@voltro/plugin-storage 0.86.0 → 0.88.0

package/dist/service.js

@@ -1,25 +1,28 @@
-import { requireStorageReferenceScope as e, storageObjectNamespace as t, storageUploadTicketScope as n } from "./storageNamespaces.js";
-import { storageReferenceCatalogueId as r } from "./referenceCatalogue.js";
-import { STORAGE_GRANTS_TABLE as i, STORAGE_REFS_TABLE as a, STORAGE_USAGE_TABLE as o } from "./table.js";
+import { requireStorageReferenceScope as e, storageObjectNamespace as t, storageReferenceScopeFor as n, storageUploadTicketScope as r } from "./storageNamespaces.js";
+import { storageReferenceCatalogueId as i } from "./referenceCatalogue.js";
+import { STORAGE_GRANTS_TABLE as a, STORAGE_REFS_TABLE as o, STORAGE_USAGE_TABLE as s } from "./table.js";
 import "./storageReferenceInstances.js";
-import { StorageAccessDenied as s, StorageError as c, StorageRejected as l, StorageScanRejected as u, StorageService as d } from "./types.js";
-import { storageInteger as f, storageIntegerSum as p } from "./storageNumbers.js";
-import { getObjectStream as m } from "./streamBridge.js";
-import { storageMetadataError as h } from "./metadataError.js";
-import { evaluatePolicy as g, grantsAllow as _, hashPassword as v, resolveSubjectGroups as y } from "./access.js";
-import { signGrant as b } from "./grant.js";
-import { checkLimits as ee } from "./constraints.js";
-import { extractImageMetadata as te } from "./derivatives.js";
-import { fetchIngestBody as x, withIngestAbort as S } from "./ingest.js";
-import { makeStorageObjectWriter as C } from "./objectWriter.js";
-import { randomUUID as w } from "node:crypto";
-import { and as T, authoredError as E, column as D, contains as O, eq as k, generateId as A, isNull as j, or as M } from "@voltro/database";
-import { Effect as N, Exit as P, Layer as F, Schedule as I, Stream as L } from "effect";
-//#region src/service.ts
-var R = async (e) => {
+import { StorageAccessDenied as c, StorageError as l, StorageRejected as u, StorageScanRejected as d, StorageService as f, storageRefAddress as p } from "./types.js";
+import { storageInteger as m, storageIntegerSum as h } from "./storageNumbers.js";
+import { getObjectStream as g } from "./streamBridge.js";
+import { storageMetadataError as _ } from "./metadataError.js";
+import { evaluatePolicy as v, grantsAllow as y, hashPassword as ee, resolveSubjectGroups as b } from "./access.js";
+import { declareStorageSigningLifetime as x, signGrant as S } from "./grant.js";
+import { checkLimits as te } from "./constraints.js";
+import { extractImageMetadata as ne } from "./derivatives.js";
+import { assertRenditionOutput as re, makeRenditionProof as C, ownRenditionRef as w, readRenditionProof as T } from "./renditionProof.js";
+import { fetchIngestBody as E, withIngestAbort as D } from "./ingest.js";
+import { makeStorageObjectWriter as ie } from "./objectWriter.js";
+import { protectStorageReferences as ae } from "./physicalReferences.js";
+import { StorageAddress as O, storageKeyProblem as k } from "@voltro/kv/storage";
+import { Effect as A, Exit as oe, Layer as j, Schedule as M, Schema as N, Stream as se } from "effect";
+import { randomUUID as P } from "node:crypto";
+import { and as F, authoredError as I, column as L, contains as R, eq as z, generateId as B, isNull as V, or as H } from "@voltro/database";
+// src/service.ts
+var U = async (e) => {
 	let { createHash: t } = await import("node:crypto");
 	return t("sha256").update(e).digest("hex");
-}, z = (e, t, n) => `${e?.replace(/\/+$/, "") ?? ""}${n}/${t}`, B = (e) => {
+}, ce = (e, t, n) => `${e?.replace(/\/+$/, "") ?? ""}${n}/${t}`, W = (e) => {
 	let t = /* @__PURE__ */ new Map(), n = {
 		public: 0,
 		private: 0
@@ -29,13 +32,13 @@ var R = async (e) => {
 			count: 0,
 			bytes: 0
 		};
-		i.count = p(i.count, r.count, "ref count"), i.bytes = p(i.bytes, r.bytes, "usage bytes"), t.set(e, i), r.visibility === "public" ? n.public = p(n.public, r.count, "public ref count") : n.private = p(n.private, r.count, "private ref count");
+		i.count = h(i.count, r.count, "ref count"), i.bytes = h(i.bytes, r.bytes, "usage bytes"), t.set(e, i), r.visibility === "public" ? n.public = h(n.public, r.count, "public ref count") : n.private = h(n.private, r.count, "private ref count");
 	}
 	return {
 		byTenant: Object.fromEntries(t),
 		visibility: n
 	};
-}, V = (e, t) => {
+}, G = (e, t) => {
 	if (t.search && ![
 		e.id,
 		e.key,
@@ -52,12 +55,18 @@ var R = async (e) => {
 		if (!t.tags.every((e) => n.includes(e))) return !1;
 	}
 	return !0;
-}, H = (e) => e ?? "global", U = () => {
+}, K = (e) => e === null ? "global" : e === "global" ? "%67lobal" : e.startsWith("%") ? `%${e}` : e, q = () => {
 	let e = /* @__PURE__ */ new Map(), n = /* @__PURE__ */ new Map();
 	return {
-		catalogueId: N.succeed(t(["memory-reference-catalogue", w()])),
-		statistics: () => N.try({
-			try: () => B((function* () {
+		listObjectReferences: () => A.sync(() => [...e.values()].map((e) => ({
+			bucket: e.bucket,
+			tenantId: e.tenantId,
+			key: e.key,
+			visibility: e.visibility
+		}))),
+		catalogueId: A.succeed(t(["memory-reference-catalogue", P()])),
+		statistics: () => A.try({
+			try: () => W((function* () {
 				for (let t of e.values()) yield {
 					tenantId: t.tenantId,
 					visibility: t.visibility,
@@ -65,46 +74,49 @@ var R = async (e) => {
 					bytes: t.size
 				};
 			})()),
-			catch: (e) => h(e, "refstore")
+			catch: (e) => _(e, "refstore")
 		}),
-		insert: (t) => N.try({
+		insert: (t) => A.try({
 			try: () => {
-				f(t.size, "ref size"), e.set(t.id, t);
+				m(t.size, "ref size"), e.set(t.id, w(t));
 			},
-			catch: (e) => h(e, "refstore")
+			catch: (e) => _(e, "refstore")
+		}),
+		getById: (t) => A.sync(() => {
+			let n = e.get(t);
+			return n === void 0 ? null : w(n);
 		}),
-		getById: (t) => N.sync(() => e.get(t) ?? null),
-		delete: (t) => N.sync(() => e.delete(t)),
-		listRecent: (t) => N.sync(() => [...e.values()].sort((e, t) => t.createdAt.getTime() - e.createdAt.getTime() || t.id.localeCompare(e.id)).slice(0, t)),
-		countByKey: (t, n) => N.sync(() => [...e.values()].filter((e) => e.bucket === t && e.key === n).length),
-		countPublicByKey: (t, n) => N.sync(() => [...e.values()].filter((e) => e.bucket === t && e.key === n && e.visibility === "public").length),
-		setVisibility: (t, n) => N.sync(() => {
+		delete: (t) => A.sync(() => e.delete(t)),
+		listRecent: (t) => A.sync(() => [...e.values()].sort((e, t) => t.createdAt.getTime() - e.createdAt.getTime() || t.id.localeCompare(e.id)).slice(0, t).map(w)),
+		countByAddress: (t) => A.sync(() => [...e.values()].filter((e) => e.bucket === t.destination && e.tenantId === t.tenantId && e.key === t.key).length),
+		countPublicByAddress: (t) => A.sync(() => [...e.values()].filter((e) => e.bucket === t.destination && e.tenantId === t.tenantId && e.key === t.key && e.visibility === "public").length),
+		setVisibility: (t, n) => A.sync(() => {
 			let r = e.get(t);
 			if (r === void 0) return null;
 			let i = {
 				...r,
 				visibility: n
 			};
-			return e.set(t, i), i;
+			return e.set(t, i), w(i);
 		}),
-		usageByTenant: (t) => N.try({
+		usageByTenant: (t) => A.try({
 			try: () => {
 				let n = 0, r = 0;
-				for (let i of e.values()) (i.tenantId ?? null) === (t ?? null) && (n = p(n, i.size, "usage bytes"), r++);
+				for (let i of e.values()) (i.tenantId ?? null) === (t ?? null) && (n = h(n, i.size, "usage bytes"), r++);
 				return {
 					bytes: n,
 					count: r
 				};
 			},
-			catch: (e) => h(e, "refstore")
+			catch: (e) => _(e, "refstore")
 		}),
-		consumeUsage: (e, t, r) => N.try({
+		consumeUsage: (e, t, r) => A.try({
 			try: () => {
-				let i = H(e), a = n.get(i) ?? {
+				let i = K(e), a = n.get(i) ?? {
 					bytes: 0,
 					count: 0
 				};
-				f(t.bytes, "usage byte delta"), f(t.count, "usage count delta");
+				m(t.bytes, "usage byte delta"), m(t.count, "usage count delta");
 				let o = Number.isSafeInteger(a.bytes + t.bytes) && Number.isSafeInteger(a.count + t.count) && (r?.maxBytes === void 0 || a.bytes + t.bytes <= r.maxBytes) && (r?.maxCount === void 0 || a.count + t.count <= r.maxCount);
 				return o && n.set(i, {
 					bytes: a.bytes + t.bytes,
@@ -115,48 +127,52 @@ var R = async (e) => {
 					count: a.count
 				};
 			},
-			catch: (e) => h(e, "refstore")
+			catch: (e) => _(e, "refstore")
 		}),
-		releaseUsage: (e, t) => N.try({
+		releaseUsage: (e, t) => A.try({
 			try: () => {
-				let r = H(e), i = n.get(r);
-				f(t.bytes, "usage byte delta"), f(t.count, "usage count delta"), i && n.set(r, {
+				let r = K(e), i = n.get(r);
+				m(t.bytes, "usage byte delta"), m(t.count, "usage count delta"), i && n.set(r, {
 					bytes: Math.max(0, i.bytes - t.bytes),
 					count: Math.max(0, i.count - t.count)
 				});
 			},
-			catch: (e) => h(e, "refstore")
+			catch: (e) => _(e, "refstore")
 		}),
-		listByDerivedFrom: (t) => N.sync(() => [...e.values()].filter((e) => (e.derivedFrom ?? null) === t)),
-		listRefs: (t) => N.sync(() => [...e.values()].filter((e) => V(e, t)).sort((e, t) => t.createdAt.getTime() - e.createdAt.getTime() || t.id.localeCompare(e.id)).slice(t.offset, t.offset + t.limit))
+		listByDerivedFrom: (t) => A.sync(() => [...e.values()].filter((e) => (e.derivedFrom ?? null) === t).map(w)),
+		listRefs: (t) => A.sync(() => [...e.values()].filter((e) => G(e, t)).sort((e, t) => t.createdAt.getTime() - e.createdAt.getTime() || t.id.localeCompare(e.id)).slice(t.offset, t.offset + t.limit).map(w))
 	};
-}, W = (e) => Array.isArray(e) && e.every((e) => typeof e == "string") ? e : null, G = (e) => ({
-	id: String(e.id),
-	tenantId: e.tenantId ?? null,
-	ownerId: e.ownerId ?? null,
-	bucket: String(e.bucket),
-	key: String(e.key),
-	contentType: String(e.contentType),
-	size: f(e.size, "ref size"),
-	checksum: String(e.checksum),
-	visibility: e.visibility === "public" ? "public" : "private",
-	accessPolicy: e.accessPolicy ?? null,
-	passwordHash: e.passwordHash ?? null,
-	createdAt: e.createdAt instanceof Date ? e.createdAt : new Date(String(e.createdAt)),
-	width: e.width ?? null,
-	height: e.height ?? null,
-	duration: e.duration ?? null,
-	placeholder: e.placeholder ?? null,
-	folder: e.folder ?? null,
-	tags: W(e.tags),
-	alt: e.alt ?? null,
-	caption: e.caption ?? null,
-	derivedFrom: e.derivedFrom ?? null,
-	kind: e.kind ?? null
-}), K = (e) => N.tryPromise({
+}, le = (e) => Array.isArray(e) && e.every((e) => typeof e == "string") ? e : null, J = (e) => {
+	let t = {
+		id: String(e.id),
+		tenantId: e.tenantId ?? null,
+		ownerId: e.ownerId ?? null,
+		bucket: String(e.bucket),
+		key: String(e.key),
+		contentType: String(e.contentType),
+		size: m(e.size, "ref size"),
+		checksum: String(e.checksum),
+		visibility: e.visibility === "public" ? "public" : "private",
+		accessPolicy: e.accessPolicy ?? null,
+		passwordHash: e.passwordHash ?? null,
+		createdAt: e.createdAt instanceof Date ? e.createdAt : new Date(String(e.createdAt)),
+		width: e.width ?? null,
+		height: e.height ?? null,
+		duration: e.duration ?? null,
+		placeholder: e.placeholder ?? null,
+		folder: e.folder ?? null,
+		tags: le(e.tags),
+		alt: e.alt ?? null,
+		caption: e.caption ?? null,
+		derivedFrom: e.derivedFrom ?? null,
+		kind: e.kind ?? null,
+		...e.renditionProof == null ? {} : { renditionProof: T(e.renditionProof) }
+	};
+	return t.renditionProof !== void 0 && t.renditionProof !== null && re(t.renditionProof, t), t;
+}, Y = (e) => A.tryPromise({
 	try: e,
-	catch: (e) => h(e, "refstore", !0)
-}), q = async (e, t) => (await e.query({
+	catch: (e) => _(e, "refstore", !0)
+}), X = async (e, t) => (await e.query({
 	table: "_voltro_storage_usage",
 	predicate: {
 		column: "tenantId",
@@ -167,74 +183,204 @@ var R = async (e) => {
 	take: 1,
 	skip: void 0,
 	projection: void 0
-}))[0] ?? null, J = (t, n) => {
-	let i = Object.freeze({ ...n });
-	return e(i), {
-		catalogueId: K(() => r(t, i)),
-		statistics: () => K(async () => B((await t.query({
-			table: a,
-			predicate: T(k("storageInstance", i.storageInstance), k("objectNamespace", i.objectNamespace)),
+}))[0] ?? null, Z = (r, a) => {
+	let c = Object.freeze({ ...a }), l = "resolveNamespace" in c;
+	if (!c.storageInstance.trim()) throw I("Storage requires an explicit plugin instance");
+	l || e(c);
+	let u = l ? z("storageInstance", c.storageInstance) : F(z("storageInstance", c.storageInstance), z("objectNamespace", c.objectNamespace)), d = async (e) => {
+		if (e.storageInstance !== c.storageInstance) return !1;
+		let t = N.decodeUnknownSync(O)({
+			destination: e.bucket,
+			tenantId: e.tenantId,
+			key: e.key
+		}), r = await A.runPromise(n(c, t));
+		return e.objectNamespace === r.objectNamespace;
+	}, f = async function* (e) {
+		let t = e.take, n = e.skip ?? 0;
+		if (!l) {
+			yield* await r.query(e);
+			return;
+		}
+		let i = 0;
+		for (let a = 0;; a += 256) {
+			let o = await r.query({
+				...e,
+				take: 256,
+				skip: a,
+				projection: void 0
+			});
+			for (let e of o) if (await d(e) && !(i++ < n)) {
+				if (t !== void 0 && i > n + t) return;
+				yield e;
+			}
+			if (o.length < 256) return;
+		}
+	}, g = async (e) => {
+		let t = [];
+		for await (let n of f(e)) t.push(n);
+		return t;
+	};
+	return {
+		catalogueId: Y(() => "resolveNamespace" in c ? i(r).then((e) => t([
+			"reference-view",
+			e,
+			c.storageInstance
+		])) : i(r, c)),
+		hasObjectReservation: (e, t) => Y(async () => (await r.query({
+			table: "_voltro_storage_object_heads",
+			predicate: F(z("objectNamespace", e), z("key", t)),
+			order: [],
+			take: 1,
+			skip: void 0,
+			projection: ["id"]
+		})).length > 0),
+		listObjectReferences: () => Y(async () => (await r.query({
+			table: o,
+			predicate: void 0,
 			order: [],
 			take: void 0,
 			skip: void 0,
-			projection: void 0,
-			groupBy: ["tenantId", "visibility"],
-			aggregations: [
-				D("tenantId"),
-				D("visibility"),
-				{
-					op: "count",
-					alias: "count"
-				},
-				{
-					op: "sum",
-					column: "size",
-					alias: "bytes"
-				}
+			projection: [
+				"bucket",
+				"tenantId",
+				"key",
+				"visibility",
+				"storageInstance",
+				"objectNamespace"
 			]
-		})).map((e) => ({
-			tenantId: e.tenantId == null ? null : String(e.tenantId),
-			visibility: String(e.visibility),
-			count: f(e.count, "ref count"),
-			bytes: f(e.bytes ?? 0, "usage bytes")
-		})))),
-		insert: (e) => K(() => t.insert(a, {
-			...e,
-			storageInstance: i.storageInstance,
-			objectNamespace: i.objectNamespace,
-			size: String(f(e.size, "ref size"))
+		})).map((t) => {
+			let n = N.decodeUnknownSync(O)({
+				destination: t.bucket,
+				tenantId: t.tenantId,
+				key: t.key
+			}), r = N.decodeUnknownSync(N.Struct({
+				storageInstance: N.String,
+				objectNamespace: N.String
+			}))(t);
+			return e(r), {
+				...r,
+				bucket: n.destination,
+				tenantId: n.tenantId,
+				key: n.key,
+				visibility: N.decodeUnknownSync(N.Literals(["public", "private"]))(t.visibility)
+			};
 		})),
-		getById: (e) => K(async () => {
-			let n = await t.query({
-				table: a,
-				predicate: T(T(k("storageInstance", i.storageInstance), k("objectNamespace", i.objectNamespace)), k("id", e)),
+		statistics: () => Y(async () => {
+			if (l) {
+				let e = /* @__PURE__ */ new Map();
+				for await (let t of f({
+					table: o,
+					predicate: u,
+					order: [{
+						column: "id",
+						direction: "asc"
+					}],
+					take: void 0,
+					skip: void 0,
+					projection: void 0
+				})) {
+					let n = J(t), r = JSON.stringify([n.tenantId, n.visibility]), i = e.get(r) ?? {
+						tenantId: n.tenantId,
+						visibility: n.visibility,
+						count: 0,
+						bytes: 0
+					};
+					i.count = h(i.count, 1, "ref count"), i.bytes = h(i.bytes, n.size, "usage bytes"), e.set(r, i);
+				}
+				return W(e.values());
+			}
+			return W((await r.query({
+				table: o,
+				predicate: u,
+				order: [],
+				take: void 0,
+				skip: void 0,
+				projection: void 0,
+				groupBy: ["tenantId", "visibility"],
+				aggregations: [
+					L("tenantId"),
+					L("visibility"),
+					{
+						op: "count",
+						alias: "count"
+					},
+					{
+						op: "sum",
+						column: "size",
+						alias: "bytes"
+					}
+				]
+			})).map((e) => ({
+				tenantId: e.tenantId == null ? null : String(e.tenantId),
+				visibility: String(e.visibility),
+				count: m(e.count, "ref count"),
+				bytes: m(e.bytes ?? 0, "usage bytes")
+			})));
+		}),
+		insert: (e) => n(c, p(e)).pipe(A.flatMap((t) => Y(() => r.insert(o, {
+			...w(e),
+			...t,
+			size: String(m(e.size, "ref size"))
+		})))),
+		getById: (e) => Y(async () => {
+			let t = await r.query({
+				table: o,
+				predicate: F(u, z("id", e)),
 				order: [],
 				take: 1,
 				skip: void 0,
 				projection: void 0
 			});
-			return n[0] ? G(n[0]) : null;
+			return t[0] && await d(t[0]) ? J(t[0]) : null;
 		}),
-		delete: (e) => K(async () => await t.deleteMany(a, { where: T(T(k("storageInstance", i.storageInstance), k("objectNamespace", i.objectNamespace)), k("id", e)) }) > 0),
-		listRecent: (e) => K(async () => (await t.query({
-			table: a,
-			predicate: T(k("storageInstance", i.storageInstance), k("objectNamespace", i.objectNamespace)),
+		delete: (e) => Y(l ? () => r.transactional(async (t) => {
+			let n = await t.query({
+				table: o,
+				predicate: F(u, z("id", e)),
+				lock: "update",
+				order: [],
+				take: 1,
+				skip: void 0,
+				projection: void 0
+			});
+			return !n[0] || !await d(n[0]) ? !1 : await t.deleteMany(o, { where: F(u, z("objectNamespace", n[0].objectNamespace), z("id", e)) }) > 0;
+		}) : async () => await r.deleteMany(o, { where: F(u, z("id", e)) }) > 0),
+		listRecent: (e) => Y(async () => (await g({
+			table: o,
+			predicate: u,
 			order: [{
 				column: "createdAt",
 				direction: "desc"
+			}, {
+				column: "id",
+				direction: "desc"
 			}],
 			take: e,
 			skip: void 0,
 			projection: void 0
-		})).map(G)),
-		countByKey: (e, n) => K(async () => {
-			let e = await t.query({
-				table: a,
-				predicate: { and: [k("objectNamespace", i.objectNamespace), {
-					column: "key",
-					op: "eq",
-					value: n
-				}] },
+		})).map(J)),
+		countByAddress: (e) => n(c, e).pipe(A.flatMap((t) => Y(async () => {
+			let n = await r.query({
+				table: o,
+				predicate: { and: [
+					u,
+					z("objectNamespace", t.objectNamespace),
+					{
+						column: "bucket",
+						op: "eq",
+						value: e.destination
+					},
+					{
+						column: "tenantId",
+						op: "eq",
+						value: e.tenantId
+					},
+					{
+						column: "key",
+						op: "eq",
+						value: e.key
+					}
+				] },
 				order: [],
 				take: void 0,
 				skip: void 0,
@@ -243,25 +389,29 @@ var R = async (e) => {
 					op: "count",
 					alias: "count"
 				}]
-			}), r = f(e[0]?.count ?? 0, "ref count");
-			return r === 0 ? (await t.query({
-				table: "_voltro_storage_object_heads",
-				predicate: T(k("objectNamespace", i.objectNamespace), k("key", n)),
-				order: [],
-				take: 1,
-				skip: void 0,
-				projection: ["id"]
-			})).length : r;
-		}),
-		countPublicByKey: (e, n) => K(async () => {
-			let e = await t.query({
-				table: a,
+			});
+			return m(n[0]?.count ?? 0, "ref count");
+		}))),
+		countPublicByAddress: (e) => n(c, e).pipe(A.flatMap((t) => Y(async () => {
+			let n = await r.query({
+				table: o,
 				predicate: { and: [
-					k("objectNamespace", i.objectNamespace),
+					u,
+					z("objectNamespace", t.objectNamespace),
+					{
+						column: "bucket",
+						op: "eq",
+						value: e.destination
+					},
+					{
+						column: "tenantId",
+						op: "eq",
+						value: e.tenantId
+					},
 					{
 						column: "key",
 						op: "eq",
-						value: n
+						value: e.key
 					},
 					{
 						column: "visibility",
@@ -278,25 +428,26 @@ var R = async (e) => {
 					alias: "count"
 				}]
 			});
-			return f(e[0]?.count ?? 0, "ref count");
-		}),
-		setVisibility: (e, n) => K(() => t.transactional(async (t) => {
-			if ((await t.query({
-				table: "_voltro_storage_refs",
-				predicate: T(T(k("storageInstance", i.storageInstance), k("objectNamespace", i.objectNamespace)), k("id", e)),
+			return m(n[0]?.count ?? 0, "ref count");
+		}))),
+		setVisibility: (e, t) => Y(() => r.transactional(async (n) => {
+			let r = await n.query({
+				table: o,
+				predicate: F(u, z("id", e)),
 				lock: "update",
 				order: [],
 				take: 1,
 				skip: void 0,
-				projection: ["id"]
-			})).length === 0) return null;
-			let r = await t.update(a, e, { visibility: n });
-			return r ? G(r) : null;
+				projection: void 0
+			});
+			if (!r[0] || !await d(r[0])) return null;
+			let i = await n.update(o, e, { visibility: t });
+			return i ? J(i) : null;
 		})),
-		usageByTenant: (e) => K(async () => {
-			let n = await t.query({
-				table: a,
-				predicate: e === null ? j("tenantId") : k("tenantId", e),
+		usageByTenant: (e) => Y(async () => {
+			let t = await r.query({
+				table: o,
+				predicate: e === null ? V("tenantId") : z("tenantId", e),
 				order: [],
 				take: void 0,
 				skip: void 0,
@@ -323,91 +474,94 @@ var R = async (e) => {
 					}
 				]
 			});
-			return f(n[0]?.count ?? 0, "ref count") > 0 && (f(n[0]?.minSize, "ref size"), f(n[0]?.maxSize, "ref size")), {
-				bytes: f(n[0]?.bytes ?? 0, "usage bytes"),
-				count: f(n[0]?.count ?? 0, "ref count")
+			return m(t[0]?.count ?? 0, "ref count") > 0 && (m(t[0]?.minSize, "ref size"), m(t[0]?.maxSize, "ref size")), {
+				bytes: m(t[0]?.bytes ?? 0, "usage bytes"),
+				count: m(t[0]?.count ?? 0, "ref count")
 			};
 		}),
-		consumeUsage: (e, n, r) => K(async () => {
-			let i = H(e);
-			f(n.bytes, "usage byte delta"), f(n.count, "usage count delta");
+		consumeUsage: (e, t, n) => Y(async () => {
+			let i = K(e);
+			m(t.bytes, "usage byte delta"), m(t.count, "usage count delta");
 			for (let e = 0; e < 32; e++) {
 				e > 0 && await new Promise((t) => setTimeout(t, e));
-				let a = await q(t, i), s = a ? f(a.bytes, "usage bytes") : 0, c = a ? f(a.count, "ref count") : 0;
-				if (!(Number.isSafeInteger(s + n.bytes) && Number.isSafeInteger(c + n.count) && (r?.maxBytes === void 0 || s + n.bytes <= r.maxBytes) && (r?.maxCount === void 0 || c + n.count <= r.maxCount))) return {
+				let a = await X(r, i), o = a ? m(a.bytes, "usage bytes") : 0, c = a ? m(a.count, "ref count") : 0;
+				if (!(Number.isSafeInteger(o + t.bytes) && Number.isSafeInteger(c + t.count) && (n?.maxBytes === void 0 || o + t.bytes <= n.maxBytes) && (n?.maxCount === void 0 || c + t.count <= n.maxCount))) return {
 					allowed: !1,
-					bytes: s,
+					bytes: o,
 					count: c
 				};
 				if (a) {
-					if (await t.updateMany("_voltro_storage_usage", {
-						bytes: String(s + n.bytes),
-						count: String(c + n.count),
+					if (await r.updateMany("_voltro_storage_usage", {
+						bytes: String(o + t.bytes),
+						count: String(c + t.count),
 						updatedAt: /* @__PURE__ */ new Date()
-					}, { where: T(k("id", String(a.id)), k("bytes", a.bytes), k("count", a.count)) }) === 1) return {
+					}, { where: F(z("id", String(a.id)), z("bytes", a.bytes), z("count", a.count)) }) === 1) return {
 						allowed: !0,
-						bytes: s,
+						bytes: o,
 						count: c
 					};
 				} else {
-					let e = A({
+					let e = B({
 						kind: "typeid",
 						prefix: "susage"
-					}, o), r = await t.insertIgnore(o, {
+					}, s), n = await r.insertIgnore(s, {
 						id: e,
 						tenantId: i,
-						bytes: String(n.bytes),
-						count: String(n.count),
+						bytes: String(t.bytes),
+						count: String(t.count),
 						updatedAt: /* @__PURE__ */ new Date()
 					}, { conflictColumns: ["tenantId"] });
-					if (String(r.id) === e) return {
+					if (String(n.id) === e) return {
 						allowed: !0,
 						bytes: 0,
 						count: 0
 					};
 				}
 			}
-			throw E("Storage quota reservation contended after 32 attempts; retry");
+			throw I("Storage quota reservation contended after 32 attempts; retry");
 		}),
-		releaseUsage: (e, n) => K(async () => {
-			let r = H(e);
-			f(n.bytes, "usage byte delta"), f(n.count, "usage count delta");
+		releaseUsage: (e, t) => Y(async () => {
+			let n = K(e);
+			m(t.bytes, "usage byte delta"), m(t.count, "usage count delta");
 			for (let e = 0; e < 32; e++) {
 				e > 0 && await new Promise((t) => setTimeout(t, e));
-				let i = await q(t, r);
+				let i = await X(r, n);
 				if (!i) return;
-				let a = f(i.bytes, "usage bytes"), o = f(i.count, "ref count");
-				if (await t.updateMany("_voltro_storage_usage", {
-					bytes: String(Math.max(0, a - n.bytes)),
-					count: String(Math.max(0, o - n.count)),
+				let a = m(i.bytes, "usage bytes"), o = m(i.count, "ref count");
+				if (await r.updateMany("_voltro_storage_usage", {
+					bytes: String(Math.max(0, a - t.bytes)),
+					count: String(Math.max(0, o - t.count)),
 					updatedAt: /* @__PURE__ */ new Date()
-				}, { where: T(k("id", String(i.id)), k("bytes", i.bytes), k("count", i.count)) }) === 1) return;
+				}, { where: F(z("id", String(i.id)), z("bytes", i.bytes), z("count", i.count)) }) === 1) return;
 			}
-			throw E("Storage quota release contended after 32 attempts; retry");
+			throw I("Storage quota release contended after 32 attempts; retry");
 		}),
-		listByDerivedFrom: (e) => K(async () => (await t.query({
-			table: a,
-			predicate: T(T(k("storageInstance", i.storageInstance), k("objectNamespace", i.objectNamespace)), k("derivedFrom", e)),
+		listByDerivedFrom: (e) => Y(async () => (await g({
+			table: o,
+			predicate: F(u, z("derivedFrom", e)),
 			order: [{
 				column: "createdAt",
 				direction: "asc"
+			}, {
+				column: "id",
+				direction: "asc"
 			}],
 			take: void 0,
 			skip: void 0,
 			projection: void 0
-		})).map(G)),
-		listRefs: (e) => K(async () => {
-			let n = [T(k("storageInstance", i.storageInstance), k("objectNamespace", i.objectNamespace))];
-			e.tenantId !== void 0 && n.push(e.tenantId === null ? j("tenantId") : k("tenantId", e.tenantId)), e.ownerId !== void 0 && n.push(k("ownerId", e.ownerId)), e.search && n.push(M(...[
+		})).map(J)),
+		listRefs: (e) => Y(async () => {
+			let t = [u];
+			e.tenantId !== void 0 && t.push(e.tenantId === null ? V("tenantId") : z("tenantId", e.tenantId)), e.ownerId !== void 0 && t.push(z("ownerId", e.ownerId)), e.search && t.push(H(...[
 				"id",
 				"key",
 				"contentType",
 				"ownerId",
 				"tenantId"
-			].map((t) => O(t, e.search)))), e.includeDerived || n.push(j("derivedFrom"));
-			let r = e.folder === void 0 && e.tags.length === 0, o = n.length ? T(...n) : void 0, s = await t.query({
-				table: a,
-				predicate: o,
+			].map((t) => R(t, e.search)))), e.includeDerived || t.push(V("derivedFrom"));
+			let n = e.folder === void 0 && e.tags.length === 0, r = t.length ? F(...t) : void 0, i = await g({
+				table: o,
+				predicate: r,
 				order: [{
 					column: "createdAt",
 					direction: "desc"
@@ -415,29 +569,29 @@ var R = async (e) => {
 					column: "id",
 					direction: "desc"
 				}],
-				take: r ? e.limit : void 0,
-				skip: r ? e.offset : void 0,
+				take: n ? e.limit : void 0,
+				skip: n ? e.offset : void 0,
 				projection: void 0
 			});
-			return r ? s.map(G) : s.map(G).filter((t) => V(t, e)).slice(e.offset, e.offset + e.limit);
+			return n ? i.map(J) : i.map(J).filter((t) => G(t, e)).slice(e.offset, e.offset + e.limit);
 		})
 	};
-}, Y = () => {
+}, Q = () => {
 	let e = /* @__PURE__ */ new Map();
 	return {
-		insert: (t) => N.sync(() => {
+		insert: (t) => A.sync(() => {
 			e.set(t.id, t);
 		}),
-		delete: (t) => N.sync(() => {
+		delete: (t) => A.sync(() => {
 			e.delete(t);
 		}),
-		getById: (t) => N.sync(() => e.get(t) ?? null),
-		listByRef: (t) => N.sync(() => [...e.values()].filter((e) => e.refId === t)),
-		deleteByRef: (t) => N.sync(() => {
+		getById: (t) => A.sync(() => e.get(t) ?? null),
+		listByRef: (t) => A.sync(() => [...e.values()].filter((e) => e.refId === t)),
+		deleteByRef: (t) => A.sync(() => {
 			for (let [n, r] of e) r.refId === t && e.delete(n);
 		})
 	};
-}, X = (e) => ({
+}, $ = (e) => ({
 	id: String(e.id),
 	refId: String(e.refId),
 	principalType: e.principalType,
@@ -446,28 +600,28 @@ var R = async (e) => {
 	createdAt: e.createdAt instanceof Date ? e.createdAt : new Date(String(e.createdAt)),
 	expiresAt: e.expiresAt ? e.expiresAt instanceof Date ? e.expiresAt : new Date(String(e.expiresAt)) : null,
 	createdBy: e.createdBy ?? null
-}), Z = (t, n) => {
+}), ue = (t, n) => {
 	let r = Object.freeze({ ...n });
 	return e(r), {
-		insert: (e) => K(() => t.insert(i, {
+		insert: (e) => Y(() => t.insert(a, {
 			...e,
 			...r
 		})),
-		delete: (e) => K(() => t.deleteMany(i, { where: T(T(k("storageInstance", r.storageInstance), k("objectNamespace", r.objectNamespace)), k("id", e)) })).pipe(N.asVoid),
-		getById: (e) => K(async () => {
+		delete: (e) => Y(() => t.deleteMany(a, { where: F(F(z("storageInstance", r.storageInstance), z("objectNamespace", r.objectNamespace)), z("id", e)) })).pipe(A.asVoid),
+		getById: (e) => Y(async () => {
 			let n = (await t.query({
-				table: i,
-				predicate: T(T(k("storageInstance", r.storageInstance), k("objectNamespace", r.objectNamespace)), k("id", e)),
+				table: a,
+				predicate: F(F(z("storageInstance", r.storageInstance), z("objectNamespace", r.objectNamespace)), z("id", e)),
 				order: [],
 				take: 1,
 				skip: void 0,
 				projection: void 0
 			}))[0];
-			return n ? X(n) : null;
+			return n ? $(n) : null;
 		}),
-		listByRef: (e) => K(async () => (await t.query({
-			table: i,
-			predicate: T(T(k("storageInstance", r.storageInstance), k("objectNamespace", r.objectNamespace)), k("refId", e)),
+		listByRef: (e) => Y(async () => (await t.query({
+			table: a,
+			predicate: F(F(z("storageInstance", r.storageInstance), z("objectNamespace", r.objectNamespace)), z("refId", e)),
 			order: [{
 				column: "createdAt",
 				direction: "desc"
@@ -475,382 +629,523 @@ var R = async (e) => {
 			take: void 0,
 			skip: void 0,
 			projection: void 0
-		})).map(X)),
-		deleteByRef: (e) => K(async () => {
+		})).map($)),
+		deleteByRef: (e) => Y(async () => {
 			let n = await t.query({
-				table: i,
-				predicate: T(T(k("storageInstance", r.storageInstance), k("objectNamespace", r.objectNamespace)), k("refId", e)),
+				table: a,
+				predicate: F(F(z("storageInstance", r.storageInstance), z("objectNamespace", r.objectNamespace)), z("refId", e)),
 				order: [],
 				take: void 0,
 				skip: void 0,
 				projection: void 0
 			});
-			for (let e of n) await t.delete(i, String(e.id));
+			for (let e of n) await t.delete(a, String(e.id));
 		})
 	};
-}, Q = () => A({
+}, de = (e, t) => {
+	let r = Object.freeze({ ...t });
+	if (!("resolveNamespace" in r)) return ue(e, r);
+	let i = Z(e, r), o = (t) => i.getById(t).pipe(A.flatMap((t) => t === null ? A.succeed(void 0) : n(r, p(t)).pipe(A.map((t) => ue(e, t))))), s = (t) => Y(() => e.query({
+		table: a,
+		predicate: F(z("storageInstance", r.storageInstance), z("id", t)),
+		order: [],
+		take: 1,
+		skip: void 0,
+		projection: ["refId"]
+	})).pipe(A.flatMap((e) => e[0] === void 0 ? A.succeed(void 0) : o(String(e[0].refId))));
+	return {
+		insert: (e) => o(e.refId).pipe(A.flatMap((t) => t === void 0 ? A.fail(new l({
+			provider: "metadata",
+			message: "Storage grant reference is outside the current destination view",
+			transient: !1,
+			status: 409
+		})) : t.insert(e))),
+		delete: (e) => s(e).pipe(A.flatMap((t) => t === void 0 ? A.void : t.delete(e))),
+		getById: (e) => s(e).pipe(A.flatMap((t) => t === void 0 ? A.succeed(null) : t.getById(e))),
+		listByRef: (e) => o(e).pipe(A.flatMap((t) => t === void 0 ? A.succeed([]) : t.listByRef(e))),
+		deleteByRef: (e) => o(e).pipe(A.flatMap((t) => t === void 0 ? A.void : t.deleteByRef(e)))
+	};
+}, fe = () => B({
 	kind: "typeid",
 	prefix: "file"
-}, a), ne = () => A({
+}, o), pe = () => B({
 	kind: "typeid",
 	prefix: "grant"
-}, i), $ = (e) => {
-	let { provider: t, refStore: r, grantStore: i, bucket: o } = e, d = e.access ?? {}, f = e.attempts ?? 3, p = e.urlExpiresInSec ?? 3600, w = (t) => z(e.publicBaseUrl, t, e.httpPath ?? "/_voltro/storage"), T = I.max([I.recurs(Math.max(0, f - 1)), I.exponential("100 millis")]).pipe(I.while(({ input: e }) => e.transient)), E = (t, n, r) => [
+}, a), me = (e) => {
+	let { provider: n, refStore: i, grantStore: a } = e, s = (t) => N.decodeUnknownEffect(O)(p(t)).pipe(A.mapError(() => new l({
+		provider: "storage",
+		message: "Invalid stored object address",
+		transient: !1
+	})), A.flatMap((r) => e.destinations === void 0 ? t.bucket === e.bucket ? A.succeed(n) : A.fail(new l({
+		provider: "storage",
+		message: "Stored object destination is not configured",
+		transient: !1
+	})) : e.destinations.resolve(r))), f = (t) => ae(t, i, (e) => s({
+		bucket: e.destination,
+		tenantId: e.tenantId,
+		key: e.key
+	}), e.resolveObjectReference), m = (e) => s(e).pipe(A.map(f)), h = (t, r, i) => N.decodeUnknownEffect(O)({
+		destination: i ?? e.bucket,
+		tenantId: t,
+		key: r
+	}).pipe(A.mapError(() => new l({
+		provider: "storage",
+		message: "Invalid new object address",
+		transient: !1,
+		status: 400
+	})), A.flatMap(() => i === void 0 ? e.destinations === void 0 ? A.succeed({
+		destination: e.bucket,
+		provider: n
+	}) : e.destinations.select(t) : s({
+		bucket: i,
+		tenantId: t,
+		key: r
+	}).pipe(A.map((e) => ({
+		destination: i,
+		provider: e
+	})))), A.map((e) => ({
+		...e,
+		provider: f(e.provider)
+	}))), T = (t) => A.gen(function* () {
+		let n = yield* i.catalogueId, a = yield* t.objectNamespace;
+		return yield* A.try({
+			try: () => r({
+				catalogueId: n,
+				objectNamespace: a,
+				storageInstance: e.storageInstance ?? "@voltro/plugin-storage"
+			}),
+			catch: (e) => _(e, "storage", !1)
+		});
+	}), j = e.access ?? {}, P = e.attempts ?? 3, F = e.urlExpiresInSec ?? 3600;
+	x(F);
+	let I = (t) => ce(e.publicBaseUrl, t, e.httpPath ?? "/_voltro/storage"), L = M.max([M.recurs(Math.max(0, P - 1)), M.exponential("100 millis")]).pipe(M.while(({ input: e }) => e.transient)), R = (e) => e === null ? "global" : typeof e != "string" || e.length === 0 || /[\uD800-\uDFFF]/u.test(e) ? "\0" : e === "global" ? "%67lobal" : e === "." ? "%2E" : e === ".." ? "%2E%2E" : encodeURIComponent(e), z = (t, n, r) => [
 		e.tenantPrefix,
-		t ?? "global",
+		R(t),
 		r ?? n
-	].filter(Boolean).join("/"), D = (e) => {
-		if (e === void 0) return N.succeed(void 0);
-		let n = e.length === 0 ? "empty" : e.includes("\0") ? "contains NUL" : e.startsWith("/") || e.startsWith("\\") ? "starts with a path separator" : e.includes("\\") ? "contains a backslash" : e.split("/").some((e) => e === "" || e === "." || e === "..") ? "contains an empty, \".\" or \"..\" segment" : void 0;
-		return n === void 0 ? N.succeed(e) : N.fail(new c({
-			provider: t.name,
-			message: `storage key rejected: ${n}`,
+	].filter(Boolean).join("/"), V = (e) => {
+		if (e === void 0) return A.succeed(void 0);
+		let t = k(e);
+		return t === void 0 ? A.succeed(e) : A.fail(new l({
+			provider: "storage",
+			message: `storage key rejected: ${t}`,
 			transient: !1,
 			status: 400
 		}));
-	}, O = (t, n, r) => [
+	}, H = (t, n, r) => [
 		e.tenantPrefix,
-		t ?? "global",
+		R(t),
 		"_incoming",
 		n,
 		String(r).padStart(6, "0")
-	].filter(Boolean).join("/"), k = (e, t) => t === void 0 || e.tenantId === t, j = (e, n) => k(e, n) ? N.succeed(e) : N.fail(new c({
-		provider: t.name,
+	].filter(Boolean).join("/"), W = (e, t) => t === void 0 || e.tenantId === t, G = (e, t) => t !== void 0 && e.tenantId !== t ? A.fail(new l({
+		provider: "storage",
 		message: "cross-tenant access denied",
 		transient: !1,
 		status: 403
-	})), M = (n, r, i) => N.gen(function* () {
-		let a = e.objects?.(), o = (e) => new c({
+	})) : A.succeed(e), K = (t, n, r) => A.gen(function* () {
+		let i = e.objects?.(), a = (e) => new l({
 			provider: "metadata",
 			message: e,
 			transient: !1,
 			status: 409
 		});
-		if (a === void 0) return i === void 0 ? !1 : yield* N.fail(o(`claim '${i}' cannot be released: no data store is bound, so ref '${n}' holds no claims`));
-		let s = yield* N.tryPromise({
-			try: () => a.intent(n),
-			catch: (e) => new c({
+		if (i === void 0) return r === void 0 ? !1 : yield* A.fail(a(`claim '${r}' cannot be released: no data store is bound, so ref '${t}' holds no claims`));
+		let o = yield* A.tryPromise({
+			try: () => i.intent(t),
+			catch: (e) => new l({
 				provider: "metadata",
 				message: String(e?.message ?? e),
 				transient: !1
 			})
 		});
-		return s === void 0 ? i === void 0 ? !1 : yield* N.fail(o(`claim '${i}' cannot be released: ref '${n}' was not written through an operation and holds no claims`)) : (yield* j(s.ref, r), yield* C({
-			metadata: a,
+		if (o === void 0) return r === void 0 ? !1 : yield* A.fail(a(`claim '${r}' cannot be released: ref '${t}' was not written through an operation and holds no claims`));
+		yield* G(o.ref, n);
+		let s = yield* m(o.ref);
+		return yield* ie({
+			metadata: i,
 			provider: {
-				...t,
-				delete: (e) => t.delete(e).pipe(N.retry(T))
+				...s,
+				delete: (e) => s.delete(e).pipe(A.retry(L))
 			}
-		}).delete(n, r, i).pipe(N.catchTag("StorageRejected", (e) => N.fail(e.reason === "claim-not-held" ? o(e.detail) : new c({
+		}).delete(t, n, r).pipe(A.catchTag("StorageRejected", (e) => A.fail(e.reason === "claim-not-held" ? a(e.detail) : new l({
 			provider: "metadata",
 			message: e.detail,
 			transient: !1
-		})))), !0);
-	}), F = (e, n) => r.getById(e).pipe(N.flatMap((r) => r ? j(r, n) : N.fail(new c({
-		provider: t.name,
+		})))), !0;
+	}), q = (e, t) => i.getById(e).pipe(A.flatMap((n) => n ? G(n, t) : A.fail(new l({
+		provider: "storage",
 		message: `no ref '${e}'`,
 		transient: !1,
 		status: 404
-	})))), B = (t) => N.suspend(() => {
+	})))), le = (t) => A.suspend(() => {
 		let n = e.scan(t);
-		return N.isEffect(n) ? n : N.tryPromise({
+		return A.isEffect(n) ? n : A.tryPromise({
 			try: () => Promise.resolve(n),
-			catch: (e) => new c({
+			catch: (e) => new l({
 				provider: "scan",
 				message: String(e?.message ?? e),
 				transient: !0
 			})
 		});
-	}), V = (t) => N.suspend(() => {
+	}), J = (t) => A.suspend(() => {
 		let n = t.contentType;
-		if (!e.videoProbe || !(n.startsWith("video/") || n.startsWith("audio/"))) return N.succeed(null);
+		if (!e.videoProbe || !(n.startsWith("video/") || n.startsWith("audio/"))) return A.succeed(null);
 		let r;
 		try {
 			r = e.videoProbe(t);
 		} catch {
-			return N.succeed(null);
+			return A.succeed(null);
 		}
-		return N.isEffect(r) ? r.pipe(N.catch(() => N.succeed(null))) : N.tryPromise({
+		return A.isEffect(r) ? r.pipe(A.catch(() => A.succeed(null))) : A.tryPromise({
 			try: () => Promise.resolve(r),
 			catch: () => null
-		}).pipe(N.catch(() => N.succeed(null)));
-	}), H = (n) => N.gen(function* () {
-		let i = ee(n.bytes, n.contentType, e.limits);
-		if (i) return yield* N.fail(new l(i));
-		if (n.claim !== void 0 && n.operationId === void 0) return yield* N.fail(new l({
+		}).pipe(A.catch(() => A.succeed(null)));
+	}), Y = (t, n) => A.gen(function* () {
+		let r = te(t.bytes, t.contentType, e.limits);
+		if (r) return yield* A.fail(new u(r));
+		if (t.claim !== void 0 && t.operationId === void 0) return yield* A.fail(new u({
 			reason: "claim-without-operation",
 			detail: "a put with a claim needs an operationId; the claim names this caller's hold on that operation's object"
 		}));
 		if (e.scan) {
-			let e = yield* B({
-				bytes: n.bytes,
-				contentType: n.contentType,
-				...n.key ? { key: n.key } : {}
+			let e = yield* le({
+				bytes: t.bytes,
+				contentType: t.contentType,
+				...t.key ? { key: t.key } : {}
 			});
-			if (!e.clean) return yield* N.fail(new u({ threat: e.threat ?? "unknown" }));
+			if (!e.clean) return yield* A.fail(new d({ threat: e.threat ?? "unknown" }));
 		}
-		let a = yield* N.promise(() => te(n.bytes, n.contentType, { normalize: e.normalizeImages ?? !1 })), s = a.bytes, c = yield* V({
-			bytes: s,
-			contentType: n.contentType
-		}), d = a.width ?? c?.width, f = a.height ?? c?.height, p = a.placeholder ?? c?.poster, m = n.duration ?? c?.duration, h = yield* N.promise(() => R(s)), g = n.tenantId ?? null, _ = n.visibility ?? "private", y = yield* D(n.key), b = E(g, h, y), x = n.operationId === void 0 ? E(g, h, `i-${yield* N.promise(() => R(new TextEncoder().encode(JSON.stringify([e.storageInstance ?? "@voltro/plugin-storage", o]))))}/plain/${y ?? h}`) : b, S = n.password ? yield* N.sync(() => v(n.password)) : null, w = {
-			id: Q(),
+		let a = yield* A.promise(() => ne(t.bytes, t.contentType, { normalize: e.normalizeImages ?? !1 })), o = a.bytes, s = yield* J({
+			bytes: o,
+			contentType: t.contentType
+		}), c = a.width ?? s?.width, l = a.height ?? s?.height, f = a.placeholder ?? s?.poster, p = t.duration ?? s?.duration, m = yield* A.promise(() => U(o)), g = t.tenantId ?? null, _ = t.visibility ?? "private", v = yield* V(t.key), y = z(g, m, v), b = yield* h(g, y, t.destination), { provider: x } = b, S = b.destination, C = t.operationId === void 0 ? z(g, m, `i-${yield* A.promise(() => U(new TextEncoder().encode(JSON.stringify([e.storageInstance ?? "@voltro/plugin-storage", S]))))}/plain/${v ?? m}`) : y, T = t.password ? yield* A.sync(() => ee(t.password)) : null, E = {
+			id: fe(),
 			tenantId: g,
-			ownerId: n.ownerId ?? null,
-			bucket: o,
-			key: x,
-			contentType: n.contentType,
-			size: s.byteLength,
-			checksum: h,
+			ownerId: t.ownerId ?? null,
+			bucket: S,
+			key: C,
+			contentType: t.contentType,
+			size: o.byteLength,
+			checksum: m,
 			visibility: _,
-			accessPolicy: n.access ?? null,
-			passwordHash: S,
+			accessPolicy: t.access ?? null,
+			passwordHash: T,
 			createdAt: /* @__PURE__ */ new Date(),
-			...d === void 0 ? {} : { width: d },
-			...f === void 0 ? {} : { height: f },
-			...p === void 0 ? {} : { placeholder: p },
-			...m === void 0 ? {} : { duration: m },
-			...n.folder === void 0 ? {} : { folder: n.folder },
-			...n.tags === void 0 ? {} : { tags: n.tags },
-			...n.alt === void 0 ? {} : { alt: n.alt },
-			...n.caption === void 0 ? {} : { caption: n.caption },
-			...n.derivedFrom === void 0 ? {} : { derivedFrom: n.derivedFrom },
-			...n.kind === void 0 ? {} : { kind: n.kind }
-		}, O = e.transcode !== void 0 && e.autoTranscode !== !1, k = (e) => O && e.derivedFrom == null && (n.contentType.startsWith("video/") || n.contentType.startsWith("audio/")) ? N.forkDetach(W(e).pipe(N.ignore)) : N.void;
-		if (n.operationId !== void 0) {
-			let r = e.objects?.();
-			if (r === void 0) return yield* N.fail(new l({
+			...c === void 0 ? {} : { width: c },
+			...l === void 0 ? {} : { height: l },
+			...f === void 0 ? {} : { placeholder: f },
+			...p === void 0 ? {} : { duration: p },
+			...t.folder === void 0 ? {} : { folder: t.folder },
+			...t.tags === void 0 ? {} : { tags: t.tags },
+			...t.alt === void 0 ? {} : { alt: t.alt },
+			...t.caption === void 0 ? {} : { caption: t.caption },
+			...t.derivedFrom === void 0 ? {} : { derivedFrom: t.derivedFrom },
+			...t.kind === void 0 ? {} : { kind: t.kind }
+		}, D = n === void 0 ? E : {
+			...E,
+			renditionProof: yield* A.try({
+				try: () => re(n, E),
+				catch: (e) => e
+			})
+		}, ae = e.transcode !== void 0 && e.autoTranscode !== !1, O = (e) => ae && e.derivedFrom == null && (t.contentType.startsWith("video/") || t.contentType.startsWith("audio/")) ? A.forkDetach(Z(e).pipe(A.ignore)) : A.void;
+		if (t.operationId !== void 0) {
+			let n = e.objects?.();
+			if (n === void 0) return yield* A.fail(new u({
 				reason: "operation-store-unbound",
 				detail: "a put with an operationId needs a bound data store; the in-memory ref store cannot hold operation intents"
 			}));
-			let i = {
+			let r = {
 				tenantId: g,
-				bucket: o,
-				operationId: n.operationId,
-				checksum: h,
-				logicalKey: x,
-				fingerprint: yield* N.promise(() => R(new TextEncoder().encode(JSON.stringify([
-					h,
-					n.contentType,
+				bucket: S,
+				operationId: t.operationId,
+				checksum: m,
+				logicalKey: C,
+				fingerprint: yield* A.promise(() => U(new TextEncoder().encode(JSON.stringify([
+					m,
+					t.contentType,
 					_,
-					n.access ?? null,
-					n.key ?? null,
-					n.ownerId ?? null,
-					n.folder ?? null,
-					n.tags ?? null,
-					n.alt ?? null,
-					n.caption ?? null,
-					n.derivedFrom ?? null,
-					n.kind ?? null,
-					m ?? null,
-					n.password !== void 0
+					t.access ?? null,
+					t.key ?? null,
+					t.ownerId ?? null,
+					t.folder ?? null,
+					t.tags ?? null,
+					t.alt ?? null,
+					t.caption ?? null,
+					t.derivedFrom ?? null,
+					t.kind ?? null,
+					p ?? null,
+					t.password !== void 0
 				]))))
-			}, a = yield* C({
-				metadata: r,
+			}, i = yield* ie({
+				metadata: n,
 				provider: {
-					...t,
-					put: (e, n, r) => t.put(e, n, r).pipe(N.retry(T))
+					...x,
+					put: (e, t, n) => x.put(e, t, n).pipe(A.retry(L))
 				}
 			}).put({
-				identity: i,
-				ref: w,
-				bytes: s,
+				identity: r,
+				ref: D,
+				bytes: o,
 				...e.quota === void 0 ? {} : { quota: e.quota },
-				...n.claim === void 0 ? {} : { claim: n.claim }
+				...t.claim === void 0 ? {} : { claim: t.claim }
 			});
-			return yield* k(a.ref), {
-				...a.ref,
-				outcome: a.outcome
+			return yield* O(i.ref), {
+				...i.ref,
+				outcome: i.outcome
 			};
 		}
-		let A = {
-			bytes: s.byteLength,
+		let k = {
+			bytes: o.byteLength,
 			count: 1
-		}, j = yield* r.consumeUsage(g, A, e.quota);
+		}, j = yield* i.consumeUsage(g, k, e.quota);
 		if (!j.allowed) {
-			let t = e.quota ?? {}, n = t.maxCount !== void 0 && j.count + 1 > t.maxCount ? `tenant object count ${j.count} + 1 exceeds max ${t.maxCount}` : `tenant usage ${j.bytes} + ${s.byteLength} bytes exceeds max ${t.maxBytes}`;
-			return yield* N.fail(new l({
+			let t = e.quota ?? {}, n = t.maxCount !== void 0 && j.count + 1 > t.maxCount ? `tenant object count ${j.count} + 1 exceeds max ${t.maxCount}` : `tenant usage ${j.bytes} + ${o.byteLength} bytes exceeds max ${t.maxBytes}`;
+			return yield* A.fail(new u({
 				reason: "quota-exceeded",
 				detail: n
 			}));
 		}
-		return yield* ((e) => e.pipe(N.onExit((e) => P.isSuccess(e) ? N.void : r.delete(w.id).pipe(N.andThen(r.releaseUsage(g, A)), N.ignore))))(r.insert(w).pipe(N.andThen(t.put(x, s, {
-			contentType: n.contentType,
+		return yield* ((e) => e.pipe(A.onExit((e) => oe.isSuccess(e) ? A.void : i.delete(D.id).pipe(A.andThen(i.releaseUsage(g, k)), A.ignore))))(i.insert(w(D)).pipe(A.andThen(x.put(C, o, {
+			contentType: t.contentType,
 			public: _ === "public"
-		}).pipe(N.retry(T))))), yield* k(w), {
-			...w,
+		}).pipe(A.retry(L))))), yield* O(D), {
+			...D,
 			outcome: "created"
 		};
-	}), U = (t) => N.suspend(() => {
-		if (!e.transcode) return N.succeed([]);
+	}), X = (t) => A.suspend(() => {
+		if (!e.transcode) return A.succeed([]);
 		let n;
 		try {
 			n = e.transcode(t);
 		} catch {
-			return N.succeed([]);
+			return A.succeed([]);
 		}
-		return N.isEffect(n) ? n.pipe(N.catch(() => N.succeed([]))) : N.tryPromise({
+		return A.isEffect(n) ? n.pipe(A.catch(() => A.succeed([]))) : A.tryPromise({
 			try: () => Promise.resolve(n),
 			catch: () => []
-		}).pipe(N.catch(() => N.succeed([])));
-	}), W = (n) => N.gen(function* () {
-		if (!e.transcode || n.derivedFrom != null) return [];
-		let r = yield* t.get(n.key).pipe(N.retry(T)), i = yield* U({
-			bytes: r.bytes,
-			contentType: n.contentType,
-			ref: n
-		}), a = [];
-		for (let e of i) {
-			let t = yield* H({
-				bytes: e.bytes,
-				contentType: e.contentType,
-				tenantId: n.tenantId,
-				ownerId: n.ownerId,
-				visibility: n.visibility,
-				derivedFrom: n.id,
-				kind: e.kind,
-				...e.label === void 0 ? {} : { caption: e.label }
-			});
-			a.push(t);
+		}).pipe(A.catch(() => A.succeed([])));
+	}), Z = (t) => A.gen(function* () {
+		if (!e.transcode || t.derivedFrom != null) return [];
+		let n = yield* m(t), r = { ...t }, i = r.checksum !== "" && !/^[a-f0-9]{64}$/.test(r.checksum), a = () => n.head(r.key).pipe(A.map((e) => e === null ? null : { ...e })), o = i ? yield* a() : void 0, s = yield* n.get(r.key).pipe(A.retry(L)), c = i ? yield* a() : void 0, l = yield* X({
+			bytes: Uint8Array.from(s.bytes),
+			contentType: r.contentType,
+			ref: { ...r }
+		}), u = [];
+		for (let e of l) {
+			let n = {
+				...e,
+				bytes: Uint8Array.from(e.bytes)
+			}, i = yield* A.try({
+				try: () => C(r, s.bytes, n, {
+					before: o,
+					after: c
+				}),
+				catch: (e) => e
+			}), a = yield* Y({
+				destination: t.bucket,
+				bytes: n.bytes,
+				contentType: n.contentType,
+				tenantId: r.tenantId,
+				ownerId: r.ownerId,
+				visibility: r.visibility,
+				derivedFrom: r.id,
+				kind: n.kind,
+				...n.label === void 0 ? {} : { caption: n.label }
+			}, i);
+			u.push(a);
 		}
-		return a;
-	}), G = (e, t, n) => N.gen(function* () {
+		return u;
+	}), Q = (e, t, n) => A.gen(function* () {
 		if (e.derivedFrom != null) {
-			let i = yield* r.getById(e.derivedFrom);
-			return i === null ? !1 : yield* G(i, t, n);
+			let r = yield* i.getById(e.derivedFrom);
+			return r === null ? !1 : yield* Q(r, t, n);
 		}
 		if (e.visibility === "public") return !0;
-		if (e.tenantId !== null && !k(e, t.tenantId ?? null)) return !1;
-		if (yield* g(e, t, {
-			...d,
+		if (e.tenantId !== null && !W(e, t.tenantId ?? null)) return !1;
+		if (yield* v(e, t, {
+			...j,
 			...n?.password === void 0 ? {} : { password: n.password }
 		})) return !0;
-		let a = yield* y(t, d), o = yield* i.listByRef(e.id);
-		return _(o, t, a, n?.permission ?? "read", Date.now());
-	}), K = (e) => {
+		let r = yield* b(t, j), o = yield* a.listByRef(e.id);
+		return y(o, t, r, n?.permission ?? "read", Date.now());
+	}), $ = (e, t) => {
 		if (e.visibility === "public") {
 			let n = t.publicUrl?.(e.key);
 			if (n != null) return n;
 		}
-		return w(e.id);
+		return I(e.id);
 	};
 	return {
-		uploadTicketScope: () => N.gen(function* () {
-			let i = yield* r.catalogueId, a = yield* t.objectNamespace;
-			return yield* N.try({
-				try: () => n({
-					catalogueId: i,
-					objectNamespace: a,
-					storageInstance: e.storageInstance ?? "@voltro/plugin-storage"
+		operationStatus: (n) => A.gen(function* () {
+			if (!n || typeof n.operationId != "string" || n.operationId.length === 0 || n.tenantId !== null && typeof n.tenantId != "string") return yield* A.fail(new l({
+				provider: "metadata",
+				message: "An exact operation ID and explicit tenant are required",
+				transient: !1,
+				status: 400
+			}));
+			let a = e.objects?.();
+			if (!a) return yield* A.fail(new l({
+				provider: "metadata",
+				message: "Durable storage operation metadata is not bound",
+				transient: !1,
+				status: 409
+			}));
+			let o = yield* h(n.tenantId, "_namespace", n.destination), s = yield* A.tryPromise({
+				try: () => a.operationStatus({
+					operationId: n.operationId,
+					tenantId: n.tenantId,
+					bucket: o.destination
 				}),
-				catch: (e) => h(e, "storage", !1)
+				catch: (e) => {
+					let t = _(e, "metadata");
+					return new l({
+						provider: "metadata",
+						message: "Storage operation state could not be confirmed; retain its identity for recovery",
+						transient: t.transient,
+						...t.status === void 0 ? {} : { status: t.status }
+					});
+				}
+			});
+			if ((yield* o.provider.objectNamespace) !== s.scope.objectNamespace || s.scope.storageInstance !== (e.storageInstance ?? "@voltro/plugin-storage")) return yield* A.fail(new l({
+				provider: "metadata",
+				message: "Storage operation metadata belongs to another configured destination",
+				transient: !1,
+				status: 409
+			}));
+			let c = yield* i.catalogueId, u = yield* A.try({
+				try: () => t([
+					"durable-operation-observation",
+					r({
+						...s.scope,
+						catalogueId: c
+					}),
+					o.destination
+				]),
+				catch: (e) => _(e, "metadata")
 			});
+			return {
+				...s.observation,
+				scope: u,
+				destination: o.destination
+			};
 		}),
-		put: H,
-		get: (e, n) => F(e, n?.tenantId).pipe(N.flatMap((e) => t.get(e.key).pipe(N.retry(T), N.map((t) => ({
+		uploadTicketScope: (e) => h(e?.tenantId ?? null, "_namespace", e?.destination).pipe(A.flatMap((e) => T(e.provider))),
+		put: (e) => Y(e),
+		get: (e, t) => q(e, t?.tenantId).pipe(A.flatMap((e) => m(e).pipe(A.flatMap((t) => t.get(e.key).pipe(A.retry(L), A.map((t) => ({
 			bytes: t.bytes,
 			ref: e
-		}))))),
-		getStream: (e, n) => F(e, n?.tenantId).pipe(N.flatMap((e) => m(t, e.key).pipe(N.retry(T), N.map((t) => ({
+		}))))))),
+		getStream: (e, t) => q(e, t?.tenantId).pipe(A.flatMap((e) => m(e).pipe(A.flatMap((t) => g(t, e.key).pipe(A.retry(L), A.map((t) => ({
 			ref: e,
 			stream: t.stream
-		}))))),
-		getRange: (e, n, r) => F(e, r?.tenantId).pipe(N.flatMap((e) => {
-			let r = e.size, i = Math.max(0, Math.trunc(n.start));
-			if (r > 0 && i >= r) return N.fail(new c({
-				provider: t.name,
+		}))))))),
+		getRange: (e, t, n) => q(e, n?.tenantId).pipe(A.flatMap((e) => m(e).pipe(A.flatMap((n) => {
+			let r = e.size, i = Math.max(0, Math.trunc(t.start));
+			if (r > 0 && i >= r) return A.fail(new l({
+				provider: n.name,
 				message: `range start ${i} past end ${r}`,
 				transient: !1,
 				status: 416
 			}));
-			let a = Math.min(Math.trunc(n.endInclusive), Math.max(0, r - 1));
-			return a < i ? N.fail(new c({
-				provider: t.name,
+			let a = Math.min(Math.trunc(t.endInclusive), Math.max(0, r - 1));
+			return a < i ? A.fail(new l({
+				provider: n.name,
 				message: `empty range ${i}-${a}`,
 				transient: !1,
 				status: 416
-			})) : (t.getRange ? t.getRange(e.key, i, a).pipe(N.retry(T)) : t.get(e.key).pipe(N.retry(T), N.map((e) => e.bytes.subarray(i, a + 1)))).pipe(N.map((t) => ({
+			})) : (n.getRange ? n.getRange(e.key, i, a).pipe(A.retry(L)) : n.get(e.key).pipe(A.retry(L), A.map((e) => e.bytes.subarray(i, a + 1)))).pipe(A.map((t) => ({
 				bytes: t,
 				ref: e,
 				totalSize: r
 			})));
-		})),
-		getUrl: (e, n) => F(e, n?.tenantId).pipe(N.flatMap((e) => e.visibility === "public" ? N.succeed(K(e)) : t.presigns ? t.getUrl(e.key, n?.expiresInSec ?? p) : N.succeed(w(e.id)))),
-		head: (e, t) => r.getById(e).pipe(N.flatMap((e) => e ? j(e, t?.tenantId).pipe(N.map((e) => e)) : N.succeed(null))),
-		delete: (e, n) => M(e, n?.tenantId, n?.claim).pipe(N.flatMap((a) => a ? N.void : F(e, n?.tenantId).pipe(N.flatMap((n) => i.deleteByRef(e).pipe(N.flatMap(() => r.delete(e)), N.flatMap((e) => e ? r.countByKey(n.bucket, n.key).pipe(N.flatMap((e) => e === 0 ? t.delete(n.key).pipe(N.retry(T)) : N.void), N.flatMap(() => r.releaseUsage(n.tenantId, {
-			bytes: n.size,
+		})))),
+		getUrl: (e, t) => q(e, t?.tenantId).pipe(A.flatMap((e) => m(e).pipe(A.flatMap((n) => e.visibility === "public" ? A.succeed($(e, n)) : n.presigns ? n.getUrl(e.key, t?.expiresInSec ?? F) : A.succeed(I(e.id)))))),
+		head: (e, t) => i.getById(e).pipe(A.flatMap((e) => e ? G(e, t?.tenantId).pipe(A.map((e) => e)) : A.succeed(null))),
+		delete: (e, t) => K(e, t?.tenantId, t?.claim).pipe(A.flatMap((n) => n ? A.void : q(e, t?.tenantId).pipe(A.flatMap((t) => m(t).pipe(A.flatMap((n) => a.deleteByRef(e).pipe(A.flatMap(() => i.delete(e)), A.flatMap((e) => e ? n.delete(t.key).pipe(A.retry(L), A.flatMap(() => i.releaseUsage(t.tenantId, {
+			bytes: t.size,
 			count: 1
-		}))) : N.void), N.asVoid))))),
-		signedUrl: (n, r) => F(n, r?.tenantId).pipe(N.flatMap((n) => {
-			if (n.visibility === "public") return N.succeed(K(n));
-			let i = r?.expiresInSec ?? p;
-			return t.presigns ? t.getUrl(n.key, i) : N.sync(() => `${w(n.id)}?t=${b(n.id, i, void 0, e.httpPath ?? "/_voltro/storage")}`);
-		})),
-		setVisibility: (e, n, i) => N.gen(function* () {
-			let a = yield* F(e, i?.tenantId);
-			if (a.visibility === n) return a;
-			let o = r.setVisibility;
-			if (o === void 0) return yield* N.fail(new l({
-				reason: "visibility-unsupported",
-				detail: "the ref store cannot change a stored object's visibility"
-			}));
-			if (n === "private" && t.publicUrl?.(a.key) != null) return yield* N.fail(new l({
-				reason: "visibility-unsupported",
-				detail: `objects are served from a public base (${t.name} cdnBaseUrl); a public object cannot be made private there`
-			}));
-			if (n === "private" && t.setObjectPublic !== void 0 && r.countPublicByKey === void 0) return yield* N.fail(new l({
+		}))) : A.void), A.asVoid))))))),
+		signedUrl: (t, n) => q(t, n?.tenantId).pipe(A.flatMap((t) => m(t).pipe(A.flatMap((r) => {
+			if (t.visibility === "public") return A.succeed($(t, r));
+			let i = n?.expiresInSec ?? F;
+			return r.presigns ? r.getUrl(t.key, i) : A.sync(() => `${I(t.id)}?t=${S(t.id, i, void 0, e.httpPath ?? "/_voltro/storage")}`);
+		})))),
+		setVisibility: (e, t, n) => A.gen(function* () {
+			let r = yield* q(e, n?.tenantId);
+			if (r.visibility === t) return r;
+			let a = i.setVisibility;
+			if (a === void 0) return yield* A.fail(new u({
 				reason: "visibility-unsupported",
-				detail: "the ref store cannot tell whether other refs keep these bytes public"
+				detail: "the ref store cannot change a stored object visibility"
 			}));
-			let s = yield* o(a.id, n);
-			if (s === null) return yield* N.fail(new c({
-				provider: t.name,
+			let o = r.derivedFrom == null ? yield* i.listByDerivedFrom(r.id) : [], s = [];
+			for (let e of [r, ...o]) {
+				let n = yield* m(e);
+				if (t === "private" && n.publicUrl?.(e.key) != null) return yield* A.fail(new u({
+					reason: "visibility-unsupported",
+					detail: `objects are served from a public base (${n.name} cdnBaseUrl); a public object cannot be made private there`
+				}));
+				if (t === "private" && n.setObjectPublic !== void 0 && i.countPublicByAddress === void 0) return yield* A.fail(new u({
+					reason: "visibility-unsupported",
+					detail: "the ref store cannot tell whether other refs keep these bytes public"
+				}));
+				s.push({
+					ref: e,
+					provider: n
+				});
+			}
+			let c = yield* a(r.id, t);
+			if (c === null) return yield* A.fail(new l({
+				provider: "storage",
 				message: `no ref '${e}'`,
 				transient: !1,
 				status: 404
 			}));
-			let u = a.derivedFrom == null ? yield* r.listByDerivedFrom(a.id) : [];
-			for (let e of u) e.visibility !== n && (yield* o(e.id, n));
-			if (t.setObjectPublic !== void 0) {
-				let e = r.countPublicByKey;
-				for (let r of [a, ...u]) {
-					let i = n === "public" || e !== void 0 && (yield* e(r.bucket, r.key)) > 0;
-					yield* t.setObjectPublic(r.key, i);
-				}
+			for (let e of o) if (e.visibility !== t && (yield* a(e.id, t)) === null) return yield* A.fail(new l({
+				provider: "storage",
+				message: `no ref '${e.id}'`,
+				transient: !1,
+				status: 404
+			}));
+			for (let e of s) if (e.provider.setObjectPublic !== void 0) {
+				let n = i.countPublicByAddress, r = t === "public" || n !== void 0 && (yield* n(p(e.ref))) > 0;
+				yield* e.provider.setObjectPublic(e.ref.key, r);
 			}
-			return s;
+			return c;
 		}),
-		mintUrl: (n, i, a) => N.gen(function* () {
-			let o = yield* r.getById(n).pipe(N.flatMap((e) => e ? N.succeed(e) : N.fail(new c({
-				provider: t.name,
-				message: `no ref '${n}'`,
+		mintUrl: (t, n, r) => A.gen(function* () {
+			let a = yield* i.getById(t).pipe(A.flatMap((e) => e ? A.succeed(e) : A.fail(new l({
+				provider: "storage",
+				message: `no ref '${t}'`,
 				transient: !1,
 				status: 404
 			}))));
-			if (o.visibility === "public" && o.derivedFrom == null) return K(o);
-			if (!(yield* G(o, i, a?.password === void 0 ? {} : { password: a.password }))) return yield* N.fail(new s({
-				refId: n,
+			if (a.visibility === "public" && a.derivedFrom == null) return $(a, yield* m(a));
+			if (!(yield* Q(a, n, r?.password === void 0 ? {} : { password: r.password }))) return yield* A.fail(new c({
+				refId: t,
 				reason: "access denied"
 			}));
-			let l = a?.expiresInSec ?? p;
-			if (t.presigns) return yield* t.getUrl(o.key, l);
-			let u = yield* N.sync(() => b(o.id, l, void 0, e.httpPath ?? "/_voltro/storage"));
-			return `${w(o.id)}?t=${u}`;
+			let o = yield* m(a), s = r?.expiresInSec ?? F;
+			if (o.presigns) return yield* o.getUrl(a.key, s);
+			let u = yield* A.sync(() => S(a.id, s, void 0, e.httpPath ?? "/_voltro/storage"));
+			return `${I(a.id)}?t=${u}`;
 		}),
-		mintUploadUrl: (e) => N.gen(function* () {
-			if (!t.getUploadUrl) return yield* N.fail(new c({
+		mintUploadUrl: (e) => A.gen(function* () {
+			let { provider: t } = yield* h(e.tenantId ?? null, z(e.tenantId ?? null, "", e.key));
+			if (!t.getUploadUrl) return yield* A.fail(new l({
 				provider: t.name,
 				message: `provider '${t.name}' does not support presigned uploads`,
 				transient: !1,
 				status: 400
 			}));
-			let n = E(e.tenantId ?? null, "", yield* D(e.key));
-			return yield* t.getUploadUrl(n, e.expiresInSec ?? p, e.contentType);
+			let n = z(e.tenantId ?? null, "", yield* V(e.key));
+			return yield* t.getUploadUrl(n, e.expiresInSec ?? F, e.contentType);
 		}),
-		checkAccess: G,
-		grant: (e) => N.gen(function* () {
-			yield* F(e.refId);
+		checkAccess: Q,
+		grant: (e) => A.gen(function* () {
+			yield* q(e.refId);
 			let t = {
-				id: ne(),
+				id: pe(),
 				refId: e.refId,
 				principalType: e.principalType,
 				principalId: e.principalId,
@@ -859,10 +1154,10 @@ var R = async (e) => {
 				expiresAt: e.expiresAt ?? null,
 				createdBy: e.createdBy ?? null
 			};
-			return yield* i.insert(t), t;
+			return yield* a.insert(t), t;
 		}),
-		listRefs: (e) => N.suspend(() => {
-			let t = Math.min(500, Math.max(1, Math.trunc(e?.limit ?? 50))), n = Math.max(0, Math.trunc(e?.offset ?? 0)), i = {
+		listRefs: (e) => A.suspend(() => {
+			let t = Math.min(500, Math.max(1, Math.trunc(e?.limit ?? 50))), n = Math.max(0, Math.trunc(e?.offset ?? 0)), r = {
 				tenantId: e && "tenantId" in e ? e.tenantId : void 0,
 				folder: e?.folder,
 				tags: e?.tags ?? [],
@@ -871,7 +1166,7 @@ var R = async (e) => {
 				limit: t + 1,
 				offset: n
 			};
-			return r.listRefs(i).pipe(N.map((e) => {
+			return i.listRefs(r).pipe(A.map((e) => {
 				let r = e.length > t;
 				return {
 					refs: r ? e.slice(0, t) : e,
@@ -879,30 +1174,30 @@ var R = async (e) => {
 				};
 			}));
 		}),
-		revoke: (e) => i.delete(e),
-		getGrant: (e) => i.getById(e),
-		listGrants: (e) => i.listByRef(e),
-		usage: (e) => r.usageByTenant(e),
-		sweepOrphans: (e) => N.gen(function* () {
-			let n = e?.limit ?? 1e3, i = e?.dryRun ?? !1, a = yield* r.listRecent(n), o = [];
-			for (let e of a) if ((yield* t.head(e.key)) === null) {
-				if (!i) {
-					if (!(yield* r.delete(e.id))) continue;
-					yield* r.releaseUsage(e.tenantId, {
+		revoke: (e) => a.delete(e),
+		getGrant: (e) => a.getById(e),
+		listGrants: (e) => a.listByRef(e),
+		usage: (e) => i.usageByTenant(e),
+		sweepOrphans: (e) => A.gen(function* () {
+			let t = e?.limit ?? 1e3, n = e?.dryRun ?? !1, r = yield* i.listRecent(t), a = [];
+			for (let e of r) if ((yield* (yield* m(e)).head(e.key)) === null) {
+				if (!n) {
+					if (!(yield* i.delete(e.id))) continue;
+					yield* i.releaseUsage(e.tenantId, {
 						bytes: e.size,
 						count: 1
 					});
 				}
-				o.push(e.id);
+				a.push(e.id);
 			}
 			return {
-				scanned: a.length,
-				removed: o
+				scanned: r.length,
+				removed: a
 			};
 		}),
-		ingestUrl: (t, n) => S(N.gen(function* () {
-			let r = yield* x(t, e.limits?.maxBytes, e.ingest);
-			return yield* H({
+		ingestUrl: (t, n) => D(A.gen(function* () {
+			let r = yield* E(t, e.limits?.maxBytes, e.ingest);
+			return yield* Y({
 				bytes: r.bytes,
 				contentType: n?.contentType ?? r.contentType,
 				...n?.tenantId === void 0 ? {} : { tenantId: n.tenantId },
@@ -917,24 +1212,33 @@ var R = async (e) => {
 				...n?.caption === void 0 ? {} : { caption: n.caption }
 			});
 		}), n?.abortSignal),
-		mintPresignedUpload: (e) => N.gen(function* () {
-			if (!t.getUploadUrl) return yield* N.fail(new c({
-				provider: t.name,
-				message: `provider '${t.name}' does not support presigned uploads`,
+		mintPresignedUpload: (e) => A.gen(function* () {
+			let t = yield* h(e.tenantId ?? null, H(e.tenantId ?? null, "selection", 0)), { provider: n } = t;
+			if (!n.getUploadUrl) return yield* A.fail(new l({
+				provider: n.name,
+				message: `provider '${n.name}' does not support presigned uploads`,
 				transient: !1,
 				status: 400
 			}));
-			let n = e.expiresInSec ?? p, r = `_incoming/${A({
+			let r = e.expiresInSec ?? F, i = `_incoming/${B({
 				kind: "typeid",
 				prefix: "up"
-			}, a)}`, i = E(e.tenantId ?? null, "", r);
+			}, o)}`, a = z(e.tenantId ?? null, "", i), s = yield* T(n), c = yield* n.getUploadUrl(a, r, e.contentType);
 			return {
-				uploadUrl: yield* t.getUploadUrl(i, n, e.contentType),
-				key: i,
-				expiresInSec: n
+				writeScope: s,
+				destination: t.destination,
+				tenantId: e.tenantId ?? null,
+				uploadUrl: c,
+				key: a,
+				expiresInSec: r
 			};
 		}),
-		finalizeUpload: (e) => t.get(e.key).pipe(N.retry(T), N.flatMap((t) => H({
+		finalizeUpload: (e) => m({
+			bucket: e.destination,
+			tenantId: e.tenantId ?? null,
+			key: e.key
+		}).pipe(A.flatMap((t) => t.get(e.key).pipe(A.retry(L), A.flatMap((t) => Y({
+			destination: e.destination,
 			bytes: t.bytes,
 			contentType: e.contentType,
 			...e.tenantId === void 0 ? {} : { tenantId: e.tenantId },
@@ -945,12 +1249,20 @@ var R = async (e) => {
 			...e.tags === void 0 ? {} : { tags: e.tags },
 			...e.alt === void 0 ? {} : { alt: e.alt },
 			...e.caption === void 0 ? {} : { caption: e.caption }
-		})), N.ensuring(t.delete(e.key).pipe(N.retry(T), N.ignore))),
-		putResumableChunk: (e) => t.put(O(e.tenantId ?? null, e.uploadId, e.index), e.bytes, { contentType: "application/octet-stream" }).pipe(N.retry(T), N.asVoid),
-		resumableStatus: (e) => N.gen(function* () {
-			let n = 0, r = 0;
+		})), A.ensuring(t.delete(e.key).pipe(A.retry(L), A.ignore))))),
+		putResumableChunk: (e) => m({
+			bucket: e.destination,
+			tenantId: e.tenantId ?? null,
+			key: H(e.tenantId ?? null, e.uploadId, e.index)
+		}).pipe(A.flatMap((t) => t.put(H(e.tenantId ?? null, e.uploadId, e.index), e.bytes, { contentType: "application/octet-stream" }).pipe(A.retry(L), A.asVoid))),
+		resumableStatus: (e) => A.gen(function* () {
+			let t = yield* m({
+				bucket: e.destination,
+				tenantId: e.tenantId ?? null,
+				key: H(e.tenantId ?? null, e.uploadId, 0)
+			}), n = 0, r = 0;
 			for (; n < 1e6;) {
-				let i = yield* t.head(O(e.tenantId ?? null, e.uploadId, n)).pipe(N.retry(T), N.catch(() => N.succeed(null)));
+				let i = yield* t.head(H(e.tenantId ?? null, e.uploadId, n)).pipe(A.retry(L), A.catchIf((e) => e.status === 404, () => A.succeed(null)));
 				if (i === null) break;
 				r += i.size, n += 1;
 			}
@@ -959,42 +1271,46 @@ var R = async (e) => {
 				nextIndex: n
 			};
 		}),
-		finalizeResumable: (n) => N.gen(function* () {
-			let r = e.limits?.maxBytes ?? 2 ** 53 - 1;
-			if (!Number.isSafeInteger(r) || r < 0 || !Number.isSafeInteger(n.count) || n.count < 0) return yield* N.fail(new c({
-				provider: t.name,
+		finalizeResumable: (t) => A.gen(function* () {
+			let n = yield* m({
+				bucket: t.destination,
+				tenantId: t.tenantId ?? null,
+				key: H(t.tenantId ?? null, t.uploadId, 0)
+			}), r = e.limits?.maxBytes ?? 2 ** 53 - 1;
+			if (!Number.isSafeInteger(r) || r < 0 || !Number.isSafeInteger(t.count) || t.count < 0) return yield* A.fail(new l({
+				provider: n.name,
 				message: "resumable count and limits.maxBytes must be non-negative safe integers",
 				transient: !1,
 				status: 400
 			}));
-			let i = (e) => O(n.tenantId ?? null, n.uploadId, e), a = N.gen(function* () {
-				for (let e = 0; e < n.count; e++) yield* t.delete(i(e)).pipe(N.retry(T), N.ignore);
-			}), o = () => new l({
+			let i = (e) => H(t.tenantId ?? null, t.uploadId, e), a = A.gen(function* () {
+				for (let e = 0; e < t.count; e++) yield* n.delete(i(e)).pipe(A.retry(L), A.ignore);
+			}), o = () => new u({
 				reason: "too-large",
 				detail: `resumable upload exceeds ${r}-byte limit`
-			}), s = yield* N.gen(function* () {
+			}), s = yield* A.gen(function* () {
 				let e = 0;
-				for (let a = 0; a < n.count; a++) {
-					let n = yield* t.head(i(a)).pipe(N.retry(T));
-					if (n === null) return yield* N.fail(new c({
-						provider: t.name,
+				for (let a = 0; a < t.count; a++) {
+					let t = yield* n.head(i(a)).pipe(A.retry(L));
+					if (t === null) return yield* A.fail(new l({
+						provider: n.name,
 						message: `no resumable chunk at '${i(a)}'`,
 						transient: !1,
 						status: 404
 					}));
-					if (!Number.isSafeInteger(n.size) || n.size < 0) return yield* N.fail(new c({
-						provider: t.name,
+					if (!Number.isSafeInteger(t.size) || t.size < 0) return yield* A.fail(new l({
+						provider: n.name,
 						message: "resumable chunk metadata has an invalid size",
 						transient: !1
 					}));
-					if (n.size > r - e) return yield* N.fail(o());
-					e += n.size;
+					if (t.size > r - e) return yield* A.fail(o());
+					e += t.size;
 				}
 				let a = /* @__PURE__ */ new Uint8Array(), s = 0;
-				for (let e = 0; e < n.count; e++) {
-					let n = yield* m(t, i(e)).pipe(N.retry(T));
-					yield* L.runForEach(n.stream, (e) => N.gen(function* () {
-						if (e.byteLength > r - s) return yield* N.fail(o());
+				for (let e = 0; e < t.count; e++) {
+					let t = yield* g(n, i(e)).pipe(A.retry(L));
+					yield* se.runForEach(t.stream, (e) => A.gen(function* () {
+						if (e.byteLength > r - s) return yield* A.fail(o());
 						let t = s + e.byteLength;
 						if (t > a.byteLength) {
 							let e = new Uint8Array(Math.min(r, Math.max(65536, a.byteLength * 2, t)));
@@ -1004,81 +1320,98 @@ var R = async (e) => {
 					}));
 				}
 				return a.subarray(0, s);
-			}).pipe(N.tapError((e) => e._tag === "StorageRejected" ? a : N.void));
-			return yield* H({
+			}).pipe(A.tapError((e) => e._tag === "StorageRejected" ? a : A.void));
+			return yield* Y({
+				destination: t.destination,
 				bytes: s,
-				contentType: n.contentType,
-				...n.tenantId === void 0 ? {} : { tenantId: n.tenantId },
-				...n.ownerId === void 0 ? {} : { ownerId: n.ownerId },
-				...n.visibility === void 0 ? {} : { visibility: n.visibility },
-				...n.access === void 0 ? {} : { access: n.access },
-				...n.folder === void 0 ? {} : { folder: n.folder },
-				...n.tags === void 0 ? {} : { tags: n.tags },
-				...n.alt === void 0 ? {} : { alt: n.alt },
-				...n.caption === void 0 ? {} : { caption: n.caption }
-			}).pipe(N.ensuring(a));
+				contentType: t.contentType,
+				...t.tenantId === void 0 ? {} : { tenantId: t.tenantId },
+				...t.ownerId === void 0 ? {} : { ownerId: t.ownerId },
+				...t.visibility === void 0 ? {} : { visibility: t.visibility },
+				...t.access === void 0 ? {} : { access: t.access },
+				...t.folder === void 0 ? {} : { folder: t.folder },
+				...t.tags === void 0 ? {} : { tags: t.tags },
+				...t.alt === void 0 ? {} : { alt: t.alt },
+				...t.caption === void 0 ? {} : { caption: t.caption }
+			}).pipe(A.ensuring(a));
 		}),
-		transcode: (e, t) => F(e, t?.tenantId).pipe(N.flatMap((e) => W(e))),
-		renditions: (e, t) => F(e, t?.tenantId).pipe(N.flatMap(() => r.listByDerivedFrom(e))),
-		beginMultipartUpload: (e) => N.gen(function* () {
-			if (!t.createMultipartUpload || !t.presignUploadPart || !t.completeMultipartUpload) return yield* N.fail(new c({
-				provider: t.name,
-				message: `provider '${t.name}' does not support multipart uploads`,
+		transcode: (e, t) => q(e, t?.tenantId).pipe(A.flatMap((e) => Z(e))),
+		renditions: (e, t) => q(e, t?.tenantId).pipe(A.flatMap(() => i.listByDerivedFrom(e))),
+		beginMultipartUpload: (e) => A.gen(function* () {
+			let t = yield* h(e.tenantId ?? null, H(e.tenantId ?? null, "selection", 0)), { provider: n } = t;
+			if (!n.createMultipartUpload || !n.presignUploadPart || !n.completeMultipartUpload) return yield* A.fail(new l({
+				provider: n.name,
+				message: `provider '${n.name}' does not support multipart uploads`,
 				transient: !1,
 				status: 400
 			}));
-			let n = E(e.tenantId ?? null, "", `multipart/${A({
+			let r = z(e.tenantId ?? null, "", `multipart/${B({
 				kind: "typeid",
 				prefix: "mp"
-			}, a)}`);
+			}, o)}`), i = yield* T(n), a = yield* n.createMultipartUpload(r, e.contentType, { public: (e.visibility ?? "private") === "public" });
 			return {
-				uploadId: (yield* t.createMultipartUpload(n, e.contentType, { public: (e.visibility ?? "private") === "public" })).uploadId,
-				key: n
+				writeScope: i,
+				destination: t.destination,
+				tenantId: e.tenantId ?? null,
+				uploadId: a.uploadId,
+				key: r
 			};
 		}),
-		signMultipartPart: (e) => N.suspend(() => t.presignUploadPart ? t.presignUploadPart(e.key, e.uploadId, e.partNumber, e.expiresInSec ?? p) : N.fail(new c({
+		signMultipartPart: (e) => m({
+			bucket: e.destination,
+			tenantId: e.tenantId ?? null,
+			key: e.key
+		}).pipe(A.flatMap((t) => A.suspend(() => t.presignUploadPart ? t.presignUploadPart(e.key, e.uploadId, e.partNumber, e.expiresInSec ?? F) : A.fail(new l({
 			provider: t.name,
 			message: "provider does not support multipart uploads",
 			transient: !1,
 			status: 400
-		}))),
-		completeMultipart: (n) => N.gen(function* () {
-			if (!t.completeMultipartUpload) return yield* N.fail(new c({
-				provider: t.name,
+		}))))),
+		completeMultipart: (t) => A.gen(function* () {
+			let n = yield* m({
+				bucket: t.destination,
+				tenantId: t.tenantId ?? null,
+				key: t.key
+			}), r = t.destination;
+			if (!n.completeMultipartUpload) return yield* A.fail(new l({
+				provider: n.name,
 				message: "provider does not support multipart uploads",
 				transient: !1,
 				status: 400
 			}));
-			let i = yield* t.completeMultipartUpload(n.key, n.uploadId, n.parts), a = yield* t.head(n.key).pipe(N.retry(T)), s = a?.size ?? 0, u = (i.etag ?? a?.etag ?? "").replace(/"/g, ""), d = n.tenantId ?? null, f = {
+			let a = yield* n.completeMultipartUpload(t.key, t.uploadId, t.parts), o = yield* n.head(t.key).pipe(A.retry(L)), s = o?.size ?? 0, c = (a.etag ?? o?.etag ?? "").replace(/"/g, ""), d = t.tenantId ?? null, f = {
 				bytes: s,
 				count: 1
 			};
-			if (!(yield* r.consumeUsage(d, f, e.quota)).allowed) return yield* t.delete(n.key).pipe(N.retry(T), N.ignore), yield* N.fail(new l({
+			if (!(yield* i.consumeUsage(d, f, e.quota)).allowed) return yield* n.delete(t.key).pipe(A.retry(L), A.ignore), yield* A.fail(new u({
 				reason: "quota-exceeded",
 				detail: `multipart upload of ${s} bytes exceeds tenant quota`
 			}));
 			let p = {
-				id: Q(),
-				tenantId: n.tenantId ?? null,
-				ownerId: n.ownerId ?? null,
-				bucket: o,
-				key: n.key,
-				contentType: n.contentType,
+				id: fe(),
+				tenantId: t.tenantId ?? null,
+				ownerId: t.ownerId ?? null,
+				bucket: r,
+				key: t.key,
+				contentType: t.contentType,
 				size: s,
-				checksum: u,
-				visibility: n.visibility ?? "private",
-				accessPolicy: n.access ?? null,
+				checksum: c,
+				visibility: t.visibility ?? "private",
+				accessPolicy: t.access ?? null,
 				passwordHash: null,
 				createdAt: /* @__PURE__ */ new Date(),
-				...n.folder === void 0 ? {} : { folder: n.folder },
-				...n.tags === void 0 ? {} : { tags: n.tags },
-				...n.alt === void 0 ? {} : { alt: n.alt },
-				...n.caption === void 0 ? {} : { caption: n.caption }
+				...t.folder === void 0 ? {} : { folder: t.folder },
+				...t.tags === void 0 ? {} : { tags: t.tags },
+				...t.alt === void 0 ? {} : { alt: t.alt },
+				...t.caption === void 0 ? {} : { caption: t.caption }
 			};
-			return yield* r.insert(p).pipe(N.onExit((e) => P.isSuccess(e) ? N.void : r.releaseUsage(d, f).pipe(N.ignore))), p;
+			return yield* i.insert(p).pipe(A.onExit((e) => oe.isSuccess(e) ? A.void : i.releaseUsage(d, f).pipe(A.ignore))), p;
 		}),
-		abortMultipart: (e) => N.suspend(() => t.abortMultipartUpload ? t.abortMultipartUpload(e.key, e.uploadId).pipe(N.retry(T)) : N.void)
+		abortMultipart: (e) => m({
+			bucket: e.destination,
+			tenantId: e.tenantId ?? null,
+			key: e.key
+		}).pipe(A.flatMap((t) => A.suspend(() => t.abortMultipartUpload ? t.abortMultipartUpload(e.key, e.uploadId).pipe(A.retry(L)) : A.void)))
 	};
-}, re = (e) => F.succeed(d, $(e));
-//#endregion
-export { $ as buildStorageService, Z as dataStoreGrantStore, J as dataStoreRefStore, Y as memoryGrantStore, U as memoryRefStore, V as refMatchesListQuery, re as storageServiceLayer, G as toRef };
+}, he = (e) => j.succeed(f, me(e));
+export { me as buildStorageService, de as dataStoreGrantStore, Z as dataStoreRefStore, Q as memoryGrantStore, q as memoryRefStore, G as refMatchesListQuery, he as storageServiceLayer, J as toRef };