@voltro/plugin-storage 0.85.0 → 0.86.0

package/dist/index.js

@@ -1,2700 +1,42 @@
-import { StorageAccessDenied as e, StorageError as t, StorageRejected as n, StorageScanRejected as r, StorageService as i } from "./types.js";
-import { abortMultipartUploadDescriptor as a, beginMultipartUploadDescriptor as o, beginResumableUploadDescriptor as s, completeMultipartUploadDescriptor as c, finalizeUploadDescriptor as l, ingestUrlDescriptor as u, listGrantsDescriptor as d, listRefsDescriptor as f, mintPresignedUploadDescriptor as p, mintUploadTicketDescriptor as m, mintUploadUrlDescriptor as ee, mintUrlDescriptor as te, revokeDescriptor as ne, shareDescriptor as h, signMultipartPartDescriptor as g, storageRpcClientImports as _, uploadDescriptor as re } from "./rpc.js";
-import { processIdentity as ie } from "@voltro/protocol/identity";
-import { Effect as v, Exit as y, Layer as b, Schedule as x, Schema as S, Stream as C } from "effect";
-import { StorageAccessPolicySchema as ae, definePlugin as oe, pluginInstanceName as w } from "@voltro/protocol";
-import { readCookie as se, resolveSessionSecret as ce, verifySession as le } from "@voltro/protocol/session";
-import { and as ue, authoredError as T, bigint as E, bytes as D, causeBranches as O, column as de, contains as fe, eq as k, extractDbCause as pe, generateId as A, id as j, integer as M, isNull as me, isTransientContention as he, json as ge, mixin as _e, neq as ve, or as N, reference as ye, table as P, text as F, timestamp as be, wireSafeCause as xe } from "@voltro/database";
-import { pluginEnv as Se } from "@voltro/env";
-import { createHash as Ce, createHmac as I, randomBytes as we, randomUUID as Te, scryptSync as Ee, timingSafeEqual as L } from "node:crypto";
-import { ssrfReason as De } from "@voltro/runtime";
-import { spawn as Oe } from "node:child_process";
-import { mkdtemp as R, readFile as z, rm as ke, writeFile as Ae } from "node:fs/promises";
-import { tmpdir as je } from "node:os";
-import { join as Me } from "node:path";
-import { statSync as Ne } from "node:fs";
-//#region src/streamBridge.ts
-var Pe = 1 << 20, Fe = (e, n, r = !1) => new t({
-	provider: e,
-	message: n,
-	transient: r
-}), Ie = (e) => {
-	let t = 0;
-	for (let n of e) t += n.byteLength;
-	let n = new Uint8Array(t), r = 0;
-	for (let t of e) n.set(t, r), r += t.byteLength;
-	return n;
-}, Le = (e, t = Pe) => {
-	let n = [];
-	for (let r = 0; r < e.byteLength; r += t) n.push(e.subarray(r, Math.min(r + t, e.byteLength)));
-	return C.fromIterable(n);
-}, Re = (e) => e.pipe(C.runCollect, v.map((e) => Ie(e))), ze = (e, t) => C.suspend(() => C.fromAsyncIterable(t(), (t) => Fe(e, `read stream failed: ${String(t?.message ?? t)}`, !0))).pipe(C.map((e) => e instanceof Uint8Array ? e : new Uint8Array(e))), Be = async (e) => {
-	let { Readable: t } = await import("node:stream");
-	return t.fromWeb(C.toReadableStream(e));
-}, Ve = (e, t) => e.getStream ? e.getStream(t) : e.get(t).pipe(v.map((e) => ({
-	stream: Le(e.bytes),
-	contentType: e.contentType,
-	size: e.bytes.byteLength
-}))), He = (e, t, n, r) => e.putStream ? e.putStream(t, n, r) : Re(n).pipe(v.flatMap((n) => e.put(t, n, {
-	contentType: r.contentType,
-	...r.public === void 0 ? {} : { public: r.public }
-}))), B = "_voltro_storage_refs", V = "_voltro_storage_grants", H = "_voltro_storage_blobs", Ue = "_voltro_storage_usage", We = P(B, {
-	id: j({ prefix: "file" }),
-	tenantId: F().nullable(),
-	ownerId: F().nullable(),
-	bucket: F(),
-	key: F(),
-	contentType: F(),
-	size: E(),
-	checksum: F(),
-	visibility: F(),
-	accessPolicy: ge().nullable(),
-	passwordHash: F().nullable(),
-	width: M().nullable(),
-	height: M().nullable(),
-	duration: M().nullable(),
-	placeholder: F().nullable(),
-	folder: F().nullable(),
-	tags: ge().nullable(),
-	alt: F().nullable(),
-	caption: F().nullable(),
-	derivedFrom: F().nullable(),
-	kind: F().nullable(),
-	createdAt: be()
-}).index(["key"]).index(["tenantId"]).index(["ownerId"]).index(["folder"]).index(["derivedFrom"]), Ge = P(V, {
-	id: j({ prefix: "sgrant" }),
-	refId: F(),
-	principalType: F(),
-	principalId: F(),
-	permission: F(),
-	createdAt: be(),
-	expiresAt: be().nullable(),
-	createdBy: F().nullable()
-}).index(["refId"]).index(["principalId"]), Ke = P(Ue, {
-	id: j({ prefix: "susage" }),
-	tenantId: F().maxLength(191),
-	bytes: E().default("0"),
-	count: E().default("0"),
-	updatedAt: be()
-}).unique("byStorageUsageTenant", ["tenantId"]), qe = P(H, {
-	id: j({ prefix: "blob" }),
-	key: F(),
-	data: D(),
-	contentType: F(),
-	size: E()
-}).index(["key"]), U = Se([
-	{
-		name: "STORAGE_PROVIDER",
-		required: !1,
-		secret: !1,
-		description: "Provider name: 's3' | 'minio' | 'azure' | 'database' | 'filesystem' | 'memory'. Default 'memory'."
-	},
-	{
-		name: "S3_BUCKET",
-		required: !1,
-		secret: !1,
-		description: "S3/MinIO bucket name. Default STORAGE_BUCKET, else \"voltro\"."
-	},
-	{
-		name: "STORAGE_BUCKET",
-		required: !1,
-		secret: !1,
-		description: "Fallback bucket name when S3_BUCKET is unset."
-	},
-	{
-		name: "S3_REGION",
-		required: !1,
-		secret: !1,
-		description: "S3 region. Falls back to AWS_REGION."
-	},
-	{
-		name: "AWS_REGION",
-		required: !1,
-		secret: !1,
-		description: "AWS region fallback for the S3 provider."
-	},
-	{
-		name: "S3_ENDPOINT",
-		required: !1,
-		secret: !1,
-		description: "Custom S3 endpoint URL. Falls back to MINIO_ENDPOINT."
-	},
-	{
-		name: "MINIO_ENDPOINT",
-		required: !1,
-		secret: !1,
-		description: "MinIO endpoint URL fallback for the S3 provider."
-	},
-	{
-		name: "S3_ACCESS_KEY_ID",
-		required: !1,
-		secret: !0,
-		description: "S3 access key id. Falls back to AWS_ACCESS_KEY_ID."
-	},
-	{
-		name: "AWS_ACCESS_KEY_ID",
-		required: !1,
-		secret: !0,
-		description: "AWS access key id fallback for the S3 provider."
-	},
-	{
-		name: "S3_SECRET_ACCESS_KEY",
-		required: !1,
-		secret: !0,
-		description: "S3 secret access key. Falls back to AWS_SECRET_ACCESS_KEY."
-	},
-	{
-		name: "AWS_SECRET_ACCESS_KEY",
-		required: !1,
-		secret: !0,
-		description: "AWS secret access key fallback for the S3 provider."
-	},
-	{
-		name: "S3_FORCE_PATH_STYLE",
-		required: !1,
-		secret: !1,
-		description: "Set to \"1\" to force path-style S3 addressing."
-	},
-	{
-		name: "STORAGE_CDN_URL",
-		required: !1,
-		secret: !1,
-		description: "Public base URL (CDN) served in front of the bucket for public objects."
-	},
-	{
-		name: "VOLTRO_PUBLIC_URL",
-		required: !1,
-		secret: !1,
-		description: "Absolute public base URL of THIS api (scheme://host[:port]) — prepended to the /_voltro/storage/:id serve URL so getUrl/mintUrl/the upload route emit ABSOLUTE URLs. Required when the api is a different origin than the app."
-	},
-	{
-		name: "STORAGE_ALLOWED_ORIGINS",
-		required: !1,
-		secret: !1,
-		description: "Comma-separated origins allowed to read the serve route + POST the upload route cross-origin (CORS). Use '*' for any. Omit for same-origin only."
-	},
-	{
-		name: "AZURE_STORAGE_ACCOUNT",
-		required: !1,
-		secret: !1,
-		description: "Azure storage account name (provider \"azure\")."
-	},
-	{
-		name: "AZURE_STORAGE_KEY",
-		required: !1,
-		secret: !0,
-		description: "Azure account key — needed to mint SAS URLs."
-	},
-	{
-		name: "AZURE_STORAGE_CONNECTION_STRING",
-		required: !1,
-		secret: !0,
-		description: "Azure connection string (carries the account key)."
-	},
-	{
-		name: "AZURE_STORAGE_ENDPOINT",
-		required: !1,
-		secret: !1,
-		description: "Custom Azure blob endpoint (e.g. Azurite)."
-	},
-	{
-		name: "AZURE_STORAGE_CONTAINER",
-		required: !1,
-		secret: !1,
-		description: "Azure blob container name (the \"bucket\")."
-	},
-	{
-		name: "STORAGE_ROOT",
-		required: !1,
-		secret: !1,
-		description: "Filesystem provider root directory. Default \".voltro-storage\"."
-	},
-	{
-		name: "VOLTRO_STORAGE_SECRET",
-		required: !1,
-		secret: !0,
-		description: "HMAC secret for signed grant tokens. Falls back to the session secret."
-	},
-	{
-		name: "VOLTRO_SESSION_COOKIE",
-		required: !1,
-		secret: !1,
-		description: "Session cookie name used to resolve private-object access. Default \"voltro:session\"."
-	},
-	{
-		name: "CLAMAV_HOST",
-		required: !1,
-		secret: !1,
-		description: "clamd host for the optional clamav virus scanner. Default 127.0.0.1."
-	},
-	{
-		name: "CLAMAV_PORT",
-		required: !1,
-		secret: !1,
-		description: "clamd port for the optional clamav virus scanner. Default 3310."
-	}
-]), W = (e, n) => {
-	let r = typeof e == "number" ? e : typeof e == "bigint" || typeof e == "string" && /^\d+$/.test(e) ? Number(e) : NaN;
-	if (!Number.isSafeInteger(r) || r < 0) throw new t({
-		provider: "metadata",
-		message: `Storage ${n} must be a non-negative safe integer at most Number.MAX_SAFE_INTEGER`,
-		transient: !1
-	});
-	return r;
-}, Je = (e, t, n) => W(e + t, n), G = (e, n, r = !1) => {
-	let i = O(e).find(S.is(t));
-	if (i !== void 0) return i;
-	let a = pe(e), o = a.dbCode === "22003" || a.dbSqlState === "22003" || a.dbCode === "ER_WARN_DATA_OUT_OF_RANGE" || a.dbErrno === 1264 || a.dbNumber === 8115 || a.dbNumber === 248, s = new t({
-		provider: n,
-		message: `${o ? "Storage metadata numeric value out of range: " : ""}${xe(e)}`,
-		transient: o ? !1 : he(e) || r
-	});
-	return Object.defineProperty(s, "cause", {
-		value: e,
-		configurable: !0
-	}), s;
-}, Ye = (e) => O(e).find(S.is(n)), K = (e, n, r, i) => new t({
-	provider: e,
-	message: n,
-	transient: r,
-	...i === void 0 ? {} : { status: i }
-}), Xe = (e) => e === void 0 || e === 408 || e === 429 || e >= 500, Ze = /* @__PURE__ */ new Map(), Qe = (e, t) => Ze.get(e)?.get(t)?.bytes, $e = (e) => {
-	Ze.get(e)?.clear();
-}, et = (e = "default") => {
-	let t = Ze.get(e) ?? /* @__PURE__ */ new Map();
-	return Ze.set(e, t), {
-		name: "memory",
-		presigns: !1,
-		put: (e, n, r) => v.sync(() => (t.set(e, {
-			bytes: n,
-			contentType: r.contentType
-		}), { size: n.byteLength })),
-		get: (e) => v.suspend(() => {
-			let n = t.get(e);
-			return n ? v.succeed({
-				bytes: n.bytes,
-				contentType: n.contentType
-			}) : v.fail(K("memory", `no object at key '${e}'`, !1, 404));
-		}),
-		delete: (e) => v.sync(() => {
-			t.delete(e);
-		}),
-		publicUrl: () => null,
-		getUrl: () => v.succeed(""),
-		head: (e) => v.sync(() => {
-			let n = t.get(e);
-			return n ? { size: n.bytes.byteLength } : null;
-		})
-	};
-}, tt = (e) => {
-	let t = e.root, n = async (e) => {
-		let { join: n, resolve: r, sep: i } = await import("node:path"), a = r(t), o = r(a, e);
-		if (o !== a && !o.startsWith(a + i)) throw Error(`key '${e}' escapes the storage root`);
-		return n(o);
-	}, r = (e, t, n = !1) => v.tryPromise({
-		try: e,
-		catch: (e) => e?.code === "ENOENT" ? K("filesystem", `no object at key '${t}'`, !1, 404) : K("filesystem", String(e?.message ?? e), n)
-	});
-	return {
-		root: t,
-		name: "filesystem",
-		presigns: !1,
-		put: (e, t, i) => r(async () => {
-			let r = await import("node:fs/promises"), { dirname: i } = await import("node:path"), { randomUUID: a } = await import("node:crypto"), o = await n(e), s = i(o);
-			await r.mkdir(s, { recursive: !0 });
-			let c = `${o}.tmp-${a()}`;
-			try {
-				await r.writeFile(c, t), await r.rename(c, o);
-			} catch (e) {
-				throw await r.rm(c, { force: !0 }).catch(() => {}), e;
-			}
-			return { size: t.byteLength };
-		}, e, !0),
-		get: (e) => r(async () => {
-			let t = await (await import("node:fs/promises")).readFile(await n(e));
-			return {
-				bytes: new Uint8Array(t),
-				contentType: "application/octet-stream"
-			};
-		}, e),
-		delete: (e) => r(async () => {
-			await (await import("node:fs/promises")).rm(await n(e), { force: !0 });
-		}, e),
-		publicUrl: () => null,
-		getUrl: () => v.succeed(""),
-		head: (e) => v.tryPromise({
-			try: async () => {
-				let t = await import("node:fs/promises");
-				try {
-					return { size: (await t.stat(await n(e))).size };
-				} catch (e) {
-					if (e?.code === "ENOENT") return null;
-					throw e;
-				}
-			},
-			catch: (e) => K("filesystem", String(e?.message ?? e), !1)
-		}),
-		getStream: (e) => r(async () => {
-			let t = await import("node:fs/promises"), { createReadStream: r } = await import("node:fs"), i = await n(e), a = await t.stat(i);
-			return {
-				stream: ze("filesystem", () => r(i)),
-				contentType: "application/octet-stream",
-				size: a.size
-			};
-		}, e),
-		putStream: (e, t, i) => r(async () => {
-			let r = await import("node:fs/promises"), { dirname: i } = await import("node:path"), { randomUUID: a } = await import("node:crypto"), { createWriteStream: o } = await import("node:fs"), { pipeline: s } = await import("node:stream/promises"), c = await n(e);
-			await r.mkdir(i(c), { recursive: !0 });
-			let l = `${c}.tmp-${a()}`;
-			try {
-				await s(await Be(t), o(l));
-				let e = await r.stat(l);
-				return await r.rename(l, c), { size: e.size };
-			} catch (e) {
-				throw await r.rm(l, { force: !0 }).catch(() => {}), e;
-			}
-		}, e, !0),
-		getRange: (e, t, i) => r(async () => {
-			let { createReadStream: r } = await import("node:fs"), a = await n(e), o = [];
-			return await new Promise((e, n) => {
-				let s = r(a, {
-					start: t,
-					end: i
-				});
-				s.on("data", (e) => o.push(e)), s.on("end", () => e()), s.on("error", n);
-			}), Ie(o);
-		}, e)
-	};
-}, nt = (e) => {
-	let t = e.name ?? "s3", n = e.publicAcl ?? !0, r = null, i = () => r || (r = (async () => {
-		let t, n;
-		try {
-			t = await import("@aws-sdk/client-s3"), n = await import("@aws-sdk/s3-request-presigner");
-		} catch (e) {
-			throw Error("the 's3'/'minio' storage provider requires the '@aws-sdk/client-s3' + '@aws-sdk/s3-request-presigner' optional dependencies. Install them to enable it.", { cause: e });
-		}
-		return {
-			client: new t.S3Client({
-				...e.region ? { region: e.region } : { region: "us-east-1" },
-				...e.endpoint ? { endpoint: e.endpoint } : {},
-				...e.forcePathStyle ? { forcePathStyle: !0 } : {},
-				...e.accessKeyId && e.secretAccessKey ? { credentials: {
-					accessKeyId: e.accessKeyId,
-					secretAccessKey: e.secretAccessKey
-				} } : {}
-			}),
-			cmds: t,
-			presign: n.getSignedUrl
-		};
-	})(), r), a = (e) => v.tryPromise({
-		try: e,
-		catch: (e) => {
-			let n = e?.$metadata?.httpStatusCode;
-			return K(t, String(e?.message ?? e), Xe(n), n);
-		}
-	}), o = async (e) => {
-		let t = e;
-		if (typeof t.transformToByteArray == "function") return t.transformToByteArray();
-		let n = [];
-		for await (let e of t) n.push(e);
-		let r = n.reduce((e, t) => e + t.byteLength, 0), i = new Uint8Array(r), a = 0;
-		for (let e of n) i.set(e, a), a += e.byteLength;
-		return i;
-	};
-	return {
-		name: t,
-		presigns: !0,
-		put: (t, r, o) => a(async () => {
-			let { client: a, cmds: s } = await i();
-			return await a.send(new s.PutObjectCommand({
-				Bucket: e.bucket,
-				Key: t,
-				Body: r,
-				ContentType: o.contentType,
-				...o.public && n ? { ACL: "public-read" } : {}
-			})), { size: r.byteLength };
-		}),
-		get: (t) => a(async () => {
-			let { client: n, cmds: r } = await i(), a = await n.send(new r.GetObjectCommand({
-				Bucket: e.bucket,
-				Key: t
-			}));
-			return {
-				bytes: await o(a.Body),
-				contentType: a.ContentType ?? "application/octet-stream"
-			};
-		}),
-		delete: (t) => a(async () => {
-			let { client: n, cmds: r } = await i();
-			await n.send(new r.DeleteObjectCommand({
-				Bucket: e.bucket,
-				Key: t
-			}));
-		}),
-		publicUrl: (t) => e.cdnBaseUrl ? `${e.cdnBaseUrl.replace(/\/$/, "")}/${t}` : null,
-		...n ? { setObjectPublic: (t, n) => a(async () => {
-			let { client: r, cmds: a } = await i();
-			await r.send(new a.PutObjectAclCommand({
-				Bucket: e.bucket,
-				Key: t,
-				ACL: n ? "public-read" : "private"
-			}));
-		}) } : {},
-		getUrl: (t, n) => a(async () => {
-			let { client: r, cmds: a, presign: o } = await i();
-			return o(r, new a.GetObjectCommand({
-				Bucket: e.bucket,
-				Key: t
-			}), { expiresIn: n });
-		}),
-		getUploadUrl: (t, n, r) => a(async () => {
-			let { client: a, cmds: o, presign: s } = await i();
-			return s(a, new o.PutObjectCommand({
-				Bucket: e.bucket,
-				Key: t,
-				ContentType: r
-			}), { expiresIn: n });
-		}),
-		createMultipartUpload: (t, r, o) => a(async () => {
-			let { client: a, cmds: s } = await i(), c = await a.send(new s.CreateMultipartUploadCommand({
-				Bucket: e.bucket,
-				Key: t,
-				ContentType: r,
-				...o?.public && n ? { ACL: "public-read" } : {}
-			}));
-			if (!c.UploadId) throw Error("s3 createMultipartUpload returned no UploadId");
-			return { uploadId: c.UploadId };
-		}),
-		presignUploadPart: (t, n, r, o) => a(async () => {
-			let { client: a, cmds: s, presign: c } = await i();
-			return c(a, new s.UploadPartCommand({
-				Bucket: e.bucket,
-				Key: t,
-				UploadId: n,
-				PartNumber: r
-			}), { expiresIn: o });
-		}),
-		completeMultipartUpload: (t, n, r) => a(async () => {
-			let { client: a, cmds: o } = await i(), s = await a.send(new o.CompleteMultipartUploadCommand({
-				Bucket: e.bucket,
-				Key: t,
-				UploadId: n,
-				MultipartUpload: { Parts: r.map((e) => ({
-					PartNumber: e.partNumber,
-					ETag: e.etag
-				})) }
-			}));
-			return s.ETag === void 0 ? {} : { etag: s.ETag };
-		}),
-		abortMultipartUpload: (t, n) => a(async () => {
-			let { client: r, cmds: a } = await i();
-			await r.send(new a.AbortMultipartUploadCommand({
-				Bucket: e.bucket,
-				Key: t,
-				UploadId: n
-			}));
-		}),
-		head: (n) => v.tryPromise({
-			try: async () => {
-				let { client: t, cmds: r } = await i();
-				try {
-					let i = await t.send(new r.HeadObjectCommand({
-						Bucket: e.bucket,
-						Key: n
-					}));
-					return {
-						size: i.ContentLength ?? 0,
-						...i.ETag === void 0 ? {} : { etag: i.ETag }
-					};
-				} catch (e) {
-					if (e?.$metadata?.httpStatusCode === 404) return null;
-					throw e;
-				}
-			},
-			catch: (e) => {
-				let n = e?.$metadata?.httpStatusCode;
-				return K(t, String(e?.message ?? e), Xe(n), n);
-			}
-		}),
-		getStream: (n) => a(async () => {
-			let { client: r, cmds: a } = await i(), o = await r.send(new a.GetObjectCommand({
-				Bucket: e.bucket,
-				Key: n
-			})), s = o.Body;
-			return {
-				stream: ze(t, () => s),
-				contentType: o.ContentType ?? "application/octet-stream",
-				...o.ContentLength === void 0 ? {} : { size: o.ContentLength }
-			};
-		}),
-		putStream: (t, r, o) => a(async () => {
-			let { client: a, cmds: s } = await i(), c;
-			try {
-				c = await import("@aws-sdk/lib-storage");
-			} catch (e) {
-				throw Error("s3/minio `putStream` requires the '@aws-sdk/lib-storage' optional dependency (multipart upload). Install it to enable streamed uploads.", { cause: e });
-			}
-			let l = await Be(r);
-			return await new c.Upload({
-				client: a,
-				params: {
-					Bucket: e.bucket,
-					Key: t,
-					Body: l,
-					ContentType: o.contentType,
-					...o.public && n ? { ACL: "public-read" } : {}
-				}
-			}).done(), { size: o.totalSize ?? (await a.send(new s.HeadObjectCommand({
-				Bucket: e.bucket,
-				Key: t
-			}))).ContentLength ?? 0 };
-		}),
-		getRange: (t, n, r) => a(async () => {
-			let { client: a, cmds: s } = await i(), c = await a.send(new s.GetObjectCommand({
-				Bucket: e.bucket,
-				Key: t,
-				Range: `bytes=${n}-${r}`
-			}));
-			return o(c.Body);
-		})
-	};
-}, rt = (e) => e instanceof Uint8Array ? e : typeof e == "string" ? new Uint8Array(Buffer.from(e, "base64")) : new Uint8Array(e), it = () => {
-	let e = null, t = () => {
-		if (!e) throw T("the 'database' storage provider isn't bound to a DataStore yet");
-		return e;
-	}, n = (e) => v.tryPromise({
-		try: e,
-		catch: (e) => G(e, "database", !0)
-	}), r = async (e, n) => (await t().query({
-		table: H,
-		predicate: {
-			column: "key",
-			op: "eq",
-			value: e
-		},
-		order: [],
-		take: 1,
-		skip: void 0,
-		projection: n
-	}))[0];
-	return {
-		name: "database",
-		presigns: !1,
-		bindDataStore: (t) => {
-			e = t;
-		},
-		put: (e, i, a) => n(async () => {
-			let n = await r(e);
-			return n ? await t().update(H, String(n.id), {
-				data: i,
-				contentType: a.contentType,
-				size: String(i.byteLength)
-			}) : await t().insert(H, {
-				id: A({
-					kind: "typeid",
-					prefix: "blob"
-				}, H),
-				key: e,
-				data: i,
-				contentType: a.contentType,
-				size: String(i.byteLength)
-			}), { size: i.byteLength };
-		}),
-		get: (e) => v.suspend(() => n(() => r(e)).pipe(v.flatMap((t) => t ? v.succeed({
-			bytes: rt(t.data),
-			contentType: String(t.contentType)
-		}) : v.fail(K("database", `no object at key '${e}'`, !1, 404))))),
-		delete: (e) => n(async () => {
-			let n = await r(e, ["id"]);
-			n && await t().delete(H, String(n.id));
-		}),
-		publicUrl: () => null,
-		getUrl: () => v.succeed(""),
-		head: (e) => n(async () => {
-			let t = await r(e, ["size"]);
-			return t ? { size: W(t.size, "blob size") } : null;
-		})
-	};
-}, at = (e) => {
-	let t = null, n = () => t || (t = (async () => {
-		let t;
-		try {
-			t = await import("@azure/storage-blob");
-		} catch (e) {
-			throw Error("the 'azure' storage provider requires the '@azure/storage-blob' optional dependency. Install it to enable it.", { cause: e });
-		}
-		let n = U.read("AZURE_STORAGE_ACCOUNT", e.accountName), r = U.read("AZURE_STORAGE_KEY", e.accountKey), i = n && r ? new t.StorageSharedKeyCredential(n, r) : null, a = U.read("AZURE_STORAGE_CONNECTION_STRING", e.connectionString);
-		return {
-			container: (a ? t.BlobServiceClient.fromConnectionString(a) : new t.BlobServiceClient(e.endpoint ?? `https://${n}.blob.core.windows.net`, i ?? void 0)).getContainerClient(e.container),
-			sdk: t,
-			cred: i
-		};
-	})(), t), r = (e) => v.tryPromise({
-		try: e,
-		catch: (e) => {
-			let t = e?.statusCode;
-			return K("azure", String(e?.message ?? e), Xe(t), t);
-		}
-	}), i = async (e) => {
-		if (!e) return /* @__PURE__ */ new Uint8Array();
-		let t = [];
-		for await (let n of e) t.push(typeof n == "string" ? new TextEncoder().encode(n) : new Uint8Array(n));
-		let n = t.reduce((e, t) => e + t.byteLength, 0), r = new Uint8Array(n), i = 0;
-		for (let e of t) r.set(e, i), i += e.byteLength;
-		return r;
-	}, a = async (t, r, i) => {
-		let { container: a, sdk: o, cred: s } = await n();
-		if (!s) throw Error("azure SAS requires accountName + accountKey (set them or AZURE_STORAGE_ACCOUNT/AZURE_STORAGE_KEY)");
-		let c = a.getBlockBlobClient(t), l = o.generateBlobSASQueryParameters({
-			containerName: e.container,
-			blobName: t,
-			permissions: o.BlobSASPermissions.parse(r),
-			startsOn: /* @__PURE__ */ new Date(Date.now() - 6e4),
-			expiresOn: new Date(Date.now() + i * 1e3)
-		}, s).toString();
-		return `${c.url}?${l}`;
-	};
-	return {
-		name: "azure",
-		presigns: !0,
-		put: (e, t, i) => r(async () => {
-			let { container: r } = await n();
-			return await r.getBlockBlobClient(e).uploadData(Buffer.from(t), { blobHTTPHeaders: { blobContentType: i.contentType } }), { size: t.byteLength };
-		}),
-		get: (e) => r(async () => {
-			let { container: t } = await n(), r = await t.getBlockBlobClient(e).download();
-			return {
-				bytes: await i(r.readableStreamBody),
-				contentType: r.contentType ?? "application/octet-stream"
-			};
-		}),
-		delete: (e) => r(async () => {
-			let { container: t } = await n();
-			await t.getBlockBlobClient(e).deleteIfExists();
-		}),
-		publicUrl: (t) => e.cdnBaseUrl ? `${e.cdnBaseUrl.replace(/\/$/, "")}/${t}` : null,
-		getUrl: (e, t) => r(() => a(e, "r", t)),
-		getUploadUrl: (e, t, n) => r(() => a(e, "cw", t)),
-		head: (e) => v.tryPromise({
-			try: async () => {
-				let { container: t } = await n();
-				try {
-					let n = await t.getBlockBlobClient(e).getProperties();
-					return {
-						size: n.contentLength ?? 0,
-						...n.etag === void 0 ? {} : { etag: n.etag }
-					};
-				} catch (e) {
-					if (e?.statusCode === 404) return null;
-					throw e;
-				}
-			},
-			catch: (e) => {
-				let t = e?.statusCode;
-				return K("azure", String(e?.message ?? e), Xe(t), t);
-			}
-		}),
-		getStream: (e) => r(async () => {
-			let { container: t } = await n(), r = await t.getBlockBlobClient(e).download();
-			return {
-				stream: ze("azure", () => r.readableStreamBody),
-				contentType: r.contentType ?? "application/octet-stream",
-				...r.contentLength === void 0 ? {} : { size: r.contentLength }
-			};
-		}),
-		putStream: (e, t, i) => r(async () => {
-			let { container: r } = await n(), a = await Be(t);
-			return await r.getBlockBlobClient(e).uploadStream(a, 4194304, 5, { blobHTTPHeaders: { blobContentType: i.contentType } }), { size: i.totalSize ?? (await r.getBlockBlobClient(e).getProperties()).contentLength ?? 0 };
-		}),
-		getRange: (e, t, a) => r(async () => {
-			let { container: r } = await n(), o = await r.getBlockBlobClient(e).download(t, a - t + 1);
-			return i(o.readableStreamBody);
-		})
-	};
-}, ot = (e = {
-	entries: 200,
-	bytes: 67108864,
-	pending: 32
-}) => {
-	let t = /* @__PURE__ */ new Map(), n = /* @__PURE__ */ new Map(), r = 0;
-	return { getOrCreate: (i, a) => {
-		let o = t.get(i);
-		if (o) return Promise.resolve(o);
-		let s = n.get(i);
-		if (s) return s;
-		if (n.size >= e.pending) return Promise.resolve(null);
-		let c = Promise.resolve().then(a).then((n) => {
-			if (n && e.entries > 0 && n.bytes.byteLength <= e.bytes) {
-				for (; t.size >= e.entries || r + n.bytes.byteLength > e.bytes;) {
-					let e = t.keys().next().value;
-					if (e === void 0) break;
-					r -= t.get(e).bytes.byteLength, t.delete(e);
-				}
-				t.set(i, n), r += n.bytes.byteLength;
-			}
-			return n;
-		}).finally(() => {
-			n.delete(i);
-		});
-		return n.set(i, c), c;
-	} };
-}, st = (e, t, n, r, i, a) => {
-	let o = n / r, s = Math.min(e, Math.round(t * o)), c = Math.min(t, Math.round(s / o)), l = (e, t) => Math.max(0, Math.min(t, e));
-	return {
-		left: l(Math.round(i * e - s / 2), e - s),
-		top: l(Math.round(a * t - c / 2), t - c),
-		width: s,
-		height: c
-	};
-}, ct = {
-	webp: "image/webp",
-	avif: "image/avif",
-	jpeg: "image/jpeg",
-	jpg: "image/jpeg",
-	png: "image/png"
-}, lt = (e) => {
-	if (!e) return null;
-	let t = new URLSearchParams(e), n = (e) => {
-		let n = t.get(e);
-		if (n == null) return;
-		let r = Number(n);
-		return Number.isFinite(r) && r > 0 ? Math.floor(r) : void 0;
-	}, r = n("w"), i = n("h"), a = n("q"), o = (t.get("format") ?? t.get("fm") ?? void 0)?.toLowerCase(), s = t.get("fit") ?? void 0, c = (t.get("fp") ?? "").split(",").map(Number), l = c.length === 2 && c.every((e) => Number.isFinite(e) && e >= 0 && e <= 1) ? {
-		x: c[0],
-		y: c[1]
-	} : void 0;
-	return r === void 0 && i === void 0 && !o && a === void 0 ? null : {
-		...r === void 0 ? {} : { w: r },
-		...i === void 0 ? {} : { h: i },
-		...o ? { format: o } : {},
-		...a === void 0 ? {} : { q: a },
-		...s ? { fit: s } : {},
-		...l ? { fp: l } : {}
-	};
-}, ut = (e) => e.startsWith("image/") && !e.includes("svg"), dt, ft = async () => (dt ??= import("sharp").then((e) => e.default ?? e, () => null), dt), pt = async (e, t) => t ? null : ut(e) ? await ft() === null ? "no-sharp" : "failed" : "not-an-image", mt = async (e, t, n) => {
-	if (!ut(t)) return null;
-	let r = await ft();
-	if (!r) return null;
-	try {
-		let i = r(Buffer.from(e), { failOn: "none" }), a = n.fit ?? "cover";
-		if (n.fp !== void 0 && n.w !== void 0 && n.h !== void 0 && a === "cover") {
-			let e = await i.metadata();
-			e.width !== void 0 && e.height !== void 0 && (i = i.extract(st(e.width, e.height, n.w, n.h, n.fp.x, n.fp.y)));
-		}
-		(n.w !== void 0 || n.h !== void 0) && (i = i.resize({
-			...n.w === void 0 ? {} : { width: n.w },
-			...n.h === void 0 ? {} : { height: n.h },
-			fit: n.fit ?? "cover",
-			withoutEnlargement: !0
-		}));
-		let o = n.format && ct[n.format] ? n.format : void 0, s = t;
-		if (o) {
-			let e = o === "jpg" ? "jpeg" : o;
-			i = i.toFormat(e, n.q === void 0 ? {} : { quality: n.q }), s = ct[o];
-		} else n.q !== void 0 && (t === "image/jpeg" || t === "image/webp") && (i = i.toFormat(t === "image/webp" ? "webp" : "jpeg", { quality: n.q }));
-		let c = await i.toBuffer();
-		return {
-			bytes: new Uint8Array(c),
-			contentType: s
-		};
-	} catch {
-		return null;
-	}
-}, ht = async (e, t, n) => {
-	if (!ut(t) || n.rotate === void 0 && n.flip !== !0 && n.flop !== !0 && n.grayscale !== !0 && n.crop === void 0) return null;
-	let r = await ft();
-	if (!r) return null;
-	try {
-		let i = r(Buffer.from(e), { failOn: "none" });
-		return n.crop !== void 0 && (i = i.extract(n.crop)), n.rotate !== void 0 && (i = i.rotate(n.rotate)), n.flip === !0 && (i = i.flip()), n.flop === !0 && (i = i.flop()), n.grayscale === !0 && (i = i.grayscale()), {
-			bytes: new Uint8Array(await i.toBuffer()),
-			contentType: t
-		};
-	} catch {
-		return null;
-	}
-}, gt = ot(), _t = (e, t, n) => JSON.stringify([
-	e,
-	t,
-	n.w,
-	n.h,
-	n.format,
-	n.q,
-	n.fit,
-	n.fp?.x,
-	n.fp?.y
-]), vt = async (e, t, n, r) => gt.getOrCreate(_t(e, n, r), () => mt(t, n, r)), yt = (e) => {
-	let t = we(16).toString("hex");
-	return `${t}:${Ee(e, t, 32).toString("hex")}`;
-}, bt = (e, t) => {
-	if (!e || !t) return !1;
-	let [n, r] = t.split(":");
-	if (!n || !r) return !1;
-	let i = Buffer.from(r, "hex"), a = Ee(e, n, i.length);
-	return a.length === i.length && L(a, i);
-}, xt = (e) => Array.isArray(e) ? e.filter((e) => typeof e == "string") : [], St = (e) => xt(e.metadata?.roles), Ct = (e) => xt(e.scopes), wt = (e, t) => e.some((e) => t.includes(e)), Tt = (e) => xt(e.metadata?.groups), Et = (e) => typeof e == "boolean" ? v.succeed(e) : v.isEffect(e) ? e : v.promise(() => e), Dt = (e, t, n = {}) => v.gen(function* () {
-	if (t.id && e.ownerId && t.id === e.ownerId) return !0;
-	let r = e.accessPolicy ?? [];
-	if (r.length === 0) return !1;
-	let i = n.resolveGroups ? yield* v.promise(async () => await n.resolveGroups(t)) : Tt(t);
-	for (let a of r) if (yield* Ot(a, e, t, i, n)) return !0;
-	return !1;
-}), Ot = (e, t, n, r, i) => v.gen(function* () {
-	let a = !1, o = (e) => (a = !0, e);
-	if (e.owner !== void 0 && e.owner && !o(!!n.id && !!t.ownerId && n.id === t.ownerId) || e.tenant !== void 0 && e.tenant && !o(!!n.tenantId && n.tenantId === t.tenantId) || e.apiKey !== void 0 && e.apiKey && !o(n.type === "apiKey") || e.roles && e.roles.length > 0 && !o(wt(St(n), e.roles)) || e.groups && e.groups.length > 0 && !o(wt(r, e.groups)) || e.scopes && e.scopes.length > 0 && !o(wt(Ct(n), e.scopes)) || e.password !== void 0 && e.password && !o(bt(i.password, t.passwordHash))) return !1;
-	if (e.guard) {
-		let r = i.guards?.[e.guard];
-		if (!o(r ? yield* Et(r({
-			subject: n,
-			ref: t
-		})) : !1)) return !1;
-	}
-	return a;
-}), kt = (e, t) => {
-	let n = [];
-	e.id && n.push({
-		type: e.type === "apiKey" ? "apiKey" : "user",
-		id: e.id
-	});
-	for (let e of t) n.push({
-		type: "group",
-		id: e
-	});
-	return n;
-}, At = (e, t, n, r, i) => {
-	let a = kt(t, n);
-	return e.some((e) => e.expiresAt && e.expiresAt.getTime() < i || r === "write" && e.permission !== "write" ? !1 : a.some((t) => t.type === e.principalType && t.id === e.principalId));
-}, jt = (e, t) => t.resolveGroups ? v.promise(async () => await t.resolveGroups(e)) : v.succeed(Tt(e)), q = () => U.read("VOLTRO_STORAGE_SECRET") ?? ce(), J = (e) => (typeof e == "string" ? Buffer.from(e, "utf8") : e).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, ""), Y = (e) => {
-	let t = e.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - e.length % 4) % 4);
-	return Buffer.from(t, "base64");
-}, Mt = (e, t, n = q(), r = "/_voltro/storage") => {
-	if (!n) throw Error("signGrant: secret must be a non-empty string");
-	let i = {
-		refId: e,
-		audience: r,
-		exp: Math.floor(Date.now() / 1e3) + Math.floor(t)
-	}, a = J(JSON.stringify(i));
-	return `${a}.${J(I("sha256", n).update(a).digest())}`;
-}, Nt = (e, t = q()) => {
-	if (!e || !t) return null;
-	let n = e.indexOf(".");
-	if (n <= 0 || n === e.length - 1) return null;
-	let r = e.slice(0, n), i = e.slice(n + 1), a = I("sha256", t).update(r).digest(), o = Y(i);
-	if (o.length !== a.length || !L(o, a)) return null;
-	try {
-		let e = JSON.parse(Y(r).toString("utf8"));
-		return typeof e.audience != "string" || !e.audience || typeof e.refId != "string" || typeof e.exp != "number" || e.exp < Math.floor(Date.now() / 1e3) ? null : e;
-	} catch {
-		return null;
-	}
-}, Pt = (e) => e.version === 1 ? e.access === void 0 || e.vis === "private" && y.isSuccess(S.decodeUnknownExit(ae, { onExcessProperty: "error" })(e.access)) : !1, Ft = (e, t, n = q()) => {
-	if (!n) throw Error("signUploadTicket: secret must be a non-empty string");
-	let r = {
-		...e,
-		version: 1,
-		exp: Math.floor(Date.now() / 1e3) + Math.floor(t)
-	}, i = J(JSON.stringify(r));
-	return `${i}.${J(I("sha256", n).update(`u:${i}`).digest())}`;
-}, It = (e, t = q()) => {
-	if (!e || !t) return null;
-	let n = e.indexOf(".");
-	if (n <= 0 || n === e.length - 1) return null;
-	let r = e.slice(0, n), i = e.slice(n + 1), a = I("sha256", t).update(`u:${r}`).digest(), o = Y(i);
-	if (o.length !== a.length || !L(o, a)) return null;
-	try {
-		let e = JSON.parse(Y(r).toString("utf8"));
-		return !Pt(e) || e.operationId !== void 0 && (typeof e.operationId != "string" || !e.operationId.trim() || e.operationId.length > 200) || typeof e.instance != "string" || !e.instance || typeof e.ct != "string" || typeof e.exp != "number" || e.vis !== "public" && e.vis !== "private" || e.replicaId !== void 0 && (typeof e.replicaId != "string" || !e.replicaId.trim()) || e.exp < Math.floor(Date.now() / 1e3) ? null : e;
-	} catch {
-		return null;
-	}
-}, Lt = (e, t, n = q()) => {
-	if (!n) throw Error("signFinalizeTicket: secret must be a non-empty string");
-	let r = {
-		...e,
-		version: 1,
-		exp: Math.floor(Date.now() / 1e3) + Math.floor(t)
-	}, i = J(JSON.stringify(r));
-	return `${i}.${J(I("sha256", n).update(`f:${i}`).digest())}`;
-}, Rt = (e, t = q()) => {
-	if (!e || !t) return null;
-	let n = e.indexOf(".");
-	if (n <= 0 || n === e.length - 1) return null;
-	let r = e.slice(0, n), i = e.slice(n + 1), a = I("sha256", t).update(`f:${r}`).digest(), o = Y(i);
-	if (o.length !== a.length || !L(o, a)) return null;
-	try {
-		let e = JSON.parse(Y(r).toString("utf8"));
-		return !Pt(e) || typeof e.key != "string" || e.key.length === 0 || typeof e.instance != "string" || !e.instance || typeof e.ct != "string" || typeof e.exp != "number" || e.vis !== "public" && e.vis !== "private" || e.exp < Math.floor(Date.now() / 1e3) ? null : e;
-	} catch {
-		return null;
-	}
-}, zt = (e, t, n = q()) => {
-	if (!n) throw Error("signResumableTicket: secret must be a non-empty string");
-	let r = {
-		...e,
-		version: 1,
-		exp: Math.floor(Date.now() / 1e3) + Math.floor(t)
-	}, i = J(JSON.stringify(r));
-	return `${i}.${J(I("sha256", n).update(`r:${i}`).digest())}`;
-}, Bt = (e, t = q()) => {
-	if (!e || !t) return null;
-	let n = e.indexOf(".");
-	if (n <= 0 || n === e.length - 1) return null;
-	let r = e.slice(0, n), i = e.slice(n + 1), a = I("sha256", t).update(`r:${r}`).digest(), o = Y(i);
-	if (o.length !== a.length || !L(o, a)) return null;
-	try {
-		let e = JSON.parse(Y(r).toString("utf8"));
-		return !Pt(e) || typeof e.id != "string" || e.id.length === 0 || typeof e.size != "number" || e.size < 0 || typeof e.instance != "string" || !e.instance || typeof e.ct != "string" || typeof e.exp != "number" || e.vis !== "public" && e.vis !== "private" || e.exp < Math.floor(Date.now() / 1e3) ? null : e;
-	} catch {
-		return null;
-	}
-}, Vt = (e, t, n = q()) => {
-	if (!n) throw Error("signMultipartTicket: secret must be a non-empty string");
-	let r = {
-		...e,
-		version: 1,
-		exp: Math.floor(Date.now() / 1e3) + Math.floor(t)
-	}, i = J(JSON.stringify(r));
-	return `${i}.${J(I("sha256", n).update(`m:${i}`).digest())}`;
-}, Ht = (e, t = q()) => {
-	if (!e || !t) return null;
-	let n = e.indexOf(".");
-	if (n <= 0 || n === e.length - 1) return null;
-	let r = e.slice(0, n), i = e.slice(n + 1), a = I("sha256", t).update(`m:${r}`).digest(), o = Y(i);
-	if (o.length !== a.length || !L(o, a)) return null;
-	try {
-		let e = JSON.parse(Y(r).toString("utf8"));
-		return !Pt(e) || typeof e.key != "string" || e.key.length === 0 || typeof e.uploadId != "string" || e.uploadId.length === 0 || typeof e.instance != "string" || !e.instance || typeof e.ct != "string" || typeof e.exp != "number" || e.vis !== "public" && e.vis !== "private" || e.exp < Math.floor(Date.now() / 1e3) ? null : e;
-	} catch {
-		return null;
-	}
-}, Ut = (e, t) => {
-	if (!t || t.length === 0) return !0;
-	let n = e.toLowerCase();
-	return t.some((e) => {
-		let t = e.toLowerCase();
-		return t.endsWith("/*") ? n.startsWith(t.slice(0, -1)) : n === t;
-	});
-}, Wt = [
-	{
-		ct: /^image\/png$/,
-		offset: 0,
-		magic: [
-			137,
-			80,
-			78,
-			71
-		]
-	},
-	{
-		ct: /^image\/jpe?g$/,
-		offset: 0,
-		magic: [
-			255,
-			216,
-			255
-		]
-	},
-	{
-		ct: /^image\/gif$/,
-		offset: 0,
-		magic: [
-			71,
-			73,
-			70,
-			56
-		]
-	},
-	{
-		ct: /^image\/webp$/,
-		offset: 0,
-		magic: [
-			82,
-			73,
-			70,
-			70
-		]
-	},
-	{
-		ct: /^image\/bmp$/,
-		offset: 0,
-		magic: [66, 77]
-	},
-	{
-		ct: /^application\/pdf$/,
-		offset: 0,
-		magic: [
-			37,
-			80,
-			68,
-			70
-		]
-	},
-	{
-		ct: /^application\/zip$/,
-		offset: 0,
-		magic: [
-			80,
-			75,
-			3,
-			4
-		]
-	},
-	{
-		ct: /^application\/gzip$/,
-		offset: 0,
-		magic: [31, 139]
-	}
-], Gt = (e, t) => {
-	let n = t.toLowerCase(), r = Wt.find((e) => e.ct.test(n));
-	return r ? e.length < r.offset + r.magic.length ? !1 : r.magic.every((t, n) => e[r.offset + n] === t) : !0;
-}, Kt = (e, t, n) => n ? n.maxBytes !== void 0 && e.byteLength > n.maxBytes ? {
-	reason: "too-large",
-	detail: `${e.byteLength} bytes exceeds the ${n.maxBytes}-byte limit`
-} : Ut(t, n.allowedContentTypes) ? n.sniff && !Gt(e, t) ? {
-	reason: "content-mismatch",
-	detail: `bytes do not match the declared content type '${t}'`
-} : null : {
-	reason: "content-type-not-allowed",
-	detail: `content type '${t}' is not in the allow-list`
-} : null, qt = async (e, t, n) => {
-	if (!ut(t)) return { bytes: e };
-	let r = await ft();
-	if (!r) return { bytes: e };
-	try {
-		let t = e;
-		if (n?.normalize) {
-			let n = await r(Buffer.from(e), { failOn: "none" }).rotate().toBuffer();
-			t = new Uint8Array(n);
-		}
-		let i = await r(Buffer.from(t), { failOn: "none" }).metadata(), a = await r(Buffer.from(t), { failOn: "none" }).resize({
-			width: 24,
-			height: 24,
-			fit: "inside",
-			withoutEnlargement: !0
-		}).webp({ quality: 40 }).toBuffer().catch(() => null);
-		return {
-			bytes: t,
-			...typeof i.width == "number" ? { width: i.width } : {},
-			...typeof i.height == "number" ? { height: i.height } : {},
-			...a ? { placeholder: `data:image/webp;base64,${a.toString("base64")}` } : {}
-		};
-	} catch {
-		return { bytes: e };
-	}
-}, Jt = 67108864, Yt = (e) => new n({
-	reason: "too-large",
-	detail: `remote body exceeds the ${e}-byte ingest limit`
-}), Xt = (e, t) => new n({
-	reason: "blocked-source",
-	detail: `will not fetch ${e}: ${t}`
-}), Zt = (e, r, i = {}) => v.suspend(() => {
-	let a = r ?? Jt;
-	return !Number.isSafeInteger(a) || a < 0 ? v.fail(new t({
-		provider: "ingest",
-		message: "limits.maxBytes must be a non-negative safe integer",
-		transient: !1
-	})) : v.tryPromise({
-		try: async (n) => {
-			let r = e, o;
-			for (let e = 0;; e++) {
-				let t = De(r, { ...i.allowHosts === void 0 ? {} : { allowHosts: i.allowHosts } });
-				if (t !== null) throw Xt(r, t);
-				o = await fetch(r, {
-					signal: n,
-					redirect: "manual"
-				});
-				let a = o.headers.get("location");
-				if (o.status < 300 || o.status >= 400 || a === null) break;
-				if (await o.body?.cancel().catch(() => {}), e >= (i.maxRedirects ?? 5)) throw Xt(r, "too many redirects");
-				r = new URL(a, r).toString();
-			}
-			let s;
-			try {
-				if (!o.ok) throw new t({
-					provider: "ingest",
-					message: `remote server returned HTTP ${o.status}`,
-					transient: o.status === 429 || o.status >= 500,
-					status: o.status
-				});
-				let e = o.headers.get("content-length"), n = o.headers.get("content-encoding")?.trim().toLowerCase();
-				if ((!n || n === "identity") && e !== null && /^\d+$/.test(e) && BigInt(e) > BigInt(a)) throw Yt(a);
-				let r = /* @__PURE__ */ new Uint8Array(), i = 0;
-				if (o.body !== null) for (s = o.body.getReader();;) {
-					let e = await s.read();
-					if (e.done) break;
-					if (e.value.byteLength > a - i) throw Yt(a);
-					if (e.value.byteLength !== 0) {
-						let t = i + e.value.byteLength;
-						if (t > r.byteLength) {
-							let e = Math.min(a, Math.max(65536, r.byteLength * 2, t)), n = new Uint8Array(e);
-							n.set(r), r = n;
-						}
-						r.set(e.value, i), i = t;
-					}
-				}
-				return {
-					bytes: i === r.byteLength ? r : r.slice(0, i),
-					contentType: o.headers.get("content-type")?.split(";")[0]?.trim() || "application/octet-stream"
-				};
-			} finally {
-				s === void 0 ? await o.body?.cancel().catch(() => {}) : (await s.cancel().catch(() => {}), s.releaseLock());
-			}
-		},
-		catch: (e) => e instanceof n || e instanceof t ? e : new t({
-			provider: "ingest",
-			message: "remote fetch or body read failed",
-			transient: !0
-		})
-	});
-}), Qt = (e, t) => v.suspend(() => {
-	if (t === void 0) return e;
-	if (t.aborted) return v.interrupt;
-	let n = v.callback((e) => {
-		let n = () => e(v.interrupt);
-		return t.addEventListener("abort", n, { once: !0 }), t.aborted && n(), v.sync(() => t.removeEventListener("abort", n));
-	});
-	return v.raceFirst(e, n);
-}), $t = (e) => {
-	let r = (e, n) => v.tryPromise({
-		try: n,
-		catch: (n) => {
-			let r = Ye(n);
-			if (r !== void 0) return r;
-			let i = G(n, "metadata"), a = new t({
-				provider: "metadata",
-				message: `Storage ${e} was not confirmed: ${i.message}; retain the operation identity for recovery`,
-				transient: i.transient,
-				...i.status === void 0 ? {} : { status: i.status }
-			});
-			return Object.defineProperty(a, "cause", {
-				value: n,
-				configurable: !0
-			}), a;
-		}
-	});
-	return {
-		put: (t) => v.gen(function* () {
-			if (t.bytes.byteLength !== t.ref.size || Ce("sha256").update(t.bytes).digest("hex") !== t.identity.checksum) return yield* v.fail(new n({
-				reason: "operation-content-mismatch",
-				detail: "Storage operation bytes do not match their reserved identity"
-			}));
-			let i = yield* r("put reservation", () => e.metadata.reserve(t.identity, t.ref, t.quota, t.claim)), a = i.outcome;
-			return i.ready ? {
-				ref: i.ref,
-				outcome: a
-			} : (yield* e.provider.put(i.ref.key, t.bytes, {
-				contentType: i.ref.contentType,
-				public: i.ref.visibility === "public"
-			}), {
-				ref: yield* r("put confirmation", () => e.metadata.confirm(t.identity, t.claim)),
-				outcome: a
-			});
-		}),
-		delete: (t, n, i) => v.gen(function* () {
-			let a = yield* r("delete acceptance", () => e.metadata.beginDelete(t, n, i));
-			"operation" in a && (a.operation.deleteKey !== null && (yield* e.provider.delete(a.operation.deleteKey)), yield* r("delete confirmation", () => e.metadata.confirmDelete(a.identity)));
-		})
-	};
-}, en = async (e) => {
-	let { createHash: t } = await import("node:crypto");
-	return t("sha256").update(e).digest("hex");
-}, tn = (e, t, n) => `${e?.replace(/\/+$/, "") ?? ""}${n}/${t}`, nn = (e) => {
-	let t = /* @__PURE__ */ new Map(), n = {
-		public: 0,
-		private: 0
-	};
-	for (let r of e) {
-		let e = r.tenantId ?? "(global)", i = t.get(e) ?? {
-			count: 0,
-			bytes: 0
-		};
-		i.count = Je(i.count, r.count, "ref count"), i.bytes = Je(i.bytes, r.bytes, "usage bytes"), t.set(e, i), r.visibility === "public" ? n.public = Je(n.public, r.count, "public ref count") : n.private = Je(n.private, r.count, "private ref count");
-	}
-	return {
-		byTenant: Object.fromEntries(t),
-		visibility: n
-	};
-}, rn = (e, t) => {
-	if (t.search && ![
-		e.id,
-		e.key,
-		e.contentType,
-		e.ownerId,
-		e.tenantId
-	].some((e) => e?.toLowerCase().includes(t.search.toLowerCase())) || t.tenantId !== void 0 && (e.tenantId ?? null) !== (t.tenantId ?? null) || t.ownerId !== void 0 && e.ownerId !== t.ownerId || !t.includeDerived && e.derivedFrom != null) return !1;
-	if (t.folder !== void 0) {
-		let n = t.folder.replace(/\/+$/, ""), r = (e.folder ?? "").replace(/\/+$/, "");
-		if (r !== n && !r.startsWith(`${n}/`)) return !1;
-	}
-	if (t.tags.length > 0) {
-		let n = e.tags ?? [];
-		if (!t.tags.every((e) => n.includes(e))) return !1;
-	}
-	return !0;
-}, an = (e) => e ?? "global", on = () => {
-	let e = /* @__PURE__ */ new Map(), t = /* @__PURE__ */ new Map();
-	return {
-		statistics: () => v.try({
-			try: () => nn((function* () {
-				for (let t of e.values()) yield {
-					tenantId: t.tenantId,
-					visibility: t.visibility,
-					count: 1,
-					bytes: t.size
-				};
-			})()),
-			catch: (e) => G(e, "refstore")
-		}),
-		insert: (t) => v.try({
-			try: () => {
-				W(t.size, "ref size"), e.set(t.id, t);
-			},
-			catch: (e) => G(e, "refstore")
-		}),
-		getById: (t) => v.sync(() => e.get(t) ?? null),
-		delete: (t) => v.sync(() => e.delete(t)),
-		listRecent: (t) => v.sync(() => [...e.values()].sort((e, t) => t.createdAt.getTime() - e.createdAt.getTime() || t.id.localeCompare(e.id)).slice(0, t)),
-		countByKey: (t, n) => v.sync(() => [...e.values()].filter((e) => e.bucket === t && e.key === n).length),
-		countPublicByKey: (t, n) => v.sync(() => [...e.values()].filter((e) => e.bucket === t && e.key === n && e.visibility === "public").length),
-		setVisibility: (t, n) => v.sync(() => {
-			let r = e.get(t);
-			if (r === void 0) return null;
-			let i = {
-				...r,
-				visibility: n
-			};
-			return e.set(t, i), i;
-		}),
-		usageByTenant: (t) => v.try({
-			try: () => {
-				let n = 0, r = 0;
-				for (let i of e.values()) (i.tenantId ?? null) === (t ?? null) && (n = Je(n, i.size, "usage bytes"), r++);
-				return {
-					bytes: n,
-					count: r
-				};
-			},
-			catch: (e) => G(e, "refstore")
-		}),
-		consumeUsage: (e, n, r) => v.try({
-			try: () => {
-				let i = an(e), a = t.get(i) ?? {
-					bytes: 0,
-					count: 0
-				};
-				W(n.bytes, "usage byte delta"), W(n.count, "usage count delta");
-				let o = Number.isSafeInteger(a.bytes + n.bytes) && Number.isSafeInteger(a.count + n.count) && (r?.maxBytes === void 0 || a.bytes + n.bytes <= r.maxBytes) && (r?.maxCount === void 0 || a.count + n.count <= r.maxCount);
-				return o && t.set(i, {
-					bytes: a.bytes + n.bytes,
-					count: a.count + n.count
-				}), {
-					allowed: o,
-					bytes: a.bytes,
-					count: a.count
-				};
-			},
-			catch: (e) => G(e, "refstore")
-		}),
-		releaseUsage: (e, n) => v.try({
-			try: () => {
-				let r = an(e), i = t.get(r);
-				W(n.bytes, "usage byte delta"), W(n.count, "usage count delta"), i && t.set(r, {
-					bytes: Math.max(0, i.bytes - n.bytes),
-					count: Math.max(0, i.count - n.count)
-				});
-			},
-			catch: (e) => G(e, "refstore")
-		}),
-		listByDerivedFrom: (t) => v.sync(() => [...e.values()].filter((e) => (e.derivedFrom ?? null) === t)),
-		listRefs: (t) => v.sync(() => [...e.values()].filter((e) => rn(e, t)).sort((e, t) => t.createdAt.getTime() - e.createdAt.getTime() || t.id.localeCompare(e.id)).slice(t.offset, t.offset + t.limit))
-	};
-}, sn = (e) => Array.isArray(e) && e.every((e) => typeof e == "string") ? e : null, X = (e) => ({
-	id: String(e.id),
-	tenantId: e.tenantId ?? null,
-	ownerId: e.ownerId ?? null,
-	bucket: String(e.bucket),
-	key: String(e.key),
-	contentType: String(e.contentType),
-	size: W(e.size, "ref size"),
-	checksum: String(e.checksum),
-	visibility: e.visibility === "public" ? "public" : "private",
-	accessPolicy: e.accessPolicy ?? null,
-	passwordHash: e.passwordHash ?? null,
-	createdAt: e.createdAt instanceof Date ? e.createdAt : new Date(String(e.createdAt)),
-	width: e.width ?? null,
-	height: e.height ?? null,
-	duration: e.duration ?? null,
-	placeholder: e.placeholder ?? null,
-	folder: e.folder ?? null,
-	tags: sn(e.tags),
-	alt: e.alt ?? null,
-	caption: e.caption ?? null,
-	derivedFrom: e.derivedFrom ?? null,
-	kind: e.kind ?? null
-}), Z = (e) => v.tryPromise({
-	try: e,
-	catch: (e) => G(e, "refstore", !0)
-}), cn = async (e, t) => (await e.query({
-	table: "_voltro_storage_usage",
-	predicate: {
-		column: "tenantId",
-		op: "eq",
-		value: t
-	},
-	order: [],
-	take: 1,
-	skip: void 0,
-	projection: void 0
-}))[0] ?? null, ln = (e) => ({
-	statistics: () => Z(async () => nn((await e.query({
-		table: B,
-		predicate: void 0,
-		order: [],
-		take: void 0,
-		skip: void 0,
-		projection: void 0,
-		groupBy: ["tenantId", "visibility"],
-		aggregations: [
-			de("tenantId"),
-			de("visibility"),
-			{
-				op: "count",
-				alias: "count"
-			},
-			{
-				op: "sum",
-				column: "size",
-				alias: "bytes"
-			}
-		]
-	})).map((e) => ({
-		tenantId: e.tenantId == null ? null : String(e.tenantId),
-		visibility: String(e.visibility),
-		count: W(e.count, "ref count"),
-		bytes: W(e.bytes ?? 0, "usage bytes")
-	})))),
-	insert: (t) => Z(() => e.insert(B, {
-		...t,
-		size: String(W(t.size, "ref size"))
-	})),
-	getById: (t) => Z(async () => {
-		let n = await e.query({
-			table: B,
-			predicate: {
-				column: "id",
-				op: "eq",
-				value: t
-			},
-			order: [],
-			take: 1,
-			skip: void 0,
-			projection: void 0
-		});
-		return n[0] ? X(n[0]) : null;
-	}),
-	delete: (t) => Z(() => e.delete(B, t)),
-	listRecent: (t) => Z(async () => (await e.query({
-		table: B,
-		predicate: void 0,
-		order: [{
-			column: "createdAt",
-			direction: "desc"
-		}],
-		take: t,
-		skip: void 0,
-		projection: void 0
-	})).map(X)),
-	countByKey: (t, n) => Z(async () => W((await e.query({
-		table: B,
-		predicate: { and: [{
-			column: "bucket",
-			op: "eq",
-			value: t
-		}, {
-			column: "key",
-			op: "eq",
-			value: n
-		}] },
-		order: [],
-		take: void 0,
-		skip: void 0,
-		projection: void 0,
-		aggregations: [{
-			op: "count",
-			alias: "count"
-		}]
-	}))[0]?.count ?? 0, "ref count")),
-	countPublicByKey: (t, n) => Z(async () => W((await e.query({
-		table: B,
-		predicate: { and: [
-			{
-				column: "bucket",
-				op: "eq",
-				value: t
-			},
-			{
-				column: "key",
-				op: "eq",
-				value: n
-			},
-			{
-				column: "visibility",
-				op: "eq",
-				value: "public"
-			}
-		] },
-		order: [],
-		take: void 0,
-		skip: void 0,
-		projection: void 0,
-		aggregations: [{
-			op: "count",
-			alias: "count"
-		}]
-	}))[0]?.count ?? 0, "ref count")),
-	setVisibility: (t, n) => Z(async () => {
-		let r = await e.update(B, t, { visibility: n });
-		return r ? X(r) : null;
-	}),
-	usageByTenant: (t) => Z(async () => {
-		let n = await e.query({
-			table: B,
-			predicate: {
-				column: "tenantId",
-				op: "eq",
-				value: t
-			},
-			order: [],
-			take: void 0,
-			skip: void 0,
-			projection: void 0,
-			aggregations: [
-				{
-					op: "count",
-					alias: "count"
-				},
-				{
-					op: "sum",
-					column: "size",
-					alias: "bytes"
-				},
-				{
-					op: "min",
-					column: "size",
-					alias: "minSize"
-				},
-				{
-					op: "max",
-					column: "size",
-					alias: "maxSize"
-				}
-			]
-		});
-		return W(n[0]?.count ?? 0, "ref count") > 0 && (W(n[0]?.minSize, "ref size"), W(n[0]?.maxSize, "ref size")), {
-			bytes: W(n[0]?.bytes ?? 0, "usage bytes"),
-			count: W(n[0]?.count ?? 0, "ref count")
-		};
-	}),
-	consumeUsage: (t, n, r) => Z(async () => {
-		let i = an(t);
-		W(n.bytes, "usage byte delta"), W(n.count, "usage count delta");
-		for (let t = 0; t < 32; t++) {
-			t > 0 && await new Promise((e) => setTimeout(e, t));
-			let a = await cn(e, i), o = a ? W(a.bytes, "usage bytes") : 0, s = a ? W(a.count, "ref count") : 0;
-			if (!(Number.isSafeInteger(o + n.bytes) && Number.isSafeInteger(s + n.count) && (r?.maxBytes === void 0 || o + n.bytes <= r.maxBytes) && (r?.maxCount === void 0 || s + n.count <= r.maxCount))) return {
-				allowed: !1,
-				bytes: o,
-				count: s
-			};
-			if (a) {
-				if (await e.updateMany("_voltro_storage_usage", {
-					bytes: String(o + n.bytes),
-					count: String(s + n.count),
-					updatedAt: /* @__PURE__ */ new Date()
-				}, { where: ue(k("id", String(a.id)), k("bytes", a.bytes), k("count", a.count)) }) === 1) return {
-					allowed: !0,
-					bytes: o,
-					count: s
-				};
-			} else {
-				let t = A({
-					kind: "typeid",
-					prefix: "susage"
-				}, Ue), r = await e.insertIgnore(Ue, {
-					id: t,
-					tenantId: i,
-					bytes: String(n.bytes),
-					count: String(n.count),
-					updatedAt: /* @__PURE__ */ new Date()
-				}, { conflictColumns: ["tenantId"] });
-				if (String(r.id) === t) return {
-					allowed: !0,
-					bytes: 0,
-					count: 0
-				};
-			}
-		}
-		throw T("Storage quota reservation contended after 32 attempts; retry");
-	}),
-	releaseUsage: (t, n) => Z(async () => {
-		let r = an(t);
-		W(n.bytes, "usage byte delta"), W(n.count, "usage count delta");
-		for (let t = 0; t < 32; t++) {
-			t > 0 && await new Promise((e) => setTimeout(e, t));
-			let i = await cn(e, r);
-			if (!i) return;
-			let a = W(i.bytes, "usage bytes"), o = W(i.count, "ref count");
-			if (await e.updateMany("_voltro_storage_usage", {
-				bytes: String(Math.max(0, a - n.bytes)),
-				count: String(Math.max(0, o - n.count)),
-				updatedAt: /* @__PURE__ */ new Date()
-			}, { where: ue(k("id", String(i.id)), k("bytes", i.bytes), k("count", i.count)) }) === 1) return;
-		}
-		throw T("Storage quota release contended after 32 attempts; retry");
-	}),
-	listByDerivedFrom: (t) => Z(async () => (await e.query({
-		table: B,
-		predicate: {
-			column: "derivedFrom",
-			op: "eq",
-			value: t
-		},
-		order: [{
-			column: "createdAt",
-			direction: "asc"
-		}],
-		take: void 0,
-		skip: void 0,
-		projection: void 0
-	})).map(X)),
-	listRefs: (t) => Z(async () => {
-		let n = [];
-		t.tenantId !== void 0 && n.push(k("tenantId", t.tenantId)), t.ownerId !== void 0 && n.push(k("ownerId", t.ownerId)), t.search && n.push(N(...[
-			"id",
-			"key",
-			"contentType",
-			"ownerId",
-			"tenantId"
-		].map((e) => fe(e, t.search)))), t.includeDerived || n.push(me("derivedFrom"));
-		let r = t.folder === void 0 && t.tags.length === 0, i = n.length ? ue(...n) : void 0, a = await e.query({
-			table: B,
-			predicate: i,
-			order: [{
-				column: "createdAt",
-				direction: "desc"
-			}, {
-				column: "id",
-				direction: "desc"
-			}],
-			take: r ? t.limit : void 0,
-			skip: r ? t.offset : void 0,
-			projection: void 0
-		});
-		return r ? a.map(X) : a.map(X).filter((e) => rn(e, t)).slice(t.offset, t.offset + t.limit);
-	})
-}), un = () => {
-	let e = /* @__PURE__ */ new Map();
-	return {
-		insert: (t) => v.sync(() => {
-			e.set(t.id, t);
-		}),
-		delete: (t) => v.sync(() => {
-			e.delete(t);
-		}),
-		getById: (t) => v.sync(() => e.get(t) ?? null),
-		listByRef: (t) => v.sync(() => [...e.values()].filter((e) => e.refId === t)),
-		deleteByRef: (t) => v.sync(() => {
-			for (let [n, r] of e) r.refId === t && e.delete(n);
-		})
-	};
-}, dn = (e) => ({
-	id: String(e.id),
-	refId: String(e.refId),
-	principalType: e.principalType,
-	principalId: String(e.principalId),
-	permission: e.permission === "write" ? "write" : "read",
-	createdAt: e.createdAt instanceof Date ? e.createdAt : new Date(String(e.createdAt)),
-	expiresAt: e.expiresAt ? e.expiresAt instanceof Date ? e.expiresAt : new Date(String(e.expiresAt)) : null,
-	createdBy: e.createdBy ?? null
-}), fn = (e) => ({
-	insert: (t) => Z(() => e.insert(V, { ...t })),
-	delete: (t) => Z(() => e.delete(V, t)),
-	getById: (t) => Z(async () => {
-		let n = (await e.query({
-			table: V,
-			predicate: {
-				column: "id",
-				op: "eq",
-				value: t
-			},
-			order: [],
-			take: 1,
-			skip: void 0,
-			projection: void 0
-		}))[0];
-		return n ? dn(n) : null;
-	}),
-	listByRef: (t) => Z(async () => (await e.query({
-		table: V,
-		predicate: {
-			column: "refId",
-			op: "eq",
-			value: t
-		},
-		order: [{
-			column: "createdAt",
-			direction: "desc"
-		}],
-		take: void 0,
-		skip: void 0,
-		projection: void 0
-	})).map(dn)),
-	deleteByRef: (t) => Z(async () => {
-		let n = await e.query({
-			table: V,
-			predicate: {
-				column: "refId",
-				op: "eq",
-				value: t
-			},
-			order: [],
-			take: void 0,
-			skip: void 0,
-			projection: void 0
-		});
-		for (let t of n) await e.delete(V, String(t.id));
-	})
-}), pn = () => A({
-	kind: "typeid",
-	prefix: "file"
-}, B), mn = () => A({
-	kind: "typeid",
-	prefix: "grant"
-}, V), hn = (i) => {
-	let { provider: a, refStore: o, grantStore: s, bucket: c } = i, l = i.access ?? {}, u = i.attempts ?? 3, d = i.urlExpiresInSec ?? 3600, f = (e) => tn(i.publicBaseUrl, e, i.httpPath ?? "/_voltro/storage"), p = x.max([x.recurs(Math.max(0, u - 1)), x.exponential("100 millis")]).pipe(x.while(({ input: e }) => e.transient)), m = (e, t, n) => [
-		i.tenantPrefix,
-		e ?? "global",
-		n ?? t
-	].filter(Boolean).join("/"), ee = (e) => {
-		if (e === void 0) return v.succeed(void 0);
-		let n = e.length === 0 ? "empty" : e.includes("\0") ? "contains NUL" : e.startsWith("/") || e.startsWith("\\") ? "starts with a path separator" : e.includes("\\") ? "contains a backslash" : e.split("/").some((e) => e === "" || e === "." || e === "..") ? "contains an empty, \".\" or \"..\" segment" : void 0;
-		return n === void 0 ? v.succeed(e) : v.fail(new t({
-			provider: a.name,
-			message: `storage key rejected: ${n}`,
-			transient: !1,
-			status: 400
-		}));
-	}, te = (e, t, n) => [
-		i.tenantPrefix,
-		e ?? "global",
-		"_incoming",
-		t,
-		String(n).padStart(6, "0")
-	].filter(Boolean).join("/"), ne = (e, t) => t === void 0 || e.tenantId === t, h = (e, n) => ne(e, n) ? v.succeed(e) : v.fail(new t({
-		provider: a.name,
-		message: "cross-tenant access denied",
-		transient: !1,
-		status: 403
-	})), g = (e, n, r) => v.gen(function* () {
-		let o = i.objects?.(), s = (e) => new t({
-			provider: "metadata",
-			message: e,
-			transient: !1,
-			status: 409
-		});
-		if (o === void 0) return r === void 0 ? !1 : yield* v.fail(s(`claim '${r}' cannot be released: no data store is bound, so ref '${e}' holds no claims`));
-		let c = yield* v.tryPromise({
-			try: () => o.intent(e),
-			catch: (e) => new t({
-				provider: "metadata",
-				message: String(e?.message ?? e),
-				transient: !1
-			})
-		});
-		return c === void 0 ? r === void 0 ? !1 : yield* v.fail(s(`claim '${r}' cannot be released: ref '${e}' was not written through an operation and holds no claims`)) : (yield* h(c.ref, n), yield* $t({
-			metadata: o,
-			provider: {
-				...a,
-				delete: (e) => a.delete(e).pipe(v.retry(p))
-			}
-		}).delete(e, n, r).pipe(v.catchTag("StorageRejected", (e) => v.fail(e.reason === "claim-not-held" ? s(e.detail) : new t({
-			provider: "metadata",
-			message: e.detail,
-			transient: !1
-		})))), !0);
-	}), _ = (e, n) => o.getById(e).pipe(v.flatMap((r) => r ? h(r, n) : v.fail(new t({
-		provider: a.name,
-		message: `no ref '${e}'`,
-		transient: !1,
-		status: 404
-	})))), re = (e) => v.suspend(() => {
-		let n = i.scan(e);
-		return v.isEffect(n) ? n : v.tryPromise({
-			try: () => Promise.resolve(n),
-			catch: (e) => new t({
-				provider: "scan",
-				message: String(e?.message ?? e),
-				transient: !0
-			})
-		});
-	}), ie = (e) => v.suspend(() => {
-		let t = e.contentType;
-		if (!i.videoProbe || !(t.startsWith("video/") || t.startsWith("audio/"))) return v.succeed(null);
-		let n;
-		try {
-			n = i.videoProbe(e);
-		} catch {
-			return v.succeed(null);
-		}
-		return v.isEffect(n) ? n.pipe(v.catch(() => v.succeed(null))) : v.tryPromise({
-			try: () => Promise.resolve(n),
-			catch: () => null
-		}).pipe(v.catch(() => v.succeed(null)));
-	}), b = (e) => v.gen(function* () {
-		let t = Kt(e.bytes, e.contentType, i.limits);
-		if (t) return yield* v.fail(new n(t));
-		if (e.claim !== void 0 && e.operationId === void 0) return yield* v.fail(new n({
-			reason: "claim-without-operation",
-			detail: "a put with a claim needs an operationId; the claim names this caller's hold on that operation's object"
-		}));
-		if (i.scan) {
-			let t = yield* re({
-				bytes: e.bytes,
-				contentType: e.contentType,
-				...e.key ? { key: e.key } : {}
-			});
-			if (!t.clean) return yield* v.fail(new r({ threat: t.threat ?? "unknown" }));
-		}
-		let s = yield* v.promise(() => qt(e.bytes, e.contentType, { normalize: i.normalizeImages ?? !1 })), l = s.bytes, u = yield* ie({
-			bytes: l,
-			contentType: e.contentType
-		}), d = s.width ?? u?.width, f = s.height ?? u?.height, te = s.placeholder ?? u?.poster, ne = e.duration ?? u?.duration, h = yield* v.promise(() => en(l)), g = e.tenantId ?? null, _ = e.visibility ?? "private", b = m(g, h, yield* ee(e.key)), x = e.password ? yield* v.sync(() => yt(e.password)) : null, S = {
-			id: pn(),
-			tenantId: g,
-			ownerId: e.ownerId ?? null,
-			bucket: c,
-			key: b,
-			contentType: e.contentType,
-			size: l.byteLength,
-			checksum: h,
-			visibility: _,
-			accessPolicy: e.access ?? null,
-			passwordHash: x,
-			createdAt: /* @__PURE__ */ new Date(),
-			...d === void 0 ? {} : { width: d },
-			...f === void 0 ? {} : { height: f },
-			...te === void 0 ? {} : { placeholder: te },
-			...ne === void 0 ? {} : { duration: ne },
-			...e.folder === void 0 ? {} : { folder: e.folder },
-			...e.tags === void 0 ? {} : { tags: e.tags },
-			...e.alt === void 0 ? {} : { alt: e.alt },
-			...e.caption === void 0 ? {} : { caption: e.caption },
-			...e.derivedFrom === void 0 ? {} : { derivedFrom: e.derivedFrom },
-			...e.kind === void 0 ? {} : { kind: e.kind }
-		}, C = i.transcode !== void 0 && i.autoTranscode !== !1, oe = (t) => C && t.derivedFrom == null && (e.contentType.startsWith("video/") || e.contentType.startsWith("audio/")) ? v.forkDetach(ae(t).pipe(v.ignore)) : v.void;
-		if (e.operationId !== void 0) {
-			let t = i.objects?.();
-			if (t === void 0) return yield* v.fail(new n({
-				reason: "operation-store-unbound",
-				detail: "a put with an operationId needs a bound data store; the in-memory ref store cannot hold operation intents"
-			}));
-			let r = {
-				tenantId: g,
-				bucket: c,
-				operationId: e.operationId,
-				checksum: h,
-				logicalKey: b,
-				fingerprint: yield* v.promise(() => en(new TextEncoder().encode(JSON.stringify([
-					h,
-					e.contentType,
-					_,
-					e.access ?? null,
-					e.key ?? null,
-					e.ownerId ?? null,
-					e.folder ?? null,
-					e.tags ?? null,
-					e.alt ?? null,
-					e.caption ?? null,
-					e.derivedFrom ?? null,
-					e.kind ?? null,
-					ne ?? null,
-					e.password !== void 0
-				]))))
-			}, o = yield* $t({
-				metadata: t,
-				provider: {
-					...a,
-					put: (e, t, n) => a.put(e, t, n).pipe(v.retry(p))
-				}
-			}).put({
-				identity: r,
-				ref: S,
-				bytes: l,
-				...i.quota === void 0 ? {} : { quota: i.quota },
-				...e.claim === void 0 ? {} : { claim: e.claim }
-			});
-			return yield* oe(o.ref), {
-				...o.ref,
-				outcome: o.outcome
-			};
-		}
-		let w = {
-			bytes: l.byteLength,
-			count: 1
-		}, se = yield* o.consumeUsage(g, w, i.quota);
-		if (!se.allowed) {
-			let e = i.quota ?? {}, t = e.maxCount !== void 0 && se.count + 1 > e.maxCount ? `tenant object count ${se.count} + 1 exceeds max ${e.maxCount}` : `tenant usage ${se.bytes} + ${l.byteLength} bytes exceeds max ${e.maxBytes}`;
-			return yield* v.fail(new n({
-				reason: "quota-exceeded",
-				detail: t
-			}));
-		}
-		return yield* ((e) => e.pipe(v.onExit((e) => y.isSuccess(e) ? v.void : o.delete(S.id).pipe(v.andThen(o.releaseUsage(g, w)), v.ignore))))(o.insert(S).pipe(v.andThen(a.put(b, l, {
-			contentType: e.contentType,
-			public: _ === "public"
-		}).pipe(v.retry(p))))), yield* oe(S), {
-			...S,
-			outcome: "created"
-		};
-	}), S = (e) => v.suspend(() => {
-		if (!i.transcode) return v.succeed([]);
-		let t;
-		try {
-			t = i.transcode(e);
-		} catch {
-			return v.succeed([]);
-		}
-		return v.isEffect(t) ? t.pipe(v.catch(() => v.succeed([]))) : v.tryPromise({
-			try: () => Promise.resolve(t),
-			catch: () => []
-		}).pipe(v.catch(() => v.succeed([])));
-	}), ae = (e) => v.gen(function* () {
-		if (!i.transcode || e.derivedFrom != null) return [];
-		let t = yield* a.get(e.key).pipe(v.retry(p)), n = yield* S({
-			bytes: t.bytes,
-			contentType: e.contentType,
-			ref: e
-		}), r = [];
-		for (let t of n) {
-			let n = yield* b({
-				bytes: t.bytes,
-				contentType: t.contentType,
-				tenantId: e.tenantId,
-				ownerId: e.ownerId,
-				visibility: e.visibility,
-				derivedFrom: e.id,
-				kind: t.kind,
-				...t.label === void 0 ? {} : { caption: t.label }
-			});
-			r.push(n);
-		}
-		return r;
-	}), oe = (e, t, n) => v.gen(function* () {
-		if (e.derivedFrom != null) {
-			let r = yield* o.getById(e.derivedFrom);
-			return r === null ? !1 : yield* oe(r, t, n);
-		}
-		if (e.visibility === "public") return !0;
-		if (e.tenantId !== null && !ne(e, t.tenantId ?? null)) return !1;
-		if (yield* Dt(e, t, {
-			...l,
-			...n?.password === void 0 ? {} : { password: n.password }
-		})) return !0;
-		let r = yield* jt(t, l);
-		return At(yield* s.listByRef(e.id), t, r, n?.permission ?? "read", Date.now());
-	}), w = (e) => {
-		if (e.visibility === "public") {
-			let t = a.publicUrl?.(e.key);
-			if (t != null) return t;
-		}
-		return f(e.id);
-	};
-	return {
-		put: b,
-		get: (e, t) => _(e, t?.tenantId).pipe(v.flatMap((e) => a.get(e.key).pipe(v.retry(p), v.map((t) => ({
-			bytes: t.bytes,
-			ref: e
-		}))))),
-		getStream: (e, t) => _(e, t?.tenantId).pipe(v.map((e) => ({
-			ref: e,
-			stream: C.unwrap(v.suspend(() => a.getStream ? a.getStream(e.key).pipe(v.retry(p), v.map((e) => e.stream)) : a.get(e.key).pipe(v.retry(p), v.map((e) => C.make(e.bytes)))))
-		}))),
-		getRange: (e, n, r) => _(e, r?.tenantId).pipe(v.flatMap((e) => {
-			let r = e.size, i = Math.max(0, Math.trunc(n.start));
-			if (r > 0 && i >= r) return v.fail(new t({
-				provider: a.name,
-				message: `range start ${i} past end ${r}`,
-				transient: !1,
-				status: 416
-			}));
-			let o = Math.min(Math.trunc(n.endInclusive), Math.max(0, r - 1));
-			return o < i ? v.fail(new t({
-				provider: a.name,
-				message: `empty range ${i}-${o}`,
-				transient: !1,
-				status: 416
-			})) : (a.getRange ? a.getRange(e.key, i, o).pipe(v.retry(p)) : a.get(e.key).pipe(v.retry(p), v.map((e) => e.bytes.subarray(i, o + 1)))).pipe(v.map((t) => ({
-				bytes: t,
-				ref: e,
-				totalSize: r
-			})));
-		})),
-		getUrl: (e, t) => _(e, t?.tenantId).pipe(v.flatMap((e) => e.visibility === "public" ? v.succeed(w(e)) : a.presigns ? a.getUrl(e.key, t?.expiresInSec ?? d) : v.succeed(f(e.id)))),
-		head: (e, t) => o.getById(e).pipe(v.flatMap((e) => e ? h(e, t?.tenantId).pipe(v.map((e) => e)) : v.succeed(null))),
-		delete: (e, t) => g(e, t?.tenantId, t?.claim).pipe(v.flatMap((n) => n ? v.void : _(e, t?.tenantId).pipe(v.flatMap((t) => s.deleteByRef(e).pipe(v.flatMap(() => o.delete(e)), v.flatMap((e) => e ? o.countByKey(t.bucket, t.key).pipe(v.flatMap((e) => e === 0 ? a.delete(t.key).pipe(v.retry(p)) : v.void), v.flatMap(() => o.releaseUsage(t.tenantId, {
-			bytes: t.size,
-			count: 1
-		}))) : v.void), v.asVoid))))),
-		signedUrl: (e, t) => _(e, t?.tenantId).pipe(v.flatMap((e) => {
-			if (e.visibility === "public") return v.succeed(w(e));
-			let n = t?.expiresInSec ?? d;
-			return a.presigns ? a.getUrl(e.key, n) : v.sync(() => `${f(e.id)}?t=${Mt(e.id, n, void 0, i.httpPath ?? "/_voltro/storage")}`);
-		})),
-		setVisibility: (e, r, i) => v.gen(function* () {
-			let s = yield* _(e, i?.tenantId);
-			if (s.visibility === r) return s;
-			let c = o.setVisibility;
-			if (c === void 0) return yield* v.fail(new n({
-				reason: "visibility-unsupported",
-				detail: "the ref store cannot change a stored object's visibility"
-			}));
-			if (r === "private" && a.publicUrl?.(s.key) != null) return yield* v.fail(new n({
-				reason: "visibility-unsupported",
-				detail: `objects are served from a public base (${a.name} cdnBaseUrl); a public object cannot be made private there`
-			}));
-			if (r === "private" && a.setObjectPublic !== void 0 && o.countPublicByKey === void 0) return yield* v.fail(new n({
-				reason: "visibility-unsupported",
-				detail: "the ref store cannot tell whether other refs keep these bytes public"
-			}));
-			let l = yield* c(s.id, r);
-			if (l === null) return yield* v.fail(new t({
-				provider: a.name,
-				message: `no ref '${e}'`,
-				transient: !1,
-				status: 404
-			}));
-			let u = s.derivedFrom == null ? yield* o.listByDerivedFrom(s.id) : [];
-			for (let e of u) e.visibility !== r && (yield* c(e.id, r));
-			if (a.setObjectPublic !== void 0) {
-				let e = o.countPublicByKey;
-				for (let t of [s, ...u]) {
-					let n = r === "public" || e !== void 0 && (yield* e(t.bucket, t.key)) > 0;
-					yield* a.setObjectPublic(t.key, n);
-				}
-			}
-			return l;
-		}),
-		mintUrl: (n, r, s) => v.gen(function* () {
-			let c = yield* o.getById(n).pipe(v.flatMap((e) => e ? v.succeed(e) : v.fail(new t({
-				provider: a.name,
-				message: `no ref '${n}'`,
-				transient: !1,
-				status: 404
-			}))));
-			if (c.visibility === "public" && c.derivedFrom == null) return w(c);
-			if (!(yield* oe(c, r, s?.password === void 0 ? {} : { password: s.password }))) return yield* v.fail(new e({
-				refId: n,
-				reason: "access denied"
-			}));
-			let l = s?.expiresInSec ?? d;
-			if (a.presigns) return yield* a.getUrl(c.key, l);
-			let u = yield* v.sync(() => Mt(c.id, l, void 0, i.httpPath ?? "/_voltro/storage"));
-			return `${f(c.id)}?t=${u}`;
-		}),
-		mintUploadUrl: (e) => v.gen(function* () {
-			if (!a.getUploadUrl) return yield* v.fail(new t({
-				provider: a.name,
-				message: `provider '${a.name}' does not support presigned uploads`,
-				transient: !1,
-				status: 400
-			}));
-			let n = m(e.tenantId ?? null, "", yield* ee(e.key));
-			return yield* a.getUploadUrl(n, e.expiresInSec ?? d, e.contentType);
-		}),
-		checkAccess: oe,
-		grant: (e) => v.gen(function* () {
-			let t = {
-				id: mn(),
-				refId: e.refId,
-				principalType: e.principalType,
-				principalId: e.principalId,
-				permission: e.permission ?? "read",
-				createdAt: /* @__PURE__ */ new Date(),
-				expiresAt: e.expiresAt ?? null,
-				createdBy: e.createdBy ?? null
-			};
-			return yield* s.insert(t), t;
-		}),
-		listRefs: (e) => v.suspend(() => {
-			let t = Math.min(500, Math.max(1, Math.trunc(e?.limit ?? 50))), n = Math.max(0, Math.trunc(e?.offset ?? 0)), r = {
-				tenantId: e && "tenantId" in e ? e.tenantId : void 0,
-				folder: e?.folder,
-				tags: e?.tags ?? [],
-				ownerId: e?.ownerId,
-				includeDerived: e?.includeDerived ?? !1,
-				limit: t + 1,
-				offset: n
-			};
-			return o.listRefs(r).pipe(v.map((e) => {
-				let r = e.length > t;
-				return {
-					refs: r ? e.slice(0, t) : e,
-					nextOffset: r ? n + t : null
-				};
-			}));
-		}),
-		revoke: (e) => s.delete(e),
-		getGrant: (e) => s.getById(e),
-		listGrants: (e) => s.listByRef(e),
-		usage: (e) => o.usageByTenant(e),
-		sweepOrphans: (e) => v.gen(function* () {
-			let t = e?.limit ?? 1e3, n = e?.dryRun ?? !1, r = yield* o.listRecent(t), i = [];
-			for (let e of r) if ((yield* a.head(e.key)) === null) {
-				if (!n) {
-					if (!(yield* o.delete(e.id))) continue;
-					yield* o.releaseUsage(e.tenantId, {
-						bytes: e.size,
-						count: 1
-					});
-				}
-				i.push(e.id);
-			}
-			return {
-				scanned: r.length,
-				removed: i
-			};
-		}),
-		ingestUrl: (e, t) => Qt(v.gen(function* () {
-			let n = yield* Zt(e, i.limits?.maxBytes, i.ingest);
-			return yield* b({
-				bytes: n.bytes,
-				contentType: t?.contentType ?? n.contentType,
-				...t?.tenantId === void 0 ? {} : { tenantId: t.tenantId },
-				...t?.operationId === void 0 ? {} : { operationId: t.operationId },
-				...t?.ownerId === void 0 ? {} : { ownerId: t.ownerId },
-				...t?.visibility === void 0 ? {} : { visibility: t.visibility },
-				...t?.access === void 0 ? {} : { access: t.access },
-				...t?.key === void 0 ? {} : { key: t.key },
-				...t?.folder === void 0 ? {} : { folder: t.folder },
-				...t?.tags === void 0 ? {} : { tags: t.tags },
-				...t?.alt === void 0 ? {} : { alt: t.alt },
-				...t?.caption === void 0 ? {} : { caption: t.caption }
-			});
-		}), t?.abortSignal),
-		mintPresignedUpload: (e) => v.gen(function* () {
-			if (!a.getUploadUrl) return yield* v.fail(new t({
-				provider: a.name,
-				message: `provider '${a.name}' does not support presigned uploads`,
-				transient: !1,
-				status: 400
-			}));
-			let n = e.expiresInSec ?? d, r = `_incoming/${A({
-				kind: "typeid",
-				prefix: "up"
-			}, B)}`, i = m(e.tenantId ?? null, "", r);
-			return {
-				uploadUrl: yield* a.getUploadUrl(i, n, e.contentType),
-				key: i,
-				expiresInSec: n
-			};
-		}),
-		finalizeUpload: (e) => a.get(e.key).pipe(v.retry(p), v.flatMap((t) => b({
-			bytes: t.bytes,
-			contentType: e.contentType,
-			...e.tenantId === void 0 ? {} : { tenantId: e.tenantId },
-			...e.ownerId === void 0 ? {} : { ownerId: e.ownerId },
-			...e.visibility === void 0 ? {} : { visibility: e.visibility },
-			...e.access === void 0 ? {} : { access: e.access },
-			...e.folder === void 0 ? {} : { folder: e.folder },
-			...e.tags === void 0 ? {} : { tags: e.tags },
-			...e.alt === void 0 ? {} : { alt: e.alt },
-			...e.caption === void 0 ? {} : { caption: e.caption }
-		})), v.ensuring(a.delete(e.key).pipe(v.retry(p), v.ignore))),
-		putResumableChunk: (e) => a.put(te(e.tenantId ?? null, e.uploadId, e.index), e.bytes, { contentType: "application/octet-stream" }).pipe(v.retry(p), v.asVoid),
-		resumableStatus: (e) => v.gen(function* () {
-			let t = 0, n = 0;
-			for (; t < 1e6;) {
-				let r = yield* a.head(te(e.tenantId ?? null, e.uploadId, t)).pipe(v.retry(p), v.catch(() => v.succeed(null)));
-				if (r === null) break;
-				n += r.size, t += 1;
-			}
-			return {
-				offset: n,
-				nextIndex: t
-			};
-		}),
-		finalizeResumable: (e) => v.gen(function* () {
-			let r = i.limits?.maxBytes ?? 2 ** 53 - 1;
-			if (!Number.isSafeInteger(r) || r < 0 || !Number.isSafeInteger(e.count) || e.count < 0) return yield* v.fail(new t({
-				provider: a.name,
-				message: "resumable count and limits.maxBytes must be non-negative safe integers",
-				transient: !1,
-				status: 400
-			}));
-			let o = (t) => te(e.tenantId ?? null, e.uploadId, t), s = v.gen(function* () {
-				for (let t = 0; t < e.count; t++) yield* a.delete(o(t)).pipe(v.retry(p), v.ignore);
-			}), c = () => new n({
-				reason: "too-large",
-				detail: `resumable upload exceeds ${r}-byte limit`
-			}), l = yield* v.gen(function* () {
-				let n = 0;
-				for (let i = 0; i < e.count; i++) {
-					let e = yield* a.head(o(i)).pipe(v.retry(p));
-					if (e === null) return yield* v.fail(new t({
-						provider: a.name,
-						message: `no resumable chunk at '${o(i)}'`,
-						transient: !1,
-						status: 404
-					}));
-					if (!Number.isSafeInteger(e.size) || e.size < 0) return yield* v.fail(new t({
-						provider: a.name,
-						message: "resumable chunk metadata has an invalid size",
-						transient: !1
-					}));
-					if (e.size > r - n) return yield* v.fail(c());
-					n += e.size;
-				}
-				let i = /* @__PURE__ */ new Uint8Array(), s = 0;
-				for (let t = 0; t < e.count; t++) {
-					let e = yield* Ve(a, o(t)).pipe(v.retry(p));
-					yield* C.runForEach(e.stream, (e) => v.gen(function* () {
-						if (e.byteLength > r - s) return yield* v.fail(c());
-						let t = s + e.byteLength;
-						if (t > i.byteLength) {
-							let e = new Uint8Array(Math.min(r, Math.max(65536, i.byteLength * 2, t)));
-							e.set(i.subarray(0, s)), i = e;
-						}
-						i.set(e, s), s = t;
-					}));
-				}
-				return i.subarray(0, s);
-			}).pipe(v.tapError((e) => e._tag === "StorageRejected" ? s : v.void));
-			return yield* b({
-				bytes: l,
-				contentType: e.contentType,
-				...e.tenantId === void 0 ? {} : { tenantId: e.tenantId },
-				...e.ownerId === void 0 ? {} : { ownerId: e.ownerId },
-				...e.visibility === void 0 ? {} : { visibility: e.visibility },
-				...e.access === void 0 ? {} : { access: e.access },
-				...e.folder === void 0 ? {} : { folder: e.folder },
-				...e.tags === void 0 ? {} : { tags: e.tags },
-				...e.alt === void 0 ? {} : { alt: e.alt },
-				...e.caption === void 0 ? {} : { caption: e.caption }
-			}).pipe(v.ensuring(s));
-		}),
-		transcode: (e, t) => _(e, t?.tenantId).pipe(v.flatMap((e) => ae(e))),
-		renditions: (e, t) => _(e, t?.tenantId).pipe(v.flatMap(() => o.listByDerivedFrom(e))),
-		beginMultipartUpload: (e) => v.gen(function* () {
-			if (!a.createMultipartUpload || !a.presignUploadPart || !a.completeMultipartUpload) return yield* v.fail(new t({
-				provider: a.name,
-				message: `provider '${a.name}' does not support multipart uploads`,
-				transient: !1,
-				status: 400
-			}));
-			let n = m(e.tenantId ?? null, "", `multipart/${A({
-				kind: "typeid",
-				prefix: "mp"
-			}, B)}`);
-			return {
-				uploadId: (yield* a.createMultipartUpload(n, e.contentType, { public: (e.visibility ?? "private") === "public" })).uploadId,
-				key: n
-			};
-		}),
-		signMultipartPart: (e) => v.suspend(() => a.presignUploadPart ? a.presignUploadPart(e.key, e.uploadId, e.partNumber, e.expiresInSec ?? d) : v.fail(new t({
-			provider: a.name,
-			message: "provider does not support multipart uploads",
-			transient: !1,
-			status: 400
-		}))),
-		completeMultipart: (e) => v.gen(function* () {
-			if (!a.completeMultipartUpload) return yield* v.fail(new t({
-				provider: a.name,
-				message: "provider does not support multipart uploads",
-				transient: !1,
-				status: 400
-			}));
-			let r = yield* a.completeMultipartUpload(e.key, e.uploadId, e.parts), s = yield* a.head(e.key).pipe(v.retry(p)), l = s?.size ?? 0, u = (r.etag ?? s?.etag ?? "").replace(/"/g, ""), d = e.tenantId ?? null, f = {
-				bytes: l,
-				count: 1
-			};
-			if (!(yield* o.consumeUsage(d, f, i.quota)).allowed) return yield* a.delete(e.key).pipe(v.retry(p), v.ignore), yield* v.fail(new n({
-				reason: "quota-exceeded",
-				detail: `multipart upload of ${l} bytes exceeds tenant quota`
-			}));
-			let m = {
-				id: pn(),
-				tenantId: e.tenantId ?? null,
-				ownerId: e.ownerId ?? null,
-				bucket: c,
-				key: e.key,
-				contentType: e.contentType,
-				size: l,
-				checksum: u,
-				visibility: e.visibility ?? "private",
-				accessPolicy: e.access ?? null,
-				passwordHash: null,
-				createdAt: /* @__PURE__ */ new Date(),
-				...e.folder === void 0 ? {} : { folder: e.folder },
-				...e.tags === void 0 ? {} : { tags: e.tags },
-				...e.alt === void 0 ? {} : { alt: e.alt },
-				...e.caption === void 0 ? {} : { caption: e.caption }
-			};
-			return yield* o.insert(m).pipe(v.onExit((e) => y.isSuccess(e) ? v.void : o.releaseUsage(d, f).pipe(v.ignore))), m;
-		}),
-		abortMultipart: (e) => v.suspend(() => a.abortMultipartUpload ? a.abortMultipartUpload(e.key, e.uploadId).pipe(v.retry(p)) : v.void)
-	};
-}, gn = (e) => b.succeed(i, hn(e)), _n = "_voltro_storage_operation_locks", Q = "_voltro_storage_object_heads", vn = "_voltro_storage_operations", yn = "_voltro_storage_object_claims", bn = [
-	P(_n, {
-		id: F().maxLength(64),
-		nonce: F()
-	}).primaryKey(["id"]).nonReactive(),
-	P(Q, {
-		id: F().maxLength(64),
-		generation: F(),
-		key: F(),
-		reservations: E()
-	}).primaryKey(["id"]).nonReactive(),
-	P(vn, {
-		id: F().maxLength(64),
-		objectId: F().maxLength(64),
-		fingerprint: F().maxLength(64),
-		generation: F(),
-		key: F(),
-		refId: F(),
-		state: F(),
-		deleteKey: F().nullable()
-	}).primaryKey(["id"]).nonReactive(),
-	P(yn, {
-		id: F().maxLength(64),
-		operationId: F().maxLength(64),
-		claim: F()
-	}).primaryKey(["id"]).nonReactive()
-], xn = S.Struct({
-	id: S.String,
-	objectId: S.String,
-	fingerprint: S.String,
-	generation: S.String,
-	key: S.String,
-	refId: S.String,
-	state: S.Literals([
-		"reserved",
-		"ready",
-		"deleting",
-		"deleted"
-	]),
-	deleteKey: S.NullOr(S.String)
-}), Sn = S.Struct({
-	id: S.String,
-	generation: S.String,
-	key: S.String,
-	reservations: S.Int.pipe(S.check(S.isGreaterThanOrEqualTo(0)))
-}), Cn = (e) => S.decodeUnknownSync(Sn)({
-	...e,
-	reservations: W(e.reservations, "shared-object reservation count")
-}), wn = (e) => Ce("sha256").update(JSON.stringify(e)).digest("hex"), Tn = (e, t) => wn([e, t]), En = (e) => {
-	if (!e.bucket || !e.operationId || !e.logicalKey || !/^[a-f0-9]{64}$/.test(e.fingerprint) || !/^[a-f0-9]{64}$/.test(e.checksum)) throw Error("Storage operation requires a bucket, operation identity, key and SHA-256 fingerprint");
-	return {
-		id: wn([
-			e.bucket,
-			e.tenantId,
-			e.operationId
-		]),
-		objectId: wn([
-			e.bucket,
-			e.tenantId,
-			e.logicalKey,
-			e.checksum
-		]),
-		lockId: wn([e.tenantId])
-	};
-}, Dn = async (e, t, n) => {
-	let { lockId: r } = En(t);
-	return await e.insertIgnoreWithOutcome(_n, {
-		id: r,
-		nonce: Te()
-	}, { conflictColumns: ["id"] }), e.transactional(async (e) => {
-		if ((await e.query({
-			table: _n,
-			predicate: k("id", r),
-			lock: "update",
-			order: [],
-			take: 1,
-			skip: void 0,
-			projection: void 0
-		})).length !== 1 || await e.update(_n, r, { nonce: Te() }) === null) throw Error("Storage operation lock is unavailable");
-		return n(e);
-	});
-}, $ = async (e, t) => {
-	let r = En(t), i = await e.query({
-		table: vn,
-		predicate: k("id", r.id),
-		order: [],
-		take: 1,
-		skip: void 0,
-		projection: void 0
-	});
-	if (!i[0]) return;
-	let a = S.decodeUnknownSync(xn)(i[0]);
-	if (a.fingerprint !== t.fingerprint || a.objectId !== r.objectId) throw new n({
-		reason: "operation-identity-reused",
-		detail: `storage operation '${t.operationId}' was already used with different inputs`
-	});
-	return a;
-}, On = async (e, t) => {
-	let n = await $(e, t);
-	if (n) return n;
-	let { id: r, objectId: i } = En(t), a = await e.query({
-		table: Q,
-		predicate: k("id", i),
-		order: [],
-		take: 1,
-		skip: void 0,
-		projection: void 0
-	}), o = a[0] ? Cn(a[0]) : void 0, s = o?.generation ?? Te(), c = o?.key ?? `${t.logicalKey}/g-${s}`;
-	o ? await e.update(Q, i, { reservations: String(Je(o.reservations, 1, "shared-object reservation count")) }) : await e.insert(Q, {
-		id: i,
-		generation: s,
-		key: c,
-		reservations: "1"
-	});
-	let l = {
-		id: r,
-		objectId: i,
-		fingerprint: t.fingerprint,
-		generation: s,
-		key: c,
-		refId: `file_${Te()}`,
-		state: "reserved",
-		deleteKey: null
-	};
-	return await e.insert(vn, l), l;
-}, kn = async (e, t) => {
-	let n = await $(e, t);
-	if (!n) throw Error("Storage operation is missing");
-	if (n.state === "deleting" || n.state === "deleted") throw Error("Deleted storage operation cannot be confirmed by a late put");
-	return await e.update(vn, n.id, { state: "ready" }), {
-		...n,
-		state: "ready"
-	};
-}, An = async (e, t) => {
-	let n = await $(e, t);
-	if (!n) throw Error("Storage operation is missing");
-	if (n.state === "deleting" || n.state === "deleted") return n;
-	if (n.state !== "ready") throw Error("An unconfirmed put cannot be deleted");
-	let r = await e.query({
-		table: Q,
-		predicate: k("id", n.objectId),
-		order: [],
-		take: 1,
-		skip: void 0,
-		projection: void 0
-	}), i = r[0] ? Cn(r[0]) : void 0;
-	if (!i || i.generation !== n.generation || i.reservations < 1) throw Error("Storage object generation does not own its reservation");
-	let a = i.reservations === 1 ? i.key : null;
-	return a === null ? await e.update(Q, i.id, { reservations: String(i.reservations - 1) }) : await e.delete(Q, i.id), await e.update(vn, n.id, {
-		state: "deleting",
-		deleteKey: a
-	}), {
-		...n,
-		state: "deleting",
-		deleteKey: a
-	};
-}, jn = async (e, t) => {
-	let n = await $(e, t);
-	if (!n || n.state !== "deleting" && n.state !== "deleted") throw Error("Storage deletion has not been accepted");
-	return n.state !== "deleted" && (await e.update(vn, n.id, { state: "deleted" }), !0);
-}, Mn = async (e, t, n) => {
-	if (!n) throw Error("Storage object claim must be a non-empty string");
-	await e.insertIgnoreWithOutcome(yn, {
-		id: Tn(t, n),
-		operationId: t,
-		claim: n
-	}, { conflictColumns: ["id"] });
-}, Nn = async (e, t, n) => {
-	let r = Tn(t, n);
-	return {
-		held: await e.delete(yn, r),
-		others: (await e.query({
-			table: yn,
-			predicate: ue(k("operationId", t), ve("claim", n)),
-			order: [],
-			take: 1,
-			skip: void 0,
-			projection: void 0
-		})).length > 0
-	};
-}, Pn = (e, t) => e.deleteMany(yn, { where: k("operationId", t) }), Fn = "_voltro_storage_put_intents", In = P(Fn, {
-	id: F().maxLength(64),
-	refId: F().maxLength(64),
-	identity: ge(),
-	ref: ge()
-}).primaryKey(["id"]).unique("storagePutRef", ["refId"]).nonReactive(), Ln = S.Struct({
-	tenantId: S.NullOr(S.String),
-	bucket: S.String,
-	operationId: S.String,
-	fingerprint: S.String,
-	checksum: S.String,
-	logicalKey: S.String
-}), Rn = async (e, t) => {
-	let n = await e.query({
-		table: Fn,
-		predicate: k("refId", t),
-		order: [],
-		take: 2,
-		skip: void 0,
-		projection: void 0
-	});
-	if (n.length === 0) return;
-	if (n.length !== 1) throw Error("Storage reference has ambiguous operation ownership");
-	let r = n[0], i = S.decodeUnknownSync(Ln)(r.identity);
-	if (typeof r.ref != "object" || r.ref === null || Array.isArray(r.ref)) throw Error("Storage operation reference is unreadable");
-	let a = X(r.ref);
-	if (a.id !== t || a.bucket !== i.bucket || a.tenantId !== i.tenantId || a.checksum !== i.checksum || !Number.isSafeInteger(a.size) || a.size < 0 || !Number.isFinite(a.createdAt.getTime())) throw Error("Storage operation reference does not match its identity");
-	return {
-		identity: i,
-		ref: a
-	};
-}, zn = (e) => ({
-	intent: (t) => Rn(e, t),
-	reserve: (t, r, i, a) => Dn(e, t, async (e) => {
-		if (r.tenantId !== t.tenantId || r.bucket !== t.bucket || r.checksum !== t.checksum || !Number.isSafeInteger(r.size) || r.size < 0) throw Error("Storage put metadata does not match its identity");
-		let o = await $(e, t);
-		if (o) {
-			if (o.state === "deleting" || o.state === "deleted") throw Error("Storage put identity has already been deleted");
-			let t = await Rn(e, o.refId);
-			if (!t) throw Error("Storage operation lost its put intent");
-			let n = o.state === "ready";
-			return n && a !== void 0 && await Mn(e, o.id, a), {
-				ref: t.ref,
-				ready: n,
-				outcome: n ? "joined" : "resumed"
-			};
-		}
-		let s = await On(e, t), c = ln(e);
-		if (!(await v.runPromise(c.consumeUsage(t.tenantId, {
-			bytes: r.size,
-			count: 1
-		}, i))).allowed) throw new n({
-			reason: "quota-exceeded",
-			detail: "Storage operation exceeds tenant quota"
-		});
-		let l = X({
-			...r,
-			id: s.refId,
-			key: s.key
-		});
-		return await e.insert(Fn, {
-			id: s.id,
-			refId: l.id,
-			identity: t,
-			ref: l
-		}), {
-			ref: l,
-			ready: !1,
-			outcome: "created"
-		};
-	}),
-	confirm: (t, n) => Dn(e, t, async (e) => {
-		let r = await $(e, t);
-		if (!r) throw Error("Storage put operation is missing");
-		let i = await Rn(e, r.refId);
-		if (!i) throw Error("Storage put intent is missing");
-		if (n !== void 0 && await Mn(e, r.id, n), r.state === "ready") {
-			let n = await v.runPromise(ln(e).getById(r.refId));
-			if (!n || n.key !== r.key || n.checksum !== t.checksum) throw Error("Confirmed storage operation lost its reference");
-			return n;
-		}
-		return await kn(e, t), await v.runPromise(ln(e).insert(i.ref)), i.ref;
-	}),
-	beginDelete: async (t, r, i) => {
-		let a = await Rn(e, t);
-		if (!a) throw Error("Storage delete operation is missing");
-		if (r !== void 0 && a.identity.tenantId !== r) throw Error("Storage delete tenant mismatch");
-		return Dn(e, a.identity, async (e) => {
-			let r = await Rn(e, t);
-			if (!r) throw Error("Storage delete intent disappeared");
-			let a = await $(e, r.identity);
-			if (!a) throw Error("Storage delete lost its operation");
-			let o = a.state !== "deleting" && a.state !== "deleted";
-			if (i === void 0) o && await Pn(e, a.id);
-			else if (o) {
-				let o = await Nn(e, a.id, i);
-				if (o.others) return {
-					released: !0,
-					identity: r.identity
-				};
-				if (!o.held) throw new n({
-					reason: "claim-not-held",
-					detail: `claim '${i}' is not held on storage reference '${t}'; a reference put without a claim is deleted as a whole by a delete that names none`
-				});
-			}
-			let s = await An(e, r.identity);
-			if (a.state === "ready") {
-				let n = ln(e);
-				if (await v.runPromise(fn(e).deleteByRef(t)), !await v.runPromise(n.delete(t))) throw Error("Storage deletion lost its confirmed reference");
-				await v.runPromise(n.releaseUsage(r.identity.tenantId, {
-					bytes: r.ref.size,
-					count: 1
-				}));
-			}
-			return {
-				released: !0,
-				operation: s,
-				identity: r.identity
-			};
-		});
-	},
-	confirmDelete: (t) => Dn(e, t, (e) => jn(e, t))
-}), Bn = (e, t = 65536) => {
-	let n = [Buffer.from("zINSTREAM\0", "utf8")];
-	for (let r = 0; r < e.length; r += t) {
-		let i = e.subarray(r, Math.min(r + t, e.length)), a = Buffer.alloc(4);
-		a.writeUInt32BE(i.length, 0), n.push(a, Buffer.from(i));
-	}
-	let r = Buffer.alloc(4);
-	return r.writeUInt32BE(0, 0), n.push(r), Buffer.concat(n);
-}, Vn = (e) => {
-	let t = e.replace(/\0+$/, "").trim();
-	if (/\bOK$/.test(t)) return { clean: !0 };
-	let n = /:\s*(.+?)\s+FOUND$/.exec(t);
-	if (n) return {
-		clean: !1,
-		threat: n[1] ?? "unknown"
-	};
-	throw Error(`clamav: unexpected response: ${t}`);
-}, Hn = async (e, t) => {
-	let n = await import("node:net"), r = U.read("CLAMAV_HOST", t.host) ?? "127.0.0.1", i = U.read("CLAMAV_PORT"), a = t.port ?? (i ? Number(i) : 3310), o = t.timeoutMs ?? 3e4;
-	return new Promise((i, s) => {
-		let c = n.createConnection({
-			host: r,
-			port: a
-		}), l = "", u = setTimeout(() => {
-			c.destroy(), s(/* @__PURE__ */ Error("clamav scan timed out"));
-		}, o);
-		c.on("error", (e) => {
-			clearTimeout(u), s(e);
-		}), c.on("connect", () => {
-			c.end(Bn(e, t.chunkSize));
-		}), c.on("data", (e) => {
-			l += e.toString("utf8");
-		}), c.on("close", () => {
-			clearTimeout(u);
-			try {
-				i(Vn(l));
-			} catch (e) {
-				s(e);
-			}
-		});
-	});
-}, Un = (e = {}) => (t) => Hn(t.bytes, e), Wn = (e, t, n) => new Promise((r, i) => {
-	let a = Oe(e, [...t], { stdio: [
-		"ignore",
-		"ignore",
-		"pipe"
-	] }), o = "", s = setTimeout(() => {
-		a.kill("SIGKILL"), i(/* @__PURE__ */ Error("ffmpeg timed out"));
-	}, n);
-	a.stderr?.on("data", (e) => {
-		o += String(e);
-	}), a.on("error", (e) => {
-		clearTimeout(s), i(e);
-	}), a.on("close", (e) => {
-		clearTimeout(s), e === 0 ? r() : i(/* @__PURE__ */ Error(`ffmpeg exited ${String(e)}: ${o.slice(-400)}`));
-	});
-}), Gn = (e) => async ({ bytes: t }) => {
-	let n = e.ffmpegPath ?? "ffmpeg", r = e.timeoutMs ?? 3e5, i = await R(Me(je(), "voltro-tc-")), a = Me(i, "in"), o = [];
-	try {
-		await Ae(a, t);
-		for (let t of e.renditions) {
-			let e = Me(i, `out.${t.ext}`);
-			try {
-				await Wn(n, [
-					"-y",
-					"-i",
-					a,
-					...t.args,
-					e
-				], r);
-				let i = await z(e);
-				o.push({
-					bytes: new Uint8Array(i),
-					contentType: t.contentType,
-					kind: t.kind,
-					...t.label === void 0 ? {} : { label: t.label }
-				}), await ke(e, { force: !0 });
-			} catch {}
-		}
-	} finally {
-		await ke(i, {
-			recursive: !0,
-			force: !0
-		}).catch(() => void 0);
-	}
-	return o;
-};
-//#endregion
-//#region src/assetRef.ts
-function Kn(e = {}) {
-	let t = e.nullable ?? !0, n = e.fk === !1 ? F().externalId() : ye(() => We, { onDelete: e.onDelete ?? "setNull" });
-	return t ? n.nullable() : n;
-}
-var qn = () => _e({
-	id: "@voltro/plugin-storage/withStorage",
-	fields: { asset: Kn() }
-}), Jn = {
-	"image/png": "png",
-	"image/jpeg": "jpg",
-	"image/jpg": "jpg",
-	"image/gif": "gif",
-	"image/webp": "webp",
-	"image/svg+xml": "svg"
-}, Yn = (e) => {
-	let t = /^data:([^;,]+)(;base64)?,(.*)$/s.exec(e);
-	if (!t) throw Error("not a data URI");
-	let n = t[1] || "application/octet-stream", r = !!t[2], i = t[3] ?? "";
-	return {
-		bytes: r ? new Uint8Array(Buffer.from(i, "base64")) : new Uint8Array(Buffer.from(decodeURIComponent(i), "utf8")),
-		contentType: n
-	};
-}, Xn = (e, n) => v.gen(function* () {
-	let r = yield* v.try({
-		try: () => Yn(n.dataUri),
-		catch: (e) => new t({
-			provider: "avatar",
-			message: String(e?.message ?? e),
-			transient: !1,
-			status: 400
-		})
-	}), i = Jn[r.contentType] ?? "bin";
-	return yield* e.put({
-		bytes: r.bytes,
-		contentType: r.contentType,
-		tenantId: n.tenantId,
-		ownerId: n.userId,
-		visibility: "public",
-		key: `avatars/${n.userId}/avatar.${i}`
-	});
-}), Zn = (e) => {
-	try {
-		let t = Ne(e), n = Ne("/");
-		return typeof t.dev != "number" || typeof n.dev != "number" ? "unknown" : t.dev === n.dev ? "same-device-as-root" : "separate-mount";
-	} catch {
-		return "unknown";
-	}
-}, Qn = (e) => {
-	if (Zn(e) === "same-device-as-root") return `the capture is going to ${e}, which is on the SAME filesystem as \`/\`.\n  A mounted volume would be a separate one. If this process is a container, that means the capture
-  dies with it — which is the exact failure it exists for. On a development machine this is normal
-  and can be ignored.`;
-}, $n = U.read("VOLTRO_SESSION_COOKIE") ?? "voltro:session", er, tr = (e) => {
-	er = e;
-}, nr = () => er ?? ir({}), rr = () => er === void 0 ? U.read("STORAGE_PROVIDER") === void 0 ? void 0 : ir({}) : er, ir = (e) => {
+import { storageObjectNamespace as e } from "./storageNamespaces.js";
+import { STORAGE_REFERENCE_CATALOGUE_TABLE as t, ensureStorageReferenceCatalogue as n, storageReferenceCatalogueTable as r } from "./referenceCatalogue.js";
+import { STORAGE_BLOBS_TABLE as i, STORAGE_GRANTS_TABLE as a, STORAGE_REFS_TABLE as o, STORAGE_USAGE_TABLE as s, _voltroStorageBlobsTable as c, _voltroStorageGrantsTable as l, _voltroStorageRefsTable as u, _voltroStorageUsageTable as d } from "./table.js";
+import { assignStorageReferenceInstancesInTransaction as f, requireStorageReferenceOwnership as ee } from "./storageReferenceInstances.js";
+import { StorageAccessDenied as te, StorageError as p, StorageRejected as ne, StorageScanRejected as re, StorageService as m } from "./types.js";
+import { storageObjectLifecycleTables as h } from "./objectLifecycle.js";
+import { assignStorageObjectNamespacesInTransaction as g, requireStorageObjectNamespaces as _ } from "./storageObjectNamespaces.js";
+import { bytesToStream as v, collectStream as y, concatBytes as b, fromNodeReadable as x, getObjectStream as S, putObjectStream as ie, toNodeReadable as C } from "./streamBridge.js";
+import { storageEnv as w } from "./env.js";
+import { azureProvider as T, clearStorageBuffer as E, databaseProvider as D, filesystemProvider as O, memoryProvider as k, readStorageBuffer as ae, s3Provider as A } from "./providers.js";
+import { createTransformCache as oe } from "./transformCache.js";
+import { editImage as j, parseTransformParams as se, transformCached as ce, transformFallbackReason as le, transformImage as ue, transformKey as de } from "./transform.js";
+import { hashPassword as M, verifyPassword as fe } from "./access.js";
+import { resolveStorageSecret as pe, signFinalizeTicket as me, signGrant as he, signMultipartTicket as ge, signResumableTicket as _e, signUploadTicket as N, verifyFinalizeTicket as ve, verifyGrant as ye, verifyMultipartTicket as P, verifyResumableTicket as be, verifyUploadTicket as F } from "./grant.js";
+import { checkLimits as I, contentTypeAllowed as L, sniffMatches as R } from "./constraints.js";
+import { fetchIngestBody as z } from "./ingest.js";
+import { buildStorageService as xe, dataStoreGrantStore as Se, dataStoreRefStore as Ce, memoryGrantStore as we, memoryRefStore as B, refMatchesListQuery as V, storageServiceLayer as Te } from "./service.js";
+import { makeStorageObjectMetadata as Ee, storagePutIntentsTable as De } from "./objectMetadata.js";
+import { abortMultipartUploadDescriptor as Oe, beginMultipartUploadDescriptor as ke, beginResumableUploadDescriptor as Ae, completeMultipartUploadDescriptor as je, finalizeUploadDescriptor as Me, ingestUrlDescriptor as Ne, listGrantsDescriptor as Pe, listRefsDescriptor as Fe, mintPresignedUploadDescriptor as Ie, mintUploadTicketDescriptor as Le, mintUploadUrlDescriptor as Re, mintUrlDescriptor as ze, revokeDescriptor as Be, shareDescriptor as Ve, signMultipartPartDescriptor as He, storageRpcClientImports as Ue, uploadDescriptor as We } from "./rpc.js";
+import { clamavScanner as Ge, encodeInstream as Ke, parseClamavResponse as qe } from "./scanners.js";
+import { ffmpegTranscoder as Je } from "./transcodeVideo.js";
+import { assetRef as Ye, withStorage as Xe } from "./assetRef.js";
+import { decodeDataUri as Ze, putAvatar as Qe } from "./avatar.js";
+import { durabilityNotice as $e, pathDurability as et } from "./pathDurability.js";
+import { createHash as tt, randomUUID as H } from "node:crypto";
+import { Effect as U, Schema as W, Stream as nt } from "effect";
+import { processIdentity as rt } from "@voltro/protocol/identity";
+import { StorageAccessPolicySchema as it, definePlugin as at, pluginInstanceName as G } from "@voltro/protocol";
+import { readCookie as ot, resolveSessionSecret as st, verifySession as ct } from "@voltro/protocol/session";
+//#region src/index.ts
+var lt = w.read("VOLTRO_SESSION_COOKIE") ?? "voltro:session", K, ut = (e) => {
+	K = e;
+}, dt = () => K ?? q({}), ft = () => K === void 0 ? w.read("STORAGE_PROVIDER") === void 0 ? void 0 : q({}) : K, q = (e) => {
 	if (e.provider && typeof e.provider == "object") return e.provider;
-	let t = (e.provider ?? U.read("STORAGE_PROVIDER") ?? "memory").toLowerCase(), n = U.read("S3_BUCKET", e.bucket) ?? U.read("STORAGE_BUCKET") ?? "voltro";
+	let t = (e.provider ?? w.read("STORAGE_PROVIDER") ?? "memory").toLowerCase(), n = w.read("S3_BUCKET", e.bucket) ?? w.read("STORAGE_BUCKET") ?? "voltro";
 	switch (t) {
 		case "s3":
 		case "minio": {
-			let r = U.read("S3_REGION", e.region) ?? U.read("AWS_REGION"), i = U.read("S3_ENDPOINT", e.endpoint) ?? U.read("MINIO_ENDPOINT"), a = U.read("S3_ACCESS_KEY_ID", e.accessKeyId) ?? U.read("AWS_ACCESS_KEY_ID"), o = U.read("S3_SECRET_ACCESS_KEY", e.secretAccessKey) ?? U.read("AWS_SECRET_ACCESS_KEY"), s = U.read("STORAGE_CDN_URL", e.cdnBaseUrl);
-			return nt({
+			let r = w.read("S3_REGION", e.region) ?? w.read("AWS_REGION"), i = w.read("S3_ENDPOINT", e.endpoint) ?? w.read("MINIO_ENDPOINT"), a = w.read("S3_ACCESS_KEY_ID", e.accessKeyId) ?? w.read("AWS_ACCESS_KEY_ID"), o = w.read("S3_SECRET_ACCESS_KEY", e.secretAccessKey) ?? w.read("AWS_SECRET_ACCESS_KEY"), s = w.read("STORAGE_CDN_URL", e.cdnBaseUrl), c = {
 				bucket: n,
 				name: t,
 				...r ? { region: r } : {},
@@ -2703,25 +45,26 @@ var qn = () => _e({
 				...o ? { secretAccessKey: o } : {},
 				...s ? { cdnBaseUrl: s } : {},
 				...e.publicAcl === void 0 ? {} : { publicAcl: e.publicAcl },
-				...t === "minio" || U.read("S3_FORCE_PATH_STYLE") === "1" ? { forcePathStyle: !0 } : {}
-			});
+				...t === "minio" || w.read("S3_FORCE_PATH_STYLE") === "1" ? { forcePathStyle: !0 } : {}
+			};
+			return A(c);
 		}
 		case "azure": {
-			let t = U.read("AZURE_STORAGE_ACCOUNT", e.accountName), r = U.read("AZURE_STORAGE_KEY", e.accountKey), i = U.read("AZURE_STORAGE_CONNECTION_STRING", e.connectionString), a = U.read("AZURE_STORAGE_ENDPOINT", e.endpoint), o = U.read("STORAGE_CDN_URL", e.cdnBaseUrl);
-			return at({
-				container: U.read("AZURE_STORAGE_CONTAINER", e.bucket) ?? n,
+			let t = w.read("AZURE_STORAGE_ACCOUNT", e.accountName), r = w.read("AZURE_STORAGE_KEY", e.accountKey), i = w.read("AZURE_STORAGE_CONNECTION_STRING", e.connectionString), a = w.read("AZURE_STORAGE_ENDPOINT", e.endpoint), o = w.read("STORAGE_CDN_URL", e.cdnBaseUrl), s = {
+				container: w.read("AZURE_STORAGE_CONTAINER", e.bucket) ?? n,
 				...t ? { accountName: t } : {},
 				...r ? { accountKey: r } : {},
 				...i ? { connectionString: i } : {},
 				...a ? { endpoint: a } : {},
 				...o ? { cdnBaseUrl: o } : {}
-			});
+			};
+			return T(s);
 		}
-		case "database": return it();
-		case "filesystem": return tt({ root: U.read("STORAGE_ROOT", e.root) ?? ".voltro-storage" });
-		default: return et(e.name ?? "default");
+		case "database": return D();
+		case "filesystem": return O({ root: w.read("STORAGE_ROOT", e.root) ?? ".voltro-storage" });
+		default: return k(e.name ?? "default");
 	}
-}, ar = (e) => {
+}, pt = (e) => {
 	let t = "stored files (uploads, renditions) and their reads", n = "provider 'database' or 'filesystem' keeps the bytes inside the installation";
 	if (e.provider && typeof e.provider == "object") return [{
 		destination: `runtime:the '${e.provider.name}' storage provider`,
@@ -2729,9 +72,9 @@ var qn = () => _e({
 		data: ["files"],
 		disable: n
 	}];
-	let r = (e.provider ?? U.read("STORAGE_PROVIDER") ?? "memory").toLowerCase();
+	let r = (e.provider ?? w.read("STORAGE_PROVIDER") ?? "memory").toLowerCase();
 	if (r === "s3" || r === "minio") {
-		let r = U.read("S3_ENDPOINT", e.endpoint) ?? U.read("MINIO_ENDPOINT"), i = U.read("S3_REGION", e.region) ?? U.read("AWS_REGION") ?? "us-east-1";
+		let r = w.read("S3_ENDPOINT", e.endpoint) ?? w.read("MINIO_ENDPOINT"), i = w.read("S3_REGION", e.region) ?? w.read("AWS_REGION") ?? "us-east-1";
 		return [{
 			destination: r ?? `s3.${i}.amazonaws.com`,
 			purpose: t,
@@ -2740,7 +83,7 @@ var qn = () => _e({
 		}];
 	}
 	if (r === "azure") {
-		let r = U.read("AZURE_STORAGE_ENDPOINT", e.endpoint), i = U.read("AZURE_STORAGE_ACCOUNT", e.accountName);
+		let r = w.read("AZURE_STORAGE_ENDPOINT", e.endpoint), i = w.read("AZURE_STORAGE_ACCOUNT", e.accountName);
 		return [{
 			destination: r ?? (i === void 0 ? "runtime:the Azure storage connection string" : `${i}.blob.core.windows.net`),
 			purpose: t,
@@ -2749,11 +92,11 @@ var qn = () => _e({
 		}];
 	}
 	return [];
-}, or = (e) => {
+}, mt = (e) => {
 	if (e !== void 0) return e;
-	let t = U.read("STORAGE_ALLOWED_ORIGINS");
+	let t = w.read("STORAGE_ALLOWED_ORIGINS");
 	return t ? t.trim() === "*" ? "*" : t.split(",").map((e) => e.trim()).filter(Boolean) : [];
-}, sr = (e, t) => {
+}, J = (e, t) => {
 	if (!e || t !== "*" && !t.includes(e)) return {};
 	let n = {
 		"access-control-allow-origin": t === "*" ? "*" : e,
@@ -2763,7 +106,7 @@ var qn = () => _e({
 		vary: "Origin"
 	};
 	return t !== "*" && (n["access-control-allow-credentials"] = "true"), n;
-}, cr = (e) => ({
+}, ht = (e) => ({
 	id: e.id,
 	tenantId: e.tenantId,
 	ownerId: e.ownerId,
@@ -2786,29 +129,29 @@ var qn = () => _e({
 	caption: e.caption ?? null,
 	derivedFrom: e.derivedFrom ?? null,
 	kind: e.kind ?? null
-}), lr = () => new t({
+}), Y = () => new p({
 	provider: "storage",
 	message: "not permitted to administer sharing for this object",
 	transient: !1,
 	status: 403
-}), ur = (e, t, n) => {
+}), X = (e, t, n) => {
 	let r = n.request.subject;
-	return (r.scopes ?? []).includes("admin:full") ? v.void : e.head(t, { tenantId: r.tenantId ?? null }).pipe(v.catch(() => v.fail(lr())), v.flatMap((e) => {
+	return (r.scopes ?? []).includes("admin:full") ? U.void : e.head(t, { tenantId: r.tenantId ?? null }).pipe(U.catch(() => U.fail(Y())), U.flatMap((e) => {
 		let t = e?.ownerId;
-		return t != null && t === r.id ? v.void : v.fail(lr());
+		return t != null && t === r.id ? U.void : U.fail(Y());
 	}));
-}, dr = () => new t({
+}, gt = () => new p({
 	provider: "storage",
 	message: "an upload needs an identified caller: this request carries no subject, and the app has not set `anonymousUploads: true` on storagePlugin. The ticket attributes the object to whoever minted it — with no subject there is nobody to attribute it to, so the finalized object would carry no owner and no tenant and no later owner check, tenant filter or quota could reach it.",
 	transient: !1,
 	status: 401
-}), fr = (e, t) => {
+}), Z = (e, t) => {
 	let n = e.request.subject.id ?? null, r = e.request.subject.tenantId ?? null;
-	return n === null && !t ? v.fail(dr()) : v.succeed({
+	return n === null && !t ? U.fail(gt()) : U.succeed({
 		id: n,
 		tenantId: r
 	});
-}, pr = (e, t) => e !== null && e !== (t ?? null), mr = (e) => ({
+}, _t = (e, t) => e !== null && e !== (t ?? null), Q = (e) => ({
 	id: e.id,
 	refId: e.refId,
 	principalType: e.principalType,
@@ -2817,94 +160,111 @@ var qn = () => _e({
 	createdAt: e.createdAt.toISOString(),
 	expiresAt: e.expiresAt ? e.expiresAt.toISOString() : null,
 	createdBy: e.createdBy
-}), hr = "@voltro/plugin-storage", gr = (e = {}) => w({
-	base: hr,
+}), $ = "@voltro/plugin-storage", vt = (e = {}) => G({
+	base: $,
 	alias: e.alias,
 	instance: e.name
-}), _r = (i = {}) => {
-	let y = w({
-		base: hr,
-		alias: i.alias,
-		instance: i.name
-	}), b = y === hr ? "/_voltro/storage" : `/_voltro/storage/i/${Buffer.from(y).toString("hex")}`, x = ir(i);
-	tr(x);
-	let ue = U.read("S3_BUCKET", i.bucket) ?? U.read("STORAGE_BUCKET") ?? "voltro", T = U.read("VOLTRO_PUBLIC_URL", i.publicBaseUrl), E = or(i.allowedOrigins), D = i.limits?.maxBytes, O = i.anonymousUploads === !0, de = 5242880, fe = 21600, k = i.refStore === void 0 || i.refStore === "memory", pe = i.grantStore === void 0 || i.grantStore === "memory", A = (e, n) => v.gen(function* () {
-		let r = (e) => S.decodeUnknownEffect(ae)(e, { onExcessProperty: "error" }).pipe(v.mapError(() => new t({
+}), yt = (e) => e.reason === "too-large" ? 413 : e.reason === "operation-identity-reused" || e.reason === "operation-store-unbound" || e.reason === "claim-not-held" ? 409 : 415, bt = (e = {}) => {
+	let t = G({
+		base: $,
+		alias: e.alias,
+		instance: e.name
+	}), r = t === $ ? "/_voltro/storage" : `/_voltro/storage/i/${Buffer.from(t).toString("hex")}`, i = q(e);
+	ut(i);
+	let a = w.read("S3_BUCKET", e.bucket) ?? w.read("STORAGE_BUCKET") ?? "voltro", o = w.read("VOLTRO_PUBLIC_URL", e.publicBaseUrl), s = mt(e.allowedOrigins), c = e.limits?.maxBytes, l = e.anonymousUploads === !0, u = 5242880, d = 21600, f = e.refStore === void 0 || e.refStore === "memory", m = e.grantStore === void 0 || e.grantStore === "memory", h = (t, n) => U.gen(function* () {
+		let r = (e) => W.decodeUnknownEffect(it)(e, { onExcessProperty: "error" }).pipe(U.mapError(() => new p({
 			provider: "storage",
 			message: "Invalid upload access policy",
 			transient: !1,
 			status: 400
-		}))), a = e.access === void 0 ? void 0 : yield* r(e.access), o = e.visibility ?? "private";
-		if (a !== void 0 && o === "public") return yield* v.fail(new t({
+		}))), i = t.access === void 0 ? void 0 : yield* r(t.access), a = t.visibility ?? "private";
+		if (i !== void 0 && a === "public") return yield* U.fail(new p({
 			provider: "storage",
 			message: "An access policy requires a private upload",
 			transient: !1,
 			status: 400
 		}));
-		let s = i.uploadAccess;
-		if (a !== void 0 && typeof s != "function") return yield* v.fail(new t({
+		let o = e.uploadAccess;
+		if (i !== void 0 && typeof o != "function") return yield* U.fail(new p({
 			provider: "storage",
 			message: "Requested upload access requires an uploadAccess authorization function on storagePlugin",
 			transient: !1,
 			status: 403
 		}));
-		let c = typeof s == "function" ? yield* s({
+		let s = typeof o == "function" ? yield* o({
 			subject: n,
-			requested: a,
-			visibility: o,
-			contentType: e.contentType
-		}) : o === "private" ? s : void 0, l = c === void 0 ? void 0 : yield* r(c);
-		return o === "public" ? l !== void 0 && l.length > 0 ? yield* v.fail(new t({
+			requested: i,
+			visibility: a,
+			contentType: t.contentType
+		}) : a === "private" ? o : void 0, c = s === void 0 ? void 0 : yield* r(s);
+		return a === "public" ? c !== void 0 && c.length > 0 ? yield* U.fail(new p({
 			provider: "storage",
 			message: "A public upload cannot carry an access policy",
 			transient: !1,
 			status: 400
-		})) : {} : l === void 0 ? {} : { access: l };
-	}), j = { current: k ? on() : i.refStore }, M = { current: pe ? un() : i.grantStore }, me = { current: void 0 }, he = {
-		insert: (e) => j.current.insert(e),
-		getById: (e) => j.current.getById(e),
-		delete: (e) => j.current.delete(e),
-		statistics: () => j.current.statistics(),
-		listRecent: (e) => j.current.listRecent(e),
-		countByKey: (e, t) => j.current.countByKey(e, t),
-		usageByTenant: (e) => j.current.usageByTenant(e),
-		consumeUsage: (e, t, n) => j.current.consumeUsage(e, t, n),
-		releaseUsage: (e, t) => j.current.releaseUsage(e, t),
-		listByDerivedFrom: (e) => j.current.listByDerivedFrom(e),
-		listRefs: (e) => j.current.listRefs(e),
+		})) : {} : c === void 0 ? {} : { access: c };
+	}), g = { current: f ? B() : e.refStore }, v = { current: m ? we() : e.grantStore }, y = { current: void 0 }, b = {
+		get catalogueId() {
+			return g.current.catalogueId;
+		},
+		insert: (e) => g.current.insert(e),
+		getById: (e) => g.current.getById(e),
+		delete: (e) => g.current.delete(e),
+		statistics: () => g.current.statistics(),
+		listRecent: (e) => g.current.listRecent(e),
+		countByKey: (e, t) => g.current.countByKey(e, t),
+		usageByTenant: (e) => g.current.usageByTenant(e),
+		consumeUsage: (e, t, n) => g.current.consumeUsage(e, t, n),
+		releaseUsage: (e, t) => g.current.releaseUsage(e, t),
+		listByDerivedFrom: (e) => g.current.listByDerivedFrom(e),
+		listRefs: (e) => g.current.listRefs(e),
 		get setVisibility() {
-			return j.current.setVisibility;
+			return g.current.setVisibility;
 		},
 		get countPublicByKey() {
-			return j.current.countPublicByKey;
+			return g.current.countPublicByKey;
 		}
-	}, ge = {
-		insert: (e) => M.current.insert(e),
-		delete: (e) => M.current.delete(e),
-		getById: (e) => M.current.getById(e),
-		listByRef: (e) => M.current.listByRef(e),
-		deleteByRef: (e) => M.current.deleteByRef(e)
-	}, _e = {
-		httpPath: b,
-		provider: x,
-		refStore: he,
-		grantStore: ge,
-		bucket: ue,
-		...i.tenantPrefix === void 0 ? {} : { tenantPrefix: i.tenantPrefix },
-		...i.attempts === void 0 ? {} : { attempts: i.attempts },
-		...i.urlExpiresInSec === void 0 ? {} : { urlExpiresInSec: i.urlExpiresInSec },
-		...i.access === void 0 ? {} : { access: i.access },
-		...i.limits === void 0 ? {} : { limits: i.limits },
-		...i.ingest === void 0 ? {} : { ingest: i.ingest },
-		...i.scan === void 0 ? {} : { scan: i.scan },
-		...i.videoProbe === void 0 ? {} : { videoProbe: i.videoProbe },
-		...i.transcode === void 0 ? {} : { transcode: i.transcode },
-		...i.autoTranscode === void 0 ? {} : { autoTranscode: i.autoTranscode },
-		...T ? { publicBaseUrl: T } : {},
-		...i.normalizeImages === void 0 ? {} : { normalizeImages: i.normalizeImages },
-		...i.quota === void 0 ? {} : { quota: i.quota },
-		objects: () => me.current
-	}, ve = gn(_e), N = hn(_e), ye = `${b}/`, P = (e) => v.runPromise(e.pipe(v.catch(() => v.succeed(null)))), F = (e, t) => {
+	}, x = {
+		insert: (e) => v.current.insert(e),
+		delete: (e) => v.current.delete(e),
+		getById: (e) => v.current.getById(e),
+		listByRef: (e) => v.current.listByRef(e),
+		deleteByRef: (e) => v.current.deleteByRef(e)
+	}, S = {
+		httpPath: r,
+		storageInstance: t,
+		provider: i,
+		refStore: b,
+		grantStore: x,
+		bucket: a,
+		...e.tenantPrefix === void 0 ? {} : { tenantPrefix: e.tenantPrefix },
+		...e.attempts === void 0 ? {} : { attempts: e.attempts },
+		...e.urlExpiresInSec === void 0 ? {} : { urlExpiresInSec: e.urlExpiresInSec },
+		...e.access === void 0 ? {} : { access: e.access },
+		...e.limits === void 0 ? {} : { limits: e.limits },
+		...e.ingest === void 0 ? {} : { ingest: e.ingest },
+		...e.scan === void 0 ? {} : { scan: e.scan },
+		...e.videoProbe === void 0 ? {} : { videoProbe: e.videoProbe },
+		...e.transcode === void 0 ? {} : { transcode: e.transcode },
+		...e.autoTranscode === void 0 ? {} : { autoTranscode: e.autoTranscode },
+		...o ? { publicBaseUrl: o } : {},
+		...e.normalizeImages === void 0 ? {} : { normalizeImages: e.normalizeImages },
+		...e.quota === void 0 ? {} : { quota: e.quota },
+		objects: () => y.current
+	}, ie = Te(S), C = xe(S), T = (e) => C.uploadTicketScope().pipe(U.flatMap((t) => t === e.writeScope ? U.void : U.fail(new p({
+		provider: "storage",
+		message: "Upload ticket belongs to another storage destination",
+		transient: !1,
+		status: 409
+	})))), E = (e, t) => U.runPromise(T(e).pipe(U.match({
+		onSuccess: () => null,
+		onFailure: (e) => ({
+			status: e.status ?? 503,
+			body: e.status === 409 ? e.message : "Storage upload destination could not be checked",
+			contentType: "text/plain",
+			headers: t
+		})
+	}))), D = `${r}/`, O = (e) => U.runPromise(e.pipe(U.catch(() => U.succeed(null)))), k = (e, t) => {
 		if (!e) return "invalid";
 		let n = /^bytes=(\d*)-(\d*)$/.exec(e.trim());
 		if (!n) return "invalid";
@@ -2925,34 +285,34 @@ var qn = () => _e({
 			start: a,
 			endInclusive: o
 		};
-	}, be = i.publicCacheSeconds === void 0 ? "public, max-age=31536000, immutable" : `public, max-age=${Math.max(0, Math.floor(i.publicCacheSeconds))}`, xe = /^(?:image\/(?!svg)|video\/|audio\/|application\/pdf(?:;|$)|text\/plain(?:;|$))/i, Se = (e) => ({
+	}, ae = e.publicCacheSeconds === void 0 ? "public, max-age=31536000, immutable" : `public, max-age=${Math.max(0, Math.floor(e.publicCacheSeconds))}`, A = /^(?:image\/(?!svg)|video\/|audio\/|application\/pdf(?:;|$)|text\/plain(?:;|$))/i, j = (e) => ({
 		"x-content-type-options": "nosniff",
-		"content-disposition": xe.test(e) ? "inline" : "attachment"
-	}), I = ot(), we = async (e, t, n, r) => {
+		"content-disposition": A.test(e) ? "inline" : "attachment"
+	}), ce = oe(), M = async (e, t, n, r) => {
 		if (n) {
-			let r, i = await I.getOrCreate(_t(JSON.stringify([e.id, e.checksum]), e.contentType, n), async () => {
-				let t = await P(N.get(e.id));
-				return t ? (r = t.bytes, mt(t.bytes, e.contentType, n)) : null;
+			let r, i = await ce.getOrCreate(de(JSON.stringify([e.id, e.checksum]), e.contentType, n), async () => {
+				let t = await O(C.get(e.id));
+				return t ? (r = t.bytes, ue(t.bytes, e.contentType, n)) : null;
 			}).catch(() => null);
-			if (!i && r === void 0 && (r = (await P(N.get(e.id)))?.bytes), !i && r === void 0) return {
+			if (!i && r === void 0 && (r = (await O(C.get(e.id)))?.bytes), !i && r === void 0) return {
 				status: 404,
 				body: "not found",
 				contentType: "text/plain"
 			};
-			let a = i ? i.bytes : r, o = i ? i.contentType : e.contentType, s = await pt(e.contentType, i !== null);
+			let a = i ? i.bytes : r, o = i ? i.contentType : e.contentType, s = await le(e.contentType, i !== null);
 			return {
 				status: 200,
 				body: a,
 				contentType: o,
 				headers: {
-					...Se(o),
+					...j(o),
 					"cache-control": t,
 					"accept-ranges": "none",
 					...s === null ? {} : { "x-voltro-transform": `original; reason=${s}` }
 				}
 			};
 		}
-		let i = r === void 0 ? "invalid" : F(r, e.size);
+		let i = r === void 0 ? "invalid" : k(r, e.size);
 		if (i === "unsatisfiable") return {
 			status: 416,
 			body: "range not satisfiable",
@@ -2963,13 +323,13 @@ var qn = () => _e({
 			}
 		};
 		if (i !== "invalid") {
-			let n = await P(N.getRange(e.id, i));
+			let n = await O(C.getRange(e.id, i));
 			return n ? {
 				status: 206,
 				body: n.bytes,
 				contentType: e.contentType,
 				headers: {
-					...Se(e.contentType),
+					...j(e.contentType),
 					"cache-control": t,
 					"accept-ranges": "bytes",
 					"content-range": `bytes ${i.start}-${i.endInclusive}/${n.totalSize}`
@@ -2980,69 +340,69 @@ var qn = () => _e({
 				contentType: "text/plain"
 			};
 		}
-		let a = await P(N.getStream(e.id));
+		let a = await O(C.getStream(e.id));
 		return a ? {
 			status: 200,
 			contentType: e.contentType,
 			headers: {
-				...Se(e.contentType),
+				...j(e.contentType),
 				"cache-control": t,
 				"accept-ranges": "bytes"
 			},
 			byteStream: {
 				contentLength: e.size,
-				stream: () => C.toReadableStream(a.stream)
+				stream: () => nt.toReadableStream(a.stream)
 			}
 		} : {
 			status: 404,
 			body: "not found",
 			contentType: "text/plain"
 		};
-	}, Ee = async (e) => {
-		let t = e.path.startsWith(ye) ? e.path.slice(ye.length).split("/")[0] ?? "" : "";
+	}, fe = async (e) => {
+		let t = e.path.startsWith(D) ? e.path.slice(D.length).split("/")[0] ?? "" : "";
 		if (!t) return {
 			status: 404,
 			body: "not found",
 			contentType: "text/plain"
 		};
-		let n = await P(N.head(t));
+		let n = await O(C.head(t));
 		if (!n) return {
 			status: 404,
 			body: "not found",
 			contentType: "text/plain"
 		};
-		let r = lt(e.query), i = e.headers.range, a = n.derivedFrom == null ? null : await P(N.head(n.derivedFrom));
-		if (n.derivedFrom != null && a === null) return {
+		let a = se(e.query), o = e.headers.range, s = n.derivedFrom == null ? null : await O(C.head(n.derivedFrom));
+		if (n.derivedFrom != null && s === null) return {
 			status: 404,
 			body: "not found",
 			contentType: "text/plain"
 		};
-		if (n.visibility === "public" && (a === null || a.visibility === "public")) {
-			let e = x.publicUrl?.(n.key) ?? null;
-			return e && !r ? {
+		if (n.visibility === "public" && (s === null || s.visibility === "public")) {
+			let e = i.publicUrl?.(n.key) ?? null;
+			return e && !a ? {
 				status: 302,
 				headers: {
 					location: e,
 					"cache-control": "public, max-age=300"
 				}
-			} : we(n, be, r, i);
+			} : M(n, ae, a, o);
 		}
-		let o = !1, s = e.query ? new URLSearchParams(e.query).get("t") : null;
-		if (s) {
-			let e = Nt(s);
-			o = !!e && (e.refId === t || a !== null && e.refId === a.id) && e.audience === b;
+		let c = !1, l = e.query ? new URLSearchParams(e.query).get("t") : null;
+		if (l) {
+			let e = ye(l);
+			c = !!e && (e.refId === t || s !== null && e.refId === s.id) && e.audience === r;
 		}
-		if (!o) {
-			let t = se(e.headers.cookie, $n), r = t ? le(t, ce()) : null;
-			r && (o = await P(N.checkAccess(n, r)) === !0);
+		if (!c) {
+			let t = ot(e.headers.cookie, lt), r = t ? ct(t, st()) : null;
+			r && (c = await O(C.checkAccess(n, r)) === !0);
 		}
-		if (!o) return {
+		if (!c) return {
 			status: 403,
 			body: "forbidden",
 			contentType: "text/plain"
 		};
-		if (x.presigns && !r) {
-			let e = await P(x.getUrl(n.key, 300));
+		if (i.presigns && !a) {
+			let e = await O(i.getUrl(n.key, 300));
 			if (e && /^https?:/.test(e)) return {
 				status: 302,
 				headers: {
@@ -3051,12 +411,12 @@ var qn = () => _e({
 				}
 			};
 		}
-		return we(n, "private, no-store", r, i);
-	}, L = {
+		return M(n, "private, no-store", a, o);
+	}, pe = {
 		method: "GET",
-		path: b,
+		path: r,
 		handle: async (e) => {
-			let t = await Ee(e), n = sr(e.headers.origin, E);
+			let t = await fe(e), n = J(e.headers.origin, s);
 			return Object.keys(n).length === 0 ? t : {
 				...t,
 				headers: {
@@ -3065,128 +425,127 @@ var qn = () => _e({
 				}
 			};
 		}
-	}, De = {
+	}, he = {
 		method: "*",
-		path: `${b}/upload`,
+		path: `${r}/upload`,
 		originGuard: "exempt",
 		handle: async (e) => {
-			let t = sr(e.headers.origin, E);
+			let n = J(e.headers.origin, s);
 			if (e.method === "OPTIONS") return {
 				status: 204,
-				headers: t
+				headers: n
 			};
 			if (e.method !== "POST") return {
 				status: 405,
 				body: "method not allowed",
 				contentType: "text/plain",
-				headers: t
+				headers: n
 			};
-			let n = e.query ? new URLSearchParams(e.query).get("ticket") : null, r = n ? It(n) : null;
-			if (!r || r.instance !== y) return {
+			let r = e.query ? new URLSearchParams(e.query).get("ticket") : null, i = r ? F(r) : null;
+			if (!i || i.instance !== t) return {
 				status: 401,
 				body: "invalid or expired upload ticket",
 				contentType: "text/plain",
-				headers: t
-			};
-			if (r.replicaId !== void 0 && r.replicaId !== ie().replicaId) return {
-				status: 409,
-				body: "upload ticket belongs to another replica",
-				contentType: "text/plain",
-				headers: t
+				headers: n
 			};
+			let a = await E(i, n);
+			if (a) return a;
 			if (e.rawBody.length === 0) return {
 				status: 400,
 				body: "empty body",
 				contentType: "text/plain",
-				headers: t
+				headers: n
 			};
-			if (r.max && e.rawBody.length > r.max) return {
+			if (i.max && e.rawBody.length > i.max) return {
 				status: 413,
 				body: "payload too large",
 				contentType: "text/plain",
-				headers: t
+				headers: n
 			};
-			let i = await v.runPromise(N.put({
+			let o = await U.runPromise(C.put({
 				bytes: e.rawBody,
-				contentType: r.ct,
-				tenantId: r.tenant,
-				ownerId: r.sub,
-				visibility: r.vis,
-				...r.access === void 0 ? {} : { access: r.access },
-				...r.operationId === void 0 ? {} : { operationId: r.operationId },
-				...r.key === void 0 ? {} : { key: r.key },
-				...r.folder === void 0 ? {} : { folder: r.folder },
-				...r.tags === void 0 ? {} : { tags: r.tags },
-				...r.alt === void 0 ? {} : { alt: r.alt },
-				...r.caption === void 0 ? {} : { caption: r.caption }
-			}).pipe(v.flatMap((e) => N.getUrl(e.id).pipe(v.map((t) => ({
+				contentType: i.ct,
+				tenantId: i.tenant,
+				ownerId: i.sub,
+				visibility: i.vis,
+				...i.access === void 0 ? {} : { access: i.access },
+				...i.operationId === void 0 ? {} : { operationId: i.operationId },
+				...i.key === void 0 ? {} : { key: i.key },
+				...i.folder === void 0 ? {} : { folder: i.folder },
+				...i.tags === void 0 ? {} : { tags: i.tags },
+				...i.alt === void 0 ? {} : { alt: i.alt },
+				...i.caption === void 0 ? {} : { caption: i.caption }
+			}).pipe(U.flatMap((e) => C.getUrl(e.id).pipe(U.map((t) => ({
 				kind: "ok",
 				ref: e,
 				url: t
-			})))), v.catchTags({
-				StorageRejected: (e) => v.succeed({
+			})))), U.catchTags({
+				StorageRejected: (e) => U.succeed({
 					kind: "rejected",
-					status: e.reason === "too-large" ? 413 : 415,
+					status: yt(e),
 					detail: e.detail
 				}),
-				StorageScanRejected: (e) => v.succeed({
+				StorageScanRejected: (e) => U.succeed({
 					kind: "scan",
 					threat: e.threat
 				}),
-				StorageError: (e) => v.succeed({
+				StorageError: (e) => U.succeed({
 					kind: "error",
-					message: e.message
+					message: e.message,
+					status: e.status ?? 500
 				})
 			})));
-			return i.kind === "ok" ? {
+			return o.kind === "ok" ? {
 				status: 201,
 				body: JSON.stringify({
-					id: i.ref.id,
-					url: i.url,
-					contentType: i.ref.contentType,
-					size: i.ref.size
+					id: o.ref.id,
+					url: o.url,
+					contentType: o.ref.contentType,
+					size: o.ref.size
 				}),
 				contentType: "application/json",
-				headers: t
-			} : i.kind === "rejected" ? {
-				status: i.status,
-				body: i.detail,
+				headers: n
+			} : o.kind === "rejected" ? {
+				status: o.status,
+				body: o.detail,
 				contentType: "text/plain",
-				headers: t
-			} : i.kind === "scan" ? {
+				headers: n
+			} : o.kind === "scan" ? {
 				status: 422,
-				body: `rejected: ${i.threat}`,
+				body: `rejected: ${o.threat}`,
 				contentType: "text/plain",
-				headers: t
+				headers: n
 			} : {
-				status: 500,
-				body: i.message,
+				status: o.status,
+				body: o.message,
 				contentType: "text/plain",
-				headers: t
+				headers: n
 			};
 		}
-	}, Oe = {
+	}, I = {
 		method: "*",
-		path: `${b}/upload/resumable`,
+		path: `${r}/upload/resumable`,
 		originGuard: "exempt",
 		handle: async (e) => {
-			let t = sr(e.headers.origin, E);
+			let n = J(e.headers.origin, s);
 			if (e.method === "OPTIONS") return {
 				status: 204,
-				headers: t
+				headers: n
 			};
-			let n = new URLSearchParams(e.query || ""), r = Bt(n.get("token") ?? "");
-			if (!r || r.instance !== y) return {
+			let r = new URLSearchParams(e.query || ""), i = be(r.get("token") ?? "");
+			if (!i || i.instance !== t) return {
 				status: 401,
 				body: "invalid or expired resumable token",
 				contentType: "text/plain",
-				headers: t
+				headers: n
 			};
+			let a = await E(i, n);
+			if (a) return a;
 			if (e.method === "GET" || e.method === "HEAD") {
-				let e = await v.runPromise(N.resumableStatus({
-					uploadId: r.id,
-					tenantId: r.tenant
-				}).pipe(v.match({
+				let e = await U.runPromise(C.resumableStatus({
+					uploadId: i.id,
+					tenantId: i.tenant
+				}).pipe(U.match({
 					onFailure: (e) => ({ error: e.message }),
 					onSuccess: (e) => e
 				})));
@@ -3194,13 +553,13 @@ var qn = () => _e({
 					status: 500,
 					body: e.error,
 					contentType: "text/plain",
-					headers: t
+					headers: n
 				} : {
 					status: 200,
 					body: JSON.stringify(e),
 					contentType: "application/json",
 					headers: {
-						...t,
+						...n,
 						"upload-offset": String(e.offset)
 					}
 				};
@@ -3209,168 +568,177 @@ var qn = () => _e({
 				status: 405,
 				body: "method not allowed",
 				contentType: "text/plain",
-				headers: t
+				headers: n
 			};
-			let i = Number(n.get("index"));
-			if (!Number.isInteger(i) || i < 0) return {
+			let o = Number(r.get("index"));
+			if (!Number.isInteger(o) || o < 0) return {
 				status: 400,
 				body: "missing/invalid chunk index",
 				contentType: "text/plain",
-				headers: t
+				headers: n
 			};
 			if (e.rawBody.length === 0) return {
 				status: 400,
 				body: "empty chunk",
 				contentType: "text/plain",
-				headers: t
+				headers: n
 			};
-			let a = n.get("final") === "1", o = await v.runPromise(N.putResumableChunk({
-				uploadId: r.id,
-				tenantId: r.tenant,
-				index: i,
+			let c = r.get("final") === "1", l = await U.runPromise(C.putResumableChunk({
+				uploadId: i.id,
+				tenantId: i.tenant,
+				index: o,
 				bytes: e.rawBody
-			}).pipe(v.flatMap(() => a ? N.finalizeResumable({
-				uploadId: r.id,
-				count: i + 1,
-				contentType: r.ct,
-				tenantId: r.tenant,
-				ownerId: r.sub,
-				visibility: r.vis,
-				...r.access === void 0 ? {} : { access: r.access },
-				...r.folder === void 0 ? {} : { folder: r.folder },
-				...r.tags === void 0 ? {} : { tags: r.tags },
-				...r.alt === void 0 ? {} : { alt: r.alt },
-				...r.caption === void 0 ? {} : { caption: r.caption }
-			}).pipe(v.flatMap((e) => N.getUrl(e.id).pipe(v.map((t) => ({
+			}).pipe(U.flatMap(() => c ? C.finalizeResumable({
+				uploadId: i.id,
+				count: o + 1,
+				contentType: i.ct,
+				tenantId: i.tenant,
+				ownerId: i.sub,
+				visibility: i.vis,
+				...i.access === void 0 ? {} : { access: i.access },
+				...i.folder === void 0 ? {} : { folder: i.folder },
+				...i.tags === void 0 ? {} : { tags: i.tags },
+				...i.alt === void 0 ? {} : { alt: i.alt },
+				...i.caption === void 0 ? {} : { caption: i.caption }
+			}).pipe(U.flatMap((e) => C.getUrl(e.id).pipe(U.map((t) => ({
 				kind: "done",
 				ref: e,
 				url: t
-			}))))) : v.succeed({ kind: "chunk" })), v.catchTags({
-				StorageRejected: (e) => v.succeed({
+			}))))) : U.succeed({ kind: "chunk" })), U.catchTags({
+				StorageRejected: (e) => U.succeed({
 					kind: "rejected",
-					status: e.reason === "too-large" ? 413 : 415,
+					status: yt(e),
 					detail: e.detail
 				}),
-				StorageScanRejected: (e) => v.succeed({
+				StorageScanRejected: (e) => U.succeed({
 					kind: "scan",
 					threat: e.threat
 				}),
-				StorageError: (e) => v.succeed({
+				StorageError: (e) => U.succeed({
 					kind: "error",
-					message: e.message
+					message: e.message,
+					status: e.status ?? 500
 				})
 			})));
-			return o.kind === "chunk" ? {
+			return l.kind === "chunk" ? {
 				status: 204,
 				headers: {
-					...t,
-					"upload-offset": String(i + 1)
+					...n,
+					"upload-offset": String(o + 1)
 				}
-			} : o.kind === "done" ? {
+			} : l.kind === "done" ? {
 				status: 201,
 				body: JSON.stringify({
-					id: o.ref.id,
-					url: o.url,
-					contentType: o.ref.contentType,
-					size: o.ref.size
+					id: l.ref.id,
+					url: l.url,
+					contentType: l.ref.contentType,
+					size: l.ref.size
 				}),
 				contentType: "application/json",
-				headers: t
-			} : o.kind === "rejected" ? {
-				status: o.status,
-				body: o.detail,
+				headers: n
+			} : l.kind === "rejected" ? {
+				status: l.status,
+				body: l.detail,
 				contentType: "text/plain",
-				headers: t
-			} : o.kind === "scan" ? {
+				headers: n
+			} : l.kind === "scan" ? {
 				status: 422,
-				body: `rejected: ${o.threat}`,
+				body: `rejected: ${l.threat}`,
 				contentType: "text/plain",
-				headers: t
+				headers: n
 			} : {
-				status: 500,
-				body: o.message,
+				status: l.status,
+				body: l.message,
 				contentType: "text/plain",
-				headers: t
+				headers: n
 			};
 		}
-	}, R = (e) => ({
+	}, L = (e) => ({
 		kind: "json",
 		data: e
-	}), z = (e, t) => ({
+	}), R = (e, t) => ({
 		kind: "json",
 		status: e,
 		data: { error: t }
-	}), ke = (e, t) => {
+	}), z = (e, t) => {
 		try {
 			return new URL(e, "http://localhost").searchParams.get(t);
 		} catch {
 			return null;
 		}
-	}, Ae = [
+	}, V = U.gen(function* () {
+		return {
+			catalogueId: yield* b.catalogueId,
+			objectNamespace: yield* i.objectNamespace,
+			storageInstance: t
+		};
+	}), De = [
 		{
 			method: "POST",
 			path: "/upload-ticket",
 			description: "Authorize a binary upload with explicit tenant and owner attribution",
-			handler: (e) => v.gen(function* () {
-				let n = S.String.pipe(S.check(S.makeFilter((e) => e.trim().length > 0))), r = yield* S.decodeUnknownEffect(S.fromJsonString(S.Struct({
-					operationId: S.optional(n.pipe(S.check(S.isMaxLength(200)))),
-					tenantId: S.NullOr(n),
-					ownerId: S.NullOr(n),
-					key: n.pipe(S.check(S.isMaxLength(1024))),
-					contentType: n.pipe(S.check(S.isMaxLength(255)), S.check(S.makeFilter((e) => !/[\r\n]/.test(e)))),
-					size: S.Number.pipe(S.check(S.isInt()), S.check(S.isGreaterThan(0)), S.check(S.makeFilter(Number.isSafeInteger))),
-					visibility: S.optional(S.Literals(["public", "private"]))
-				})))(e.body).pipe(v.mapError(() => new t({
+			handler: (n) => U.gen(function* () {
+				let i = W.String.pipe(W.check(W.makeFilter((e) => e.trim().length > 0))), a = yield* W.decodeUnknownEffect(W.fromJsonString(W.Struct({
+					operationId: W.optional(i.pipe(W.check(W.isMaxLength(200)))),
+					tenantId: W.NullOr(i),
+					ownerId: W.NullOr(i),
+					key: i.pipe(W.check(W.isMaxLength(1024))),
+					contentType: i.pipe(W.check(W.isMaxLength(255)), W.check(W.makeFilter((e) => !/[\r\n]/.test(e)))),
+					size: W.Number.pipe(W.check(W.isInt()), W.check(W.isGreaterThan(0)), W.check(W.makeFilter(Number.isSafeInteger))),
+					visibility: W.optional(W.Literals(["public", "private"]))
+				})))(n.body).pipe(U.mapError(() => new p({
 					provider: "inspect",
 					message: "Provide explicit tenantId and ownerId (or null), key, contentType and a positive file size",
 					transient: !1,
 					status: 400
 				})));
-				if (r.operationId !== void 0 && me.current === void 0) return z(409, "Durable uploads require a bound operation store with default reference and grant stores");
-				if (D !== void 0 && r.size > D) return z(413, "File exceeds the configured upload limit");
-				let a = r.visibility !== "public" && Array.isArray(i.uploadAccess) ? yield* S.decodeUnknownEffect(ae)(i.uploadAccess, { onExcessProperty: "error" }).pipe(v.mapError(() => new t({
+				if (a.operationId !== void 0 && y.current === void 0) return R(409, "Durable uploads require a bound operation store with default reference and grant stores");
+				if (c !== void 0 && a.size > c) return R(413, "File exceeds the configured upload limit");
+				let o = a.operationId ?? (y.current === void 0 ? void 0 : H()), s = o === void 0 ? void 0 : "inspect-upload:" + tt("sha256").update(JSON.stringify([t, o])).digest("hex"), l = a.visibility !== "public" && Array.isArray(e.uploadAccess) ? yield* W.decodeUnknownEffect(it)(e.uploadAccess, { onExcessProperty: "error" }).pipe(U.mapError(() => new p({
 					provider: "storage",
 					message: "Invalid upload access policy",
 					transient: !1,
 					status: 400
-				}))) : void 0, o = Ft({
-					instance: y,
-					...a === void 0 ? {} : { access: a },
-					...r.operationId === void 0 ? {} : { operationId: `inspect-upload:${Ce("sha256").update(JSON.stringify([y, r.operationId])).digest("hex")}` },
-					replicaId: ie().replicaId,
-					sub: r.ownerId,
-					tenant: r.tenantId,
-					ct: r.contentType,
-					key: r.key,
-					vis: r.visibility ?? "private",
-					max: r.size
+				}))) : void 0, u = yield* C.uploadTicketScope(), d = N({
+					writeScope: u,
+					instance: t,
+					issuerReplicaId: rt().replicaId,
+					...l === void 0 ? {} : { access: l },
+					...s === void 0 ? {} : { operationId: s },
+					sub: a.ownerId,
+					tenant: a.tenantId,
+					ct: a.contentType,
+					key: a.key,
+					vis: a.visibility ?? "private",
+					max: a.size
 				}, 300);
-				return R({
-					uploadPath: `${b}/upload?ticket=${encodeURIComponent(o)}`,
+				return L({
+					uploadPath: `${r}/upload?ticket=${encodeURIComponent(d)}`,
 					expiresInSec: 300,
-					maxBytes: r.size
+					maxBytes: a.size,
+					...o === void 0 ? {} : { operationId: o }
 				});
-			}).pipe(v.catch((e) => v.succeed(z(e.status ?? 500, e.message))))
+			}).pipe(U.catch((e) => U.succeed(R(e.status ?? 500, e.message))))
 		},
 		{
 			method: "GET",
 			path: "/download",
 			description: "Stream a stored file as an attachment for authorized inspect readers",
-			handler: (e) => v.gen(function* () {
-				let t = ke(e.url, "refId");
-				if (!t?.trim()) return z(400, "A non-empty refId is required");
-				let { ref: n, stream: r } = yield* N.getStream(t), i = n.key.split("/").pop() || n.id, a = encodeURIComponent(i).replace(/[!'()*]/g, (e) => `%${e.charCodeAt(0).toString(16).toUpperCase()}`);
+			handler: (e) => U.gen(function* () {
+				let t = z(e.url, "refId");
+				if (!t?.trim()) return R(400, "A non-empty refId is required");
+				let { ref: n, stream: r } = yield* C.getStream(t), i = n.key.split("/").pop() || n.id, a = encodeURIComponent(i).replace(/[!'()*]/g, (e) => `%${e.charCodeAt(0).toString(16).toUpperCase()}`);
 				return {
 					kind: "bytes",
 					contentType: n.contentType,
 					byteStream: {
-						stream: () => C.toReadableStream(r),
+						stream: () => nt.toReadableStream(r),
 						contentLength: n.size,
 						contentDisposition: `attachment; filename="download"; filename*=UTF-8''${a}`
 					},
 					headers: { "cache-control": "no-store" }
 				};
-			}).pipe(v.catch((e) => v.succeed(z(e.status ?? 500, e.message))))
+			}).pipe(U.catch((e) => U.succeed(R(e.status ?? 500, e.message))))
 		},
 		{
 			method: "GET",
@@ -3378,8 +746,8 @@ var qn = () => _e({
 			scope: "process",
 			description: "Searchable storage refs, newest first, paginated",
 			handler: (e) => {
-				let t = Number(ke(e.url, "offset") ?? 0), n = Number.isSafeInteger(t) && t >= 0 ? t : 0, r = (ke(e.url, "search") ?? "").trim().slice(0, 200);
-				return he.listRefs({
+				let t = Number(z(e.url, "offset") ?? 0), n = Number.isSafeInteger(t) && t >= 0 ? t : 0, r = (z(e.url, "search") ?? "").trim().slice(0, 200);
+				return b.listRefs({
 					tenantId: void 0,
 					ownerId: void 0,
 					folder: void 0,
@@ -3388,14 +756,15 @@ var qn = () => _e({
 					search: r,
 					limit: 51,
 					offset: n
-				}).pipe(v.map((e) => R({
-					refs: e.slice(0, 50).map(cr),
+				}).pipe(U.flatMap((e) => V.pipe(U.map((t) => L({
+					source: t,
+					refs: e.slice(0, 50).map(ht),
 					page: {
 						search: r,
 						offset: n,
 						nextOffset: e.length > 50 ? n + 50 : null
 					}
-				})), v.catch((e) => v.succeed(z(500, e.message))));
+				})))), U.catch((e) => U.succeed(R(500, e.message))));
 			}
 		},
 		{
@@ -3403,11 +772,12 @@ var qn = () => _e({
 			path: "/stats",
 			scope: "process",
 			description: "Object count + total bytes per tenant + visibility split",
-			handler: () => he.statistics().pipe(v.map((e) => R({
-				provider: x.name,
-				bucket: ue,
+			handler: () => b.statistics().pipe(U.flatMap((e) => V.pipe(U.map((t) => L({
+				source: t,
+				provider: i.name,
+				bucket: a,
 				...e
-			})), v.catch((e) => v.succeed(z(500, e.message))))
+			})))), U.catch((e) => U.succeed(R(500, e.message))))
 		},
 		{
 			method: "GET",
@@ -3415,171 +785,185 @@ var qn = () => _e({
 			scope: "process",
 			description: "Grants for a ref (?refId=…)",
 			handler: (e) => {
-				let t = ke(e.url, "refId");
-				return t ? ge.listByRef(t).pipe(v.map((e) => R({ grants: e.map(mr) })), v.catch((e) => v.succeed(z(500, e.message)))) : v.succeed(z(400, "refId query param required"));
+				let t = z(e.url, "refId");
+				return t ? x.listByRef(t).pipe(U.map((e) => L({ grants: e.map(Q) })), U.catch((e) => U.succeed(R(500, e.message)))) : U.succeed(R(400, "refId query param required"));
 			}
 		},
 		{
 			method: "POST",
 			path: "/share",
 			description: "Grant a principal access to a ref",
-			handler: (e) => v.gen(function* () {
-				let n = yield* S.decodeUnknownEffect(S.fromJsonString(S.Struct({
-					refId: S.String.pipe(S.check(S.makeFilter((e) => e.trim().length > 0))),
-					principalType: S.Literals([
+			handler: (e) => U.gen(function* () {
+				let t = yield* W.decodeUnknownEffect(W.fromJsonString(W.Struct({
+					refId: W.String.pipe(W.check(W.makeFilter((e) => e.trim().length > 0))),
+					principalType: W.Literals([
 						"user",
 						"group",
 						"apiKey"
 					]),
-					principalId: S.String.pipe(S.check(S.makeFilter((e) => e.trim().length > 0))),
-					permission: S.optional(S.Literals(["read", "write"])),
-					expiresInDays: S.optional(S.Number.pipe(S.check(S.isFinite()), S.check(S.isGreaterThan(0))))
-				})))(e.body).pipe(v.mapError(() => new t({
+					principalId: W.String.pipe(W.check(W.makeFilter((e) => e.trim().length > 0))),
+					permission: W.optional(W.Literals(["read", "write"])),
+					expiresInDays: W.optional(W.Number.pipe(W.check(W.isFinite()), W.check(W.isGreaterThan(0))))
+				})))(e.body).pipe(U.mapError(() => new p({
 					provider: "inspect",
 					message: "Invalid share input: provide refId, principalType, principalId, read/write permission and a positive finite expiry if set",
 					transient: !1,
 					status: 400
-				}))), r = n.expiresInDays === void 0 ? null : new Date(Date.now() + n.expiresInDays * 864e5);
-				if (r !== null && !Number.isFinite(r.getTime())) return z(400, "Expiry exceeds the supported date range");
-				let i = yield* N.grant({
-					refId: n.refId,
-					principalType: n.principalType,
-					principalId: n.principalId,
-					...n.permission ? { permission: n.permission } : {},
-					expiresAt: r
+				}))), n = t.expiresInDays === void 0 ? null : new Date(Date.now() + t.expiresInDays * 864e5);
+				if (n !== null && !Number.isFinite(n.getTime())) return R(400, "Expiry exceeds the supported date range");
+				let r = yield* C.grant({
+					refId: t.refId,
+					principalType: t.principalType,
+					principalId: t.principalId,
+					...t.permission ? { permission: t.permission } : {},
+					expiresAt: n
 				});
-				return R({ grant: mr(i) });
-			}).pipe(v.catch((e) => v.succeed(z(e.status ?? 500, e.message ?? "share failed"))))
+				return L({ grant: Q(r) });
+			}).pipe(U.catch((e) => U.succeed(R(e.status ?? 500, e.message ?? "share failed"))))
 		},
 		{
 			method: "POST",
 			path: "/delete",
 			description: "Delete an object reference and its grants; release unreferenced bytes",
-			handler: (e) => v.gen(function* () {
-				let n = yield* S.decodeUnknownEffect(S.fromJsonString(S.Struct({ refId: S.String.pipe(S.check(S.makeFilter((e) => e.trim().length > 0))) })))(e.body).pipe(v.mapError(() => new t({
+			handler: (e) => U.gen(function* () {
+				let t = yield* W.decodeUnknownEffect(W.fromJsonString(W.Struct({ refId: W.String.pipe(W.check(W.makeFilter((e) => e.trim().length > 0))) })))(e.body).pipe(U.mapError(() => new p({
 					provider: "inspect",
 					message: "A non-empty refId is required",
 					transient: !1,
 					status: 400
 				})));
-				return yield* N.delete(n.refId), R({ ok: !0 });
-			}).pipe(v.catch((e) => v.succeed(z(e.status ?? 500, e.message))))
+				return yield* C.delete(t.refId), L({ ok: !0 });
+			}).pipe(U.catch((e) => U.succeed(R(e.status ?? 500, e.message))))
 		},
 		{
 			method: "POST",
 			path: "/revoke",
 			description: "Revoke a grant by id",
-			handler: (e) => v.gen(function* () {
-				let n = yield* S.decodeUnknownEffect(S.fromJsonString(S.Struct({ grantId: S.String.pipe(S.check(S.makeFilter((e) => e.trim().length > 0))) })))(e.body).pipe(v.mapError(() => new t({
+			handler: (e) => U.gen(function* () {
+				let t = yield* W.decodeUnknownEffect(W.fromJsonString(W.Struct({ grantId: W.String.pipe(W.check(W.makeFilter((e) => e.trim().length > 0))) })))(e.body).pipe(U.mapError(() => new p({
 					provider: "inspect",
 					message: "A non-empty grantId is required",
 					transient: !1,
 					status: 400
 				})));
-				return yield* N.revoke(n.grantId), R({ ok: !0 });
-			}).pipe(v.catch((e) => v.succeed(z(e.status ?? 500, e.message ?? "revoke failed"))))
+				return yield* C.revoke(t.grantId), L({ ok: !0 });
+			}).pipe(U.catch((e) => U.succeed(R(e.status ?? 500, e.message ?? "revoke failed"))))
 		}
-	], je = [
+	], Ge = [
 		{
-			...te,
+			...ze,
 			execute: (e, t) => {
 				let n = e;
-				return N.mintUrl(n.id, t.request.subject, {
+				return C.mintUrl(n.id, t.request.subject, {
 					...n.password === void 0 ? {} : { password: n.password },
 					...n.expiresInSec === void 0 ? {} : { expiresInSec: n.expiresInSec }
-				}).pipe(v.map((e) => ({ url: e })));
+				}).pipe(U.map((e) => ({ url: e })));
 			}
 		},
 		{
-			...ee,
+			...Re,
 			execute: (e, t) => {
 				let n = e;
-				return N.mintUploadUrl({
+				return C.mintUploadUrl({
 					key: n.key,
 					contentType: n.contentType,
 					tenantId: t.request.subject.tenantId,
 					...n.expiresInSec === void 0 ? {} : { expiresInSec: n.expiresInSec }
-				}).pipe(v.map((e) => ({ url: e })));
+				}).pipe(U.map((e) => ({ url: e })));
 			}
 		},
 		{
-			...m,
-			execute: (e, t) => {
-				let n = e;
-				return fr(t, O).pipe(v.flatMap((e) => A(n, t.request.subject).pipe(v.map((t) => ({
+			...Le,
+			execute: (e, n) => {
+				let i = e;
+				return Z(n, l).pipe(U.flatMap((e) => h(i, n.request.subject).pipe(U.map((t) => ({
 					writer: e,
 					policy: t
-				})))), v.map(({ writer: e, policy: t }) => {
-					let r = n.expiresInSec ?? 900, i = Ft({
-						instance: y,
+				})))), U.flatMap((e) => i.operationId !== void 0 && y.current === void 0 ? U.fail(new p({
+					provider: "storage",
+					message: "Durable uploads require a bound operation store with default reference and grant stores",
+					transient: !1,
+					status: 409
+				})) : U.succeed(e)), U.flatMap(({ writer: e, policy: n }) => C.uploadTicketScope().pipe(U.map((a) => {
+					let s = i.expiresInSec ?? 900, l = i.operationId ?? (y.current === void 0 ? void 0 : H()), u = l === void 0 ? void 0 : "client-upload:" + tt("sha256").update(JSON.stringify([
+						t,
+						e.tenantId,
+						e.id,
+						l
+					])).digest("hex"), d = N({
+						writeScope: a,
+						instance: t,
+						...u === void 0 ? {} : { operationId: u },
 						sub: e.id,
 						tenant: e.tenantId,
-						ct: n.contentType,
-						vis: n.visibility ?? "private",
-						...t,
-						...n.key === void 0 ? {} : { key: n.key },
-						...n.folder === void 0 ? {} : { folder: n.folder },
-						...n.tags === void 0 ? {} : { tags: n.tags },
-						...n.alt === void 0 ? {} : { alt: n.alt },
-						...n.caption === void 0 ? {} : { caption: n.caption },
-						...D === void 0 ? {} : { max: D }
-					}, r);
+						ct: i.contentType,
+						vis: i.visibility ?? "private",
+						...n,
+						...i.key === void 0 ? {} : { key: i.key },
+						...i.folder === void 0 ? {} : { folder: i.folder },
+						...i.tags === void 0 ? {} : { tags: i.tags },
+						...i.alt === void 0 ? {} : { alt: i.alt },
+						...i.caption === void 0 ? {} : { caption: i.caption },
+						...c === void 0 ? {} : { max: c }
+					}, s);
 					return {
-						uploadUrl: `${T ? T.replace(/\/+$/, "") : ""}${b}/upload?ticket=${encodeURIComponent(i)}`,
-						expiresInSec: r
+						uploadUrl: `${o ? o.replace(/\/+$/, "") : ""}${r}/upload?ticket=${encodeURIComponent(d)}`,
+						expiresInSec: s,
+						...l === void 0 ? {} : { operationId: l }
 					};
-				}));
+				}))));
 			}
 		},
 		{
-			...p,
-			execute: (e, t) => {
-				let n = e;
-				return fr(t, O).pipe(v.flatMap((e) => A(n, t.request.subject).pipe(v.map((t) => ({
+			...Ie,
+			execute: (e, n) => {
+				let r = e;
+				return Z(n, l).pipe(U.flatMap((e) => h(r, n.request.subject).pipe(U.map((t) => ({
 					writer: e,
 					policy: t
-				})))), v.flatMap(({ writer: e, policy: t }) => N.mintPresignedUpload({
-					contentType: n.contentType,
+				})))), U.flatMap(({ writer: e, policy: n }) => C.uploadTicketScope().pipe(U.flatMap((i) => C.mintPresignedUpload({
+					contentType: r.contentType,
 					tenantId: e.tenantId,
-					...n.expiresInSec === void 0 ? {} : { expiresInSec: n.expiresInSec }
-				}).pipe(v.map((r) => {
-					let i = Lt({
-						instance: y,
-						key: r.key,
+					...r.expiresInSec === void 0 ? {} : { expiresInSec: r.expiresInSec }
+				}).pipe(U.map((a) => {
+					let o = me({
+						writeScope: i,
+						instance: t,
+						key: a.key,
 						sub: e.id,
 						tenant: e.tenantId,
-						ct: n.contentType,
-						vis: n.visibility ?? "private",
-						...t,
-						...n.folder === void 0 ? {} : { folder: n.folder },
-						...n.tags === void 0 ? {} : { tags: n.tags },
-						...n.alt === void 0 ? {} : { alt: n.alt },
-						...n.caption === void 0 ? {} : { caption: n.caption },
-						...D === void 0 ? {} : { max: D }
-					}, r.expiresInSec);
+						ct: r.contentType,
+						vis: r.visibility ?? "private",
+						...n,
+						...r.folder === void 0 ? {} : { folder: r.folder },
+						...r.tags === void 0 ? {} : { tags: r.tags },
+						...r.alt === void 0 ? {} : { alt: r.alt },
+						...r.caption === void 0 ? {} : { caption: r.caption },
+						...c === void 0 ? {} : { max: c }
+					}, a.expiresInSec);
 					return {
-						uploadUrl: r.uploadUrl,
-						finalizeToken: i,
-						expiresInSec: r.expiresInSec
+						uploadUrl: a.uploadUrl,
+						finalizeToken: o,
+						expiresInSec: a.expiresInSec
 					};
-				}))));
+				}))))));
 			}
 		},
 		{
-			...l,
+			...Me,
 			execute: (e, n) => {
-				let r = Rt(e.finalizeToken);
-				return !r || r.instance !== y ? v.fail(new t({
+				let r = ve(e.finalizeToken);
+				return !r || r.instance !== t ? U.fail(new p({
 					provider: "storage",
 					message: "invalid or expired finalize token",
 					transient: !1,
 					status: 401
-				})) : pr(r.sub, n.request.subject.id) ? v.fail(new t({
+				})) : _t(r.sub, n.request.subject.id) ? U.fail(new p({
 					provider: "storage",
 					message: "finalize token belongs to another subject",
 					transient: !1,
 					status: 403
-				})) : N.finalizeUpload({
+				})) : T(r).pipe(U.flatMap(() => C.finalizeUpload({
 					key: r.key,
 					contentType: r.ct,
 					tenantId: r.tenant,
@@ -3590,118 +974,120 @@ var qn = () => _e({
 					...r.tags === void 0 ? {} : { tags: r.tags },
 					...r.alt === void 0 ? {} : { alt: r.alt },
 					...r.caption === void 0 ? {} : { caption: r.caption }
-				}).pipe(v.flatMap((e) => N.getUrl(e.id).pipe(v.map((t) => ({
+				}).pipe(U.flatMap((e) => C.getUrl(e.id).pipe(U.map((t) => ({
 					id: e.id,
 					url: t,
 					contentType: e.contentType,
 					size: e.size,
 					...e.width == null ? {} : { width: e.width },
 					...e.height == null ? {} : { height: e.height }
-				})))));
+				})))))));
 			}
 		},
 		{
-			...s,
-			execute: (e, t) => {
-				let n = e;
-				return fr(t, O).pipe(v.flatMap((e) => A(n, t.request.subject).pipe(v.map((t) => ({
+			...Ae,
+			execute: (e, n) => {
+				let i = e;
+				return Z(n, l).pipe(U.flatMap((e) => h(i, n.request.subject).pipe(U.map((t) => ({
 					writer: e,
 					policy: t
-				})))), v.map(({ writer: e, policy: t }) => {
-					let r = n.expiresInSec ?? fe, i = Te(), a = n.chunkSize && n.chunkSize > 0 ? n.chunkSize : de;
+				})))), U.flatMap(({ writer: e, policy: n }) => C.uploadTicketScope().pipe(U.map((a) => {
+					let s = i.expiresInSec ?? d, l = H(), f = i.chunkSize && i.chunkSize > 0 ? i.chunkSize : u;
 					return {
-						uploadId: i,
-						resumableToken: zt({
-							instance: y,
-							id: i,
+						uploadId: l,
+						resumableToken: _e({
+							writeScope: a,
+							instance: t,
+							id: l,
 							sub: e.id,
 							tenant: e.tenantId,
-							ct: n.contentType,
-							vis: n.visibility ?? "private",
-							...t,
-							size: n.size,
-							...n.folder === void 0 ? {} : { folder: n.folder },
-							...n.tags === void 0 ? {} : { tags: n.tags },
-							...n.alt === void 0 ? {} : { alt: n.alt },
-							...n.caption === void 0 ? {} : { caption: n.caption },
-							...D === void 0 ? {} : { max: D }
-						}, r),
-						uploadUrl: `${T ? T.replace(/\/+$/, "") : ""}${b}/upload/resumable`,
-						chunkSize: a,
-						expiresInSec: r
+							ct: i.contentType,
+							vis: i.visibility ?? "private",
+							...n,
+							size: i.size,
+							...i.folder === void 0 ? {} : { folder: i.folder },
+							...i.tags === void 0 ? {} : { tags: i.tags },
+							...i.alt === void 0 ? {} : { alt: i.alt },
+							...i.caption === void 0 ? {} : { caption: i.caption },
+							...c === void 0 ? {} : { max: c }
+						}, s),
+						uploadUrl: `${o ? o.replace(/\/+$/, "") : ""}${r}/upload/resumable`,
+						chunkSize: f,
+						expiresInSec: s
 					};
-				}));
+				}))));
 			}
 		},
 		{
-			...o,
-			execute: (e, t) => {
-				let n = e, r = n.expiresInSec ?? fe;
-				return fr(t, O).pipe(v.flatMap((e) => A(n, t.request.subject).pipe(v.map((t) => ({
+			...ke,
+			execute: (e, n) => {
+				let r = e, i = r.expiresInSec ?? d;
+				return Z(n, l).pipe(U.flatMap((e) => h(r, n.request.subject).pipe(U.map((t) => ({
 					writer: e,
 					policy: t
-				})))), v.flatMap(({ writer: e, policy: t }) => N.beginMultipartUpload({
-					contentType: n.contentType,
+				})))), U.flatMap(({ writer: e, policy: n }) => C.uploadTicketScope().pipe(U.flatMap((a) => C.beginMultipartUpload({
+					contentType: r.contentType,
 					tenantId: e.tenantId,
-					visibility: n.visibility ?? "private",
-					expiresInSec: r
-				}).pipe(v.map((i) => ({
-					multipartToken: Vt({
-						instance: y,
-						key: i.key,
-						uploadId: i.uploadId,
+					visibility: r.visibility ?? "private",
+					expiresInSec: i
+				}).pipe(U.map((o) => ({
+					multipartToken: ge({
+						writeScope: a,
+						instance: t,
+						key: o.key,
+						uploadId: o.uploadId,
 						sub: e.id,
 						tenant: e.tenantId,
-						ct: n.contentType,
-						vis: n.visibility ?? "private",
-						...t,
-						size: n.size,
-						...n.folder === void 0 ? {} : { folder: n.folder },
-						...n.tags === void 0 ? {} : { tags: n.tags },
-						...n.alt === void 0 ? {} : { alt: n.alt },
-						...n.caption === void 0 ? {} : { caption: n.caption }
-					}, r),
-					partSize: n.partSize && n.partSize >= de ? n.partSize : de,
-					expiresInSec: r
-				})))));
+						ct: r.contentType,
+						vis: r.visibility ?? "private",
+						...n,
+						size: r.size,
+						...r.folder === void 0 ? {} : { folder: r.folder },
+						...r.tags === void 0 ? {} : { tags: r.tags },
+						...r.alt === void 0 ? {} : { alt: r.alt },
+						...r.caption === void 0 ? {} : { caption: r.caption }
+					}, i),
+					partSize: r.partSize && r.partSize >= u ? r.partSize : u,
+					expiresInSec: i
+				})))))));
 			}
 		},
 		{
-			...g,
+			...He,
 			execute: (e) => {
-				let n = e, r = Ht(n.multipartToken);
-				return !r || r.instance !== y ? v.fail(new t({
+				let n = e, r = P(n.multipartToken);
+				return !r || r.instance !== t ? U.fail(new p({
 					provider: "storage",
 					message: "invalid or expired multipart token",
 					transient: !1,
 					status: 401
-				})) : !Number.isInteger(n.partNumber) || n.partNumber < 1 ? v.fail(new t({
+				})) : !Number.isInteger(n.partNumber) || n.partNumber < 1 ? U.fail(new p({
 					provider: "storage",
 					message: "partNumber must be a positive integer",
 					transient: !1,
 					status: 400
-				})) : N.signMultipartPart({
+				})) : T(r).pipe(U.flatMap(() => C.signMultipartPart({
 					key: r.key,
 					uploadId: r.uploadId,
 					partNumber: n.partNumber
-				}).pipe(v.map((e) => ({ url: e })));
+				}).pipe(U.map((e) => ({ url: e })))));
 			}
 		},
 		{
-			...c,
+			...je,
 			execute: (e, n) => {
-				let r = e, i = Ht(r.multipartToken);
-				return !i || i.instance !== y ? v.fail(new t({
+				let r = e, i = P(r.multipartToken);
+				return !i || i.instance !== t ? U.fail(new p({
 					provider: "storage",
 					message: "invalid or expired multipart token",
 					transient: !1,
 					status: 401
-				})) : pr(i.sub, n.request.subject.id) ? v.fail(new t({
+				})) : _t(i.sub, n.request.subject.id) ? U.fail(new p({
 					provider: "storage",
 					message: "multipart token belongs to another subject",
 					transient: !1,
 					status: 403
-				})) : N.completeMultipart({
+				})) : T(i).pipe(U.flatMap(() => C.completeMultipart({
 					key: i.key,
 					uploadId: i.uploadId,
 					parts: r.parts,
@@ -3714,36 +1100,36 @@ var qn = () => _e({
 					...i.tags === void 0 ? {} : { tags: i.tags },
 					...i.alt === void 0 ? {} : { alt: i.alt },
 					...i.caption === void 0 ? {} : { caption: i.caption }
-				}).pipe(v.flatMap((e) => N.getUrl(e.id).pipe(v.map((t) => ({
+				}).pipe(U.flatMap((e) => C.getUrl(e.id).pipe(U.map((t) => ({
 					id: e.id,
 					url: t,
 					size: e.size
-				})))));
+				})))))));
 			}
 		},
 		{
-			...a,
+			...Oe,
 			execute: (e) => {
-				let n = Ht(e.multipartToken);
-				return !n || n.instance !== y ? v.fail(new t({
+				let n = P(e.multipartToken);
+				return !n || n.instance !== t ? U.fail(new p({
 					provider: "storage",
 					message: "invalid or expired multipart token",
 					transient: !1,
 					status: 401
-				})) : N.abortMultipart({
+				})) : T(n).pipe(U.flatMap(() => C.abortMultipart({
 					key: n.key,
 					uploadId: n.uploadId
-				}).pipe(v.as({ ok: !0 }));
+				}).pipe(U.as({ ok: !0 }))));
 			}
 		},
 		{
-			...re,
+			...We,
 			execute: (e, t) => {
 				let n = e, r = new Uint8Array(Buffer.from(n.bytesBase64, "base64"));
-				return fr(t, O).pipe(v.flatMap((e) => A(n, t.request.subject).pipe(v.map((t) => ({
+				return Z(t, l).pipe(U.flatMap((e) => h(n, t.request.subject).pipe(U.map((t) => ({
 					writer: e,
 					policy: t
-				})))), v.flatMap(({ writer: e, policy: t }) => N.put({
+				})))), U.flatMap(({ writer: e, policy: t }) => C.put({
 					bytes: r,
 					...t,
 					contentType: n.contentType,
@@ -3752,17 +1138,17 @@ var qn = () => _e({
 					...n.visibility ? { visibility: n.visibility } : {},
 					...n.key ? { key: n.key } : {},
 					...n.password ? { password: n.password } : {}
-				})), v.flatMap((e) => N.getUrl(e.id).pipe(v.map((t) => ({
+				})), U.flatMap((e) => C.getUrl(e.id).pipe(U.map((t) => ({
 					id: e.id,
 					url: t
 				})))));
 			}
 		},
 		{
-			...u,
+			...Ne,
 			execute: (e, t) => {
 				let n = e;
-				return fr(t, O).pipe(v.flatMap((e) => N.ingestUrl(n.url, {
+				return Z(t, l).pipe(U.flatMap((e) => C.ingestUrl(n.url, {
 					tenantId: e.tenantId,
 					ownerId: e.id,
 					...n.visibility ? { visibility: n.visibility } : {},
@@ -3771,45 +1157,45 @@ var qn = () => _e({
 					...n.alt === void 0 ? {} : { alt: n.alt },
 					...n.caption === void 0 ? {} : { caption: n.caption },
 					...n.key === void 0 ? {} : { key: n.key }
-				})), v.flatMap((e) => N.getUrl(e.id).pipe(v.map((t) => ({
+				})), U.flatMap((e) => C.getUrl(e.id).pipe(U.map((t) => ({
 					id: e.id,
 					url: t
 				})))));
 			}
 		},
 		{
-			...h,
+			...Ve,
 			execute: (e, t) => {
 				let n = e, r = n.expiresInDays ? new Date(Date.now() + n.expiresInDays * 864e5) : null;
-				return ur(N, n.refId, t).pipe(v.flatMap(() => N.grant({
+				return X(C, n.refId, t).pipe(U.flatMap(() => C.grant({
 					refId: n.refId,
 					principalType: n.principalType,
 					principalId: n.principalId,
 					...n.permission ? { permission: n.permission } : {},
 					expiresAt: r,
 					createdBy: t.request.subject.id
-				})), v.map((e) => ({ grantId: e.id })));
+				})), U.map((e) => ({ grantId: e.id })));
 			}
 		},
 		{
-			...ne,
+			...Be,
 			execute: (e, t) => {
 				let n = e;
-				return N.getGrant(n.grantId).pipe(v.flatMap((e) => e === null ? v.fail(lr()) : ur(N, e.refId, t)), v.flatMap(() => N.revoke(n.grantId)), v.map(() => ({ ok: !0 })));
+				return C.getGrant(n.grantId).pipe(U.flatMap((e) => e === null ? U.fail(Y()) : X(C, e.refId, t)), U.flatMap(() => C.revoke(n.grantId)), U.map(() => ({ ok: !0 })));
 			}
 		},
 		{
-			...d,
+			...Pe,
 			execute: (e, t) => {
 				let n = e;
-				return ur(N, n.refId, t).pipe(v.flatMap(() => N.listGrants(n.refId)), v.map((e) => ({ grants: e.map(mr) })));
+				return X(C, n.refId, t).pipe(U.flatMap(() => C.listGrants(n.refId)), U.map((e) => ({ grants: e.map(Q) })));
 			}
 		},
 		{
-			...f,
+			...Fe,
 			execute: (e, t) => {
 				let n = e;
-				return N.listRefs({
+				return C.listRefs({
 					tenantId: t.request.subject.tenantId,
 					...n.folder === void 0 ? {} : { folder: n.folder },
 					...n.tags === void 0 ? {} : { tags: n.tags },
@@ -3817,61 +1203,61 @@ var qn = () => _e({
 					...n.includeDerived === void 0 ? {} : { includeDerived: n.includeDerived },
 					...n.limit === void 0 ? {} : { limit: n.limit },
 					...n.offset === void 0 ? {} : { offset: n.offset }
-				}).pipe(v.map((e) => ({
-					refs: e.refs.map(cr),
+				}).pipe(U.map((e) => ({
+					refs: e.refs.map(ht),
 					nextOffset: e.nextOffset
 				})));
 			}
 		}
 	];
-	return oe({
-		name: w({
-			base: hr,
-			alias: i.alias,
-			instance: i.name
+	return at({
+		name: G({
+			base: $,
+			alias: e.alias,
+			instance: e.name
 		}),
-		baseName: hr,
+		baseName: $,
 		description: "File storage — StorageService over S3 / MinIO / filesystem / memory. Public objects served direct from bucket/CDN; private objects gated by an access policy + per-object grants. Checksums, tenant key-prefixing, _voltro_storage_refs + _voltro_storage_grants, retry.",
 		permissions: [
 			"network:outbound:*",
 			"inspect:read",
 			"inspect:write"
 		],
-		declaredEnv: U.declared,
-		egress: ar(i),
-		services: ve,
-		inspectEndpoints: Ae,
+		declaredEnv: w.declared,
+		egress: pt(e),
+		services: ie,
+		inspectEndpoints: De,
 		httpRoutes: [
-			L,
-			De,
-			Oe
+			pe,
+			he,
+			I
 		],
-		routes: je,
-		rpcClientDescriptors: _,
+		routes: Ge,
+		rpcClientDescriptors: Ue,
 		errorSchemas: [
 			{
-				schema: t,
+				schema: p,
 				import: {
 					module: "@voltro/plugin-storage/errors",
 					name: "StorageError"
 				}
 			},
 			{
-				schema: e,
+				schema: te,
 				import: {
 					module: "@voltro/plugin-storage/errors",
 					name: "StorageAccessDenied"
 				}
 			},
 			{
-				schema: n,
+				schema: ne,
 				import: {
 					module: "@voltro/plugin-storage/errors",
 					name: "StorageRejected"
 				}
 			},
 			{
-				schema: r,
+				schema: re,
 				import: {
 					module: "@voltro/plugin-storage/errors",
 					name: "StorageScanRejected"
@@ -3880,7 +1266,7 @@ var qn = () => _e({
 		],
 		capabilities: { mediaPersist: {
 			put: async ({ bytes: e, mediaType: t, tenantId: n, operationId: r, ownerId: i, visibility: a, tags: o }) => {
-				let s = await v.runPromise(N.put({
+				let s = await U.runPromise(C.put({
 					bytes: e,
 					contentType: t,
 					tenantId: n,
@@ -3888,40 +1274,50 @@ var qn = () => _e({
 					...i === void 0 ? {} : { ownerId: i },
 					...a === void 0 ? {} : { visibility: a },
 					...o === void 0 ? {} : { tags: o },
-					...me.current === void 0 ? {} : { operationId: r }
+					...y.current === void 0 ? {} : { operationId: r }
 				}));
 				return {
-					url: await v.runPromise(N.getUrl(s.id, { tenantId: n })),
+					url: await U.runPromise(C.getUrl(s.id, { tenantId: n })),
 					refId: s.id
 				};
 			},
 			ingestUrl: async ({ url: e, tenantId: t, operationId: n, ownerId: r, visibility: i, tags: a }) => {
-				let o = await v.runPromise(N.ingestUrl(e, {
+				let o = await U.runPromise(C.ingestUrl(e, {
 					tenantId: t,
 					...r === void 0 ? {} : { ownerId: r },
 					...i === void 0 ? {} : { visibility: i },
 					...a === void 0 ? {} : { tags: a },
-					...me.current === void 0 ? {} : { operationId: n }
+					...y.current === void 0 ? {} : { operationId: n }
 				}));
 				return {
-					url: await v.runPromise(N.getUrl(o.id, { tenantId: t })),
+					url: await U.runPromise(C.getUrl(o.id, { tenantId: t })),
 					refId: o.id
 				};
 			}
 		} },
-		bindDataStore: (e) => {
-			k && (j.current = ln(e)), pe && (M.current = fn(e)), k && pe && (me.current = zn(e)), x.bindDataStore?.(e);
+		bindDataStore: async (e) => {
+			let r = await U.runPromise(i.objectNamespace);
+			(f || m) && await ee(e), (f || m) && await _(e), f && await n(e), f && (g.current = Ce(e, {
+				storageInstance: t,
+				objectNamespace: r
+			})), m && (v.current = Se(e, {
+				storageInstance: t,
+				objectNamespace: r
+			})), f && m && (y.current = Ee(e, {
+				storageInstance: t,
+				objectNamespace: r
+			})), i.bindDataStore?.(e);
 		},
-		onActivate: (e) => v.sync(() => {
-			let t = !!T || !!U.read("STORAGE_CDN_URL", i.cdnBaseUrl);
-			e.logger.info(`storage: provider=${x.name} presign=${x.presigns ? "yes" : "no"} publicUrl=${t ? "yes" : "no"} transforms=yes`, {
-				provider: x.name,
-				bucket: ue,
-				refStore: k ? "memory" : "custom"
-			}), x.name === "memory" && process.env.NODE_ENV !== "test" && e.logger.warn("storage: provider=memory — uploads are IN-MEMORY and LOST on restart. Set STORAGE_PROVIDER (filesystem / s3 / r2 / azure / gcs) for anything but throwaway dev. (Empty/placeholder storage env silently falls back to memory.)"), !t && !x.presigns && e.logger.warn("storage: no VOLTRO_PUBLIC_URL / STORAGE_CDN_URL and this provider can't presign — serve URLs are RELATIVE and will not resolve cross-origin (browser <img> / server-to-server AI fetches). Set VOLTRO_PUBLIC_URL to this api's absolute base URL.");
+		onActivate: (t) => U.sync(() => {
+			let n = !!o || !!w.read("STORAGE_CDN_URL", e.cdnBaseUrl);
+			t.logger.info(`storage: provider=${i.name} presign=${i.presigns ? "yes" : "no"} publicUrl=${n ? "yes" : "no"} transforms=yes`, {
+				provider: i.name,
+				bucket: a,
+				refStore: f ? "memory" : "custom"
+			}), i.name === "memory" && process.env.NODE_ENV !== "test" && t.logger.warn("storage: provider=memory — uploads are IN-MEMORY and LOST on restart. Set STORAGE_PROVIDER (filesystem / s3 / r2 / azure / gcs) for anything but throwaway dev. (Empty/placeholder storage env silently falls back to memory.)"), !n && !i.presigns && t.logger.warn("storage: no VOLTRO_PUBLIC_URL / STORAGE_CDN_URL and this provider can't presign — serve URLs are RELATIVE and will not resolve cross-origin (browser <img> / server-to-server AI fetches). Set VOLTRO_PUBLIC_URL to this api's absolute base URL.");
 		}),
-		onDeactivate: () => v.void
+		onDeactivate: () => U.void
 	});
 };
 //#endregion
-export { H as STORAGE_BLOBS_TABLE, V as STORAGE_GRANTS_TABLE, B as STORAGE_REFS_TABLE, Ue as STORAGE_USAGE_TABLE, e as StorageAccessDenied, t as StorageError, n as StorageRejected, r as StorageScanRejected, i as StorageService, qe as _voltroStorageBlobsTable, Ge as _voltroStorageGrantsTable, We as _voltroStorageRefsTable, Ke as _voltroStorageUsageTable, nr as appStorageProvider, Kn as assetRef, at as azureProvider, hn as buildStorageService, Le as bytesToStream, Kt as checkLimits, Un as clamavScanner, $e as clearStorageBuffer, Re as collectStream, Ie as concatBytes, rr as configuredStorageProvider, Ut as contentTypeAllowed, fn as dataStoreGrantStore, ln as dataStoreRefStore, it as databaseProvider, Yn as decodeDataUri, Qn as durabilityNotice, ht as editImage, Bn as encodeInstream, Gn as ffmpegTranscoder, tt as filesystemProvider, ze as fromNodeReadable, Ve as getObjectStream, yt as hashPassword, zn as makeStorageObjectMetadata, un as memoryGrantStore, et as memoryProvider, on as memoryRefStore, Vn as parseClamavResponse, lt as parseTransformParams, Zn as pathDurability, Xn as putAvatar, He as putObjectStream, Qe as readStorageBuffer, rn as refMatchesListQuery, ir as resolveStorageProvider, q as resolveStorageSecret, nt as s3Provider, tr as setActiveStorageProvider, Lt as signFinalizeTicket, Mt as signGrant, Vt as signMultipartTicket, zt as signResumableTicket, Ft as signUploadTicket, Gt as sniffMatches, ar as storageEgressOf, gr as storageInstanceName, bn as storageObjectLifecycleTables, _r as storagePlugin, In as storagePutIntentsTable, gn as storageServiceLayer, Be as toNodeReadable, vt as transformCached, pt as transformFallbackReason, mt as transformImage, Rt as verifyFinalizeTicket, Nt as verifyGrant, Ht as verifyMultipartTicket, bt as verifyPassword, Bt as verifyResumableTicket, It as verifyUploadTicket, qn as withStorage };
+export { i as STORAGE_BLOBS_TABLE, a as STORAGE_GRANTS_TABLE, t as STORAGE_REFERENCE_CATALOGUE_TABLE, o as STORAGE_REFS_TABLE, s as STORAGE_USAGE_TABLE, te as StorageAccessDenied, p as StorageError, ne as StorageRejected, re as StorageScanRejected, m as StorageService, c as _voltroStorageBlobsTable, l as _voltroStorageGrantsTable, u as _voltroStorageRefsTable, d as _voltroStorageUsageTable, dt as appStorageProvider, Ye as assetRef, g as assignStorageObjectNamespacesInTransaction, f as assignStorageReferenceInstancesInTransaction, T as azureProvider, xe as buildStorageService, v as bytesToStream, I as checkLimits, Ge as clamavScanner, E as clearStorageBuffer, y as collectStream, b as concatBytes, ft as configuredStorageProvider, L as contentTypeAllowed, Se as dataStoreGrantStore, Ce as dataStoreRefStore, D as databaseProvider, Ze as decodeDataUri, $e as durabilityNotice, j as editImage, Ke as encodeInstream, n as ensureStorageReferenceCatalogue, z as fetchIngestBody, Je as ffmpegTranscoder, O as filesystemProvider, x as fromNodeReadable, S as getObjectStream, M as hashPassword, Ee as makeStorageObjectMetadata, we as memoryGrantStore, k as memoryProvider, B as memoryRefStore, qe as parseClamavResponse, se as parseTransformParams, et as pathDurability, Qe as putAvatar, ie as putObjectStream, ae as readStorageBuffer, V as refMatchesListQuery, _ as requireStorageObjectNamespaces, q as resolveStorageProvider, pe as resolveStorageSecret, A as s3Provider, ut as setActiveStorageProvider, me as signFinalizeTicket, he as signGrant, ge as signMultipartTicket, _e as signResumableTicket, N as signUploadTicket, R as sniffMatches, pt as storageEgressOf, vt as storageInstanceName, h as storageObjectLifecycleTables, e as storageObjectNamespace, bt as storagePlugin, De as storagePutIntentsTable, r as storageReferenceCatalogueTable, Te as storageServiceLayer, C as toNodeReadable, ce as transformCached, le as transformFallbackReason, ue as transformImage, ve as verifyFinalizeTicket, ye as verifyGrant, P as verifyMultipartTicket, fe as verifyPassword, be as verifyResumableTicket, F as verifyUploadTicket, Xe as withStorage };