@voltro/plugin-storage 0.68.0 → 0.69.0

package/dist/rpc.js

@@ -86,7 +86,7 @@ var c = i.Literal("user", "group", "apiKey"), l = i.Literal("read", "write"), u
 		expiresInSec: i.Number
 	}),
 	error: t,
-	openAccess: "self-service upload: the ticket binds the calling subject + tenant, caps size, and the finalize path runs limits + scan"
+	openAccess: "self-service upload: the ticket binds the calling subject + tenant, caps size, and the finalize path runs limits + scan; an unidentified caller is refused in-handler unless the app set `anonymousUploads`"
 }), g = a({
 	name: "storage.mintPresignedUpload",
 	input: i.Struct({
@@ -104,7 +104,7 @@ var c = i.Literal("user", "group", "apiKey"), l = i.Literal("read", "write"), u
 		expiresInSec: i.Number
 	}),
 	error: t,
-	openAccess: "self-service upload: the finalize token binds the calling subject + tenant; finalizeUpload refuses another subject's token and runs limits + scan"
+	openAccess: "self-service upload: the finalize token binds the calling subject + tenant; finalizeUpload refuses another subject's token and runs limits + scan; an unidentified caller is refused in-handler unless the app set `anonymousUploads`"
 }), _ = a({
 	name: "storage.finalizeUpload",
 	input: i.Struct({ finalizeToken: i.String }),
@@ -117,7 +117,7 @@ var c = i.Literal("user", "group", "apiKey"), l = i.Literal("read", "write"), u
 		height: i.optional(i.Number)
 	}),
 	error: i.Union(t, n, r),
-	openAccess: "authorization is the signed finalize token itself: it binds the minting subject (403 for another caller) and the finalize runs limits + scan"
+	openAccess: "authorization is the signed finalize token itself: it binds the minting subject where there was one (403 for another caller; an anonymous ticket is bound by possession of the short-lived token alone) and the finalize runs limits + scan"
 }), v = a({
 	name: "storage.beginResumableUpload",
 	input: i.Struct({
@@ -139,7 +139,7 @@ var c = i.Literal("user", "group", "apiKey"), l = i.Literal("read", "write"), u
 		expiresInSec: i.Number
 	}),
 	error: t,
-	openAccess: "self-service upload: the resumable token binds the calling subject + tenant and the assembled object runs limits + scan"
+	openAccess: "self-service upload: the resumable token binds the calling subject + tenant and the assembled object runs limits + scan; an unidentified caller is refused in-handler unless the app set `anonymousUploads`"
 }), y = a({
 	name: "storage.beginMultipartUpload",
 	input: i.Struct({
@@ -159,7 +159,7 @@ var c = i.Literal("user", "group", "apiKey"), l = i.Literal("read", "write"), u
 		expiresInSec: i.Number
 	}),
 	error: t,
-	openAccess: "self-service upload: the multipart token binds the calling subject + tenant; completion refuses another subject's token"
+	openAccess: "self-service upload: the multipart token binds the calling subject + tenant; completion refuses another subject's token; an unidentified caller is refused in-handler unless the app set `anonymousUploads`"
 }), b = a({
 	name: "storage.signMultipartPart",
 	input: i.Struct({
@@ -184,7 +184,7 @@ var c = i.Literal("user", "group", "apiKey"), l = i.Literal("read", "write"), u
 		size: i.Number
 	}),
 	error: i.Union(t, n),
-	openAccess: "authorization is the signed multipart token: completion refuses a token minted by another subject"
+	openAccess: "authorization is the signed multipart token: completion refuses a token minted by another subject, and where there was none the binding is possession of the short-lived token alone"
 }), S = a({
 	name: "storage.abortMultipartUpload",
 	input: i.Struct({ multipartToken: i.String }),
@@ -205,7 +205,7 @@ var c = i.Literal("user", "group", "apiKey"), l = i.Literal("read", "write"), u
 		url: i.String
 	}),
 	error: i.Union(t, n, r),
-	openAccess: "self-service upload: ownerId/tenant come from the calling subject and the put runs limits + scan"
+	openAccess: "self-service upload: ownerId/tenant come from the calling subject and the put runs limits + scan; an unidentified caller is refused in-handler unless the app set `anonymousUploads`"
 }), w = a({
 	name: "storage.ingestUrl",
 	input: i.Struct({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/plugin-storage",
-  "version": "0.68.0",
+  "version": "0.69.0",
   "description": "File-storage plugin — one StorageProvider contract, switchable backends (S3 / MinIO / Azure / filesystem / memory / database). Public (CDN-direct) + private (access policy + per-object grants) objects, upload constraints, virus-scan hook, on-the-fly image transforms.",
   "keywords": [
     "voltro",
@@ -43,9 +43,9 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@voltro/database": "0.68.0",
-    "@voltro/env": "0.68.0",
-    "@voltro/protocol": "0.68.0"
+    "@voltro/database": "0.69.0",
+    "@voltro/env": "0.69.0",
+    "@voltro/protocol": "0.69.0"
   },
   "optionalDependencies": {
     "@aws-sdk/client-s3": "^3.1126.0",