@voltro/plugin-storage 0.81.0 → 0.82.0

package/dist/types.d.ts

@@ -255,6 +255,10 @@ export declare interface StorageProvider {
      *  publicly without the app (filesystem/memory) → the service falls
      *  back to the `/_voltro/storage/:id` route. */
     readonly publicUrl?: (key: string) => string | null;
+    /** Make an object publicly readable at the provider, or not (s3/minio with
+     *  per-object ACLs). Absent where the app decides per request (database,
+     *  filesystem, memory) — there a ref's visibility is the whole answer. */
+    readonly setObjectPublic?: (key: string, isPublic: boolean) => Effect.Effect<void, StorageError>;
     /** Presigned PUT for direct-to-bucket uploads (s3/minio). Absent on
      *  providers that can't presign uploads. */
     readonly getUploadUrl?: (key: string, expiresInSec: number, contentType: string) => Effect.Effect<string, StorageError>;
@@ -485,6 +489,30 @@ export declare interface StorageServiceShape {
      *  caller's `tenantId` / `ownerId` for an end-user surface, and deliver any
      *  listed private object through `mintUrl`. */
     readonly listRefs: (input?: ListRefsInput) => Effect.Effect<ListRefsResult, StorageError>;
+    /**
+     * A short-lived URL that delivers the bytes WITHOUT an access check — for
+     * server code that has already decided the reader may see them (a shared
+     * preview whose link was verified). Public: its public URL. Private: a
+     * presigned GET (s3/minio) or the serve URL with a signed grant token. Never
+     * hand one to a caller whose access you have not checked.
+     */
+    readonly signedUrl: (id: string, opts?: {
+        readonly tenantId?: string | null;
+        readonly expiresInSec?: number;
+    }) => Effect.Effect<string, StorageError>;
+    /**
+     * Make a stored object public or private after the fact — an image that goes
+     * public when its page is published, and private again when it is taken
+     * down. Checks the tenant like `delete`. Where objects are served from a
+     * public base (`cdnBaseUrl`) a public object cannot be taken back: that is
+     * refused (`StorageRejected`, reason `visibility-unsupported`) rather than
+     * left public. On s3 with per-object ACLs the object follows its refs: it
+     * stays public while any ref to the same bytes is. A public object's earlier
+     * responses may remain in browser and CDN caches.
+     */
+    readonly setVisibility: (id: string, visibility: StorageVisibility, opts?: {
+        readonly tenantId?: string | null;
+    }) => Effect.Effect<StorageRef, StorageError | StorageRejected>;
     readonly grant: (input: GrantInput) => Effect.Effect<StorageGrant, StorageError>;
     readonly revoke: (grantId: string) => Effect.Effect<void, StorageError>;
     /** One grant by id, or null. Server-side read — the RPC layer uses it to
@@ -523,6 +551,8 @@ export declare interface StorageServiceShape {
         readonly operationId?: string;
         readonly ownerId?: string | null;
         readonly visibility?: StorageVisibility;
+        /** The access policy of a private object, as on `put`. */
+        readonly access?: AccessPolicy;
         readonly key?: string;
         readonly folder?: string;
         readonly tags?: ReadonlyArray<string>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/plugin-storage",
-  "version": "0.81.0",
+  "version": "0.82.0",
   "description": "File-storage plugin — one StorageProvider contract, switchable backends (S3 / MinIO / Azure / filesystem / memory / database). Public (CDN-direct) + private (access policy + per-object grants) objects, upload constraints, virus-scan hook, on-the-fly image transforms.",
   "keywords": [
     "voltro",
@@ -43,9 +43,9 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@voltro/database": "0.81.0",
-    "@voltro/env": "0.81.0",
-    "@voltro/protocol": "0.81.0"
+    "@voltro/database": "0.82.0",
+    "@voltro/env": "0.82.0",
+    "@voltro/protocol": "0.82.0"
   },
   "optionalDependencies": {
     "@aws-sdk/client-s3": "^3.1134.0",