The db() plugin automatically attaches guards and synchronization actions across upload, download, and delete flows.

Access & scope validation

Before executing operations, @dimah-s3/db resolves the active session scope via resolveScope(request):

Situation	Response Status	Error Code
`resolveScope` returns `null`	401 Unauthorized	`UNAUTHORIZED`
Target key belongs to another scope	403 Forbidden	`FORBIDDEN`
Target object row not found or soft-deleted	404 Not Found	`OBJECT_NOT_FOUND`

Lifecycle behavior by operation

Upload: Inserts a new row with status: "pending".
Upload Confirmation: Verifies pending state, records verified contentLength from HeadObject, and transitions status to "active".
Download: Enforces that the object has status: "active" and matches the caller's scope.
Delete: Runs S3 DeleteObjectCommand, then updates row status to "deleted" (soft delete) or removes it (hard delete).