@voltro/plugin-storage 0.85.0 → 0.87.0

package/dist/index.js

@@ -1,2737 +1,128 @@
-import { StorageAccessDenied as e, StorageError as t, StorageRejected as n, StorageScanRejected as r, StorageService as i } from "./types.js";
-import { abortMultipartUploadDescriptor as a, beginMultipartUploadDescriptor as o, beginResumableUploadDescriptor as s, completeMultipartUploadDescriptor as c, finalizeUploadDescriptor as l, ingestUrlDescriptor as u, listGrantsDescriptor as d, listRefsDescriptor as f, mintPresignedUploadDescriptor as p, mintUploadTicketDescriptor as m, mintUploadUrlDescriptor as ee, mintUrlDescriptor as te, revokeDescriptor as ne, shareDescriptor as h, signMultipartPartDescriptor as g, storageRpcClientImports as _, uploadDescriptor as re } from "./rpc.js";
-import { processIdentity as ie } from "@voltro/protocol/identity";
-import { Effect as v, Exit as y, Layer as b, Schedule as x, Schema as S, Stream as C } from "effect";
-import { StorageAccessPolicySchema as ae, definePlugin as oe, pluginInstanceName as w } from "@voltro/protocol";
-import { readCookie as se, resolveSessionSecret as ce, verifySession as le } from "@voltro/protocol/session";
-import { and as ue, authoredError as T, bigint as E, bytes as D, causeBranches as O, column as de, contains as fe, eq as k, extractDbCause as pe, generateId as A, id as j, integer as M, isNull as me, isTransientContention as he, json as ge, mixin as _e, neq as ve, or as N, reference as ye, table as P, text as F, timestamp as be, wireSafeCause as xe } from "@voltro/database";
-import { pluginEnv as Se } from "@voltro/env";
-import { createHash as Ce, createHmac as I, randomBytes as we, randomUUID as Te, scryptSync as Ee, timingSafeEqual as L } from "node:crypto";
-import { ssrfReason as De } from "@voltro/runtime";
-import { spawn as Oe } from "node:child_process";
-import { mkdtemp as R, readFile as z, rm as ke, writeFile as Ae } from "node:fs/promises";
-import { tmpdir as je } from "node:os";
-import { join as Me } from "node:path";
-import { statSync as Ne } from "node:fs";
-//#region src/streamBridge.ts
-var Pe = 1 << 20, Fe = (e, n, r = !1) => new t({
-	provider: e,
-	message: n,
-	transient: r
-}), Ie = (e) => {
-	let t = 0;
-	for (let n of e) t += n.byteLength;
-	let n = new Uint8Array(t), r = 0;
-	for (let t of e) n.set(t, r), r += t.byteLength;
-	return n;
-}, Le = (e, t = Pe) => {
-	let n = [];
-	for (let r = 0; r < e.byteLength; r += t) n.push(e.subarray(r, Math.min(r + t, e.byteLength)));
-	return C.fromIterable(n);
-}, Re = (e) => e.pipe(C.runCollect, v.map((e) => Ie(e))), ze = (e, t) => C.suspend(() => C.fromAsyncIterable(t(), (t) => Fe(e, `read stream failed: ${String(t?.message ?? t)}`, !0))).pipe(C.map((e) => e instanceof Uint8Array ? e : new Uint8Array(e))), Be = async (e) => {
-	let { Readable: t } = await import("node:stream");
-	return t.fromWeb(C.toReadableStream(e));
-}, Ve = (e, t) => e.getStream ? e.getStream(t) : e.get(t).pipe(v.map((e) => ({
-	stream: Le(e.bytes),
-	contentType: e.contentType,
-	size: e.bytes.byteLength
-}))), He = (e, t, n, r) => e.putStream ? e.putStream(t, n, r) : Re(n).pipe(v.flatMap((n) => e.put(t, n, {
-	contentType: r.contentType,
-	...r.public === void 0 ? {} : { public: r.public }
-}))), B = "_voltro_storage_refs", V = "_voltro_storage_grants", H = "_voltro_storage_blobs", Ue = "_voltro_storage_usage", We = P(B, {
-	id: j({ prefix: "file" }),
-	tenantId: F().nullable(),
-	ownerId: F().nullable(),
-	bucket: F(),
-	key: F(),
-	contentType: F(),
-	size: E(),
-	checksum: F(),
-	visibility: F(),
-	accessPolicy: ge().nullable(),
-	passwordHash: F().nullable(),
-	width: M().nullable(),
-	height: M().nullable(),
-	duration: M().nullable(),
-	placeholder: F().nullable(),
-	folder: F().nullable(),
-	tags: ge().nullable(),
-	alt: F().nullable(),
-	caption: F().nullable(),
-	derivedFrom: F().nullable(),
-	kind: F().nullable(),
-	createdAt: be()
-}).index(["key"]).index(["tenantId"]).index(["ownerId"]).index(["folder"]).index(["derivedFrom"]), Ge = P(V, {
-	id: j({ prefix: "sgrant" }),
-	refId: F(),
-	principalType: F(),
-	principalId: F(),
-	permission: F(),
-	createdAt: be(),
-	expiresAt: be().nullable(),
-	createdBy: F().nullable()
-}).index(["refId"]).index(["principalId"]), Ke = P(Ue, {
-	id: j({ prefix: "susage" }),
-	tenantId: F().maxLength(191),
-	bytes: E().default("0"),
-	count: E().default("0"),
-	updatedAt: be()
-}).unique("byStorageUsageTenant", ["tenantId"]), qe = P(H, {
-	id: j({ prefix: "blob" }),
-	key: F(),
-	data: D(),
-	contentType: F(),
-	size: E()
-}).index(["key"]), U = Se([
-	{
-		name: "STORAGE_PROVIDER",
-		required: !1,
-		secret: !1,
-		description: "Provider name: 's3' | 'minio' | 'azure' | 'database' | 'filesystem' | 'memory'. Default 'memory'."
-	},
-	{
-		name: "S3_BUCKET",
-		required: !1,
-		secret: !1,
-		description: "S3/MinIO bucket name. Default STORAGE_BUCKET, else \"voltro\"."
-	},
-	{
-		name: "STORAGE_BUCKET",
-		required: !1,
-		secret: !1,
-		description: "Fallback bucket name when S3_BUCKET is unset."
-	},
-	{
-		name: "S3_REGION",
-		required: !1,
-		secret: !1,
-		description: "S3 region. Falls back to AWS_REGION."
-	},
-	{
-		name: "AWS_REGION",
-		required: !1,
-		secret: !1,
-		description: "AWS region fallback for the S3 provider."
-	},
-	{
-		name: "S3_ENDPOINT",
-		required: !1,
-		secret: !1,
-		description: "Custom S3 endpoint URL. Falls back to MINIO_ENDPOINT."
-	},
-	{
-		name: "MINIO_ENDPOINT",
-		required: !1,
-		secret: !1,
-		description: "MinIO endpoint URL fallback for the S3 provider."
-	},
-	{
-		name: "S3_ACCESS_KEY_ID",
-		required: !1,
-		secret: !0,
-		description: "S3 access key id. Falls back to AWS_ACCESS_KEY_ID."
-	},
-	{
-		name: "AWS_ACCESS_KEY_ID",
-		required: !1,
-		secret: !0,
-		description: "AWS access key id fallback for the S3 provider."
-	},
-	{
-		name: "S3_SECRET_ACCESS_KEY",
-		required: !1,
-		secret: !0,
-		description: "S3 secret access key. Falls back to AWS_SECRET_ACCESS_KEY."
-	},
-	{
-		name: "AWS_SECRET_ACCESS_KEY",
-		required: !1,
-		secret: !0,
-		description: "AWS secret access key fallback for the S3 provider."
-	},
-	{
-		name: "S3_FORCE_PATH_STYLE",
-		required: !1,
-		secret: !1,
-		description: "Set to \"1\" to force path-style S3 addressing."
-	},
-	{
-		name: "STORAGE_CDN_URL",
-		required: !1,
-		secret: !1,
-		description: "Public base URL (CDN) served in front of the bucket for public objects."
-	},
-	{
-		name: "VOLTRO_PUBLIC_URL",
-		required: !1,
-		secret: !1,
-		description: "Absolute public base URL of THIS api (scheme://host[:port]) — prepended to the /_voltro/storage/:id serve URL so getUrl/mintUrl/the upload route emit ABSOLUTE URLs. Required when the api is a different origin than the app."
-	},
-	{
-		name: "STORAGE_ALLOWED_ORIGINS",
-		required: !1,
-		secret: !1,
-		description: "Comma-separated origins allowed to read the serve route + POST the upload route cross-origin (CORS). Use '*' for any. Omit for same-origin only."
-	},
-	{
-		name: "AZURE_STORAGE_ACCOUNT",
-		required: !1,
-		secret: !1,
-		description: "Azure storage account name (provider \"azure\")."
-	},
-	{
-		name: "AZURE_STORAGE_KEY",
-		required: !1,
-		secret: !0,
-		description: "Azure account key — needed to mint SAS URLs."
-	},
-	{
-		name: "AZURE_STORAGE_CONNECTION_STRING",
-		required: !1,
-		secret: !0,
-		description: "Azure connection string (carries the account key)."
-	},
-	{
-		name: "AZURE_STORAGE_ENDPOINT",
-		required: !1,
-		secret: !1,
-		description: "Custom Azure blob endpoint (e.g. Azurite)."
-	},
-	{
-		name: "AZURE_STORAGE_CONTAINER",
-		required: !1,
-		secret: !1,
-		description: "Azure blob container name (the \"bucket\")."
-	},
-	{
-		name: "STORAGE_ROOT",
-		required: !1,
-		secret: !1,
-		description: "Filesystem provider root directory. Default \".voltro-storage\"."
-	},
-	{
-		name: "VOLTRO_STORAGE_SECRET",
-		required: !1,
-		secret: !0,
-		description: "HMAC secret for signed grant tokens. Falls back to the session secret."
-	},
-	{
-		name: "VOLTRO_SESSION_COOKIE",
-		required: !1,
-		secret: !1,
-		description: "Session cookie name used to resolve private-object access. Default \"voltro:session\"."
-	},
-	{
-		name: "CLAMAV_HOST",
-		required: !1,
-		secret: !1,
-		description: "clamd host for the optional clamav virus scanner. Default 127.0.0.1."
-	},
-	{
-		name: "CLAMAV_PORT",
-		required: !1,
-		secret: !1,
-		description: "clamd port for the optional clamav virus scanner. Default 3310."
-	}
-]), W = (e, n) => {
-	let r = typeof e == "number" ? e : typeof e == "bigint" || typeof e == "string" && /^\d+$/.test(e) ? Number(e) : NaN;
-	if (!Number.isSafeInteger(r) || r < 0) throw new t({
-		provider: "metadata",
-		message: `Storage ${n} must be a non-negative safe integer at most Number.MAX_SAFE_INTEGER`,
+import { appStorageRouter as e, makeStorageDestinationRouter as t } from "./storageRouting.js";
+import { storageByteSecurityHeaders as n } from "./byteSecurity.js";
+import { existingFilesystemObjectNamespace as r, storageObjectNamespace as i } from "./storageNamespaces.js";
+import { STORAGE_REFERENCE_CATALOGUE_TABLE as a, ensureStorageReferenceCatalogue as o, storageReferenceCatalogueTable as s } from "./referenceCatalogue.js";
+import { STORAGE_BLOBS_TABLE as c, STORAGE_GRANTS_TABLE as l, STORAGE_REFS_TABLE as u, STORAGE_USAGE_TABLE as d, _voltroStorageBlobsTable as ee, _voltroStorageGrantsTable as f, _voltroStorageRefsTable as p, _voltroStorageUsageTable as m } from "./table.js";
+import { assignStorageReferenceInstancesInTransaction as h, requireStorageReferenceOwnership as te } from "./storageReferenceInstances.js";
+import { StorageAccessDenied as ne, StorageError as g, StorageRejected as re, StorageScanRejected as ie, StorageService as _, storageAddressIdentity as ae, storageRefAddress as v } from "./types.js";
+import { storageObjectLifecycleTables as oe } from "./objectLifecycle.js";
+import { assignStorageObjectNamespacesInTransaction as y, requireStorageObjectNamespaces as se } from "./storageObjectNamespaces.js";
+import { bytesToStream as b, collectStream as x, concatBytes as S, fromNodeReadable as C, getObjectStream as ce, putObjectStream as w, toNodeReadable as T } from "./streamBridge.js";
+import { storageEnv as E } from "./env.js";
+import { azureProvider as D, clearStorageBuffer as O, databaseProvider as k, filesystemProvider as A, memoryProvider as j, memoryProviderWithState as M, readStorageBuffer as N, s3Provider as P } from "./providers.js";
+import { createTransformCache as le } from "./transformCache.js";
+import { editImage as ue, parseTransformParams as de, transformCached as fe, transformFallbackReason as pe, transformImage as me, transformKey as he } from "./transform.js";
+import { hashPassword as F, verifyPassword as I } from "./access.js";
+import { resolveStorageSecret as L, signFinalizeTicket as ge, signGrant as R, signMultipartTicket as _e, signResumableTicket as ve, signUploadTicket as z, verifyFinalizeTicket as ye, verifyGrant as be, verifyMultipartTicket as B, verifyResumableTicket as xe, verifyUploadTicket as Se } from "./grant.js";
+import { checkLimits as V, contentTypeAllowed as Ce, sniffMatches as we } from "./constraints.js";
+import { fetchIngestBody as H } from "./ingest.js";
+import { buildStorageService as Te, dataStoreGrantStore as Ee, dataStoreRefStore as De, memoryGrantStore as Oe, memoryRefStore as ke, refMatchesListQuery as Ae, storageServiceLayer as je } from "./service.js";
+import { makeStorageObjectMetadata as Me, storagePutIntentsTable as Ne } from "./objectMetadata.js";
+import { retainedCaptureTables as Pe } from "./retainedCapture.js";
+import { StorageCustody as Fe, storageCustodyLayer as Ie } from "./custody.js";
+import { abortMultipartUploadDescriptor as Le, beginMultipartUploadDescriptor as Re, beginResumableUploadDescriptor as ze, completeMultipartUploadDescriptor as Be, finalizeUploadDescriptor as Ve, ingestUrlDescriptor as He, listGrantsDescriptor as Ue, listRefsDescriptor as We, mintPresignedUploadDescriptor as Ge, mintUploadTicketDescriptor as Ke, mintUploadUrlDescriptor as qe, mintUrlDescriptor as Je, revokeDescriptor as Ye, shareDescriptor as Xe, signMultipartPartDescriptor as Ze, storageRpcClientImports as Qe, uploadDescriptor as $e } from "./rpc.js";
+import { clamavScanner as U, encodeInstream as W, parseClamavResponse as G } from "./scanners.js";
+import { ffmpegTranscoder as K } from "./transcodeVideo.js";
+import { assetRef as et, withStorage as tt } from "./assetRef.js";
+import { decodeDataUri as nt, putAvatar as rt } from "./avatar.js";
+import { durabilityNotice as it, pathDurability as at } from "./pathDurability.js";
+import { connectStorage as ot, withStorageKeyPrefix as st } from "./connection.js";
+import { StorageAddress as ct, forwardStorageProvider as lt, isStorageKey as ut, storageAddressIdentity as dt } from "@voltro/kv/storage";
+import { Effect as q, Layer as ft, Schema as J, Stream as pt } from "effect";
+import { createHash as mt, randomUUID as ht } from "node:crypto";
+import { authoredError as gt } from "@voltro/database";
+import { processIdentity as _t } from "@voltro/protocol/identity";
+import { StorageAccessPolicySchema as vt, definePlugin as yt, effectiveScopes as bt, pluginInstanceName as xt } from "@voltro/protocol";
+import { readCookie as St, resolveSessionSecrets as Ct, verifySessionKeyed as wt } from "@voltro/protocol/session";
+import { ifRangeAllowsRange as Tt, parseByteRange as Et } from "@voltro/runtime/http-range";
+//#region src/index.ts
+var Dt = E.read("VOLTRO_SESSION_COOKIE") ?? "voltro:session", Ot = (e) => {
+	let t = e.filter((e) => e.capabilities?.storageProvider !== void 0);
+	if (t.length > 1) throw new g({
+		provider: "storage",
+		message: "Storage destination is ambiguous; installed instances: " + t.map((e) => e.name).sort().join(", "),
 		transient: !1
 	});
-	return r;
-}, Je = (e, t, n) => W(e + t, n), G = (e, n, r = !1) => {
-	let i = O(e).find(S.is(t));
-	if (i !== void 0) return i;
-	let a = pe(e), o = a.dbCode === "22003" || a.dbSqlState === "22003" || a.dbCode === "ER_WARN_DATA_OUT_OF_RANGE" || a.dbErrno === 1264 || a.dbNumber === 8115 || a.dbNumber === 248, s = new t({
-		provider: n,
-		message: `${o ? "Storage metadata numeric value out of range: " : ""}${xe(e)}`,
-		transient: o ? !1 : he(e) || r
-	});
-	return Object.defineProperty(s, "cause", {
-		value: e,
-		configurable: !0
-	}), s;
-}, Ye = (e) => O(e).find(S.is(n)), K = (e, n, r, i) => new t({
-	provider: e,
-	message: n,
-	transient: r,
-	...i === void 0 ? {} : { status: i }
-}), Xe = (e) => e === void 0 || e === 408 || e === 429 || e >= 500, Ze = /* @__PURE__ */ new Map(), Qe = (e, t) => Ze.get(e)?.get(t)?.bytes, $e = (e) => {
-	Ze.get(e)?.clear();
-}, et = (e = "default") => {
-	let t = Ze.get(e) ?? /* @__PURE__ */ new Map();
-	return Ze.set(e, t), {
-		name: "memory",
-		presigns: !1,
-		put: (e, n, r) => v.sync(() => (t.set(e, {
-			bytes: n,
-			contentType: r.contentType
-		}), { size: n.byteLength })),
-		get: (e) => v.suspend(() => {
-			let n = t.get(e);
-			return n ? v.succeed({
-				bytes: n.bytes,
-				contentType: n.contentType
-			}) : v.fail(K("memory", `no object at key '${e}'`, !1, 404));
-		}),
-		delete: (e) => v.sync(() => {
-			t.delete(e);
-		}),
-		publicUrl: () => null,
-		getUrl: () => v.succeed(""),
-		head: (e) => v.sync(() => {
-			let n = t.get(e);
-			return n ? { size: n.bytes.byteLength } : null;
-		})
-	};
-}, tt = (e) => {
-	let t = e.root, n = async (e) => {
-		let { join: n, resolve: r, sep: i } = await import("node:path"), a = r(t), o = r(a, e);
-		if (o !== a && !o.startsWith(a + i)) throw Error(`key '${e}' escapes the storage root`);
-		return n(o);
-	}, r = (e, t, n = !1) => v.tryPromise({
-		try: e,
-		catch: (e) => e?.code === "ENOENT" ? K("filesystem", `no object at key '${t}'`, !1, 404) : K("filesystem", String(e?.message ?? e), n)
-	});
-	return {
-		root: t,
-		name: "filesystem",
-		presigns: !1,
-		put: (e, t, i) => r(async () => {
-			let r = await import("node:fs/promises"), { dirname: i } = await import("node:path"), { randomUUID: a } = await import("node:crypto"), o = await n(e), s = i(o);
-			await r.mkdir(s, { recursive: !0 });
-			let c = `${o}.tmp-${a()}`;
-			try {
-				await r.writeFile(c, t), await r.rename(c, o);
-			} catch (e) {
-				throw await r.rm(c, { force: !0 }).catch(() => {}), e;
-			}
-			return { size: t.byteLength };
-		}, e, !0),
-		get: (e) => r(async () => {
-			let t = await (await import("node:fs/promises")).readFile(await n(e));
-			return {
-				bytes: new Uint8Array(t),
-				contentType: "application/octet-stream"
-			};
-		}, e),
-		delete: (e) => r(async () => {
-			await (await import("node:fs/promises")).rm(await n(e), { force: !0 });
-		}, e),
-		publicUrl: () => null,
-		getUrl: () => v.succeed(""),
-		head: (e) => v.tryPromise({
-			try: async () => {
-				let t = await import("node:fs/promises");
-				try {
-					return { size: (await t.stat(await n(e))).size };
-				} catch (e) {
-					if (e?.code === "ENOENT") return null;
-					throw e;
-				}
-			},
-			catch: (e) => K("filesystem", String(e?.message ?? e), !1)
-		}),
-		getStream: (e) => r(async () => {
-			let t = await import("node:fs/promises"), { createReadStream: r } = await import("node:fs"), i = await n(e), a = await t.stat(i);
-			return {
-				stream: ze("filesystem", () => r(i)),
-				contentType: "application/octet-stream",
-				size: a.size
-			};
-		}, e),
-		putStream: (e, t, i) => r(async () => {
-			let r = await import("node:fs/promises"), { dirname: i } = await import("node:path"), { randomUUID: a } = await import("node:crypto"), { createWriteStream: o } = await import("node:fs"), { pipeline: s } = await import("node:stream/promises"), c = await n(e);
-			await r.mkdir(i(c), { recursive: !0 });
-			let l = `${c}.tmp-${a()}`;
-			try {
-				await s(await Be(t), o(l));
-				let e = await r.stat(l);
-				return await r.rename(l, c), { size: e.size };
-			} catch (e) {
-				throw await r.rm(l, { force: !0 }).catch(() => {}), e;
-			}
-		}, e, !0),
-		getRange: (e, t, i) => r(async () => {
-			let { createReadStream: r } = await import("node:fs"), a = await n(e), o = [];
-			return await new Promise((e, n) => {
-				let s = r(a, {
-					start: t,
-					end: i
-				});
-				s.on("data", (e) => o.push(e)), s.on("end", () => e()), s.on("error", n);
-			}), Ie(o);
-		}, e)
-	};
-}, nt = (e) => {
-	let t = e.name ?? "s3", n = e.publicAcl ?? !0, r = null, i = () => r || (r = (async () => {
-		let t, n;
-		try {
-			t = await import("@aws-sdk/client-s3"), n = await import("@aws-sdk/s3-request-presigner");
-		} catch (e) {
-			throw Error("the 's3'/'minio' storage provider requires the '@aws-sdk/client-s3' + '@aws-sdk/s3-request-presigner' optional dependencies. Install them to enable it.", { cause: e });
-		}
-		return {
-			client: new t.S3Client({
-				...e.region ? { region: e.region } : { region: "us-east-1" },
-				...e.endpoint ? { endpoint: e.endpoint } : {},
-				...e.forcePathStyle ? { forcePathStyle: !0 } : {},
-				...e.accessKeyId && e.secretAccessKey ? { credentials: {
-					accessKeyId: e.accessKeyId,
-					secretAccessKey: e.secretAccessKey
-				} } : {}
-			}),
-			cmds: t,
-			presign: n.getSignedUrl
-		};
-	})(), r), a = (e) => v.tryPromise({
-		try: e,
-		catch: (e) => {
-			let n = e?.$metadata?.httpStatusCode;
-			return K(t, String(e?.message ?? e), Xe(n), n);
-		}
-	}), o = async (e) => {
-		let t = e;
-		if (typeof t.transformToByteArray == "function") return t.transformToByteArray();
-		let n = [];
-		for await (let e of t) n.push(e);
-		let r = n.reduce((e, t) => e + t.byteLength, 0), i = new Uint8Array(r), a = 0;
-		for (let e of n) i.set(e, a), a += e.byteLength;
-		return i;
-	};
-	return {
-		name: t,
-		presigns: !0,
-		put: (t, r, o) => a(async () => {
-			let { client: a, cmds: s } = await i();
-			return await a.send(new s.PutObjectCommand({
-				Bucket: e.bucket,
-				Key: t,
-				Body: r,
-				ContentType: o.contentType,
-				...o.public && n ? { ACL: "public-read" } : {}
-			})), { size: r.byteLength };
-		}),
-		get: (t) => a(async () => {
-			let { client: n, cmds: r } = await i(), a = await n.send(new r.GetObjectCommand({
-				Bucket: e.bucket,
-				Key: t
-			}));
-			return {
-				bytes: await o(a.Body),
-				contentType: a.ContentType ?? "application/octet-stream"
-			};
-		}),
-		delete: (t) => a(async () => {
-			let { client: n, cmds: r } = await i();
-			await n.send(new r.DeleteObjectCommand({
-				Bucket: e.bucket,
-				Key: t
-			}));
-		}),
-		publicUrl: (t) => e.cdnBaseUrl ? `${e.cdnBaseUrl.replace(/\/$/, "")}/${t}` : null,
-		...n ? { setObjectPublic: (t, n) => a(async () => {
-			let { client: r, cmds: a } = await i();
-			await r.send(new a.PutObjectAclCommand({
-				Bucket: e.bucket,
-				Key: t,
-				ACL: n ? "public-read" : "private"
-			}));
-		}) } : {},
-		getUrl: (t, n) => a(async () => {
-			let { client: r, cmds: a, presign: o } = await i();
-			return o(r, new a.GetObjectCommand({
-				Bucket: e.bucket,
-				Key: t
-			}), { expiresIn: n });
-		}),
-		getUploadUrl: (t, n, r) => a(async () => {
-			let { client: a, cmds: o, presign: s } = await i();
-			return s(a, new o.PutObjectCommand({
-				Bucket: e.bucket,
-				Key: t,
-				ContentType: r
-			}), { expiresIn: n });
-		}),
-		createMultipartUpload: (t, r, o) => a(async () => {
-			let { client: a, cmds: s } = await i(), c = await a.send(new s.CreateMultipartUploadCommand({
-				Bucket: e.bucket,
-				Key: t,
-				ContentType: r,
-				...o?.public && n ? { ACL: "public-read" } : {}
-			}));
-			if (!c.UploadId) throw Error("s3 createMultipartUpload returned no UploadId");
-			return { uploadId: c.UploadId };
-		}),
-		presignUploadPart: (t, n, r, o) => a(async () => {
-			let { client: a, cmds: s, presign: c } = await i();
-			return c(a, new s.UploadPartCommand({
-				Bucket: e.bucket,
-				Key: t,
-				UploadId: n,
-				PartNumber: r
-			}), { expiresIn: o });
-		}),
-		completeMultipartUpload: (t, n, r) => a(async () => {
-			let { client: a, cmds: o } = await i(), s = await a.send(new o.CompleteMultipartUploadCommand({
-				Bucket: e.bucket,
-				Key: t,
-				UploadId: n,
-				MultipartUpload: { Parts: r.map((e) => ({
-					PartNumber: e.partNumber,
-					ETag: e.etag
-				})) }
-			}));
-			return s.ETag === void 0 ? {} : { etag: s.ETag };
-		}),
-		abortMultipartUpload: (t, n) => a(async () => {
-			let { client: r, cmds: a } = await i();
-			await r.send(new a.AbortMultipartUploadCommand({
-				Bucket: e.bucket,
-				Key: t,
-				UploadId: n
-			}));
-		}),
-		head: (n) => v.tryPromise({
-			try: async () => {
-				let { client: t, cmds: r } = await i();
-				try {
-					let i = await t.send(new r.HeadObjectCommand({
-						Bucket: e.bucket,
-						Key: n
-					}));
-					return {
-						size: i.ContentLength ?? 0,
-						...i.ETag === void 0 ? {} : { etag: i.ETag }
-					};
-				} catch (e) {
-					if (e?.$metadata?.httpStatusCode === 404) return null;
-					throw e;
-				}
-			},
-			catch: (e) => {
-				let n = e?.$metadata?.httpStatusCode;
-				return K(t, String(e?.message ?? e), Xe(n), n);
-			}
-		}),
-		getStream: (n) => a(async () => {
-			let { client: r, cmds: a } = await i(), o = await r.send(new a.GetObjectCommand({
-				Bucket: e.bucket,
-				Key: n
-			})), s = o.Body;
-			return {
-				stream: ze(t, () => s),
-				contentType: o.ContentType ?? "application/octet-stream",
-				...o.ContentLength === void 0 ? {} : { size: o.ContentLength }
-			};
-		}),
-		putStream: (t, r, o) => a(async () => {
-			let { client: a, cmds: s } = await i(), c;
-			try {
-				c = await import("@aws-sdk/lib-storage");
-			} catch (e) {
-				throw Error("s3/minio `putStream` requires the '@aws-sdk/lib-storage' optional dependency (multipart upload). Install it to enable streamed uploads.", { cause: e });
-			}
-			let l = await Be(r);
-			return await new c.Upload({
-				client: a,
-				params: {
-					Bucket: e.bucket,
-					Key: t,
-					Body: l,
-					ContentType: o.contentType,
-					...o.public && n ? { ACL: "public-read" } : {}
-				}
-			}).done(), { size: o.totalSize ?? (await a.send(new s.HeadObjectCommand({
-				Bucket: e.bucket,
-				Key: t
-			}))).ContentLength ?? 0 };
-		}),
-		getRange: (t, n, r) => a(async () => {
-			let { client: a, cmds: s } = await i(), c = await a.send(new s.GetObjectCommand({
-				Bucket: e.bucket,
-				Key: t,
-				Range: `bytes=${n}-${r}`
-			}));
-			return o(c.Body);
-		})
-	};
-}, rt = (e) => e instanceof Uint8Array ? e : typeof e == "string" ? new Uint8Array(Buffer.from(e, "base64")) : new Uint8Array(e), it = () => {
-	let e = null, t = () => {
-		if (!e) throw T("the 'database' storage provider isn't bound to a DataStore yet");
-		return e;
-	}, n = (e) => v.tryPromise({
-		try: e,
-		catch: (e) => G(e, "database", !0)
-	}), r = async (e, n) => (await t().query({
-		table: H,
-		predicate: {
-			column: "key",
-			op: "eq",
-			value: e
-		},
-		order: [],
-		take: 1,
-		skip: void 0,
-		projection: n
-	}))[0];
-	return {
-		name: "database",
-		presigns: !1,
-		bindDataStore: (t) => {
-			e = t;
-		},
-		put: (e, i, a) => n(async () => {
-			let n = await r(e);
-			return n ? await t().update(H, String(n.id), {
-				data: i,
-				contentType: a.contentType,
-				size: String(i.byteLength)
-			}) : await t().insert(H, {
-				id: A({
-					kind: "typeid",
-					prefix: "blob"
-				}, H),
-				key: e,
-				data: i,
-				contentType: a.contentType,
-				size: String(i.byteLength)
-			}), { size: i.byteLength };
-		}),
-		get: (e) => v.suspend(() => n(() => r(e)).pipe(v.flatMap((t) => t ? v.succeed({
-			bytes: rt(t.data),
-			contentType: String(t.contentType)
-		}) : v.fail(K("database", `no object at key '${e}'`, !1, 404))))),
-		delete: (e) => n(async () => {
-			let n = await r(e, ["id"]);
-			n && await t().delete(H, String(n.id));
-		}),
-		publicUrl: () => null,
-		getUrl: () => v.succeed(""),
-		head: (e) => n(async () => {
-			let t = await r(e, ["size"]);
-			return t ? { size: W(t.size, "blob size") } : null;
-		})
-	};
-}, at = (e) => {
-	let t = null, n = () => t || (t = (async () => {
-		let t;
-		try {
-			t = await import("@azure/storage-blob");
-		} catch (e) {
-			throw Error("the 'azure' storage provider requires the '@azure/storage-blob' optional dependency. Install it to enable it.", { cause: e });
-		}
-		let n = U.read("AZURE_STORAGE_ACCOUNT", e.accountName), r = U.read("AZURE_STORAGE_KEY", e.accountKey), i = n && r ? new t.StorageSharedKeyCredential(n, r) : null, a = U.read("AZURE_STORAGE_CONNECTION_STRING", e.connectionString);
-		return {
-			container: (a ? t.BlobServiceClient.fromConnectionString(a) : new t.BlobServiceClient(e.endpoint ?? `https://${n}.blob.core.windows.net`, i ?? void 0)).getContainerClient(e.container),
-			sdk: t,
-			cred: i
-		};
-	})(), t), r = (e) => v.tryPromise({
-		try: e,
-		catch: (e) => {
-			let t = e?.statusCode;
-			return K("azure", String(e?.message ?? e), Xe(t), t);
-		}
-	}), i = async (e) => {
-		if (!e) return /* @__PURE__ */ new Uint8Array();
-		let t = [];
-		for await (let n of e) t.push(typeof n == "string" ? new TextEncoder().encode(n) : new Uint8Array(n));
-		let n = t.reduce((e, t) => e + t.byteLength, 0), r = new Uint8Array(n), i = 0;
-		for (let e of t) r.set(e, i), i += e.byteLength;
-		return r;
-	}, a = async (t, r, i) => {
-		let { container: a, sdk: o, cred: s } = await n();
-		if (!s) throw Error("azure SAS requires accountName + accountKey (set them or AZURE_STORAGE_ACCOUNT/AZURE_STORAGE_KEY)");
-		let c = a.getBlockBlobClient(t), l = o.generateBlobSASQueryParameters({
-			containerName: e.container,
-			blobName: t,
-			permissions: o.BlobSASPermissions.parse(r),
-			startsOn: /* @__PURE__ */ new Date(Date.now() - 6e4),
-			expiresOn: new Date(Date.now() + i * 1e3)
-		}, s).toString();
-		return `${c.url}?${l}`;
-	};
-	return {
-		name: "azure",
-		presigns: !0,
-		put: (e, t, i) => r(async () => {
-			let { container: r } = await n();
-			return await r.getBlockBlobClient(e).uploadData(Buffer.from(t), { blobHTTPHeaders: { blobContentType: i.contentType } }), { size: t.byteLength };
-		}),
-		get: (e) => r(async () => {
-			let { container: t } = await n(), r = await t.getBlockBlobClient(e).download();
-			return {
-				bytes: await i(r.readableStreamBody),
-				contentType: r.contentType ?? "application/octet-stream"
-			};
-		}),
-		delete: (e) => r(async () => {
-			let { container: t } = await n();
-			await t.getBlockBlobClient(e).deleteIfExists();
-		}),
-		publicUrl: (t) => e.cdnBaseUrl ? `${e.cdnBaseUrl.replace(/\/$/, "")}/${t}` : null,
-		getUrl: (e, t) => r(() => a(e, "r", t)),
-		getUploadUrl: (e, t, n) => r(() => a(e, "cw", t)),
-		head: (e) => v.tryPromise({
-			try: async () => {
-				let { container: t } = await n();
-				try {
-					let n = await t.getBlockBlobClient(e).getProperties();
-					return {
-						size: n.contentLength ?? 0,
-						...n.etag === void 0 ? {} : { etag: n.etag }
-					};
-				} catch (e) {
-					if (e?.statusCode === 404) return null;
-					throw e;
-				}
-			},
-			catch: (e) => {
-				let t = e?.statusCode;
-				return K("azure", String(e?.message ?? e), Xe(t), t);
-			}
-		}),
-		getStream: (e) => r(async () => {
-			let { container: t } = await n(), r = await t.getBlockBlobClient(e).download();
-			return {
-				stream: ze("azure", () => r.readableStreamBody),
-				contentType: r.contentType ?? "application/octet-stream",
-				...r.contentLength === void 0 ? {} : { size: r.contentLength }
-			};
-		}),
-		putStream: (e, t, i) => r(async () => {
-			let { container: r } = await n(), a = await Be(t);
-			return await r.getBlockBlobClient(e).uploadStream(a, 4194304, 5, { blobHTTPHeaders: { blobContentType: i.contentType } }), { size: i.totalSize ?? (await r.getBlockBlobClient(e).getProperties()).contentLength ?? 0 };
-		}),
-		getRange: (e, t, a) => r(async () => {
-			let { container: r } = await n(), o = await r.getBlockBlobClient(e).download(t, a - t + 1);
-			return i(o.readableStreamBody);
-		})
-	};
-}, ot = (e = {
-	entries: 200,
-	bytes: 67108864,
-	pending: 32
-}) => {
-	let t = /* @__PURE__ */ new Map(), n = /* @__PURE__ */ new Map(), r = 0;
-	return { getOrCreate: (i, a) => {
-		let o = t.get(i);
-		if (o) return Promise.resolve(o);
-		let s = n.get(i);
-		if (s) return s;
-		if (n.size >= e.pending) return Promise.resolve(null);
-		let c = Promise.resolve().then(a).then((n) => {
-			if (n && e.entries > 0 && n.bytes.byteLength <= e.bytes) {
-				for (; t.size >= e.entries || r + n.bytes.byteLength > e.bytes;) {
-					let e = t.keys().next().value;
-					if (e === void 0) break;
-					r -= t.get(e).bytes.byteLength, t.delete(e);
-				}
-				t.set(i, n), r += n.bytes.byteLength;
-			}
-			return n;
-		}).finally(() => {
-			n.delete(i);
-		});
-		return n.set(i, c), c;
-	} };
-}, st = (e, t, n, r, i, a) => {
-	let o = n / r, s = Math.min(e, Math.round(t * o)), c = Math.min(t, Math.round(s / o)), l = (e, t) => Math.max(0, Math.min(t, e));
-	return {
-		left: l(Math.round(i * e - s / 2), e - s),
-		top: l(Math.round(a * t - c / 2), t - c),
-		width: s,
-		height: c
-	};
-}, ct = {
-	webp: "image/webp",
-	avif: "image/avif",
-	jpeg: "image/jpeg",
-	jpg: "image/jpeg",
-	png: "image/png"
-}, lt = (e) => {
-	if (!e) return null;
-	let t = new URLSearchParams(e), n = (e) => {
-		let n = t.get(e);
-		if (n == null) return;
-		let r = Number(n);
-		return Number.isFinite(r) && r > 0 ? Math.floor(r) : void 0;
-	}, r = n("w"), i = n("h"), a = n("q"), o = (t.get("format") ?? t.get("fm") ?? void 0)?.toLowerCase(), s = t.get("fit") ?? void 0, c = (t.get("fp") ?? "").split(",").map(Number), l = c.length === 2 && c.every((e) => Number.isFinite(e) && e >= 0 && e <= 1) ? {
-		x: c[0],
-		y: c[1]
-	} : void 0;
-	return r === void 0 && i === void 0 && !o && a === void 0 ? null : {
-		...r === void 0 ? {} : { w: r },
-		...i === void 0 ? {} : { h: i },
-		...o ? { format: o } : {},
-		...a === void 0 ? {} : { q: a },
-		...s ? { fit: s } : {},
-		...l ? { fp: l } : {}
-	};
-}, ut = (e) => e.startsWith("image/") && !e.includes("svg"), dt, ft = async () => (dt ??= import("sharp").then((e) => e.default ?? e, () => null), dt), pt = async (e, t) => t ? null : ut(e) ? await ft() === null ? "no-sharp" : "failed" : "not-an-image", mt = async (e, t, n) => {
-	if (!ut(t)) return null;
-	let r = await ft();
-	if (!r) return null;
-	try {
-		let i = r(Buffer.from(e), { failOn: "none" }), a = n.fit ?? "cover";
-		if (n.fp !== void 0 && n.w !== void 0 && n.h !== void 0 && a === "cover") {
-			let e = await i.metadata();
-			e.width !== void 0 && e.height !== void 0 && (i = i.extract(st(e.width, e.height, n.w, n.h, n.fp.x, n.fp.y)));
-		}
-		(n.w !== void 0 || n.h !== void 0) && (i = i.resize({
-			...n.w === void 0 ? {} : { width: n.w },
-			...n.h === void 0 ? {} : { height: n.h },
-			fit: n.fit ?? "cover",
-			withoutEnlargement: !0
-		}));
-		let o = n.format && ct[n.format] ? n.format : void 0, s = t;
-		if (o) {
-			let e = o === "jpg" ? "jpeg" : o;
-			i = i.toFormat(e, n.q === void 0 ? {} : { quality: n.q }), s = ct[o];
-		} else n.q !== void 0 && (t === "image/jpeg" || t === "image/webp") && (i = i.toFormat(t === "image/webp" ? "webp" : "jpeg", { quality: n.q }));
-		let c = await i.toBuffer();
-		return {
-			bytes: new Uint8Array(c),
-			contentType: s
-		};
-	} catch {
-		return null;
-	}
-}, ht = async (e, t, n) => {
-	if (!ut(t) || n.rotate === void 0 && n.flip !== !0 && n.flop !== !0 && n.grayscale !== !0 && n.crop === void 0) return null;
-	let r = await ft();
-	if (!r) return null;
-	try {
-		let i = r(Buffer.from(e), { failOn: "none" });
-		return n.crop !== void 0 && (i = i.extract(n.crop)), n.rotate !== void 0 && (i = i.rotate(n.rotate)), n.flip === !0 && (i = i.flip()), n.flop === !0 && (i = i.flop()), n.grayscale === !0 && (i = i.grayscale()), {
-			bytes: new Uint8Array(await i.toBuffer()),
-			contentType: t
-		};
-	} catch {
-		return null;
-	}
-}, gt = ot(), _t = (e, t, n) => JSON.stringify([
-	e,
-	t,
-	n.w,
-	n.h,
-	n.format,
-	n.q,
-	n.fit,
-	n.fp?.x,
-	n.fp?.y
-]), vt = async (e, t, n, r) => gt.getOrCreate(_t(e, n, r), () => mt(t, n, r)), yt = (e) => {
-	let t = we(16).toString("hex");
-	return `${t}:${Ee(e, t, 32).toString("hex")}`;
-}, bt = (e, t) => {
-	if (!e || !t) return !1;
-	let [n, r] = t.split(":");
-	if (!n || !r) return !1;
-	let i = Buffer.from(r, "hex"), a = Ee(e, n, i.length);
-	return a.length === i.length && L(a, i);
-}, xt = (e) => Array.isArray(e) ? e.filter((e) => typeof e == "string") : [], St = (e) => xt(e.metadata?.roles), Ct = (e) => xt(e.scopes), wt = (e, t) => e.some((e) => t.includes(e)), Tt = (e) => xt(e.metadata?.groups), Et = (e) => typeof e == "boolean" ? v.succeed(e) : v.isEffect(e) ? e : v.promise(() => e), Dt = (e, t, n = {}) => v.gen(function* () {
-	if (t.id && e.ownerId && t.id === e.ownerId) return !0;
-	let r = e.accessPolicy ?? [];
-	if (r.length === 0) return !1;
-	let i = n.resolveGroups ? yield* v.promise(async () => await n.resolveGroups(t)) : Tt(t);
-	for (let a of r) if (yield* Ot(a, e, t, i, n)) return !0;
-	return !1;
-}), Ot = (e, t, n, r, i) => v.gen(function* () {
-	let a = !1, o = (e) => (a = !0, e);
-	if (e.owner !== void 0 && e.owner && !o(!!n.id && !!t.ownerId && n.id === t.ownerId) || e.tenant !== void 0 && e.tenant && !o(!!n.tenantId && n.tenantId === t.tenantId) || e.apiKey !== void 0 && e.apiKey && !o(n.type === "apiKey") || e.roles && e.roles.length > 0 && !o(wt(St(n), e.roles)) || e.groups && e.groups.length > 0 && !o(wt(r, e.groups)) || e.scopes && e.scopes.length > 0 && !o(wt(Ct(n), e.scopes)) || e.password !== void 0 && e.password && !o(bt(i.password, t.passwordHash))) return !1;
-	if (e.guard) {
-		let r = i.guards?.[e.guard];
-		if (!o(r ? yield* Et(r({
-			subject: n,
-			ref: t
-		})) : !1)) return !1;
-	}
-	return a;
-}), kt = (e, t) => {
-	let n = [];
-	e.id && n.push({
-		type: e.type === "apiKey" ? "apiKey" : "user",
-		id: e.id
-	});
-	for (let e of t) n.push({
-		type: "group",
-		id: e
-	});
-	return n;
-}, At = (e, t, n, r, i) => {
-	let a = kt(t, n);
-	return e.some((e) => e.expiresAt && e.expiresAt.getTime() < i || r === "write" && e.permission !== "write" ? !1 : a.some((t) => t.type === e.principalType && t.id === e.principalId));
-}, jt = (e, t) => t.resolveGroups ? v.promise(async () => await t.resolveGroups(e)) : v.succeed(Tt(e)), q = () => U.read("VOLTRO_STORAGE_SECRET") ?? ce(), J = (e) => (typeof e == "string" ? Buffer.from(e, "utf8") : e).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, ""), Y = (e) => {
-	let t = e.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - e.length % 4) % 4);
-	return Buffer.from(t, "base64");
-}, Mt = (e, t, n = q(), r = "/_voltro/storage") => {
-	if (!n) throw Error("signGrant: secret must be a non-empty string");
-	let i = {
-		refId: e,
-		audience: r,
-		exp: Math.floor(Date.now() / 1e3) + Math.floor(t)
-	}, a = J(JSON.stringify(i));
-	return `${a}.${J(I("sha256", n).update(a).digest())}`;
-}, Nt = (e, t = q()) => {
-	if (!e || !t) return null;
-	let n = e.indexOf(".");
-	if (n <= 0 || n === e.length - 1) return null;
-	let r = e.slice(0, n), i = e.slice(n + 1), a = I("sha256", t).update(r).digest(), o = Y(i);
-	if (o.length !== a.length || !L(o, a)) return null;
-	try {
-		let e = JSON.parse(Y(r).toString("utf8"));
-		return typeof e.audience != "string" || !e.audience || typeof e.refId != "string" || typeof e.exp != "number" || e.exp < Math.floor(Date.now() / 1e3) ? null : e;
-	} catch {
-		return null;
-	}
-}, Pt = (e) => e.version === 1 ? e.access === void 0 || e.vis === "private" && y.isSuccess(S.decodeUnknownExit(ae, { onExcessProperty: "error" })(e.access)) : !1, Ft = (e, t, n = q()) => {
-	if (!n) throw Error("signUploadTicket: secret must be a non-empty string");
-	let r = {
-		...e,
-		version: 1,
-		exp: Math.floor(Date.now() / 1e3) + Math.floor(t)
-	}, i = J(JSON.stringify(r));
-	return `${i}.${J(I("sha256", n).update(`u:${i}`).digest())}`;
-}, It = (e, t = q()) => {
-	if (!e || !t) return null;
-	let n = e.indexOf(".");
-	if (n <= 0 || n === e.length - 1) return null;
-	let r = e.slice(0, n), i = e.slice(n + 1), a = I("sha256", t).update(`u:${r}`).digest(), o = Y(i);
-	if (o.length !== a.length || !L(o, a)) return null;
-	try {
-		let e = JSON.parse(Y(r).toString("utf8"));
-		return !Pt(e) || e.operationId !== void 0 && (typeof e.operationId != "string" || !e.operationId.trim() || e.operationId.length > 200) || typeof e.instance != "string" || !e.instance || typeof e.ct != "string" || typeof e.exp != "number" || e.vis !== "public" && e.vis !== "private" || e.replicaId !== void 0 && (typeof e.replicaId != "string" || !e.replicaId.trim()) || e.exp < Math.floor(Date.now() / 1e3) ? null : e;
-	} catch {
-		return null;
-	}
-}, Lt = (e, t, n = q()) => {
-	if (!n) throw Error("signFinalizeTicket: secret must be a non-empty string");
-	let r = {
-		...e,
-		version: 1,
-		exp: Math.floor(Date.now() / 1e3) + Math.floor(t)
-	}, i = J(JSON.stringify(r));
-	return `${i}.${J(I("sha256", n).update(`f:${i}`).digest())}`;
-}, Rt = (e, t = q()) => {
-	if (!e || !t) return null;
-	let n = e.indexOf(".");
-	if (n <= 0 || n === e.length - 1) return null;
-	let r = e.slice(0, n), i = e.slice(n + 1), a = I("sha256", t).update(`f:${r}`).digest(), o = Y(i);
-	if (o.length !== a.length || !L(o, a)) return null;
-	try {
-		let e = JSON.parse(Y(r).toString("utf8"));
-		return !Pt(e) || typeof e.key != "string" || e.key.length === 0 || typeof e.instance != "string" || !e.instance || typeof e.ct != "string" || typeof e.exp != "number" || e.vis !== "public" && e.vis !== "private" || e.exp < Math.floor(Date.now() / 1e3) ? null : e;
-	} catch {
-		return null;
-	}
-}, zt = (e, t, n = q()) => {
-	if (!n) throw Error("signResumableTicket: secret must be a non-empty string");
-	let r = {
-		...e,
-		version: 1,
-		exp: Math.floor(Date.now() / 1e3) + Math.floor(t)
-	}, i = J(JSON.stringify(r));
-	return `${i}.${J(I("sha256", n).update(`r:${i}`).digest())}`;
-}, Bt = (e, t = q()) => {
-	if (!e || !t) return null;
-	let n = e.indexOf(".");
-	if (n <= 0 || n === e.length - 1) return null;
-	let r = e.slice(0, n), i = e.slice(n + 1), a = I("sha256", t).update(`r:${r}`).digest(), o = Y(i);
-	if (o.length !== a.length || !L(o, a)) return null;
-	try {
-		let e = JSON.parse(Y(r).toString("utf8"));
-		return !Pt(e) || typeof e.id != "string" || e.id.length === 0 || typeof e.size != "number" || e.size < 0 || typeof e.instance != "string" || !e.instance || typeof e.ct != "string" || typeof e.exp != "number" || e.vis !== "public" && e.vis !== "private" || e.exp < Math.floor(Date.now() / 1e3) ? null : e;
-	} catch {
-		return null;
-	}
-}, Vt = (e, t, n = q()) => {
-	if (!n) throw Error("signMultipartTicket: secret must be a non-empty string");
-	let r = {
-		...e,
-		version: 1,
-		exp: Math.floor(Date.now() / 1e3) + Math.floor(t)
-	}, i = J(JSON.stringify(r));
-	return `${i}.${J(I("sha256", n).update(`m:${i}`).digest())}`;
-}, Ht = (e, t = q()) => {
-	if (!e || !t) return null;
-	let n = e.indexOf(".");
-	if (n <= 0 || n === e.length - 1) return null;
-	let r = e.slice(0, n), i = e.slice(n + 1), a = I("sha256", t).update(`m:${r}`).digest(), o = Y(i);
-	if (o.length !== a.length || !L(o, a)) return null;
-	try {
-		let e = JSON.parse(Y(r).toString("utf8"));
-		return !Pt(e) || typeof e.key != "string" || e.key.length === 0 || typeof e.uploadId != "string" || e.uploadId.length === 0 || typeof e.instance != "string" || !e.instance || typeof e.ct != "string" || typeof e.exp != "number" || e.vis !== "public" && e.vis !== "private" || e.exp < Math.floor(Date.now() / 1e3) ? null : e;
-	} catch {
-		return null;
-	}
-}, Ut = (e, t) => {
-	if (!t || t.length === 0) return !0;
-	let n = e.toLowerCase();
-	return t.some((e) => {
-		let t = e.toLowerCase();
-		return t.endsWith("/*") ? n.startsWith(t.slice(0, -1)) : n === t;
-	});
-}, Wt = [
-	{
-		ct: /^image\/png$/,
-		offset: 0,
-		magic: [
-			137,
-			80,
-			78,
-			71
-		]
-	},
-	{
-		ct: /^image\/jpe?g$/,
-		offset: 0,
-		magic: [
-			255,
-			216,
-			255
-		]
-	},
-	{
-		ct: /^image\/gif$/,
-		offset: 0,
-		magic: [
-			71,
-			73,
-			70,
-			56
-		]
-	},
-	{
-		ct: /^image\/webp$/,
-		offset: 0,
-		magic: [
-			82,
-			73,
-			70,
-			70
-		]
-	},
-	{
-		ct: /^image\/bmp$/,
-		offset: 0,
-		magic: [66, 77]
-	},
-	{
-		ct: /^application\/pdf$/,
-		offset: 0,
-		magic: [
-			37,
-			80,
-			68,
-			70
-		]
-	},
-	{
-		ct: /^application\/zip$/,
-		offset: 0,
-		magic: [
-			80,
-			75,
-			3,
-			4
-		]
-	},
-	{
-		ct: /^application\/gzip$/,
-		offset: 0,
-		magic: [31, 139]
-	}
-], Gt = (e, t) => {
-	let n = t.toLowerCase(), r = Wt.find((e) => e.ct.test(n));
-	return r ? e.length < r.offset + r.magic.length ? !1 : r.magic.every((t, n) => e[r.offset + n] === t) : !0;
-}, Kt = (e, t, n) => n ? n.maxBytes !== void 0 && e.byteLength > n.maxBytes ? {
-	reason: "too-large",
-	detail: `${e.byteLength} bytes exceeds the ${n.maxBytes}-byte limit`
-} : Ut(t, n.allowedContentTypes) ? n.sniff && !Gt(e, t) ? {
-	reason: "content-mismatch",
-	detail: `bytes do not match the declared content type '${t}'`
-} : null : {
-	reason: "content-type-not-allowed",
-	detail: `content type '${t}' is not in the allow-list`
-} : null, qt = async (e, t, n) => {
-	if (!ut(t)) return { bytes: e };
-	let r = await ft();
-	if (!r) return { bytes: e };
-	try {
-		let t = e;
-		if (n?.normalize) {
-			let n = await r(Buffer.from(e), { failOn: "none" }).rotate().toBuffer();
-			t = new Uint8Array(n);
-		}
-		let i = await r(Buffer.from(t), { failOn: "none" }).metadata(), a = await r(Buffer.from(t), { failOn: "none" }).resize({
-			width: 24,
-			height: 24,
-			fit: "inside",
-			withoutEnlargement: !0
-		}).webp({ quality: 40 }).toBuffer().catch(() => null);
-		return {
-			bytes: t,
-			...typeof i.width == "number" ? { width: i.width } : {},
-			...typeof i.height == "number" ? { height: i.height } : {},
-			...a ? { placeholder: `data:image/webp;base64,${a.toString("base64")}` } : {}
-		};
-	} catch {
-		return { bytes: e };
-	}
-}, Jt = 67108864, Yt = (e) => new n({
-	reason: "too-large",
-	detail: `remote body exceeds the ${e}-byte ingest limit`
-}), Xt = (e, t) => new n({
-	reason: "blocked-source",
-	detail: `will not fetch ${e}: ${t}`
-}), Zt = (e, r, i = {}) => v.suspend(() => {
-	let a = r ?? Jt;
-	return !Number.isSafeInteger(a) || a < 0 ? v.fail(new t({
-		provider: "ingest",
-		message: "limits.maxBytes must be a non-negative safe integer",
+	return t.length === 1 ? t[0].capabilities.storageProvider() : void 0;
+}, kt = (e) => {
+	let t = Ot(e);
+	return t === void 0 || Y.has(t) ? void 0 : t;
+}, Y = /* @__PURE__ */ new WeakSet(), At = (e) => {
+	if (Y.has(e) && process.env.NODE_ENV === "production") throw gt("storage: no provider is configured in this production process — `storagePlugin()` has no `provider` and STORAGE_PROVIDER is unset, so storage would fall back to process memory, which no other replica or later process can see. Set STORAGE_PROVIDER (s3 | minio | azure | filesystem | database) for every process that reaches storage, migrate jobs included, or pass `provider: 'memory'` to choose memory deliberately.");
+	return e;
+}, jt = (e) => {
+	let t = Ot(e);
+	if (t === void 0) throw new g({
+		provider: "storage",
+		message: "This app has no configured storage destination",
 		transient: !1
-	})) : v.tryPromise({
-		try: async (n) => {
-			let r = e, o;
-			for (let e = 0;; e++) {
-				let t = De(r, { ...i.allowHosts === void 0 ? {} : { allowHosts: i.allowHosts } });
-				if (t !== null) throw Xt(r, t);
-				o = await fetch(r, {
-					signal: n,
-					redirect: "manual"
-				});
-				let a = o.headers.get("location");
-				if (o.status < 300 || o.status >= 400 || a === null) break;
-				if (await o.body?.cancel().catch(() => {}), e >= (i.maxRedirects ?? 5)) throw Xt(r, "too many redirects");
-				r = new URL(a, r).toString();
-			}
-			let s;
-			try {
-				if (!o.ok) throw new t({
-					provider: "ingest",
-					message: `remote server returned HTTP ${o.status}`,
-					transient: o.status === 429 || o.status >= 500,
-					status: o.status
-				});
-				let e = o.headers.get("content-length"), n = o.headers.get("content-encoding")?.trim().toLowerCase();
-				if ((!n || n === "identity") && e !== null && /^\d+$/.test(e) && BigInt(e) > BigInt(a)) throw Yt(a);
-				let r = /* @__PURE__ */ new Uint8Array(), i = 0;
-				if (o.body !== null) for (s = o.body.getReader();;) {
-					let e = await s.read();
-					if (e.done) break;
-					if (e.value.byteLength > a - i) throw Yt(a);
-					if (e.value.byteLength !== 0) {
-						let t = i + e.value.byteLength;
-						if (t > r.byteLength) {
-							let e = Math.min(a, Math.max(65536, r.byteLength * 2, t)), n = new Uint8Array(e);
-							n.set(r), r = n;
-						}
-						r.set(e.value, i), i = t;
-					}
-				}
-				return {
-					bytes: i === r.byteLength ? r : r.slice(0, i),
-					contentType: o.headers.get("content-type")?.split(";")[0]?.trim() || "application/octet-stream"
-				};
-			} finally {
-				s === void 0 ? await o.body?.cancel().catch(() => {}) : (await s.cancel().catch(() => {}), s.releaseLock());
-			}
-		},
-		catch: (e) => e instanceof n || e instanceof t ? e : new t({
-			provider: "ingest",
-			message: "remote fetch or body read failed",
-			transient: !0
-		})
-	});
-}), Qt = (e, t) => v.suspend(() => {
-	if (t === void 0) return e;
-	if (t.aborted) return v.interrupt;
-	let n = v.callback((e) => {
-		let n = () => e(v.interrupt);
-		return t.addEventListener("abort", n, { once: !0 }), t.aborted && n(), v.sync(() => t.removeEventListener("abort", n));
 	});
-	return v.raceFirst(e, n);
-}), $t = (e) => {
-	let r = (e, n) => v.tryPromise({
-		try: n,
-		catch: (n) => {
-			let r = Ye(n);
-			if (r !== void 0) return r;
-			let i = G(n, "metadata"), a = new t({
-				provider: "metadata",
-				message: `Storage ${e} was not confirmed: ${i.message}; retain the operation identity for recovery`,
-				transient: i.transient,
-				...i.status === void 0 ? {} : { status: i.status }
-			});
-			return Object.defineProperty(a, "cause", {
-				value: n,
-				configurable: !0
-			}), a;
-		}
-	});
-	return {
-		put: (t) => v.gen(function* () {
-			if (t.bytes.byteLength !== t.ref.size || Ce("sha256").update(t.bytes).digest("hex") !== t.identity.checksum) return yield* v.fail(new n({
-				reason: "operation-content-mismatch",
-				detail: "Storage operation bytes do not match their reserved identity"
-			}));
-			let i = yield* r("put reservation", () => e.metadata.reserve(t.identity, t.ref, t.quota, t.claim)), a = i.outcome;
-			return i.ready ? {
-				ref: i.ref,
-				outcome: a
-			} : (yield* e.provider.put(i.ref.key, t.bytes, {
-				contentType: i.ref.contentType,
-				public: i.ref.visibility === "public"
-			}), {
-				ref: yield* r("put confirmation", () => e.metadata.confirm(t.identity, t.claim)),
-				outcome: a
-			});
-		}),
-		delete: (t, n, i) => v.gen(function* () {
-			let a = yield* r("delete acceptance", () => e.metadata.beginDelete(t, n, i));
-			"operation" in a && (a.operation.deleteKey !== null && (yield* e.provider.delete(a.operation.deleteKey)), yield* r("delete confirmation", () => e.metadata.confirmDelete(a.identity)));
-		})
-	};
-}, en = async (e) => {
-	let { createHash: t } = await import("node:crypto");
-	return t("sha256").update(e).digest("hex");
-}, tn = (e, t, n) => `${e?.replace(/\/+$/, "") ?? ""}${n}/${t}`, nn = (e) => {
-	let t = /* @__PURE__ */ new Map(), n = {
-		public: 0,
-		private: 0
-	};
-	for (let r of e) {
-		let e = r.tenantId ?? "(global)", i = t.get(e) ?? {
-			count: 0,
-			bytes: 0
-		};
-		i.count = Je(i.count, r.count, "ref count"), i.bytes = Je(i.bytes, r.bytes, "usage bytes"), t.set(e, i), r.visibility === "public" ? n.public = Je(n.public, r.count, "public ref count") : n.private = Je(n.private, r.count, "private ref count");
-	}
-	return {
-		byTenant: Object.fromEntries(t),
-		visibility: n
-	};
-}, rn = (e, t) => {
-	if (t.search && ![
-		e.id,
-		e.key,
-		e.contentType,
-		e.ownerId,
-		e.tenantId
-	].some((e) => e?.toLowerCase().includes(t.search.toLowerCase())) || t.tenantId !== void 0 && (e.tenantId ?? null) !== (t.tenantId ?? null) || t.ownerId !== void 0 && e.ownerId !== t.ownerId || !t.includeDerived && e.derivedFrom != null) return !1;
-	if (t.folder !== void 0) {
-		let n = t.folder.replace(/\/+$/, ""), r = (e.folder ?? "").replace(/\/+$/, "");
-		if (r !== n && !r.startsWith(`${n}/`)) return !1;
-	}
-	if (t.tags.length > 0) {
-		let n = e.tags ?? [];
-		if (!t.tags.every((e) => n.includes(e))) return !1;
-	}
-	return !0;
-}, an = (e) => e ?? "global", on = () => {
-	let e = /* @__PURE__ */ new Map(), t = /* @__PURE__ */ new Map();
-	return {
-		statistics: () => v.try({
-			try: () => nn((function* () {
-				for (let t of e.values()) yield {
-					tenantId: t.tenantId,
-					visibility: t.visibility,
-					count: 1,
-					bytes: t.size
-				};
-			})()),
-			catch: (e) => G(e, "refstore")
-		}),
-		insert: (t) => v.try({
-			try: () => {
-				W(t.size, "ref size"), e.set(t.id, t);
-			},
-			catch: (e) => G(e, "refstore")
-		}),
-		getById: (t) => v.sync(() => e.get(t) ?? null),
-		delete: (t) => v.sync(() => e.delete(t)),
-		listRecent: (t) => v.sync(() => [...e.values()].sort((e, t) => t.createdAt.getTime() - e.createdAt.getTime() || t.id.localeCompare(e.id)).slice(0, t)),
-		countByKey: (t, n) => v.sync(() => [...e.values()].filter((e) => e.bucket === t && e.key === n).length),
-		countPublicByKey: (t, n) => v.sync(() => [...e.values()].filter((e) => e.bucket === t && e.key === n && e.visibility === "public").length),
-		setVisibility: (t, n) => v.sync(() => {
-			let r = e.get(t);
-			if (r === void 0) return null;
-			let i = {
-				...r,
-				visibility: n
-			};
-			return e.set(t, i), i;
-		}),
-		usageByTenant: (t) => v.try({
-			try: () => {
-				let n = 0, r = 0;
-				for (let i of e.values()) (i.tenantId ?? null) === (t ?? null) && (n = Je(n, i.size, "usage bytes"), r++);
-				return {
-					bytes: n,
-					count: r
-				};
-			},
-			catch: (e) => G(e, "refstore")
-		}),
-		consumeUsage: (e, n, r) => v.try({
-			try: () => {
-				let i = an(e), a = t.get(i) ?? {
-					bytes: 0,
-					count: 0
-				};
-				W(n.bytes, "usage byte delta"), W(n.count, "usage count delta");
-				let o = Number.isSafeInteger(a.bytes + n.bytes) && Number.isSafeInteger(a.count + n.count) && (r?.maxBytes === void 0 || a.bytes + n.bytes <= r.maxBytes) && (r?.maxCount === void 0 || a.count + n.count <= r.maxCount);
-				return o && t.set(i, {
-					bytes: a.bytes + n.bytes,
-					count: a.count + n.count
-				}), {
-					allowed: o,
-					bytes: a.bytes,
-					count: a.count
-				};
-			},
-			catch: (e) => G(e, "refstore")
-		}),
-		releaseUsage: (e, n) => v.try({
-			try: () => {
-				let r = an(e), i = t.get(r);
-				W(n.bytes, "usage byte delta"), W(n.count, "usage count delta"), i && t.set(r, {
-					bytes: Math.max(0, i.bytes - n.bytes),
-					count: Math.max(0, i.count - n.count)
-				});
-			},
-			catch: (e) => G(e, "refstore")
-		}),
-		listByDerivedFrom: (t) => v.sync(() => [...e.values()].filter((e) => (e.derivedFrom ?? null) === t)),
-		listRefs: (t) => v.sync(() => [...e.values()].filter((e) => rn(e, t)).sort((e, t) => t.createdAt.getTime() - e.createdAt.getTime() || t.id.localeCompare(e.id)).slice(t.offset, t.offset + t.limit))
-	};
-}, sn = (e) => Array.isArray(e) && e.every((e) => typeof e == "string") ? e : null, X = (e) => ({
-	id: String(e.id),
-	tenantId: e.tenantId ?? null,
-	ownerId: e.ownerId ?? null,
-	bucket: String(e.bucket),
-	key: String(e.key),
-	contentType: String(e.contentType),
-	size: W(e.size, "ref size"),
-	checksum: String(e.checksum),
-	visibility: e.visibility === "public" ? "public" : "private",
-	accessPolicy: e.accessPolicy ?? null,
-	passwordHash: e.passwordHash ?? null,
-	createdAt: e.createdAt instanceof Date ? e.createdAt : new Date(String(e.createdAt)),
-	width: e.width ?? null,
-	height: e.height ?? null,
-	duration: e.duration ?? null,
-	placeholder: e.placeholder ?? null,
-	folder: e.folder ?? null,
-	tags: sn(e.tags),
-	alt: e.alt ?? null,
-	caption: e.caption ?? null,
-	derivedFrom: e.derivedFrom ?? null,
-	kind: e.kind ?? null
-}), Z = (e) => v.tryPromise({
-	try: e,
-	catch: (e) => G(e, "refstore", !0)
-}), cn = async (e, t) => (await e.query({
-	table: "_voltro_storage_usage",
-	predicate: {
-		column: "tenantId",
-		op: "eq",
-		value: t
-	},
-	order: [],
-	take: 1,
-	skip: void 0,
-	projection: void 0
-}))[0] ?? null, ln = (e) => ({
-	statistics: () => Z(async () => nn((await e.query({
-		table: B,
-		predicate: void 0,
-		order: [],
-		take: void 0,
-		skip: void 0,
-		projection: void 0,
-		groupBy: ["tenantId", "visibility"],
-		aggregations: [
-			de("tenantId"),
-			de("visibility"),
-			{
-				op: "count",
-				alias: "count"
-			},
-			{
-				op: "sum",
-				column: "size",
-				alias: "bytes"
-			}
-		]
-	})).map((e) => ({
-		tenantId: e.tenantId == null ? null : String(e.tenantId),
-		visibility: String(e.visibility),
-		count: W(e.count, "ref count"),
-		bytes: W(e.bytes ?? 0, "usage bytes")
-	})))),
-	insert: (t) => Z(() => e.insert(B, {
-		...t,
-		size: String(W(t.size, "ref size"))
-	})),
-	getById: (t) => Z(async () => {
-		let n = await e.query({
-			table: B,
-			predicate: {
-				column: "id",
-				op: "eq",
-				value: t
-			},
-			order: [],
-			take: 1,
-			skip: void 0,
-			projection: void 0
-		});
-		return n[0] ? X(n[0]) : null;
-	}),
-	delete: (t) => Z(() => e.delete(B, t)),
-	listRecent: (t) => Z(async () => (await e.query({
-		table: B,
-		predicate: void 0,
-		order: [{
-			column: "createdAt",
-			direction: "desc"
-		}],
-		take: t,
-		skip: void 0,
-		projection: void 0
-	})).map(X)),
-	countByKey: (t, n) => Z(async () => W((await e.query({
-		table: B,
-		predicate: { and: [{
-			column: "bucket",
-			op: "eq",
-			value: t
-		}, {
-			column: "key",
-			op: "eq",
-			value: n
-		}] },
-		order: [],
-		take: void 0,
-		skip: void 0,
-		projection: void 0,
-		aggregations: [{
-			op: "count",
-			alias: "count"
-		}]
-	}))[0]?.count ?? 0, "ref count")),
-	countPublicByKey: (t, n) => Z(async () => W((await e.query({
-		table: B,
-		predicate: { and: [
-			{
-				column: "bucket",
-				op: "eq",
-				value: t
-			},
-			{
-				column: "key",
-				op: "eq",
-				value: n
-			},
-			{
-				column: "visibility",
-				op: "eq",
-				value: "public"
-			}
-		] },
-		order: [],
-		take: void 0,
-		skip: void 0,
-		projection: void 0,
-		aggregations: [{
-			op: "count",
-			alias: "count"
-		}]
-	}))[0]?.count ?? 0, "ref count")),
-	setVisibility: (t, n) => Z(async () => {
-		let r = await e.update(B, t, { visibility: n });
-		return r ? X(r) : null;
-	}),
-	usageByTenant: (t) => Z(async () => {
-		let n = await e.query({
-			table: B,
-			predicate: {
-				column: "tenantId",
-				op: "eq",
-				value: t
-			},
-			order: [],
-			take: void 0,
-			skip: void 0,
-			projection: void 0,
-			aggregations: [
-				{
-					op: "count",
-					alias: "count"
-				},
-				{
-					op: "sum",
-					column: "size",
-					alias: "bytes"
-				},
-				{
-					op: "min",
-					column: "size",
-					alias: "minSize"
-				},
-				{
-					op: "max",
-					column: "size",
-					alias: "maxSize"
-				}
-			]
-		});
-		return W(n[0]?.count ?? 0, "ref count") > 0 && (W(n[0]?.minSize, "ref size"), W(n[0]?.maxSize, "ref size")), {
-			bytes: W(n[0]?.bytes ?? 0, "usage bytes"),
-			count: W(n[0]?.count ?? 0, "ref count")
-		};
-	}),
-	consumeUsage: (t, n, r) => Z(async () => {
-		let i = an(t);
-		W(n.bytes, "usage byte delta"), W(n.count, "usage count delta");
-		for (let t = 0; t < 32; t++) {
-			t > 0 && await new Promise((e) => setTimeout(e, t));
-			let a = await cn(e, i), o = a ? W(a.bytes, "usage bytes") : 0, s = a ? W(a.count, "ref count") : 0;
-			if (!(Number.isSafeInteger(o + n.bytes) && Number.isSafeInteger(s + n.count) && (r?.maxBytes === void 0 || o + n.bytes <= r.maxBytes) && (r?.maxCount === void 0 || s + n.count <= r.maxCount))) return {
-				allowed: !1,
-				bytes: o,
-				count: s
-			};
-			if (a) {
-				if (await e.updateMany("_voltro_storage_usage", {
-					bytes: String(o + n.bytes),
-					count: String(s + n.count),
-					updatedAt: /* @__PURE__ */ new Date()
-				}, { where: ue(k("id", String(a.id)), k("bytes", a.bytes), k("count", a.count)) }) === 1) return {
-					allowed: !0,
-					bytes: o,
-					count: s
-				};
-			} else {
-				let t = A({
-					kind: "typeid",
-					prefix: "susage"
-				}, Ue), r = await e.insertIgnore(Ue, {
-					id: t,
-					tenantId: i,
-					bytes: String(n.bytes),
-					count: String(n.count),
-					updatedAt: /* @__PURE__ */ new Date()
-				}, { conflictColumns: ["tenantId"] });
-				if (String(r.id) === t) return {
-					allowed: !0,
-					bytes: 0,
-					count: 0
-				};
-			}
-		}
-		throw T("Storage quota reservation contended after 32 attempts; retry");
-	}),
-	releaseUsage: (t, n) => Z(async () => {
-		let r = an(t);
-		W(n.bytes, "usage byte delta"), W(n.count, "usage count delta");
-		for (let t = 0; t < 32; t++) {
-			t > 0 && await new Promise((e) => setTimeout(e, t));
-			let i = await cn(e, r);
-			if (!i) return;
-			let a = W(i.bytes, "usage bytes"), o = W(i.count, "ref count");
-			if (await e.updateMany("_voltro_storage_usage", {
-				bytes: String(Math.max(0, a - n.bytes)),
-				count: String(Math.max(0, o - n.count)),
-				updatedAt: /* @__PURE__ */ new Date()
-			}, { where: ue(k("id", String(i.id)), k("bytes", i.bytes), k("count", i.count)) }) === 1) return;
-		}
-		throw T("Storage quota release contended after 32 attempts; retry");
-	}),
-	listByDerivedFrom: (t) => Z(async () => (await e.query({
-		table: B,
-		predicate: {
-			column: "derivedFrom",
-			op: "eq",
-			value: t
-		},
-		order: [{
-			column: "createdAt",
-			direction: "asc"
-		}],
-		take: void 0,
-		skip: void 0,
-		projection: void 0
-	})).map(X)),
-	listRefs: (t) => Z(async () => {
-		let n = [];
-		t.tenantId !== void 0 && n.push(k("tenantId", t.tenantId)), t.ownerId !== void 0 && n.push(k("ownerId", t.ownerId)), t.search && n.push(N(...[
-			"id",
-			"key",
-			"contentType",
-			"ownerId",
-			"tenantId"
-		].map((e) => fe(e, t.search)))), t.includeDerived || n.push(me("derivedFrom"));
-		let r = t.folder === void 0 && t.tags.length === 0, i = n.length ? ue(...n) : void 0, a = await e.query({
-			table: B,
-			predicate: i,
-			order: [{
-				column: "createdAt",
-				direction: "desc"
-			}, {
-				column: "id",
-				direction: "desc"
-			}],
-			take: r ? t.limit : void 0,
-			skip: r ? t.offset : void 0,
-			projection: void 0
-		});
-		return r ? a.map(X) : a.map(X).filter((e) => rn(e, t)).slice(t.offset, t.offset + t.limit);
-	})
-}), un = () => {
-	let e = /* @__PURE__ */ new Map();
-	return {
-		insert: (t) => v.sync(() => {
-			e.set(t.id, t);
-		}),
-		delete: (t) => v.sync(() => {
-			e.delete(t);
-		}),
-		getById: (t) => v.sync(() => e.get(t) ?? null),
-		listByRef: (t) => v.sync(() => [...e.values()].filter((e) => e.refId === t)),
-		deleteByRef: (t) => v.sync(() => {
-			for (let [n, r] of e) r.refId === t && e.delete(n);
-		})
-	};
-}, dn = (e) => ({
-	id: String(e.id),
-	refId: String(e.refId),
-	principalType: e.principalType,
-	principalId: String(e.principalId),
-	permission: e.permission === "write" ? "write" : "read",
-	createdAt: e.createdAt instanceof Date ? e.createdAt : new Date(String(e.createdAt)),
-	expiresAt: e.expiresAt ? e.expiresAt instanceof Date ? e.expiresAt : new Date(String(e.expiresAt)) : null,
-	createdBy: e.createdBy ?? null
-}), fn = (e) => ({
-	insert: (t) => Z(() => e.insert(V, { ...t })),
-	delete: (t) => Z(() => e.delete(V, t)),
-	getById: (t) => Z(async () => {
-		let n = (await e.query({
-			table: V,
-			predicate: {
-				column: "id",
-				op: "eq",
-				value: t
-			},
-			order: [],
-			take: 1,
-			skip: void 0,
-			projection: void 0
-		}))[0];
-		return n ? dn(n) : null;
-	}),
-	listByRef: (t) => Z(async () => (await e.query({
-		table: V,
-		predicate: {
-			column: "refId",
-			op: "eq",
-			value: t
-		},
-		order: [{
-			column: "createdAt",
-			direction: "desc"
-		}],
-		take: void 0,
-		skip: void 0,
-		projection: void 0
-	})).map(dn)),
-	deleteByRef: (t) => Z(async () => {
-		let n = await e.query({
-			table: V,
-			predicate: {
-				column: "refId",
-				op: "eq",
-				value: t
-			},
-			order: [],
-			take: void 0,
-			skip: void 0,
-			projection: void 0
-		});
-		for (let t of n) await e.delete(V, String(t.id));
-	})
-}), pn = () => A({
-	kind: "typeid",
-	prefix: "file"
-}, B), mn = () => A({
-	kind: "typeid",
-	prefix: "grant"
-}, V), hn = (i) => {
-	let { provider: a, refStore: o, grantStore: s, bucket: c } = i, l = i.access ?? {}, u = i.attempts ?? 3, d = i.urlExpiresInSec ?? 3600, f = (e) => tn(i.publicBaseUrl, e, i.httpPath ?? "/_voltro/storage"), p = x.max([x.recurs(Math.max(0, u - 1)), x.exponential("100 millis")]).pipe(x.while(({ input: e }) => e.transient)), m = (e, t, n) => [
-		i.tenantPrefix,
-		e ?? "global",
-		n ?? t
-	].filter(Boolean).join("/"), ee = (e) => {
-		if (e === void 0) return v.succeed(void 0);
-		let n = e.length === 0 ? "empty" : e.includes("\0") ? "contains NUL" : e.startsWith("/") || e.startsWith("\\") ? "starts with a path separator" : e.includes("\\") ? "contains a backslash" : e.split("/").some((e) => e === "" || e === "." || e === "..") ? "contains an empty, \".\" or \"..\" segment" : void 0;
-		return n === void 0 ? v.succeed(e) : v.fail(new t({
-			provider: a.name,
-			message: `storage key rejected: ${n}`,
-			transient: !1,
-			status: 400
-		}));
-	}, te = (e, t, n) => [
-		i.tenantPrefix,
-		e ?? "global",
-		"_incoming",
-		t,
-		String(n).padStart(6, "0")
-	].filter(Boolean).join("/"), ne = (e, t) => t === void 0 || e.tenantId === t, h = (e, n) => ne(e, n) ? v.succeed(e) : v.fail(new t({
-		provider: a.name,
-		message: "cross-tenant access denied",
-		transient: !1,
-		status: 403
-	})), g = (e, n, r) => v.gen(function* () {
-		let o = i.objects?.(), s = (e) => new t({
-			provider: "metadata",
-			message: e,
-			transient: !1,
-			status: 409
-		});
-		if (o === void 0) return r === void 0 ? !1 : yield* v.fail(s(`claim '${r}' cannot be released: no data store is bound, so ref '${e}' holds no claims`));
-		let c = yield* v.tryPromise({
-			try: () => o.intent(e),
-			catch: (e) => new t({
-				provider: "metadata",
-				message: String(e?.message ?? e),
-				transient: !1
-			})
-		});
-		return c === void 0 ? r === void 0 ? !1 : yield* v.fail(s(`claim '${r}' cannot be released: ref '${e}' was not written through an operation and holds no claims`)) : (yield* h(c.ref, n), yield* $t({
-			metadata: o,
-			provider: {
-				...a,
-				delete: (e) => a.delete(e).pipe(v.retry(p))
-			}
-		}).delete(e, n, r).pipe(v.catchTag("StorageRejected", (e) => v.fail(e.reason === "claim-not-held" ? s(e.detail) : new t({
-			provider: "metadata",
-			message: e.detail,
-			transient: !1
-		})))), !0);
-	}), _ = (e, n) => o.getById(e).pipe(v.flatMap((r) => r ? h(r, n) : v.fail(new t({
-		provider: a.name,
-		message: `no ref '${e}'`,
-		transient: !1,
-		status: 404
-	})))), re = (e) => v.suspend(() => {
-		let n = i.scan(e);
-		return v.isEffect(n) ? n : v.tryPromise({
-			try: () => Promise.resolve(n),
-			catch: (e) => new t({
-				provider: "scan",
-				message: String(e?.message ?? e),
-				transient: !0
-			})
-		});
-	}), ie = (e) => v.suspend(() => {
-		let t = e.contentType;
-		if (!i.videoProbe || !(t.startsWith("video/") || t.startsWith("audio/"))) return v.succeed(null);
-		let n;
-		try {
-			n = i.videoProbe(e);
-		} catch {
-			return v.succeed(null);
-		}
-		return v.isEffect(n) ? n.pipe(v.catch(() => v.succeed(null))) : v.tryPromise({
-			try: () => Promise.resolve(n),
-			catch: () => null
-		}).pipe(v.catch(() => v.succeed(null)));
-	}), b = (e) => v.gen(function* () {
-		let t = Kt(e.bytes, e.contentType, i.limits);
-		if (t) return yield* v.fail(new n(t));
-		if (e.claim !== void 0 && e.operationId === void 0) return yield* v.fail(new n({
-			reason: "claim-without-operation",
-			detail: "a put with a claim needs an operationId; the claim names this caller's hold on that operation's object"
-		}));
-		if (i.scan) {
-			let t = yield* re({
-				bytes: e.bytes,
-				contentType: e.contentType,
-				...e.key ? { key: e.key } : {}
-			});
-			if (!t.clean) return yield* v.fail(new r({ threat: t.threat ?? "unknown" }));
-		}
-		let s = yield* v.promise(() => qt(e.bytes, e.contentType, { normalize: i.normalizeImages ?? !1 })), l = s.bytes, u = yield* ie({
-			bytes: l,
-			contentType: e.contentType
-		}), d = s.width ?? u?.width, f = s.height ?? u?.height, te = s.placeholder ?? u?.poster, ne = e.duration ?? u?.duration, h = yield* v.promise(() => en(l)), g = e.tenantId ?? null, _ = e.visibility ?? "private", b = m(g, h, yield* ee(e.key)), x = e.password ? yield* v.sync(() => yt(e.password)) : null, S = {
-			id: pn(),
-			tenantId: g,
-			ownerId: e.ownerId ?? null,
-			bucket: c,
-			key: b,
-			contentType: e.contentType,
-			size: l.byteLength,
-			checksum: h,
-			visibility: _,
-			accessPolicy: e.access ?? null,
-			passwordHash: x,
-			createdAt: /* @__PURE__ */ new Date(),
-			...d === void 0 ? {} : { width: d },
-			...f === void 0 ? {} : { height: f },
-			...te === void 0 ? {} : { placeholder: te },
-			...ne === void 0 ? {} : { duration: ne },
-			...e.folder === void 0 ? {} : { folder: e.folder },
-			...e.tags === void 0 ? {} : { tags: e.tags },
-			...e.alt === void 0 ? {} : { alt: e.alt },
-			...e.caption === void 0 ? {} : { caption: e.caption },
-			...e.derivedFrom === void 0 ? {} : { derivedFrom: e.derivedFrom },
-			...e.kind === void 0 ? {} : { kind: e.kind }
-		}, C = i.transcode !== void 0 && i.autoTranscode !== !1, oe = (t) => C && t.derivedFrom == null && (e.contentType.startsWith("video/") || e.contentType.startsWith("audio/")) ? v.forkDetach(ae(t).pipe(v.ignore)) : v.void;
-		if (e.operationId !== void 0) {
-			let t = i.objects?.();
-			if (t === void 0) return yield* v.fail(new n({
-				reason: "operation-store-unbound",
-				detail: "a put with an operationId needs a bound data store; the in-memory ref store cannot hold operation intents"
-			}));
-			let r = {
-				tenantId: g,
-				bucket: c,
-				operationId: e.operationId,
-				checksum: h,
-				logicalKey: b,
-				fingerprint: yield* v.promise(() => en(new TextEncoder().encode(JSON.stringify([
-					h,
-					e.contentType,
-					_,
-					e.access ?? null,
-					e.key ?? null,
-					e.ownerId ?? null,
-					e.folder ?? null,
-					e.tags ?? null,
-					e.alt ?? null,
-					e.caption ?? null,
-					e.derivedFrom ?? null,
-					e.kind ?? null,
-					ne ?? null,
-					e.password !== void 0
-				]))))
-			}, o = yield* $t({
-				metadata: t,
-				provider: {
-					...a,
-					put: (e, t, n) => a.put(e, t, n).pipe(v.retry(p))
-				}
-			}).put({
-				identity: r,
-				ref: S,
-				bytes: l,
-				...i.quota === void 0 ? {} : { quota: i.quota },
-				...e.claim === void 0 ? {} : { claim: e.claim }
-			});
-			return yield* oe(o.ref), {
-				...o.ref,
-				outcome: o.outcome
-			};
-		}
-		let w = {
-			bytes: l.byteLength,
-			count: 1
-		}, se = yield* o.consumeUsage(g, w, i.quota);
-		if (!se.allowed) {
-			let e = i.quota ?? {}, t = e.maxCount !== void 0 && se.count + 1 > e.maxCount ? `tenant object count ${se.count} + 1 exceeds max ${e.maxCount}` : `tenant usage ${se.bytes} + ${l.byteLength} bytes exceeds max ${e.maxBytes}`;
-			return yield* v.fail(new n({
-				reason: "quota-exceeded",
-				detail: t
-			}));
-		}
-		return yield* ((e) => e.pipe(v.onExit((e) => y.isSuccess(e) ? v.void : o.delete(S.id).pipe(v.andThen(o.releaseUsage(g, w)), v.ignore))))(o.insert(S).pipe(v.andThen(a.put(b, l, {
-			contentType: e.contentType,
-			public: _ === "public"
-		}).pipe(v.retry(p))))), yield* oe(S), {
-			...S,
-			outcome: "created"
-		};
-	}), S = (e) => v.suspend(() => {
-		if (!i.transcode) return v.succeed([]);
-		let t;
-		try {
-			t = i.transcode(e);
-		} catch {
-			return v.succeed([]);
-		}
-		return v.isEffect(t) ? t.pipe(v.catch(() => v.succeed([]))) : v.tryPromise({
-			try: () => Promise.resolve(t),
-			catch: () => []
-		}).pipe(v.catch(() => v.succeed([])));
-	}), ae = (e) => v.gen(function* () {
-		if (!i.transcode || e.derivedFrom != null) return [];
-		let t = yield* a.get(e.key).pipe(v.retry(p)), n = yield* S({
-			bytes: t.bytes,
-			contentType: e.contentType,
-			ref: e
-		}), r = [];
-		for (let t of n) {
-			let n = yield* b({
-				bytes: t.bytes,
-				contentType: t.contentType,
-				tenantId: e.tenantId,
-				ownerId: e.ownerId,
-				visibility: e.visibility,
-				derivedFrom: e.id,
-				kind: t.kind,
-				...t.label === void 0 ? {} : { caption: t.label }
-			});
-			r.push(n);
-		}
-		return r;
-	}), oe = (e, t, n) => v.gen(function* () {
-		if (e.derivedFrom != null) {
-			let r = yield* o.getById(e.derivedFrom);
-			return r === null ? !1 : yield* oe(r, t, n);
-		}
-		if (e.visibility === "public") return !0;
-		if (e.tenantId !== null && !ne(e, t.tenantId ?? null)) return !1;
-		if (yield* Dt(e, t, {
-			...l,
-			...n?.password === void 0 ? {} : { password: n.password }
-		})) return !0;
-		let r = yield* jt(t, l);
-		return At(yield* s.listByRef(e.id), t, r, n?.permission ?? "read", Date.now());
-	}), w = (e) => {
-		if (e.visibility === "public") {
-			let t = a.publicUrl?.(e.key);
-			if (t != null) return t;
-		}
-		return f(e.id);
-	};
-	return {
-		put: b,
-		get: (e, t) => _(e, t?.tenantId).pipe(v.flatMap((e) => a.get(e.key).pipe(v.retry(p), v.map((t) => ({
-			bytes: t.bytes,
-			ref: e
-		}))))),
-		getStream: (e, t) => _(e, t?.tenantId).pipe(v.map((e) => ({
-			ref: e,
-			stream: C.unwrap(v.suspend(() => a.getStream ? a.getStream(e.key).pipe(v.retry(p), v.map((e) => e.stream)) : a.get(e.key).pipe(v.retry(p), v.map((e) => C.make(e.bytes)))))
-		}))),
-		getRange: (e, n, r) => _(e, r?.tenantId).pipe(v.flatMap((e) => {
-			let r = e.size, i = Math.max(0, Math.trunc(n.start));
-			if (r > 0 && i >= r) return v.fail(new t({
-				provider: a.name,
-				message: `range start ${i} past end ${r}`,
-				transient: !1,
-				status: 416
-			}));
-			let o = Math.min(Math.trunc(n.endInclusive), Math.max(0, r - 1));
-			return o < i ? v.fail(new t({
-				provider: a.name,
-				message: `empty range ${i}-${o}`,
-				transient: !1,
-				status: 416
-			})) : (a.getRange ? a.getRange(e.key, i, o).pipe(v.retry(p)) : a.get(e.key).pipe(v.retry(p), v.map((e) => e.bytes.subarray(i, o + 1)))).pipe(v.map((t) => ({
-				bytes: t,
-				ref: e,
-				totalSize: r
-			})));
-		})),
-		getUrl: (e, t) => _(e, t?.tenantId).pipe(v.flatMap((e) => e.visibility === "public" ? v.succeed(w(e)) : a.presigns ? a.getUrl(e.key, t?.expiresInSec ?? d) : v.succeed(f(e.id)))),
-		head: (e, t) => o.getById(e).pipe(v.flatMap((e) => e ? h(e, t?.tenantId).pipe(v.map((e) => e)) : v.succeed(null))),
-		delete: (e, t) => g(e, t?.tenantId, t?.claim).pipe(v.flatMap((n) => n ? v.void : _(e, t?.tenantId).pipe(v.flatMap((t) => s.deleteByRef(e).pipe(v.flatMap(() => o.delete(e)), v.flatMap((e) => e ? o.countByKey(t.bucket, t.key).pipe(v.flatMap((e) => e === 0 ? a.delete(t.key).pipe(v.retry(p)) : v.void), v.flatMap(() => o.releaseUsage(t.tenantId, {
-			bytes: t.size,
-			count: 1
-		}))) : v.void), v.asVoid))))),
-		signedUrl: (e, t) => _(e, t?.tenantId).pipe(v.flatMap((e) => {
-			if (e.visibility === "public") return v.succeed(w(e));
-			let n = t?.expiresInSec ?? d;
-			return a.presigns ? a.getUrl(e.key, n) : v.sync(() => `${f(e.id)}?t=${Mt(e.id, n, void 0, i.httpPath ?? "/_voltro/storage")}`);
-		})),
-		setVisibility: (e, r, i) => v.gen(function* () {
-			let s = yield* _(e, i?.tenantId);
-			if (s.visibility === r) return s;
-			let c = o.setVisibility;
-			if (c === void 0) return yield* v.fail(new n({
-				reason: "visibility-unsupported",
-				detail: "the ref store cannot change a stored object's visibility"
-			}));
-			if (r === "private" && a.publicUrl?.(s.key) != null) return yield* v.fail(new n({
-				reason: "visibility-unsupported",
-				detail: `objects are served from a public base (${a.name} cdnBaseUrl); a public object cannot be made private there`
-			}));
-			if (r === "private" && a.setObjectPublic !== void 0 && o.countPublicByKey === void 0) return yield* v.fail(new n({
-				reason: "visibility-unsupported",
-				detail: "the ref store cannot tell whether other refs keep these bytes public"
-			}));
-			let l = yield* c(s.id, r);
-			if (l === null) return yield* v.fail(new t({
-				provider: a.name,
-				message: `no ref '${e}'`,
-				transient: !1,
-				status: 404
-			}));
-			let u = s.derivedFrom == null ? yield* o.listByDerivedFrom(s.id) : [];
-			for (let e of u) e.visibility !== r && (yield* c(e.id, r));
-			if (a.setObjectPublic !== void 0) {
-				let e = o.countPublicByKey;
-				for (let t of [s, ...u]) {
-					let n = r === "public" || e !== void 0 && (yield* e(t.bucket, t.key)) > 0;
-					yield* a.setObjectPublic(t.key, n);
-				}
-			}
-			return l;
-		}),
-		mintUrl: (n, r, s) => v.gen(function* () {
-			let c = yield* o.getById(n).pipe(v.flatMap((e) => e ? v.succeed(e) : v.fail(new t({
-				provider: a.name,
-				message: `no ref '${n}'`,
-				transient: !1,
-				status: 404
-			}))));
-			if (c.visibility === "public" && c.derivedFrom == null) return w(c);
-			if (!(yield* oe(c, r, s?.password === void 0 ? {} : { password: s.password }))) return yield* v.fail(new e({
-				refId: n,
-				reason: "access denied"
-			}));
-			let l = s?.expiresInSec ?? d;
-			if (a.presigns) return yield* a.getUrl(c.key, l);
-			let u = yield* v.sync(() => Mt(c.id, l, void 0, i.httpPath ?? "/_voltro/storage"));
-			return `${f(c.id)}?t=${u}`;
-		}),
-		mintUploadUrl: (e) => v.gen(function* () {
-			if (!a.getUploadUrl) return yield* v.fail(new t({
-				provider: a.name,
-				message: `provider '${a.name}' does not support presigned uploads`,
-				transient: !1,
-				status: 400
-			}));
-			let n = m(e.tenantId ?? null, "", yield* ee(e.key));
-			return yield* a.getUploadUrl(n, e.expiresInSec ?? d, e.contentType);
-		}),
-		checkAccess: oe,
-		grant: (e) => v.gen(function* () {
-			let t = {
-				id: mn(),
-				refId: e.refId,
-				principalType: e.principalType,
-				principalId: e.principalId,
-				permission: e.permission ?? "read",
-				createdAt: /* @__PURE__ */ new Date(),
-				expiresAt: e.expiresAt ?? null,
-				createdBy: e.createdBy ?? null
-			};
-			return yield* s.insert(t), t;
-		}),
-		listRefs: (e) => v.suspend(() => {
-			let t = Math.min(500, Math.max(1, Math.trunc(e?.limit ?? 50))), n = Math.max(0, Math.trunc(e?.offset ?? 0)), r = {
-				tenantId: e && "tenantId" in e ? e.tenantId : void 0,
-				folder: e?.folder,
-				tags: e?.tags ?? [],
-				ownerId: e?.ownerId,
-				includeDerived: e?.includeDerived ?? !1,
-				limit: t + 1,
-				offset: n
-			};
-			return o.listRefs(r).pipe(v.map((e) => {
-				let r = e.length > t;
-				return {
-					refs: r ? e.slice(0, t) : e,
-					nextOffset: r ? n + t : null
-				};
-			}));
-		}),
-		revoke: (e) => s.delete(e),
-		getGrant: (e) => s.getById(e),
-		listGrants: (e) => s.listByRef(e),
-		usage: (e) => o.usageByTenant(e),
-		sweepOrphans: (e) => v.gen(function* () {
-			let t = e?.limit ?? 1e3, n = e?.dryRun ?? !1, r = yield* o.listRecent(t), i = [];
-			for (let e of r) if ((yield* a.head(e.key)) === null) {
-				if (!n) {
-					if (!(yield* o.delete(e.id))) continue;
-					yield* o.releaseUsage(e.tenantId, {
-						bytes: e.size,
-						count: 1
-					});
-				}
-				i.push(e.id);
-			}
-			return {
-				scanned: r.length,
-				removed: i
-			};
-		}),
-		ingestUrl: (e, t) => Qt(v.gen(function* () {
-			let n = yield* Zt(e, i.limits?.maxBytes, i.ingest);
-			return yield* b({
-				bytes: n.bytes,
-				contentType: t?.contentType ?? n.contentType,
-				...t?.tenantId === void 0 ? {} : { tenantId: t.tenantId },
-				...t?.operationId === void 0 ? {} : { operationId: t.operationId },
-				...t?.ownerId === void 0 ? {} : { ownerId: t.ownerId },
-				...t?.visibility === void 0 ? {} : { visibility: t.visibility },
-				...t?.access === void 0 ? {} : { access: t.access },
-				...t?.key === void 0 ? {} : { key: t.key },
-				...t?.folder === void 0 ? {} : { folder: t.folder },
-				...t?.tags === void 0 ? {} : { tags: t.tags },
-				...t?.alt === void 0 ? {} : { alt: t.alt },
-				...t?.caption === void 0 ? {} : { caption: t.caption }
-			});
-		}), t?.abortSignal),
-		mintPresignedUpload: (e) => v.gen(function* () {
-			if (!a.getUploadUrl) return yield* v.fail(new t({
-				provider: a.name,
-				message: `provider '${a.name}' does not support presigned uploads`,
-				transient: !1,
-				status: 400
-			}));
-			let n = e.expiresInSec ?? d, r = `_incoming/${A({
-				kind: "typeid",
-				prefix: "up"
-			}, B)}`, i = m(e.tenantId ?? null, "", r);
-			return {
-				uploadUrl: yield* a.getUploadUrl(i, n, e.contentType),
-				key: i,
-				expiresInSec: n
-			};
-		}),
-		finalizeUpload: (e) => a.get(e.key).pipe(v.retry(p), v.flatMap((t) => b({
-			bytes: t.bytes,
-			contentType: e.contentType,
-			...e.tenantId === void 0 ? {} : { tenantId: e.tenantId },
-			...e.ownerId === void 0 ? {} : { ownerId: e.ownerId },
-			...e.visibility === void 0 ? {} : { visibility: e.visibility },
-			...e.access === void 0 ? {} : { access: e.access },
-			...e.folder === void 0 ? {} : { folder: e.folder },
-			...e.tags === void 0 ? {} : { tags: e.tags },
-			...e.alt === void 0 ? {} : { alt: e.alt },
-			...e.caption === void 0 ? {} : { caption: e.caption }
-		})), v.ensuring(a.delete(e.key).pipe(v.retry(p), v.ignore))),
-		putResumableChunk: (e) => a.put(te(e.tenantId ?? null, e.uploadId, e.index), e.bytes, { contentType: "application/octet-stream" }).pipe(v.retry(p), v.asVoid),
-		resumableStatus: (e) => v.gen(function* () {
-			let t = 0, n = 0;
-			for (; t < 1e6;) {
-				let r = yield* a.head(te(e.tenantId ?? null, e.uploadId, t)).pipe(v.retry(p), v.catch(() => v.succeed(null)));
-				if (r === null) break;
-				n += r.size, t += 1;
-			}
-			return {
-				offset: n,
-				nextIndex: t
-			};
-		}),
-		finalizeResumable: (e) => v.gen(function* () {
-			let r = i.limits?.maxBytes ?? 2 ** 53 - 1;
-			if (!Number.isSafeInteger(r) || r < 0 || !Number.isSafeInteger(e.count) || e.count < 0) return yield* v.fail(new t({
-				provider: a.name,
-				message: "resumable count and limits.maxBytes must be non-negative safe integers",
-				transient: !1,
-				status: 400
-			}));
-			let o = (t) => te(e.tenantId ?? null, e.uploadId, t), s = v.gen(function* () {
-				for (let t = 0; t < e.count; t++) yield* a.delete(o(t)).pipe(v.retry(p), v.ignore);
-			}), c = () => new n({
-				reason: "too-large",
-				detail: `resumable upload exceeds ${r}-byte limit`
-			}), l = yield* v.gen(function* () {
-				let n = 0;
-				for (let i = 0; i < e.count; i++) {
-					let e = yield* a.head(o(i)).pipe(v.retry(p));
-					if (e === null) return yield* v.fail(new t({
-						provider: a.name,
-						message: `no resumable chunk at '${o(i)}'`,
-						transient: !1,
-						status: 404
-					}));
-					if (!Number.isSafeInteger(e.size) || e.size < 0) return yield* v.fail(new t({
-						provider: a.name,
-						message: "resumable chunk metadata has an invalid size",
-						transient: !1
-					}));
-					if (e.size > r - n) return yield* v.fail(c());
-					n += e.size;
-				}
-				let i = /* @__PURE__ */ new Uint8Array(), s = 0;
-				for (let t = 0; t < e.count; t++) {
-					let e = yield* Ve(a, o(t)).pipe(v.retry(p));
-					yield* C.runForEach(e.stream, (e) => v.gen(function* () {
-						if (e.byteLength > r - s) return yield* v.fail(c());
-						let t = s + e.byteLength;
-						if (t > i.byteLength) {
-							let e = new Uint8Array(Math.min(r, Math.max(65536, i.byteLength * 2, t)));
-							e.set(i.subarray(0, s)), i = e;
-						}
-						i.set(e, s), s = t;
-					}));
-				}
-				return i.subarray(0, s);
-			}).pipe(v.tapError((e) => e._tag === "StorageRejected" ? s : v.void));
-			return yield* b({
-				bytes: l,
-				contentType: e.contentType,
-				...e.tenantId === void 0 ? {} : { tenantId: e.tenantId },
-				...e.ownerId === void 0 ? {} : { ownerId: e.ownerId },
-				...e.visibility === void 0 ? {} : { visibility: e.visibility },
-				...e.access === void 0 ? {} : { access: e.access },
-				...e.folder === void 0 ? {} : { folder: e.folder },
-				...e.tags === void 0 ? {} : { tags: e.tags },
-				...e.alt === void 0 ? {} : { alt: e.alt },
-				...e.caption === void 0 ? {} : { caption: e.caption }
-			}).pipe(v.ensuring(s));
-		}),
-		transcode: (e, t) => _(e, t?.tenantId).pipe(v.flatMap((e) => ae(e))),
-		renditions: (e, t) => _(e, t?.tenantId).pipe(v.flatMap(() => o.listByDerivedFrom(e))),
-		beginMultipartUpload: (e) => v.gen(function* () {
-			if (!a.createMultipartUpload || !a.presignUploadPart || !a.completeMultipartUpload) return yield* v.fail(new t({
-				provider: a.name,
-				message: `provider '${a.name}' does not support multipart uploads`,
-				transient: !1,
-				status: 400
-			}));
-			let n = m(e.tenantId ?? null, "", `multipart/${A({
-				kind: "typeid",
-				prefix: "mp"
-			}, B)}`);
-			return {
-				uploadId: (yield* a.createMultipartUpload(n, e.contentType, { public: (e.visibility ?? "private") === "public" })).uploadId,
-				key: n
-			};
-		}),
-		signMultipartPart: (e) => v.suspend(() => a.presignUploadPart ? a.presignUploadPart(e.key, e.uploadId, e.partNumber, e.expiresInSec ?? d) : v.fail(new t({
-			provider: a.name,
-			message: "provider does not support multipart uploads",
-			transient: !1,
-			status: 400
-		}))),
-		completeMultipart: (e) => v.gen(function* () {
-			if (!a.completeMultipartUpload) return yield* v.fail(new t({
-				provider: a.name,
-				message: "provider does not support multipart uploads",
-				transient: !1,
-				status: 400
-			}));
-			let r = yield* a.completeMultipartUpload(e.key, e.uploadId, e.parts), s = yield* a.head(e.key).pipe(v.retry(p)), l = s?.size ?? 0, u = (r.etag ?? s?.etag ?? "").replace(/"/g, ""), d = e.tenantId ?? null, f = {
-				bytes: l,
-				count: 1
-			};
-			if (!(yield* o.consumeUsage(d, f, i.quota)).allowed) return yield* a.delete(e.key).pipe(v.retry(p), v.ignore), yield* v.fail(new n({
-				reason: "quota-exceeded",
-				detail: `multipart upload of ${l} bytes exceeds tenant quota`
-			}));
-			let m = {
-				id: pn(),
-				tenantId: e.tenantId ?? null,
-				ownerId: e.ownerId ?? null,
-				bucket: c,
-				key: e.key,
-				contentType: e.contentType,
-				size: l,
-				checksum: u,
-				visibility: e.visibility ?? "private",
-				accessPolicy: e.access ?? null,
-				passwordHash: null,
-				createdAt: /* @__PURE__ */ new Date(),
-				...e.folder === void 0 ? {} : { folder: e.folder },
-				...e.tags === void 0 ? {} : { tags: e.tags },
-				...e.alt === void 0 ? {} : { alt: e.alt },
-				...e.caption === void 0 ? {} : { caption: e.caption }
-			};
-			return yield* o.insert(m).pipe(v.onExit((e) => y.isSuccess(e) ? v.void : o.releaseUsage(d, f).pipe(v.ignore))), m;
-		}),
-		abortMultipart: (e) => v.suspend(() => a.abortMultipartUpload ? a.abortMultipartUpload(e.key, e.uploadId).pipe(v.retry(p)) : v.void)
-	};
-}, gn = (e) => b.succeed(i, hn(e)), _n = "_voltro_storage_operation_locks", Q = "_voltro_storage_object_heads", vn = "_voltro_storage_operations", yn = "_voltro_storage_object_claims", bn = [
-	P(_n, {
-		id: F().maxLength(64),
-		nonce: F()
-	}).primaryKey(["id"]).nonReactive(),
-	P(Q, {
-		id: F().maxLength(64),
-		generation: F(),
-		key: F(),
-		reservations: E()
-	}).primaryKey(["id"]).nonReactive(),
-	P(vn, {
-		id: F().maxLength(64),
-		objectId: F().maxLength(64),
-		fingerprint: F().maxLength(64),
-		generation: F(),
-		key: F(),
-		refId: F(),
-		state: F(),
-		deleteKey: F().nullable()
-	}).primaryKey(["id"]).nonReactive(),
-	P(yn, {
-		id: F().maxLength(64),
-		operationId: F().maxLength(64),
-		claim: F()
-	}).primaryKey(["id"]).nonReactive()
-], xn = S.Struct({
-	id: S.String,
-	objectId: S.String,
-	fingerprint: S.String,
-	generation: S.String,
-	key: S.String,
-	refId: S.String,
-	state: S.Literals([
-		"reserved",
-		"ready",
-		"deleting",
-		"deleted"
-	]),
-	deleteKey: S.NullOr(S.String)
-}), Sn = S.Struct({
-	id: S.String,
-	generation: S.String,
-	key: S.String,
-	reservations: S.Int.pipe(S.check(S.isGreaterThanOrEqualTo(0)))
-}), Cn = (e) => S.decodeUnknownSync(Sn)({
-	...e,
-	reservations: W(e.reservations, "shared-object reservation count")
-}), wn = (e) => Ce("sha256").update(JSON.stringify(e)).digest("hex"), Tn = (e, t) => wn([e, t]), En = (e) => {
-	if (!e.bucket || !e.operationId || !e.logicalKey || !/^[a-f0-9]{64}$/.test(e.fingerprint) || !/^[a-f0-9]{64}$/.test(e.checksum)) throw Error("Storage operation requires a bucket, operation identity, key and SHA-256 fingerprint");
-	return {
-		id: wn([
-			e.bucket,
-			e.tenantId,
-			e.operationId
-		]),
-		objectId: wn([
-			e.bucket,
-			e.tenantId,
-			e.logicalKey,
-			e.checksum
-		]),
-		lockId: wn([e.tenantId])
-	};
-}, Dn = async (e, t, n) => {
-	let { lockId: r } = En(t);
-	return await e.insertIgnoreWithOutcome(_n, {
-		id: r,
-		nonce: Te()
-	}, { conflictColumns: ["id"] }), e.transactional(async (e) => {
-		if ((await e.query({
-			table: _n,
-			predicate: k("id", r),
-			lock: "update",
-			order: [],
-			take: 1,
-			skip: void 0,
-			projection: void 0
-		})).length !== 1 || await e.update(_n, r, { nonce: Te() }) === null) throw Error("Storage operation lock is unavailable");
-		return n(e);
-	});
-}, $ = async (e, t) => {
-	let r = En(t), i = await e.query({
-		table: vn,
-		predicate: k("id", r.id),
-		order: [],
-		take: 1,
-		skip: void 0,
-		projection: void 0
-	});
-	if (!i[0]) return;
-	let a = S.decodeUnknownSync(xn)(i[0]);
-	if (a.fingerprint !== t.fingerprint || a.objectId !== r.objectId) throw new n({
-		reason: "operation-identity-reused",
-		detail: `storage operation '${t.operationId}' was already used with different inputs`
-	});
-	return a;
-}, On = async (e, t) => {
-	let n = await $(e, t);
-	if (n) return n;
-	let { id: r, objectId: i } = En(t), a = await e.query({
-		table: Q,
-		predicate: k("id", i),
-		order: [],
-		take: 1,
-		skip: void 0,
-		projection: void 0
-	}), o = a[0] ? Cn(a[0]) : void 0, s = o?.generation ?? Te(), c = o?.key ?? `${t.logicalKey}/g-${s}`;
-	o ? await e.update(Q, i, { reservations: String(Je(o.reservations, 1, "shared-object reservation count")) }) : await e.insert(Q, {
-		id: i,
-		generation: s,
-		key: c,
-		reservations: "1"
-	});
-	let l = {
-		id: r,
-		objectId: i,
-		fingerprint: t.fingerprint,
-		generation: s,
-		key: c,
-		refId: `file_${Te()}`,
-		state: "reserved",
-		deleteKey: null
-	};
-	return await e.insert(vn, l), l;
-}, kn = async (e, t) => {
-	let n = await $(e, t);
-	if (!n) throw Error("Storage operation is missing");
-	if (n.state === "deleting" || n.state === "deleted") throw Error("Deleted storage operation cannot be confirmed by a late put");
-	return await e.update(vn, n.id, { state: "ready" }), {
-		...n,
-		state: "ready"
-	};
-}, An = async (e, t) => {
-	let n = await $(e, t);
-	if (!n) throw Error("Storage operation is missing");
-	if (n.state === "deleting" || n.state === "deleted") return n;
-	if (n.state !== "ready") throw Error("An unconfirmed put cannot be deleted");
-	let r = await e.query({
-		table: Q,
-		predicate: k("id", n.objectId),
-		order: [],
-		take: 1,
-		skip: void 0,
-		projection: void 0
-	}), i = r[0] ? Cn(r[0]) : void 0;
-	if (!i || i.generation !== n.generation || i.reservations < 1) throw Error("Storage object generation does not own its reservation");
-	let a = i.reservations === 1 ? i.key : null;
-	return a === null ? await e.update(Q, i.id, { reservations: String(i.reservations - 1) }) : await e.delete(Q, i.id), await e.update(vn, n.id, {
-		state: "deleting",
-		deleteKey: a
-	}), {
-		...n,
-		state: "deleting",
-		deleteKey: a
-	};
-}, jn = async (e, t) => {
-	let n = await $(e, t);
-	if (!n || n.state !== "deleting" && n.state !== "deleted") throw Error("Storage deletion has not been accepted");
-	return n.state !== "deleted" && (await e.update(vn, n.id, { state: "deleted" }), !0);
-}, Mn = async (e, t, n) => {
-	if (!n) throw Error("Storage object claim must be a non-empty string");
-	await e.insertIgnoreWithOutcome(yn, {
-		id: Tn(t, n),
-		operationId: t,
-		claim: n
-	}, { conflictColumns: ["id"] });
-}, Nn = async (e, t, n) => {
-	let r = Tn(t, n);
-	return {
-		held: await e.delete(yn, r),
-		others: (await e.query({
-			table: yn,
-			predicate: ue(k("operationId", t), ve("claim", n)),
-			order: [],
-			take: 1,
-			skip: void 0,
-			projection: void 0
-		})).length > 0
-	};
-}, Pn = (e, t) => e.deleteMany(yn, { where: k("operationId", t) }), Fn = "_voltro_storage_put_intents", In = P(Fn, {
-	id: F().maxLength(64),
-	refId: F().maxLength(64),
-	identity: ge(),
-	ref: ge()
-}).primaryKey(["id"]).unique("storagePutRef", ["refId"]).nonReactive(), Ln = S.Struct({
-	tenantId: S.NullOr(S.String),
-	bucket: S.String,
-	operationId: S.String,
-	fingerprint: S.String,
-	checksum: S.String,
-	logicalKey: S.String
-}), Rn = async (e, t) => {
-	let n = await e.query({
-		table: Fn,
-		predicate: k("refId", t),
-		order: [],
-		take: 2,
-		skip: void 0,
-		projection: void 0
-	});
-	if (n.length === 0) return;
-	if (n.length !== 1) throw Error("Storage reference has ambiguous operation ownership");
-	let r = n[0], i = S.decodeUnknownSync(Ln)(r.identity);
-	if (typeof r.ref != "object" || r.ref === null || Array.isArray(r.ref)) throw Error("Storage operation reference is unreadable");
-	let a = X(r.ref);
-	if (a.id !== t || a.bucket !== i.bucket || a.tenantId !== i.tenantId || a.checksum !== i.checksum || !Number.isSafeInteger(a.size) || a.size < 0 || !Number.isFinite(a.createdAt.getTime())) throw Error("Storage operation reference does not match its identity");
-	return {
-		identity: i,
-		ref: a
-	};
-}, zn = (e) => ({
-	intent: (t) => Rn(e, t),
-	reserve: (t, r, i, a) => Dn(e, t, async (e) => {
-		if (r.tenantId !== t.tenantId || r.bucket !== t.bucket || r.checksum !== t.checksum || !Number.isSafeInteger(r.size) || r.size < 0) throw Error("Storage put metadata does not match its identity");
-		let o = await $(e, t);
-		if (o) {
-			if (o.state === "deleting" || o.state === "deleted") throw Error("Storage put identity has already been deleted");
-			let t = await Rn(e, o.refId);
-			if (!t) throw Error("Storage operation lost its put intent");
-			let n = o.state === "ready";
-			return n && a !== void 0 && await Mn(e, o.id, a), {
-				ref: t.ref,
-				ready: n,
-				outcome: n ? "joined" : "resumed"
-			};
-		}
-		let s = await On(e, t), c = ln(e);
-		if (!(await v.runPromise(c.consumeUsage(t.tenantId, {
-			bytes: r.size,
-			count: 1
-		}, i))).allowed) throw new n({
-			reason: "quota-exceeded",
-			detail: "Storage operation exceeds tenant quota"
-		});
-		let l = X({
-			...r,
-			id: s.refId,
-			key: s.key
-		});
-		return await e.insert(Fn, {
-			id: s.id,
-			refId: l.id,
-			identity: t,
-			ref: l
-		}), {
-			ref: l,
-			ready: !1,
-			outcome: "created"
-		};
-	}),
-	confirm: (t, n) => Dn(e, t, async (e) => {
-		let r = await $(e, t);
-		if (!r) throw Error("Storage put operation is missing");
-		let i = await Rn(e, r.refId);
-		if (!i) throw Error("Storage put intent is missing");
-		if (n !== void 0 && await Mn(e, r.id, n), r.state === "ready") {
-			let n = await v.runPromise(ln(e).getById(r.refId));
-			if (!n || n.key !== r.key || n.checksum !== t.checksum) throw Error("Confirmed storage operation lost its reference");
-			return n;
-		}
-		return await kn(e, t), await v.runPromise(ln(e).insert(i.ref)), i.ref;
-	}),
-	beginDelete: async (t, r, i) => {
-		let a = await Rn(e, t);
-		if (!a) throw Error("Storage delete operation is missing");
-		if (r !== void 0 && a.identity.tenantId !== r) throw Error("Storage delete tenant mismatch");
-		return Dn(e, a.identity, async (e) => {
-			let r = await Rn(e, t);
-			if (!r) throw Error("Storage delete intent disappeared");
-			let a = await $(e, r.identity);
-			if (!a) throw Error("Storage delete lost its operation");
-			let o = a.state !== "deleting" && a.state !== "deleted";
-			if (i === void 0) o && await Pn(e, a.id);
-			else if (o) {
-				let o = await Nn(e, a.id, i);
-				if (o.others) return {
-					released: !0,
-					identity: r.identity
-				};
-				if (!o.held) throw new n({
-					reason: "claim-not-held",
-					detail: `claim '${i}' is not held on storage reference '${t}'; a reference put without a claim is deleted as a whole by a delete that names none`
-				});
-			}
-			let s = await An(e, r.identity);
-			if (a.state === "ready") {
-				let n = ln(e);
-				if (await v.runPromise(fn(e).deleteByRef(t)), !await v.runPromise(n.delete(t))) throw Error("Storage deletion lost its confirmed reference");
-				await v.runPromise(n.releaseUsage(r.identity.tenantId, {
-					bytes: r.ref.size,
-					count: 1
-				}));
-			}
-			return {
-				released: !0,
-				operation: s,
-				identity: r.identity
-			};
-		});
-	},
-	confirmDelete: (t) => Dn(e, t, (e) => jn(e, t))
-}), Bn = (e, t = 65536) => {
-	let n = [Buffer.from("zINSTREAM\0", "utf8")];
-	for (let r = 0; r < e.length; r += t) {
-		let i = e.subarray(r, Math.min(r + t, e.length)), a = Buffer.alloc(4);
-		a.writeUInt32BE(i.length, 0), n.push(a, Buffer.from(i));
-	}
-	let r = Buffer.alloc(4);
-	return r.writeUInt32BE(0, 0), n.push(r), Buffer.concat(n);
-}, Vn = (e) => {
-	let t = e.replace(/\0+$/, "").trim();
-	if (/\bOK$/.test(t)) return { clean: !0 };
-	let n = /:\s*(.+?)\s+FOUND$/.exec(t);
-	if (n) return {
-		clean: !1,
-		threat: n[1] ?? "unknown"
-	};
-	throw Error(`clamav: unexpected response: ${t}`);
-}, Hn = async (e, t) => {
-	let n = await import("node:net"), r = U.read("CLAMAV_HOST", t.host) ?? "127.0.0.1", i = U.read("CLAMAV_PORT"), a = t.port ?? (i ? Number(i) : 3310), o = t.timeoutMs ?? 3e4;
-	return new Promise((i, s) => {
-		let c = n.createConnection({
-			host: r,
-			port: a
-		}), l = "", u = setTimeout(() => {
-			c.destroy(), s(/* @__PURE__ */ Error("clamav scan timed out"));
-		}, o);
-		c.on("error", (e) => {
-			clearTimeout(u), s(e);
-		}), c.on("connect", () => {
-			c.end(Bn(e, t.chunkSize));
-		}), c.on("data", (e) => {
-			l += e.toString("utf8");
-		}), c.on("close", () => {
-			clearTimeout(u);
-			try {
-				i(Vn(l));
-			} catch (e) {
-				s(e);
-			}
+	return At(t);
+}, X = (e) => {
+	if (e.provider && typeof e.provider == "object") return e.provider;
+	let t = e.provider ?? E.read("STORAGE_PROVIDER");
+	if (t === void 0) {
+		let t = X({
+			...e,
+			provider: "memory"
 		});
-	});
-}, Un = (e = {}) => (t) => Hn(t.bytes, e), Wn = (e, t, n) => new Promise((r, i) => {
-	let a = Oe(e, [...t], { stdio: [
-		"ignore",
-		"ignore",
-		"pipe"
-	] }), o = "", s = setTimeout(() => {
-		a.kill("SIGKILL"), i(/* @__PURE__ */ Error("ffmpeg timed out"));
-	}, n);
-	a.stderr?.on("data", (e) => {
-		o += String(e);
-	}), a.on("error", (e) => {
-		clearTimeout(s), i(e);
-	}), a.on("close", (e) => {
-		clearTimeout(s), e === 0 ? r() : i(/* @__PURE__ */ Error(`ffmpeg exited ${String(e)}: ${o.slice(-400)}`));
-	});
-}), Gn = (e) => async ({ bytes: t }) => {
-	let n = e.ffmpegPath ?? "ffmpeg", r = e.timeoutMs ?? 3e5, i = await R(Me(je(), "voltro-tc-")), a = Me(i, "in"), o = [];
-	try {
-		await Ae(a, t);
-		for (let t of e.renditions) {
-			let e = Me(i, `out.${t.ext}`);
-			try {
-				await Wn(n, [
-					"-y",
-					"-i",
-					a,
-					...t.args,
-					e
-				], r);
-				let i = await z(e);
-				o.push({
-					bytes: new Uint8Array(i),
-					contentType: t.contentType,
-					kind: t.kind,
-					...t.label === void 0 ? {} : { label: t.label }
-				}), await ke(e, { force: !0 });
-			} catch {}
-		}
-	} finally {
-		await ke(i, {
-			recursive: !0,
-			force: !0
-		}).catch(() => void 0);
-	}
-	return o;
-};
-//#endregion
-//#region src/assetRef.ts
-function Kn(e = {}) {
-	let t = e.nullable ?? !0, n = e.fk === !1 ? F().externalId() : ye(() => We, { onDelete: e.onDelete ?? "setNull" });
-	return t ? n.nullable() : n;
-}
-var qn = () => _e({
-	id: "@voltro/plugin-storage/withStorage",
-	fields: { asset: Kn() }
-}), Jn = {
-	"image/png": "png",
-	"image/jpeg": "jpg",
-	"image/jpg": "jpg",
-	"image/gif": "gif",
-	"image/webp": "webp",
-	"image/svg+xml": "svg"
-}, Yn = (e) => {
-	let t = /^data:([^;,]+)(;base64)?,(.*)$/s.exec(e);
-	if (!t) throw Error("not a data URI");
-	let n = t[1] || "application/octet-stream", r = !!t[2], i = t[3] ?? "";
-	return {
-		bytes: r ? new Uint8Array(Buffer.from(i, "base64")) : new Uint8Array(Buffer.from(decodeURIComponent(i), "utf8")),
-		contentType: n
-	};
-}, Xn = (e, n) => v.gen(function* () {
-	let r = yield* v.try({
-		try: () => Yn(n.dataUri),
-		catch: (e) => new t({
-			provider: "avatar",
-			message: String(e?.message ?? e),
-			transient: !1,
-			status: 400
-		})
-	}), i = Jn[r.contentType] ?? "bin";
-	return yield* e.put({
-		bytes: r.bytes,
-		contentType: r.contentType,
-		tenantId: n.tenantId,
-		ownerId: n.userId,
-		visibility: "public",
-		key: `avatars/${n.userId}/avatar.${i}`
-	});
-}), Zn = (e) => {
-	try {
-		let t = Ne(e), n = Ne("/");
-		return typeof t.dev != "number" || typeof n.dev != "number" ? "unknown" : t.dev === n.dev ? "same-device-as-root" : "separate-mount";
-	} catch {
-		return "unknown";
+		return Y.add(t), t;
 	}
-}, Qn = (e) => {
-	if (Zn(e) === "same-device-as-root") return `the capture is going to ${e}, which is on the SAME filesystem as \`/\`.\n  A mounted volume would be a separate one. If this process is a container, that means the capture
-  dies with it — which is the exact failure it exists for. On a development machine this is normal
-  and can be ignored.`;
-}, $n = U.read("VOLTRO_SESSION_COOKIE") ?? "voltro:session", er, tr = (e) => {
-	er = e;
-}, nr = () => er ?? ir({}), rr = () => er === void 0 ? U.read("STORAGE_PROVIDER") === void 0 ? void 0 : ir({}) : er, ir = (e) => {
-	if (e.provider && typeof e.provider == "object") return e.provider;
-	let t = (e.provider ?? U.read("STORAGE_PROVIDER") ?? "memory").toLowerCase(), n = U.read("S3_BUCKET", e.bucket) ?? U.read("STORAGE_BUCKET") ?? "voltro";
-	switch (t) {
+	let n = t.toLowerCase(), r = E.read("S3_BUCKET", e.bucket) ?? E.read("STORAGE_BUCKET") ?? "voltro";
+	switch (n) {
 		case "s3":
 		case "minio": {
-			let r = U.read("S3_REGION", e.region) ?? U.read("AWS_REGION"), i = U.read("S3_ENDPOINT", e.endpoint) ?? U.read("MINIO_ENDPOINT"), a = U.read("S3_ACCESS_KEY_ID", e.accessKeyId) ?? U.read("AWS_ACCESS_KEY_ID"), o = U.read("S3_SECRET_ACCESS_KEY", e.secretAccessKey) ?? U.read("AWS_SECRET_ACCESS_KEY"), s = U.read("STORAGE_CDN_URL", e.cdnBaseUrl);
-			return nt({
-				bucket: n,
-				name: t,
-				...r ? { region: r } : {},
+			let t = E.read("S3_REGION", e.region) ?? E.read("AWS_REGION"), i = E.read("S3_ENDPOINT", e.endpoint) ?? E.read("MINIO_ENDPOINT"), a = E.read("S3_ACCESS_KEY_ID", e.accessKeyId) ?? E.read("AWS_ACCESS_KEY_ID"), o = E.read("S3_SECRET_ACCESS_KEY", e.secretAccessKey) ?? E.read("AWS_SECRET_ACCESS_KEY"), s = E.read("STORAGE_CDN_URL", e.cdnBaseUrl), c = {
+				bucket: r,
+				name: n,
+				...t ? { region: t } : {},
 				...i ? { endpoint: i } : {},
 				...a ? { accessKeyId: a } : {},
 				...o ? { secretAccessKey: o } : {},
 				...s ? { cdnBaseUrl: s } : {},
 				...e.publicAcl === void 0 ? {} : { publicAcl: e.publicAcl },
-				...t === "minio" || U.read("S3_FORCE_PATH_STYLE") === "1" ? { forcePathStyle: !0 } : {}
-			});
+				...n === "minio" || E.read("S3_FORCE_PATH_STYLE") === "1" ? { forcePathStyle: !0 } : {}
+			};
+			return P(c);
 		}
 		case "azure": {
-			let t = U.read("AZURE_STORAGE_ACCOUNT", e.accountName), r = U.read("AZURE_STORAGE_KEY", e.accountKey), i = U.read("AZURE_STORAGE_CONNECTION_STRING", e.connectionString), a = U.read("AZURE_STORAGE_ENDPOINT", e.endpoint), o = U.read("STORAGE_CDN_URL", e.cdnBaseUrl);
-			return at({
-				container: U.read("AZURE_STORAGE_CONTAINER", e.bucket) ?? n,
+			let t = E.read("AZURE_STORAGE_ACCOUNT", e.accountName), n = E.read("AZURE_STORAGE_KEY", e.accountKey), i = E.read("AZURE_STORAGE_CONNECTION_STRING", e.connectionString), a = E.read("AZURE_STORAGE_ENDPOINT", e.endpoint), o = E.read("STORAGE_CDN_URL", e.cdnBaseUrl), s = {
+				container: E.read("AZURE_STORAGE_CONTAINER", e.bucket) ?? r,
 				...t ? { accountName: t } : {},
-				...r ? { accountKey: r } : {},
+				...n ? { accountKey: n } : {},
 				...i ? { connectionString: i } : {},
 				...a ? { endpoint: a } : {},
 				...o ? { cdnBaseUrl: o } : {}
-			});
+			};
+			return D(s);
 		}
-		case "database": return it();
-		case "filesystem": return tt({ root: U.read("STORAGE_ROOT", e.root) ?? ".voltro-storage" });
-		default: return et(e.name ?? "default");
+		case "database": return k();
+		case "filesystem": return A({ root: E.read("STORAGE_ROOT", e.root) ?? ".voltro-storage" });
+		case "memory": return M(/* @__PURE__ */ new Map());
+		default: throw new g({
+			provider: "storage",
+			message: "Unknown storage provider; choose memory, filesystem, database, s3, minio or azure",
+			transient: !1
+		});
 	}
-}, ar = (e) => {
-	let t = "stored files (uploads, renditions) and their reads", n = "provider 'database' or 'filesystem' keeps the bytes inside the installation";
+}, Mt = (e) => {
+	let t = "stored files (uploads, renditions) and their reads";
+	if (e.connection !== void 0) return [{
+		destination: `runtime:the app-owned ${e.connection} connection`,
+		purpose: t,
+		data: ["files"],
+		disable: "remove the storage connection binding"
+	}];
+	let n = "provider 'database' or 'filesystem' keeps the bytes inside the installation";
 	if (e.provider && typeof e.provider == "object") return [{
 		destination: `runtime:the '${e.provider.name}' storage provider`,
 		purpose: t,
 		data: ["files"],
 		disable: n
 	}];
-	let r = (e.provider ?? U.read("STORAGE_PROVIDER") ?? "memory").toLowerCase();
+	let r = (e.provider ?? E.read("STORAGE_PROVIDER") ?? "memory").toLowerCase();
 	if (r === "s3" || r === "minio") {
-		let r = U.read("S3_ENDPOINT", e.endpoint) ?? U.read("MINIO_ENDPOINT"), i = U.read("S3_REGION", e.region) ?? U.read("AWS_REGION") ?? "us-east-1";
+		let r = E.read("S3_ENDPOINT", e.endpoint) ?? E.read("MINIO_ENDPOINT"), i = E.read("S3_REGION", e.region) ?? E.read("AWS_REGION") ?? "us-east-1";
 		return [{
 			destination: r ?? `s3.${i}.amazonaws.com`,
 			purpose: t,
@@ -2740,7 +131,7 @@ var qn = () => _e({
 		}];
 	}
 	if (r === "azure") {
-		let r = U.read("AZURE_STORAGE_ENDPOINT", e.endpoint), i = U.read("AZURE_STORAGE_ACCOUNT", e.accountName);
+		let r = E.read("AZURE_STORAGE_ENDPOINT", e.endpoint), i = E.read("AZURE_STORAGE_ACCOUNT", e.accountName);
 		return [{
 			destination: r ?? (i === void 0 ? "runtime:the Azure storage connection string" : `${i}.blob.core.windows.net`),
 			purpose: t,
@@ -2749,11 +140,11 @@ var qn = () => _e({
 		}];
 	}
 	return [];
-}, or = (e) => {
+}, Nt = (e) => {
 	if (e !== void 0) return e;
-	let t = U.read("STORAGE_ALLOWED_ORIGINS");
+	let t = E.read("STORAGE_ALLOWED_ORIGINS");
 	return t ? t.trim() === "*" ? "*" : t.split(",").map((e) => e.trim()).filter(Boolean) : [];
-}, sr = (e, t) => {
+}, Pt = (e, t) => {
 	if (!e || t !== "*" && !t.includes(e)) return {};
 	let n = {
 		"access-control-allow-origin": t === "*" ? "*" : e,
@@ -2763,7 +154,7 @@ var qn = () => _e({
 		vary: "Origin"
 	};
 	return t !== "*" && (n["access-control-allow-credentials"] = "true"), n;
-}, cr = (e) => ({
+}, Ft = (e) => ({
 	id: e.id,
 	tenantId: e.tenantId,
 	ownerId: e.ownerId,
@@ -2786,29 +177,29 @@ var qn = () => _e({
 	caption: e.caption ?? null,
 	derivedFrom: e.derivedFrom ?? null,
 	kind: e.kind ?? null
-}), lr = () => new t({
+}), It = () => new g({
 	provider: "storage",
 	message: "not permitted to administer sharing for this object",
 	transient: !1,
 	status: 403
-}), ur = (e, t, n) => {
+}), Lt = (e, t, n) => {
 	let r = n.request.subject;
-	return (r.scopes ?? []).includes("admin:full") ? v.void : e.head(t, { tenantId: r.tenantId ?? null }).pipe(v.catch(() => v.fail(lr())), v.flatMap((e) => {
+	return bt(r).includes("admin:full") ? q.void : e.head(t, { tenantId: r.tenantId ?? null }).pipe(q.catch(() => q.fail(It())), q.flatMap((e) => {
 		let t = e?.ownerId;
-		return t != null && t === r.id ? v.void : v.fail(lr());
+		return t != null && t === r.id ? q.void : q.fail(It());
 	}));
-}, dr = () => new t({
+}, Rt = () => new g({
 	provider: "storage",
 	message: "an upload needs an identified caller: this request carries no subject, and the app has not set `anonymousUploads: true` on storagePlugin. The ticket attributes the object to whoever minted it — with no subject there is nobody to attribute it to, so the finalized object would carry no owner and no tenant and no later owner check, tenant filter or quota could reach it.",
 	transient: !1,
 	status: 401
-}), fr = (e, t) => {
+}), Z = (e, t) => {
 	let n = e.request.subject.id ?? null, r = e.request.subject.tenantId ?? null;
-	return n === null && !t ? v.fail(dr()) : v.succeed({
+	return n === null && !t ? q.fail(Rt()) : q.succeed({
 		id: n,
 		tenantId: r
 	});
-}, pr = (e, t) => e !== null && e !== (t ?? null), mr = (e) => ({
+}, zt = (e, t) => e !== null && e !== (t ?? null), Bt = (e) => ({
 	id: e.id,
 	refId: e.refId,
 	principalType: e.principalType,
@@ -2817,143 +208,208 @@ var qn = () => _e({
 	createdAt: e.createdAt.toISOString(),
 	expiresAt: e.expiresAt ? e.expiresAt.toISOString() : null,
 	createdBy: e.createdBy
-}), hr = "@voltro/plugin-storage", gr = (e = {}) => w({
-	base: hr,
+}), Q = "@voltro/plugin-storage", Vt = (e = {}) => xt({
+	base: Q,
 	alias: e.alias,
 	instance: e.name
-}), _r = (i = {}) => {
-	let y = w({
-		base: hr,
-		alias: i.alias,
-		instance: i.name
-	}), b = y === hr ? "/_voltro/storage" : `/_voltro/storage/i/${Buffer.from(y).toString("hex")}`, x = ir(i);
-	tr(x);
-	let ue = U.read("S3_BUCKET", i.bucket) ?? U.read("STORAGE_BUCKET") ?? "voltro", T = U.read("VOLTRO_PUBLIC_URL", i.publicBaseUrl), E = or(i.allowedOrigins), D = i.limits?.maxBytes, O = i.anonymousUploads === !0, de = 5242880, fe = 21600, k = i.refStore === void 0 || i.refStore === "memory", pe = i.grantStore === void 0 || i.grantStore === "memory", A = (e, n) => v.gen(function* () {
-		let r = (e) => S.decodeUnknownEffect(ae)(e, { onExcessProperty: "error" }).pipe(v.mapError(() => new t({
+}), Ht = (e) => e.reason === "too-large" ? 413 : e.reason === "operation-identity-reused" || e.reason === "operation-store-unbound" || e.reason === "claim-not-held" ? 409 : 415, Ut = (e = {}) => {
+	let r = xt({
+		base: Q,
+		alias: e.alias,
+		instance: e.name
+	}), i = r === Q ? "/_voltro/storage" : `/_voltro/storage/i/${Buffer.from(r).toString("hex")}`, a = [
+		"provider",
+		"bucket",
+		"region",
+		"endpoint",
+		"accessKeyId",
+		"secretAccessKey",
+		"root",
+		"accountName",
+		"accountKey",
+		"connectionString",
+		"cdnBaseUrl"
+	].some((t) => e[t] !== void 0);
+	if (e.connection !== void 0 && a) throw Error("Storage selects either a named connection or direct transport options");
+	let s = e.connection !== void 0 || !a;
+	if (e.connection === void 0 && typeof e.provider != "object" && ![
+		"memory",
+		"filesystem",
+		"database",
+		"s3",
+		"minio",
+		"azure"
+	].includes((e.provider ?? E.read("STORAGE_PROVIDER") ?? "memory").toLowerCase())) throw new g({
+		provider: "storage",
+		message: "Unknown storage provider; choose memory, filesystem, database, s3, minio or azure",
+		transient: !1
+	});
+	let c = E.read("S3_BUCKET", e.bucket) ?? E.read("STORAGE_BUCKET") ?? "voltro", l = a ? X(e) : void 0, u = () => (l === void 0 && (l = X(e)), l), d = l, ee = e.connection, f, p = !1, m = s ? lt(() => {
+		if (d === void 0) {
+			if (ee !== void 0) throw new g({
+				provider: "storage",
+				message: "Named storage requires a bound tenant-aware destination",
+				transient: !1
+			});
+			d = u();
+		}
+		return d;
+	}) : d;
+	e.provider === void 0 && e.connection === void 0 && E.read("STORAGE_PROVIDER") === void 0 && Y.add(m);
+	let h = e.connection ?? c, _ = t({
+		selected: () => h,
+		directDestination: e.connection === void 0 ? c : void 0,
+		directProvider: u,
+		registry: () => f
+	}), oe = (e, t) => q.gen(function* () {
+		if (f = e, ee = t, p = !1, h = t ?? c, t === void 0) return;
+		if (Y.delete(m), e === void 0) throw Error("Named storage requires the app connection registry");
+		let n = yield* e.validate(t);
+		p = n.tenantScoped, d = n.tenantScoped ? void 0 : yield* e.storage(t);
+	}), y = E.read("VOLTRO_PUBLIC_URL", e.publicBaseUrl), b = Nt(e.allowedOrigins), x = e.limits?.maxBytes, S = e.anonymousUploads === !0, C = 5242880, ce = 21600, w = e.refStore === void 0 || e.refStore === "memory", T = e.grantStore === void 0 || e.grantStore === "memory", D = (t, n) => q.gen(function* () {
+		let r = (e) => J.decodeUnknownEffect(vt)(e, { onExcessProperty: "error" }).pipe(q.mapError(() => new g({
 			provider: "storage",
 			message: "Invalid upload access policy",
 			transient: !1,
 			status: 400
-		}))), a = e.access === void 0 ? void 0 : yield* r(e.access), o = e.visibility ?? "private";
-		if (a !== void 0 && o === "public") return yield* v.fail(new t({
+		}))), i = t.access === void 0 ? void 0 : yield* r(t.access), a = t.visibility ?? "private";
+		if (i !== void 0 && a === "public") return yield* q.fail(new g({
 			provider: "storage",
 			message: "An access policy requires a private upload",
 			transient: !1,
 			status: 400
 		}));
-		let s = i.uploadAccess;
-		if (a !== void 0 && typeof s != "function") return yield* v.fail(new t({
+		let o = e.uploadAccess;
+		if (i !== void 0 && typeof o != "function") return yield* q.fail(new g({
 			provider: "storage",
 			message: "Requested upload access requires an uploadAccess authorization function on storagePlugin",
 			transient: !1,
 			status: 403
 		}));
-		let c = typeof s == "function" ? yield* s({
+		let s = typeof o == "function" ? yield* o({
 			subject: n,
-			requested: a,
-			visibility: o,
-			contentType: e.contentType
-		}) : o === "private" ? s : void 0, l = c === void 0 ? void 0 : yield* r(c);
-		return o === "public" ? l !== void 0 && l.length > 0 ? yield* v.fail(new t({
+			requested: i,
+			visibility: a,
+			contentType: t.contentType
+		}) : a === "private" ? o : void 0, c = s === void 0 ? void 0 : yield* r(s);
+		return a === "public" ? c !== void 0 && c.length > 0 ? yield* q.fail(new g({
 			provider: "storage",
 			message: "A public upload cannot carry an access policy",
 			transient: !1,
 			status: 400
-		})) : {} : l === void 0 ? {} : { access: l };
-	}), j = { current: k ? on() : i.refStore }, M = { current: pe ? un() : i.grantStore }, me = { current: void 0 }, he = {
-		insert: (e) => j.current.insert(e),
-		getById: (e) => j.current.getById(e),
-		delete: (e) => j.current.delete(e),
-		statistics: () => j.current.statistics(),
-		listRecent: (e) => j.current.listRecent(e),
-		countByKey: (e, t) => j.current.countByKey(e, t),
-		usageByTenant: (e) => j.current.usageByTenant(e),
-		consumeUsage: (e, t, n) => j.current.consumeUsage(e, t, n),
-		releaseUsage: (e, t) => j.current.releaseUsage(e, t),
-		listByDerivedFrom: (e) => j.current.listByDerivedFrom(e),
-		listRefs: (e) => j.current.listRefs(e),
+		})) : {} : c === void 0 ? {} : { access: c };
+	}), O = { current: w ? ke() : e.refStore }, k = { current: T ? Oe() : e.grantStore }, A = { current: void 0 }, j = { current: void 0 }, M = {
+		get catalogueId() {
+			return O.current.catalogueId;
+		},
+		insert: (e) => O.current.insert(e),
+		getById: (e) => O.current.getById(e),
+		delete: (e) => O.current.delete(e),
+		statistics: () => O.current.statistics(),
+		listRecent: (e) => O.current.listRecent(e),
+		countByAddress: (e) => O.current.countByAddress(e),
+		listObjectReferences: () => O.current.listObjectReferences(),
+		hasObjectReservation: (e, t) => O.current.hasObjectReservation?.(e, t) ?? q.succeed(!1),
+		usageByTenant: (e) => O.current.usageByTenant(e),
+		consumeUsage: (e, t, n) => O.current.consumeUsage(e, t, n),
+		releaseUsage: (e, t) => O.current.releaseUsage(e, t),
+		listByDerivedFrom: (e) => O.current.listByDerivedFrom(e),
+		listRefs: (e) => O.current.listRefs(e),
 		get setVisibility() {
-			return j.current.setVisibility;
+			return O.current.setVisibility;
 		},
-		get countPublicByKey() {
-			return j.current.countPublicByKey;
+		get countPublicByAddress() {
+			return O.current.countPublicByAddress;
 		}
-	}, ge = {
-		insert: (e) => M.current.insert(e),
-		delete: (e) => M.current.delete(e),
-		getById: (e) => M.current.getById(e),
-		listByRef: (e) => M.current.listByRef(e),
-		deleteByRef: (e) => M.current.deleteByRef(e)
-	}, _e = {
-		httpPath: b,
-		provider: x,
-		refStore: he,
-		grantStore: ge,
-		bucket: ue,
-		...i.tenantPrefix === void 0 ? {} : { tenantPrefix: i.tenantPrefix },
-		...i.attempts === void 0 ? {} : { attempts: i.attempts },
-		...i.urlExpiresInSec === void 0 ? {} : { urlExpiresInSec: i.urlExpiresInSec },
-		...i.access === void 0 ? {} : { access: i.access },
-		...i.limits === void 0 ? {} : { limits: i.limits },
-		...i.ingest === void 0 ? {} : { ingest: i.ingest },
-		...i.scan === void 0 ? {} : { scan: i.scan },
-		...i.videoProbe === void 0 ? {} : { videoProbe: i.videoProbe },
-		...i.transcode === void 0 ? {} : { transcode: i.transcode },
-		...i.autoTranscode === void 0 ? {} : { autoTranscode: i.autoTranscode },
-		...T ? { publicBaseUrl: T } : {},
-		...i.normalizeImages === void 0 ? {} : { normalizeImages: i.normalizeImages },
-		...i.quota === void 0 ? {} : { quota: i.quota },
-		objects: () => me.current
-	}, ve = gn(_e), N = hn(_e), ye = `${b}/`, P = (e) => v.runPromise(e.pipe(v.catch(() => v.succeed(null)))), F = (e, t) => {
-		if (!e) return "invalid";
-		let n = /^bytes=(\d*)-(\d*)$/.exec(e.trim());
-		if (!n) return "invalid";
-		let r = n[1] ?? "", i = n[2] ?? "";
-		if (r === "" && i === "") return "invalid";
-		if (r === "") {
-			let e = Number(i);
-			return !Number.isFinite(e) || e <= 0 ? "invalid" : t === 0 ? "unsatisfiable" : {
-				start: Math.max(0, t - e),
-				endInclusive: t - 1
-			};
-		}
-		let a = Number(r);
-		if (!Number.isFinite(a)) return "invalid";
-		if (t > 0 && a >= t) return "unsatisfiable";
-		let o = i === "" ? Math.max(0, t - 1) : Math.min(Number(i), Math.max(0, t - 1));
-		return !Number.isFinite(o) || o < a ? "invalid" : {
-			start: a,
-			endInclusive: o
-		};
-	}, be = i.publicCacheSeconds === void 0 ? "public, max-age=31536000, immutable" : `public, max-age=${Math.max(0, Math.floor(i.publicCacheSeconds))}`, xe = /^(?:image\/(?!svg)|video\/|audio\/|application\/pdf(?:;|$)|text\/plain(?:;|$))/i, Se = (e) => ({
-		"x-content-type-options": "nosniff",
-		"content-disposition": xe.test(e) ? "inline" : "attachment"
-	}), I = ot(), we = async (e, t, n, r) => {
-		if (n) {
-			let r, i = await I.getOrCreate(_t(JSON.stringify([e.id, e.checksum]), e.contentType, n), async () => {
-				let t = await P(N.get(e.id));
-				return t ? (r = t.bytes, mt(t.bytes, e.contentType, n)) : null;
+	}, N = {
+		insert: (e) => k.current.insert(e),
+		delete: (e) => k.current.delete(e),
+		getById: (e) => k.current.getById(e),
+		listByRef: (e) => k.current.listByRef(e),
+		deleteByRef: (e) => k.current.deleteByRef(e)
+	}, P, ue = {
+		httpPath: i,
+		storageInstance: r,
+		provider: m,
+		refStore: M,
+		grantStore: N,
+		get bucket() {
+			return h;
+		},
+		destinations: _,
+		resolveObjectReference: (e) => P !== void 0 && e.storageInstance !== void 0 ? P({
+			storageInstance: e.storageInstance,
+			address: v(e)
+		}) : _.resolve(v(e)),
+		...e.tenantPrefix === void 0 ? {} : { tenantPrefix: e.tenantPrefix },
+		...e.attempts === void 0 ? {} : { attempts: e.attempts },
+		...e.urlExpiresInSec === void 0 ? {} : { urlExpiresInSec: e.urlExpiresInSec },
+		...e.access === void 0 ? {} : { access: e.access },
+		...e.limits === void 0 ? {} : { limits: e.limits },
+		...e.ingest === void 0 ? {} : { ingest: e.ingest },
+		...e.scan === void 0 ? {} : { scan: e.scan },
+		...e.videoProbe === void 0 ? {} : { videoProbe: e.videoProbe },
+		...e.transcode === void 0 ? {} : { transcode: e.transcode },
+		...e.autoTranscode === void 0 ? {} : { autoTranscode: e.autoTranscode },
+		...y ? { publicBaseUrl: y } : {},
+		...e.normalizeImages === void 0 ? {} : { normalizeImages: e.normalizeImages },
+		...e.quota === void 0 ? {} : { quota: e.quota },
+		objects: () => A.current
+	}, fe = ft.merge(je(ue), Ie({
+		selection: {
+			...e.alias === void 0 ? {} : { alias: e.alias },
+			...e.name === void 0 ? {} : { name: e.name }
+		},
+		bucket: h,
+		provider: m,
+		store: () => j.current,
+		...e.quota === void 0 ? {} : { quota: e.quota }
+	})), F = Te(ue), I = (e) => F.uploadTicketScope({
+		tenantId: e.tenant,
+		destination: e.destination
+	}).pipe(q.flatMap((t) => t === e.writeScope ? q.void : q.fail(new g({
+		provider: "storage",
+		message: "Upload ticket belongs to another storage destination",
+		transient: !1,
+		status: 409
+	})))), L = (e, t) => q.runPromise(I(e).pipe(q.match({
+		onSuccess: () => null,
+		onFailure: (e) => ({
+			status: e.status ?? 503,
+			body: e.status === 409 ? e.message : "Storage upload destination could not be checked",
+			contentType: "text/plain",
+			headers: t
+		})
+	}))), R = `${i}/`, V = (e) => q.runPromise(e.pipe(q.catch(() => q.succeed(null)))), Ce = e.publicCacheSeconds === void 0 ? "public, max-age=31536000, immutable" : `public, max-age=${Math.max(0, Math.floor(e.publicCacheSeconds))}`, we = le(), H = async (e, t, r, i, a) => {
+		if (r) {
+			let i, a = await we.getOrCreate(he(JSON.stringify([
+				ae(v(e)),
+				e.id,
+				e.checksum
+			]), e.contentType, r), async () => {
+				let t = await V(F.get(e.id));
+				return t ? (i = t.bytes, me(t.bytes, e.contentType, r)) : null;
 			}).catch(() => null);
-			if (!i && r === void 0 && (r = (await P(N.get(e.id)))?.bytes), !i && r === void 0) return {
+			if (!a && i === void 0 && (i = (await V(F.get(e.id)))?.bytes), !a && i === void 0) return {
 				status: 404,
 				body: "not found",
 				contentType: "text/plain"
 			};
-			let a = i ? i.bytes : r, o = i ? i.contentType : e.contentType, s = await pt(e.contentType, i !== null);
+			let o = a ? a.bytes : i, s = a ? a.contentType : e.contentType, c = await pe(e.contentType, a !== null);
 			return {
 				status: 200,
-				body: a,
-				contentType: o,
+				body: o,
+				contentType: s,
 				headers: {
-					...Se(o),
+					...n(s),
 					"cache-control": t,
 					"accept-ranges": "none",
-					...s === null ? {} : { "x-voltro-transform": `original; reason=${s}` }
+					...c === null ? {} : { "x-voltro-transform": `original; reason=${c}` }
 				}
 			};
 		}
-		let i = r === void 0 ? "invalid" : F(r, e.size);
-		if (i === "unsatisfiable") return {
+		let o = Tt(a, {}) ? Et(i, e.size) : { _tag: "ignored" };
+		if (o._tag === "unsatisfiable") return {
 			status: 416,
 			body: "range not satisfiable",
 			contentType: "text/plain",
@@ -2962,17 +418,20 @@ var qn = () => _e({
 				"accept-ranges": "bytes"
 			}
 		};
-		if (i !== "invalid") {
-			let n = await P(N.getRange(e.id, i));
-			return n ? {
+		if (o._tag === "satisfiable") {
+			let r = await V(F.getRange(e.id, {
+				start: o.start,
+				endInclusive: o.end
+			}));
+			return r ? {
 				status: 206,
-				body: n.bytes,
+				body: r.bytes,
 				contentType: e.contentType,
 				headers: {
-					...Se(e.contentType),
+					...n(e.contentType),
 					"cache-control": t,
 					"accept-ranges": "bytes",
-					"content-range": `bytes ${i.start}-${i.endInclusive}/${n.totalSize}`
+					"content-range": `bytes ${o.start}-${o.end}/${r.totalSize}`
 				}
 			} : {
 				status: 404,
@@ -2980,69 +439,81 @@ var qn = () => _e({
 				contentType: "text/plain"
 			};
 		}
-		let a = await P(N.getStream(e.id));
-		return a ? {
+		let s = await V(F.getStream(e.id));
+		return s ? {
 			status: 200,
 			contentType: e.contentType,
 			headers: {
-				...Se(e.contentType),
+				...n(e.contentType),
 				"cache-control": t,
 				"accept-ranges": "bytes"
 			},
 			byteStream: {
 				contentLength: e.size,
-				stream: () => C.toReadableStream(a.stream)
+				stream: () => pt.toReadableStream(s.stream)
 			}
 		} : {
 			status: 404,
 			body: "not found",
 			contentType: "text/plain"
 		};
-	}, Ee = async (e) => {
-		let t = e.path.startsWith(ye) ? e.path.slice(ye.length).split("/")[0] ?? "" : "";
+	}, Ae = async (e) => {
+		let t = e.path.startsWith(R) ? e.path.slice(R.length).split("/")[0] ?? "" : "";
 		if (!t) return {
 			status: 404,
 			body: "not found",
 			contentType: "text/plain"
 		};
-		let n = await P(N.head(t));
+		let n = await V(F.head(t));
 		if (!n) return {
 			status: 404,
 			body: "not found",
 			contentType: "text/plain"
 		};
-		let r = lt(e.query), i = e.headers.range, a = n.derivedFrom == null ? null : await P(N.head(n.derivedFrom));
-		if (n.derivedFrom != null && a === null) return {
+		let r = de(e.query), a = e.headers.range, o = e.headers["if-range"], s = n.derivedFrom == null ? null : await V(F.head(n.derivedFrom));
+		if (n.derivedFrom != null && s === null) return {
 			status: 404,
 			body: "not found",
 			contentType: "text/plain"
 		};
-		if (n.visibility === "public" && (a === null || a.visibility === "public")) {
-			let e = x.publicUrl?.(n.key) ?? null;
-			return e && !r ? {
+		if (n.visibility === "public" && (s === null || s.visibility === "public")) {
+			let e = await V(_.resolve(v(n)));
+			if (!e) return {
+				status: 503,
+				body: "storage destination unavailable",
+				contentType: "text/plain"
+			};
+			let t = e.publicUrl?.(n.key) ?? null;
+			return t && !r ? {
 				status: 302,
 				headers: {
-					location: e,
+					location: t,
 					"cache-control": "public, max-age=300"
 				}
-			} : we(n, be, r, i);
+			} : H(n, Ce, r, a, o);
 		}
-		let o = !1, s = e.query ? new URLSearchParams(e.query).get("t") : null;
-		if (s) {
-			let e = Nt(s);
-			o = !!e && (e.refId === t || a !== null && e.refId === a.id) && e.audience === b;
+		let c = !1, l = e.query ? new URLSearchParams(e.query).get("t") : null;
+		if (l) {
+			let e = be(l);
+			c = !!e && (e.refId === t || s !== null && e.refId === s.id) && e.audience === i;
 		}
-		if (!o) {
-			let t = se(e.headers.cookie, $n), r = t ? le(t, ce()) : null;
-			r && (o = await P(N.checkAccess(n, r)) === !0);
+		if (!c) {
+			let t = St(e.headers.cookie, Dt), r = t ? wt(t, Ct())?.subject ?? null : null;
+			r && (c = await V(F.checkAccess(n, r)) === !0);
 		}
-		if (!o) return {
+		if (!c) return {
 			status: 403,
 			body: "forbidden",
 			contentType: "text/plain"
 		};
-		if (x.presigns && !r) {
-			let e = await P(x.getUrl(n.key, 300));
+		let u = await V(_.resolve(v(n)));
+		if (!u) return {
+			status: 503,
+			body: "storage destination unavailable",
+			contentType: "text/plain"
+		};
+		if (u.presigns && !r) {
+			let e = await V(u.getUrl(n.key, 300));
 			if (e && /^https?:/.test(e)) return {
 				status: 302,
 				headers: {
@@ -3051,12 +522,12 @@ var qn = () => _e({
 				}
 			};
 		}
-		return we(n, "private, no-store", r, i);
-	}, L = {
+		return H(n, "private, no-store", r, a, o);
+	}, Ne = {
 		method: "GET",
-		path: b,
+		path: i,
 		handle: async (e) => {
-			let t = await Ee(e), n = sr(e.headers.origin, E);
+			let t = await Ae(e), n = Pt(e.headers.origin, b);
 			return Object.keys(n).length === 0 ? t : {
 				...t,
 				headers: {
@@ -3065,12 +536,12 @@ var qn = () => _e({
 				}
 			};
 		}
-	}, De = {
+	}, Pe = {
 		method: "*",
-		path: `${b}/upload`,
+		path: `${i}/upload`,
 		originGuard: "exempt",
 		handle: async (e) => {
-			let t = sr(e.headers.origin, E);
+			let t = Pt(e.headers.origin, b);
 			if (e.method === "OPTIONS") return {
 				status: 204,
 				headers: t
@@ -3081,112 +552,113 @@ var qn = () => _e({
 				contentType: "text/plain",
 				headers: t
 			};
-			let n = e.query ? new URLSearchParams(e.query).get("ticket") : null, r = n ? It(n) : null;
-			if (!r || r.instance !== y) return {
+			let n = e.query ? new URLSearchParams(e.query).get("ticket") : null, i = n ? Se(n) : null;
+			if (!i || i.instance !== r) return {
 				status: 401,
 				body: "invalid or expired upload ticket",
 				contentType: "text/plain",
 				headers: t
 			};
-			if (r.replicaId !== void 0 && r.replicaId !== ie().replicaId) return {
-				status: 409,
-				body: "upload ticket belongs to another replica",
-				contentType: "text/plain",
-				headers: t
-			};
+			let a = await L(i, t);
+			if (a) return a;
 			if (e.rawBody.length === 0) return {
 				status: 400,
 				body: "empty body",
 				contentType: "text/plain",
 				headers: t
 			};
-			if (r.max && e.rawBody.length > r.max) return {
+			if (i.max && e.rawBody.length > i.max) return {
 				status: 413,
 				body: "payload too large",
 				contentType: "text/plain",
 				headers: t
 			};
-			let i = await v.runPromise(N.put({
+			let o = await q.runPromise(F.put({
 				bytes: e.rawBody,
-				contentType: r.ct,
-				tenantId: r.tenant,
-				ownerId: r.sub,
-				visibility: r.vis,
-				...r.access === void 0 ? {} : { access: r.access },
-				...r.operationId === void 0 ? {} : { operationId: r.operationId },
-				...r.key === void 0 ? {} : { key: r.key },
-				...r.folder === void 0 ? {} : { folder: r.folder },
-				...r.tags === void 0 ? {} : { tags: r.tags },
-				...r.alt === void 0 ? {} : { alt: r.alt },
-				...r.caption === void 0 ? {} : { caption: r.caption }
-			}).pipe(v.flatMap((e) => N.getUrl(e.id).pipe(v.map((t) => ({
+				contentType: i.ct,
+				tenantId: i.tenant,
+				destination: i.destination,
+				ownerId: i.sub,
+				visibility: i.vis,
+				...i.access === void 0 ? {} : { access: i.access },
+				...i.operationId === void 0 ? {} : { operationId: i.operationId },
+				...i.key === void 0 ? {} : { key: i.key },
+				...i.folder === void 0 ? {} : { folder: i.folder },
+				...i.tags === void 0 ? {} : { tags: i.tags },
+				...i.alt === void 0 ? {} : { alt: i.alt },
+				...i.caption === void 0 ? {} : { caption: i.caption }
+			}).pipe(q.flatMap((e) => F.getUrl(e.id).pipe(q.map((t) => ({
 				kind: "ok",
 				ref: e,
 				url: t
-			})))), v.catchTags({
-				StorageRejected: (e) => v.succeed({
+			})))), q.catchTags({
+				StorageRejected: (e) => q.succeed({
 					kind: "rejected",
-					status: e.reason === "too-large" ? 413 : 415,
+					status: Ht(e),
 					detail: e.detail
 				}),
-				StorageScanRejected: (e) => v.succeed({
+				StorageScanRejected: (e) => q.succeed({
 					kind: "scan",
 					threat: e.threat
 				}),
-				StorageError: (e) => v.succeed({
+				StorageError: (e) => q.succeed({
 					kind: "error",
-					message: e.message
+					message: e.message,
+					status: e.status ?? 500
 				})
 			})));
-			return i.kind === "ok" ? {
+			return o.kind === "ok" ? {
 				status: 201,
 				body: JSON.stringify({
-					id: i.ref.id,
-					url: i.url,
-					contentType: i.ref.contentType,
-					size: i.ref.size
+					id: o.ref.id,
+					url: o.url,
+					contentType: o.ref.contentType,
+					size: o.ref.size
 				}),
 				contentType: "application/json",
 				headers: t
-			} : i.kind === "rejected" ? {
-				status: i.status,
-				body: i.detail,
+			} : o.kind === "rejected" ? {
+				status: o.status,
+				body: o.detail,
 				contentType: "text/plain",
 				headers: t
-			} : i.kind === "scan" ? {
+			} : o.kind === "scan" ? {
 				status: 422,
-				body: `rejected: ${i.threat}`,
+				body: `rejected: ${o.threat}`,
 				contentType: "text/plain",
 				headers: t
 			} : {
-				status: 500,
-				body: i.message,
+				status: o.status,
+				body: o.message,
 				contentType: "text/plain",
 				headers: t
 			};
 		}
-	}, Oe = {
+	}, Fe = {
 		method: "*",
-		path: `${b}/upload/resumable`,
+		path: `${i}/upload/resumable`,
 		originGuard: "exempt",
 		handle: async (e) => {
-			let t = sr(e.headers.origin, E);
+			let t = Pt(e.headers.origin, b);
 			if (e.method === "OPTIONS") return {
 				status: 204,
 				headers: t
 			};
-			let n = new URLSearchParams(e.query || ""), r = Bt(n.get("token") ?? "");
-			if (!r || r.instance !== y) return {
+			let n = new URLSearchParams(e.query || ""), i = xe(n.get("token") ?? "");
+			if (!i || i.instance !== r) return {
 				status: 401,
 				body: "invalid or expired resumable token",
 				contentType: "text/plain",
 				headers: t
 			};
+			let a = await L(i, t);
+			if (a) return a;
 			if (e.method === "GET" || e.method === "HEAD") {
-				let e = await v.runPromise(N.resumableStatus({
-					uploadId: r.id,
-					tenantId: r.tenant
-				}).pipe(v.match({
+				let e = await q.runPromise(F.resumableStatus({
+					uploadId: i.id,
+					tenantId: i.tenant,
+					destination: i.destination
+				}).pipe(q.match({
 					onFailure: (e) => ({ error: e.message }),
 					onSuccess: (e) => e
 				})));
@@ -3211,8 +683,8 @@ var qn = () => _e({
 				contentType: "text/plain",
 				headers: t
 			};
-			let i = Number(n.get("index"));
-			if (!Number.isInteger(i) || i < 0) return {
+			let o = Number(n.get("index"));
+			if (!Number.isInteger(o) || o < 0) return {
 				status: 400,
 				body: "missing/invalid chunk index",
 				contentType: "text/plain",
@@ -3224,153 +696,173 @@ var qn = () => _e({
 				contentType: "text/plain",
 				headers: t
 			};
-			let a = n.get("final") === "1", o = await v.runPromise(N.putResumableChunk({
-				uploadId: r.id,
-				tenantId: r.tenant,
-				index: i,
+			let s = n.get("final") === "1", c = await q.runPromise(F.putResumableChunk({
+				uploadId: i.id,
+				tenantId: i.tenant,
+				destination: i.destination,
+				index: o,
 				bytes: e.rawBody
-			}).pipe(v.flatMap(() => a ? N.finalizeResumable({
-				uploadId: r.id,
-				count: i + 1,
-				contentType: r.ct,
-				tenantId: r.tenant,
-				ownerId: r.sub,
-				visibility: r.vis,
-				...r.access === void 0 ? {} : { access: r.access },
-				...r.folder === void 0 ? {} : { folder: r.folder },
-				...r.tags === void 0 ? {} : { tags: r.tags },
-				...r.alt === void 0 ? {} : { alt: r.alt },
-				...r.caption === void 0 ? {} : { caption: r.caption }
-			}).pipe(v.flatMap((e) => N.getUrl(e.id).pipe(v.map((t) => ({
+			}).pipe(q.flatMap(() => s ? F.finalizeResumable({
+				uploadId: i.id,
+				destination: i.destination,
+				count: o + 1,
+				contentType: i.ct,
+				tenantId: i.tenant,
+				ownerId: i.sub,
+				visibility: i.vis,
+				...i.access === void 0 ? {} : { access: i.access },
+				...i.folder === void 0 ? {} : { folder: i.folder },
+				...i.tags === void 0 ? {} : { tags: i.tags },
+				...i.alt === void 0 ? {} : { alt: i.alt },
+				...i.caption === void 0 ? {} : { caption: i.caption }
+			}).pipe(q.flatMap((e) => F.getUrl(e.id).pipe(q.map((t) => ({
 				kind: "done",
 				ref: e,
 				url: t
-			}))))) : v.succeed({ kind: "chunk" })), v.catchTags({
-				StorageRejected: (e) => v.succeed({
+			}))))) : q.succeed({ kind: "chunk" })), q.catchTags({
+				StorageRejected: (e) => q.succeed({
 					kind: "rejected",
-					status: e.reason === "too-large" ? 413 : 415,
+					status: Ht(e),
 					detail: e.detail
 				}),
-				StorageScanRejected: (e) => v.succeed({
+				StorageScanRejected: (e) => q.succeed({
 					kind: "scan",
 					threat: e.threat
 				}),
-				StorageError: (e) => v.succeed({
+				StorageError: (e) => q.succeed({
 					kind: "error",
-					message: e.message
+					message: e.message,
+					status: e.status ?? 500
 				})
 			})));
-			return o.kind === "chunk" ? {
+			return c.kind === "chunk" ? {
 				status: 204,
 				headers: {
 					...t,
-					"upload-offset": String(i + 1)
+					"upload-offset": String(o + 1)
 				}
-			} : o.kind === "done" ? {
+			} : c.kind === "done" ? {
 				status: 201,
 				body: JSON.stringify({
-					id: o.ref.id,
-					url: o.url,
-					contentType: o.ref.contentType,
-					size: o.ref.size
+					id: c.ref.id,
+					url: c.url,
+					contentType: c.ref.contentType,
+					size: c.ref.size
 				}),
 				contentType: "application/json",
 				headers: t
-			} : o.kind === "rejected" ? {
-				status: o.status,
-				body: o.detail,
+			} : c.kind === "rejected" ? {
+				status: c.status,
+				body: c.detail,
 				contentType: "text/plain",
 				headers: t
-			} : o.kind === "scan" ? {
+			} : c.kind === "scan" ? {
 				status: 422,
-				body: `rejected: ${o.threat}`,
+				body: `rejected: ${c.threat}`,
 				contentType: "text/plain",
 				headers: t
 			} : {
-				status: 500,
-				body: o.message,
+				status: c.status,
+				body: c.message,
 				contentType: "text/plain",
 				headers: t
 			};
 		}
-	}, R = (e) => ({
+	}, U = (e) => ({
 		kind: "json",
 		data: e
-	}), z = (e, t) => ({
+	}), W = (e, t) => ({
 		kind: "json",
 		status: e,
 		data: { error: t }
-	}), ke = (e, t) => {
+	}), G = (e, t) => {
 		try {
 			return new URL(e, "http://localhost").searchParams.get(t);
 		} catch {
 			return null;
 		}
-	}, Ae = [
+	}, K = q.gen(function* () {
+		let e = yield* M.catalogueId;
+		return p ? {
+			catalogueId: e,
+			storageInstance: r,
+			tenantScoped: !0
+		} : {
+			catalogueId: e,
+			objectNamespace: yield* m.objectNamespace,
+			storageInstance: r
+		};
+	}), et = [
 		{
 			method: "POST",
 			path: "/upload-ticket",
 			description: "Authorize a binary upload with explicit tenant and owner attribution",
-			handler: (e) => v.gen(function* () {
-				let n = S.String.pipe(S.check(S.makeFilter((e) => e.trim().length > 0))), r = yield* S.decodeUnknownEffect(S.fromJsonString(S.Struct({
-					operationId: S.optional(n.pipe(S.check(S.isMaxLength(200)))),
-					tenantId: S.NullOr(n),
-					ownerId: S.NullOr(n),
-					key: n.pipe(S.check(S.isMaxLength(1024))),
-					contentType: n.pipe(S.check(S.isMaxLength(255)), S.check(S.makeFilter((e) => !/[\r\n]/.test(e)))),
-					size: S.Number.pipe(S.check(S.isInt()), S.check(S.isGreaterThan(0)), S.check(S.makeFilter(Number.isSafeInteger))),
-					visibility: S.optional(S.Literals(["public", "private"]))
-				})))(e.body).pipe(v.mapError(() => new t({
+			handler: (t) => q.gen(function* () {
+				let n = J.String.pipe(J.check(J.makeFilter((e) => e.trim().length > 0))), a = yield* J.decodeUnknownEffect(J.fromJsonString(J.Struct({
+					operationId: J.optional(n.pipe(J.check(J.isMaxLength(200)))),
+					tenantId: J.NullOr(n),
+					ownerId: J.NullOr(n),
+					key: n.pipe(J.check(J.isMaxLength(1024))),
+					contentType: n.pipe(J.check(J.isMaxLength(255)), J.check(J.makeFilter((e) => !/[\r\n]/.test(e)))),
+					size: J.Number.pipe(J.check(J.isInt()), J.check(J.isGreaterThan(0)), J.check(J.makeFilter(Number.isSafeInteger))),
+					visibility: J.optional(J.Literals(["public", "private"]))
+				})))(t.body).pipe(q.mapError(() => new g({
 					provider: "inspect",
 					message: "Provide explicit tenantId and ownerId (or null), key, contentType and a positive file size",
 					transient: !1,
 					status: 400
 				})));
-				if (r.operationId !== void 0 && me.current === void 0) return z(409, "Durable uploads require a bound operation store with default reference and grant stores");
-				if (D !== void 0 && r.size > D) return z(413, "File exceeds the configured upload limit");
-				let a = r.visibility !== "public" && Array.isArray(i.uploadAccess) ? yield* S.decodeUnknownEffect(ae)(i.uploadAccess, { onExcessProperty: "error" }).pipe(v.mapError(() => new t({
+				if (a.operationId !== void 0 && A.current === void 0) return W(409, "Durable uploads require a bound operation store with default reference and grant stores");
+				if (x !== void 0 && a.size > x) return W(413, "File exceeds the configured upload limit");
+				let o = yield* _.select(a.tenantId), s = a.operationId ?? (A.current === void 0 ? void 0 : ht()), c = s === void 0 ? void 0 : "inspect-upload:" + mt("sha256").update(JSON.stringify([r, s])).digest("hex"), l = a.visibility !== "public" && Array.isArray(e.uploadAccess) ? yield* J.decodeUnknownEffect(vt)(e.uploadAccess, { onExcessProperty: "error" }).pipe(q.mapError(() => new g({
 					provider: "storage",
 					message: "Invalid upload access policy",
 					transient: !1,
 					status: 400
-				}))) : void 0, o = Ft({
-					instance: y,
-					...a === void 0 ? {} : { access: a },
-					...r.operationId === void 0 ? {} : { operationId: `inspect-upload:${Ce("sha256").update(JSON.stringify([y, r.operationId])).digest("hex")}` },
-					replicaId: ie().replicaId,
-					sub: r.ownerId,
-					tenant: r.tenantId,
-					ct: r.contentType,
-					key: r.key,
-					vis: r.visibility ?? "private",
-					max: r.size
+				}))) : void 0, u = yield* F.uploadTicketScope({
+					tenantId: a.tenantId,
+					destination: o.destination
+				}), d = z({
+					writeScope: u,
+					instance: r,
+					destination: o.destination,
+					issuerReplicaId: _t().replicaId,
+					...l === void 0 ? {} : { access: l },
+					...c === void 0 ? {} : { operationId: c },
+					sub: a.ownerId,
+					tenant: a.tenantId,
+					ct: a.contentType,
+					key: a.key,
+					vis: a.visibility ?? "private",
+					max: a.size
 				}, 300);
-				return R({
-					uploadPath: `${b}/upload?ticket=${encodeURIComponent(o)}`,
+				return U({
+					uploadPath: `${i}/upload?ticket=${encodeURIComponent(d)}`,
 					expiresInSec: 300,
-					maxBytes: r.size
+					maxBytes: a.size,
+					...s === void 0 ? {} : { operationId: s }
 				});
-			}).pipe(v.catch((e) => v.succeed(z(e.status ?? 500, e.message))))
+			}).pipe(q.catch((e) => q.succeed(W(e.status ?? 500, e.message))))
 		},
 		{
 			method: "GET",
 			path: "/download",
 			description: "Stream a stored file as an attachment for authorized inspect readers",
-			handler: (e) => v.gen(function* () {
-				let t = ke(e.url, "refId");
-				if (!t?.trim()) return z(400, "A non-empty refId is required");
-				let { ref: n, stream: r } = yield* N.getStream(t), i = n.key.split("/").pop() || n.id, a = encodeURIComponent(i).replace(/[!'()*]/g, (e) => `%${e.charCodeAt(0).toString(16).toUpperCase()}`);
+			handler: (e) => q.gen(function* () {
+				let t = G(e.url, "refId");
+				if (!t?.trim()) return W(400, "A non-empty refId is required");
+				let { ref: n, stream: r } = yield* F.getStream(t), i = n.key.split("/").pop() || n.id, a = encodeURIComponent(i).replace(/[!'()*]/g, (e) => `%${e.charCodeAt(0).toString(16).toUpperCase()}`);
 				return {
 					kind: "bytes",
 					contentType: n.contentType,
 					byteStream: {
-						stream: () => C.toReadableStream(r),
+						stream: () => pt.toReadableStream(r),
 						contentLength: n.size,
 						contentDisposition: `attachment; filename="download"; filename*=UTF-8''${a}`
 					},
 					headers: { "cache-control": "no-store" }
 				};
-			}).pipe(v.catch((e) => v.succeed(z(e.status ?? 500, e.message))))
+			}).pipe(q.catch((e) => q.succeed(W(e.status ?? 500, e.message))))
 		},
 		{
 			method: "GET",
@@ -3378,8 +870,8 @@ var qn = () => _e({
 			scope: "process",
 			description: "Searchable storage refs, newest first, paginated",
 			handler: (e) => {
-				let t = Number(ke(e.url, "offset") ?? 0), n = Number.isSafeInteger(t) && t >= 0 ? t : 0, r = (ke(e.url, "search") ?? "").trim().slice(0, 200);
-				return he.listRefs({
+				let t = Number(G(e.url, "offset") ?? 0), n = Number.isSafeInteger(t) && t >= 0 ? t : 0, r = (G(e.url, "search") ?? "").trim().slice(0, 200);
+				return M.listRefs({
 					tenantId: void 0,
 					ownerId: void 0,
 					folder: void 0,
@@ -3388,14 +880,15 @@ var qn = () => _e({
 					search: r,
 					limit: 51,
 					offset: n
-				}).pipe(v.map((e) => R({
-					refs: e.slice(0, 50).map(cr),
+				}).pipe(q.flatMap((e) => K.pipe(q.map((t) => U({
+					source: t,
+					refs: e.slice(0, 50).map(Ft),
 					page: {
 						search: r,
 						offset: n,
 						nextOffset: e.length > 50 ? n + 50 : null
 					}
-				})), v.catch((e) => v.succeed(z(500, e.message))));
+				})))), q.catch((e) => q.succeed(W(500, e.message))));
 			}
 		},
 		{
@@ -3403,11 +896,12 @@ var qn = () => _e({
 			path: "/stats",
 			scope: "process",
 			description: "Object count + total bytes per tenant + visibility split",
-			handler: () => he.statistics().pipe(v.map((e) => R({
-				provider: x.name,
-				bucket: ue,
+			handler: () => M.statistics().pipe(q.flatMap((e) => K.pipe(q.map((t) => U({
+				source: t,
+				provider: p ? "tenant-scoped" : m.name,
+				bucket: h,
 				...e
-			})), v.catch((e) => v.succeed(z(500, e.message))))
+			})))), q.catch((e) => q.succeed(W(500, e.message))))
 		},
 		{
 			method: "GET",
@@ -3415,103 +909,119 @@ var qn = () => _e({
 			scope: "process",
 			description: "Grants for a ref (?refId=…)",
 			handler: (e) => {
-				let t = ke(e.url, "refId");
-				return t ? ge.listByRef(t).pipe(v.map((e) => R({ grants: e.map(mr) })), v.catch((e) => v.succeed(z(500, e.message)))) : v.succeed(z(400, "refId query param required"));
+				let t = G(e.url, "refId");
+				return t ? N.listByRef(t).pipe(q.map((e) => U({ grants: e.map(Bt) })), q.catch((e) => q.succeed(W(500, e.message)))) : q.succeed(W(400, "refId query param required"));
 			}
 		},
 		{
 			method: "POST",
 			path: "/share",
 			description: "Grant a principal access to a ref",
-			handler: (e) => v.gen(function* () {
-				let n = yield* S.decodeUnknownEffect(S.fromJsonString(S.Struct({
-					refId: S.String.pipe(S.check(S.makeFilter((e) => e.trim().length > 0))),
-					principalType: S.Literals([
+			handler: (e) => q.gen(function* () {
+				let t = yield* J.decodeUnknownEffect(J.fromJsonString(J.Struct({
+					refId: J.String.pipe(J.check(J.makeFilter((e) => e.trim().length > 0))),
+					principalType: J.Literals([
 						"user",
 						"group",
 						"apiKey"
 					]),
-					principalId: S.String.pipe(S.check(S.makeFilter((e) => e.trim().length > 0))),
-					permission: S.optional(S.Literals(["read", "write"])),
-					expiresInDays: S.optional(S.Number.pipe(S.check(S.isFinite()), S.check(S.isGreaterThan(0))))
-				})))(e.body).pipe(v.mapError(() => new t({
+					principalId: J.String.pipe(J.check(J.makeFilter((e) => e.trim().length > 0))),
+					permission: J.optional(J.Literals(["read", "write"])),
+					expiresInDays: J.optional(J.Number.pipe(J.check(J.isFinite()), J.check(J.isGreaterThan(0))))
+				})))(e.body).pipe(q.mapError(() => new g({
 					provider: "inspect",
 					message: "Invalid share input: provide refId, principalType, principalId, read/write permission and a positive finite expiry if set",
 					transient: !1,
 					status: 400
-				}))), r = n.expiresInDays === void 0 ? null : new Date(Date.now() + n.expiresInDays * 864e5);
-				if (r !== null && !Number.isFinite(r.getTime())) return z(400, "Expiry exceeds the supported date range");
-				let i = yield* N.grant({
-					refId: n.refId,
-					principalType: n.principalType,
-					principalId: n.principalId,
-					...n.permission ? { permission: n.permission } : {},
-					expiresAt: r
+				}))), n = t.expiresInDays === void 0 ? null : new Date(Date.now() + t.expiresInDays * 864e5);
+				if (n !== null && !Number.isFinite(n.getTime())) return W(400, "Expiry exceeds the supported date range");
+				let r = yield* F.grant({
+					refId: t.refId,
+					principalType: t.principalType,
+					principalId: t.principalId,
+					...t.permission ? { permission: t.permission } : {},
+					expiresAt: n
 				});
-				return R({ grant: mr(i) });
-			}).pipe(v.catch((e) => v.succeed(z(e.status ?? 500, e.message ?? "share failed"))))
+				return U({ grant: Bt(r) });
+			}).pipe(q.catch((e) => q.succeed(W(e.status ?? 500, e.message ?? "share failed"))))
 		},
 		{
 			method: "POST",
 			path: "/delete",
 			description: "Delete an object reference and its grants; release unreferenced bytes",
-			handler: (e) => v.gen(function* () {
-				let n = yield* S.decodeUnknownEffect(S.fromJsonString(S.Struct({ refId: S.String.pipe(S.check(S.makeFilter((e) => e.trim().length > 0))) })))(e.body).pipe(v.mapError(() => new t({
+			handler: (e) => q.gen(function* () {
+				let t = yield* J.decodeUnknownEffect(J.fromJsonString(J.Struct({ refId: J.String.pipe(J.check(J.makeFilter((e) => e.trim().length > 0))) })))(e.body).pipe(q.mapError(() => new g({
 					provider: "inspect",
 					message: "A non-empty refId is required",
 					transient: !1,
 					status: 400
 				})));
-				return yield* N.delete(n.refId), R({ ok: !0 });
-			}).pipe(v.catch((e) => v.succeed(z(e.status ?? 500, e.message))))
+				return yield* F.delete(t.refId), U({ ok: !0 });
+			}).pipe(q.catch((e) => q.succeed(W(e.status ?? 500, e.message))))
 		},
 		{
 			method: "POST",
 			path: "/revoke",
 			description: "Revoke a grant by id",
-			handler: (e) => v.gen(function* () {
-				let n = yield* S.decodeUnknownEffect(S.fromJsonString(S.Struct({ grantId: S.String.pipe(S.check(S.makeFilter((e) => e.trim().length > 0))) })))(e.body).pipe(v.mapError(() => new t({
+			handler: (e) => q.gen(function* () {
+				let t = yield* J.decodeUnknownEffect(J.fromJsonString(J.Struct({ grantId: J.String.pipe(J.check(J.makeFilter((e) => e.trim().length > 0))) })))(e.body).pipe(q.mapError(() => new g({
 					provider: "inspect",
 					message: "A non-empty grantId is required",
 					transient: !1,
 					status: 400
 				})));
-				return yield* N.revoke(n.grantId), R({ ok: !0 });
-			}).pipe(v.catch((e) => v.succeed(z(e.status ?? 500, e.message ?? "revoke failed"))))
+				return yield* F.revoke(t.grantId), U({ ok: !0 });
+			}).pipe(q.catch((e) => q.succeed(W(e.status ?? 500, e.message ?? "revoke failed"))))
 		}
-	], je = [
+	], tt = [
 		{
-			...te,
+			...Je,
 			execute: (e, t) => {
 				let n = e;
-				return N.mintUrl(n.id, t.request.subject, {
+				return F.mintUrl(n.id, t.request.subject, {
 					...n.password === void 0 ? {} : { password: n.password },
 					...n.expiresInSec === void 0 ? {} : { expiresInSec: n.expiresInSec }
-				}).pipe(v.map((e) => ({ url: e })));
+				}).pipe(q.map((e) => ({ url: e })));
 			}
 		},
 		{
-			...ee,
+			...qe,
 			execute: (e, t) => {
 				let n = e;
-				return N.mintUploadUrl({
+				return F.mintUploadUrl({
 					key: n.key,
 					contentType: n.contentType,
 					tenantId: t.request.subject.tenantId,
 					...n.expiresInSec === void 0 ? {} : { expiresInSec: n.expiresInSec }
-				}).pipe(v.map((e) => ({ url: e })));
+				}).pipe(q.map((e) => ({ url: e })));
 			}
 		},
 		{
-			...m,
+			...Ke,
 			execute: (e, t) => {
 				let n = e;
-				return fr(t, O).pipe(v.flatMap((e) => A(n, t.request.subject).pipe(v.map((t) => ({
+				return Z(t, S).pipe(q.flatMap((e) => D(n, t.request.subject).pipe(q.map((t) => ({
 					writer: e,
 					policy: t
-				})))), v.map(({ writer: e, policy: t }) => {
-					let r = n.expiresInSec ?? 900, i = Ft({
-						instance: y,
+				})))), q.flatMap((e) => n.operationId !== void 0 && A.current === void 0 ? q.fail(new g({
+					provider: "storage",
+					message: "Durable uploads require a bound operation store with default reference and grant stores",
+					transient: !1,
+					status: 409
+				})) : q.succeed(e)), q.flatMap(({ writer: e, policy: t }) => _.select(e.tenantId).pipe(q.flatMap((a) => F.uploadTicketScope({
+					tenantId: e.tenantId,
+					destination: a.destination
+				}).pipe(q.map((o) => {
+					let s = n.expiresInSec ?? 900, c = n.operationId ?? (A.current === void 0 ? void 0 : ht()), l = c === void 0 ? void 0 : "client-upload:" + mt("sha256").update(JSON.stringify([
+						r,
+						e.tenantId,
+						e.id,
+						c
+					])).digest("hex"), u = z({
+						writeScope: o,
+						instance: r,
+						destination: a.destination,
+						...l === void 0 ? {} : { operationId: l },
 						sub: e.id,
 						tenant: e.tenantId,
 						ct: n.contentType,
@@ -3522,30 +1032,33 @@ var qn = () => _e({
 						...n.tags === void 0 ? {} : { tags: n.tags },
 						...n.alt === void 0 ? {} : { alt: n.alt },
 						...n.caption === void 0 ? {} : { caption: n.caption },
-						...D === void 0 ? {} : { max: D }
-					}, r);
+						...x === void 0 ? {} : { max: x }
+					}, s);
 					return {
-						uploadUrl: `${T ? T.replace(/\/+$/, "") : ""}${b}/upload?ticket=${encodeURIComponent(i)}`,
-						expiresInSec: r
+						uploadUrl: `${y ? y.replace(/\/+$/, "") : ""}${i}/upload?ticket=${encodeURIComponent(u)}`,
+						expiresInSec: s,
+						...c === void 0 ? {} : { operationId: c }
 					};
-				}));
+				}))))));
 			}
 		},
 		{
-			...p,
+			...Ge,
 			execute: (e, t) => {
 				let n = e;
-				return fr(t, O).pipe(v.flatMap((e) => A(n, t.request.subject).pipe(v.map((t) => ({
+				return Z(t, S).pipe(q.flatMap((e) => D(n, t.request.subject).pipe(q.map((t) => ({
 					writer: e,
 					policy: t
-				})))), v.flatMap(({ writer: e, policy: t }) => N.mintPresignedUpload({
+				})))), q.flatMap(({ writer: e, policy: t }) => F.mintPresignedUpload({
 					contentType: n.contentType,
 					tenantId: e.tenantId,
 					...n.expiresInSec === void 0 ? {} : { expiresInSec: n.expiresInSec }
-				}).pipe(v.map((r) => {
-					let i = Lt({
-						instance: y,
-						key: r.key,
+				}).pipe(q.map((i) => {
+					let a = ge({
+						writeScope: i.writeScope,
+						instance: r,
+						destination: i.destination,
+						key: i.key,
 						sub: e.id,
 						tenant: e.tenantId,
 						ct: n.contentType,
@@ -3555,65 +1068,71 @@ var qn = () => _e({
 						...n.tags === void 0 ? {} : { tags: n.tags },
 						...n.alt === void 0 ? {} : { alt: n.alt },
 						...n.caption === void 0 ? {} : { caption: n.caption },
-						...D === void 0 ? {} : { max: D }
-					}, r.expiresInSec);
+						...x === void 0 ? {} : { max: x }
+					}, i.expiresInSec);
 					return {
-						uploadUrl: r.uploadUrl,
-						finalizeToken: i,
-						expiresInSec: r.expiresInSec
+						uploadUrl: i.uploadUrl,
+						finalizeToken: a,
+						expiresInSec: i.expiresInSec
 					};
 				}))));
 			}
 		},
 		{
-			...l,
-			execute: (e, n) => {
-				let r = Rt(e.finalizeToken);
-				return !r || r.instance !== y ? v.fail(new t({
+			...Ve,
+			execute: (e, t) => {
+				let n = ye(e.finalizeToken);
+				return !n || n.instance !== r ? q.fail(new g({
 					provider: "storage",
 					message: "invalid or expired finalize token",
 					transient: !1,
 					status: 401
-				})) : pr(r.sub, n.request.subject.id) ? v.fail(new t({
+				})) : zt(n.sub, t.request.subject.id) ? q.fail(new g({
 					provider: "storage",
 					message: "finalize token belongs to another subject",
 					transient: !1,
 					status: 403
-				})) : N.finalizeUpload({
-					key: r.key,
-					contentType: r.ct,
-					tenantId: r.tenant,
-					ownerId: r.sub,
-					visibility: r.vis,
-					...r.access === void 0 ? {} : { access: r.access },
-					...r.folder === void 0 ? {} : { folder: r.folder },
-					...r.tags === void 0 ? {} : { tags: r.tags },
-					...r.alt === void 0 ? {} : { alt: r.alt },
-					...r.caption === void 0 ? {} : { caption: r.caption }
-				}).pipe(v.flatMap((e) => N.getUrl(e.id).pipe(v.map((t) => ({
+				})) : I(n).pipe(q.flatMap(() => F.finalizeUpload({
+					destination: n.destination,
+					key: n.key,
+					contentType: n.ct,
+					tenantId: n.tenant,
+					ownerId: n.sub,
+					visibility: n.vis,
+					...n.access === void 0 ? {} : { access: n.access },
+					...n.folder === void 0 ? {} : { folder: n.folder },
+					...n.tags === void 0 ? {} : { tags: n.tags },
+					...n.alt === void 0 ? {} : { alt: n.alt },
+					...n.caption === void 0 ? {} : { caption: n.caption }
+				}).pipe(q.flatMap((e) => F.getUrl(e.id).pipe(q.map((t) => ({
 					id: e.id,
 					url: t,
 					contentType: e.contentType,
 					size: e.size,
 					...e.width == null ? {} : { width: e.width },
 					...e.height == null ? {} : { height: e.height }
-				})))));
+				})))))));
 			}
 		},
 		{
-			...s,
+			...ze,
 			execute: (e, t) => {
 				let n = e;
-				return fr(t, O).pipe(v.flatMap((e) => A(n, t.request.subject).pipe(v.map((t) => ({
+				return Z(t, S).pipe(q.flatMap((e) => D(n, t.request.subject).pipe(q.map((t) => ({
 					writer: e,
 					policy: t
-				})))), v.map(({ writer: e, policy: t }) => {
-					let r = n.expiresInSec ?? fe, i = Te(), a = n.chunkSize && n.chunkSize > 0 ? n.chunkSize : de;
+				})))), q.flatMap(({ writer: e, policy: t }) => _.select(e.tenantId).pipe(q.flatMap((a) => F.uploadTicketScope({
+					tenantId: e.tenantId,
+					destination: a.destination
+				}).pipe(q.map((o) => {
+					let s = n.expiresInSec ?? ce, c = ht(), l = n.chunkSize && n.chunkSize > 0 ? n.chunkSize : C;
 					return {
-						uploadId: i,
-						resumableToken: zt({
-							instance: y,
-							id: i,
+						uploadId: c,
+						resumableToken: ve({
+							writeScope: o,
+							instance: r,
+							destination: a.destination,
+							id: c,
 							sub: e.id,
 							tenant: e.tenantId,
 							ct: n.contentType,
@@ -3624,32 +1143,34 @@ var qn = () => _e({
 							...n.tags === void 0 ? {} : { tags: n.tags },
 							...n.alt === void 0 ? {} : { alt: n.alt },
 							...n.caption === void 0 ? {} : { caption: n.caption },
-							...D === void 0 ? {} : { max: D }
-						}, r),
-						uploadUrl: `${T ? T.replace(/\/+$/, "") : ""}${b}/upload/resumable`,
-						chunkSize: a,
-						expiresInSec: r
+							...x === void 0 ? {} : { max: x }
+						}, s),
+						uploadUrl: `${y ? y.replace(/\/+$/, "") : ""}${i}/upload/resumable`,
+						chunkSize: l,
+						expiresInSec: s
 					};
-				}));
+				}))))));
 			}
 		},
 		{
-			...o,
+			...Re,
 			execute: (e, t) => {
-				let n = e, r = n.expiresInSec ?? fe;
-				return fr(t, O).pipe(v.flatMap((e) => A(n, t.request.subject).pipe(v.map((t) => ({
+				let n = e, i = n.expiresInSec ?? ce;
+				return Z(t, S).pipe(q.flatMap((e) => D(n, t.request.subject).pipe(q.map((t) => ({
 					writer: e,
 					policy: t
-				})))), v.flatMap(({ writer: e, policy: t }) => N.beginMultipartUpload({
+				})))), q.flatMap(({ writer: e, policy: t }) => F.beginMultipartUpload({
 					contentType: n.contentType,
 					tenantId: e.tenantId,
 					visibility: n.visibility ?? "private",
-					expiresInSec: r
-				}).pipe(v.map((i) => ({
-					multipartToken: Vt({
-						instance: y,
-						key: i.key,
-						uploadId: i.uploadId,
+					expiresInSec: i
+				}).pipe(q.map((a) => ({
+					multipartToken: _e({
+						writeScope: a.writeScope,
+						instance: r,
+						destination: a.destination,
+						key: a.key,
+						uploadId: a.uploadId,
 						sub: e.id,
 						tenant: e.tenantId,
 						ct: n.contentType,
@@ -3660,51 +1181,54 @@ var qn = () => _e({
 						...n.tags === void 0 ? {} : { tags: n.tags },
 						...n.alt === void 0 ? {} : { alt: n.alt },
 						...n.caption === void 0 ? {} : { caption: n.caption }
-					}, r),
-					partSize: n.partSize && n.partSize >= de ? n.partSize : de,
-					expiresInSec: r
+					}, i),
+					partSize: n.partSize && n.partSize >= C ? n.partSize : C,
+					expiresInSec: i
 				})))));
 			}
 		},
 		{
-			...g,
+			...Ze,
 			execute: (e) => {
-				let n = e, r = Ht(n.multipartToken);
-				return !r || r.instance !== y ? v.fail(new t({
+				let t = e, n = B(t.multipartToken);
+				return !n || n.instance !== r ? q.fail(new g({
 					provider: "storage",
 					message: "invalid or expired multipart token",
 					transient: !1,
 					status: 401
-				})) : !Number.isInteger(n.partNumber) || n.partNumber < 1 ? v.fail(new t({
+				})) : !Number.isInteger(t.partNumber) || t.partNumber < 1 ? q.fail(new g({
 					provider: "storage",
 					message: "partNumber must be a positive integer",
 					transient: !1,
 					status: 400
-				})) : N.signMultipartPart({
-					key: r.key,
-					uploadId: r.uploadId,
-					partNumber: n.partNumber
-				}).pipe(v.map((e) => ({ url: e })));
+				})) : I(n).pipe(q.flatMap(() => F.signMultipartPart({
+					key: n.key,
+					destination: n.destination,
+					tenantId: n.tenant,
+					uploadId: n.uploadId,
+					partNumber: t.partNumber
+				}).pipe(q.map((e) => ({ url: e })))));
 			}
 		},
 		{
-			...c,
-			execute: (e, n) => {
-				let r = e, i = Ht(r.multipartToken);
-				return !i || i.instance !== y ? v.fail(new t({
+			...Be,
+			execute: (e, t) => {
+				let n = e, i = B(n.multipartToken);
+				return !i || i.instance !== r ? q.fail(new g({
 					provider: "storage",
 					message: "invalid or expired multipart token",
 					transient: !1,
 					status: 401
-				})) : pr(i.sub, n.request.subject.id) ? v.fail(new t({
+				})) : zt(i.sub, t.request.subject.id) ? q.fail(new g({
 					provider: "storage",
 					message: "multipart token belongs to another subject",
 					transient: !1,
 					status: 403
-				})) : N.completeMultipart({
+				})) : I(i).pipe(q.flatMap(() => F.completeMultipart({
+					destination: i.destination,
 					key: i.key,
 					uploadId: i.uploadId,
-					parts: r.parts,
+					parts: n.parts,
 					contentType: i.ct,
 					tenantId: i.tenant,
 					ownerId: i.sub,
@@ -3714,36 +1238,38 @@ var qn = () => _e({
 					...i.tags === void 0 ? {} : { tags: i.tags },
 					...i.alt === void 0 ? {} : { alt: i.alt },
 					...i.caption === void 0 ? {} : { caption: i.caption }
-				}).pipe(v.flatMap((e) => N.getUrl(e.id).pipe(v.map((t) => ({
+				}).pipe(q.flatMap((e) => F.getUrl(e.id).pipe(q.map((t) => ({
 					id: e.id,
 					url: t,
 					size: e.size
-				})))));
+				})))))));
 			}
 		},
 		{
-			...a,
+			...Le,
 			execute: (e) => {
-				let n = Ht(e.multipartToken);
-				return !n || n.instance !== y ? v.fail(new t({
+				let t = B(e.multipartToken);
+				return !t || t.instance !== r ? q.fail(new g({
 					provider: "storage",
 					message: "invalid or expired multipart token",
 					transient: !1,
 					status: 401
-				})) : N.abortMultipart({
-					key: n.key,
-					uploadId: n.uploadId
-				}).pipe(v.as({ ok: !0 }));
+				})) : I(t).pipe(q.flatMap(() => F.abortMultipart({
+					key: t.key,
+					destination: t.destination,
+					tenantId: t.tenant,
+					uploadId: t.uploadId
+				}).pipe(q.as({ ok: !0 }))));
 			}
 		},
 		{
-			...re,
+			...$e,
 			execute: (e, t) => {
 				let n = e, r = new Uint8Array(Buffer.from(n.bytesBase64, "base64"));
-				return fr(t, O).pipe(v.flatMap((e) => A(n, t.request.subject).pipe(v.map((t) => ({
+				return Z(t, S).pipe(q.flatMap((e) => D(n, t.request.subject).pipe(q.map((t) => ({
 					writer: e,
 					policy: t
-				})))), v.flatMap(({ writer: e, policy: t }) => N.put({
+				})))), q.flatMap(({ writer: e, policy: t }) => F.put({
 					bytes: r,
 					...t,
 					contentType: n.contentType,
@@ -3752,17 +1278,17 @@ var qn = () => _e({
 					...n.visibility ? { visibility: n.visibility } : {},
 					...n.key ? { key: n.key } : {},
 					...n.password ? { password: n.password } : {}
-				})), v.flatMap((e) => N.getUrl(e.id).pipe(v.map((t) => ({
+				})), q.flatMap((e) => F.getUrl(e.id).pipe(q.map((t) => ({
 					id: e.id,
 					url: t
 				})))));
 			}
 		},
 		{
-			...u,
+			...He,
 			execute: (e, t) => {
 				let n = e;
-				return fr(t, O).pipe(v.flatMap((e) => N.ingestUrl(n.url, {
+				return Z(t, S).pipe(q.flatMap((e) => F.ingestUrl(n.url, {
 					tenantId: e.tenantId,
 					ownerId: e.id,
 					...n.visibility ? { visibility: n.visibility } : {},
@@ -3771,45 +1297,45 @@ var qn = () => _e({
 					...n.alt === void 0 ? {} : { alt: n.alt },
 					...n.caption === void 0 ? {} : { caption: n.caption },
 					...n.key === void 0 ? {} : { key: n.key }
-				})), v.flatMap((e) => N.getUrl(e.id).pipe(v.map((t) => ({
+				})), q.flatMap((e) => F.getUrl(e.id).pipe(q.map((t) => ({
 					id: e.id,
 					url: t
 				})))));
 			}
 		},
 		{
-			...h,
+			...Xe,
 			execute: (e, t) => {
 				let n = e, r = n.expiresInDays ? new Date(Date.now() + n.expiresInDays * 864e5) : null;
-				return ur(N, n.refId, t).pipe(v.flatMap(() => N.grant({
+				return Lt(F, n.refId, t).pipe(q.flatMap(() => F.grant({
 					refId: n.refId,
 					principalType: n.principalType,
 					principalId: n.principalId,
 					...n.permission ? { permission: n.permission } : {},
 					expiresAt: r,
 					createdBy: t.request.subject.id
-				})), v.map((e) => ({ grantId: e.id })));
+				})), q.map((e) => ({ grantId: e.id })));
 			}
 		},
 		{
-			...ne,
+			...Ye,
 			execute: (e, t) => {
 				let n = e;
-				return N.getGrant(n.grantId).pipe(v.flatMap((e) => e === null ? v.fail(lr()) : ur(N, e.refId, t)), v.flatMap(() => N.revoke(n.grantId)), v.map(() => ({ ok: !0 })));
+				return F.getGrant(n.grantId).pipe(q.flatMap((e) => e === null ? q.fail(It()) : Lt(F, e.refId, t)), q.flatMap(() => F.revoke(n.grantId)), q.map(() => ({ ok: !0 })));
 			}
 		},
 		{
-			...d,
+			...Ue,
 			execute: (e, t) => {
 				let n = e;
-				return ur(N, n.refId, t).pipe(v.flatMap(() => N.listGrants(n.refId)), v.map((e) => ({ grants: e.map(mr) })));
+				return Lt(F, n.refId, t).pipe(q.flatMap(() => F.listGrants(n.refId)), q.map((e) => ({ grants: e.map(Bt) })));
 			}
 		},
 		{
-			...f,
+			...We,
 			execute: (e, t) => {
 				let n = e;
-				return N.listRefs({
+				return F.listRefs({
 					tenantId: t.request.subject.tenantId,
 					...n.folder === void 0 ? {} : { folder: n.folder },
 					...n.tags === void 0 ? {} : { tags: n.tags },
@@ -3817,111 +1343,154 @@ var qn = () => _e({
 					...n.includeDerived === void 0 ? {} : { includeDerived: n.includeDerived },
 					...n.limit === void 0 ? {} : { limit: n.limit },
 					...n.offset === void 0 ? {} : { offset: n.offset }
-				}).pipe(v.map((e) => ({
-					refs: e.refs.map(cr),
+				}).pipe(q.map((e) => ({
+					refs: e.refs.map(Ft),
 					nextOffset: e.nextOffset
 				})));
 			}
 		}
-	];
-	return oe({
-		name: w({
-			base: hr,
-			alias: i.alias,
-			instance: i.name
+	], nt = yt({
+		name: xt({
+			base: Q,
+			alias: e.alias,
+			instance: e.name
 		}),
-		baseName: hr,
+		baseName: Q,
 		description: "File storage — StorageService over S3 / MinIO / filesystem / memory. Public objects served direct from bucket/CDN; private objects gated by an access policy + per-object grants. Checksums, tenant key-prefixing, _voltro_storage_refs + _voltro_storage_grants, retry.",
 		permissions: [
 			"network:outbound:*",
 			"inspect:read",
 			"inspect:write"
 		],
-		declaredEnv: U.declared,
-		egress: ar(i),
-		services: ve,
-		inspectEndpoints: Ae,
+		declaredEnv: E.declared,
+		egress: Mt(e),
+		services: fe,
+		inspectEndpoints: et,
 		httpRoutes: [
-			L,
-			De,
-			Oe
+			Ne,
+			Pe,
+			Fe
 		],
-		routes: je,
-		rpcClientDescriptors: _,
+		routes: tt,
+		rpcClientDescriptors: Qe,
 		errorSchemas: [
 			{
-				schema: t,
+				schema: g,
 				import: {
 					module: "@voltro/plugin-storage/errors",
 					name: "StorageError"
 				}
 			},
 			{
-				schema: e,
+				schema: ne,
 				import: {
 					module: "@voltro/plugin-storage/errors",
 					name: "StorageAccessDenied"
 				}
 			},
 			{
-				schema: n,
+				schema: re,
 				import: {
 					module: "@voltro/plugin-storage/errors",
 					name: "StorageRejected"
 				}
 			},
 			{
-				schema: r,
+				schema: ie,
 				import: {
 					module: "@voltro/plugin-storage/errors",
 					name: "StorageScanRejected"
 				}
 			}
 		],
-		capabilities: { mediaPersist: {
-			put: async ({ bytes: e, mediaType: t, tenantId: n, operationId: r, ownerId: i, visibility: a, tags: o }) => {
-				let s = await v.runPromise(N.put({
-					bytes: e,
-					contentType: t,
-					tenantId: n,
-					kind: "media",
-					...i === void 0 ? {} : { ownerId: i },
-					...a === void 0 ? {} : { visibility: a },
-					...o === void 0 ? {} : { tags: o },
-					...me.current === void 0 ? {} : { operationId: r }
-				}));
-				return {
-					url: await v.runPromise(N.getUrl(s.id, { tenantId: n })),
-					refId: s.id
-				};
+		...s ? { needs: { connections: [{
+			kind: "storage",
+			role: "objects",
+			optional: e.connection === void 0
+		}] } } : {},
+		...e.connection === void 0 ? {} : { connectionBindings: { objects: e.connection } },
+		capabilities: {
+			storageProvider: () => m,
+			storageDestinations: {
+				router: _,
+				directDestination: e.connection === void 0 ? c : void 0,
+				registry: () => f
 			},
-			ingestUrl: async ({ url: e, tenantId: t, operationId: n, ownerId: r, visibility: i, tags: a }) => {
-				let o = await v.runPromise(N.ingestUrl(e, {
-					tenantId: t,
-					...r === void 0 ? {} : { ownerId: r },
-					...i === void 0 ? {} : { visibility: i },
-					...a === void 0 ? {} : { tags: a },
-					...me.current === void 0 ? {} : { operationId: n }
-				}));
-				return {
-					url: await v.runPromise(N.getUrl(o.id, { tenantId: t })),
-					refId: o.id
-				};
+			mediaPersist: {
+				put: async ({ bytes: e, mediaType: t, tenantId: n, operationId: r, ownerId: i, visibility: a, tags: o }) => {
+					let s = await q.runPromise(F.put({
+						bytes: e,
+						contentType: t,
+						tenantId: n,
+						kind: "media",
+						...i === void 0 ? {} : { ownerId: i },
+						...a === void 0 ? {} : { visibility: a },
+						...o === void 0 ? {} : { tags: o },
+						...A.current === void 0 ? {} : { operationId: r }
+					}));
+					return {
+						url: await q.runPromise(F.getUrl(s.id, { tenantId: n })),
+						refId: s.id
+					};
+				},
+				ingestUrl: async ({ url: e, tenantId: t, operationId: n, ownerId: r, visibility: i, tags: a }) => {
+					let o = await q.runPromise(F.ingestUrl(e, {
+						tenantId: t,
+						...r === void 0 ? {} : { ownerId: r },
+						...i === void 0 ? {} : { visibility: i },
+						...a === void 0 ? {} : { tags: a },
+						...A.current === void 0 ? {} : { operationId: n }
+					}));
+					return {
+						url: await q.runPromise(F.getUrl(o.id, { tenantId: t })),
+						refId: o.id
+					};
+				}
 			}
-		} },
-		bindDataStore: (e) => {
-			k && (j.current = ln(e)), pe && (M.current = fn(e)), k && pe && (me.current = zn(e)), x.bindDataStore?.(e);
 		},
-		onActivate: (e) => v.sync(() => {
-			let t = !!T || !!U.read("STORAGE_CDN_URL", i.cdnBaseUrl);
-			e.logger.info(`storage: provider=${x.name} presign=${x.presigns ? "yes" : "no"} publicUrl=${t ? "yes" : "no"} transforms=yes`, {
-				provider: x.name,
-				bucket: ue,
-				refStore: k ? "memory" : "custom"
-			}), x.name === "memory" && process.env.NODE_ENV !== "test" && e.logger.warn("storage: provider=memory — uploads are IN-MEMORY and LOST on restart. Set STORAGE_PROVIDER (filesystem / s3 / r2 / azure / gcs) for anything but throwaway dev. (Empty/placeholder storage env silently falls back to memory.)"), !t && !x.presigns && e.logger.warn("storage: no VOLTRO_PUBLIC_URL / STORAGE_CDN_URL and this provider can't presign — serve URLs are RELATIVE and will not resolve cross-origin (browser <img> / server-to-server AI fetches). Set VOLTRO_PUBLIC_URL to this api's absolute base URL.");
+		bindDataStore: async (t, n) => {
+			let i = s ? n?.connectionReference?.("objects", "storage") || e.connection : void 0;
+			await q.runPromise(oe(n?.connectionRegistry, i)), P = n?.storageReferenceProvider;
+			let a = {
+				storageInstance: r,
+				resolveNamespace: (e) => _.resolve(e).pipe(q.flatMap((e) => e.objectNamespace))
+			};
+			At(m), (w || T) && await te(t), (w || T) && await se(t), (w || !p && m.name === "database") && await o(t), w && (O.current = De(t, a)), T && (k.current = Ee(t, a)), w && T && (A.current = Me(t, a), j.current = t), p || m.bindDataStore?.(t);
+		},
+		onActivate: (t) => q.gen(function* () {
+			let n = s ? t.connectionReference?.("objects", "storage") || e.connection : void 0;
+			if (yield* oe(t.connectionRegistry, n), p) {
+				t.logger.info("storage: tenant-scoped named destination; resolved per request", { destination: h });
+				return;
+			}
+			let r = !!y || !!E.read("STORAGE_CDN_URL", e.cdnBaseUrl);
+			t.logger.info(`storage: provider=${m.name} presign=${m.presigns ? "yes" : "no"} publicUrl=${r ? "yes" : "no"} transforms=yes`, {
+				provider: m.name,
+				bucket: h,
+				refStore: w ? "memory" : "custom"
+			}), m.name === "memory" && process.env.NODE_ENV !== "test" && t.logger.warn("storage: provider=memory — uploads are IN-MEMORY and LOST on restart. Set STORAGE_PROVIDER to filesystem, s3, minio, azure or database and configure a durable destination."), !r && !m.presigns && t.logger.warn("storage: no VOLTRO_PUBLIC_URL / STORAGE_CDN_URL and this provider can't presign — serve URLs are RELATIVE and will not resolve cross-origin (browser <img> / server-to-server AI fetches). Set VOLTRO_PUBLIC_URL to this api's absolute base URL.");
 		}),
-		onDeactivate: () => v.void
+		onDeactivate: () => q.void
+	});
+	return $.set(nt, () => A.current === void 0 ? void 0 : {
+		service: F,
+		metadata: A.current,
+		bucket: h
+	}), nt;
+}, $ = /* @__PURE__ */ new WeakMap(), Wt = (e) => {
+	let t = e.filter((e) => $.has(e));
+	if (t.length !== 1) throw new g({
+		provider: "storage",
+		message: t.length ? "Storage objects are ambiguous; installed instances: " + t.map((e) => e.name).sort().join(", ") : "This app has no Storage plugin",
+		transient: !1
 	});
+	let n = $.get(t[0])();
+	if (n === void 0) throw new g({
+		provider: "storage",
+		message: "Storage objects need a bound data store with the default reference and grant stores",
+		transient: !1
+	});
+	return n;
 };
 //#endregion
-export { H as STORAGE_BLOBS_TABLE, V as STORAGE_GRANTS_TABLE, B as STORAGE_REFS_TABLE, Ue as STORAGE_USAGE_TABLE, e as StorageAccessDenied, t as StorageError, n as StorageRejected, r as StorageScanRejected, i as StorageService, qe as _voltroStorageBlobsTable, Ge as _voltroStorageGrantsTable, We as _voltroStorageRefsTable, Ke as _voltroStorageUsageTable, nr as appStorageProvider, Kn as assetRef, at as azureProvider, hn as buildStorageService, Le as bytesToStream, Kt as checkLimits, Un as clamavScanner, $e as clearStorageBuffer, Re as collectStream, Ie as concatBytes, rr as configuredStorageProvider, Ut as contentTypeAllowed, fn as dataStoreGrantStore, ln as dataStoreRefStore, it as databaseProvider, Yn as decodeDataUri, Qn as durabilityNotice, ht as editImage, Bn as encodeInstream, Gn as ffmpegTranscoder, tt as filesystemProvider, ze as fromNodeReadable, Ve as getObjectStream, yt as hashPassword, zn as makeStorageObjectMetadata, un as memoryGrantStore, et as memoryProvider, on as memoryRefStore, Vn as parseClamavResponse, lt as parseTransformParams, Zn as pathDurability, Xn as putAvatar, He as putObjectStream, Qe as readStorageBuffer, rn as refMatchesListQuery, ir as resolveStorageProvider, q as resolveStorageSecret, nt as s3Provider, tr as setActiveStorageProvider, Lt as signFinalizeTicket, Mt as signGrant, Vt as signMultipartTicket, zt as signResumableTicket, Ft as signUploadTicket, Gt as sniffMatches, ar as storageEgressOf, gr as storageInstanceName, bn as storageObjectLifecycleTables, _r as storagePlugin, In as storagePutIntentsTable, gn as storageServiceLayer, Be as toNodeReadable, vt as transformCached, pt as transformFallbackReason, mt as transformImage, Rt as verifyFinalizeTicket, Nt as verifyGrant, Ht as verifyMultipartTicket, bt as verifyPassword, Bt as verifyResumableTicket, It as verifyUploadTicket, qn as withStorage };
+export { c as STORAGE_BLOBS_TABLE, l as STORAGE_GRANTS_TABLE, a as STORAGE_REFERENCE_CATALOGUE_TABLE, u as STORAGE_REFS_TABLE, d as STORAGE_USAGE_TABLE, ne as StorageAccessDenied, ct as StorageAddress, Fe as StorageCustody, g as StorageError, re as StorageRejected, ie as StorageScanRejected, _ as StorageService, ee as _voltroStorageBlobsTable, f as _voltroStorageGrantsTable, p as _voltroStorageRefsTable, m as _voltroStorageUsageTable, Wt as appStorageObjects, jt as appStorageProvider, e as appStorageRouter, et as assetRef, y as assignStorageObjectNamespacesInTransaction, h as assignStorageReferenceInstancesInTransaction, D as azureProvider, Te as buildStorageService, b as bytesToStream, V as checkLimits, U as clamavScanner, O as clearStorageBuffer, x as collectStream, S as concatBytes, kt as configuredStorageProvider, ot as connectStorage, Ce as contentTypeAllowed, Ee as dataStoreGrantStore, De as dataStoreRefStore, k as databaseProvider, nt as decodeDataUri, it as durabilityNotice, ue as editImage, W as encodeInstream, o as ensureStorageReferenceCatalogue, r as existingFilesystemObjectNamespace, H as fetchIngestBody, K as ffmpegTranscoder, A as filesystemProvider, C as fromNodeReadable, ce as getObjectStream, F as hashPassword, ut as isStorageKey, t as makeStorageDestinationRouter, Me as makeStorageObjectMetadata, Oe as memoryGrantStore, j as memoryProvider, ke as memoryRefStore, G as parseClamavResponse, de as parseTransformParams, at as pathDurability, rt as putAvatar, w as putObjectStream, N as readStorageBuffer, Ae as refMatchesListQuery, se as requireStorageObjectNamespaces, X as resolveStorageProvider, L as resolveStorageSecret, Pe as retainedCaptureTables, P as s3Provider, ge as signFinalizeTicket, R as signGrant, _e as signMultipartTicket, ve as signResumableTicket, z as signUploadTicket, we as sniffMatches, dt as storageAddressIdentity, n as storageByteSecurityHeaders, Mt as storageEgressOf, Vt as storageInstanceName, oe as storageObjectLifecycleTables, i as storageObjectNamespace, Ut as storagePlugin, Ne as storagePutIntentsTable, v as storageRefAddress, s as storageReferenceCatalogueTable, je as storageServiceLayer, T as toNodeReadable, fe as transformCached, pe as transformFallbackReason, me as transformImage, ye as verifyFinalizeTicket, be as verifyGrant, B as verifyMultipartTicket, I as verifyPassword, xe as verifyResumableTicket, Se as verifyUploadTicket, tt as withStorage, st as withStorageKeyPrefix };