@voltro/plugin-storage 0.85.0 → 0.87.0

package/dist/service.js

@@ -0,0 +1,1418 @@
+import { requireStorageReferenceScope as e, storageObjectNamespace as t, storageReferenceScopeFor as n, storageUploadTicketScope as r } from "./storageNamespaces.js";
+import { storageReferenceCatalogueId as i } from "./referenceCatalogue.js";
+import { STORAGE_GRANTS_TABLE as a, STORAGE_REFS_TABLE as o, STORAGE_USAGE_TABLE as s } from "./table.js";
+import "./storageReferenceInstances.js";
+import { StorageAccessDenied as c, StorageError as l, StorageRejected as u, StorageScanRejected as d, StorageService as f, storageRefAddress as p } from "./types.js";
+import { storageInteger as m, storageIntegerSum as h } from "./storageNumbers.js";
+import { getObjectStream as g } from "./streamBridge.js";
+import { storageMetadataError as _ } from "./metadataError.js";
+import { evaluatePolicy as v, grantsAllow as y, hashPassword as ee, resolveSubjectGroups as b } from "./access.js";
+import { declareStorageSigningLifetime as x, signGrant as S } from "./grant.js";
+import { checkLimits as te } from "./constraints.js";
+import { extractImageMetadata as ne } from "./derivatives.js";
+import { assertRenditionOutput as re, makeRenditionProof as C, ownRenditionRef as w, readRenditionProof as T } from "./renditionProof.js";
+import { fetchIngestBody as E, withIngestAbort as D } from "./ingest.js";
+import { makeStorageObjectWriter as ie } from "./objectWriter.js";
+import { protectStorageReferences as ae } from "./physicalReferences.js";
+import { StorageAddress as O, storageKeyProblem as k } from "@voltro/kv/storage";
+import { Effect as A, Exit as oe, Layer as j, Schedule as M, Schema as N, Stream as se } from "effect";
+import { randomUUID as P } from "node:crypto";
+import { and as F, authoredError as I, column as L, contains as R, eq as z, generateId as B, isNull as V, or as H } from "@voltro/database";
+//#region src/service.ts
+var U = async (e) => {
+	let { createHash: t } = await import("node:crypto");
+	return t("sha256").update(e).digest("hex");
+}, ce = (e, t, n) => `${e?.replace(/\/+$/, "") ?? ""}${n}/${t}`, W = (e) => {
+	let t = /* @__PURE__ */ new Map(), n = {
+		public: 0,
+		private: 0
+	};
+	for (let r of e) {
+		let e = r.tenantId ?? "(global)", i = t.get(e) ?? {
+			count: 0,
+			bytes: 0
+		};
+		i.count = h(i.count, r.count, "ref count"), i.bytes = h(i.bytes, r.bytes, "usage bytes"), t.set(e, i), r.visibility === "public" ? n.public = h(n.public, r.count, "public ref count") : n.private = h(n.private, r.count, "private ref count");
+	}
+	return {
+		byTenant: Object.fromEntries(t),
+		visibility: n
+	};
+}, G = (e, t) => {
+	if (t.search && ![
+		e.id,
+		e.key,
+		e.contentType,
+		e.ownerId,
+		e.tenantId
+	].some((e) => e?.toLowerCase().includes(t.search.toLowerCase())) || t.tenantId !== void 0 && (e.tenantId ?? null) !== (t.tenantId ?? null) || t.ownerId !== void 0 && e.ownerId !== t.ownerId || !t.includeDerived && e.derivedFrom != null) return !1;
+	if (t.folder !== void 0) {
+		let n = t.folder.replace(/\/+$/, ""), r = (e.folder ?? "").replace(/\/+$/, "");
+		if (r !== n && !r.startsWith(`${n}/`)) return !1;
+	}
+	if (t.tags.length > 0) {
+		let n = e.tags ?? [];
+		if (!t.tags.every((e) => n.includes(e))) return !1;
+	}
+	return !0;
+}, K = (e) => e === null ? "global" : e === "global" ? "%67lobal" : e.startsWith("%") ? `%${e}` : e, q = () => {
+	let e = /* @__PURE__ */ new Map(), n = /* @__PURE__ */ new Map();
+	return {
+		listObjectReferences: () => A.sync(() => [...e.values()].map((e) => ({
+			bucket: e.bucket,
+			tenantId: e.tenantId,
+			key: e.key,
+			visibility: e.visibility
+		}))),
+		catalogueId: A.succeed(t(["memory-reference-catalogue", P()])),
+		statistics: () => A.try({
+			try: () => W((function* () {
+				for (let t of e.values()) yield {
+					tenantId: t.tenantId,
+					visibility: t.visibility,
+					count: 1,
+					bytes: t.size
+				};
+			})()),
+			catch: (e) => _(e, "refstore")
+		}),
+		insert: (t) => A.try({
+			try: () => {
+				m(t.size, "ref size"), e.set(t.id, w(t));
+			},
+			catch: (e) => _(e, "refstore")
+		}),
+		getById: (t) => A.sync(() => {
+			let n = e.get(t);
+			return n === void 0 ? null : w(n);
+		}),
+		delete: (t) => A.sync(() => e.delete(t)),
+		listRecent: (t) => A.sync(() => [...e.values()].sort((e, t) => t.createdAt.getTime() - e.createdAt.getTime() || t.id.localeCompare(e.id)).slice(0, t).map(w)),
+		countByAddress: (t) => A.sync(() => [...e.values()].filter((e) => e.bucket === t.destination && e.tenantId === t.tenantId && e.key === t.key).length),
+		countPublicByAddress: (t) => A.sync(() => [...e.values()].filter((e) => e.bucket === t.destination && e.tenantId === t.tenantId && e.key === t.key && e.visibility === "public").length),
+		setVisibility: (t, n) => A.sync(() => {
+			let r = e.get(t);
+			if (r === void 0) return null;
+			let i = {
+				...r,
+				visibility: n
+			};
+			return e.set(t, i), w(i);
+		}),
+		usageByTenant: (t) => A.try({
+			try: () => {
+				let n = 0, r = 0;
+				for (let i of e.values()) (i.tenantId ?? null) === (t ?? null) && (n = h(n, i.size, "usage bytes"), r++);
+				return {
+					bytes: n,
+					count: r
+				};
+			},
+			catch: (e) => _(e, "refstore")
+		}),
+		consumeUsage: (e, t, r) => A.try({
+			try: () => {
+				let i = K(e), a = n.get(i) ?? {
+					bytes: 0,
+					count: 0
+				};
+				m(t.bytes, "usage byte delta"), m(t.count, "usage count delta");
+				let o = Number.isSafeInteger(a.bytes + t.bytes) && Number.isSafeInteger(a.count + t.count) && (r?.maxBytes === void 0 || a.bytes + t.bytes <= r.maxBytes) && (r?.maxCount === void 0 || a.count + t.count <= r.maxCount);
+				return o && n.set(i, {
+					bytes: a.bytes + t.bytes,
+					count: a.count + t.count
+				}), {
+					allowed: o,
+					bytes: a.bytes,
+					count: a.count
+				};
+			},
+			catch: (e) => _(e, "refstore")
+		}),
+		releaseUsage: (e, t) => A.try({
+			try: () => {
+				let r = K(e), i = n.get(r);
+				m(t.bytes, "usage byte delta"), m(t.count, "usage count delta"), i && n.set(r, {
+					bytes: Math.max(0, i.bytes - t.bytes),
+					count: Math.max(0, i.count - t.count)
+				});
+			},
+			catch: (e) => _(e, "refstore")
+		}),
+		listByDerivedFrom: (t) => A.sync(() => [...e.values()].filter((e) => (e.derivedFrom ?? null) === t).map(w)),
+		listRefs: (t) => A.sync(() => [...e.values()].filter((e) => G(e, t)).sort((e, t) => t.createdAt.getTime() - e.createdAt.getTime() || t.id.localeCompare(e.id)).slice(t.offset, t.offset + t.limit).map(w))
+	};
+}, le = (e) => Array.isArray(e) && e.every((e) => typeof e == "string") ? e : null, J = (e) => {
+	let t = {
+		id: String(e.id),
+		tenantId: e.tenantId ?? null,
+		ownerId: e.ownerId ?? null,
+		bucket: String(e.bucket),
+		key: String(e.key),
+		contentType: String(e.contentType),
+		size: m(e.size, "ref size"),
+		checksum: String(e.checksum),
+		visibility: e.visibility === "public" ? "public" : "private",
+		accessPolicy: e.accessPolicy ?? null,
+		passwordHash: e.passwordHash ?? null,
+		createdAt: e.createdAt instanceof Date ? e.createdAt : new Date(String(e.createdAt)),
+		width: e.width ?? null,
+		height: e.height ?? null,
+		duration: e.duration ?? null,
+		placeholder: e.placeholder ?? null,
+		folder: e.folder ?? null,
+		tags: le(e.tags),
+		alt: e.alt ?? null,
+		caption: e.caption ?? null,
+		derivedFrom: e.derivedFrom ?? null,
+		kind: e.kind ?? null,
+		...e.renditionProof == null ? {} : { renditionProof: T(e.renditionProof) }
+	};
+	return t.renditionProof !== void 0 && t.renditionProof !== null && re(t.renditionProof, t), t;
+}, Y = (e) => A.tryPromise({
+	try: e,
+	catch: (e) => _(e, "refstore", !0)
+}), X = async (e, t) => (await e.query({
+	table: "_voltro_storage_usage",
+	predicate: {
+		column: "tenantId",
+		op: "eq",
+		value: t
+	},
+	order: [],
+	take: 1,
+	skip: void 0,
+	projection: void 0
+}))[0] ?? null, Z = (r, a) => {
+	let c = Object.freeze({ ...a }), l = "resolveNamespace" in c;
+	if (!c.storageInstance.trim()) throw I("Storage requires an explicit plugin instance");
+	l || e(c);
+	let u = l ? z("storageInstance", c.storageInstance) : F(z("storageInstance", c.storageInstance), z("objectNamespace", c.objectNamespace)), d = async (e) => {
+		if (e.storageInstance !== c.storageInstance) return !1;
+		let t = N.decodeUnknownSync(O)({
+			destination: e.bucket,
+			tenantId: e.tenantId,
+			key: e.key
+		}), r = await A.runPromise(n(c, t));
+		return e.objectNamespace === r.objectNamespace;
+	}, f = async function* (e) {
+		let t = e.take, n = e.skip ?? 0;
+		if (!l) {
+			yield* await r.query(e);
+			return;
+		}
+		let i = 0;
+		for (let a = 0;; a += 256) {
+			let o = await r.query({
+				...e,
+				take: 256,
+				skip: a,
+				projection: void 0
+			});
+			for (let e of o) if (await d(e) && !(i++ < n)) {
+				if (t !== void 0 && i > n + t) return;
+				yield e;
+			}
+			if (o.length < 256) return;
+		}
+	}, g = async (e) => {
+		let t = [];
+		for await (let n of f(e)) t.push(n);
+		return t;
+	};
+	return {
+		catalogueId: Y(() => "resolveNamespace" in c ? i(r).then((e) => t([
+			"reference-view",
+			e,
+			c.storageInstance
+		])) : i(r, c)),
+		hasObjectReservation: (e, t) => Y(async () => (await r.query({
+			table: "_voltro_storage_object_heads",
+			predicate: F(z("objectNamespace", e), z("key", t)),
+			order: [],
+			take: 1,
+			skip: void 0,
+			projection: ["id"]
+		})).length > 0),
+		listObjectReferences: () => Y(async () => (await r.query({
+			table: o,
+			predicate: void 0,
+			order: [],
+			take: void 0,
+			skip: void 0,
+			projection: [
+				"bucket",
+				"tenantId",
+				"key",
+				"visibility",
+				"storageInstance",
+				"objectNamespace"
+			]
+		})).map((t) => {
+			let n = N.decodeUnknownSync(O)({
+				destination: t.bucket,
+				tenantId: t.tenantId,
+				key: t.key
+			}), r = N.decodeUnknownSync(N.Struct({
+				storageInstance: N.String,
+				objectNamespace: N.String
+			}))(t);
+			return e(r), {
+				...r,
+				bucket: n.destination,
+				tenantId: n.tenantId,
+				key: n.key,
+				visibility: N.decodeUnknownSync(N.Literals(["public", "private"]))(t.visibility)
+			};
+		})),
+		statistics: () => Y(async () => {
+			if (l) {
+				let e = /* @__PURE__ */ new Map();
+				for await (let t of f({
+					table: o,
+					predicate: u,
+					order: [{
+						column: "id",
+						direction: "asc"
+					}],
+					take: void 0,
+					skip: void 0,
+					projection: void 0
+				})) {
+					let n = J(t), r = JSON.stringify([n.tenantId, n.visibility]), i = e.get(r) ?? {
+						tenantId: n.tenantId,
+						visibility: n.visibility,
+						count: 0,
+						bytes: 0
+					};
+					i.count = h(i.count, 1, "ref count"), i.bytes = h(i.bytes, n.size, "usage bytes"), e.set(r, i);
+				}
+				return W(e.values());
+			}
+			return W((await r.query({
+				table: o,
+				predicate: u,
+				order: [],
+				take: void 0,
+				skip: void 0,
+				projection: void 0,
+				groupBy: ["tenantId", "visibility"],
+				aggregations: [
+					L("tenantId"),
+					L("visibility"),
+					{
+						op: "count",
+						alias: "count"
+					},
+					{
+						op: "sum",
+						column: "size",
+						alias: "bytes"
+					}
+				]
+			})).map((e) => ({
+				tenantId: e.tenantId == null ? null : String(e.tenantId),
+				visibility: String(e.visibility),
+				count: m(e.count, "ref count"),
+				bytes: m(e.bytes ?? 0, "usage bytes")
+			})));
+		}),
+		insert: (e) => n(c, p(e)).pipe(A.flatMap((t) => Y(() => r.insert(o, {
+			...w(e),
+			...t,
+			size: String(m(e.size, "ref size"))
+		})))),
+		getById: (e) => Y(async () => {
+			let t = await r.query({
+				table: o,
+				predicate: F(u, z("id", e)),
+				order: [],
+				take: 1,
+				skip: void 0,
+				projection: void 0
+			});
+			return t[0] && await d(t[0]) ? J(t[0]) : null;
+		}),
+		delete: (e) => Y(l ? () => r.transactional(async (t) => {
+			let n = await t.query({
+				table: o,
+				predicate: F(u, z("id", e)),
+				lock: "update",
+				order: [],
+				take: 1,
+				skip: void 0,
+				projection: void 0
+			});
+			return !n[0] || !await d(n[0]) ? !1 : await t.deleteMany(o, { where: F(u, z("objectNamespace", n[0].objectNamespace), z("id", e)) }) > 0;
+		}) : async () => await r.deleteMany(o, { where: F(u, z("id", e)) }) > 0),
+		listRecent: (e) => Y(async () => (await g({
+			table: o,
+			predicate: u,
+			order: [{
+				column: "createdAt",
+				direction: "desc"
+			}, {
+				column: "id",
+				direction: "desc"
+			}],
+			take: e,
+			skip: void 0,
+			projection: void 0
+		})).map(J)),
+		countByAddress: (e) => n(c, e).pipe(A.flatMap((t) => Y(async () => {
+			let n = await r.query({
+				table: o,
+				predicate: { and: [
+					u,
+					z("objectNamespace", t.objectNamespace),
+					{
+						column: "bucket",
+						op: "eq",
+						value: e.destination
+					},
+					{
+						column: "tenantId",
+						op: "eq",
+						value: e.tenantId
+					},
+					{
+						column: "key",
+						op: "eq",
+						value: e.key
+					}
+				] },
+				order: [],
+				take: void 0,
+				skip: void 0,
+				projection: void 0,
+				aggregations: [{
+					op: "count",
+					alias: "count"
+				}]
+			});
+			return m(n[0]?.count ?? 0, "ref count");
+		}))),
+		countPublicByAddress: (e) => n(c, e).pipe(A.flatMap((t) => Y(async () => {
+			let n = await r.query({
+				table: o,
+				predicate: { and: [
+					u,
+					z("objectNamespace", t.objectNamespace),
+					{
+						column: "bucket",
+						op: "eq",
+						value: e.destination
+					},
+					{
+						column: "tenantId",
+						op: "eq",
+						value: e.tenantId
+					},
+					{
+						column: "key",
+						op: "eq",
+						value: e.key
+					},
+					{
+						column: "visibility",
+						op: "eq",
+						value: "public"
+					}
+				] },
+				order: [],
+				take: void 0,
+				skip: void 0,
+				projection: void 0,
+				aggregations: [{
+					op: "count",
+					alias: "count"
+				}]
+			});
+			return m(n[0]?.count ?? 0, "ref count");
+		}))),
+		setVisibility: (e, t) => Y(() => r.transactional(async (n) => {
+			let r = await n.query({
+				table: o,
+				predicate: F(u, z("id", e)),
+				lock: "update",
+				order: [],
+				take: 1,
+				skip: void 0,
+				projection: void 0
+			});
+			if (!r[0] || !await d(r[0])) return null;
+			let i = await n.update(o, e, { visibility: t });
+			return i ? J(i) : null;
+		})),
+		usageByTenant: (e) => Y(async () => {
+			let t = await r.query({
+				table: o,
+				predicate: e === null ? V("tenantId") : z("tenantId", e),
+				order: [],
+				take: void 0,
+				skip: void 0,
+				projection: void 0,
+				aggregations: [
+					{
+						op: "count",
+						alias: "count"
+					},
+					{
+						op: "sum",
+						column: "size",
+						alias: "bytes"
+					},
+					{
+						op: "min",
+						column: "size",
+						alias: "minSize"
+					},
+					{
+						op: "max",
+						column: "size",
+						alias: "maxSize"
+					}
+				]
+			});
+			return m(t[0]?.count ?? 0, "ref count") > 0 && (m(t[0]?.minSize, "ref size"), m(t[0]?.maxSize, "ref size")), {
+				bytes: m(t[0]?.bytes ?? 0, "usage bytes"),
+				count: m(t[0]?.count ?? 0, "ref count")
+			};
+		}),
+		consumeUsage: (e, t, n) => Y(async () => {
+			let i = K(e);
+			m(t.bytes, "usage byte delta"), m(t.count, "usage count delta");
+			for (let e = 0; e < 32; e++) {
+				e > 0 && await new Promise((t) => setTimeout(t, e));
+				let a = await X(r, i), o = a ? m(a.bytes, "usage bytes") : 0, c = a ? m(a.count, "ref count") : 0;
+				if (!(Number.isSafeInteger(o + t.bytes) && Number.isSafeInteger(c + t.count) && (n?.maxBytes === void 0 || o + t.bytes <= n.maxBytes) && (n?.maxCount === void 0 || c + t.count <= n.maxCount))) return {
+					allowed: !1,
+					bytes: o,
+					count: c
+				};
+				if (a) {
+					if (await r.updateMany("_voltro_storage_usage", {
+						bytes: String(o + t.bytes),
+						count: String(c + t.count),
+						updatedAt: /* @__PURE__ */ new Date()
+					}, { where: F(z("id", String(a.id)), z("bytes", a.bytes), z("count", a.count)) }) === 1) return {
+						allowed: !0,
+						bytes: o,
+						count: c
+					};
+				} else {
+					let e = B({
+						kind: "typeid",
+						prefix: "susage"
+					}, s), n = await r.insertIgnore(s, {
+						id: e,
+						tenantId: i,
+						bytes: String(t.bytes),
+						count: String(t.count),
+						updatedAt: /* @__PURE__ */ new Date()
+					}, { conflictColumns: ["tenantId"] });
+					if (String(n.id) === e) return {
+						allowed: !0,
+						bytes: 0,
+						count: 0
+					};
+				}
+			}
+			throw I("Storage quota reservation contended after 32 attempts; retry");
+		}),
+		releaseUsage: (e, t) => Y(async () => {
+			let n = K(e);
+			m(t.bytes, "usage byte delta"), m(t.count, "usage count delta");
+			for (let e = 0; e < 32; e++) {
+				e > 0 && await new Promise((t) => setTimeout(t, e));
+				let i = await X(r, n);
+				if (!i) return;
+				let a = m(i.bytes, "usage bytes"), o = m(i.count, "ref count");
+				if (await r.updateMany("_voltro_storage_usage", {
+					bytes: String(Math.max(0, a - t.bytes)),
+					count: String(Math.max(0, o - t.count)),
+					updatedAt: /* @__PURE__ */ new Date()
+				}, { where: F(z("id", String(i.id)), z("bytes", i.bytes), z("count", i.count)) }) === 1) return;
+			}
+			throw I("Storage quota release contended after 32 attempts; retry");
+		}),
+		listByDerivedFrom: (e) => Y(async () => (await g({
+			table: o,
+			predicate: F(u, z("derivedFrom", e)),
+			order: [{
+				column: "createdAt",
+				direction: "asc"
+			}, {
+				column: "id",
+				direction: "asc"
+			}],
+			take: void 0,
+			skip: void 0,
+			projection: void 0
+		})).map(J)),
+		listRefs: (e) => Y(async () => {
+			let t = [u];
+			e.tenantId !== void 0 && t.push(e.tenantId === null ? V("tenantId") : z("tenantId", e.tenantId)), e.ownerId !== void 0 && t.push(z("ownerId", e.ownerId)), e.search && t.push(H(...[
+				"id",
+				"key",
+				"contentType",
+				"ownerId",
+				"tenantId"
+			].map((t) => R(t, e.search)))), e.includeDerived || t.push(V("derivedFrom"));
+			let n = e.folder === void 0 && e.tags.length === 0, r = t.length ? F(...t) : void 0, i = await g({
+				table: o,
+				predicate: r,
+				order: [{
+					column: "createdAt",
+					direction: "desc"
+				}, {
+					column: "id",
+					direction: "desc"
+				}],
+				take: n ? e.limit : void 0,
+				skip: n ? e.offset : void 0,
+				projection: void 0
+			});
+			return n ? i.map(J) : i.map(J).filter((t) => G(t, e)).slice(e.offset, e.offset + e.limit);
+		})
+	};
+}, Q = () => {
+	let e = /* @__PURE__ */ new Map();
+	return {
+		insert: (t) => A.sync(() => {
+			e.set(t.id, t);
+		}),
+		delete: (t) => A.sync(() => {
+			e.delete(t);
+		}),
+		getById: (t) => A.sync(() => e.get(t) ?? null),
+		listByRef: (t) => A.sync(() => [...e.values()].filter((e) => e.refId === t)),
+		deleteByRef: (t) => A.sync(() => {
+			for (let [n, r] of e) r.refId === t && e.delete(n);
+		})
+	};
+}, $ = (e) => ({
+	id: String(e.id),
+	refId: String(e.refId),
+	principalType: e.principalType,
+	principalId: String(e.principalId),
+	permission: e.permission === "write" ? "write" : "read",
+	createdAt: e.createdAt instanceof Date ? e.createdAt : new Date(String(e.createdAt)),
+	expiresAt: e.expiresAt ? e.expiresAt instanceof Date ? e.expiresAt : new Date(String(e.expiresAt)) : null,
+	createdBy: e.createdBy ?? null
+}), ue = (t, n) => {
+	let r = Object.freeze({ ...n });
+	return e(r), {
+		insert: (e) => Y(() => t.insert(a, {
+			...e,
+			...r
+		})),
+		delete: (e) => Y(() => t.deleteMany(a, { where: F(F(z("storageInstance", r.storageInstance), z("objectNamespace", r.objectNamespace)), z("id", e)) })).pipe(A.asVoid),
+		getById: (e) => Y(async () => {
+			let n = (await t.query({
+				table: a,
+				predicate: F(F(z("storageInstance", r.storageInstance), z("objectNamespace", r.objectNamespace)), z("id", e)),
+				order: [],
+				take: 1,
+				skip: void 0,
+				projection: void 0
+			}))[0];
+			return n ? $(n) : null;
+		}),
+		listByRef: (e) => Y(async () => (await t.query({
+			table: a,
+			predicate: F(F(z("storageInstance", r.storageInstance), z("objectNamespace", r.objectNamespace)), z("refId", e)),
+			order: [{
+				column: "createdAt",
+				direction: "desc"
+			}],
+			take: void 0,
+			skip: void 0,
+			projection: void 0
+		})).map($)),
+		deleteByRef: (e) => Y(async () => {
+			let n = await t.query({
+				table: a,
+				predicate: F(F(z("storageInstance", r.storageInstance), z("objectNamespace", r.objectNamespace)), z("refId", e)),
+				order: [],
+				take: void 0,
+				skip: void 0,
+				projection: void 0
+			});
+			for (let e of n) await t.delete(a, String(e.id));
+		})
+	};
+}, de = (e, t) => {
+	let r = Object.freeze({ ...t });
+	if (!("resolveNamespace" in r)) return ue(e, r);
+	let i = Z(e, r), o = (t) => i.getById(t).pipe(A.flatMap((t) => t === null ? A.succeed(void 0) : n(r, p(t)).pipe(A.map((t) => ue(e, t))))), s = (t) => Y(() => e.query({
+		table: a,
+		predicate: F(z("storageInstance", r.storageInstance), z("id", t)),
+		order: [],
+		take: 1,
+		skip: void 0,
+		projection: ["refId"]
+	})).pipe(A.flatMap((e) => e[0] === void 0 ? A.succeed(void 0) : o(String(e[0].refId))));
+	return {
+		insert: (e) => o(e.refId).pipe(A.flatMap((t) => t === void 0 ? A.fail(new l({
+			provider: "metadata",
+			message: "Storage grant reference is outside the current destination view",
+			transient: !1,
+			status: 409
+		})) : t.insert(e))),
+		delete: (e) => s(e).pipe(A.flatMap((t) => t === void 0 ? A.void : t.delete(e))),
+		getById: (e) => s(e).pipe(A.flatMap((t) => t === void 0 ? A.succeed(null) : t.getById(e))),
+		listByRef: (e) => o(e).pipe(A.flatMap((t) => t === void 0 ? A.succeed([]) : t.listByRef(e))),
+		deleteByRef: (e) => o(e).pipe(A.flatMap((t) => t === void 0 ? A.void : t.deleteByRef(e)))
+	};
+}, fe = () => B({
+	kind: "typeid",
+	prefix: "file"
+}, o), pe = () => B({
+	kind: "typeid",
+	prefix: "grant"
+}, a), me = (e) => {
+	let { provider: n, refStore: i, grantStore: a } = e, s = (t) => N.decodeUnknownEffect(O)(p(t)).pipe(A.mapError(() => new l({
+		provider: "storage",
+		message: "Invalid stored object address",
+		transient: !1
+	})), A.flatMap((r) => e.destinations === void 0 ? t.bucket === e.bucket ? A.succeed(n) : A.fail(new l({
+		provider: "storage",
+		message: "Stored object destination is not configured",
+		transient: !1
+	})) : e.destinations.resolve(r))), f = (t) => ae(t, i, (e) => s({
+		bucket: e.destination,
+		tenantId: e.tenantId,
+		key: e.key
+	}), e.resolveObjectReference), m = (e) => s(e).pipe(A.map(f)), h = (t, r, i) => N.decodeUnknownEffect(O)({
+		destination: i ?? e.bucket,
+		tenantId: t,
+		key: r
+	}).pipe(A.mapError(() => new l({
+		provider: "storage",
+		message: "Invalid new object address",
+		transient: !1,
+		status: 400
+	})), A.flatMap(() => i === void 0 ? e.destinations === void 0 ? A.succeed({
+		destination: e.bucket,
+		provider: n
+	}) : e.destinations.select(t) : s({
+		bucket: i,
+		tenantId: t,
+		key: r
+	}).pipe(A.map((e) => ({
+		destination: i,
+		provider: e
+	})))), A.map((e) => ({
+		...e,
+		provider: f(e.provider)
+	}))), T = (t) => A.gen(function* () {
+		let n = yield* i.catalogueId, a = yield* t.objectNamespace;
+		return yield* A.try({
+			try: () => r({
+				catalogueId: n,
+				objectNamespace: a,
+				storageInstance: e.storageInstance ?? "@voltro/plugin-storage"
+			}),
+			catch: (e) => _(e, "storage", !1)
+		});
+	}), j = e.access ?? {}, P = e.attempts ?? 3, F = e.urlExpiresInSec ?? 3600;
+	x(F);
+	let I = (t) => ce(e.publicBaseUrl, t, e.httpPath ?? "/_voltro/storage"), L = M.max([M.recurs(Math.max(0, P - 1)), M.exponential("100 millis")]).pipe(M.while(({ input: e }) => e.transient)), R = (e) => e === null ? "global" : typeof e != "string" || e.length === 0 || /[\uD800-\uDFFF]/u.test(e) ? "\0" : e === "global" ? "%67lobal" : e === "." ? "%2E" : e === ".." ? "%2E%2E" : encodeURIComponent(e), z = (t, n, r) => [
+		e.tenantPrefix,
+		R(t),
+		r ?? n
+	].filter(Boolean).join("/"), V = (e) => {
+		if (e === void 0) return A.succeed(void 0);
+		let t = k(e);
+		return t === void 0 ? A.succeed(e) : A.fail(new l({
+			provider: "storage",
+			message: `storage key rejected: ${t}`,
+			transient: !1,
+			status: 400
+		}));
+	}, H = (t, n, r) => [
+		e.tenantPrefix,
+		R(t),
+		"_incoming",
+		n,
+		String(r).padStart(6, "0")
+	].filter(Boolean).join("/"), W = (e, t) => t === void 0 || e.tenantId === t, G = (e, t) => t !== void 0 && e.tenantId !== t ? A.fail(new l({
+		provider: "storage",
+		message: "cross-tenant access denied",
+		transient: !1,
+		status: 403
+	})) : A.succeed(e), K = (t, n, r) => A.gen(function* () {
+		let i = e.objects?.(), a = (e) => new l({
+			provider: "metadata",
+			message: e,
+			transient: !1,
+			status: 409
+		});
+		if (i === void 0) return r === void 0 ? !1 : yield* A.fail(a(`claim '${r}' cannot be released: no data store is bound, so ref '${t}' holds no claims`));
+		let o = yield* A.tryPromise({
+			try: () => i.intent(t),
+			catch: (e) => new l({
+				provider: "metadata",
+				message: String(e?.message ?? e),
+				transient: !1
+			})
+		});
+		if (o === void 0) return r === void 0 ? !1 : yield* A.fail(a(`claim '${r}' cannot be released: ref '${t}' was not written through an operation and holds no claims`));
+		yield* G(o.ref, n);
+		let s = yield* m(o.ref);
+		return yield* ie({
+			metadata: i,
+			provider: {
+				...s,
+				delete: (e) => s.delete(e).pipe(A.retry(L))
+			}
+		}).delete(t, n, r).pipe(A.catchTag("StorageRejected", (e) => A.fail(e.reason === "claim-not-held" ? a(e.detail) : new l({
+			provider: "metadata",
+			message: e.detail,
+			transient: !1
+		})))), !0;
+	}), q = (e, t) => i.getById(e).pipe(A.flatMap((n) => n ? G(n, t) : A.fail(new l({
+		provider: "storage",
+		message: `no ref '${e}'`,
+		transient: !1,
+		status: 404
+	})))), le = (t) => A.suspend(() => {
+		let n = e.scan(t);
+		return A.isEffect(n) ? n : A.tryPromise({
+			try: () => Promise.resolve(n),
+			catch: (e) => new l({
+				provider: "scan",
+				message: String(e?.message ?? e),
+				transient: !0
+			})
+		});
+	}), J = (t) => A.suspend(() => {
+		let n = t.contentType;
+		if (!e.videoProbe || !(n.startsWith("video/") || n.startsWith("audio/"))) return A.succeed(null);
+		let r;
+		try {
+			r = e.videoProbe(t);
+		} catch {
+			return A.succeed(null);
+		}
+		return A.isEffect(r) ? r.pipe(A.catch(() => A.succeed(null))) : A.tryPromise({
+			try: () => Promise.resolve(r),
+			catch: () => null
+		}).pipe(A.catch(() => A.succeed(null)));
+	}), Y = (t, n) => A.gen(function* () {
+		let r = te(t.bytes, t.contentType, e.limits);
+		if (r) return yield* A.fail(new u(r));
+		if (t.claim !== void 0 && t.operationId === void 0) return yield* A.fail(new u({
+			reason: "claim-without-operation",
+			detail: "a put with a claim needs an operationId; the claim names this caller's hold on that operation's object"
+		}));
+		if (e.scan) {
+			let e = yield* le({
+				bytes: t.bytes,
+				contentType: t.contentType,
+				...t.key ? { key: t.key } : {}
+			});
+			if (!e.clean) return yield* A.fail(new d({ threat: e.threat ?? "unknown" }));
+		}
+		let a = yield* A.promise(() => ne(t.bytes, t.contentType, { normalize: e.normalizeImages ?? !1 })), o = a.bytes, s = yield* J({
+			bytes: o,
+			contentType: t.contentType
+		}), c = a.width ?? s?.width, l = a.height ?? s?.height, f = a.placeholder ?? s?.poster, p = t.duration ?? s?.duration, m = yield* A.promise(() => U(o)), g = t.tenantId ?? null, _ = t.visibility ?? "private", v = yield* V(t.key), y = z(g, m, v), b = yield* h(g, y, t.destination), { provider: x } = b, S = b.destination, C = t.operationId === void 0 ? z(g, m, `i-${yield* A.promise(() => U(new TextEncoder().encode(JSON.stringify([e.storageInstance ?? "@voltro/plugin-storage", S]))))}/plain/${v ?? m}`) : y, T = t.password ? yield* A.sync(() => ee(t.password)) : null, E = {
+			id: fe(),
+			tenantId: g,
+			ownerId: t.ownerId ?? null,
+			bucket: S,
+			key: C,
+			contentType: t.contentType,
+			size: o.byteLength,
+			checksum: m,
+			visibility: _,
+			accessPolicy: t.access ?? null,
+			passwordHash: T,
+			createdAt: /* @__PURE__ */ new Date(),
+			...c === void 0 ? {} : { width: c },
+			...l === void 0 ? {} : { height: l },
+			...f === void 0 ? {} : { placeholder: f },
+			...p === void 0 ? {} : { duration: p },
+			...t.folder === void 0 ? {} : { folder: t.folder },
+			...t.tags === void 0 ? {} : { tags: t.tags },
+			...t.alt === void 0 ? {} : { alt: t.alt },
+			...t.caption === void 0 ? {} : { caption: t.caption },
+			...t.derivedFrom === void 0 ? {} : { derivedFrom: t.derivedFrom },
+			...t.kind === void 0 ? {} : { kind: t.kind }
+		}, D = n === void 0 ? E : {
+			...E,
+			renditionProof: yield* A.try({
+				try: () => re(n, E),
+				catch: (e) => e
+			})
+		}, ae = e.transcode !== void 0 && e.autoTranscode !== !1, O = (e) => ae && e.derivedFrom == null && (t.contentType.startsWith("video/") || t.contentType.startsWith("audio/")) ? A.forkDetach(Z(e).pipe(A.ignore)) : A.void;
+		if (t.operationId !== void 0) {
+			let n = e.objects?.();
+			if (n === void 0) return yield* A.fail(new u({
+				reason: "operation-store-unbound",
+				detail: "a put with an operationId needs a bound data store; the in-memory ref store cannot hold operation intents"
+			}));
+			let r = {
+				tenantId: g,
+				bucket: S,
+				operationId: t.operationId,
+				checksum: m,
+				logicalKey: C,
+				fingerprint: yield* A.promise(() => U(new TextEncoder().encode(JSON.stringify([
+					m,
+					t.contentType,
+					_,
+					t.access ?? null,
+					t.key ?? null,
+					t.ownerId ?? null,
+					t.folder ?? null,
+					t.tags ?? null,
+					t.alt ?? null,
+					t.caption ?? null,
+					t.derivedFrom ?? null,
+					t.kind ?? null,
+					p ?? null,
+					t.password !== void 0
+				]))))
+			}, i = yield* ie({
+				metadata: n,
+				provider: {
+					...x,
+					put: (e, t, n) => x.put(e, t, n).pipe(A.retry(L))
+				}
+			}).put({
+				identity: r,
+				ref: D,
+				bytes: o,
+				...e.quota === void 0 ? {} : { quota: e.quota },
+				...t.claim === void 0 ? {} : { claim: t.claim }
+			});
+			return yield* O(i.ref), {
+				...i.ref,
+				outcome: i.outcome
+			};
+		}
+		let k = {
+			bytes: o.byteLength,
+			count: 1
+		}, j = yield* i.consumeUsage(g, k, e.quota);
+		if (!j.allowed) {
+			let t = e.quota ?? {}, n = t.maxCount !== void 0 && j.count + 1 > t.maxCount ? `tenant object count ${j.count} + 1 exceeds max ${t.maxCount}` : `tenant usage ${j.bytes} + ${o.byteLength} bytes exceeds max ${t.maxBytes}`;
+			return yield* A.fail(new u({
+				reason: "quota-exceeded",
+				detail: n
+			}));
+		}
+		return yield* ((e) => e.pipe(A.onExit((e) => oe.isSuccess(e) ? A.void : i.delete(D.id).pipe(A.andThen(i.releaseUsage(g, k)), A.ignore))))(i.insert(w(D)).pipe(A.andThen(x.put(C, o, {
+			contentType: t.contentType,
+			public: _ === "public"
+		}).pipe(A.retry(L))))), yield* O(D), {
+			...D,
+			outcome: "created"
+		};
+	}), X = (t) => A.suspend(() => {
+		if (!e.transcode) return A.succeed([]);
+		let n;
+		try {
+			n = e.transcode(t);
+		} catch {
+			return A.succeed([]);
+		}
+		return A.isEffect(n) ? n.pipe(A.catch(() => A.succeed([]))) : A.tryPromise({
+			try: () => Promise.resolve(n),
+			catch: () => []
+		}).pipe(A.catch(() => A.succeed([])));
+	}), Z = (t) => A.gen(function* () {
+		if (!e.transcode || t.derivedFrom != null) return [];
+		let n = yield* m(t), r = { ...t }, i = r.checksum !== "" && !/^[a-f0-9]{64}$/.test(r.checksum), a = () => n.head(r.key).pipe(A.map((e) => e === null ? null : { ...e })), o = i ? yield* a() : void 0, s = yield* n.get(r.key).pipe(A.retry(L)), c = i ? yield* a() : void 0, l = yield* X({
+			bytes: Uint8Array.from(s.bytes),
+			contentType: r.contentType,
+			ref: { ...r }
+		}), u = [];
+		for (let e of l) {
+			let n = {
+				...e,
+				bytes: Uint8Array.from(e.bytes)
+			}, i = yield* A.try({
+				try: () => C(r, s.bytes, n, {
+					before: o,
+					after: c
+				}),
+				catch: (e) => e
+			}), a = yield* Y({
+				destination: t.bucket,
+				bytes: n.bytes,
+				contentType: n.contentType,
+				tenantId: r.tenantId,
+				ownerId: r.ownerId,
+				visibility: r.visibility,
+				derivedFrom: r.id,
+				kind: n.kind,
+				...n.label === void 0 ? {} : { caption: n.label }
+			}, i);
+			u.push(a);
+		}
+		return u;
+	}), Q = (e, t, n) => A.gen(function* () {
+		if (e.derivedFrom != null) {
+			let r = yield* i.getById(e.derivedFrom);
+			return r === null ? !1 : yield* Q(r, t, n);
+		}
+		if (e.visibility === "public") return !0;
+		if (e.tenantId !== null && !W(e, t.tenantId ?? null)) return !1;
+		if (yield* v(e, t, {
+			...j,
+			...n?.password === void 0 ? {} : { password: n.password }
+		})) return !0;
+		let r = yield* b(t, j), o = yield* a.listByRef(e.id);
+		return y(o, t, r, n?.permission ?? "read", Date.now());
+	}), $ = (e, t) => {
+		if (e.visibility === "public") {
+			let n = t.publicUrl?.(e.key);
+			if (n != null) return n;
+		}
+		return I(e.id);
+	};
+	return {
+		operationStatus: (n) => A.gen(function* () {
+			if (!n || typeof n.operationId != "string" || n.operationId.length === 0 || n.tenantId !== null && typeof n.tenantId != "string") return yield* A.fail(new l({
+				provider: "metadata",
+				message: "An exact operation ID and explicit tenant are required",
+				transient: !1,
+				status: 400
+			}));
+			let a = e.objects?.();
+			if (!a) return yield* A.fail(new l({
+				provider: "metadata",
+				message: "Durable storage operation metadata is not bound",
+				transient: !1,
+				status: 409
+			}));
+			let o = yield* h(n.tenantId, "_namespace", n.destination), s = yield* A.tryPromise({
+				try: () => a.operationStatus({
+					operationId: n.operationId,
+					tenantId: n.tenantId,
+					bucket: o.destination
+				}),
+				catch: (e) => {
+					let t = _(e, "metadata");
+					return new l({
+						provider: "metadata",
+						message: "Storage operation state could not be confirmed; retain its identity for recovery",
+						transient: t.transient,
+						...t.status === void 0 ? {} : { status: t.status }
+					});
+				}
+			});
+			if ((yield* o.provider.objectNamespace) !== s.scope.objectNamespace || s.scope.storageInstance !== (e.storageInstance ?? "@voltro/plugin-storage")) return yield* A.fail(new l({
+				provider: "metadata",
+				message: "Storage operation metadata belongs to another configured destination",
+				transient: !1,
+				status: 409
+			}));
+			let c = yield* i.catalogueId, u = yield* A.try({
+				try: () => t([
+					"durable-operation-observation",
+					r({
+						...s.scope,
+						catalogueId: c
+					}),
+					o.destination
+				]),
+				catch: (e) => _(e, "metadata")
+			});
+			return {
+				...s.observation,
+				scope: u,
+				destination: o.destination
+			};
+		}),
+		uploadTicketScope: (e) => h(e?.tenantId ?? null, "_namespace", e?.destination).pipe(A.flatMap((e) => T(e.provider))),
+		put: (e) => Y(e),
+		get: (e, t) => q(e, t?.tenantId).pipe(A.flatMap((e) => m(e).pipe(A.flatMap((t) => t.get(e.key).pipe(A.retry(L), A.map((t) => ({
+			bytes: t.bytes,
+			ref: e
+		}))))))),
+		getStream: (e, t) => q(e, t?.tenantId).pipe(A.flatMap((e) => m(e).pipe(A.flatMap((t) => g(t, e.key).pipe(A.retry(L), A.map((t) => ({
+			ref: e,
+			stream: t.stream
+		}))))))),
+		getRange: (e, t, n) => q(e, n?.tenantId).pipe(A.flatMap((e) => m(e).pipe(A.flatMap((n) => {
+			let r = e.size, i = Math.max(0, Math.trunc(t.start));
+			if (r > 0 && i >= r) return A.fail(new l({
+				provider: n.name,
+				message: `range start ${i} past end ${r}`,
+				transient: !1,
+				status: 416
+			}));
+			let a = Math.min(Math.trunc(t.endInclusive), Math.max(0, r - 1));
+			return a < i ? A.fail(new l({
+				provider: n.name,
+				message: `empty range ${i}-${a}`,
+				transient: !1,
+				status: 416
+			})) : (n.getRange ? n.getRange(e.key, i, a).pipe(A.retry(L)) : n.get(e.key).pipe(A.retry(L), A.map((e) => e.bytes.subarray(i, a + 1)))).pipe(A.map((t) => ({
+				bytes: t,
+				ref: e,
+				totalSize: r
+			})));
+		})))),
+		getUrl: (e, t) => q(e, t?.tenantId).pipe(A.flatMap((e) => m(e).pipe(A.flatMap((n) => e.visibility === "public" ? A.succeed($(e, n)) : n.presigns ? n.getUrl(e.key, t?.expiresInSec ?? F) : A.succeed(I(e.id)))))),
+		head: (e, t) => i.getById(e).pipe(A.flatMap((e) => e ? G(e, t?.tenantId).pipe(A.map((e) => e)) : A.succeed(null))),
+		delete: (e, t) => K(e, t?.tenantId, t?.claim).pipe(A.flatMap((n) => n ? A.void : q(e, t?.tenantId).pipe(A.flatMap((t) => m(t).pipe(A.flatMap((n) => a.deleteByRef(e).pipe(A.flatMap(() => i.delete(e)), A.flatMap((e) => e ? n.delete(t.key).pipe(A.retry(L), A.flatMap(() => i.releaseUsage(t.tenantId, {
+			bytes: t.size,
+			count: 1
+		}))) : A.void), A.asVoid))))))),
+		signedUrl: (t, n) => q(t, n?.tenantId).pipe(A.flatMap((t) => m(t).pipe(A.flatMap((r) => {
+			if (t.visibility === "public") return A.succeed($(t, r));
+			let i = n?.expiresInSec ?? F;
+			return r.presigns ? r.getUrl(t.key, i) : A.sync(() => `${I(t.id)}?t=${S(t.id, i, void 0, e.httpPath ?? "/_voltro/storage")}`);
+		})))),
+		setVisibility: (e, t, n) => A.gen(function* () {
+			let r = yield* q(e, n?.tenantId);
+			if (r.visibility === t) return r;
+			let a = i.setVisibility;
+			if (a === void 0) return yield* A.fail(new u({
+				reason: "visibility-unsupported",
+				detail: "the ref store cannot change a stored object visibility"
+			}));
+			let o = r.derivedFrom == null ? yield* i.listByDerivedFrom(r.id) : [], s = [];
+			for (let e of [r, ...o]) {
+				let n = yield* m(e);
+				if (t === "private" && n.publicUrl?.(e.key) != null) return yield* A.fail(new u({
+					reason: "visibility-unsupported",
+					detail: `objects are served from a public base (${n.name} cdnBaseUrl); a public object cannot be made private there`
+				}));
+				if (t === "private" && n.setObjectPublic !== void 0 && i.countPublicByAddress === void 0) return yield* A.fail(new u({
+					reason: "visibility-unsupported",
+					detail: "the ref store cannot tell whether other refs keep these bytes public"
+				}));
+				s.push({
+					ref: e,
+					provider: n
+				});
+			}
+			let c = yield* a(r.id, t);
+			if (c === null) return yield* A.fail(new l({
+				provider: "storage",
+				message: `no ref '${e}'`,
+				transient: !1,
+				status: 404
+			}));
+			for (let e of o) if (e.visibility !== t && (yield* a(e.id, t)) === null) return yield* A.fail(new l({
+				provider: "storage",
+				message: `no ref '${e.id}'`,
+				transient: !1,
+				status: 404
+			}));
+			for (let e of s) if (e.provider.setObjectPublic !== void 0) {
+				let n = i.countPublicByAddress, r = t === "public" || n !== void 0 && (yield* n(p(e.ref))) > 0;
+				yield* e.provider.setObjectPublic(e.ref.key, r);
+			}
+			return c;
+		}),
+		mintUrl: (t, n, r) => A.gen(function* () {
+			let a = yield* i.getById(t).pipe(A.flatMap((e) => e ? A.succeed(e) : A.fail(new l({
+				provider: "storage",
+				message: `no ref '${t}'`,
+				transient: !1,
+				status: 404
+			}))));
+			if (a.visibility === "public" && a.derivedFrom == null) return $(a, yield* m(a));
+			if (!(yield* Q(a, n, r?.password === void 0 ? {} : { password: r.password }))) return yield* A.fail(new c({
+				refId: t,
+				reason: "access denied"
+			}));
+			let o = yield* m(a), s = r?.expiresInSec ?? F;
+			if (o.presigns) return yield* o.getUrl(a.key, s);
+			let u = yield* A.sync(() => S(a.id, s, void 0, e.httpPath ?? "/_voltro/storage"));
+			return `${I(a.id)}?t=${u}`;
+		}),
+		mintUploadUrl: (e) => A.gen(function* () {
+			let { provider: t } = yield* h(e.tenantId ?? null, z(e.tenantId ?? null, "", e.key));
+			if (!t.getUploadUrl) return yield* A.fail(new l({
+				provider: t.name,
+				message: `provider '${t.name}' does not support presigned uploads`,
+				transient: !1,
+				status: 400
+			}));
+			let n = z(e.tenantId ?? null, "", yield* V(e.key));
+			return yield* t.getUploadUrl(n, e.expiresInSec ?? F, e.contentType);
+		}),
+		checkAccess: Q,
+		grant: (e) => A.gen(function* () {
+			yield* q(e.refId);
+			let t = {
+				id: pe(),
+				refId: e.refId,
+				principalType: e.principalType,
+				principalId: e.principalId,
+				permission: e.permission ?? "read",
+				createdAt: /* @__PURE__ */ new Date(),
+				expiresAt: e.expiresAt ?? null,
+				createdBy: e.createdBy ?? null
+			};
+			return yield* a.insert(t), t;
+		}),
+		listRefs: (e) => A.suspend(() => {
+			let t = Math.min(500, Math.max(1, Math.trunc(e?.limit ?? 50))), n = Math.max(0, Math.trunc(e?.offset ?? 0)), r = {
+				tenantId: e && "tenantId" in e ? e.tenantId : void 0,
+				folder: e?.folder,
+				tags: e?.tags ?? [],
+				ownerId: e?.ownerId,
+				includeDerived: e?.includeDerived ?? !1,
+				limit: t + 1,
+				offset: n
+			};
+			return i.listRefs(r).pipe(A.map((e) => {
+				let r = e.length > t;
+				return {
+					refs: r ? e.slice(0, t) : e,
+					nextOffset: r ? n + t : null
+				};
+			}));
+		}),
+		revoke: (e) => a.delete(e),
+		getGrant: (e) => a.getById(e),
+		listGrants: (e) => a.listByRef(e),
+		usage: (e) => i.usageByTenant(e),
+		sweepOrphans: (e) => A.gen(function* () {
+			let t = e?.limit ?? 1e3, n = e?.dryRun ?? !1, r = yield* i.listRecent(t), a = [];
+			for (let e of r) if ((yield* (yield* m(e)).head(e.key)) === null) {
+				if (!n) {
+					if (!(yield* i.delete(e.id))) continue;
+					yield* i.releaseUsage(e.tenantId, {
+						bytes: e.size,
+						count: 1
+					});
+				}
+				a.push(e.id);
+			}
+			return {
+				scanned: r.length,
+				removed: a
+			};
+		}),
+		ingestUrl: (t, n) => D(A.gen(function* () {
+			let r = yield* E(t, e.limits?.maxBytes, e.ingest);
+			return yield* Y({
+				bytes: r.bytes,
+				contentType: n?.contentType ?? r.contentType,
+				...n?.tenantId === void 0 ? {} : { tenantId: n.tenantId },
+				...n?.operationId === void 0 ? {} : { operationId: n.operationId },
+				...n?.ownerId === void 0 ? {} : { ownerId: n.ownerId },
+				...n?.visibility === void 0 ? {} : { visibility: n.visibility },
+				...n?.access === void 0 ? {} : { access: n.access },
+				...n?.key === void 0 ? {} : { key: n.key },
+				...n?.folder === void 0 ? {} : { folder: n.folder },
+				...n?.tags === void 0 ? {} : { tags: n.tags },
+				...n?.alt === void 0 ? {} : { alt: n.alt },
+				...n?.caption === void 0 ? {} : { caption: n.caption }
+			});
+		}), n?.abortSignal),
+		mintPresignedUpload: (e) => A.gen(function* () {
+			let t = yield* h(e.tenantId ?? null, H(e.tenantId ?? null, "selection", 0)), { provider: n } = t;
+			if (!n.getUploadUrl) return yield* A.fail(new l({
+				provider: n.name,
+				message: `provider '${n.name}' does not support presigned uploads`,
+				transient: !1,
+				status: 400
+			}));
+			let r = e.expiresInSec ?? F, i = `_incoming/${B({
+				kind: "typeid",
+				prefix: "up"
+			}, o)}`, a = z(e.tenantId ?? null, "", i), s = yield* T(n), c = yield* n.getUploadUrl(a, r, e.contentType);
+			return {
+				writeScope: s,
+				destination: t.destination,
+				tenantId: e.tenantId ?? null,
+				uploadUrl: c,
+				key: a,
+				expiresInSec: r
+			};
+		}),
+		finalizeUpload: (e) => m({
+			bucket: e.destination,
+			tenantId: e.tenantId ?? null,
+			key: e.key
+		}).pipe(A.flatMap((t) => t.get(e.key).pipe(A.retry(L), A.flatMap((t) => Y({
+			destination: e.destination,
+			bytes: t.bytes,
+			contentType: e.contentType,
+			...e.tenantId === void 0 ? {} : { tenantId: e.tenantId },
+			...e.ownerId === void 0 ? {} : { ownerId: e.ownerId },
+			...e.visibility === void 0 ? {} : { visibility: e.visibility },
+			...e.access === void 0 ? {} : { access: e.access },
+			...e.folder === void 0 ? {} : { folder: e.folder },
+			...e.tags === void 0 ? {} : { tags: e.tags },
+			...e.alt === void 0 ? {} : { alt: e.alt },
+			...e.caption === void 0 ? {} : { caption: e.caption }
+		})), A.ensuring(t.delete(e.key).pipe(A.retry(L), A.ignore))))),
+		putResumableChunk: (e) => m({
+			bucket: e.destination,
+			tenantId: e.tenantId ?? null,
+			key: H(e.tenantId ?? null, e.uploadId, e.index)
+		}).pipe(A.flatMap((t) => t.put(H(e.tenantId ?? null, e.uploadId, e.index), e.bytes, { contentType: "application/octet-stream" }).pipe(A.retry(L), A.asVoid))),
+		resumableStatus: (e) => A.gen(function* () {
+			let t = yield* m({
+				bucket: e.destination,
+				tenantId: e.tenantId ?? null,
+				key: H(e.tenantId ?? null, e.uploadId, 0)
+			}), n = 0, r = 0;
+			for (; n < 1e6;) {
+				let i = yield* t.head(H(e.tenantId ?? null, e.uploadId, n)).pipe(A.retry(L), A.catchIf((e) => e.status === 404, () => A.succeed(null)));
+				if (i === null) break;
+				r += i.size, n += 1;
+			}
+			return {
+				offset: r,
+				nextIndex: n
+			};
+		}),
+		finalizeResumable: (t) => A.gen(function* () {
+			let n = yield* m({
+				bucket: t.destination,
+				tenantId: t.tenantId ?? null,
+				key: H(t.tenantId ?? null, t.uploadId, 0)
+			}), r = e.limits?.maxBytes ?? 2 ** 53 - 1;
+			if (!Number.isSafeInteger(r) || r < 0 || !Number.isSafeInteger(t.count) || t.count < 0) return yield* A.fail(new l({
+				provider: n.name,
+				message: "resumable count and limits.maxBytes must be non-negative safe integers",
+				transient: !1,
+				status: 400
+			}));
+			let i = (e) => H(t.tenantId ?? null, t.uploadId, e), a = A.gen(function* () {
+				for (let e = 0; e < t.count; e++) yield* n.delete(i(e)).pipe(A.retry(L), A.ignore);
+			}), o = () => new u({
+				reason: "too-large",
+				detail: `resumable upload exceeds ${r}-byte limit`
+			}), s = yield* A.gen(function* () {
+				let e = 0;
+				for (let a = 0; a < t.count; a++) {
+					let t = yield* n.head(i(a)).pipe(A.retry(L));
+					if (t === null) return yield* A.fail(new l({
+						provider: n.name,
+						message: `no resumable chunk at '${i(a)}'`,
+						transient: !1,
+						status: 404
+					}));
+					if (!Number.isSafeInteger(t.size) || t.size < 0) return yield* A.fail(new l({
+						provider: n.name,
+						message: "resumable chunk metadata has an invalid size",
+						transient: !1
+					}));
+					if (t.size > r - e) return yield* A.fail(o());
+					e += t.size;
+				}
+				let a = /* @__PURE__ */ new Uint8Array(), s = 0;
+				for (let e = 0; e < t.count; e++) {
+					let t = yield* g(n, i(e)).pipe(A.retry(L));
+					yield* se.runForEach(t.stream, (e) => A.gen(function* () {
+						if (e.byteLength > r - s) return yield* A.fail(o());
+						let t = s + e.byteLength;
+						if (t > a.byteLength) {
+							let e = new Uint8Array(Math.min(r, Math.max(65536, a.byteLength * 2, t)));
+							e.set(a.subarray(0, s)), a = e;
+						}
+						a.set(e, s), s = t;
+					}));
+				}
+				return a.subarray(0, s);
+			}).pipe(A.tapError((e) => e._tag === "StorageRejected" ? a : A.void));
+			return yield* Y({
+				destination: t.destination,
+				bytes: s,
+				contentType: t.contentType,
+				...t.tenantId === void 0 ? {} : { tenantId: t.tenantId },
+				...t.ownerId === void 0 ? {} : { ownerId: t.ownerId },
+				...t.visibility === void 0 ? {} : { visibility: t.visibility },
+				...t.access === void 0 ? {} : { access: t.access },
+				...t.folder === void 0 ? {} : { folder: t.folder },
+				...t.tags === void 0 ? {} : { tags: t.tags },
+				...t.alt === void 0 ? {} : { alt: t.alt },
+				...t.caption === void 0 ? {} : { caption: t.caption }
+			}).pipe(A.ensuring(a));
+		}),
+		transcode: (e, t) => q(e, t?.tenantId).pipe(A.flatMap((e) => Z(e))),
+		renditions: (e, t) => q(e, t?.tenantId).pipe(A.flatMap(() => i.listByDerivedFrom(e))),
+		beginMultipartUpload: (e) => A.gen(function* () {
+			let t = yield* h(e.tenantId ?? null, H(e.tenantId ?? null, "selection", 0)), { provider: n } = t;
+			if (!n.createMultipartUpload || !n.presignUploadPart || !n.completeMultipartUpload) return yield* A.fail(new l({
+				provider: n.name,
+				message: `provider '${n.name}' does not support multipart uploads`,
+				transient: !1,
+				status: 400
+			}));
+			let r = z(e.tenantId ?? null, "", `multipart/${B({
+				kind: "typeid",
+				prefix: "mp"
+			}, o)}`), i = yield* T(n), a = yield* n.createMultipartUpload(r, e.contentType, { public: (e.visibility ?? "private") === "public" });
+			return {
+				writeScope: i,
+				destination: t.destination,
+				tenantId: e.tenantId ?? null,
+				uploadId: a.uploadId,
+				key: r
+			};
+		}),
+		signMultipartPart: (e) => m({
+			bucket: e.destination,
+			tenantId: e.tenantId ?? null,
+			key: e.key
+		}).pipe(A.flatMap((t) => A.suspend(() => t.presignUploadPart ? t.presignUploadPart(e.key, e.uploadId, e.partNumber, e.expiresInSec ?? F) : A.fail(new l({
+			provider: t.name,
+			message: "provider does not support multipart uploads",
+			transient: !1,
+			status: 400
+		}))))),
+		completeMultipart: (t) => A.gen(function* () {
+			let n = yield* m({
+				bucket: t.destination,
+				tenantId: t.tenantId ?? null,
+				key: t.key
+			}), r = t.destination;
+			if (!n.completeMultipartUpload) return yield* A.fail(new l({
+				provider: n.name,
+				message: "provider does not support multipart uploads",
+				transient: !1,
+				status: 400
+			}));
+			let a = yield* n.completeMultipartUpload(t.key, t.uploadId, t.parts), o = yield* n.head(t.key).pipe(A.retry(L)), s = o?.size ?? 0, c = (a.etag ?? o?.etag ?? "").replace(/"/g, ""), d = t.tenantId ?? null, f = {
+				bytes: s,
+				count: 1
+			};
+			if (!(yield* i.consumeUsage(d, f, e.quota)).allowed) return yield* n.delete(t.key).pipe(A.retry(L), A.ignore), yield* A.fail(new u({
+				reason: "quota-exceeded",
+				detail: `multipart upload of ${s} bytes exceeds tenant quota`
+			}));
+			let p = {
+				id: fe(),
+				tenantId: t.tenantId ?? null,
+				ownerId: t.ownerId ?? null,
+				bucket: r,
+				key: t.key,
+				contentType: t.contentType,
+				size: s,
+				checksum: c,
+				visibility: t.visibility ?? "private",
+				accessPolicy: t.access ?? null,
+				passwordHash: null,
+				createdAt: /* @__PURE__ */ new Date(),
+				...t.folder === void 0 ? {} : { folder: t.folder },
+				...t.tags === void 0 ? {} : { tags: t.tags },
+				...t.alt === void 0 ? {} : { alt: t.alt },
+				...t.caption === void 0 ? {} : { caption: t.caption }
+			};
+			return yield* i.insert(p).pipe(A.onExit((e) => oe.isSuccess(e) ? A.void : i.releaseUsage(d, f).pipe(A.ignore))), p;
+		}),
+		abortMultipart: (e) => m({
+			bucket: e.destination,
+			tenantId: e.tenantId ?? null,
+			key: e.key
+		}).pipe(A.flatMap((t) => A.suspend(() => t.abortMultipartUpload ? t.abortMultipartUpload(e.key, e.uploadId).pipe(A.retry(L)) : A.void)))
+	};
+}, he = (e) => j.succeed(f, me(e));
+//#endregion
+export { me as buildStorageService, de as dataStoreGrantStore, Z as dataStoreRefStore, Q as memoryGrantStore, q as memoryRefStore, G as refMatchesListQuery, he as storageServiceLayer, J as toRef };