@segmentstream-cloud/ontology 0.9.0 → 0.10.0

package/dist/service/service.js

@@ -1,6 +1,7 @@
-import { Cause, Context, Effect, Layer } from "effect";
+import { Cause, Context, Effect, Layer, Redacted } from "effect";
 import { HttpRouter, HttpServer, HttpServerError } from "effect/unstable/http";
 import { HttpApiBuilder } from "effect/unstable/httpapi";
+import { storageMaintenanceAuthenticationLayer } from "../storage/maintenance-auth.js";
 import { nameToWire } from "../authoring-names.js";
 import { sqlServiceRuntime } from "../runtime/service-binding.js";
 import { ErrorResponsesLive, buildApi } from "./api.js";
@@ -58,18 +59,32 @@ function decorate(response, requestId, hash) {
  * answer with a JSON error and never a stack or SQL.
  */
 export function createOntologyService(ontology, config) {
+    if (config.blobStorage &&
+        (!config.storageMaintenanceKey || Redacted.value(config.storageMaintenanceKey).length < 32)) {
+        throw new OntologyServiceConfigError({
+            message: "File storage requires a deployment maintenance credential of at least 32 characters.",
+        });
+    }
     const runtime = config.runtime ?? sqlServiceRuntime;
     const plan = planApi(ontology, runtime.generatedActions);
     const built = buildApi(plan);
     const hooks = afterCommitHooks(plan, config.afterCommit);
     const verifyToken = tokenVerifier(config);
     const exchangeSession = config.neonAuth === undefined ? undefined : neonAuthSessionExchange(config.neonAuth);
-    const backend = runtime.connect({ ontology, databaseUrl: config.databaseUrl });
+    const backend = runtime.connect({
+        ontology,
+        databaseUrl: config.databaseUrl,
+        ...(config.blobStorage ? { blobStorage: config.blobStorage } : {}),
+    });
     const connections = config.connections ??
         (config.localConnections === undefined
             ? deployedConnections(config)
             : localConnections(config.localConnections));
-    const routes = HttpApiBuilder.layer(built.api).pipe(Layer.provide(handlersLayer(built, hooks, connections)), Layer.provide([authenticationLayer(verifyToken, exchangeSession), ErrorResponsesLive]), Layer.provide(backend));
+    const routes = HttpApiBuilder.layer(built.api).pipe(Layer.provide(handlersLayer(built, hooks, connections)), Layer.provide([
+        authenticationLayer(verifyToken, exchangeSession),
+        ErrorResponsesLive,
+        storageMaintenanceAuthenticationLayer(config.storageMaintenanceKey),
+    ]), Layer.provide(backend));
     const application = Layer.mergeAll(routes, DocsRoute, UnmatchedRoutes).pipe(Layer.provide(HttpServer.layerServices));
     const web = HttpRouter.toWebHandler(application, { disableLogger: true });
     const hash = ontology.manifest.hash;

package/dist/storage/api.d.ts

@@ -0,0 +1,4 @@
+import { Schema } from "effect";
+import { HttpApiEndpoint, HttpApiGroup } from "effect/unstable/httpapi";
+export declare const STORAGE_GROUP = "BlobStorage";
+export declare function storageGroup(authenticate: (endpoint: HttpApiEndpoint.Top) => HttpApiEndpoint.Top, errors: ReadonlyArray<Schema.Top>, maintenanceErrors: (endpoint: HttpApiEndpoint.Top) => HttpApiEndpoint.Top): HttpApiGroup.HttpApiGroup<"BlobStorage", HttpApiEndpoint.Top | HttpApiEndpoint.HttpApiEndpoint<string, import("effect/unstable/http/HttpMethod").HttpMethod, string, Schema.Top, Schema.Top, Schema.Top, Schema.Top, Schema.Top, Schema.Top, any, unknown>, false>;

package/dist/storage/api.js

@@ -0,0 +1,39 @@
+import { Schema } from "effect";
+import { HttpApiEndpoint, HttpApiGroup } from "effect/unstable/httpapi";
+import { StorageMaintenanceAuthentication } from "./maintenance-auth.js";
+import { BeginUpload, UploadView, TransferGrant } from "./sessions.js";
+export const STORAGE_GROUP = "BlobStorage";
+export function storageGroup(authenticate, errors, maintenanceErrors) {
+    const base = "/api/ontology/uploads";
+    const params = { id: Schema.String.check(Schema.isUUID()) };
+    const endpoints = [
+        HttpApiEndpoint.post("begin", base, {
+            payload: BeginUpload,
+            success: UploadView,
+            error: errors,
+        }),
+        HttpApiEndpoint.get("status", `${base}/:id`, { params, success: UploadView, error: errors }),
+        HttpApiEndpoint.post("part", `${base}/:id/parts`, {
+            params,
+            success: TransferGrant,
+            error: errors,
+        }),
+        HttpApiEndpoint.post("complete", `${base}/:id/complete`, {
+            params,
+            success: UploadView,
+            error: errors,
+        }),
+        HttpApiEndpoint.post("cancel", `${base}/:id/cancel`, {
+            params,
+            success: UploadView,
+            error: errors,
+        }),
+    ];
+    const [first, ...rest] = endpoints.map(authenticate);
+    return HttpApiGroup.make(STORAGE_GROUP)
+        .add(first, ...rest)
+        .add(maintenanceErrors(HttpApiEndpoint.post("maintain", "/api/ontology/internal/storage/maintenance", {
+        success: Schema.Struct({ removed: Schema.Int }),
+        error: errors,
+    })).middleware(StorageMaintenanceAuthentication));
+}

package/dist/storage/authorization.d.ts

@@ -0,0 +1,8 @@
+import { Effect } from "effect";
+import type { SqlError } from "effect/unstable/sql/SqlError";
+import type { Ontology } from "../ontology.js";
+import { PermissionDenied } from "../errors.js";
+/** Re-read user and roles in the same transaction that authorizes a storage operation. */
+export declare function authorizeBlobOperation(ontology: Ontology, sql: {
+    readonly unsafe: (text: string, args: ReadonlyArray<unknown>) => Effect.Effect<ReadonlyArray<Readonly<Record<string, unknown>>>, SqlError>;
+}, principalId: string, required: ReadonlyArray<string>): Effect.Effect<undefined, PermissionDenied | SqlError, never>;

package/dist/storage/authorization.js

@@ -0,0 +1,30 @@
+import { Effect } from "effect";
+import { missingPermission, permissionsOf } from "../permissions.js";
+import { PermissionDenied } from "../errors.js";
+/** Re-read user and roles in the same transaction that authorizes a storage operation. */
+export function authorizeBlobOperation(ontology, sql, principalId, required) {
+    return Effect.gen(function* () {
+        const [catalog] = yield* sql.unsafe(`SELECT hash FROM "_ontology" WHERE id = true FOR SHARE`, []);
+        if (catalog?.hash !== ontology.manifest.hash) {
+            return yield* new PermissionDenied({
+                message: "The deployed ontology no longer matches the database catalog.",
+            });
+        }
+        const users = yield* sql.unsafe(`SELECT kind::text, active FROM "user" WHERE id = $1::uuid FOR SHARE`, [principalId]);
+        const user = users[0];
+        const roles = yield* sql.unsafe(`SELECT role FROM "_user_roles" WHERE user_id = $1::uuid FOR SHARE`, [principalId]);
+        const held = roles.map((row) => String(row.role));
+        if (user?.kind === "member") {
+            held.push("member");
+        }
+        const missing = missingPermission(required, {
+            permissions: permissionsOf(ontology.roles, held),
+        });
+        if (!user?.active || missing) {
+            return yield* new PermissionDenied({
+                message: "The member cannot use this file operation.",
+                ...(missing ? { permission: missing } : {}),
+            });
+        }
+    });
+}

package/dist/storage/maintenance-auth.d.ts

@@ -0,0 +1,20 @@
+import { Layer, Redacted } from "effect";
+import { HttpApiMiddleware, HttpApiSecurity } from "effect/unstable/httpapi";
+import { RequestId } from "../service/errors.js";
+declare const StorageMaintenanceAuthentication_base: HttpApiMiddleware.ServiceClass<StorageMaintenanceAuthentication, "@segmentstream-cloud/ontology/StorageMaintenanceAuthentication", {
+    requires: RequestId;
+    provides: never;
+    error: readonly [import("effect/Schema").Top];
+    clientError: never;
+    requiredForClient: false;
+    security: {
+        readonly maintenanceBearer: HttpApiSecurity.Http;
+    };
+}, HttpApiMiddleware.HttpApiMiddlewareSecurity<{
+    readonly maintenanceBearer: HttpApiSecurity.Http;
+}, never, readonly [import("effect/Schema").Top], RequestId>>;
+/** Deployment scheduler identity: this credential grants only orphan maintenance. */
+export declare class StorageMaintenanceAuthentication extends StorageMaintenanceAuthentication_base {
+}
+export declare function storageMaintenanceAuthenticationLayer(key?: Redacted.Redacted<string>): Layer.Layer<StorageMaintenanceAuthentication, never, never>;
+export {};

package/dist/storage/maintenance-auth.js

@@ -0,0 +1,24 @@
+import { createHash, timingSafeEqual } from "node:crypto";
+import { Effect, Layer, Redacted } from "effect";
+import { HttpApiMiddleware, HttpApiSecurity } from "effect/unstable/httpapi";
+import { RequestId, toServerResponse, unauthorized } from "../service/errors.js";
+import { ErrorSchemas } from "../service/schemas.js";
+/** Deployment scheduler identity: this credential grants only orphan maintenance. */
+export class StorageMaintenanceAuthentication extends HttpApiMiddleware.Service()("@segmentstream-cloud/ontology/StorageMaintenanceAuthentication", {
+    security: { maintenanceBearer: HttpApiSecurity.bearer },
+    error: [ErrorSchemas.unauthorized],
+}) {
+}
+export function storageMaintenanceAuthenticationLayer(key) {
+    return Layer.succeed(StorageMaintenanceAuthentication)({
+        maintenanceBearer: (httpEffect, { credential }) => Effect.gen(function* () {
+            const requestId = yield* RequestId;
+            const digest = (value) => createHash("sha256").update(value).digest();
+            if (!key ||
+                !timingSafeEqual(digest(Redacted.value(credential)), digest(Redacted.value(key)))) {
+                return toServerResponse(unauthorized(requestId, "A deployment maintenance credential is required."));
+            }
+            return yield* httpEffect;
+        }),
+    });
+}

package/dist/storage/maintenance.d.ts

@@ -0,0 +1,7 @@
+import { Effect } from "effect";
+import type { SqlClient } from "effect/unstable/sql";
+import type { BlobProvider } from "./provider.js";
+/** A scheduler-owned capability: lifecycle operations only, with persisted deletion fencing. */
+export declare function maintainBlobStorage(sql: SqlClient.SqlClient, provider: BlobProvider["Service"], limit?: number): Effect.Effect<{
+    removed: number;
+}, import("effect/unstable/sql/SqlError").SqlError | import("./provider.js").BlobStorageError, never>;

package/dist/storage/maintenance.js

@@ -0,0 +1,50 @@
+import { randomUUID } from "node:crypto";
+import { Effect } from "effect";
+/** A scheduler-owned capability: lifecycle operations only, with persisted deletion fencing. */
+export function maintainBlobStorage(sql, provider, limit = 100) {
+    return Effect.gen(function* () {
+        let removed = 0;
+        for (let count = 0; count < limit; count += 1) {
+            const claim = randomUUID();
+            const candidate = yield* sql.withTransaction(Effect.gen(function* () {
+                const [row] = yield* sql.unsafe(`SELECT u.id::text, u.blob_id::text, b.key, u.provider_upload_id
+           FROM "_blob_uploads" u JOIN "_blobs" b ON b.id = u.blob_id
+           WHERE u.state NOT IN ('consumed', 'deleted') AND b.state IN ('ready', 'deleting')
+             AND (u.branch_id <> $1 OR u.expires_at <= now() OR u.state IN ('canceled', 'deleting'))
+             AND (u.claim IS NULL OR u.claimed_at < now() - interval '5 minutes')
+             AND NOT EXISTS (SELECT 1 FROM "_blob_references" r WHERE r.blob_id = b.id)
+           ORDER BY u.created_at LIMIT 1 FOR UPDATE OF u, b SKIP LOCKED`, [provider.binding.branchId]);
+                if (!row) {
+                    return undefined;
+                }
+                yield* sql.unsafe(`UPDATE "_blob_uploads" SET state = 'deleting', claim = $1::uuid,
+          claimed_at = now() WHERE id = $2::uuid`, [claim, row.id]);
+                yield* sql.unsafe(`UPDATE "_blobs" SET state = 'deleting' WHERE id = $1::uuid`, [
+                    row.blob_id,
+                ]);
+                return row;
+            }));
+            if (!candidate) {
+                break;
+            }
+            const handles = new Set([
+                ...(candidate.provider_upload_id ? [candidate.provider_upload_id] : []),
+                ...(yield* provider.pending(candidate.key)),
+            ]);
+            for (const uploadId of handles) {
+                yield* provider.abort({ key: candidate.key, uploadId });
+            }
+            yield* provider.remove(candidate.key);
+            yield* sql.withTransaction(Effect.gen(function* () {
+                const done = yield* sql.unsafe(`UPDATE "_blob_uploads" SET state = 'deleted', claim = NULL,
+          claimed_at = NULL WHERE id = $1::uuid AND state = 'deleting' AND claim = $2::uuid
+          RETURNING blob_id`, [candidate.id, claim]);
+                if (done.length) {
+                    yield* sql.unsafe(`UPDATE "_blobs" SET state = 'deleted' WHERE id = $1::uuid AND state = 'deleting'`, [candidate.blob_id]);
+                    removed += 1;
+                }
+            }));
+        }
+        return { removed };
+    });
+}

package/dist/storage/neon.d.ts

@@ -0,0 +1,3 @@
+import { BlobProvider, type BlobStorageBinding } from "./provider.js";
+/** A branch-bound S3 adapter; never uses the ambient AWS credential chain. */
+export declare function neonBlobProvider(binding: BlobStorageBinding): BlobProvider["Service"];

package/dist/storage/neon.js

@@ -0,0 +1,212 @@
+import { AbortMultipartUploadCommand, CompleteMultipartUploadCommand, CreateMultipartUploadCommand, DeleteObjectCommand, GetObjectCommand, HeadObjectCommand, ListMultipartUploadsCommand, ListPartsCommand, S3Client, UploadPartCommand, } from "@aws-sdk/client-s3";
+import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
+import { Effect } from "effect";
+import { BlobStorageError, } from "./provider.js";
+function missing(error) {
+    return error instanceof Error && ["NotFound", "NoSuchKey", "NoSuchUpload"].includes(error.name);
+}
+function redactStorageFailure(cause, binding) {
+    const seen = new WeakSet();
+    const redact = (value) => {
+        if (typeof value === "string") {
+            return [binding.accessKeyId, binding.secretAccessKey]
+                .reduce((text, secret) => secret
+                ? text
+                    .replaceAll(secret, "[redacted]")
+                    .replaceAll(encodeURIComponent(secret), "[redacted]")
+                : text, value)
+                .replace(/https?:\/\/[^\s"'<>]*[?&]X-Amz-(?:Signature|Credential)=[^\s"'<>]*/gi, "[redacted storage grant]")
+                .replace(/(X-Amz-Signature=)[^&\s]+/gi, "$1[redacted]");
+        }
+        if (value === null || typeof value !== "object") {
+            return value;
+        }
+        if (seen.has(value)) {
+            return "[Circular]";
+        }
+        seen.add(value);
+        if (Array.isArray(value)) {
+            return value.map(redact);
+        }
+        const entries = value instanceof Error
+            ? Object.fromEntries([
+                ["name", value.name],
+                ["message", value.message],
+                ["stack", value.stack],
+                ["cause", value.cause],
+                ...(value instanceof AggregateError ? [["errors", value.errors]] : []),
+                ...Object.entries(value),
+            ])
+            : value;
+        return Object.fromEntries(Object.entries(entries).map(([key, child]) => [key, redact(child)]));
+    };
+    return redact(cause);
+}
+/** A branch-bound S3 adapter; never uses the ambient AWS credential chain. */
+export function neonBlobProvider(binding) {
+    const endpoint = new URL(binding.endpoint);
+    if (endpoint.protocol !== "https:" ||
+        endpoint.username ||
+        endpoint.password ||
+        !endpoint.hostname.startsWith(`${binding.branchId}.storage.`) ||
+        !endpoint.hostname.endsWith(".aws.neon.tech") ||
+        endpoint.pathname !== "/" ||
+        endpoint.search ||
+        endpoint.hash ||
+        endpoint.port) {
+        throw new Error("The ontology storage endpoint does not match its verified branch.");
+    }
+    const client = new S3Client({
+        endpoint: binding.endpoint,
+        region: binding.region,
+        credentials: { accessKeyId: binding.accessKeyId, secretAccessKey: binding.secretAccessKey },
+        forcePathStyle: true,
+        requestChecksumCalculation: "WHEN_REQUIRED",
+        maxAttempts: 1,
+        requestHandler: { requestTimeout: 30000 },
+    });
+    let storageClockOffset;
+    // The SDK's normal skew correction tolerates four minutes, longer than a download grant.
+    // Calibrate every grant from an authenticated response instead of extending its lifetime.
+    client.middlewareStack.add((next) => async (args) => {
+        const result = await next(args);
+        const response = result.response;
+        const serverTime = Date.parse(response.headers?.date ?? "");
+        if (Number.isFinite(serverTime)) {
+            storageClockOffset = serverTime - Date.now();
+        }
+        return result;
+    }, { step: "deserialize", name: "ontologyStorageClock" });
+    const signingDate = () => {
+        if (storageClockOffset === undefined) {
+            throw new Error("Neon did not return a valid server time for the transfer grant.");
+        }
+        return new Date(Date.now() + storageClockOffset);
+    };
+    const object = (key) => ({ Bucket: binding.bucket, Key: key });
+    const disposition = (filename, inline = false) => `${inline ? "inline" : "attachment"}; filename="${filename.replace(/[^a-zA-Z0-9_. -]/g, "_")}"`;
+    const attempt = (operation, run) => Effect.tryPromise({
+        try: run,
+        catch: (cause) => new BlobStorageError({ operation, cause: redactStorageFailure(cause, binding) }),
+    });
+    const grant = (url, method, seconds, signedAt) => ({
+        url,
+        method,
+        headers: {},
+        expiresAt: new Date(signedAt.getTime() + seconds * 1000).toISOString(),
+    });
+    return {
+        binding,
+        close: () => client.destroy(),
+        initiate: ({ key, filename, contentType, sessionId }) => attempt("blob.initiate", async () => {
+            const response = await client.send(new CreateMultipartUploadCommand({
+                ...object(key),
+                ContentType: contentType,
+                ContentDisposition: disposition(filename),
+                CacheControl: "private, no-store",
+                Metadata: { session: sessionId },
+            }));
+            if (!response.UploadId) {
+                throw new Error("Neon did not return a multipart upload ID.");
+            }
+            return response.UploadId;
+        }),
+        signPart: ({ key, uploadId, partNumber, size }) => attempt("blob.sign_part", async () => {
+            await client.send(new ListPartsCommand({ ...object(key), UploadId: uploadId }));
+            const signedAt = signingDate();
+            const url = await getSignedUrl(client, new UploadPartCommand({
+                ...object(key),
+                UploadId: uploadId,
+                PartNumber: partNumber,
+                ContentLength: size,
+            }), {
+                expiresIn: 300,
+                signingDate: signedAt,
+                signableHeaders: new Set(["content-length"]),
+            });
+            return grant(url, "PUT", 300, signedAt);
+        }),
+        parts: ({ key, uploadId }) => attempt("blob.parts", async () => {
+            const response = await client.send(new ListPartsCommand({ ...object(key), UploadId: uploadId }));
+            if (response.IsTruncated) {
+                throw new Error("Unexpected truncated multipart session.");
+            }
+            return (response.Parts ?? []).map((part) => {
+                if (!part.PartNumber || part.Size === undefined || !part.ETag) {
+                    throw new Error("Neon returned incomplete part metadata.");
+                }
+                return { number: part.PartNumber, size: part.Size, etag: part.ETag };
+            });
+        }),
+        complete: ({ key, uploadId, parts }) => attempt("blob.complete", async () => {
+            await client.send(new CompleteMultipartUploadCommand({
+                ...object(key),
+                UploadId: uploadId,
+                MultipartUpload: {
+                    Parts: parts.map((part) => ({ PartNumber: part.number, ETag: part.etag })),
+                },
+            }));
+        }),
+        inspect: (key) => attempt("blob.inspect", async () => {
+            try {
+                const response = await client.send(new HeadObjectCommand(object(key)));
+                if (response.ContentLength === undefined ||
+                    !response.ContentType ||
+                    !response.Metadata?.session) {
+                    throw new Error("Neon returned incomplete object metadata.");
+                }
+                return {
+                    size: response.ContentLength,
+                    contentType: response.ContentType,
+                    sessionId: response.Metadata.session,
+                };
+            }
+            catch (error) {
+                if (missing(error)) {
+                    return undefined;
+                }
+                throw error;
+            }
+        }),
+        readPrefix: (key) => attempt("blob.read_prefix", async () => {
+            const response = await client.send(new GetObjectCommand({ ...object(key), Range: "bytes=0-511" }));
+            if (!response.Body) {
+                throw new Error("Neon returned no object body.");
+            }
+            return response.Body.transformToByteArray();
+        }),
+        download: ({ key, filename, contentType, inline }) => attempt("blob.download", async () => {
+            await client.send(new HeadObjectCommand(object(key)));
+            const signedAt = signingDate();
+            const url = await getSignedUrl(client, new GetObjectCommand({
+                ...object(key),
+                ResponseContentType: contentType,
+                ResponseContentDisposition: disposition(filename, inline),
+                ResponseCacheControl: "private, no-store",
+            }), { expiresIn: 60, signingDate: signedAt });
+            return grant(url, "GET", 60, signedAt);
+        }),
+        abort: ({ key, uploadId }) => attempt("blob.abort", async () => {
+            try {
+                await client.send(new AbortMultipartUploadCommand({ ...object(key), UploadId: uploadId }));
+            }
+            catch (error) {
+                if (!missing(error)) {
+                    throw error;
+                }
+            }
+        }),
+        remove: (key) => attempt("blob.remove", async () => {
+            await client.send(new DeleteObjectCommand(object(key)));
+        }),
+        pending: (key) => attempt("blob.pending", async () => {
+            const response = await client.send(new ListMultipartUploadsCommand({ Bucket: binding.bucket, Prefix: key }));
+            if (response.IsTruncated) {
+                throw new Error("Unexpected truncated initialization recovery.");
+            }
+            return (response.Uploads ?? [])
+                .filter((upload) => upload.Key === key && upload.UploadId)
+                .map((upload) => upload.UploadId);
+        }),
+    };
+}

package/dist/storage/operator.d.ts

@@ -0,0 +1,10 @@
+import { Effect, Redacted } from "effect";
+import { BlobStorageError, type BlobStorageBinding } from "./provider.js";
+/** Scheduler capability that survives removal of blob declarations. Never reads file contents. */
+export declare function runBlobStorageMaintenance(input: {
+    readonly databaseUrl: Redacted.Redacted<string>;
+    readonly binding: Redacted.Redacted<BlobStorageBinding>;
+    readonly limit?: number;
+}): Effect.Effect<{
+    removed: number;
+}, import("effect/unstable/sql/SqlError").SqlError | BlobStorageError, never>;

package/dist/storage/operator.js

@@ -0,0 +1,30 @@
+import * as PgClient from "@effect/sql-pg/PgClient";
+import { Effect, Redacted } from "effect";
+import { SqlClient } from "effect/unstable/sql";
+import { postgresTls } from "../runtime/postgres-tls.js";
+import { maintainBlobStorage } from "./maintenance.js";
+import { neonBlobProvider } from "./neon.js";
+import { BlobStorageError } from "./provider.js";
+/** Scheduler capability that survives removal of blob declarations. Never reads file contents. */
+export function runBlobStorageMaintenance(input) {
+    const limit = input.limit ?? 100;
+    if (!Number.isInteger(limit) || limit < 1 || limit > 100) {
+        return Effect.fail(new BlobStorageError({ operation: "maintenance.limit" }));
+    }
+    return Effect.gen(function* () {
+        const sql = yield* SqlClient.SqlClient;
+        const [tables] = yield* sql `
+      SELECT to_regclass('public._blob_uploads')::text AS uploads
+    `;
+        if (!tables?.uploads) {
+            return { removed: 0 };
+        }
+        const provider = yield* Effect.acquireRelease(Effect.sync(() => neonBlobProvider(Redacted.value(input.binding))), (provider) => Effect.sync(() => provider.close?.()));
+        return yield* maintainBlobStorage(sql, provider, limit);
+    }).pipe(Effect.provide(PgClient.layer({
+        url: input.databaseUrl,
+        ssl: postgresTls(input.databaseUrl),
+        maxConnections: 1,
+        applicationName: "segmentstream-ontology-maintenance",
+    })), Effect.scoped);
+}

package/dist/storage/provider.d.ts

@@ -0,0 +1,80 @@
+import { Context, Schema, type Effect } from "effect";
+/** Validated deployment binding, independent of the action and browser contracts. */
+export declare const BlobStorageBinding: Schema.Struct<{
+    readonly projectId: Schema.String;
+    readonly branchId: Schema.String;
+    readonly endpoint: Schema.String;
+    readonly region: Schema.String;
+    readonly bucket: Schema.Literal<"ontology-files">;
+    readonly accessKeyId: Schema.String;
+    readonly secretAccessKey: Schema.String;
+    readonly quotaBytes: Schema.Int;
+}>;
+export type BlobStorageBinding = typeof BlobStorageBinding.Type;
+declare const BlobStorageError_base: Schema.Class<BlobStorageError, Schema.TaggedStruct<"BlobStorageError", {
+    readonly operation: Schema.String;
+    readonly cause: Schema.optionalKey<Schema.Unknown>;
+}>, import("effect/Cause").YieldableError>;
+export declare class BlobStorageError extends BlobStorageError_base {
+}
+export interface TransferGrant {
+    readonly url: string;
+    readonly method: "GET" | "PUT";
+    readonly headers: Readonly<Record<string, string>>;
+    readonly expiresAt: string;
+}
+export interface StoredObject {
+    readonly size: number;
+    readonly contentType: string;
+    readonly sessionId: string;
+}
+declare const BlobProvider_base: Context.ServiceClass<BlobProvider, "@segmentstream-cloud/ontology/BlobProvider", {
+    readonly binding: BlobStorageBinding;
+    readonly close?: () => void;
+    readonly initiate: (input: {
+        key: string;
+        filename: string;
+        contentType: string;
+        sessionId: string;
+    }) => Effect.Effect<string, BlobStorageError>;
+    readonly signPart: (input: {
+        key: string;
+        uploadId: string;
+        partNumber: number;
+        size: number;
+    }) => Effect.Effect<TransferGrant, BlobStorageError>;
+    readonly parts: (input: {
+        key: string;
+        uploadId: string;
+    }) => Effect.Effect<ReadonlyArray<{
+        number: number;
+        size: number;
+        etag: string;
+    }>, BlobStorageError>;
+    readonly complete: (input: {
+        key: string;
+        uploadId: string;
+        parts: ReadonlyArray<{
+            number: number;
+            etag: string;
+        }>;
+    }) => Effect.Effect<void, BlobStorageError>;
+    readonly inspect: (key: string) => Effect.Effect<StoredObject | undefined, BlobStorageError>;
+    readonly readPrefix: (key: string) => Effect.Effect<Uint8Array, BlobStorageError>;
+    readonly download: (input: {
+        key: string;
+        filename: string;
+        contentType: string;
+        inline: boolean;
+    }) => Effect.Effect<TransferGrant, BlobStorageError>;
+    readonly abort: (input: {
+        key: string;
+        uploadId: string;
+    }) => Effect.Effect<void, BlobStorageError>;
+    readonly remove: (key: string) => Effect.Effect<void, BlobStorageError>;
+    readonly pending: (key: string) => Effect.Effect<ReadonlyArray<string>, BlobStorageError>;
+}>;
+/** Private provider capability. Actions never receive storage credentials or this service. */
+export declare class BlobProvider extends BlobProvider_base {
+}
+export {};

package/dist/storage/provider.js

@@ -0,0 +1,20 @@
+import { Context, Schema } from "effect";
+/** Validated deployment binding, independent of the action and browser contracts. */
+export const BlobStorageBinding = Schema.Struct({
+    projectId: Schema.String,
+    branchId: Schema.String,
+    endpoint: Schema.String,
+    region: Schema.String,
+    bucket: Schema.Literal("ontology-files"),
+    accessKeyId: Schema.String,
+    secretAccessKey: Schema.String,
+    quotaBytes: Schema.Int.check(Schema.isGreaterThan(0)),
+});
+export class BlobStorageError extends Schema.TaggedError()("BlobStorageError", {
+    operation: Schema.String,
+    cause: Schema.optionalKey(Schema.Unknown),
+}) {
+}
+/** Private provider capability. Actions never receive storage credentials or this service. */
+export class BlobProvider extends Context.Service()("@segmentstream-cloud/ontology/BlobProvider") {
+}