@voltro/plugin-storage 0.85.0 → 0.86.0

package/README.md

@@ -20,7 +20,57 @@ Installation, guides, the full API reference, and examples all live in the
 **[Voltro documentation](https://docs.voltro.dev/docs/intro/getting-started)** — the single source of truth. This README is
 deliberately short so there is nothing here to drift out of date.
 
+### Bounded HTTP source reader
+
+Server integrations may use `fetchIngestBody(url, maxBytes?, policy?)` to collect
+bounded, interruptible HTTP bytes before validating an expected digest or size.
+The default limit is 64 MiB. Redirects and internal addresses use `IngestPolicy`;
+`allowHosts` exempts named internal hosts, not an exclusive source allow-list.
+The reader creates no references and performs no authorization, scanning or
+persistence. Use `StorageService.put` after validation for the complete storage
+pipeline, bound request duration, and protect network egress against DNS rebinding.
+Redact capability URLs from errors. Bounded buffering is not a process-RSS limit.
+
 ## License
 
+
 Proprietary. © 2026 Voltro UG. Your use is governed by the
 [Terms of Service](https://voltro.cloud/legal/terms). See the bundled `LICENSE`.
+
+
+### Reference catalogues and combined replica inspection
+
+A physical provider namespace identifies object bytes. A reference catalogue identifies the metadata view that lists those objects. They are separate: independent reference stores may use the same provider, and one database may contain views for independent providers or named storage instances.
+
+`RefStore.catalogueId` is a required `Effect<string, StorageError>` with a stable SHA-256 identity for its actual catalogue view. Replicas reading the same view must agree; independent catalogues must differ even if their reference IDs or contents match. Custom stores must retain this identity with their metadata. Wrappers forward the underlying effect. `memoryRefStore()` creates one identity per actual map, not per read.
+
+Configured default stores initialize `_voltro_storage_reference_catalogue` after normal schema reconciliation. Production starts still require applying the normal schema first. Preserve the catalogue marker on restart, backup and restore. If database copies will run concurrently as independent catalogues, assign them distinct markers through a reviewed stopped-service data migration. Do not treat two independent copies as one catalogue merely because a backup copied its marker.
+
+Direct `dataStoreRefStore` consumers register `storageReferenceCatalogueTable`, reconcile their schema and call `ensureStorageReferenceCatalogue(store)` once at boot before inspection. The adapter's `catalogueId` read never writes or repairs missing or corrupt identity. Its view identity additionally includes the configured storage instance and physical provider namespace.
+
+The `/refs` and `/stats` inspect reads report their catalogue, provider namespace and storage instance in `source`. Combined reads expose `sources` and attach source identity and answering replica IDs to each reference. Shared catalogue rows and counters appear once; independent catalogues remain separate, including equal reference IDs. The observation envelope retains unavailable-replica evidence. Counts describe reference metadata, not a complete inventory of unindexed provider objects.
+
+Each catalogue contributes up to 50 references for the requested page offset. Combined pages can therefore contain more than 50 files. Page advancement moves the same 50-reference window across all catalogues; ordering is newest first within the combined window. This is not global pagination across a single merged index. Divergent snapshots from the same shared catalogue are refused with an explicit comparison/retry message; no responder wins silently and counters are not guessed.
+
+The shared Storage browser displays file provenance and catalogue page semantics. Choose one replica before uploading, downloading, sharing, revoking access or deleting. Multi-replica browsing does not fan out file operations. Custom hosts must pass `StoragePage.operationTargetAvailable={false}` while multiple replicas or all replicas are selected, and use a distinct upload scope when the target changes. Server authorization and explicit mutation-target checks remain authoritative.
+
+Combined instance choosers offer only identical plugin declarations from every answering replica. Differing or absent installations are named explicitly; select a single replica to inspect those instances. Missing replica answers remain visible in the observation notice.
+
+## Through-app ticket retries
+
+With the application's DataStore and default reference/grant stores bound, ordinary and Inspect through-app upload tickets carry one native object operation. The ordinary ticket response exposes its optional `operationId`. Keep the issued upload URL to retry the same transfer: repeated or concurrent POSTs with the same bytes converge on one reference in that physical storage namespace.
+
+A provider failure retains the operation's intent and reservation until it is resumed or explicitly retired through the server's object-operation lifecycle. Ticket expiry alone does not release that reservation. Its reference becomes visible after the bytes are confirmed; retrying the same ticket resumes that intent. Different bytes or immutable inputs under that operation are refused with HTTP 409. Upload and resumable HTTP responses retain a provider's declared error status.
+
+Pass the returned `operationId` in a fresh authorized `storage.mintUploadTicket` request with the same metadata to renew an expired ticket and resume its retained transfer. A caller can also choose a stable `operationId` before the first request to recover a lost ticket acknowledgement. This identity is scoped to the current upload owner, tenant and configured storage instance; it is not an authorization credential. Omitting `operationId` starts another operation. Custom reference or grant stores do not bind the native object-operation boundary and do not advertise its operation ID. Presigned, resumable and multipart transfers retain their separate transport contracts. Provider I/O stays outside retryable metadata transactions; the operation does not add a later business-authorization check.
+
+`useUpload` retains an advertised ticket `operationId` across its automatic through-app retries. To recover a lost first mint reply or an explicit later UI retry, choose `operationId` before the first `upload(file, { operationId, prefer: 'through-app' })` call and retain it with that same file and metadata. A new file or business scope needs a new identity. `uploadMany` rejects one explicit identity shared by multiple files before dispatch. Without native operation support, omit the explicit identity; custom stores do not acquire an exactly-once guarantee. This does not persist a browser transfer across a page reload or extend presigned, resumable or multipart contracts.
+
+Object keys are physical provider keys. Native operation-backed writes use their existing content-addressed namespace; use the reference ID and approved ticket binding instead of inferring authority from a logical path inside a physical key.
+
+## Signed token deadlines
+
+Native signed read grants and upload, finalize, resumable and multipart tickets expire at their signed Unix-second deadline. Verification refuses the exact deadline and every later instant; a zero-second lifetime grants no usable interval. Obtain a new token through the authorized issuer when another transfer or read is needed.
+
+The ticket keeps its approved owner, tenant, key and access policy. Its deadline does not turn redemption into a session login or rerun the application's authorization function. Provider-presigned URLs retain their provider's expiry contract; this rule concerns Voltro's native signed tokens.
+

package/THIRD-PARTY-NOTICES.md

@@ -1,11 +1,11 @@
 # Third-Party Notices — @voltro/plugin-storage
 
-This package depends on the open-source software listed below. Each is the
+This package uses the open-source software listed below. Each is the
 property of its respective copyright holders and is used under the terms of
 its license. This file is provided for attribution; it grants no rights in
 @voltro/plugin-storage itself, which is proprietary (see LICENSE).
 
-Generated from the resolved runtime dependency closure (109 packages).
+Generated from the resolved runtime dependency closure (108 packages).
 
 ---
 
@@ -9624,34 +9624,6 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ```
 
-## layerr@3.0.0
-
-License: MIT
-
-```
-MIT License
-
-Copyright (c) 2020 Perry Mitchell
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-```
-
 ## lib0@0.2.117
 
 License: MIT
@@ -10459,14 +10431,14 @@ Apache License
    limitations under the License.
 ```
 
-## ulidx@2.4.1
+## ulid@3.0.2
 
 License: MIT
 
 ```
-MIT License
+The MIT License (MIT)
 
-Copyright (c) 2021 Perry Mitchell
+Copyright (c) 2017 Alizain Feerasta
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/dist/access.js

@@ -0,0 +1,47 @@
+import { randomBytes as e, scryptSync as t, timingSafeEqual as n } from "node:crypto";
+import { Effect as r } from "effect";
+//#region src/access.ts
+var i = (n) => {
+	let r = e(16).toString("hex");
+	return `${r}:${t(n, r, 32).toString("hex")}`;
+}, a = (e, r) => {
+	if (!e || !r) return !1;
+	let [i, a] = r.split(":");
+	if (!i || !a) return !1;
+	let o = Buffer.from(a, "hex"), s = t(e, i, o.length);
+	return s.length === o.length && n(s, o);
+}, o = (e) => Array.isArray(e) ? e.filter((e) => typeof e == "string") : [], s = (e) => o(e.metadata?.roles), c = (e) => o(e.scopes), l = (e, t) => e.some((e) => t.includes(e)), u = (e) => o(e.metadata?.groups), d = (e) => typeof e == "boolean" ? r.succeed(e) : r.isEffect(e) ? e : r.promise(() => e), f = (e, t, n = {}) => r.gen(function* () {
+	if (t.id && e.ownerId && t.id === e.ownerId) return !0;
+	let i = e.accessPolicy ?? [];
+	if (i.length === 0) return !1;
+	let a = n.resolveGroups ? yield* r.promise(async () => await n.resolveGroups(t)) : u(t);
+	for (let r of i) if (yield* p(r, e, t, a, n)) return !0;
+	return !1;
+}), p = (e, t, n, i, o) => r.gen(function* () {
+	let r = !1, u = (e) => (r = !0, e);
+	if (e.owner !== void 0 && e.owner && !u(!!n.id && !!t.ownerId && n.id === t.ownerId) || e.tenant !== void 0 && e.tenant && !u(!!n.tenantId && n.tenantId === t.tenantId) || e.apiKey !== void 0 && e.apiKey && !u(n.type === "apiKey") || e.roles && e.roles.length > 0 && !u(l(s(n), e.roles)) || e.groups && e.groups.length > 0 && !u(l(i, e.groups)) || e.scopes && e.scopes.length > 0 && !u(l(c(n), e.scopes)) || e.password !== void 0 && e.password && !u(a(o.password, t.passwordHash))) return !1;
+	if (e.guard) {
+		let r = o.guards?.[e.guard];
+		if (!u(r ? yield* d(r({
+			subject: n,
+			ref: t
+		})) : !1)) return !1;
+	}
+	return r;
+}), m = (e, t) => {
+	let n = [];
+	e.id && n.push({
+		type: e.type === "apiKey" ? "apiKey" : "user",
+		id: e.id
+	});
+	for (let e of t) n.push({
+		type: "group",
+		id: e
+	});
+	return n;
+}, h = (e, t, n, r, i) => {
+	let a = m(t, n);
+	return e.some((e) => e.expiresAt && e.expiresAt.getTime() < i || r === "write" && e.permission !== "write" ? !1 : a.some((t) => t.type === e.principalType && t.id === e.principalId));
+}, g = (e, t) => t.resolveGroups ? r.promise(async () => await t.resolveGroups(e)) : r.succeed(u(e));
+//#endregion
+export { f as evaluatePolicy, h as grantsAllow, i as hashPassword, g as resolveSubjectGroups, m as subjectPrincipals, a as verifyPassword };

package/dist/assetRef.js

@@ -0,0 +1,13 @@
+import { _voltroStorageRefsTable as e } from "./table.js";
+import { mixin as t, reference as n, text as r } from "@voltro/database";
+//#region src/assetRef.ts
+function i(t = {}) {
+	let i = t.nullable ?? !0, a = t.fk === !1 ? r().externalId() : n(() => e, { onDelete: t.onDelete ?? "setNull" });
+	return i ? a.nullable() : a;
+}
+var a = () => t({
+	id: "@voltro/plugin-storage/withStorage",
+	fields: { asset: i() }
+});
+//#endregion
+export { i as assetRef, a as withStorage };

package/dist/avatar.js

@@ -0,0 +1,39 @@
+import { StorageError as e } from "./types.js";
+import { Effect as t } from "effect";
+//#region src/avatar.ts
+var n = {
+	"image/png": "png",
+	"image/jpeg": "jpg",
+	"image/jpg": "jpg",
+	"image/gif": "gif",
+	"image/webp": "webp",
+	"image/svg+xml": "svg"
+}, r = (e) => {
+	let t = /^data:([^;,]+)(;base64)?,(.*)$/s.exec(e);
+	if (!t) throw Error("not a data URI");
+	let n = t[1] || "application/octet-stream", r = !!t[2], i = t[3] ?? "";
+	return {
+		bytes: r ? new Uint8Array(Buffer.from(i, "base64")) : new Uint8Array(Buffer.from(decodeURIComponent(i), "utf8")),
+		contentType: n
+	};
+}, i = (i, a) => t.gen(function* () {
+	let o = yield* t.try({
+		try: () => r(a.dataUri),
+		catch: (t) => new e({
+			provider: "avatar",
+			message: String(t?.message ?? t),
+			transient: !1,
+			status: 400
+		})
+	}), s = n[o.contentType] ?? "bin";
+	return yield* i.put({
+		bytes: o.bytes,
+		contentType: o.contentType,
+		tenantId: a.tenantId,
+		ownerId: a.userId,
+		visibility: "public",
+		key: `avatars/${a.userId}/avatar.${s}`
+	});
+});
+//#endregion
+export { r as decodeDataUri, i as putAvatar };

package/dist/constraints.js

@@ -0,0 +1,93 @@
+//#region src/constraints.ts
+var e = (e, t) => {
+	if (!t || t.length === 0) return !0;
+	let n = e.toLowerCase();
+	return t.some((e) => {
+		let t = e.toLowerCase();
+		return t.endsWith("/*") ? n.startsWith(t.slice(0, -1)) : n === t;
+	});
+}, t = [
+	{
+		ct: /^image\/png$/,
+		offset: 0,
+		magic: [
+			137,
+			80,
+			78,
+			71
+		]
+	},
+	{
+		ct: /^image\/jpe?g$/,
+		offset: 0,
+		magic: [
+			255,
+			216,
+			255
+		]
+	},
+	{
+		ct: /^image\/gif$/,
+		offset: 0,
+		magic: [
+			71,
+			73,
+			70,
+			56
+		]
+	},
+	{
+		ct: /^image\/webp$/,
+		offset: 0,
+		magic: [
+			82,
+			73,
+			70,
+			70
+		]
+	},
+	{
+		ct: /^image\/bmp$/,
+		offset: 0,
+		magic: [66, 77]
+	},
+	{
+		ct: /^application\/pdf$/,
+		offset: 0,
+		magic: [
+			37,
+			80,
+			68,
+			70
+		]
+	},
+	{
+		ct: /^application\/zip$/,
+		offset: 0,
+		magic: [
+			80,
+			75,
+			3,
+			4
+		]
+	},
+	{
+		ct: /^application\/gzip$/,
+		offset: 0,
+		magic: [31, 139]
+	}
+], n = (e, n) => {
+	let r = n.toLowerCase(), i = t.find((e) => e.ct.test(r));
+	return i ? e.length < i.offset + i.magic.length ? !1 : i.magic.every((t, n) => e[i.offset + n] === t) : !0;
+}, r = (t, r, i) => i ? i.maxBytes !== void 0 && t.byteLength > i.maxBytes ? {
+	reason: "too-large",
+	detail: `${t.byteLength} bytes exceeds the ${i.maxBytes}-byte limit`
+} : e(r, i.allowedContentTypes) ? i.sniff && !n(t, r) ? {
+	reason: "content-mismatch",
+	detail: `bytes do not match the declared content type '${r}'`
+} : null : {
+	reason: "content-type-not-allowed",
+	detail: `content type '${r}' is not in the allow-list`
+} : null;
+//#endregion
+export { r as checkLimits, e as contentTypeAllowed, n as sniffMatches };

package/dist/derivatives.js

@@ -0,0 +1,30 @@
+import { isTransformable as e, loadSharp as t } from "./transform.js";
+//#region src/derivatives.ts
+var n = async (n, r, i) => {
+	if (!e(r)) return { bytes: n };
+	let a = await t();
+	if (!a) return { bytes: n };
+	try {
+		let e = n;
+		if (i?.normalize) {
+			let t = await a(Buffer.from(n), { failOn: "none" }).rotate().toBuffer();
+			e = new Uint8Array(t);
+		}
+		let t = await a(Buffer.from(e), { failOn: "none" }).metadata(), r = await a(Buffer.from(e), { failOn: "none" }).resize({
+			width: 24,
+			height: 24,
+			fit: "inside",
+			withoutEnlargement: !0
+		}).webp({ quality: 40 }).toBuffer().catch(() => null);
+		return {
+			bytes: e,
+			...typeof t.width == "number" ? { width: t.width } : {},
+			...typeof t.height == "number" ? { height: t.height } : {},
+			...r ? { placeholder: `data:image/webp;base64,${r.toString("base64")}` } : {}
+		};
+	} catch {
+		return { bytes: n };
+	}
+};
+//#endregion
+export { n as extractImageMetadata };

package/dist/env.js

@@ -0,0 +1,156 @@
+import { pluginEnv as e } from "@voltro/env";
+//#region src/env.ts
+var t = e([
+	{
+		name: "STORAGE_PROVIDER",
+		required: !1,
+		secret: !1,
+		description: "Provider name: 's3' | 'minio' | 'azure' | 'database' | 'filesystem' | 'memory'. Default 'memory'."
+	},
+	{
+		name: "S3_BUCKET",
+		required: !1,
+		secret: !1,
+		description: "S3/MinIO bucket name. Default STORAGE_BUCKET, else \"voltro\"."
+	},
+	{
+		name: "STORAGE_BUCKET",
+		required: !1,
+		secret: !1,
+		description: "Fallback bucket name when S3_BUCKET is unset."
+	},
+	{
+		name: "S3_REGION",
+		required: !1,
+		secret: !1,
+		description: "S3 region. Falls back to AWS_REGION."
+	},
+	{
+		name: "AWS_REGION",
+		required: !1,
+		secret: !1,
+		description: "AWS region fallback for the S3 provider."
+	},
+	{
+		name: "S3_ENDPOINT",
+		required: !1,
+		secret: !1,
+		description: "Custom S3 endpoint URL. Falls back to MINIO_ENDPOINT."
+	},
+	{
+		name: "MINIO_ENDPOINT",
+		required: !1,
+		secret: !1,
+		description: "MinIO endpoint URL fallback for the S3 provider."
+	},
+	{
+		name: "S3_ACCESS_KEY_ID",
+		required: !1,
+		secret: !0,
+		description: "S3 access key id. Falls back to AWS_ACCESS_KEY_ID."
+	},
+	{
+		name: "AWS_ACCESS_KEY_ID",
+		required: !1,
+		secret: !0,
+		description: "AWS access key id fallback for the S3 provider."
+	},
+	{
+		name: "S3_SECRET_ACCESS_KEY",
+		required: !1,
+		secret: !0,
+		description: "S3 secret access key. Falls back to AWS_SECRET_ACCESS_KEY."
+	},
+	{
+		name: "AWS_SECRET_ACCESS_KEY",
+		required: !1,
+		secret: !0,
+		description: "AWS secret access key fallback for the S3 provider."
+	},
+	{
+		name: "S3_FORCE_PATH_STYLE",
+		required: !1,
+		secret: !1,
+		description: "Set to \"1\" to force path-style S3 addressing."
+	},
+	{
+		name: "STORAGE_CDN_URL",
+		required: !1,
+		secret: !1,
+		description: "Public base URL (CDN) served in front of the bucket for public objects."
+	},
+	{
+		name: "VOLTRO_PUBLIC_URL",
+		required: !1,
+		secret: !1,
+		description: "Absolute public base URL of THIS api (scheme://host[:port]) — prepended to the /_voltro/storage/:id serve URL so getUrl/mintUrl/the upload route emit ABSOLUTE URLs. Required when the api is a different origin than the app."
+	},
+	{
+		name: "STORAGE_ALLOWED_ORIGINS",
+		required: !1,
+		secret: !1,
+		description: "Comma-separated origins allowed to read the serve route + POST the upload route cross-origin (CORS). Use '*' for any. Omit for same-origin only."
+	},
+	{
+		name: "AZURE_STORAGE_ACCOUNT",
+		required: !1,
+		secret: !1,
+		description: "Azure storage account name (provider \"azure\")."
+	},
+	{
+		name: "AZURE_STORAGE_KEY",
+		required: !1,
+		secret: !0,
+		description: "Azure account key — needed to mint SAS URLs."
+	},
+	{
+		name: "AZURE_STORAGE_CONNECTION_STRING",
+		required: !1,
+		secret: !0,
+		description: "Azure connection string (carries the account key)."
+	},
+	{
+		name: "AZURE_STORAGE_ENDPOINT",
+		required: !1,
+		secret: !1,
+		description: "Custom Azure blob endpoint (e.g. Azurite)."
+	},
+	{
+		name: "AZURE_STORAGE_CONTAINER",
+		required: !1,
+		secret: !1,
+		description: "Azure blob container name (the \"bucket\")."
+	},
+	{
+		name: "STORAGE_ROOT",
+		required: !1,
+		secret: !1,
+		description: "Filesystem provider root directory. Default \".voltro-storage\"."
+	},
+	{
+		name: "VOLTRO_STORAGE_SECRET",
+		required: !1,
+		secret: !0,
+		description: "HMAC secret for signed grant tokens. Falls back to the session secret."
+	},
+	{
+		name: "VOLTRO_SESSION_COOKIE",
+		required: !1,
+		secret: !1,
+		description: "Session cookie name used to resolve private-object access. Default \"voltro:session\"."
+	},
+	{
+		name: "CLAMAV_HOST",
+		required: !1,
+		secret: !1,
+		description: "clamd host for the optional clamav virus scanner. Default 127.0.0.1."
+	},
+	{
+		name: "CLAMAV_PORT",
+		required: !1,
+		secret: !1,
+		description: "clamd port for the optional clamav virus scanner. Default 3310."
+	}
+]);
+//#endregion
+export { t as storageEnv };

package/dist/grant.js

@@ -0,0 +1,112 @@
+import { storageEnv as e } from "./env.js";
+import { createHmac as t, timingSafeEqual as n } from "node:crypto";
+import { Exit as r, Schema as i } from "effect";
+import { StorageAccessPolicySchema as a } from "@voltro/protocol";
+import { resolveSessionSecret as o } from "@voltro/protocol/session";
+//#region src/grant.ts
+var s = () => e.read("VOLTRO_STORAGE_SECRET") ?? o(), c = (e) => (typeof e == "string" ? Buffer.from(e, "utf8") : e).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, ""), l = (e) => {
+	let t = e.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - e.length % 4) % 4);
+	return Buffer.from(t, "base64");
+}, u = (e, n, r = s(), i = "/_voltro/storage") => {
+	if (!r) throw Error("signGrant: secret must be a non-empty string");
+	let a = {
+		refId: e,
+		audience: i,
+		exp: Math.floor(Date.now() / 1e3) + Math.floor(n)
+	}, o = c(JSON.stringify(a));
+	return `${o}.${c(t("sha256", r).update(o).digest())}`;
+}, d = (e, r = s()) => {
+	if (!e || !r) return null;
+	let i = e.indexOf(".");
+	if (i <= 0 || i === e.length - 1) return null;
+	let a = e.slice(0, i), o = e.slice(i + 1), c = t("sha256", r).update(a).digest(), u = l(o);
+	if (u.length !== c.length || !n(u, c)) return null;
+	try {
+		let e = JSON.parse(l(a).toString("utf8"));
+		return typeof e.audience != "string" || !e.audience || typeof e.refId != "string" || typeof e.exp != "number" || e.exp <= Math.floor(Date.now() / 1e3) ? null : e;
+	} catch {
+		return null;
+	}
+}, f = (e) => e.version !== 2 || typeof e.writeScope != "string" || !/^[a-f0-9]{64}$/.test(e.writeScope) || Object.hasOwn(e, "replicaId") || e.issuerReplicaId !== void 0 && (typeof e.issuerReplicaId != "string" || !e.issuerReplicaId.trim()) ? !1 : e.access === void 0 || e.vis === "private" && r.isSuccess(i.decodeUnknownExit(a, { onExcessProperty: "error" })(e.access)), p = (e, n, r = s()) => {
+	if (!r) throw Error("signUploadTicket: secret must be a non-empty string");
+	let i = {
+		...e,
+		version: 2,
+		exp: Math.floor(Date.now() / 1e3) + Math.floor(n)
+	}, a = c(JSON.stringify(i));
+	return `${a}.${c(t("sha256", r).update(`u:${a}`).digest())}`;
+}, m = (e, r = s()) => {
+	if (!e || !r) return null;
+	let i = e.indexOf(".");
+	if (i <= 0 || i === e.length - 1) return null;
+	let a = e.slice(0, i), o = e.slice(i + 1), c = t("sha256", r).update(`u:${a}`).digest(), u = l(o);
+	if (u.length !== c.length || !n(u, c)) return null;
+	try {
+		let e = JSON.parse(l(a).toString("utf8"));
+		return !f(e) || e.operationId !== void 0 && (typeof e.operationId != "string" || !e.operationId.trim() || e.operationId.length > 200) || typeof e.instance != "string" || !e.instance || typeof e.ct != "string" || typeof e.exp != "number" || e.vis !== "public" && e.vis !== "private" || e.exp <= Math.floor(Date.now() / 1e3) ? null : e;
+	} catch {
+		return null;
+	}
+}, h = (e, n, r = s()) => {
+	if (!r) throw Error("signFinalizeTicket: secret must be a non-empty string");
+	let i = {
+		...e,
+		version: 2,
+		exp: Math.floor(Date.now() / 1e3) + Math.floor(n)
+	}, a = c(JSON.stringify(i));
+	return `${a}.${c(t("sha256", r).update(`f:${a}`).digest())}`;
+}, g = (e, r = s()) => {
+	if (!e || !r) return null;
+	let i = e.indexOf(".");
+	if (i <= 0 || i === e.length - 1) return null;
+	let a = e.slice(0, i), o = e.slice(i + 1), c = t("sha256", r).update(`f:${a}`).digest(), u = l(o);
+	if (u.length !== c.length || !n(u, c)) return null;
+	try {
+		let e = JSON.parse(l(a).toString("utf8"));
+		return !f(e) || typeof e.key != "string" || e.key.length === 0 || typeof e.instance != "string" || !e.instance || typeof e.ct != "string" || typeof e.exp != "number" || e.vis !== "public" && e.vis !== "private" || e.exp <= Math.floor(Date.now() / 1e3) ? null : e;
+	} catch {
+		return null;
+	}
+}, _ = (e, n, r = s()) => {
+	if (!r) throw Error("signResumableTicket: secret must be a non-empty string");
+	let i = {
+		...e,
+		version: 2,
+		exp: Math.floor(Date.now() / 1e3) + Math.floor(n)
+	}, a = c(JSON.stringify(i));
+	return `${a}.${c(t("sha256", r).update(`r:${a}`).digest())}`;
+}, v = (e, r = s()) => {
+	if (!e || !r) return null;
+	let i = e.indexOf(".");
+	if (i <= 0 || i === e.length - 1) return null;
+	let a = e.slice(0, i), o = e.slice(i + 1), c = t("sha256", r).update(`r:${a}`).digest(), u = l(o);
+	if (u.length !== c.length || !n(u, c)) return null;
+	try {
+		let e = JSON.parse(l(a).toString("utf8"));
+		return !f(e) || typeof e.id != "string" || e.id.length === 0 || typeof e.size != "number" || e.size < 0 || typeof e.instance != "string" || !e.instance || typeof e.ct != "string" || typeof e.exp != "number" || e.vis !== "public" && e.vis !== "private" || e.exp <= Math.floor(Date.now() / 1e3) ? null : e;
+	} catch {
+		return null;
+	}
+}, y = (e, n, r = s()) => {
+	if (!r) throw Error("signMultipartTicket: secret must be a non-empty string");
+	let i = {
+		...e,
+		version: 2,
+		exp: Math.floor(Date.now() / 1e3) + Math.floor(n)
+	}, a = c(JSON.stringify(i));
+	return `${a}.${c(t("sha256", r).update(`m:${a}`).digest())}`;
+}, b = (e, r = s()) => {
+	if (!e || !r) return null;
+	let i = e.indexOf(".");
+	if (i <= 0 || i === e.length - 1) return null;
+	let a = e.slice(0, i), o = e.slice(i + 1), c = t("sha256", r).update(`m:${a}`).digest(), u = l(o);
+	if (u.length !== c.length || !n(u, c)) return null;
+	try {
+		let e = JSON.parse(l(a).toString("utf8"));
+		return !f(e) || typeof e.key != "string" || e.key.length === 0 || typeof e.uploadId != "string" || e.uploadId.length === 0 || typeof e.instance != "string" || !e.instance || typeof e.ct != "string" || typeof e.exp != "number" || e.vis !== "public" && e.vis !== "private" || e.exp <= Math.floor(Date.now() / 1e3) ? null : e;
+	} catch {
+		return null;
+	}
+};
+//#endregion
+export { s as resolveStorageSecret, h as signFinalizeTicket, u as signGrant, y as signMultipartTicket, _ as signResumableTicket, p as signUploadTicket, g as verifyFinalizeTicket, d as verifyGrant, b as verifyMultipartTicket, v as verifyResumableTicket, m as verifyUploadTicket };