreWithOutcome(pn, {
-		id: r,
-		nonce: Te()
-	}, { conflictColumns: ["id"] }), e.transactional(async (e) => {
-		if ((await e.query({
-			table: pn,
-			predicate: O("id", r),
-			lock: "update",
-			order: [],
-			take: 1,
-			skip: void 0,
-			projection: void 0
-		})).length !== 1 || await e.update(pn, r, { nonce: Te() }) === null) throw Error("Storage operation lock is unavailable");
-		return n(e);
-	});
-}, $ = async (e, t) => {
-	let r = Sn(t), i = await e.query({
-		table: mn,
-		predicate: O("id", r.id),
-		order: [],
-		take: 1,
-		skip: void 0,
-		projection: void 0
-	});
-	if (!i[0]) return;
-	let a = C.decodeUnknownSync(_n)(i[0]);
-	if (a.fingerprint !== t.fingerprint || a.objectId !== r.objectId) throw new n({
-		reason: "operation-identity-reused",
-		detail: `storage operation '${t.operationId}' was already used with different inputs`
-	});
-	return a;
-}, wn = async (e, t) => {
-	let n = await $(e, t);
-	if (n) return n;
-	let { id: r, objectId: i } = Sn(t), a = await e.query({
-		table: Q,
-		predicate: O("id", i),
-		order: [],
-		take: 1,
-		skip: void 0,
-		projection: void 0
-	}), o = a[0] ? yn(a[0]) : void 0, s = o?.generation ?? Te(), c = o?.key ?? `${t.logicalKey}/g-${s}`;
-	o ? await e.update(Q, i, { reservations: String(W(o.reservations, 1, "shared-object reservation count")) }) : await e.insert(Q, {
-		id: i,
-		generation: s,
-		key: c,
-		reservations: "1"
-	});
-	let l = {
-		id: r,
-		objectId: i,
-		fingerprint: t.fingerprint,
-		generation: s,
-		key: c,
-		refId: `file_${Te()}`,
-		state: "reserved",
-		deleteKey: null
-	};
-	return await e.insert(mn, l), l;
-}, Tn = async (e, t) => {
-	let n = await $(e, t);
-	if (!n) throw Error("Storage operation is missing");
-	if (n.state === "deleting" || n.state === "deleted") throw Error("Deleted storage operation cannot be confirmed by a late put");
-	return await e.update(mn, n.id, { state: "ready" }), {
-		...n,
-		state: "ready"
-	};
-}, En = async (e, t) => {
-	let n = await $(e, t);
-	if (!n) throw Error("Storage operation is missing");
-	if (n.state === "deleting" || n.state === "deleted") return n;
-	if (n.state !== "ready") throw Error("An unconfirmed put cannot be deleted");
-	let r = await e.query({
-		table: Q,
-		predicate: O("id", n.objectId),
-		order: [],
-		take: 1,
-		skip: void 0,
-		projection: void 0
-	}), i = r[0] ? yn(r[0]) : void 0;
-	if (!i || i.generation !== n.generation || i.reservations < 1) throw Error("Storage object generation does not own its reservation");
-	let a = i.reservations === 1 ? i.key : null;
-	return a === null ? await e.update(Q, i.id, { reservations: String(i.reservations - 1) }) : await e.delete(Q, i.id), await e.update(mn, n.id, {
-		state: "deleting",
-		deleteKey: a
-	}), {
-		...n,
-		state: "deleting",
-		deleteKey: a
-	};
-}, Dn = async (e, t) => {
-	let n = await $(e, t);
-	if (!n || n.state !== "deleting" && n.state !== "deleted") throw Error("Storage deletion has not been accepted");
-	return n.state !== "deleted" && (await e.update(mn, n.id, { state: "deleted" }), !0);
-}, On = async (e, t, n) => {
-	if (!n) throw Error("Storage object claim must be a non-empty string");
-	await e.insertIgnoreWithOutcome(hn, {
-		id: xn(t, n),
-		operationId: t,
-		claim: n
-	}, { conflictColumns: ["id"] });
-}, kn = async (e, t, n) => {
-	let r = xn(t, n);
-	return {
-		held: await e.delete(hn, r),
-		others: (await e.query({
-			table: hn,
-			predicate: T(O("operationId", t), ve("claim", n)),
-			order: [],
-			take: 1,
-			skip: void 0,
-			projection: void 0
-		})).length > 0
-	};
-}, An = (e, t) => e.deleteMany(hn, { where: O("operationId", t) }), jn = "_voltro_storage_put_intents", Mn = N(jn, {
-	id: P().maxLength(64),
-	refId: P().maxLength(64),
-	identity: ge(),
-	ref: ge()
-}).primaryKey(["id"]).unique("storagePutRef", ["refId"]).nonReactive(), Nn = C.Struct({
-	tenantId: C.NullOr(C.String),
-	bucket: C.String,
-	operationId: C.String,
-	fingerprint: C.String,
-	checksum: C.String,
-	logicalKey: C.String
-}), Pn = async (e, t) => {
-	let n = await e.query({
-		table: jn,
-		predicate: O("refId", t),
-		order: [],
-		take: 2,
-		skip: void 0,
-		projection: void 0
-	});
-	if (n.length === 0) return;
-	if (n.length !== 1) throw Error("Storage reference has ambiguous operation ownership");
-	let r = n[0], i = C.decodeUnknownSync(Nn)(r.identity);
-	if (typeof r.ref != "object" || r.ref === null || Array.isArray(r.ref)) throw Error("Storage operation reference is unreadable");
-	let a = X(r.ref);
-	if (a.id !== t || a.bucket !== i.bucket || a.tenantId !== i.tenantId || a.checksum !== i.checksum || !Number.isSafeInteger(a.size) || a.size < 0 || !Number.isFinite(a.createdAt.getTime())) throw Error("Storage operation reference does not match its identity");
-	return {
-		identity: i,
-		ref: a
-	};
-}, Fn = (e) => ({
-	intent: (t) => Pn(e, t),
-	reserve: (t, r, i, a) => Cn(e, t, async (e) => {
-		if (r.tenantId !== t.tenantId || r.bucket !== t.bucket || r.checksum !== t.checksum || !Number.isSafeInteger(r.size) || r.size < 0) throw Error("Storage put metadata does not match its identity");
-		let o = await $(e, t);
-		if (o) {
-			if (o.state === "deleting" || o.state === "deleted") throw Error("Storage put identity has already been deleted");
-			let t = await Pn(e, o.refId);
-			if (!t) throw Error("Storage operation lost its put intent");
-			let n = o.state === "ready";
-			return n && a !== void 0 && await On(e, o.id, a), {
-				ref: t.ref,
-				ready: n,
-				outcome: n ? "joined" : "resumed"
-			};
-		}
-		let s = await wn(e, t), c = an(e);
-		if (!(await y.runPromise(c.consumeUsage(t.tenantId, {
-			bytes: r.size,
-			count: 1
-		}, i))).allowed) throw new n({
-			reason: "quota-exceeded",
-			detail: "Storage operation exceeds tenant quota"
-		});
-		let l = X({
-			...r,
-			id: s.refId,
-			key: s.key
-		});
-		return await e.insert(jn, {
-			id: s.id,
-			refId: l.id,
-			identity: t,
-			ref: l
-		}), {
-			ref: l,
-			ready: !1,
-			outcome: "created"
-		};
-	}),
-	confirm: (t, n) => Cn(e, t, async (e) => {
-		let r = await $(e, t);
-		if (!r) throw Error("Storage put operation is missing");
-		let i = await Pn(e, r.refId);
-		if (!i) throw Error("Storage put intent is missing");
-		if (n !== void 0 && await On(e, r.id, n), r.state === "ready") {
-			let n = await y.runPromise(an(e).getById(r.refId));
-			if (!n || n.key !== r.key || n.checksum !== t.checksum) throw Error("Confirmed storage operation lost its reference");
-			return n;
-		}
-		return await Tn(e, t), await y.runPromise(an(e).insert(i.ref)), i.ref;
-	}),
-	beginDelete: async (t, r, i) => {
-		let a = await Pn(e, t);
-		if (!a) throw Error("Storage delete operation is missing");
-		if (r !== void 0 && a.identity.tenantId !== r) throw Error("Storage delete tenant mismatch");
-		return Cn(e, a.identity, async (e) => {
-			let r = await Pn(e, t);
-			if (!r) throw Error("Storage delete intent disappeared");
-			let a = await $(e, r.identity);
-			if (!a) throw Error("Storage delete lost its operation");
-			let o = a.state !== "deleting" && a.state !== "deleted";
-			if (i === void 0) o && await An(e, a.id);
-			else if (o) {
-				let o = await kn(e, a.id, i);
-				if (o.others) return {
-					released: !0,
-					identity: r.identity
-				};
-				if (!o.held) throw new n({
-					reason: "claim-not-held",
-					detail: `claim '${i}' is not held on storage reference '${t}'; a reference put without a claim is deleted as a whole by a delete that names none`
-				});
-			}
-			let s = await En(e, r.identity);
-			if (a.state === "ready") {
-				let n = an(e);
-				if (await y.runPromise(cn(e).deleteByRef(t)), !await y.runPromise(n.delete(t))) throw Error("Storage deletion lost its confirmed reference");
-				await y.runPromise(n.releaseUsage(r.identity.tenantId, {
-					bytes: r.ref.size,
-					count: 1
-				}));
-			}
-			return {
-				released: !0,
-				operation: s,
-				identity: r.identity
-			};
-		});
-	},
-	confirmDelete: (t) => Cn(e, t, (e) => Dn(e, t))
-}), In = (e, t = 65536) => {
-	let n = [Buffer.from("zINSTREAM\0", "utf8")];
-	for (let r = 0; r < e.length; r += t) {
-		let i = e.subarray(r, Math.min(r + t, e.length)), a = Buffer.alloc(4);
-		a.writeUInt32BE(i.length, 0), n.push(a, Buffer.from(i));
-	}
-	let r = Buffer.alloc(4);
-	return r.writeUInt32BE(0, 0), n.push(r), Buffer.concat(n);
-}, Ln = (e) => {
-	let t = e.replace(/\0+$/, "").trim();
-	if (/\bOK$/.test(t)) return { clean: !0 };
-	let n = /:\s*(.+?)\s+FOUND$/.exec(t);
-	if (n) return {
-		clean: !1,
-		threat: n[1] ?? "unknown"
-	};
-	throw Error(`clamav: unexpected response: ${t}`);
-}, Rn = async (e, t) => {
-	let n = await import("node:net"), r = H.read("CLAMAV_HOST", t.host) ?? "127.0.0.1", i = H.read("CLAMAV_PORT"), a = t.port ?? (i ? Number(i) : 3310), o = t.timeoutMs ?? 3e4;
-	return new Promise((i, s) => {
-		let c = n.createConnection({
-			host: r,
-			port: a
-		}), l = "", u = setTimeout(() => {
-			c.destroy(), s(/* @__PURE__ */ Error("clamav scan timed out"));
-		}, o);
-		c.on("error", (e) => {
-			clearTimeout(u), s(e);
-		}), c.on("connect", () => {
-			c.end(In(e, t.chunkSize));
-		}), c.on("data", (e) => {
-			l += e.toString("utf8");
-		}), c.on("close", () => {
-			clearTimeout(u);
-			try {
-				i(Ln(l));
-			} catch (e) {
-				s(e);
-			}
-		});
-	});
-}, zn = (e = {}) => (t) => Rn(t.bytes, e), Bn = (e, t, n) => new Promise((r, i) => {
-	let a = R(e, [...t], { stdio: [
-		"ignore",
-		"ignore",
-		"pipe"
-	] }), o = "", s = setTimeout(() => {
-		a.kill("SIGKILL"), i(/* @__PURE__ */ Error("ffmpeg timed out"));
-	}, n);
-	a.stderr?.on("data", (e) => {
-		o += String(e);
-	}), a.on("error", (e) => {
-		clearTimeout(s), i(e);
-	}), a.on("close", (e) => {
-		clearTimeout(s), e === 0 ? r() : i(/* @__PURE__ */ Error(`ffmpeg exited ${String(e)}: ${o.slice(-400)}`));
-	});
-}), Vn = (e) => async ({ bytes: t }) => {
-	let n = e.ffmpegPath ?? "ffmpeg", r = e.timeoutMs ?? 3e5, i = await De(Me(je(), "voltro-tc-")), a = Me(i, "in"), o = [];
-	try {
-		await Ae(a, t);
-		for (let t of e.renditions) {
-			let e = Me(i, `out.${t.ext}`);
-			try {
-				await Bn(n, [
-					"-y",
-					"-i",
-					a,
-					...t.args,
-					e
-				], r);
-				let i = await Oe(e);
-				o.push({
-					bytes: new Uint8Array(i),
-					contentType: t.contentType,
-					kind: t.kind,
-					...t.label === void 0 ? {} : { label: t.label }
-				}), await ke(e, { force: !0 });
-			} catch {}
-		}
-	} finally {
-		await ke(i, {
-			recursive: !0,
-			force: !0
-		}).catch(() => void 0);
-	}
-	return o;
-};
-//#endregion
-//#region src/assetRef.ts
-function Hn(e = {}) {
-	let t = e.nullable ?? !0, n = e.fk === !1 ? P().externalId() : ye(() => We, { onDelete: e.onDelete ?? "setNull" });
-	return t ? n.nullable() : n;
-}
-var Un = () => _e({
-	id: "@voltro/plugin-storage/withStorage",
-	fields: { asset: Hn() }
-}), Wn = {
-	"image/png": "png",
-	"image/jpeg": "jpg",
-	"image/jpg": "jpg",
-	"image/gif": "gif",
-	"image/webp": "webp",
-	"image/svg+xml": "svg"
-}, Gn = (e) => {
-	let t = /^data:([^;,]+)(;base64)?,(.*)$/s.exec(e);
-	if (!t) throw Error("not a data URI");
-	let n = t[1] || "application/octet-stream", r = !!t[2], i = t[3] ?? "";
-	return {
-		bytes: r ? new Uint8Array(Buffer.from(i, "base64")) : new Uint8Array(Buffer.from(decodeURIComponent(i), "utf8")),
-		contentType: n
-	};
-}, Kn = (e, n) => y.gen(function* () {
-	let r = yield* y.try({
-		try: () => Gn(n.dataUri),
-		catch: (e) => new t({
-			provider: "avatar",
-			message: String(e?.message ?? e),
-			transient: !1,
-			status: 400
-		})
-	}), i = Wn[r.contentType] ?? "bin";
-	return yield* e.put({
-		bytes: r.bytes,
-		contentType: r.contentType,
-		tenantId: n.tenantId,
-		ownerId: n.userId,
-		visibility: "public",
-		key: `avatars/${n.userId}/avatar.${i}`
-	});
-}), qn = (e) => {
-	try {
-		let t = Ne(e), n = Ne("/");
-		return typeof t.dev != "number" || typeof n.dev != "number" ? "unknown" : t.dev === n.dev ? "same-device-as-root" : "separate-mount";
-	} catch {
-		return "unknown";
-	}
-}, Jn = (e) => {
-	if (qn(e) === "same-device-as-root") return `the capture is going to ${e}, which is on the SAME filesystem as \`/\`.\n  A mounted volume would be a separate one. If this process is a container, that means the capture
-  dies with it — which is the exact failure it exists for. On a development machine this is normal
-  and can be ignored.`;
-}, Yn = H.read("VOLTRO_SESSION_COOKIE") ?? "voltro:session", Xn, Zn = (e) => {
-	Xn = e;
-}, Qn = () => Xn ?? er({}), $n = () => Xn === void 0 ? H.read("STORAGE_PROVIDER") === void 0 ? void 0 : er({}) : Xn, er = (e) => {
+import { storageObjectNamespace as e } from "./storageNamespaces.js";
+import { STORAGE_REFERENCE_CATALOGUE_TABLE as t, ensureStorageReferenceCatalogue as n, storageReferenceCatalogueTable as r } from "./referenceCatalogue.js";
+import { STORAGE_BLOBS_TABLE as i, STORAGE_GRANTS_TABLE as a, STORAGE_REFS_TABLE as o, STORAGE_USAGE_TABLE as s, _voltroStorageBlobsTable as c, _voltroStorageGrantsTable as l, _voltroStorageRefsTable as u, _voltroStorageUsageTable as d } from "./table.js";
+import { assignStorageReferenceInstancesInTransaction as f, requireStorageReferenceOwnership as ee } from "./storageReferenceInstances.js";
+import { StorageAccessDenied as te, StorageError as p, StorageRejected as ne, StorageScanRejected as re, StorageService as m } from "./types.js";
+import { storageObjectLifecycleTables as h } from "./objectLifecycle.js";
+import { assignStorageObjectNamespacesInTransaction as g, requireStorageObjectNamespaces as _ } from "./storageObjectNamespaces.js";
+import { bytesToStream as v, collectStream as y, concatBytes as b, fromNodeReadable as x, getObjectStream as S, putObjectStream as ie, toNodeReadable as C } from "./streamBridge.js";
+import { storageEnv as w } from "./env.js";
+import { azureProvider as T, clearStorageBuffer as E, databaseProvider as D, filesystemProvider as O, memoryProvider as k, readStorageBuffer as ae, s3Provider as A } from "./providers.js";
+import { createTransformCache as oe } from "./transformCache.js";
+import { editImage as j, parseTransformParams as se, transformCached as ce, transformFallbackReason as le, transformImage as ue, transformKey as de } from "./transform.js";
+import { hashPassword as M, verifyPassword as fe } from "./access.js";
+import { resolveStorageSecret as pe, signFinalizeTicket as me, signGrant as he, signMultipartTicket as ge, signResumableTicket as _e, signUploadTicket as N, verifyFinalizeTicket as ve, verifyGrant as ye, verifyMultipartTicket as P, verifyResumableTicket as be, verifyUploadTicket as F } from "./grant.js";
+import { checkLimits as I, contentTypeAllowed as L, sniffMatches as R } from "./constraints.js";
+import { fetchIngestBody as z } from "./ingest.js";
+import { buildStorageService as xe, dataStoreGrantStore as Se, dataStoreRefStore as Ce, memoryGrantStore as we, memoryRefStore as B, refMatchesListQuery as V, storageServiceLayer as Te } from "./service.js";
+import { makeStorageObjectMetadata as Ee, storagePutIntentsTable as De } from "./objectMetadata.js";
+import { abortMultipartUploadDescriptor as Oe, beginMultipartUploadDescriptor as ke, beginResumableUploadDescriptor as Ae, completeMultipartUploadDescriptor as je, finalizeUploadDescriptor as Me, ingestUrlDescriptor as Ne, listGrantsDescriptor as Pe, listRefsDescriptor as Fe, mintPresignedUploadDescriptor as Ie, mintUploadTicketDescriptor as Le, mintUploadUrlDescriptor as Re, mintUrlDescriptor as ze, revokeDescriptor as Be, shareDescriptor as Ve, signMultipartPartDescriptor as He, storageRpcClientImports as Ue, uploadDescriptor as We } from "./rpc.js";
+import { clamavScanner as Ge, encodeInstream as Ke, parseClamavResponse as qe } from "./scanners.js";
+import { ffmpegTranscoder as Je } from "./transcodeVideo.js";
+import { assetRef as Ye, withStorage as Xe } from "./assetRef.js";
+import { decodeDataUri as Ze, putAvatar as Qe } from "./avatar.js";
+import { durabilityNotice as $e, pathDurability as et } from "./pathDurability.js";
+import { createHash as tt, randomUUID as H } from "node:crypto";
+import { Effect as U, Schema as W, Stream as nt } from "effect";
+import { processIdentity as rt } from "@voltro/protocol/identity";
+import { StorageAccessPolicySchema as it, definePlugin as at, pluginInstanceName as G } from "@voltro/protocol";
+import { readCookie as ot, resolveSessionSecret as st, verifySession as ct } from "@voltro/protocol/session";
+//#region src/index.ts
+var lt = w.read("VOLTRO_SESSION_COOKIE") ?? "voltro:session", K, ut = (e) => {
+	K = e;
+}, dt = () => K ?? q({}), ft = () => K === void 0 ? w.read("STORAGE_PROVIDER") === void 0 ? void 0 : q({}) : K, q = (e) => {
 	if (e.provider && typeof e.provider == "object") return e.provider;
-	let t = (e.provider ?? H.read("STORAGE_PROVIDER") ?? "memory").toLowerCase(), n = H.read("S3_BUCKET", e.bucket) ?? H.read("STORAGE_BUCKET") ?? "voltro";
+	let t = (e.provider ?? w.read("STORAGE_PROVIDER") ?? "memory").toLowerCase(), n = w.read("S3_BUCKET", e.bucket) ?? w.read("STORAGE_BUCKET") ?? "voltro";
 	switch (t) {
 		case "s3":
 		case "minio": {
-			let r = H.read("S3_REGION", e.region) ?? H.read("AWS_REGION"), i = H.read("S3_ENDPOINT", e.endpoint) ?? H.read("MINIO_ENDPOINT"), a = H.read("S3_ACCESS_KEY_ID", e.accessKeyId) ?? H.read("AWS_ACCESS_KEY_ID"), o = H.read("S3_SECRET_ACCESS_KEY", e.secretAccessKey) ?? H.read("AWS_SECRET_ACCESS_KEY"), s = H.read("STORAGE_CDN_URL", e.cdnBaseUrl);
-			return tt({
+			let r = w.read("S3_REGION", e.region) ?? w.read("AWS_REGION"), i = w.read("S3_ENDPOINT", e.endpoint) ?? w.read("MINIO_ENDPOINT"), a = w.read("S3_ACCESS_KEY_ID", e.accessKeyId) ?? w.read("AWS_ACCESS_KEY_ID"), o = w.read("S3_SECRET_ACCESS_KEY", e.secretAccessKey) ?? w.read("AWS_SECRET_ACCESS_KEY"), s = w.read("STORAGE_CDN_URL", e.cdnBaseUrl), c = {
 				bucket: n,
 				name: t,
 				...r ? { region: r } : {},
@@ -2621,25 +45,26 @@ var Un = () => _e({
 				...o ? { secretAccessKey: o } : {},
 				...s ? { cdnBaseUrl: s } : {},
 				...e.publicAcl === void 0 ? {} : { publicAcl: e.publicAcl },
-				...t === "minio" || H.read("S3_FORCE_PATH_STYLE") === "1" ? { forcePathStyle: !0 } : {}
-			});
+				...t === "minio" || w.read("S3_FORCE_PATH_STYLE") === "1" ? { forcePathStyle: !0 } : {}
+			};
+			return A(c);
 		}
 		case "azure": {
-			let t = H.read("AZURE_STORAGE_ACCOUNT", e.accountName), r = H.read("AZURE_STORAGE_KEY", e.accountKey), i = H.read("AZURE_STORAGE_CONNECTION_STRING", e.connectionString), a = H.read("AZURE_STORAGE_ENDPOINT", e.endpoint), o = H.read("STORAGE_CDN_URL", e.cdnBaseUrl);
-			return it({
-				container: H.read("AZURE_STORAGE_CONTAINER", e.bucket) ?? n,
+			let t = w.read("AZURE_STORAGE_ACCOUNT", e.accountName), r = w.read("AZURE_STORAGE_KEY", e.accountKey), i = w.read("AZURE_STORAGE_CONNECTION_STRING", e.connectionString), a = w.read("AZURE_STORAGE_ENDPOINT", e.endpoint), o = w.read("STORAGE_CDN_URL", e.cdnBaseUrl), s = {
+				container: w.read("AZURE_STORAGE_CONTAINER", e.bucket) ?? n,
 				...t ? { accountName: t } : {},
 				...r ? { accountKey: r } : {},
 				...i ? { connectionString: i } : {},
 				...a ? { endpoint: a } : {},
 				...o ? { cdnBaseUrl: o } : {}
-			});
+			};
+			return T(s);
 		}
-		case "database": return rt();
-		case "filesystem": return et({ root: H.read("STORAGE_ROOT", e.root) ?? ".voltro-storage" });
-		default: return $e(e.name ?? "default");
+		case "database": return D();
+		case "filesystem": return O({ root: w.read("STORAGE_ROOT", e.root) ?? ".voltro-storage" });
+		default: return k(e.name ?? "default");
 	}
-}, tr = (e) => {
+}, pt = (e) => {
 	let t = "stored files (uploads, renditions) and their reads", n = "provider 'database' or 'filesystem' keeps the bytes inside the installation";
 	if (e.provider && typeof e.provider == "object") return [{
 		destination: `runtime:the '${e.provider.name}' storage provider`,
@@ -2647,9 +72,9 @@ var Un = () => _e({
 		data: ["files"],
 		disable: n
 	}];
-	let r = (e.provider ?? H.read("STORAGE_PROVIDER") ?? "memory").toLowerCase();
+	let r = (e.provider ?? w.read("STORAGE_PROVIDER") ?? "memory").toLowerCase();
 	if (r === "s3" || r === "minio") {
-		let r = H.read("S3_ENDPOINT", e.endpoint) ?? H.read("MINIO_ENDPOINT"), i = H.read("S3_REGION", e.region) ?? H.read("AWS_REGION") ?? "us-east-1";
+		let r = w.read("S3_ENDPOINT", e.endpoint) ?? w.read("MINIO_ENDPOINT"), i = w.read("S3_REGION", e.region) ?? w.read("AWS_REGION") ?? "us-east-1";
 		return [{
 			destination: r ?? `s3.${i}.amazonaws.com`,
 			purpose: t,
@@ -2658,7 +83,7 @@ var Un = () => _e({
 		}];
 	}
 	if (r === "azure") {
-		let r = H.read("AZURE_STORAGE_ENDPOINT", e.endpoint), i = H.read("AZURE_STORAGE_ACCOUNT", e.accountName);
+		let r = w.read("AZURE_STORAGE_ENDPOINT", e.endpoint), i = w.read("AZURE_STORAGE_ACCOUNT", e.accountName);
 		return [{
 			destination: r ?? (i === void 0 ? "runtime:the Azure storage connection string" : `${i}.blob.core.windows.net`),
 			purpose: t,
@@ -2667,11 +92,11 @@ var Un = () => _e({
 		}];
 	}
 	return [];
-}, nr = (e) => {
+}, mt = (e) => {
 	if (e !== void 0) return e;
-	let t = H.read("STORAGE_ALLOWED_ORIGINS");
+	let t = w.read("STORAGE_ALLOWED_ORIGINS");
 	return t ? t.trim() === "*" ? "*" : t.split(",").map((e) => e.trim()).filter(Boolean) : [];
-}, rr = (e, t) => {
+}, J = (e, t) => {
 	if (!e || t !== "*" && !t.includes(e)) return {};
 	let n = {
 		"access-control-allow-origin": t === "*" ? "*" : e,
@@ -2681,7 +106,7 @@ var Un = () => _e({
 		vary: "Origin"
 	};
 	return t !== "*" && (n["access-control-allow-credentials"] = "true"), n;
-}, ir = (e) => ({
+}, ht = (e) => ({
 	id: e.id,
 	tenantId: e.tenantId,
 	ownerId: e.ownerId,
@@ -2704,29 +129,29 @@ var Un = () => _e({
 	caption: e.caption ?? null,
 	derivedFrom: e.derivedFrom ?? null,
 	kind: e.kind ?? null
-}), ar = () => new t({
+}), Y = () => new p({
 	provider: "storage",
 	message: "not permitted to administer sharing for this object",
 	transient: !1,
 	status: 403
-}), or = (e, t, n) => {
+}), X = (e, t, n) => {
 	let r = n.request.subject;
-	return (r.scopes ?? []).includes("admin:full") ? y.void : e.head(t, { tenantId: r.tenantId ?? null }).pipe(y.catchAll(() => y.fail(ar())), y.flatMap((e) => {
+	return (r.scopes ?? []).includes("admin:full") ? U.void : e.head(t, { tenantId: r.tenantId ?? null }).pipe(U.catch(() => U.fail(Y())), U.flatMap((e) => {
 		let t = e?.ownerId;
-		return t != null && t === r.id ? y.void : y.fail(ar());
+		return t != null && t === r.id ? U.void : U.fail(Y());
 	}));
-}, sr = () => new t({
+}, gt = () => new p({
 	provider: "storage",
 	message: "an upload needs an identified caller: this request carries no subject, and the app has not set `anonymousUploads: true` on storagePlugin. The ticket attributes the object to whoever minted it — with no subject there is nobody to attribute it to, so the finalized object would carry no owner and no tenant and no later owner check, tenant filter or quota could reach it.",
 	transient: !1,
 	status: 401
-}), cr = (e, t) => {
+}), Z = (e, t) => {
 	let n = e.request.subject.id ?? null, r = e.request.subject.tenantId ?? null;
-	return n === null && !t ? y.fail(sr()) : y.succeed({
+	return n === null && !t ? U.fail(gt()) : U.succeed({
 		id: n,
 		tenantId: r
 	});
-}, lr = (e, t) => e !== null && e !== (t ?? null), ur = (e) => ({
+}, _t = (e, t) => e !== null && e !== (t ?? null), Q = (e) => ({
 	id: e.id,
 	refId: e.refId,
 	principalType: e.principalType,
@@ -2735,62 +160,111 @@ var Un = () => _e({
 	createdAt: e.createdAt.toISOString(),
 	expiresAt: e.expiresAt ? e.expiresAt.toISOString() : null,
 	createdBy: e.createdBy
-}), dr = "@voltro/plugin-storage", fr = (e = {}) => oe({
-	base: dr,
+}), $ = "@voltro/plugin-storage", vt = (e = {}) => G({
+	base: $,
 	alias: e.alias,
 	instance: e.name
-}), pr = (i = {}) => {
-	let v = oe({
-		base: dr,
-		alias: i.alias,
-		instance: i.name
-	}), b = v === dr ? "/_voltro/storage" : `/_voltro/storage/i/${Buffer.from(v).toString("hex")}`, x = er(i);
-	Zn(x);
-	let S = H.read("S3_BUCKET", i.bucket) ?? H.read("STORAGE_BUCKET") ?? "voltro", T = H.read("VOLTRO_PUBLIC_URL", i.publicBaseUrl), ue = nr(i.allowedOrigins), E = i.limits?.maxBytes, D = i.anonymousUploads === !0, de = 5242880, fe = 21600, pe = i.refStore === void 0 || i.refStore === "memory", O = i.grantStore === void 0 || i.grantStore === "memory", me = (e) => e !== "public" && i.uploadAccess !== void 0 ? { access: i.uploadAccess } : {}, k = { current: pe ? tn() : i.refStore }, A = { current: O ? on() : i.grantStore }, j = { current: void 0 }, he = {
-		insert: (e) => k.current.insert(e),
-		getById: (e) => k.current.getById(e),
-		delete: (e) => k.current.delete(e),
-		statistics: () => k.current.statistics(),
-		listRecent: (e) => k.current.listRecent(e),
-		countByKey: (e, t) => k.current.countByKey(e, t),
-		usageByTenant: (e) => k.current.usageByTenant(e),
-		consumeUsage: (e, t, n) => k.current.consumeUsage(e, t, n),
-		releaseUsage: (e, t) => k.current.releaseUsage(e, t),
-		listByDerivedFrom: (e) => k.current.listByDerivedFrom(e),
-		listRefs: (e) => k.current.listRefs(e),
+}), yt = (e) => e.reason === "too-large" ? 413 : e.reason === "operation-identity-reused" || e.reason === "operation-store-unbound" || e.reason === "claim-not-held" ? 409 : 415, bt = (e = {}) => {
+	let t = G({
+		base: $,
+		alias: e.alias,
+		instance: e.name
+	}), r = t === $ ? "/_voltro/storage" : `/_voltro/storage/i/${Buffer.from(t).toString("hex")}`, i = q(e);
+	ut(i);
+	let a = w.read("S3_BUCKET", e.bucket) ?? w.read("STORAGE_BUCKET") ?? "voltro", o = w.read("VOLTRO_PUBLIC_URL", e.publicBaseUrl), s = mt(e.allowedOrigins), c = e.limits?.maxBytes, l = e.anonymousUploads === !0, u = 5242880, d = 21600, f = e.refStore === void 0 || e.refStore === "memory", m = e.grantStore === void 0 || e.grantStore === "memory", h = (t, n) => U.gen(function* () {
+		let r = (e) => W.decodeUnknownEffect(it)(e, { onExcessProperty: "error" }).pipe(U.mapError(() => new p({
+			provider: "storage",
+			message: "Invalid upload access policy",
+			transient: !1,
+			status: 400
+		}))), i = t.access === void 0 ? void 0 : yield* r(t.access), a = t.visibility ?? "private";
+		if (i !== void 0 && a === "public") return yield* U.fail(new p({
+			provider: "storage",
+			message: "An access policy requires a private upload",
+			transient: !1,
+			status: 400
+		}));
+		let o = e.uploadAccess;
+		if (i !== void 0 && typeof o != "function") return yield* U.fail(new p({
+			provider: "storage",
+			message: "Requested upload access requires an uploadAccess authorization function on storagePlugin",
+			transient: !1,
+			status: 403
+		}));
+		let s = typeof o == "function" ? yield* o({
+			subject: n,
+			requested: i,
+			visibility: a,
+			contentType: t.contentType
+		}) : a === "private" ? o : void 0, c = s === void 0 ? void 0 : yield* r(s);
+		return a === "public" ? c !== void 0 && c.length > 0 ? yield* U.fail(new p({
+			provider: "storage",
+			message: "A public upload cannot carry an access policy",
+			transient: !1,
+			status: 400
+		})) : {} : c === void 0 ? {} : { access: c };
+	}), g = { current: f ? B() : e.refStore }, v = { current: m ? we() : e.grantStore }, y = { current: void 0 }, b = {
+		get catalogueId() {
+			return g.current.catalogueId;
+		},
+		insert: (e) => g.current.insert(e),
+		getById: (e) => g.current.getById(e),
+		delete: (e) => g.current.delete(e),
+		statistics: () => g.current.statistics(),
+		listRecent: (e) => g.current.listRecent(e),
+		countByKey: (e, t) => g.current.countByKey(e, t),
+		usageByTenant: (e) => g.current.usageByTenant(e),
+		consumeUsage: (e, t, n) => g.current.consumeUsage(e, t, n),
+		releaseUsage: (e, t) => g.current.releaseUsage(e, t),
+		listByDerivedFrom: (e) => g.current.listByDerivedFrom(e),
+		listRefs: (e) => g.current.listRefs(e),
 		get setVisibility() {
-			return k.current.setVisibility;
+			return g.current.setVisibility;
 		},
 		get countPublicByKey() {
-			return k.current.countPublicByKey;
+			return g.current.countPublicByKey;
 		}
-	}, ge = {
-		insert: (e) => A.current.insert(e),
-		delete: (e) => A.current.delete(e),
-		getById: (e) => A.current.getById(e),
-		listByRef: (e) => A.current.listByRef(e),
-		deleteByRef: (e) => A.current.deleteByRef(e)
-	}, _e = {
-		httpPath: b,
-		provider: x,
-		refStore: he,
-		grantStore: ge,
-		bucket: S,
-		...i.tenantPrefix === void 0 ? {} : { tenantPrefix: i.tenantPrefix },
-		...i.attempts === void 0 ? {} : { attempts: i.attempts },
-		...i.urlExpiresInSec === void 0 ? {} : { urlExpiresInSec: i.urlExpiresInSec },
-		...i.access === void 0 ? {} : { access: i.access },
-		...i.limits === void 0 ? {} : { limits: i.limits },
-		...i.ingest === void 0 ? {} : { ingest: i.ingest },
-		...i.scan === void 0 ? {} : { scan: i.scan },
-		...i.videoProbe === void 0 ? {} : { videoProbe: i.videoProbe },
-		...i.transcode === void 0 ? {} : { transcode: i.transcode },
-		...i.autoTranscode === void 0 ? {} : { autoTranscode: i.autoTranscode },
-		...T ? { publicBaseUrl: T } : {},
-		...i.normalizeImages === void 0 ? {} : { normalizeImages: i.normalizeImages },
-		...i.quota === void 0 ? {} : { quota: i.quota },
-		objects: () => j.current
-	}, ve = fn(_e), M = dn(_e), ye = `${b}/`, N = (e) => y.runPromise(e.pipe(y.catchAll(() => y.succeed(null)))), P = (e, t) => {
+	}, x = {
+		insert: (e) => v.current.insert(e),
+		delete: (e) => v.current.delete(e),
+		getById: (e) => v.current.getById(e),
+		listByRef: (e) => v.current.listByRef(e),
+		deleteByRef: (e) => v.current.deleteByRef(e)
+	}, S = {
+		httpPath: r,
+		storageInstance: t,
+		provider: i,
+		refStore: b,
+		grantStore: x,
+		bucket: a,
+		...e.tenantPrefix === void 0 ? {} : { tenantPrefix: e.tenantPrefix },
+		...e.attempts === void 0 ? {} : { attempts: e.attempts },
+		...e.urlExpiresInSec === void 0 ? {} : { urlExpiresInSec: e.urlExpiresInSec },
+		...e.access === void 0 ? {} : { access: e.access },
+		...e.limits === void 0 ? {} : { limits: e.limits },
+		...e.ingest === void 0 ? {} : { ingest: e.ingest },
+		...e.scan === void 0 ? {} : { scan: e.scan },
+		...e.videoProbe === void 0 ? {} : { videoProbe: e.videoProbe },
+		...e.transcode === void 0 ? {} : { transcode: e.transcode },
+		...e.autoTranscode === void 0 ? {} : { autoTranscode: e.autoTranscode },
+		...o ? { publicBaseUrl: o } : {},
+		...e.normalizeImages === void 0 ? {} : { normalizeImages: e.normalizeImages },
+		...e.quota === void 0 ? {} : { quota: e.quota },
+		objects: () => y.current
+	}, ie = Te(S), C = xe(S), T = (e) => C.uploadTicketScope().pipe(U.flatMap((t) => t === e.writeScope ? U.void : U.fail(new p({
+		provider: "storage",
+		message: "Upload ticket belongs to another storage destination",
+		transient: !1,
+		status: 409
+	})))), E = (e, t) => U.runPromise(T(e).pipe(U.match({
+		onSuccess: () => null,
+		onFailure: (e) => ({
+			status: e.status ?? 503,
+			body: e.status === 409 ? e.message : "Storage upload destination could not be checked",
+			contentType: "text/plain",
+			headers: t
+		})
+	}))), D = `${r}/`, O = (e) => U.runPromise(e.pipe(U.catch(() => U.succeed(null)))), k = (e, t) => {
 		if (!e) return "invalid";
 		let n = /^bytes=(\d*)-(\d*)$/.exec(e.trim());
 		if (!n) return "invalid";
@@ -2811,31 +285,34 @@ var Un = () => _e({
 			start: a,
 			endInclusive: o
 		};
-	}, be = /^(?:image\/(?!svg)|video\/|audio\/|application\/pdf(?:;|$)|text\/plain(?:;|$))/i, xe = (e) => ({
+	}, ae = e.publicCacheSeconds === void 0 ? "public, max-age=31536000, immutable" : `public, max-age=${Math.max(0, Math.floor(e.publicCacheSeconds))}`, A = /^(?:image\/(?!svg)|video\/|audio\/|application\/pdf(?:;|$)|text\/plain(?:;|$))/i, j = (e) => ({
 		"x-content-type-options": "nosniff",
-		"content-disposition": be.test(e) ? "inline" : "attachment"
-	}), Se = async (e, t, n, r) => {
+		"content-disposition": A.test(e) ? "inline" : "attachment"
+	}), ce = oe(), M = async (e, t, n, r) => {
 		if (n) {
-			let r = await N(M.get(e.id));
-			if (!r) return {
+			let r, i = await ce.getOrCreate(de(JSON.stringify([e.id, e.checksum]), e.contentType, n), async () => {
+				let t = await O(C.get(e.id));
+				return t ? (r = t.bytes, ue(t.bytes, e.contentType, n)) : null;
+			}).catch(() => null);
+			if (!i && r === void 0 && (r = (await O(C.get(e.id)))?.bytes), !i && r === void 0) return {
 				status: 404,
 				body: "not found",
 				contentType: "text/plain"
 			};
-			let i = await ht(e.id, r.bytes, e.contentType, n).catch(() => null), a = i ? i.bytes : r.bytes, o = i ? i.contentType : e.contentType, s = await dt(e.contentType, i !== null);
+			let a = i ? i.bytes : r, o = i ? i.contentType : e.contentType, s = await le(e.contentType, i !== null);
 			return {
 				status: 200,
 				body: a,
 				contentType: o,
 				headers: {
-					...xe(o),
+					...j(o),
 					"cache-control": t,
 					"accept-ranges": "none",
 					...s === null ? {} : { "x-voltro-transform": `original; reason=${s}` }
 				}
 			};
 		}
-		let i = r === void 0 ? "invalid" : P(r, e.size);
+		let i = r === void 0 ? "invalid" : k(r, e.size);
 		if (i === "unsatisfiable") return {
 			status: 416,
 			body: "range not satisfiable",
@@ -2846,13 +323,13 @@ var Un = () => _e({
 			}
 		};
 		if (i !== "invalid") {
-			let n = await N(M.getRange(e.id, i));
+			let n = await O(C.getRange(e.id, i));
 			return n ? {
 				status: 206,
 				body: n.bytes,
 				contentType: e.contentType,
 				headers: {
-					...xe(e.contentType),
+					...j(e.contentType),
 					"cache-control": t,
 					"accept-ranges": "bytes",
 					"content-range": `bytes ${i.start}-${i.endInclusive}/${n.totalSize}`
@@ -2863,64 +340,69 @@ var Un = () => _e({
 				contentType: "text/plain"
 			};
 		}
-		let a = await N(M.getStream(e.id));
+		let a = await O(C.getStream(e.id));
 		return a ? {
 			status: 200,
 			contentType: e.contentType,
 			headers: {
-				...xe(e.contentType),
+				...j(e.contentType),
 				"cache-control": t,
 				"accept-ranges": "bytes"
 			},
 			byteStream: {
 				contentLength: e.size,
-				stream: () => w.toReadableStream(a.stream)
+				stream: () => nt.toReadableStream(a.stream)
 			}
 		} : {
 			status: 404,
 			body: "not found",
 			contentType: "text/plain"
 		};
-	}, F = async (e) => {
-		let t = e.path.startsWith(ye) ? e.path.slice(ye.length).split("/")[0] ?? "" : "";
+	}, fe = async (e) => {
+		let t = e.path.startsWith(D) ? e.path.slice(D.length).split("/")[0] ?? "" : "";
 		if (!t) return {
 			status: 404,
 			body: "not found",
 			contentType: "text/plain"
 		};
-		let n = await N(M.head(t));
+		let n = await O(C.head(t));
 		if (!n) return {
 			status: 404,
 			body: "not found",
 			contentType: "text/plain"
 		};
-		let r = st(e.query), i = e.headers.range;
-		if (n.visibility === "public") {
-			let e = x.publicUrl?.(n.key) ?? null;
-			return e && !r ? {
+		let a = se(e.query), o = e.headers.range, s = n.derivedFrom == null ? null : await O(C.head(n.derivedFrom));
+		if (n.derivedFrom != null && s === null) return {
+			status: 404,
+			body: "not found",
+			contentType: "text/plain"
+		};
+		if (n.visibility === "public" && (s === null || s.visibility === "public")) {
+			let e = i.publicUrl?.(n.key) ?? null;
+			return e && !a ? {
 				status: 302,
 				headers: {
 					location: e,
 					"cache-control": "public, max-age=300"
 				}
-			} : Se(n, "public, max-age=31536000, immutable", r, i);
+			} : M(n, ae, a, o);
 		}
-		let a = !1, o = e.query ? new URLSearchParams(e.query).get("t") : null;
-		if (o) {
-			let e = At(o);
-			a = !!e && e.refId === t && e.audience === b;
+		let c = !1, l = e.query ? new URLSearchParams(e.query).get("t") : null;
+		if (l) {
+			let e = ye(l);
+			c = !!e && (e.refId === t || s !== null && e.refId === s.id) && e.audience === r;
 		}
-		if (!a) {
-			let t = se(e.headers.cookie, Yn), r = t ? le(t, ce()) : null;
-			r && (a = await N(M.checkAccess(n, r)) === !0);
+		if (!c) {
+			let t = ot(e.headers.cookie, lt), r = t ? ct(t, st()) : null;
+			r && (c = await O(C.checkAccess(n, r)) === !0);
 		}
-		if (!a) return {
+		if (!c) return {
 			status: 403,
 			body: "forbidden",
 			contentType: "text/plain"
 		};
-		if (x.presigns && !r) {
-			let e = await N(x.getUrl(n.key, 300));
+		if (i.presigns && !a) {
+			let e = await O(i.getUrl(n.key, 300));
 			if (e && /^https?:/.test(e)) return {
 				status: 302,
 				headers: {
@@ -2929,12 +411,12 @@ var Un = () => _e({
 				}
 			};
 		}
-		return Se(n, "private, no-store", r, i);
-	}, we = {
+		return M(n, "private, no-store", a, o);
+	}, pe = {
 		method: "GET",
-		path: b,
+		path: r,
 		handle: async (e) => {
-			let t = await F(e), n = rr(e.headers.origin, ue);
+			let t = await fe(e), n = J(e.headers.origin, s);
 			return Object.keys(n).length === 0 ? t : {
 				...t,
 				headers: {
@@ -2943,128 +425,127 @@ var Un = () => _e({
 				}
 			};
 		}
-	}, Ee = {
+	}, he = {
 		method: "*",
-		path: `${b}/upload`,
+		path: `${r}/upload`,
 		originGuard: "exempt",
 		handle: async (e) => {
-			let t = rr(e.headers.origin, ue);
+			let n = J(e.headers.origin, s);
 			if (e.method === "OPTIONS") return {
 				status: 204,
-				headers: t
+				headers: n
 			};
 			if (e.method !== "POST") return {
 				status: 405,
 				body: "method not allowed",
 				contentType: "text/plain",
-				headers: t
+				headers: n
 			};
-			let n = e.query ? new URLSearchParams(e.query).get("ticket") : null, r = n ? Mt(n) : null;
-			if (!r || r.instance !== v) return {
+			let r = e.query ? new URLSearchParams(e.query).get("ticket") : null, i = r ? F(r) : null;
+			if (!i || i.instance !== t) return {
 				status: 401,
 				body: "invalid or expired upload ticket",
 				contentType: "text/plain",
-				headers: t
-			};
-			if (r.replicaId !== void 0 && r.replicaId !== _().replicaId) return {
-				status: 409,
-				body: "upload ticket belongs to another replica",
-				contentType: "text/plain",
-				headers: t
+				headers: n
 			};
+			let a = await E(i, n);
+			if (a) return a;
 			if (e.rawBody.length === 0) return {
 				status: 400,
 				body: "empty body",
 				contentType: "text/plain",
-				headers: t
+				headers: n
 			};
-			if (r.max && e.rawBody.length > r.max) return {
+			if (i.max && e.rawBody.length > i.max) return {
 				status: 413,
 				body: "payload too large",
 				contentType: "text/plain",
-				headers: t
+				headers: n
 			};
-			let i = await y.runPromise(M.put({
+			let o = await U.runPromise(C.put({
 				bytes: e.rawBody,
-				contentType: r.ct,
-				tenantId: r.tenant,
-				ownerId: r.sub,
-				visibility: r.vis,
-				...me(r.vis),
-				...r.operationId === void 0 ? {} : { operationId: r.operationId },
-				...r.key === void 0 ? {} : { key: r.key },
-				...r.folder === void 0 ? {} : { folder: r.folder },
-				...r.tags === void 0 ? {} : { tags: r.tags },
-				...r.alt === void 0 ? {} : { alt: r.alt },
-				...r.caption === void 0 ? {} : { caption: r.caption }
-			}).pipe(y.flatMap((e) => M.getUrl(e.id).pipe(y.map((t) => ({
+				contentType: i.ct,
+				tenantId: i.tenant,
+				ownerId: i.sub,
+				visibility: i.vis,
+				...i.access === void 0 ? {} : { access: i.access },
+				...i.operationId === void 0 ? {} : { operationId: i.operationId },
+				...i.key === void 0 ? {} : { key: i.key },
+				...i.folder === void 0 ? {} : { folder: i.folder },
+				...i.tags === void 0 ? {} : { tags: i.tags },
+				...i.alt === void 0 ? {} : { alt: i.alt },
+				...i.caption === void 0 ? {} : { caption: i.caption }
+			}).pipe(U.flatMap((e) => C.getUrl(e.id).pipe(U.map((t) => ({
 				kind: "ok",
 				ref: e,
 				url: t
-			})))), y.catchTags({
-				StorageRejected: (e) => y.succeed({
+			})))), U.catchTags({
+				StorageRejected: (e) => U.succeed({
 					kind: "rejected",
-					status: e.reason === "too-large" ? 413 : 415,
+					status: yt(e),
 					detail: e.detail
 				}),
-				StorageScanRejected: (e) => y.succeed({
+				StorageScanRejected: (e) => U.succeed({
 					kind: "scan",
 					threat: e.threat
 				}),
-				StorageError: (e) => y.succeed({
+				StorageError: (e) => U.succeed({
 					kind: "error",
-					message: e.message
+					message: e.message,
+					status: e.status ?? 500
 				})
 			})));
-			return i.kind === "ok" ? {
+			return o.kind === "ok" ? {
 				status: 201,
 				body: JSON.stringify({
-					id: i.ref.id,
-					url: i.url,
-					contentType: i.ref.contentType,
-					size: i.ref.size
+					id: o.ref.id,
+					url: o.url,
+					contentType: o.ref.contentType,
+					size: o.ref.size
 				}),
 				contentType: "application/json",
-				headers: t
-			} : i.kind === "rejected" ? {
-				status: i.status,
-				body: i.detail,
+				headers: n
+			} : o.kind === "rejected" ? {
+				status: o.status,
+				body: o.detail,
 				contentType: "text/plain",
-				headers: t
-			} : i.kind === "scan" ? {
+				headers: n
+			} : o.kind === "scan" ? {
 				status: 422,
-				body: `rejected: ${i.threat}`,
+				body: `rejected: ${o.threat}`,
 				contentType: "text/plain",
-				headers: t
+				headers: n
 			} : {
-				status: 500,
-				body: i.message,
+				status: o.status,
+				body: o.message,
 				contentType: "text/plain",
-				headers: t
+				headers: n
 			};
 		}
 	}, I = {
 		method: "*",
-		path: `${b}/upload/resumable`,
+		path: `${r}/upload/resumable`,
 		originGuard: "exempt",
 		handle: async (e) => {
-			let t = rr(e.headers.origin, ue);
+			let n = J(e.headers.origin, s);
 			if (e.method === "OPTIONS") return {
 				status: 204,
-				headers: t
+				headers: n
 			};
-			let n = new URLSearchParams(e.query || ""), r = It(n.get("token") ?? "");
-			if (!r || r.instance !== v) return {
+			let r = new URLSearchParams(e.query || ""), i = be(r.get("token") ?? "");
+			if (!i || i.instance !== t) return {
 				status: 401,
 				body: "invalid or expired resumable token",
 				contentType: "text/plain",
-				headers: t
+				headers: n
 			};
+			let a = await E(i, n);
+			if (a) return a;
 			if (e.method === "GET" || e.method === "HEAD") {
-				let e = await y.runPromise(M.resumableStatus({
-					uploadId: r.id,
-					tenantId: r.tenant
-				}).pipe(y.match({
+				let e = await U.runPromise(C.resumableStatus({
+					uploadId: i.id,
+					tenantId: i.tenant
+				}).pipe(U.match({
 					onFailure: (e) => ({ error: e.message }),
 					onSuccess: (e) => e
 				})));
@@ -3072,13 +553,13 @@ var Un = () => _e({
 					status: 500,
 					body: e.error,
 					contentType: "text/plain",
-					headers: t
+					headers: n
 				} : {
 					status: 200,
 					body: JSON.stringify(e),
 					contentType: "application/json",
 					headers: {
-						...t,
+						...n,
 						"upload-offset": String(e.offset)
 					}
 				};
@@ -3087,88 +568,89 @@ var Un = () => _e({
 				status: 405,
 				body: "method not allowed",
 				contentType: "text/plain",
-				headers: t
+				headers: n
 			};
-			let i = Number(n.get("index"));
-			if (!Number.isInteger(i) || i < 0) return {
+			let o = Number(r.get("index"));
+			if (!Number.isInteger(o) || o < 0) return {
 				status: 400,
 				body: "missing/invalid chunk index",
 				contentType: "text/plain",
-				headers: t
+				headers: n
 			};
 			if (e.rawBody.length === 0) return {
 				status: 400,
 				body: "empty chunk",
 				contentType: "text/plain",
-				headers: t
+				headers: n
 			};
-			let a = n.get("final") === "1", o = await y.runPromise(M.putResumableChunk({
-				uploadId: r.id,
-				tenantId: r.tenant,
-				index: i,
+			let c = r.get("final") === "1", l = await U.runPromise(C.putResumableChunk({
+				uploadId: i.id,
+				tenantId: i.tenant,
+				index: o,
 				bytes: e.rawBody
-			}).pipe(y.flatMap(() => a ? M.finalizeResumable({
-				uploadId: r.id,
-				count: i + 1,
-				contentType: r.ct,
-				tenantId: r.tenant,
-				ownerId: r.sub,
-				visibility: r.vis,
-				...me(r.vis),
-				...r.folder === void 0 ? {} : { folder: r.folder },
-				...r.tags === void 0 ? {} : { tags: r.tags },
-				...r.alt === void 0 ? {} : { alt: r.alt },
-				...r.caption === void 0 ? {} : { caption: r.caption }
-			}).pipe(y.flatMap((e) => M.getUrl(e.id).pipe(y.map((t) => ({
+			}).pipe(U.flatMap(() => c ? C.finalizeResumable({
+				uploadId: i.id,
+				count: o + 1,
+				contentType: i.ct,
+				tenantId: i.tenant,
+				ownerId: i.sub,
+				visibility: i.vis,
+				...i.access === void 0 ? {} : { access: i.access },
+				...i.folder === void 0 ? {} : { folder: i.folder },
+				...i.tags === void 0 ? {} : { tags: i.tags },
+				...i.alt === void 0 ? {} : { alt: i.alt },
+				...i.caption === void 0 ? {} : { caption: i.caption }
+			}).pipe(U.flatMap((e) => C.getUrl(e.id).pipe(U.map((t) => ({
 				kind: "done",
 				ref: e,
 				url: t
-			}))))) : y.succeed({ kind: "chunk" })), y.catchTags({
-				StorageRejected: (e) => y.succeed({
+			}))))) : U.succeed({ kind: "chunk" })), U.catchTags({
+				StorageRejected: (e) => U.succeed({
 					kind: "rejected",
-					status: e.reason === "too-large" ? 413 : 415,
+					status: yt(e),
 					detail: e.detail
 				}),
-				StorageScanRejected: (e) => y.succeed({
+				StorageScanRejected: (e) => U.succeed({
 					kind: "scan",
 					threat: e.threat
 				}),
-				StorageError: (e) => y.succeed({
+				StorageError: (e) => U.succeed({
 					kind: "error",
-					message: e.message
+					message: e.message,
+					status: e.status ?? 500
 				})
 			})));
-			return o.kind === "chunk" ? {
+			return l.kind === "chunk" ? {
 				status: 204,
 				headers: {
-					...t,
-					"upload-offset": String(i + 1)
+					...n,
+					"upload-offset": String(o + 1)
 				}
-			} : o.kind === "done" ? {
+			} : l.kind === "done" ? {
 				status: 201,
 				body: JSON.stringify({
-					id: o.ref.id,
-					url: o.url,
-					contentType: o.ref.contentType,
-					size: o.ref.size
+					id: l.ref.id,
+					url: l.url,
+					contentType: l.ref.contentType,
+					size: l.ref.size
 				}),
 				contentType: "application/json",
-				headers: t
-			} : o.kind === "rejected" ? {
-				status: o.status,
-				body: o.detail,
+				headers: n
+			} : l.kind === "rejected" ? {
+				status: l.status,
+				body: l.detail,
 				contentType: "text/plain",
-				headers: t
-			} : o.kind === "scan" ? {
+				headers: n
+			} : l.kind === "scan" ? {
 				status: 422,
-				body: `rejected: ${o.threat}`,
+				body: `rejected: ${l.threat}`,
 				contentType: "text/plain",
-				headers: t
+				headers: n
 			} : {
-				status: 500,
-				body: o.message,
+				status: l.status,
+				body: l.message,
 				contentType: "text/plain",
-				headers: t
+				headers: n
 			};
 		}
 	}, L = (e) => ({
@@ -3178,71 +660,85 @@ var Un = () => _e({
 		kind: "json",
 		status: e,
 		data: { error: t }
-	}), De = (e, t) => {
+	}), z = (e, t) => {
 		try {
 			return new URL(e, "http://localhost").searchParams.get(t);
 		} catch {
 			return null;
 		}
-	}, Oe = [
+	}, V = U.gen(function* () {
+		return {
+			catalogueId: yield* b.catalogueId,
+			objectNamespace: yield* i.objectNamespace,
+			storageInstance: t
+		};
+	}), De = [
 		{
 			method: "POST",
 			path: "/upload-ticket",
 			description: "Authorize a binary upload with explicit tenant and owner attribution",
-			handler: (e) => y.gen(function* () {
-				let n = C.String.pipe(C.filter((e) => e.trim().length > 0)), r = yield* C.decodeUnknown(C.parseJson(C.Struct({
-					operationId: C.optional(n.pipe(C.maxLength(200))),
-					tenantId: C.NullOr(n),
-					ownerId: C.NullOr(n),
-					key: n.pipe(C.maxLength(1024)),
-					contentType: n.pipe(C.maxLength(255), C.filter((e) => !/[\r\n]/.test(e))),
-					size: C.Number.pipe(C.int(), C.positive(), C.filter(Number.isSafeInteger)),
-					visibility: C.optional(C.Literal("public", "private"))
-				})))(e.body).pipe(y.mapError(() => new t({
+			handler: (n) => U.gen(function* () {
+				let i = W.String.pipe(W.check(W.makeFilter((e) => e.trim().length > 0))), a = yield* W.decodeUnknownEffect(W.fromJsonString(W.Struct({
+					operationId: W.optional(i.pipe(W.check(W.isMaxLength(200)))),
+					tenantId: W.NullOr(i),
+					ownerId: W.NullOr(i),
+					key: i.pipe(W.check(W.isMaxLength(1024))),
+					contentType: i.pipe(W.check(W.isMaxLength(255)), W.check(W.makeFilter((e) => !/[\r\n]/.test(e)))),
+					size: W.Number.pipe(W.check(W.isInt()), W.check(W.isGreaterThan(0)), W.check(W.makeFilter(Number.isSafeInteger))),
+					visibility: W.optional(W.Literals(["public", "private"]))
+				})))(n.body).pipe(U.mapError(() => new p({
 					provider: "inspect",
 					message: "Provide explicit tenantId and ownerId (or null), key, contentType and a positive file size",
 					transient: !1,
 					status: 400
 				})));
-				if (r.operationId !== void 0 && j.current === void 0) return R(409, "Durable uploads require a bound operation store with default reference and grant stores");
-				if (E !== void 0 && r.size > E) return R(413, "File exceeds the configured upload limit");
-				let i = jt({
-					instance: v,
-					...r.operationId === void 0 ? {} : { operationId: `inspect-upload:${Ce("sha256").update(JSON.stringify([v, r.operationId])).digest("hex")}` },
-					replicaId: _().replicaId,
-					sub: r.ownerId,
-					tenant: r.tenantId,
-					ct: r.contentType,
-					key: r.key,
-					vis: r.visibility ?? "private",
-					max: r.size
+				if (a.operationId !== void 0 && y.current === void 0) return R(409, "Durable uploads require a bound operation store with default reference and grant stores");
+				if (c !== void 0 && a.size > c) return R(413, "File exceeds the configured upload limit");
+				let o = a.operationId ?? (y.current === void 0 ? void 0 : H()), s = o === void 0 ? void 0 : "inspect-upload:" + tt("sha256").update(JSON.stringify([t, o])).digest("hex"), l = a.visibility !== "public" && Array.isArray(e.uploadAccess) ? yield* W.decodeUnknownEffect(it)(e.uploadAccess, { onExcessProperty: "error" }).pipe(U.mapError(() => new p({
+					provider: "storage",
+					message: "Invalid upload access policy",
+					transient: !1,
+					status: 400
+				}))) : void 0, u = yield* C.uploadTicketScope(), d = N({
+					writeScope: u,
+					instance: t,
+					issuerReplicaId: rt().replicaId,
+					...l === void 0 ? {} : { access: l },
+					...s === void 0 ? {} : { operationId: s },
+					sub: a.ownerId,
+					tenant: a.tenantId,
+					ct: a.contentType,
+					key: a.key,
+					vis: a.visibility ?? "private",
+					max: a.size
 				}, 300);
 				return L({
-					uploadPath: `${b}/upload?ticket=${encodeURIComponent(i)}`,
+					uploadPath: `${r}/upload?ticket=${encodeURIComponent(d)}`,
 					expiresInSec: 300,
-					maxBytes: r.size
+					maxBytes: a.size,
+					...o === void 0 ? {} : { operationId: o }
 				});
-			}).pipe(y.catchAll((e) => y.succeed(R(e.status ?? 500, e.message))))
+			}).pipe(U.catch((e) => U.succeed(R(e.status ?? 500, e.message))))
 		},
 		{
 			method: "GET",
 			path: "/download",
 			description: "Stream a stored file as an attachment for authorized inspect readers",
-			handler: (e) => y.gen(function* () {
-				let t = De(e.url, "refId");
+			handler: (e) => U.gen(function* () {
+				let t = z(e.url, "refId");
 				if (!t?.trim()) return R(400, "A non-empty refId is required");
-				let { ref: n, stream: r } = yield* M.getStream(t), i = n.key.split("/").pop() || n.id, a = encodeURIComponent(i).replace(/[!'()*]/g, (e) => `%${e.charCodeAt(0).toString(16).toUpperCase()}`);
+				let { ref: n, stream: r } = yield* C.getStream(t), i = n.key.split("/").pop() || n.id, a = encodeURIComponent(i).replace(/[!'()*]/g, (e) => `%${e.charCodeAt(0).toString(16).toUpperCase()}`);
 				return {
 					kind: "bytes",
 					contentType: n.contentType,
 					byteStream: {
-						stream: () => w.toReadableStream(r),
+						stream: () => nt.toReadableStream(r),
 						contentLength: n.size,
 						contentDisposition: `attachment; filename="download"; filename*=UTF-8''${a}`
 					},
 					headers: { "cache-control": "no-store" }
 				};
-			}).pipe(y.catchAll((e) => y.succeed(R(e.status ?? 500, e.message))))
+			}).pipe(U.catch((e) => U.succeed(R(e.status ?? 500, e.message))))
 		},
 		{
 			method: "GET",
@@ -3250,8 +746,8 @@ var Un = () => _e({
 			scope: "process",
 			description: "Searchable storage refs, newest first, paginated",
 			handler: (e) => {
-				let t = Number(De(e.url, "offset") ?? 0), n = Number.isSafeInteger(t) && t >= 0 ? t : 0, r = (De(e.url, "search") ?? "").trim().slice(0, 200);
-				return he.listRefs({
+				let t = Number(z(e.url, "offset") ?? 0), n = Number.isSafeInteger(t) && t >= 0 ? t : 0, r = (z(e.url, "search") ?? "").trim().slice(0, 200);
+				return b.listRefs({
 					tenantId: void 0,
 					ownerId: void 0,
 					folder: void 0,
@@ -3260,14 +756,15 @@ var Un = () => _e({
 					search: r,
 					limit: 51,
 					offset: n
-				}).pipe(y.map((e) => L({
-					refs: e.slice(0, 50).map(ir),
+				}).pipe(U.flatMap((e) => V.pipe(U.map((t) => L({
+					source: t,
+					refs: e.slice(0, 50).map(ht),
 					page: {
 						search: r,
 						offset: n,
 						nextOffset: e.length > 50 ? n + 50 : null
 					}
-				})), y.catchAll((e) => y.succeed(R(500, e.message))));
+				})))), U.catch((e) => U.succeed(R(500, e.message))));
 			}
 		},
 		{
@@ -3275,11 +772,12 @@ var Un = () => _e({
 			path: "/stats",
 			scope: "process",
 			description: "Object count + total bytes per tenant + visibility split",
-			handler: () => he.statistics().pipe(y.map((e) => L({
-				provider: x.name,
-				bucket: S,
+			handler: () => b.statistics().pipe(U.flatMap((e) => V.pipe(U.map((t) => L({
+				source: t,
+				provider: i.name,
+				bucket: a,
 				...e
-			})), y.catchAll((e) => y.succeed(R(500, e.message))))
+			})))), U.catch((e) => U.succeed(R(500, e.message))))
 		},
 		{
 			method: "GET",
@@ -3287,273 +785,309 @@ var Un = () => _e({
 			scope: "process",
 			description: "Grants for a ref (?refId=…)",
 			handler: (e) => {
-				let t = De(e.url, "refId");
-				return t ? ge.listByRef(t).pipe(y.map((e) => L({ grants: e.map(ur) })), y.catchAll((e) => y.succeed(R(500, e.message)))) : y.succeed(R(400, "refId query param required"));
+				let t = z(e.url, "refId");
+				return t ? x.listByRef(t).pipe(U.map((e) => L({ grants: e.map(Q) })), U.catch((e) => U.succeed(R(500, e.message)))) : U.succeed(R(400, "refId query param required"));
 			}
 		},
 		{
 			method: "POST",
 			path: "/share",
 			description: "Grant a principal access to a ref",
-			handler: (e) => y.gen(function* () {
-				let n = yield* C.decodeUnknown(C.parseJson(C.Struct({
-					refId: C.String.pipe(C.filter((e) => e.trim().length > 0)),
-					principalType: C.Literal("user", "group", "apiKey"),
-					principalId: C.String.pipe(C.filter((e) => e.trim().length > 0)),
-					permission: C.optional(C.Literal("read", "write")),
-					expiresInDays: C.optional(C.Number.pipe(C.finite(), C.positive()))
-				})))(e.body).pipe(y.mapError(() => new t({
+			handler: (e) => U.gen(function* () {
+				let t = yield* W.decodeUnknownEffect(W.fromJsonString(W.Struct({
+					refId: W.String.pipe(W.check(W.makeFilter((e) => e.trim().length > 0))),
+					principalType: W.Literals([
+						"user",
+						"group",
+						"apiKey"
+					]),
+					principalId: W.String.pipe(W.check(W.makeFilter((e) => e.trim().length > 0))),
+					permission: W.optional(W.Literals(["read", "write"])),
+					expiresInDays: W.optional(W.Number.pipe(W.check(W.isFinite()), W.check(W.isGreaterThan(0))))
+				})))(e.body).pipe(U.mapError(() => new p({
 					provider: "inspect",
 					message: "Invalid share input: provide refId, principalType, principalId, read/write permission and a positive finite expiry if set",
 					transient: !1,
 					status: 400
-				}))), r = n.expiresInDays === void 0 ? null : new Date(Date.now() + n.expiresInDays * 864e5);
-				if (r !== null && !Number.isFinite(r.getTime())) return R(400, "Expiry exceeds the supported date range");
-				let i = yield* M.grant({
-					refId: n.refId,
-					principalType: n.principalType,
-					principalId: n.principalId,
-					...n.permission ? { permission: n.permission } : {},
-					expiresAt: r
+				}))), n = t.expiresInDays === void 0 ? null : new Date(Date.now() + t.expiresInDays * 864e5);
+				if (n !== null && !Number.isFinite(n.getTime())) return R(400, "Expiry exceeds the supported date range");
+				let r = yield* C.grant({
+					refId: t.refId,
+					principalType: t.principalType,
+					principalId: t.principalId,
+					...t.permission ? { permission: t.permission } : {},
+					expiresAt: n
 				});
-				return L({ grant: ur(i) });
-			}).pipe(y.catchAll((e) => y.succeed(R(e.status ?? 500, e.message ?? "share failed"))))
+				return L({ grant: Q(r) });
+			}).pipe(U.catch((e) => U.succeed(R(e.status ?? 500, e.message ?? "share failed"))))
 		},
 		{
 			method: "POST",
 			path: "/delete",
 			description: "Delete an object reference and its grants; release unreferenced bytes",
-			handler: (e) => y.gen(function* () {
-				let n = yield* C.decodeUnknown(C.parseJson(C.Struct({ refId: C.String.pipe(C.filter((e) => e.trim().length > 0)) })))(e.body).pipe(y.mapError(() => new t({
+			handler: (e) => U.gen(function* () {
+				let t = yield* W.decodeUnknownEffect(W.fromJsonString(W.Struct({ refId: W.String.pipe(W.check(W.makeFilter((e) => e.trim().length > 0))) })))(e.body).pipe(U.mapError(() => new p({
 					provider: "inspect",
 					message: "A non-empty refId is required",
 					transient: !1,
 					status: 400
 				})));
-				return yield* M.delete(n.refId), L({ ok: !0 });
-			}).pipe(y.catchAll((e) => y.succeed(R(e.status ?? 500, e.message))))
+				return yield* C.delete(t.refId), L({ ok: !0 });
+			}).pipe(U.catch((e) => U.succeed(R(e.status ?? 500, e.message))))
 		},
 		{
 			method: "POST",
 			path: "/revoke",
 			description: "Revoke a grant by id",
-			handler: (e) => y.gen(function* () {
-				let n = yield* C.decodeUnknown(C.parseJson(C.Struct({ grantId: C.String.pipe(C.filter((e) => e.trim().length > 0)) })))(e.body).pipe(y.mapError(() => new t({
+			handler: (e) => U.gen(function* () {
+				let t = yield* W.decodeUnknownEffect(W.fromJsonString(W.Struct({ grantId: W.String.pipe(W.check(W.makeFilter((e) => e.trim().length > 0))) })))(e.body).pipe(U.mapError(() => new p({
 					provider: "inspect",
 					message: "A non-empty grantId is required",
 					transient: !1,
 					status: 400
 				})));
-				return yield* M.revoke(n.grantId), L({ ok: !0 });
-			}).pipe(y.catchAll((e) => y.succeed(R(e.status ?? 500, e.message ?? "revoke failed"))))
+				return yield* C.revoke(t.grantId), L({ ok: !0 });
+			}).pipe(U.catch((e) => U.succeed(R(e.status ?? 500, e.message ?? "revoke failed"))))
 		}
-	], ke = [
+	], Ge = [
 		{
-			...te,
+			...ze,
 			execute: (e, t) => {
 				let n = e;
-				return M.mintUrl(n.id, t.request.subject, {
+				return C.mintUrl(n.id, t.request.subject, {
 					...n.password === void 0 ? {} : { password: n.password },
 					...n.expiresInSec === void 0 ? {} : { expiresInSec: n.expiresInSec }
-				}).pipe(y.map((e) => ({ url: e })));
+				}).pipe(U.map((e) => ({ url: e })));
 			}
 		},
 		{
-			...ee,
+			...Re,
 			execute: (e, t) => {
 				let n = e;
-				return M.mintUploadUrl({
+				return C.mintUploadUrl({
 					key: n.key,
 					contentType: n.contentType,
 					tenantId: t.request.subject.tenantId,
 					...n.expiresInSec === void 0 ? {} : { expiresInSec: n.expiresInSec }
-				}).pipe(y.map((e) => ({ url: e })));
+				}).pipe(U.map((e) => ({ url: e })));
 			}
 		},
 		{
-			...m,
-			execute: (e, t) => {
-				let n = e;
-				return cr(t, D).pipe(y.map((e) => {
-					let t = n.expiresInSec ?? 900, r = jt({
-						instance: v,
+			...Le,
+			execute: (e, n) => {
+				let i = e;
+				return Z(n, l).pipe(U.flatMap((e) => h(i, n.request.subject).pipe(U.map((t) => ({
+					writer: e,
+					policy: t
+				})))), U.flatMap((e) => i.operationId !== void 0 && y.current === void 0 ? U.fail(new p({
+					provider: "storage",
+					message: "Durable uploads require a bound operation store with default reference and grant stores",
+					transient: !1,
+					status: 409
+				})) : U.succeed(e)), U.flatMap(({ writer: e, policy: n }) => C.uploadTicketScope().pipe(U.map((a) => {
+					let s = i.expiresInSec ?? 900, l = i.operationId ?? (y.current === void 0 ? void 0 : H()), u = l === void 0 ? void 0 : "client-upload:" + tt("sha256").update(JSON.stringify([
+						t,
+						e.tenantId,
+						e.id,
+						l
+					])).digest("hex"), d = N({
+						writeScope: a,
+						instance: t,
+						...u === void 0 ? {} : { operationId: u },
 						sub: e.id,
 						tenant: e.tenantId,
-						ct: n.contentType,
-						vis: n.visibility ?? "private",
-						...n.key === void 0 ? {} : { key: n.key },
-						...n.folder === void 0 ? {} : { folder: n.folder },
-						...n.tags === void 0 ? {} : { tags: n.tags },
-						...n.alt === void 0 ? {} : { alt: n.alt },
-						...n.caption === void 0 ? {} : { caption: n.caption },
-						...E === void 0 ? {} : { max: E }
-					}, t);
+						ct: i.contentType,
+						vis: i.visibility ?? "private",
+						...n,
+						...i.key === void 0 ? {} : { key: i.key },
+						...i.folder === void 0 ? {} : { folder: i.folder },
+						...i.tags === void 0 ? {} : { tags: i.tags },
+						...i.alt === void 0 ? {} : { alt: i.alt },
+						...i.caption === void 0 ? {} : { caption: i.caption },
+						...c === void 0 ? {} : { max: c }
+					}, s);
 					return {
-						uploadUrl: `${T ? T.replace(/\/+$/, "") : ""}${b}/upload?ticket=${encodeURIComponent(r)}`,
-						expiresInSec: t
+						uploadUrl: `${o ? o.replace(/\/+$/, "") : ""}${r}/upload?ticket=${encodeURIComponent(d)}`,
+						expiresInSec: s,
+						...l === void 0 ? {} : { operationId: l }
 					};
-				}));
+				}))));
 			}
 		},
 		{
-			...p,
-			execute: (e, t) => {
-				let n = e;
-				return cr(t, D).pipe(y.flatMap((e) => M.mintPresignedUpload({
-					contentType: n.contentType,
+			...Ie,
+			execute: (e, n) => {
+				let r = e;
+				return Z(n, l).pipe(U.flatMap((e) => h(r, n.request.subject).pipe(U.map((t) => ({
+					writer: e,
+					policy: t
+				})))), U.flatMap(({ writer: e, policy: n }) => C.uploadTicketScope().pipe(U.flatMap((i) => C.mintPresignedUpload({
+					contentType: r.contentType,
 					tenantId: e.tenantId,
-					...n.expiresInSec === void 0 ? {} : { expiresInSec: n.expiresInSec }
-				}).pipe(y.map((t) => {
-					let r = Nt({
-						instance: v,
-						key: t.key,
+					...r.expiresInSec === void 0 ? {} : { expiresInSec: r.expiresInSec }
+				}).pipe(U.map((a) => {
+					let o = me({
+						writeScope: i,
+						instance: t,
+						key: a.key,
 						sub: e.id,
 						tenant: e.tenantId,
-						ct: n.contentType,
-						vis: n.visibility ?? "private",
-						...n.folder === void 0 ? {} : { folder: n.folder },
-						...n.tags === void 0 ? {} : { tags: n.tags },
-						...n.alt === void 0 ? {} : { alt: n.alt },
-						...n.caption === void 0 ? {} : { caption: n.caption },
-						...E === void 0 ? {} : { max: E }
-					}, t.expiresInSec);
+						ct: r.contentType,
+						vis: r.visibility ?? "private",
+						...n,
+						...r.folder === void 0 ? {} : { folder: r.folder },
+						...r.tags === void 0 ? {} : { tags: r.tags },
+						...r.alt === void 0 ? {} : { alt: r.alt },
+						...r.caption === void 0 ? {} : { caption: r.caption },
+						...c === void 0 ? {} : { max: c }
+					}, a.expiresInSec);
 					return {
-						uploadUrl: t.uploadUrl,
-						finalizeToken: r,
-						expiresInSec: t.expiresInSec
+						uploadUrl: a.uploadUrl,
+						finalizeToken: o,
+						expiresInSec: a.expiresInSec
 					};
-				}))));
+				}))))));
 			}
 		},
 		{
-			...l,
+			...Me,
 			execute: (e, n) => {
-				let r = Pt(e.finalizeToken);
-				return !r || r.instance !== v ? y.fail(new t({
+				let r = ve(e.finalizeToken);
+				return !r || r.instance !== t ? U.fail(new p({
 					provider: "storage",
 					message: "invalid or expired finalize token",
 					transient: !1,
 					status: 401
-				})) : lr(r.sub, n.request.subject.id) ? y.fail(new t({
+				})) : _t(r.sub, n.request.subject.id) ? U.fail(new p({
 					provider: "storage",
 					message: "finalize token belongs to another subject",
 					transient: !1,
 					status: 403
-				})) : M.finalizeUpload({
+				})) : T(r).pipe(U.flatMap(() => C.finalizeUpload({
 					key: r.key,
 					contentType: r.ct,
 					tenantId: r.tenant,
 					ownerId: r.sub,
 					visibility: r.vis,
-					...me(r.vis),
+					...r.access === void 0 ? {} : { access: r.access },
 					...r.folder === void 0 ? {} : { folder: r.folder },
 					...r.tags === void 0 ? {} : { tags: r.tags },
 					...r.alt === void 0 ? {} : { alt: r.alt },
 					...r.caption === void 0 ? {} : { caption: r.caption }
-				}).pipe(y.flatMap((e) => M.getUrl(e.id).pipe(y.map((t) => ({
+				}).pipe(U.flatMap((e) => C.getUrl(e.id).pipe(U.map((t) => ({
 					id: e.id,
 					url: t,
 					contentType: e.contentType,
 					size: e.size,
 					...e.width == null ? {} : { width: e.width },
 					...e.height == null ? {} : { height: e.height }
-				})))));
+				})))))));
 			}
 		},
 		{
-			...s,
-			execute: (e, t) => {
-				let n = e;
-				return cr(t, D).pipe(y.map((e) => {
-					let t = n.expiresInSec ?? fe, r = Te(), i = n.chunkSize && n.chunkSize > 0 ? n.chunkSize : de;
+			...Ae,
+			execute: (e, n) => {
+				let i = e;
+				return Z(n, l).pipe(U.flatMap((e) => h(i, n.request.subject).pipe(U.map((t) => ({
+					writer: e,
+					policy: t
+				})))), U.flatMap(({ writer: e, policy: n }) => C.uploadTicketScope().pipe(U.map((a) => {
+					let s = i.expiresInSec ?? d, l = H(), f = i.chunkSize && i.chunkSize > 0 ? i.chunkSize : u;
 					return {
-						uploadId: r,
-						resumableToken: Ft({
-							instance: v,
-							id: r,
+						uploadId: l,
+						resumableToken: _e({
+							writeScope: a,
+							instance: t,
+							id: l,
 							sub: e.id,
 							tenant: e.tenantId,
-							ct: n.contentType,
-							vis: n.visibility ?? "private",
-							size: n.size,
-							...n.folder === void 0 ? {} : { folder: n.folder },
-							...n.tags === void 0 ? {} : { tags: n.tags },
-							...n.alt === void 0 ? {} : { alt: n.alt },
-							...n.caption === void 0 ? {} : { caption: n.caption },
-							...E === void 0 ? {} : { max: E }
-						}, t),
-						uploadUrl: `${T ? T.replace(/\/+$/, "") : ""}${b}/upload/resumable`,
-						chunkSize: i,
-						expiresInSec: t
+							ct: i.contentType,
+							vis: i.visibility ?? "private",
+							...n,
+							size: i.size,
+							...i.folder === void 0 ? {} : { folder: i.folder },
+							...i.tags === void 0 ? {} : { tags: i.tags },
+							...i.alt === void 0 ? {} : { alt: i.alt },
+							...i.caption === void 0 ? {} : { caption: i.caption },
+							...c === void 0 ? {} : { max: c }
+						}, s),
+						uploadUrl: `${o ? o.replace(/\/+$/, "") : ""}${r}/upload/resumable`,
+						chunkSize: f,
+						expiresInSec: s
 					};
-				}));
+				}))));
 			}
 		},
 		{
-			...o,
-			execute: (e, t) => {
-				let n = e, r = n.expiresInSec ?? fe;
-				return cr(t, D).pipe(y.flatMap((e) => M.beginMultipartUpload({
-					contentType: n.contentType,
+			...ke,
+			execute: (e, n) => {
+				let r = e, i = r.expiresInSec ?? d;
+				return Z(n, l).pipe(U.flatMap((e) => h(r, n.request.subject).pipe(U.map((t) => ({
+					writer: e,
+					policy: t
+				})))), U.flatMap(({ writer: e, policy: n }) => C.uploadTicketScope().pipe(U.flatMap((a) => C.beginMultipartUpload({
+					contentType: r.contentType,
 					tenantId: e.tenantId,
-					visibility: n.visibility ?? "private",
-					expiresInSec: r
-				}).pipe(y.map((t) => ({
-					multipartToken: Lt({
-						instance: v,
-						key: t.key,
-						uploadId: t.uploadId,
+					visibility: r.visibility ?? "private",
+					expiresInSec: i
+				}).pipe(U.map((o) => ({
+					multipartToken: ge({
+						writeScope: a,
+						instance: t,
+						key: o.key,
+						uploadId: o.uploadId,
 						sub: e.id,
 						tenant: e.tenantId,
-						ct: n.contentType,
-						vis: n.visibility ?? "private",
-						size: n.size,
-						...n.folder === void 0 ? {} : { folder: n.folder },
-						...n.tags === void 0 ? {} : { tags: n.tags },
-						...n.alt === void 0 ? {} : { alt: n.alt },
-						...n.caption === void 0 ? {} : { caption: n.caption }
-					}, r),
-					partSize: n.partSize && n.partSize >= de ? n.partSize : de,
-					expiresInSec: r
-				})))));
+						ct: r.contentType,
+						vis: r.visibility ?? "private",
+						...n,
+						size: r.size,
+						...r.folder === void 0 ? {} : { folder: r.folder },
+						...r.tags === void 0 ? {} : { tags: r.tags },
+						...r.alt === void 0 ? {} : { alt: r.alt },
+						...r.caption === void 0 ? {} : { caption: r.caption }
+					}, i),
+					partSize: r.partSize && r.partSize >= u ? r.partSize : u,
+					expiresInSec: i
+				})))))));
 			}
 		},
 		{
-			...g,
+			...He,
 			execute: (e) => {
-				let n = e, r = Rt(n.multipartToken);
-				return !r || r.instance !== v ? y.fail(new t({
+				let n = e, r = P(n.multipartToken);
+				return !r || r.instance !== t ? U.fail(new p({
 					provider: "storage",
 					message: "invalid or expired multipart token",
 					transient: !1,
 					status: 401
-				})) : !Number.isInteger(n.partNumber) || n.partNumber < 1 ? y.fail(new t({
+				})) : !Number.isInteger(n.partNumber) || n.partNumber < 1 ? U.fail(new p({
 					provider: "storage",
 					message: "partNumber must be a positive integer",
 					transient: !1,
 					status: 400
-				})) : M.signMultipartPart({
+				})) : T(r).pipe(U.flatMap(() => C.signMultipartPart({
 					key: r.key,
 					uploadId: r.uploadId,
 					partNumber: n.partNumber
-				}).pipe(y.map((e) => ({ url: e })));
+				}).pipe(U.map((e) => ({ url: e })))));
 			}
 		},
 		{
-			...c,
+			...je,
 			execute: (e, n) => {
-				let r = e, i = Rt(r.multipartToken);
-				return !i || i.instance !== v ? y.fail(new t({
+				let r = e, i = P(r.multipartToken);
+				return !i || i.instance !== t ? U.fail(new p({
 					provider: "storage",
 					message: "invalid or expired multipart token",
 					transient: !1,
 					status: 401
-				})) : lr(i.sub, n.request.subject.id) ? y.fail(new t({
+				})) : _t(i.sub, n.request.subject.id) ? U.fail(new p({
 					provider: "storage",
 					message: "multipart token belongs to another subject",
 					transient: !1,
 					status: 403
-				})) : M.completeMultipart({
+				})) : T(i).pipe(U.flatMap(() => C.completeMultipart({
 					key: i.key,
 					uploadId: i.uploadId,
 					parts: r.parts,
@@ -3561,56 +1095,60 @@ var Un = () => _e({
 					tenantId: i.tenant,
 					ownerId: i.sub,
 					visibility: i.vis,
-					...me(i.vis),
+					...i.access === void 0 ? {} : { access: i.access },
 					...i.folder === void 0 ? {} : { folder: i.folder },
 					...i.tags === void 0 ? {} : { tags: i.tags },
 					...i.alt === void 0 ? {} : { alt: i.alt },
 					...i.caption === void 0 ? {} : { caption: i.caption }
-				}).pipe(y.flatMap((e) => M.getUrl(e.id).pipe(y.map((t) => ({
+				}).pipe(U.flatMap((e) => C.getUrl(e.id).pipe(U.map((t) => ({
 					id: e.id,
 					url: t,
 					size: e.size
-				})))));
+				})))))));
 			}
 		},
 		{
-			...a,
+			...Oe,
 			execute: (e) => {
-				let n = Rt(e.multipartToken);
-				return !n || n.instance !== v ? y.fail(new t({
+				let n = P(e.multipartToken);
+				return !n || n.instance !== t ? U.fail(new p({
 					provider: "storage",
 					message: "invalid or expired multipart token",
 					transient: !1,
 					status: 401
-				})) : M.abortMultipart({
+				})) : T(n).pipe(U.flatMap(() => C.abortMultipart({
 					key: n.key,
 					uploadId: n.uploadId
-				}).pipe(y.as({ ok: !0 }));
+				}).pipe(U.as({ ok: !0 }))));
 			}
 		},
 		{
-			...ie,
+			...We,
 			execute: (e, t) => {
 				let n = e, r = new Uint8Array(Buffer.from(n.bytesBase64, "base64"));
-				return cr(t, D).pipe(y.flatMap((e) => M.put({
+				return Z(t, l).pipe(U.flatMap((e) => h(n, t.request.subject).pipe(U.map((t) => ({
+					writer: e,
+					policy: t
+				})))), U.flatMap(({ writer: e, policy: t }) => C.put({
 					bytes: r,
+					...t,
 					contentType: n.contentType,
 					tenantId: e.tenantId,
 					ownerId: e.id,
 					...n.visibility ? { visibility: n.visibility } : {},
 					...n.key ? { key: n.key } : {},
 					...n.password ? { password: n.password } : {}
-				})), y.flatMap((e) => M.getUrl(e.id).pipe(y.map((t) => ({
+				})), U.flatMap((e) => C.getUrl(e.id).pipe(U.map((t) => ({
 					id: e.id,
 					url: t
 				})))));
 			}
 		},
 		{
-			...u,
+			...Ne,
 			execute: (e, t) => {
 				let n = e;
-				return cr(t, D).pipe(y.flatMap((e) => M.ingestUrl(n.url, {
+				return Z(t, l).pipe(U.flatMap((e) => C.ingestUrl(n.url, {
 					tenantId: e.tenantId,
 					ownerId: e.id,
 					...n.visibility ? { visibility: n.visibility } : {},
@@ -3619,45 +1157,45 @@ var Un = () => _e({
 					...n.alt === void 0 ? {} : { alt: n.alt },
 					...n.caption === void 0 ? {} : { caption: n.caption },
 					...n.key === void 0 ? {} : { key: n.key }
-				})), y.flatMap((e) => M.getUrl(e.id).pipe(y.map((t) => ({
+				})), U.flatMap((e) => C.getUrl(e.id).pipe(U.map((t) => ({
 					id: e.id,
 					url: t
 				})))));
 			}
 		},
 		{
-			...ne,
+			...Ve,
 			execute: (e, t) => {
 				let n = e, r = n.expiresInDays ? new Date(Date.now() + n.expiresInDays * 864e5) : null;
-				return or(M, n.refId, t).pipe(y.flatMap(() => M.grant({
+				return X(C, n.refId, t).pipe(U.flatMap(() => C.grant({
 					refId: n.refId,
 					principalType: n.principalType,
 					principalId: n.principalId,
 					...n.permission ? { permission: n.permission } : {},
 					expiresAt: r,
 					createdBy: t.request.subject.id
-				})), y.map((e) => ({ grantId: e.id })));
+				})), U.map((e) => ({ grantId: e.id })));
 			}
 		},
 		{
-			...h,
+			...Be,
 			execute: (e, t) => {
 				let n = e;
-				return M.getGrant(n.grantId).pipe(y.flatMap((e) => e === null ? y.fail(ar()) : or(M, e.refId, t)), y.flatMap(() => M.revoke(n.grantId)), y.map(() => ({ ok: !0 })));
+				return C.getGrant(n.grantId).pipe(U.flatMap((e) => e === null ? U.fail(Y()) : X(C, e.refId, t)), U.flatMap(() => C.revoke(n.grantId)), U.map(() => ({ ok: !0 })));
 			}
 		},
 		{
-			...d,
+			...Pe,
 			execute: (e, t) => {
 				let n = e;
-				return or(M, n.refId, t).pipe(y.flatMap(() => M.listGrants(n.refId)), y.map((e) => ({ grants: e.map(ur) })));
+				return X(C, n.refId, t).pipe(U.flatMap(() => C.listGrants(n.refId)), U.map((e) => ({ grants: e.map(Q) })));
 			}
 		},
 		{
-			...f,
+			...Fe,
 			execute: (e, t) => {
 				let n = e;
-				return M.listRefs({
+				return C.listRefs({
 					tenantId: t.request.subject.tenantId,
 					...n.folder === void 0 ? {} : { folder: n.folder },
 					...n.tags === void 0 ? {} : { tags: n.tags },
@@ -3665,61 +1203,61 @@ var Un = () => _e({
 					...n.includeDerived === void 0 ? {} : { includeDerived: n.includeDerived },
 					...n.limit === void 0 ? {} : { limit: n.limit },
 					...n.offset === void 0 ? {} : { offset: n.offset }
-				}).pipe(y.map((e) => ({
-					refs: e.refs.map(ir),
+				}).pipe(U.map((e) => ({
+					refs: e.refs.map(ht),
 					nextOffset: e.nextOffset
 				})));
 			}
 		}
 	];
-	return ae({
-		name: oe({
-			base: dr,
-			alias: i.alias,
-			instance: i.name
+	return at({
+		name: G({
+			base: $,
+			alias: e.alias,
+			instance: e.name
 		}),
-		baseName: dr,
+		baseName: $,
 		description: "File storage — StorageService over S3 / MinIO / filesystem / memory. Public objects served direct from bucket/CDN; private objects gated by an access policy + per-object grants. Checksums, tenant key-prefixing, _voltro_storage_refs + _voltro_storage_grants, retry.",
 		permissions: [
 			"network:outbound:*",
 			"inspect:read",
 			"inspect:write"
 		],
-		declaredEnv: H.declared,
-		egress: tr(i),
-		services: ve,
-		inspectEndpoints: Oe,
+		declaredEnv: w.declared,
+		egress: pt(e),
+		services: ie,
+		inspectEndpoints: De,
 		httpRoutes: [
-			we,
-			Ee,
+			pe,
+			he,
 			I
 		],
-		routes: ke,
-		rpcClientDescriptors: re,
+		routes: Ge,
+		rpcClientDescriptors: Ue,
 		errorSchemas: [
 			{
-				schema: t,
+				schema: p,
 				import: {
 					module: "@voltro/plugin-storage/errors",
 					name: "StorageError"
 				}
 			},
 			{
-				schema: e,
+				schema: te,
 				import: {
 					module: "@voltro/plugin-storage/errors",
 					name: "StorageAccessDenied"
 				}
 			},
 			{
-				schema: n,
+				schema: ne,
 				import: {
 					module: "@voltro/plugin-storage/errors",
 					name: "StorageRejected"
 				}
 			},
 			{
-				schema: r,
+				schema: re,
 				import: {
 					module: "@voltro/plugin-storage/errors",
 					name: "StorageScanRejected"
@@ -3728,7 +1266,7 @@ var Un = () => _e({
 		],
 		capabilities: { mediaPersist: {
 			put: async ({ bytes: e, mediaType: t, tenantId: n, operationId: r, ownerId: i, visibility: a, tags: o }) => {
-				let s = await y.runPromise(M.put({
+				let s = await U.runPromise(C.put({
 					bytes: e,
 					contentType: t,
 					tenantId: n,
@@ -3736,40 +1274,50 @@ var Un = () => _e({
 					...i === void 0 ? {} : { ownerId: i },
 					...a === void 0 ? {} : { visibility: a },
 					...o === void 0 ? {} : { tags: o },
-					...j.current === void 0 ? {} : { operationId: r }
+					...y.current === void 0 ? {} : { operationId: r }
 				}));
 				return {
-					url: await y.runPromise(M.getUrl(s.id, { tenantId: n })),
+					url: await U.runPromise(C.getUrl(s.id, { tenantId: n })),
 					refId: s.id
 				};
 			},
 			ingestUrl: async ({ url: e, tenantId: t, operationId: n, ownerId: r, visibility: i, tags: a }) => {
-				let o = await y.runPromise(M.ingestUrl(e, {
+				let o = await U.runPromise(C.ingestUrl(e, {
 					tenantId: t,
 					...r === void 0 ? {} : { ownerId: r },
 					...i === void 0 ? {} : { visibility: i },
 					...a === void 0 ? {} : { tags: a },
-					...j.current === void 0 ? {} : { operationId: n }
+					...y.current === void 0 ? {} : { operationId: n }
 				}));
 				return {
-					url: await y.runPromise(M.getUrl(o.id, { tenantId: t })),
+					url: await U.runPromise(C.getUrl(o.id, { tenantId: t })),
 					refId: o.id
 				};
 			}
 		} },
-		bindDataStore: (e) => {
-			pe && (k.current = an(e)), O && (A.current = cn(e)), pe && O && (j.current = Fn(e)), x.bindDataStore?.(e);
+		bindDataStore: async (e) => {
+			let r = await U.runPromise(i.objectNamespace);
+			(f || m) && await ee(e), (f || m) && await _(e), f && await n(e), f && (g.current = Ce(e, {
+				storageInstance: t,
+				objectNamespace: r
+			})), m && (v.current = Se(e, {
+				storageInstance: t,
+				objectNamespace: r
+			})), f && m && (y.current = Ee(e, {
+				storageInstance: t,
+				objectNamespace: r
+			})), i.bindDataStore?.(e);
 		},
-		onActivate: (e) => y.sync(() => {
-			let t = !!T || !!H.read("STORAGE_CDN_URL", i.cdnBaseUrl);
-			e.logger.info(`storage: provider=${x.name} presign=${x.presigns ? "yes" : "no"} publicUrl=${t ? "yes" : "no"} transforms=yes`, {
-				provider: x.name,
-				bucket: S,
-				refStore: pe ? "memory" : "custom"
-			}), x.name === "memory" && process.env.NODE_ENV !== "test" && e.logger.warn("storage: provider=memory — uploads are IN-MEMORY and LOST on restart. Set STORAGE_PROVIDER (filesystem / s3 / r2 / azure / gcs) for anything but throwaway dev. (Empty/placeholder storage env silently falls back to memory.)"), !t && !x.presigns && e.logger.warn("storage: no VOLTRO_PUBLIC_URL / STORAGE_CDN_URL and this provider can't presign — serve URLs are RELATIVE and will not resolve cross-origin (browser <img> / server-to-server AI fetches). Set VOLTRO_PUBLIC_URL to this api's absolute base URL.");
+		onActivate: (t) => U.sync(() => {
+			let n = !!o || !!w.read("STORAGE_CDN_URL", e.cdnBaseUrl);
+			t.logger.info(`storage: provider=${i.name} presign=${i.presigns ? "yes" : "no"} publicUrl=${n ? "yes" : "no"} transforms=yes`, {
+				provider: i.name,
+				bucket: a,
+				refStore: f ? "memory" : "custom"
+			}), i.name === "memory" && process.env.NODE_ENV !== "test" && t.logger.warn("storage: provider=memory — uploads are IN-MEMORY and LOST on restart. Set STORAGE_PROVIDER (filesystem / s3 / r2 / azure / gcs) for anything but throwaway dev. (Empty/placeholder storage env silently falls back to memory.)"), !n && !i.presigns && t.logger.warn("storage: no VOLTRO_PUBLIC_URL / STORAGE_CDN_URL and this provider can't presign — serve URLs are RELATIVE and will not resolve cross-origin (browser <img> / server-to-server AI fetches). Set VOLTRO_PUBLIC_URL to this api's absolute base URL.");
 		}),
-		onDeactivate: () => y.void
+		onDeactivate: () => U.void
 	});
 };
 //#endregion
-export { V as STORAGE_BLOBS_TABLE, B as STORAGE_GRANTS_TABLE, z as STORAGE_REFS_TABLE, Ue as STORAGE_USAGE_TABLE, e as StorageAccessDenied, t as StorageError, n as StorageRejected, r as StorageScanRejected, i as StorageService, qe as _voltroStorageBlobsTable, Ge as _voltroStorageGrantsTable, We as _voltroStorageRefsTable, Ke as _voltroStorageUsageTable, Qn as appStorageProvider, Hn as assetRef, it as azureProvider, dn as buildStorageService, Le as bytesToStream, Ht as checkLimits, zn as clamavScanner, Qe as clearStorageBuffer, Re as collectStream, Ie as concatBytes, $n as configuredStorageProvider, zt as contentTypeAllowed, cn as dataStoreGrantStore, an as dataStoreRefStore, rt as databaseProvider, Gn as decodeDataUri, Jn as durabilityNotice, In as encodeInstream, Vn as ffmpegTranscoder, et as filesystemProvider, ze as fromNodeReadable, Ve as getObjectStream, gt as hashPassword, Fn as makeStorageObjectMetadata, on as memoryGrantStore, $e as memoryProvider, tn as memoryRefStore, Ln as parseClamavResponse, st as parseTransformParams, qn as pathDurability, Kn as putAvatar, He as putObjectStream, Ze as readStorageBuffer, $t as refMatchesListQuery, er as resolveStorageProvider, q as resolveStorageSecret, tt as s3Provider, Zn as setActiveStorageProvider, Nt as signFinalizeTicket, kt as signGrant, Lt as signMultipartTicket, Ft as signResumableTicket, jt as signUploadTicket, Vt as sniffMatches, tr as storageEgressOf, fr as storageInstanceName, gn as storageObjectLifecycleTables, pr as storagePlugin, Mn as storagePutIntentsTable, fn as storageServiceLayer, Be as toNodeReadable, ht as transformCached, dt as transformFallbackReason, ft as transformImage, Pt as verifyFinalizeTicket, At as verifyGrant, Rt as verifyMultipartTicket, _t as verifyPassword, It as verifyResumableTicket, Mt as verifyUploadTicket, Un as withStorage };
+export { i as STORAGE_BLOBS_TABLE, a as STORAGE_GRANTS_TABLE, t as STORAGE_REFERENCE_CATALOGUE_TABLE, o as STORAGE_REFS_TABLE, s as STORAGE_USAGE_TABLE, te as StorageAccessDenied, p as StorageError, ne as StorageRejected, re as StorageScanRejected, m as StorageService, c as _voltroStorageBlobsTable, l as _voltroStorageGrantsTable, u as _voltroStorageRefsTable, d as _voltroStorageUsageTable, dt as appStorageProvider, Ye as assetRef, g as assignStorageObjectNamespacesInTransaction, f as assignStorageReferenceInstancesInTransaction, T as azureProvider, xe as buildStorageService, v as bytesToStream, I as checkLimits, Ge as clamavScanner, E as clearStorageBuffer, y as collectStream, b as concatBytes, ft as configuredStorageProvider, L as contentTypeAllowed, Se as dataStoreGrantStore, Ce as dataStoreRefStore, D as databaseProvider, Ze as decodeDataUri, $e as durabilityNotice, j as editImage, Ke as encodeInstream, n as ensureStorageReferenceCatalogue, z as fetchIngestBody, Je as ffmpegTranscoder, O as filesystemProvider, x as fromNodeReadable, S as getObjectStream, M as hashPassword, Ee as makeStorageObjectMetadata, we as memoryGrantStore, k as memoryProvider, B as memoryRefStore, qe as parseClamavResponse, se as parseTransformParams, et as pathDurability, Qe as putAvatar, ie as putObjectStream, ae as readStorageBuffer, V as refMatchesListQuery, _ as requireStorageObjectNamespaces, q as resolveStorageProvider, pe as resolveStorageSecret, A as s3Provider, ut as setActiveStorageProvider, me as signFinalizeTicket, he as signGrant, ge as signMultipartTicket, _e as signResumableTicket, N as signUploadTicket, R as sniffMatches, pt as storageEgressOf, vt as storageInstanceName, h as storageObjectLifecycleTables, e as storageObjectNamespace, bt as storagePlugin, De as storagePutIntentsTable, r as storageReferenceCatalogueTable, Te as storageServiceLayer, C as toNodeReadable, ce as transformCached, le as transformFallbackReason, ue as transformImage, ve as verifyFinalizeTicket, ye as verifyGrant, P as verifyMultipartTicket, fe as verifyPassword, be as verifyResumableTicket, F as verifyUploadTicket, Xe as withStorage };