@voltro/plugin-storage 0.85.0 → 0.87.0

package/dist/access.js

@@ -0,0 +1,47 @@
+import { Effect as e } from "effect";
+import { randomBytes as t, scryptSync as n, timingSafeEqual as r } from "node:crypto";
+//#region src/access.ts
+var i = (e) => {
+	let r = t(16).toString("hex");
+	return `${r}:${n(e, r, 32).toString("hex")}`;
+}, a = (e, t) => {
+	if (!e || !t) return !1;
+	let [i, a] = t.split(":");
+	if (!i || !a) return !1;
+	let o = Buffer.from(a, "hex"), s = n(e, i, o.length);
+	return s.length === o.length && r(s, o);
+}, o = (e) => Array.isArray(e) ? e.filter((e) => typeof e == "string") : [], s = (e) => o(e.metadata?.roles), c = (e) => o(e.scopes), l = (e, t) => e.some((e) => t.includes(e)), u = (e) => o(e.metadata?.groups), d = (t) => typeof t == "boolean" ? e.succeed(t) : e.isEffect(t) ? t : e.promise(() => t), f = (t, n, r = {}) => e.gen(function* () {
+	if (n.id && t.ownerId && n.id === t.ownerId) return !0;
+	let i = t.accessPolicy ?? [];
+	if (i.length === 0) return !1;
+	let a = r.resolveGroups ? yield* e.promise(async () => await r.resolveGroups(n)) : u(n);
+	for (let e of i) if (yield* p(e, t, n, a, r)) return !0;
+	return !1;
+}), p = (t, n, r, i, o) => e.gen(function* () {
+	let e = !1, u = (t) => (e = !0, t);
+	if (t.owner !== void 0 && t.owner && !u(!!r.id && !!n.ownerId && r.id === n.ownerId) || t.tenant !== void 0 && t.tenant && !u(!!r.tenantId && r.tenantId === n.tenantId) || t.apiKey !== void 0 && t.apiKey && !u(r.type === "apiKey") || t.roles && t.roles.length > 0 && !u(l(s(r), t.roles)) || t.groups && t.groups.length > 0 && !u(l(i, t.groups)) || t.scopes && t.scopes.length > 0 && !u(l(c(r), t.scopes)) || t.password !== void 0 && t.password && !u(a(o.password, n.passwordHash))) return !1;
+	if (t.guard) {
+		let e = o.guards?.[t.guard];
+		if (!u(e ? yield* d(e({
+			subject: r,
+			ref: n
+		})) : !1)) return !1;
+	}
+	return e;
+}), m = (e, t) => {
+	let n = [];
+	e.id && n.push({
+		type: e.type === "apiKey" ? "apiKey" : "user",
+		id: e.id
+	});
+	for (let e of t) n.push({
+		type: "group",
+		id: e
+	});
+	return n;
+}, h = (e, t, n, r, i) => {
+	let a = m(t, n);
+	return e.some((e) => e.expiresAt && e.expiresAt.getTime() < i || r === "write" && e.permission !== "write" ? !1 : a.some((t) => t.type === e.principalType && t.id === e.principalId));
+}, g = (t, n) => n.resolveGroups ? e.promise(async () => await n.resolveGroups(t)) : e.succeed(u(t));
+//#endregion
+export { f as evaluatePolicy, h as grantsAllow, i as hashPassword, g as resolveSubjectGroups, m as subjectPrincipals, a as verifyPassword };

package/dist/assetRef.js

@@ -0,0 +1,13 @@
+import { _voltroStorageRefsTable as e } from "./table.js";
+import { mixin as t, reference as n, text as r } from "@voltro/database";
+//#region src/assetRef.ts
+function i(t = {}) {
+	let i = t.nullable ?? !0, a = t.fk === !1 ? r().externalId() : n(() => e, { onDelete: t.onDelete ?? "setNull" });
+	return i ? a.nullable() : a;
+}
+var a = () => t({
+	id: "@voltro/plugin-storage/withStorage",
+	fields: { asset: i() }
+});
+//#endregion
+export { i as assetRef, a as withStorage };

package/dist/avatar.js

@@ -0,0 +1,39 @@
+import { StorageError as e } from "./types.js";
+import { Effect as t } from "effect";
+//#region src/avatar.ts
+var n = {
+	"image/png": "png",
+	"image/jpeg": "jpg",
+	"image/jpg": "jpg",
+	"image/gif": "gif",
+	"image/webp": "webp",
+	"image/svg+xml": "svg"
+}, r = (e) => {
+	let t = /^data:([^;,]+)(;base64)?,(.*)$/s.exec(e);
+	if (!t) throw Error("not a data URI");
+	let n = t[1] || "application/octet-stream", r = !!t[2], i = t[3] ?? "";
+	return {
+		bytes: r ? new Uint8Array(Buffer.from(i, "base64")) : new Uint8Array(Buffer.from(decodeURIComponent(i), "utf8")),
+		contentType: n
+	};
+}, i = (i, a) => t.gen(function* () {
+	let o = yield* t.try({
+		try: () => r(a.dataUri),
+		catch: (t) => new e({
+			provider: "avatar",
+			message: String(t?.message ?? t),
+			transient: !1,
+			status: 400
+		})
+	}), s = n[o.contentType] ?? "bin";
+	return yield* i.put({
+		bytes: o.bytes,
+		contentType: o.contentType,
+		tenantId: a.tenantId,
+		ownerId: a.userId,
+		visibility: "public",
+		key: `avatars/${a.userId}/avatar.${s}`
+	});
+});
+//#endregion
+export { r as decodeDataUri, i as putAvatar };

package/dist/byteSecurity.d.ts

@@ -0,0 +1,3 @@
+export declare const storageByteSecurityHeaders: (contentType: string) => Readonly<Record<string, string>>;
+
+export { }

package/dist/byteSecurity.js

@@ -0,0 +1,7 @@
+//#region src/byteSecurity.ts
+var e = /^(?:image\/(?!svg)|video\/|audio\/|application\/pdf(?:;|$)|text\/plain(?:;|$))/i, t = (t) => ({
+	"x-content-type-options": "nosniff",
+	"content-disposition": e.test(t) ? "inline" : "attachment"
+});
+//#endregion
+export { t as storageByteSecurityHeaders };

package/dist/connection.js

@@ -0,0 +1,99 @@
+import { storageObjectNamespace as e } from "./storageNamespaces.js";
+import { azureConnectionTransport as t, databaseProvider as n, filesystemProvider as r, memoryProviderWithState as i, s3ConnectionTransport as a } from "./providers.js";
+import { StorageError as o } from "@voltro/kv/storage";
+import { Effect as s } from "effect";
+//#region src/connection.ts
+var c = (t, n = "") => {
+	if (!n) return t;
+	let r = (e) => `${n}${e}`;
+	return {
+		...t,
+		objectNamespace: t.objectNamespace.pipe(s.map((t) => e([
+			"prefixed-object-namespace",
+			t,
+			n
+		]))),
+		...t.objectLocation === void 0 ? {} : { objectLocation: (e) => t.objectLocation(r(e)) },
+		put: (e, ...n) => t.put(r(e), ...n),
+		get: (e) => t.get(r(e)),
+		delete: (e) => t.delete(r(e)),
+		head: (e) => t.head(r(e)),
+		getUrl: (e, ...n) => t.getUrl(r(e), ...n),
+		...t.publicUrl === void 0 ? {} : { publicUrl: (e) => t.publicUrl(r(e)) },
+		...t.setObjectPublic === void 0 ? {} : { setObjectPublic: (e, n) => t.setObjectPublic(r(e), n) },
+		...t.getUploadUrl === void 0 ? {} : { getUploadUrl: (e, n, i) => t.getUploadUrl(r(e), n, i) },
+		...t.createMultipartUpload === void 0 ? {} : { createMultipartUpload: (e, n, i) => t.createMultipartUpload(r(e), n, i) },
+		...t.presignUploadPart === void 0 ? {} : { presignUploadPart: (e, n, i, a) => t.presignUploadPart(r(e), n, i, a) },
+		...t.completeMultipartUpload === void 0 ? {} : { completeMultipartUpload: (e, n, i) => t.completeMultipartUpload(r(e), n, i) },
+		...t.abortMultipartUpload === void 0 ? {} : { abortMultipartUpload: (e, n) => t.abortMultipartUpload(r(e), n) },
+		...t.getStream === void 0 ? {} : { getStream: (e) => t.getStream(r(e)) },
+		...t.putStream === void 0 ? {} : { putStream: (e, n, i) => t.putStream(r(e), n, i) },
+		...t.getRange === void 0 ? {} : { getRange: (e, n, i) => t.getRange(r(e), n, i) }
+	};
+}, l = (e, l) => s.suspend(() => {
+	let u;
+	switch (e.provider) {
+		case "s3":
+		case "minio":
+			u = a({
+				bucket: e.bucket,
+				name: e.provider,
+				...e.region === void 0 ? {} : { region: e.region },
+				...e.endpoint === void 0 ? {} : { endpoint: e.endpoint },
+				...e.accessKeyId === void 0 ? {} : { accessKeyId: e.accessKeyId },
+				...e.secretAccessKey === void 0 ? {} : { secretAccessKey: e.secretAccessKey },
+				...e.cdnBaseUrl === void 0 ? {} : { cdnBaseUrl: e.cdnBaseUrl },
+				...e.publicAcl === void 0 ? {} : { publicAcl: e.publicAcl },
+				forcePathStyle: e.forcePathStyle ?? e.provider === "minio"
+			});
+			break;
+		case "filesystem":
+			u = {
+				provider: r({ root: e.root }),
+				close: s.void,
+				probe: s.tryPromise({
+					try: async () => {
+						let t = await import("node:fs/promises");
+						if (!(await t.stat(e.root)).isDirectory()) throw Error("Storage root must be a directory");
+						await t.access(e.root);
+					},
+					catch: () => new o({
+						provider: "filesystem",
+						message: "Storage root is not readable",
+						transient: !1
+					})
+				})
+			};
+			break;
+		case "memory":
+			u = {
+				provider: i(l.memory ?? /* @__PURE__ */ new Map()),
+				probe: s.void,
+				close: s.void
+			};
+			break;
+		case "database": {
+			let e = n();
+			u = {
+				provider: e,
+				probe: e.head("_connection_readiness").pipe(s.asVoid),
+				close: s.void
+			};
+			break;
+		}
+		case "azure": u = t({
+			container: e.bucket,
+			...e.accountName === void 0 ? {} : { accountName: e.accountName },
+			...e.accountKey === void 0 ? {} : { accountKey: e.accountKey },
+			...e.connectionString === void 0 ? {} : { connectionString: e.connectionString },
+			...e.endpoint === void 0 ? {} : { endpoint: e.endpoint },
+			...e.cdnBaseUrl === void 0 ? {} : { cdnBaseUrl: e.cdnBaseUrl }
+		});
+	}
+	return s.succeed({
+		...u,
+		provider: c(u.provider, e.keyPrefix)
+	});
+});
+//#endregion
+export { l as connectStorage, c as withStorageKeyPrefix };

package/dist/constraints.js

@@ -0,0 +1,93 @@
+//#region src/constraints.ts
+var e = (e, t) => {
+	if (!t || t.length === 0) return !0;
+	let n = e.toLowerCase();
+	return t.some((e) => {
+		let t = e.toLowerCase();
+		return t.endsWith("/*") ? n.startsWith(t.slice(0, -1)) : n === t;
+	});
+}, t = [
+	{
+		ct: /^image\/png$/,
+		offset: 0,
+		magic: [
+			137,
+			80,
+			78,
+			71
+		]
+	},
+	{
+		ct: /^image\/jpe?g$/,
+		offset: 0,
+		magic: [
+			255,
+			216,
+			255
+		]
+	},
+	{
+		ct: /^image\/gif$/,
+		offset: 0,
+		magic: [
+			71,
+			73,
+			70,
+			56
+		]
+	},
+	{
+		ct: /^image\/webp$/,
+		offset: 0,
+		magic: [
+			82,
+			73,
+			70,
+			70
+		]
+	},
+	{
+		ct: /^image\/bmp$/,
+		offset: 0,
+		magic: [66, 77]
+	},
+	{
+		ct: /^application\/pdf$/,
+		offset: 0,
+		magic: [
+			37,
+			80,
+			68,
+			70
+		]
+	},
+	{
+		ct: /^application\/zip$/,
+		offset: 0,
+		magic: [
+			80,
+			75,
+			3,
+			4
+		]
+	},
+	{
+		ct: /^application\/gzip$/,
+		offset: 0,
+		magic: [31, 139]
+	}
+], n = (e, n) => {
+	let r = n.toLowerCase(), i = t.find((e) => e.ct.test(r));
+	return i ? e.length < i.offset + i.magic.length ? !1 : i.magic.every((t, n) => e[i.offset + n] === t) : !0;
+}, r = (t, r, i) => i ? i.maxBytes !== void 0 && t.byteLength > i.maxBytes ? {
+	reason: "too-large",
+	detail: `${t.byteLength} bytes exceeds the ${i.maxBytes}-byte limit`
+} : e(r, i.allowedContentTypes) ? i.sniff && !n(t, r) ? {
+	reason: "content-mismatch",
+	detail: `bytes do not match the declared content type '${r}'`
+} : null : {
+	reason: "content-type-not-allowed",
+	detail: `content type '${r}' is not in the allow-list`
+} : null;
+//#endregion
+export { r as checkLimits, e as contentTypeAllowed, n as sniffMatches };

package/dist/custody.js

@@ -0,0 +1,132 @@
+import { StorageError as e } from "./types.js";
+import { storageMetadataError as t } from "./metadataError.js";
+import { readRetainedStorageObject as n } from "./retainedObjects.js";
+import { abandonRetainedCapture as r, admitRetainedCaptureObject as i, inspectRetainedSource as a, registerRetainedCapture as o, retainedCaptureItems as s, runRetainedCapture as c, sealRetainedCapture as l } from "./retainedCapture.js";
+import { Context as u, Effect as d, Layer as f, Schema as p, Stream as m } from "effect";
+import { canonicalJson as h, pluginInstanceName as g } from "@voltro/protocol";
+//#region src/custody.ts
+var _ = "@voltro/plugin-storage", v = (e) => g({
+	base: _,
+	alias: e.alias,
+	instance: e.name
+}), y = (e) => `${_}/StorageCustody:${JSON.stringify(e)}`, b = class extends u.Service()(y(_)) {
+	static withSource(e) {
+		return d.suspend(() => {
+			let t = E.get(e.source), n = E.get(e.destination);
+			return t === void 0 || n === void 0 ? d.fail(x("Custody transfer requires configured storage services")) : t !== n && v(t.selection) === v(n.selection) ? d.fail(x("Custody source and destination need distinct configured instance identities")) : d.succeed(D(n, t));
+		});
+	}
+	static forInstance(e = {}) {
+		return u.Service(y(v(e)));
+	}
+}, x = (t, n = 409) => new e({
+	provider: "custody",
+	message: t,
+	status: n,
+	transient: !1
+}), S = (n) => p.is(e)(n) ? n : t(n, "custody"), C = (e) => d.tryPromise({
+	try: e,
+	catch: S
+}), w = (e) => ({
+	id: e.id,
+	instance: e.instance,
+	objectNamespace: e.objectNamespace,
+	tenantId: e.tenantId,
+	bucket: e.bucket,
+	contextDigest: e.contextDigest,
+	...e.source === void 0 ? {} : { source: {
+		instance: e.source.instance,
+		objectNamespace: e.source.objectNamespace,
+		bucket: e.source.bucket
+	} }
+}), T = (e) => ({
+	...w(e),
+	count: e.count,
+	digest: e.digest
+}), E = /* @__PURE__ */ new WeakMap(), D = (e, t = e) => {
+	let u = v(t.selection), f = v(e.selection), p = e.bucket, g = e.provider, _ = (t) => d.gen(function* () {
+		let n = yield* g.objectNamespace;
+		if (t !== void 0 && (t.instance !== f || t.bucket !== p || t.objectNamespace !== n)) return yield* d.fail(x("Capture belongs to another storage instance or bucket", 403));
+		let r = e.store();
+		return yield* r === void 0 ? d.fail(x("Storage custody requires a bound database and the default reference and grant stores")) : d.succeed(r);
+	}), y = () => d.gen(function* () {
+		let e = yield* t.provider.objectNamespace;
+		return u === f && t.bucket === p ? void 0 : {
+			instance: u,
+			objectNamespace: e,
+			bucket: t.bucket
+		};
+	}), b = () => d.gen(function* () {
+		let e = yield* _();
+		return t.store() === e ? e : yield* d.fail(x("Custody source and destination must share the bound application database"));
+	}), D = {
+		inspect: (e, n) => d.gen(function* () {
+			let r = n.id, i = n.tenantId;
+			yield* b();
+			let o = yield* t.provider.objectNamespace;
+			return yield* C(() => a(e, {
+				instance: u,
+				objectNamespace: o,
+				bucket: t.bucket,
+				tenantId: i
+			}, r));
+		}),
+		register: (e, t) => d.gen(function* () {
+			let n = yield* y(), r = {
+				id: t.id,
+				instance: f,
+				objectNamespace: yield* g.objectNamespace,
+				tenantId: t.tenantId,
+				bucket: p,
+				contextDigest: t.contextDigest,
+				...n === void 0 ? {} : { source: n }
+			}, i = t.maxBytes, a = t.sources;
+			return yield* b(), {
+				key: r,
+				count: (yield* C(() => o(e, r, {
+					maxBytes: i,
+					sources: a
+				}))).count
+			};
+		}),
+		run: (n) => d.gen(function* () {
+			let r = w(n);
+			yield* _(r);
+			let i = yield* b();
+			yield* c(i, g, r, e.quota, {
+				instance: u,
+				bucket: t.bucket,
+				provider: t.provider
+			}).pipe(d.mapError(S));
+		}),
+		seal: (e, t) => d.gen(function* () {
+			let n = w(t);
+			return yield* _(n), yield* C(() => l(e, n));
+		}),
+		items: (e, t) => m.unwrap(d.gen(function* () {
+			let n = T(e), r = yield* _(n);
+			return m.fromAsyncIterable(s(t ?? r, n), S);
+		})),
+		read: (e, t, r) => d.gen(function* () {
+			let a = T(e), o = yield* d.try({
+				try: () => JSON.parse(h(t)),
+				catch: S
+			}), s = {
+				storageInstance: f,
+				tenantId: r.tenantId,
+				maxBytes: r.maxBytes,
+				bucket: p
+			};
+			if (a.tenantId !== s.tenantId || o.tenantId !== s.tenantId) return yield* d.fail(x("Capture tenant does not match admitted tenant", 403));
+			let c = yield* _(a);
+			return yield* C(() => i(c, a, o)), yield* n(c, g, o, s).pipe(d.mapError(S));
+		}),
+		abandon: (e) => d.gen(function* () {
+			let t = w(e), n = yield* _(t);
+			yield* r(n, g, t).pipe(d.mapError(S));
+		})
+	};
+	return E.set(D, e), D;
+}, O = (e) => f.succeed(b.forInstance(e.selection), D(e));
+//#endregion
+export { b as StorageCustody, O as storageCustodyLayer };

package/dist/derivatives.js

@@ -0,0 +1,30 @@
+import { isTransformable as e, loadSharp as t } from "./transform.js";
+//#region src/derivatives.ts
+var n = async (n, r, i) => {
+	if (!e(r)) return { bytes: n };
+	let a = await t();
+	if (!a) return { bytes: n };
+	try {
+		let e = n;
+		if (i?.normalize) {
+			let t = await a(Buffer.from(n), { failOn: "none" }).rotate().toBuffer();
+			e = new Uint8Array(t);
+		}
+		let t = await a(Buffer.from(e), { failOn: "none" }).metadata(), r = await a(Buffer.from(e), { failOn: "none" }).resize({
+			width: 24,
+			height: 24,
+			fit: "inside",
+			withoutEnlargement: !0
+		}).webp({ quality: 40 }).toBuffer().catch(() => null);
+		return {
+			bytes: e,
+			...typeof t.width == "number" ? { width: t.width } : {},
+			...typeof t.height == "number" ? { height: t.height } : {},
+			...r ? { placeholder: `data:image/webp;base64,${r.toString("base64")}` } : {}
+		};
+	} catch {
+		return { bytes: n };
+	}
+};
+//#endregion
+export { n as extractImageMetadata };

package/dist/env.js

@@ -0,0 +1,162 @@
+import { pluginEnv as e } from "@voltro/env";
+//#region src/env.ts
+var t = e([
+	{
+		name: "STORAGE_PROVIDER",
+		required: !1,
+		secret: !1,
+		description: "Provider name: 's3' | 'minio' | 'azure' | 'database' | 'filesystem' | 'memory'. Default 'memory'."
+	},
+	{
+		name: "S3_BUCKET",
+		required: !1,
+		secret: !1,
+		description: "S3/MinIO bucket name. Default STORAGE_BUCKET, else \"voltro\"."
+	},
+	{
+		name: "STORAGE_BUCKET",
+		required: !1,
+		secret: !1,
+		description: "Fallback bucket name when S3_BUCKET is unset."
+	},
+	{
+		name: "S3_REGION",
+		required: !1,
+		secret: !1,
+		description: "S3 region. Falls back to AWS_REGION."
+	},
+	{
+		name: "AWS_REGION",
+		required: !1,
+		secret: !1,
+		description: "AWS region fallback for the S3 provider."
+	},
+	{
+		name: "S3_ENDPOINT",
+		required: !1,
+		secret: !1,
+		description: "Custom S3 endpoint URL. Falls back to MINIO_ENDPOINT."
+	},
+	{
+		name: "MINIO_ENDPOINT",
+		required: !1,
+		secret: !1,
+		description: "MinIO endpoint URL fallback for the S3 provider."
+	},
+	{
+		name: "S3_ACCESS_KEY_ID",
+		required: !1,
+		secret: !0,
+		description: "S3 access key id. Falls back to AWS_ACCESS_KEY_ID."
+	},
+	{
+		name: "AWS_ACCESS_KEY_ID",
+		required: !1,
+		secret: !0,
+		description: "AWS access key id fallback for the S3 provider."
+	},
+	{
+		name: "S3_SECRET_ACCESS_KEY",
+		required: !1,
+		secret: !0,
+		description: "S3 secret access key. Falls back to AWS_SECRET_ACCESS_KEY."
+	},
+	{
+		name: "AWS_SECRET_ACCESS_KEY",
+		required: !1,
+		secret: !0,
+		description: "AWS secret access key fallback for the S3 provider."
+	},
+	{
+		name: "S3_FORCE_PATH_STYLE",
+		required: !1,
+		secret: !1,
+		description: "Set to \"1\" to force path-style S3 addressing."
+	},
+	{
+		name: "STORAGE_CDN_URL",
+		required: !1,
+		secret: !1,
+		description: "Public base URL (CDN) served in front of the bucket for public objects."
+	},
+	{
+		name: "VOLTRO_PUBLIC_URL",
+		required: !1,
+		secret: !1,
+		description: "Absolute public base URL of THIS api (scheme://host[:port]) — prepended to the /_voltro/storage/:id serve URL so getUrl/mintUrl/the upload route emit ABSOLUTE URLs. Required when the api is a different origin than the app."
+	},
+	{
+		name: "STORAGE_ALLOWED_ORIGINS",
+		required: !1,
+		secret: !1,
+		description: "Comma-separated origins allowed to read the serve route + POST the upload route cross-origin (CORS). Use '*' for any. Omit for same-origin only."
+	},
+	{
+		name: "AZURE_STORAGE_ACCOUNT",
+		required: !1,
+		secret: !1,
+		description: "Azure storage account name (provider \"azure\")."
+	},
+	{
+		name: "AZURE_STORAGE_KEY",
+		required: !1,
+		secret: !0,
+		description: "Azure account key — needed to mint SAS URLs."
+	},
+	{
+		name: "AZURE_STORAGE_CONNECTION_STRING",
+		required: !1,
+		secret: !0,
+		description: "Azure connection string (carries the account key)."
+	},
+	{
+		name: "AZURE_STORAGE_ENDPOINT",
+		required: !1,
+		secret: !1,
+		description: "Custom Azure blob endpoint (e.g. Azurite)."
+	},
+	{
+		name: "AZURE_STORAGE_CONTAINER",
+		required: !1,
+		secret: !1,
+		description: "Azure blob container name (the \"bucket\")."
+	},
+	{
+		name: "STORAGE_ROOT",
+		required: !1,
+		secret: !1,
+		description: "Filesystem provider root directory. Default \".voltro-storage\"."
+	},
+	{
+		name: "VOLTRO_STORAGE_SECRET",
+		required: !1,
+		secret: !0,
+		description: "HMAC secret for signed storage links and upload tickets. Falls back to the session secret (and its VOLTRO_SESSION_SECRET_PREVIOUS)."
+	},
+	{
+		name: "VOLTRO_STORAGE_SECRET_PREVIOUS",
+		required: !1,
+		secret: !0,
+		description: "During a VOLTRO_STORAGE_SECRET rotation: the secret links and tickets were signed with until now. They keep verifying until they expire; then remove it."
+	},
+	{
+		name: "VOLTRO_SESSION_COOKIE",
+		required: !1,
+		secret: !1,
+		description: "Session cookie name used to resolve private-object access. Default \"voltro:session\"."
+	},
+	{
+		name: "CLAMAV_HOST",
+		required: !1,
+		secret: !1,
+		description: "clamd host for the optional clamav virus scanner. Default 127.0.0.1."
+	},
+	{
+		name: "CLAMAV_PORT",
+		required: !1,
+		secret: !1,
+		description: "clamd port for the optional clamav virus scanner. Default 3310."
+	}
+]);
+//#endregion
+export { t as storageEnv };