@voltro/plugin-storage 0.71.0 → 0.72.0

package/dist/index.d.ts

@@ -318,6 +318,49 @@ export declare interface ListRefsResult {
     readonly nextOffset: number | null;
 }
 
+/** DataStore-backed metadata boundary, intentionally no provider access. The
+ * service must use reserve -> provider.put -> confirm and retain failed intents. */
+export declare const makeStorageObjectMetadata: (store: DataStore) => {
+    /** The put intent a reference was written under, if it was written through an operation at all. */
+    intent: (refId: string) => Promise<{
+        identity: {
+            readonly tenantId: string | null;
+            readonly bucket: string;
+            readonly fingerprint: string;
+            readonly checksum: string;
+            readonly operationId: string;
+            readonly logicalKey: string;
+        };
+        ref: StorageRef;
+    } | undefined>;
+    reserve: (identity: StorageObjectIdentity, proposed: StorageRef, quota?: StorageQuota) => Promise<{
+        ref: StorageRef;
+        ready: boolean;
+    }>;
+    confirm: (identity: StorageObjectIdentity) => Promise<StorageRef>;
+    beginDelete: (refId: string, tenantId?: string | null) => Promise<{
+        operation: {
+            readonly id: string;
+            readonly key: string;
+            readonly fingerprint: string;
+            readonly generation: string;
+            readonly state: "ready" | "reserved" | "deleting" | "deleted";
+            readonly refId: string;
+            readonly objectId: string;
+            readonly deleteKey: string | null;
+        };
+        identity: {
+            readonly tenantId: string | null;
+            readonly bucket: string;
+            readonly fingerprint: string;
+            readonly checksum: string;
+            readonly operationId: string;
+            readonly logicalKey: string;
+        };
+    }>;
+    confirmDelete: (identity: StorageObjectIdentity) => Promise<boolean>;
+};
+
 export declare const memoryGrantStore: () => GrantStore;
 
 export declare const memoryProvider: (instance?: string) => StorageProvider;
@@ -400,6 +443,17 @@ export declare interface PutInput {
     readonly derivedFrom?: string;
     /** Derivative label — `'rendition'` / `'poster'` (internal). */
     readonly kind?: string;
+    /**
+     * The RESUMABLE identity of this put. Two calls with the same `operationId`
+     * (a retry after a network failure, two replicas completing the same job)
+     * resolve to ONE reference: the second finds the first's reservation and
+     * returns its ref, or finishes what the first left half-done. Without it a
+     * put is a fresh object every time — and a retried put beside its winner
+     * left a second reference on the same key whose bytes outlived the winner's
+     * delete. Any stable string the caller owns (a job id, a message id).
+     * Needs a bound data store; the in-memory ref store cannot hold intents.
+     */
+    readonly operationId?: string;
 }
 
 /**
@@ -622,7 +676,28 @@ export declare type StorageGuard = (ctx: {
     readonly ref: StorageRef;
 }) => boolean | Promise<boolean> | Effect.Effect<boolean>;
 
-declare interface StorageObjectIdentity {
+/**
+ * The instance name an upload ticket must carry, for THIS installation.
+ *
+ * `signUploadTicket` takes `instance: string`, and the upload route compares it
+ * against the plugin's own instance — so a wrong value is not a type error, it
+ * is a bare `401` on every upload. The value has always been derivable
+ * (`storagePlugin(options).name` is this same expression), but nothing said so
+ * and `BASE_NAME` is not exported, so a caller minting a ticket outside the
+ * plugin had to guess it. Guessing is exactly what a `string` parameter invites.
+ *
+ *     const ticket = signUploadTicket(
+ *       { instance: storageInstanceName(), key, contentType },
+ *       300,
+ *     )
+ *
+ * Pass the SAME options the installation was built with — `alias` and `name`
+ * both move the instance, and a ticket minted for the default name does not
+ * open a door installed under an alias.
+ */
+export declare const storageInstanceName: (options?: StoragePluginOptions) => string;
+
+export declare interface StorageObjectIdentity {
     readonly tenantId: string | null;
     readonly bucket: string;
     readonly operationId: string;
@@ -634,6 +709,29 @@ declare interface StorageObjectIdentity {
     readonly logicalKey: string;
 }
 
+/** Internal persistence substrate. Service wiring must commit quota and refs in
+ * the same transaction as these transitions; never run provider I/O here. */
+export declare const storageObjectLifecycleTables: ( Table<"_voltro_storage_operation_locks", FieldDefinitions<{
+    readonly id: ColumnBuilder<string, "text", boolean>;
+    readonly nonce: ColumnBuilder<string, "text", boolean>;
+}>, false, never> | Table<"_voltro_storage_object_heads", FieldDefinitions<{
+    readonly id: ColumnBuilder<string, "text", boolean>;
+    readonly generation: ColumnBuilder<string, "text", boolean>;
+    readonly key: ColumnBuilder<string, "text", boolean>;
+    readonly reservations: ColumnBuilder<number, "integer", boolean>;
+}>, false, never> | Table<"_voltro_storage_operations", FieldDefinitions<{
+    readonly id: ColumnBuilder<string, "text", boolean>;
+    readonly objectId: ColumnBuilder<string, "text", boolean>;
+    readonly fingerprint: ColumnBuilder<string, "text", boolean>;
+    readonly generation: ColumnBuilder<string, "text", boolean>;
+    readonly key: ColumnBuilder<string, "text", boolean>;
+    readonly refId: ColumnBuilder<string, "text", boolean>;
+    readonly state: ColumnBuilder<string, "text", boolean>;
+    readonly deleteKey: ColumnBuilder<string | null, "text", boolean>;
+}>, false, never>)[];
+
+export declare type StorageObjectMetadata = ReturnType<typeof makeStorageObjectMetadata>;
+
 export declare const storagePlugin: (options?: StoragePluginOptions) => VoltroPlugin;
 
 export declare interface StoragePluginOptions {
@@ -986,6 +1084,11 @@ export declare interface StorageServiceOptions {
      *  the cap — and refunded if the write fails. Exceeding it fails with
      *  `StorageRejected` (reason `'quota-exceeded'`) before any bytes land. */
     readonly quota?: StorageQuota;
+    /** The durable object-operation boundary a `put` with an `operationId` and
+     *  the matching `delete` go through. Read at call time: the plugin binds it
+     *  once the app's data store exists, and `undefined` before that means an
+     *  `operationId` put is refused rather than silently made non-resumable. */
+    readonly objects?: () => StorageObjectMetadata | undefined;
 }
 
 /** The service handlers consume: `const storage = yield* StorageService`. */
@@ -1108,6 +1211,8 @@ export declare interface StorageServiceShape {
         readonly abortSignal?: AbortSignal;
         readonly contentType?: string;
         readonly tenantId?: string | null;
+        /** The resumable identity of this ingest — see `PutInput.operationId`. */
+        readonly operationId?: string;
         readonly ownerId?: string | null;
         readonly visibility?: StorageVisibility;
         readonly key?: string;