The db() plugin automatically attaches guards and synchronization actions across upload, download, and delete flows.

Access and scope validation

Before an operation runs, @dimah-s3/db resolves the active session scope through resolveScope(request):

Situation	Response Status	Error Code
`resolveScope` returns `null`	401 Unauthorized	`UNAUTHORIZED`
Target key belongs to another scope	403 Forbidden	`FORBIDDEN`
Target object row not found or soft-deleted	404 Not Found	`OBJECT_NOT_FOUND`

Lifecycle behavior by operation

Upload — Inserts a new row with status: "pending".
Upload confirmation — Verifies pending state, records verified contentLength from HeadObject, and transitions status to "active".
Download — Enforces that the object has status: "active" and matches the caller's scope.
Delete — Runs S3 DeleteObjectCommand, then updates row status to "deleted" (soft delete) or removes it (hard delete).