@voltro/plugin-storage 0.86.0 → 0.88.0

package/dist/access.js

@@ -1,33 +1,33 @@
-import { randomBytes as e, scryptSync as t, timingSafeEqual as n } from "node:crypto";
-import { Effect as r } from "effect";
-//#region src/access.ts
-var i = (n) => {
-	let r = e(16).toString("hex");
-	return `${r}:${t(n, r, 32).toString("hex")}`;
-}, a = (e, r) => {
-	if (!e || !r) return !1;
-	let [i, a] = r.split(":");
+import { Effect as e } from "effect";
+import { randomBytes as t, scryptSync as n, timingSafeEqual as r } from "node:crypto";
+// src/access.ts
+var i = (e) => {
+	let r = t(16).toString("hex");
+	return `${r}:${n(e, r, 32).toString("hex")}`;
+}, a = (e, t) => {
+	if (!e || !t) return !1;
+	let [i, a] = t.split(":");
 	if (!i || !a) return !1;
-	let o = Buffer.from(a, "hex"), s = t(e, i, o.length);
-	return s.length === o.length && n(s, o);
-}, o = (e) => Array.isArray(e) ? e.filter((e) => typeof e == "string") : [], s = (e) => o(e.metadata?.roles), c = (e) => o(e.scopes), l = (e, t) => e.some((e) => t.includes(e)), u = (e) => o(e.metadata?.groups), d = (e) => typeof e == "boolean" ? r.succeed(e) : r.isEffect(e) ? e : r.promise(() => e), f = (e, t, n = {}) => r.gen(function* () {
-	if (t.id && e.ownerId && t.id === e.ownerId) return !0;
-	let i = e.accessPolicy ?? [];
+	let o = Buffer.from(a, "hex"), s = n(e, i, o.length);
+	return s.length === o.length && r(s, o);
+}, o = (e) => Array.isArray(e) ? e.filter((e) => typeof e == "string") : [], s = (e) => o(e.metadata?.roles), c = (e) => o(e.scopes), l = (e, t) => e.some((e) => t.includes(e)), u = (e) => o(e.metadata?.groups), d = (t) => typeof t == "boolean" ? e.succeed(t) : e.isEffect(t) ? t : e.promise(() => t), f = (t, n, r = {}) => e.gen(function* () {
+	if (n.id && t.ownerId && n.id === t.ownerId) return !0;
+	let i = t.accessPolicy ?? [];
 	if (i.length === 0) return !1;
-	let a = n.resolveGroups ? yield* r.promise(async () => await n.resolveGroups(t)) : u(t);
-	for (let r of i) if (yield* p(r, e, t, a, n)) return !0;
+	let a = r.resolveGroups ? yield* e.promise(async () => await r.resolveGroups(n)) : u(n);
+	for (let e of i) if (yield* p(e, t, n, a, r)) return !0;
 	return !1;
-}), p = (e, t, n, i, o) => r.gen(function* () {
-	let r = !1, u = (e) => (r = !0, e);
-	if (e.owner !== void 0 && e.owner && !u(!!n.id && !!t.ownerId && n.id === t.ownerId) || e.tenant !== void 0 && e.tenant && !u(!!n.tenantId && n.tenantId === t.tenantId) || e.apiKey !== void 0 && e.apiKey && !u(n.type === "apiKey") || e.roles && e.roles.length > 0 && !u(l(s(n), e.roles)) || e.groups && e.groups.length > 0 && !u(l(i, e.groups)) || e.scopes && e.scopes.length > 0 && !u(l(c(n), e.scopes)) || e.password !== void 0 && e.password && !u(a(o.password, t.passwordHash))) return !1;
-	if (e.guard) {
-		let r = o.guards?.[e.guard];
-		if (!u(r ? yield* d(r({
-			subject: n,
-			ref: t
+}), p = (t, n, r, i, o) => e.gen(function* () {
+	let e = !1, u = (t) => (e = !0, t);
+	if (t.owner !== void 0 && t.owner && !u(!!r.id && !!n.ownerId && r.id === n.ownerId) || t.tenant !== void 0 && t.tenant && !u(!!r.tenantId && r.tenantId === n.tenantId) || t.apiKey !== void 0 && t.apiKey && !u(r.type === "apiKey") || t.roles && t.roles.length > 0 && !u(l(s(r), t.roles)) || t.groups && t.groups.length > 0 && !u(l(i, t.groups)) || t.scopes && t.scopes.length > 0 && !u(l(c(r), t.scopes)) || t.password !== void 0 && t.password && !u(a(o.password, n.passwordHash))) return !1;
+	if (t.guard) {
+		let e = o.guards?.[t.guard];
+		if (!u(e ? yield* d(e({
+			subject: r,
+			ref: n
 		})) : !1)) return !1;
 	}
-	return r;
+	return e;
 }), m = (e, t) => {
 	let n = [];
 	e.id && n.push({
@@ -42,6 +42,5 @@ var i = (n) => {
 }, h = (e, t, n, r, i) => {
 	let a = m(t, n);
 	return e.some((e) => e.expiresAt && e.expiresAt.getTime() < i || r === "write" && e.permission !== "write" ? !1 : a.some((t) => t.type === e.principalType && t.id === e.principalId));
-}, g = (e, t) => t.resolveGroups ? r.promise(async () => await t.resolveGroups(e)) : r.succeed(u(e));
-//#endregion
+}, g = (t, n) => n.resolveGroups ? e.promise(async () => await n.resolveGroups(t)) : e.succeed(u(t));
 export { f as evaluatePolicy, h as grantsAllow, i as hashPassword, g as resolveSubjectGroups, m as subjectPrincipals, a as verifyPassword };

package/dist/assetRef.js

@@ -1,6 +1,6 @@
 import { _voltroStorageRefsTable as e } from "./table.js";
 import { mixin as t, reference as n, text as r } from "@voltro/database";
-//#region src/assetRef.ts
+// src/assetRef.ts
 function i(t = {}) {
 	let i = t.nullable ?? !0, a = t.fk === !1 ? r().externalId() : n(() => e, { onDelete: t.onDelete ?? "setNull" });
 	return i ? a.nullable() : a;
@@ -9,5 +9,4 @@ var a = () => t({
 	id: "@voltro/plugin-storage/withStorage",
 	fields: { asset: i() }
 });
-//#endregion
 export { i as assetRef, a as withStorage };

package/dist/avatar.js

@@ -1,6 +1,6 @@
 import { StorageError as e } from "./types.js";
 import { Effect as t } from "effect";
-//#region src/avatar.ts
+// src/avatar.ts
 var n = {
 	"image/png": "png",
 	"image/jpeg": "jpg",
@@ -35,5 +35,4 @@ var n = {
 		key: `avatars/${a.userId}/avatar.${s}`
 	});
 });
-//#endregion
 export { r as decodeDataUri, i as putAvatar };

package/dist/byteSecurity.d.ts

@@ -0,0 +1,3 @@
+export declare const storageByteSecurityHeaders: (contentType: string) => Readonly<Record<string, string>>;
+
+export { }

package/dist/byteSecurity.js

@@ -0,0 +1,6 @@
+// src/byteSecurity.ts
+var e = /^(?:image\/(?!svg)|video\/|audio\/|application\/pdf(?:;|$)|text\/plain(?:;|$))/i, t = (t) => ({
+	"x-content-type-options": "nosniff",
+	"content-disposition": e.test(t) ? "inline" : "attachment"
+});
+export { t as storageByteSecurityHeaders };

package/dist/connection.js

@@ -0,0 +1,98 @@
+import { storageObjectNamespace as e } from "./storageNamespaces.js";
+import { azureConnectionTransport as t, databaseProvider as n, filesystemProvider as r, memoryProviderWithState as i, s3ConnectionTransport as a } from "./providers.js";
+import { StorageError as o } from "@voltro/kv/storage";
+import { Effect as s } from "effect";
+// src/connection.ts
+var c = (t, n = "") => {
+	if (!n) return t;
+	let r = (e) => `${n}${e}`;
+	return {
+		...t,
+		objectNamespace: t.objectNamespace.pipe(s.map((t) => e([
+			"prefixed-object-namespace",
+			t,
+			n
+		]))),
+		...t.objectLocation === void 0 ? {} : { objectLocation: (e) => t.objectLocation(r(e)) },
+		put: (e, ...n) => t.put(r(e), ...n),
+		get: (e) => t.get(r(e)),
+		delete: (e) => t.delete(r(e)),
+		head: (e) => t.head(r(e)),
+		getUrl: (e, ...n) => t.getUrl(r(e), ...n),
+		...t.publicUrl === void 0 ? {} : { publicUrl: (e) => t.publicUrl(r(e)) },
+		...t.setObjectPublic === void 0 ? {} : { setObjectPublic: (e, n) => t.setObjectPublic(r(e), n) },
+		...t.getUploadUrl === void 0 ? {} : { getUploadUrl: (e, n, i) => t.getUploadUrl(r(e), n, i) },
+		...t.createMultipartUpload === void 0 ? {} : { createMultipartUpload: (e, n, i) => t.createMultipartUpload(r(e), n, i) },
+		...t.presignUploadPart === void 0 ? {} : { presignUploadPart: (e, n, i, a) => t.presignUploadPart(r(e), n, i, a) },
+		...t.completeMultipartUpload === void 0 ? {} : { completeMultipartUpload: (e, n, i) => t.completeMultipartUpload(r(e), n, i) },
+		...t.abortMultipartUpload === void 0 ? {} : { abortMultipartUpload: (e, n) => t.abortMultipartUpload(r(e), n) },
+		...t.getStream === void 0 ? {} : { getStream: (e) => t.getStream(r(e)) },
+		...t.putStream === void 0 ? {} : { putStream: (e, n, i) => t.putStream(r(e), n, i) },
+		...t.getRange === void 0 ? {} : { getRange: (e, n, i) => t.getRange(r(e), n, i) }
+	};
+}, l = (e, l) => s.suspend(() => {
+	let u;
+	switch (e.provider) {
+		case "s3":
+		case "minio":
+			u = a({
+				bucket: e.bucket,
+				name: e.provider,
+				...e.region === void 0 ? {} : { region: e.region },
+				...e.endpoint === void 0 ? {} : { endpoint: e.endpoint },
+				...e.accessKeyId === void 0 ? {} : { accessKeyId: e.accessKeyId },
+				...e.secretAccessKey === void 0 ? {} : { secretAccessKey: e.secretAccessKey },
+				...e.cdnBaseUrl === void 0 ? {} : { cdnBaseUrl: e.cdnBaseUrl },
+				...e.publicAcl === void 0 ? {} : { publicAcl: e.publicAcl },
+				forcePathStyle: e.forcePathStyle ?? e.provider === "minio"
+			});
+			break;
+		case "filesystem":
+			u = {
+				provider: r({ root: e.root }),
+				close: s.void,
+				probe: s.tryPromise({
+					try: async () => {
+						let t = await import("node:fs/promises");
+						if (!(await t.stat(e.root)).isDirectory()) throw Error("Storage root must be a directory");
+						await t.access(e.root);
+					},
+					catch: () => new o({
+						provider: "filesystem",
+						message: "Storage root is not readable",
+						transient: !1
+					})
+				})
+			};
+			break;
+		case "memory":
+			u = {
+				provider: i(l.memory ?? /* @__PURE__ */ new Map()),
+				probe: s.void,
+				close: s.void
+			};
+			break;
+		case "database": {
+			let e = n();
+			u = {
+				provider: e,
+				probe: e.head("_connection_readiness").pipe(s.asVoid),
+				close: s.void
+			};
+			break;
+		}
+		case "azure": u = t({
+			container: e.bucket,
+			...e.accountName === void 0 ? {} : { accountName: e.accountName },
+			...e.accountKey === void 0 ? {} : { accountKey: e.accountKey },
+			...e.connectionString === void 0 ? {} : { connectionString: e.connectionString },
+			...e.endpoint === void 0 ? {} : { endpoint: e.endpoint },
+			...e.cdnBaseUrl === void 0 ? {} : { cdnBaseUrl: e.cdnBaseUrl }
+		});
+	}
+	return s.succeed({
+		...u,
+		provider: c(u.provider, e.keyPrefix)
+	});
+});
+export { l as connectStorage, c as withStorageKeyPrefix };

package/dist/constraints.js

@@ -1,4 +1,4 @@
-//#region src/constraints.ts
+// src/constraints.ts
 var e = (e, t) => {
 	if (!t || t.length === 0) return !0;
 	let n = e.toLowerCase();
@@ -89,5 +89,4 @@ var e = (e, t) => {
 	reason: "content-type-not-allowed",
 	detail: `content type '${r}' is not in the allow-list`
 } : null;
-//#endregion
 export { r as checkLimits, e as contentTypeAllowed, n as sniffMatches };

package/dist/custody.js

@@ -0,0 +1,131 @@
+import { StorageError as e } from "./types.js";
+import { storageMetadataError as t } from "./metadataError.js";
+import { readRetainedStorageObject as n } from "./retainedObjects.js";
+import { abandonRetainedCapture as r, admitRetainedCaptureObject as i, inspectRetainedSource as a, registerRetainedCapture as o, retainedCaptureItems as s, runRetainedCapture as c, sealRetainedCapture as l } from "./retainedCapture.js";
+import { Context as u, Effect as d, Layer as f, Schema as p, Stream as m } from "effect";
+import { canonicalJson as h, pluginInstanceName as g } from "@voltro/protocol";
+// src/custody.ts
+var _ = "@voltro/plugin-storage", v = (e) => g({
+	base: _,
+	alias: e.alias,
+	instance: e.name
+}), y = (e) => `${_}/StorageCustody:${JSON.stringify(e)}`, b = class extends u.Service()(y(_)) {
+	static withSource(e) {
+		return d.suspend(() => {
+			let t = E.get(e.source), n = E.get(e.destination);
+			return t === void 0 || n === void 0 ? d.fail(x("Custody transfer requires configured storage services")) : t !== n && v(t.selection) === v(n.selection) ? d.fail(x("Custody source and destination need distinct configured instance identities")) : d.succeed(D(n, t));
+		});
+	}
+	static forInstance(e = {}) {
+		return u.Service(y(v(e)));
+	}
+}, x = (t, n = 409) => new e({
+	provider: "custody",
+	message: t,
+	status: n,
+	transient: !1
+}), S = (n) => p.is(e)(n) ? n : t(n, "custody"), C = (e) => d.tryPromise({
+	try: e,
+	catch: S
+}), w = (e) => ({
+	id: e.id,
+	instance: e.instance,
+	objectNamespace: e.objectNamespace,
+	tenantId: e.tenantId,
+	bucket: e.bucket,
+	contextDigest: e.contextDigest,
+	...e.source === void 0 ? {} : { source: {
+		instance: e.source.instance,
+		objectNamespace: e.source.objectNamespace,
+		bucket: e.source.bucket
+	} }
+}), T = (e) => ({
+	...w(e),
+	count: e.count,
+	digest: e.digest
+}), E = /* @__PURE__ */ new WeakMap(), D = (e, t = e) => {
+	let u = v(t.selection), f = v(e.selection), p = e.bucket, g = e.provider, _ = (t) => d.gen(function* () {
+		let n = yield* g.objectNamespace;
+		if (t !== void 0 && (t.instance !== f || t.bucket !== p || t.objectNamespace !== n)) return yield* d.fail(x("Capture belongs to another storage instance or bucket", 403));
+		let r = e.store();
+		return yield* r === void 0 ? d.fail(x("Storage custody requires a bound database and the default reference and grant stores")) : d.succeed(r);
+	}), y = () => d.gen(function* () {
+		let e = yield* t.provider.objectNamespace;
+		return u === f && t.bucket === p ? void 0 : {
+			instance: u,
+			objectNamespace: e,
+			bucket: t.bucket
+		};
+	}), b = () => d.gen(function* () {
+		let e = yield* _();
+		return t.store() === e ? e : yield* d.fail(x("Custody source and destination must share the bound application database"));
+	}), D = {
+		inspect: (e, n) => d.gen(function* () {
+			let r = n.id, i = n.tenantId;
+			yield* b();
+			let o = yield* t.provider.objectNamespace;
+			return yield* C(() => a(e, {
+				instance: u,
+				objectNamespace: o,
+				bucket: t.bucket,
+				tenantId: i
+			}, r));
+		}),
+		register: (e, t) => d.gen(function* () {
+			let n = yield* y(), r = {
+				id: t.id,
+				instance: f,
+				objectNamespace: yield* g.objectNamespace,
+				tenantId: t.tenantId,
+				bucket: p,
+				contextDigest: t.contextDigest,
+				...n === void 0 ? {} : { source: n }
+			}, i = t.maxBytes, a = t.sources;
+			return yield* b(), {
+				key: r,
+				count: (yield* C(() => o(e, r, {
+					maxBytes: i,
+					sources: a
+				}))).count
+			};
+		}),
+		run: (n) => d.gen(function* () {
+			let r = w(n);
+			yield* _(r);
+			let i = yield* b();
+			yield* c(i, g, r, e.quota, {
+				instance: u,
+				bucket: t.bucket,
+				provider: t.provider
+			}).pipe(d.mapError(S));
+		}),
+		seal: (e, t) => d.gen(function* () {
+			let n = w(t);
+			return yield* _(n), yield* C(() => l(e, n));
+		}),
+		items: (e, t) => m.unwrap(d.gen(function* () {
+			let n = T(e), r = yield* _(n);
+			return m.fromAsyncIterable(s(t ?? r, n), S);
+		})),
+		read: (e, t, r) => d.gen(function* () {
+			let a = T(e), o = yield* d.try({
+				try: () => JSON.parse(h(t)),
+				catch: S
+			}), s = {
+				storageInstance: f,
+				tenantId: r.tenantId,
+				maxBytes: r.maxBytes,
+				bucket: p
+			};
+			if (a.tenantId !== s.tenantId || o.tenantId !== s.tenantId) return yield* d.fail(x("Capture tenant does not match admitted tenant", 403));
+			let c = yield* _(a);
+			return yield* C(() => i(c, a, o)), yield* n(c, g, o, s).pipe(d.mapError(S));
+		}),
+		abandon: (e) => d.gen(function* () {
+			let t = w(e), n = yield* _(t);
+			yield* r(n, g, t).pipe(d.mapError(S));
+		})
+	};
+	return E.set(D, e), D;
+}, O = (e) => f.succeed(b.forInstance(e.selection), D(e));
+export { b as StorageCustody, O as storageCustodyLayer };

package/dist/derivatives.js

@@ -1,5 +1,5 @@
 import { isTransformable as e, loadSharp as t } from "./transform.js";
-//#region src/derivatives.ts
+// src/derivatives.ts
 var n = async (n, r, i) => {
 	if (!e(r)) return { bytes: n };
 	let a = await t();
@@ -26,5 +26,4 @@ var n = async (n, r, i) => {
 		return { bytes: n };
 	}
 };
-//#endregion
 export { n as extractImageMetadata };

package/dist/env.js

@@ -1,5 +1,5 @@
 import { pluginEnv as e } from "@voltro/env";
-//#region src/env.ts
+// src/env.ts
 var t = e([
 	{
 		name: "STORAGE_PROVIDER",
@@ -131,7 +131,13 @@ var t = e([
 		name: "VOLTRO_STORAGE_SECRET",
 		required: !1,
 		secret: !0,
-		description: "HMAC secret for signed grant tokens. Falls back to the session secret."
+		description: "HMAC secret for signed storage links and upload tickets. Falls back to the session secret (and its VOLTRO_SESSION_SECRET_PREVIOUS)."
+	},
+	{
+		name: "VOLTRO_STORAGE_SECRET_PREVIOUS",
+		required: !1,
+		secret: !0,
+		description: "During a VOLTRO_STORAGE_SECRET rotation: the secret links and tickets were signed with until now. They keep verifying until they expire; then remove it."
 	},
 	{
 		name: "VOLTRO_SESSION_COOKIE",
@@ -152,5 +158,4 @@ var t = e([
 		description: "clamd port for the optional clamav virus scanner. Default 3310."
 	}
 ]);
-//#endregion
 export { t as storageEnv };

package/dist/grant.js

@@ -1,112 +1,131 @@
 import { storageEnv as e } from "./env.js";
-import { createHmac as t, timingSafeEqual as n } from "node:crypto";
-import { Exit as r, Schema as i } from "effect";
+import { Exit as t, Schema as n } from "effect";
+import { createHmac as r, timingSafeEqual as i } from "node:crypto";
 import { StorageAccessPolicySchema as a } from "@voltro/protocol";
-import { resolveSessionSecret as o } from "@voltro/protocol/session";
-//#region src/grant.ts
-var s = () => e.read("VOLTRO_STORAGE_SECRET") ?? o(), c = (e) => (typeof e == "string" ? Buffer.from(e, "utf8") : e).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, ""), l = (e) => {
+import { noteConfigured as o, noteSigned as s, noteSigningLifetime as c, previousAccepted as l, resolveSessionSecrets as u } from "@voltro/protocol/session";
+// src/grant.ts
+var d = () => {
+	let t = e.read("VOLTRO_STORAGE_SECRET");
+	if (t !== void 0 && t !== "") {
+		let n = e.read("VOLTRO_STORAGE_SECRET_PREVIOUS");
+		return o("storage", t, n), n === void 0 || n === "" || n === t || !l("storage", n) ? [t] : [t, n];
+	}
+	let n = u();
+	return n.previous === void 0 ? [n.current.secret] : [n.current.secret, n.previous.secret];
+}, f = (t, n) => {
+	s(t === e.read("VOLTRO_STORAGE_SECRET") ? "storage" : "session", t, n * 1e3);
+}, p = (t) => {
+	c(e.read("VOLTRO_STORAGE_SECRET") ? "storage" : "session", t * 1e3);
+}, m = () => d()[0], h = (e, t, n) => {
+	let a = v(t), o = !1;
+	for (let t of typeof n == "string" ? [n] : n) {
+		if (!t) continue;
+		let n = r("sha256", t).update(e).digest();
+		a.length === n.length && i(a, n) && (o = !0);
+	}
+	return o;
+}, g = (e) => typeof e == "string" ? e.length > 0 : e.some((e) => e.length > 0), _ = (e) => (typeof e == "string" ? Buffer.from(e, "utf8") : e).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, ""), v = (e) => {
 	let t = e.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - e.length % 4) % 4);
 	return Buffer.from(t, "base64");
-}, u = (e, n, r = s(), i = "/_voltro/storage") => {
-	if (!r) throw Error("signGrant: secret must be a non-empty string");
+}, y = (e, t, n = m(), i = "/_voltro/storage") => {
+	if (!n) throw Error("signGrant: secret must be a non-empty string");
 	let a = {
 		refId: e,
 		audience: i,
-		exp: Math.floor(Date.now() / 1e3) + Math.floor(n)
-	}, o = c(JSON.stringify(a));
-	return `${o}.${c(t("sha256", r).update(o).digest())}`;
-}, d = (e, r = s()) => {
-	if (!e || !r) return null;
-	let i = e.indexOf(".");
-	if (i <= 0 || i === e.length - 1) return null;
-	let a = e.slice(0, i), o = e.slice(i + 1), c = t("sha256", r).update(a).digest(), u = l(o);
-	if (u.length !== c.length || !n(u, c)) return null;
+		exp: Math.floor(Date.now() / 1e3) + Math.floor(t)
+	}, o = _(JSON.stringify(a)), s = _(r("sha256", n).update(o).digest());
+	return f(n, a.exp), `${o}.${s}`;
+}, b = (e, t = d()) => {
+	if (!e || !g(t)) return null;
+	let n = e.indexOf(".");
+	if (n <= 0 || n === e.length - 1) return null;
+	let r = e.slice(0, n);
+	if (!h(r, e.slice(n + 1), t)) return null;
 	try {
-		let e = JSON.parse(l(a).toString("utf8"));
+		let e = JSON.parse(v(r).toString("utf8"));
 		return typeof e.audience != "string" || !e.audience || typeof e.refId != "string" || typeof e.exp != "number" || e.exp <= Math.floor(Date.now() / 1e3) ? null : e;
 	} catch {
 		return null;
 	}
-}, f = (e) => e.version !== 2 || typeof e.writeScope != "string" || !/^[a-f0-9]{64}$/.test(e.writeScope) || Object.hasOwn(e, "replicaId") || e.issuerReplicaId !== void 0 && (typeof e.issuerReplicaId != "string" || !e.issuerReplicaId.trim()) ? !1 : e.access === void 0 || e.vis === "private" && r.isSuccess(i.decodeUnknownExit(a, { onExcessProperty: "error" })(e.access)), p = (e, n, r = s()) => {
-	if (!r) throw Error("signUploadTicket: secret must be a non-empty string");
+}, x = (e) => e.version !== 2 || typeof e.writeScope != "string" || !/^[a-f0-9]{64}$/.test(e.writeScope) || Object.hasOwn(e, "replicaId") || e.issuerReplicaId !== void 0 && (typeof e.issuerReplicaId != "string" || !e.issuerReplicaId.trim()) ? !1 : e.access === void 0 || e.vis === "private" && t.isSuccess(n.decodeUnknownExit(a, { onExcessProperty: "error" })(e.access)), S = (e, t, n = m()) => {
+	if (!n) throw Error("signUploadTicket: secret must be a non-empty string");
 	let i = {
 		...e,
 		version: 2,
-		exp: Math.floor(Date.now() / 1e3) + Math.floor(n)
-	}, a = c(JSON.stringify(i));
-	return `${a}.${c(t("sha256", r).update(`u:${a}`).digest())}`;
-}, m = (e, r = s()) => {
-	if (!e || !r) return null;
-	let i = e.indexOf(".");
-	if (i <= 0 || i === e.length - 1) return null;
-	let a = e.slice(0, i), o = e.slice(i + 1), c = t("sha256", r).update(`u:${a}`).digest(), u = l(o);
-	if (u.length !== c.length || !n(u, c)) return null;
+		exp: Math.floor(Date.now() / 1e3) + Math.floor(t)
+	}, a = _(JSON.stringify(i)), o = _(r("sha256", n).update(`u:${a}`).digest());
+	return f(n, i.exp), `${a}.${o}`;
+}, C = (e, t = d()) => {
+	if (!e || !g(t)) return null;
+	let n = e.indexOf(".");
+	if (n <= 0 || n === e.length - 1) return null;
+	let r = e.slice(0, n), i = e.slice(n + 1);
+	if (!h(`u:${r}`, i, t)) return null;
 	try {
-		let e = JSON.parse(l(a).toString("utf8"));
-		return !f(e) || e.operationId !== void 0 && (typeof e.operationId != "string" || !e.operationId.trim() || e.operationId.length > 200) || typeof e.instance != "string" || !e.instance || typeof e.ct != "string" || typeof e.exp != "number" || e.vis !== "public" && e.vis !== "private" || e.exp <= Math.floor(Date.now() / 1e3) ? null : e;
+		let e = JSON.parse(v(r).toString("utf8"));
+		return !x(e) || e.operationId !== void 0 && (typeof e.operationId != "string" || !e.operationId.trim() || e.operationId.length > 200) || typeof e.instance != "string" || !e.instance || typeof e.ct != "string" || typeof e.exp != "number" || typeof e.destination != "string" || !e.destination || e.destination.includes("\0") || /[\uD800-\uDFFF]/u.test(e.destination) || e.vis !== "public" && e.vis !== "private" || e.exp <= Math.floor(Date.now() / 1e3) ? null : e;
 	} catch {
 		return null;
 	}
-}, h = (e, n, r = s()) => {
-	if (!r) throw Error("signFinalizeTicket: secret must be a non-empty string");
+}, w = (e, t, n = m()) => {
+	if (!n) throw Error("signFinalizeTicket: secret must be a non-empty string");
 	let i = {
 		...e,
 		version: 2,
-		exp: Math.floor(Date.now() / 1e3) + Math.floor(n)
-	}, a = c(JSON.stringify(i));
-	return `${a}.${c(t("sha256", r).update(`f:${a}`).digest())}`;
-}, g = (e, r = s()) => {
-	if (!e || !r) return null;
-	let i = e.indexOf(".");
-	if (i <= 0 || i === e.length - 1) return null;
-	let a = e.slice(0, i), o = e.slice(i + 1), c = t("sha256", r).update(`f:${a}`).digest(), u = l(o);
-	if (u.length !== c.length || !n(u, c)) return null;
+		exp: Math.floor(Date.now() / 1e3) + Math.floor(t)
+	}, a = _(JSON.stringify(i)), o = _(r("sha256", n).update(`f:${a}`).digest());
+	return f(n, i.exp), `${a}.${o}`;
+}, T = (e, t = d()) => {
+	if (!e || !g(t)) return null;
+	let n = e.indexOf(".");
+	if (n <= 0 || n === e.length - 1) return null;
+	let r = e.slice(0, n), i = e.slice(n + 1);
+	if (!h(`f:${r}`, i, t)) return null;
 	try {
-		let e = JSON.parse(l(a).toString("utf8"));
-		return !f(e) || typeof e.key != "string" || e.key.length === 0 || typeof e.instance != "string" || !e.instance || typeof e.ct != "string" || typeof e.exp != "number" || e.vis !== "public" && e.vis !== "private" || e.exp <= Math.floor(Date.now() / 1e3) ? null : e;
+		let e = JSON.parse(v(r).toString("utf8"));
+		return !x(e) || typeof e.key != "string" || e.key.length === 0 || typeof e.instance != "string" || !e.instance || typeof e.ct != "string" || typeof e.exp != "number" || typeof e.destination != "string" || !e.destination || e.destination.includes("\0") || /[\uD800-\uDFFF]/u.test(e.destination) || e.vis !== "public" && e.vis !== "private" || e.exp <= Math.floor(Date.now() / 1e3) ? null : e;
 	} catch {
 		return null;
 	}
-}, _ = (e, n, r = s()) => {
-	if (!r) throw Error("signResumableTicket: secret must be a non-empty string");
+}, E = (e, t, n = m()) => {
+	if (!n) throw Error("signResumableTicket: secret must be a non-empty string");
 	let i = {
 		...e,
 		version: 2,
-		exp: Math.floor(Date.now() / 1e3) + Math.floor(n)
-	}, a = c(JSON.stringify(i));
-	return `${a}.${c(t("sha256", r).update(`r:${a}`).digest())}`;
-}, v = (e, r = s()) => {
-	if (!e || !r) return null;
-	let i = e.indexOf(".");
-	if (i <= 0 || i === e.length - 1) return null;
-	let a = e.slice(0, i), o = e.slice(i + 1), c = t("sha256", r).update(`r:${a}`).digest(), u = l(o);
-	if (u.length !== c.length || !n(u, c)) return null;
+		exp: Math.floor(Date.now() / 1e3) + Math.floor(t)
+	}, a = _(JSON.stringify(i)), o = _(r("sha256", n).update(`r:${a}`).digest());
+	return f(n, i.exp), `${a}.${o}`;
+}, D = (e, t = d()) => {
+	if (!e || !g(t)) return null;
+	let n = e.indexOf(".");
+	if (n <= 0 || n === e.length - 1) return null;
+	let r = e.slice(0, n), i = e.slice(n + 1);
+	if (!h(`r:${r}`, i, t)) return null;
 	try {
-		let e = JSON.parse(l(a).toString("utf8"));
-		return !f(e) || typeof e.id != "string" || e.id.length === 0 || typeof e.size != "number" || e.size < 0 || typeof e.instance != "string" || !e.instance || typeof e.ct != "string" || typeof e.exp != "number" || e.vis !== "public" && e.vis !== "private" || e.exp <= Math.floor(Date.now() / 1e3) ? null : e;
+		let e = JSON.parse(v(r).toString("utf8"));
+		return !x(e) || typeof e.id != "string" || e.id.length === 0 || typeof e.size != "number" || e.size < 0 || typeof e.instance != "string" || !e.instance || typeof e.ct != "string" || typeof e.exp != "number" || typeof e.destination != "string" || !e.destination || e.destination.includes("\0") || /[\uD800-\uDFFF]/u.test(e.destination) || e.vis !== "public" && e.vis !== "private" || e.exp <= Math.floor(Date.now() / 1e3) ? null : e;
 	} catch {
 		return null;
 	}
-}, y = (e, n, r = s()) => {
-	if (!r) throw Error("signMultipartTicket: secret must be a non-empty string");
+}, O = (e, t, n = m()) => {
+	if (!n) throw Error("signMultipartTicket: secret must be a non-empty string");
 	let i = {
 		...e,
 		version: 2,
-		exp: Math.floor(Date.now() / 1e3) + Math.floor(n)
-	}, a = c(JSON.stringify(i));
-	return `${a}.${c(t("sha256", r).update(`m:${a}`).digest())}`;
-}, b = (e, r = s()) => {
-	if (!e || !r) return null;
-	let i = e.indexOf(".");
-	if (i <= 0 || i === e.length - 1) return null;
-	let a = e.slice(0, i), o = e.slice(i + 1), c = t("sha256", r).update(`m:${a}`).digest(), u = l(o);
-	if (u.length !== c.length || !n(u, c)) return null;
+		exp: Math.floor(Date.now() / 1e3) + Math.floor(t)
+	}, a = _(JSON.stringify(i)), o = _(r("sha256", n).update(`m:${a}`).digest());
+	return f(n, i.exp), `${a}.${o}`;
+}, k = (e, t = d()) => {
+	if (!e || !g(t)) return null;
+	let n = e.indexOf(".");
+	if (n <= 0 || n === e.length - 1) return null;
+	let r = e.slice(0, n), i = e.slice(n + 1);
+	if (!h(`m:${r}`, i, t)) return null;
 	try {
-		let e = JSON.parse(l(a).toString("utf8"));
-		return !f(e) || typeof e.key != "string" || e.key.length === 0 || typeof e.uploadId != "string" || e.uploadId.length === 0 || typeof e.instance != "string" || !e.instance || typeof e.ct != "string" || typeof e.exp != "number" || e.vis !== "public" && e.vis !== "private" || e.exp <= Math.floor(Date.now() / 1e3) ? null : e;
+		let e = JSON.parse(v(r).toString("utf8"));
+		return !x(e) || typeof e.key != "string" || e.key.length === 0 || typeof e.uploadId != "string" || e.uploadId.length === 0 || typeof e.instance != "string" || !e.instance || typeof e.ct != "string" || typeof e.exp != "number" || typeof e.destination != "string" || !e.destination || e.destination.includes("\0") || /[\uD800-\uDFFF]/u.test(e.destination) || e.vis !== "public" && e.vis !== "private" || e.exp <= Math.floor(Date.now() / 1e3) ? null : e;
 	} catch {
 		return null;
 	}
 };
-//#endregion
-export { s as resolveStorageSecret, h as signFinalizeTicket, u as signGrant, y as signMultipartTicket, _ as signResumableTicket, p as signUploadTicket, g as verifyFinalizeTicket, d as verifyGrant, b as verifyMultipartTicket, v as verifyResumableTicket, m as verifyUploadTicket };
+export { p as declareStorageSigningLifetime, m as resolveStorageSecret, d as resolveStorageSecrets, w as signFinalizeTicket, y as signGrant, O as signMultipartTicket, E as signResumableTicket, S as signUploadTicket, T as verifyFinalizeTicket, b as verifyGrant, k as verifyMultipartTicket, D as verifyResumableTicket, C as verifyUploadTicket };