@ultimat3/storage 22.1.0 → 22.2.0

package/README.md

@@ -179,6 +179,13 @@ and hands over, hashed again here and refused on any disagreement.
 Neither owns a `Request`, a `Response` or a status number — mounting is the host's job, and
 `@ultimat3/http` is the only layer that turns an `X_*` code into a status.
 
+**Step 3 ships.** `As of 2026-09-24` `@ultimat3/cli` mounts `PUT /_storage/:disk/*key` beside the
+`GET` in `x dev` and `runRole` (#523), so an app writes steps 1 and 2 only. The route calls
+`signedUploadConstraints({ url, disk, orgId })` first. That is the verified PUT constraints with
+no bytes, and the signed `maxBytes` caps the body read. Then it calls `acceptSignedUpload` with a
+policy built from the grant's own signed type and ceiling. The routes serve `definedStorage()`,
+the process's one registry, which is the app's `defineStorage` when it declared one (#524).
+
 ## Attachments and orphans
 
 An upload happens **before** the row it belongs to exists, so it lands at

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ultimat3/storage",
-  "version": "22.1.0",
+  "version": "22.2.0",
   "description": "Named disks over Bun.file and Bun.s3: safe keys, signed URLs, sniffed uploads",
   "license": "MIT",
   "type": "module",
@@ -31,6 +31,6 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@ultimat3/core": "22.1.0"
+    "@ultimat3/core": "22.2.0"
   }
 }

package/src/accept.ts

@@ -123,6 +123,19 @@ async function constraintsFor(
   return constraints;
 }
 
+/**
+ * The verified half of a PUT, without the bytes: the signature, the expiry, the method and the
+ * tenant, answered as the constraints the grant signed. A route reads this BEFORE the body so the
+ * signed `maxBytes` — not an HTTP-wide default, and never an unverified query parameter — is the
+ * cap on how much of the body it is willing to hold. `acceptSignedUpload` asks again; an HMAC is
+ * cheap and a second statement of the accept rules would not be.
+ */
+export async function signedUploadConstraints(
+  input: SignedRequestInput,
+): Promise<SignedUrlConstraints> {
+  return constraintsFor(input, 'PUT');
+}
+
 /**
  * Take a presigned PUT and write it, or refuse. Four gates the client cannot move because all
  * four are inside the signature or inside the bytes: the signature itself, the expiry, the byte

package/src/index.ts

@@ -2,7 +2,7 @@
 // every consumer imports from here, so this list is the package's contract.
 
 export type { AcceptSignedUploadInput, SignedRequestInput } from './accept';
-export { acceptSignedUpload, readSignedObject } from './accept';
+export { acceptSignedUpload, readSignedObject, signedUploadConstraints } from './accept';
 export type {
   AttachmentTarget,
   PromoteAttachmentInput,
@@ -154,7 +154,7 @@ export {
   verifySignedUrl,
 } from './signed-url';
 export type { Storage, StorageConfig } from './storage';
-export { defineStorage, disk, resetStorage, storage } from './storage';
+export { definedStorage, defineStorage, disk, resetStorage, storage } from './storage';
 export type { UploadCandidate, UploadPolicy, UploadPolicyInit, ValidatedUpload } from './upload';
 export {
   contentTypeMatches,

package/src/storage.ts

@@ -88,6 +88,16 @@ export function storage(): Storage {
   return current;
 }
 
+/**
+ * The configured storage, or `undefined` before any `defineStorage` — the question a host asks
+ * when it must serve whatever the app installed and fall back to its own disk otherwise. The LAST
+ * call wins, by `defineStorage`'s own contract: there is one registry, so the app's declaration
+ * replaces a host's default rather than sitting beside it.
+ */
+export function definedStorage(): Storage | undefined {
+  return current;
+}
+
 /** Shorthand for the common call. `disk()` alone resolves the default disk. */
 export function disk(name?: string): StorageDriver {
   return storage().disk(name);