@voltro/plugin-storage 0.83.1 → 0.85.0

package/dist/rpc.js

@@ -1,17 +1,21 @@
 import { StorageAccessDenied as e, StorageError as t, StorageRejected as n, StorageScanRejected as r } from "./types.js";
 import { Schema as i } from "effect";
-import { defineAction as a, defineMutation as o, defineQuery as s } from "@voltro/protocol";
+import { StorageAccessPolicySchema as a, defineAction as o, defineMutation as s, defineQuery as c } from "@voltro/protocol";
 //#region src/rpc.ts
-var c = i.Literal("user", "group", "apiKey"), l = i.Literal("read", "write"), u = i.Struct({
+var l = i.Literals([
+	"user",
+	"group",
+	"apiKey"
+]), u = i.Literals(["read", "write"]), d = i.Struct({
 	id: i.String,
 	refId: i.String,
-	principalType: c,
+	principalType: l,
 	principalId: i.String,
-	permission: l,
+	permission: u,
 	createdAt: i.String,
 	expiresAt: i.NullOr(i.String),
 	createdBy: i.NullOr(i.String)
-}), d = i.Struct({
+}), f = i.Struct({
 	id: i.String,
 	tenantId: i.NullOr(i.String),
 	ownerId: i.NullOr(i.String),
@@ -20,7 +24,7 @@ var c = i.Literal("user", "group", "apiKey"), l = i.Literal("read", "write"), u
 	contentType: i.String,
 	size: i.Number,
 	checksum: i.String,
-	visibility: i.Literal("public", "private"),
+	visibility: i.Literals(["public", "private"]),
 	hasPassword: i.Boolean,
 	createdAt: i.String,
 	width: i.NullOr(i.Number),
@@ -33,7 +37,7 @@ var c = i.Literal("user", "group", "apiKey"), l = i.Literal("read", "write"), u
 	caption: i.NullOr(i.String),
 	derivedFrom: i.NullOr(i.String),
 	kind: i.NullOr(i.String)
-}), f = s({
+}), p = c({
 	name: "storage.listRefs",
 	input: i.Struct({
 		folder: i.optional(i.String),
@@ -44,12 +48,12 @@ var c = i.Literal("user", "group", "apiKey"), l = i.Literal("read", "write"), u
 		offset: i.optional(i.Number)
 	}),
 	output: i.Struct({
-		refs: i.Array(d),
+		refs: i.Array(f),
 		nextOffset: i.NullOr(i.Number)
 	}),
 	error: t,
 	guards: [{ scope: "storage:browse" }]
-}), p = a({
+}), m = o({
 	name: "storage.mintUrl",
 	input: i.Struct({
 		id: i.String,
@@ -57,9 +61,9 @@ var c = i.Literal("user", "group", "apiKey"), l = i.Literal("read", "write"), u
 		expiresInSec: i.optional(i.Number)
 	}),
 	output: i.Struct({ url: i.String }),
-	error: i.Union(t, e),
+	error: i.Union([t, e]),
 	openAccess: "per-object authorization: the access policy + grants decide this subject's read (StorageAccessDenied on refusal); a scope here would double-gate what the policy already decides per object"
-}), m = a({
+}), h = o({
 	name: "storage.mintUploadUrl",
 	input: i.Struct({
 		key: i.String,
@@ -69,11 +73,12 @@ var c = i.Literal("user", "group", "apiKey"), l = i.Literal("read", "write"), u
 	output: i.Struct({ url: i.String }),
 	error: t,
 	guards: [{ scope: "storage:manage" }]
-}), h = a({
+}), g = o({
 	name: "storage.mintUploadTicket",
 	input: i.Struct({
 		contentType: i.String,
-		visibility: i.optional(i.Literal("public", "private")),
+		visibility: i.optional(i.Literals(["public", "private"])),
+		access: i.optional(a),
 		key: i.optional(i.String),
 		folder: i.optional(i.String),
 		tags: i.optional(i.Array(i.String)),
@@ -87,11 +92,12 @@ var c = i.Literal("user", "group", "apiKey"), l = i.Literal("read", "write"), u
 	}),
 	error: t,
 	openAccess: "self-service upload: the ticket binds the calling subject + tenant, caps size, and the finalize path runs limits + scan; an unidentified caller is refused in-handler unless the app set `anonymousUploads`"
-}), g = a({
+}), _ = o({
 	name: "storage.mintPresignedUpload",
 	input: i.Struct({
 		contentType: i.String,
-		visibility: i.optional(i.Literal("public", "private")),
+		visibility: i.optional(i.Literals(["public", "private"])),
+		access: i.optional(a),
 		folder: i.optional(i.String),
 		tags: i.optional(i.Array(i.String)),
 		alt: i.optional(i.String),
@@ -105,7 +111,7 @@ var c = i.Literal("user", "group", "apiKey"), l = i.Literal("read", "write"), u
 	}),
 	error: t,
 	openAccess: "self-service upload: the finalize token binds the calling subject + tenant; finalizeUpload refuses another subject's token and runs limits + scan; an unidentified caller is refused in-handler unless the app set `anonymousUploads`"
-}), _ = a({
+}), v = o({
 	name: "storage.finalizeUpload",
 	input: i.Struct({ finalizeToken: i.String }),
 	output: i.Struct({
@@ -116,14 +122,19 @@ var c = i.Literal("user", "group", "apiKey"), l = i.Literal("read", "write"), u
 		width: i.optional(i.Number),
 		height: i.optional(i.Number)
 	}),
-	error: i.Union(t, n, r),
+	error: i.Union([
+		t,
+		n,
+		r
+	]),
 	openAccess: "authorization is the signed finalize token itself: it binds the minting subject where there was one (403 for another caller; an anonymous ticket is bound by possession of the short-lived token alone) and the finalize runs limits + scan"
-}), v = a({
+}), y = o({
 	name: "storage.beginResumableUpload",
 	input: i.Struct({
 		contentType: i.String,
 		size: i.Number,
-		visibility: i.optional(i.Literal("public", "private")),
+		visibility: i.optional(i.Literals(["public", "private"])),
+		access: i.optional(a),
 		folder: i.optional(i.String),
 		tags: i.optional(i.Array(i.String)),
 		alt: i.optional(i.String),
@@ -140,12 +151,13 @@ var c = i.Literal("user", "group", "apiKey"), l = i.Literal("read", "write"), u
 	}),
 	error: t,
 	openAccess: "self-service upload: the resumable token binds the calling subject + tenant and the assembled object runs limits + scan; an unidentified caller is refused in-handler unless the app set `anonymousUploads`"
-}), y = a({
+}), b = o({
 	name: "storage.beginMultipartUpload",
 	input: i.Struct({
 		contentType: i.String,
 		size: i.Number,
-		visibility: i.optional(i.Literal("public", "private")),
+		visibility: i.optional(i.Literals(["public", "private"])),
+		access: i.optional(a),
 		folder: i.optional(i.String),
 		tags: i.optional(i.Array(i.String)),
 		alt: i.optional(i.String),
@@ -160,7 +172,7 @@ var c = i.Literal("user", "group", "apiKey"), l = i.Literal("read", "write"), u
 	}),
 	error: t,
 	openAccess: "self-service upload: the multipart token binds the calling subject + tenant; completion refuses another subject's token; an unidentified caller is refused in-handler unless the app set `anonymousUploads`"
-}), b = a({
+}), x = o({
 	name: "storage.signMultipartPart",
 	input: i.Struct({
 		multipartToken: i.String,
@@ -169,7 +181,7 @@ var c = i.Literal("user", "group", "apiKey"), l = i.Literal("read", "write"), u
 	output: i.Struct({ url: i.String }),
 	error: t,
 	openAccess: "authorization is the signed multipart token: parts can only be signed for a session a subject legitimately began"
-}), x = a({
+}), S = o({
 	name: "storage.completeMultipartUpload",
 	input: i.Struct({
 		multipartToken: i.String,
@@ -183,20 +195,21 @@ var c = i.Literal("user", "group", "apiKey"), l = i.Literal("read", "write"), u
 		url: i.String,
 		size: i.Number
 	}),
-	error: i.Union(t, n),
+	error: i.Union([t, n]),
 	openAccess: "authorization is the signed multipart token: completion refuses a token minted by another subject, and where there was none the binding is possession of the short-lived token alone"
-}), S = a({
+}), C = o({
 	name: "storage.abortMultipartUpload",
 	input: i.Struct({ multipartToken: i.String }),
 	output: i.Struct({ ok: i.Boolean }),
 	error: t,
 	openAccess: "authorization is the signed multipart token: aborting releases the caller's own upload session"
-}), C = a({
+}), w = o({
 	name: "storage.upload",
 	input: i.Struct({
 		bytesBase64: i.String,
 		contentType: i.String,
-		visibility: i.optional(i.Literal("public", "private")),
+		visibility: i.optional(i.Literals(["public", "private"])),
+		access: i.optional(a),
 		key: i.optional(i.String),
 		password: i.optional(i.String)
 	}),
@@ -204,13 +217,17 @@ var c = i.Literal("user", "group", "apiKey"), l = i.Literal("read", "write"), u
 		id: i.String,
 		url: i.String
 	}),
-	error: i.Union(t, n, r),
+	error: i.Union([
+		t,
+		n,
+		r
+	]),
 	openAccess: "self-service upload: ownerId/tenant come from the calling subject and the put runs limits + scan; an unidentified caller is refused in-handler unless the app set `anonymousUploads`"
-}), w = a({
+}), T = o({
 	name: "storage.ingestUrl",
 	input: i.Struct({
 		url: i.String,
-		visibility: i.optional(i.Literal("public", "private")),
+		visibility: i.optional(i.Literals(["public", "private"])),
 		folder: i.optional(i.String),
 		tags: i.optional(i.Array(i.String)),
 		alt: i.optional(i.String),
@@ -221,33 +238,37 @@ var c = i.Literal("user", "group", "apiKey"), l = i.Literal("read", "write"), u
 		id: i.String,
 		url: i.String
 	}),
-	error: i.Union(t, n, r),
+	error: i.Union([
+		t,
+		n,
+		r
+	]),
 	guards: [{ scope: "storage:manage" }]
-}), T = o({
+}), E = s({
 	name: "storage.share",
 	input: i.Struct({
 		refId: i.String,
-		principalType: c,
+		principalType: l,
 		principalId: i.String,
-		permission: i.optional(l),
+		permission: i.optional(u),
 		expiresInDays: i.optional(i.Number)
 	}),
 	output: i.Struct({ grantId: i.String }),
 	error: t,
 	openAccess: "owner-or-admin enforced in-handler (assertMayAdministerGrants): only the ref's owner or admin:full may grant, which is stricter per object than any global scope"
-}), E = o({
+}), D = s({
 	name: "storage.revoke",
 	input: i.Struct({ grantId: i.String }),
 	output: i.Struct({ ok: i.Boolean }),
 	error: t,
 	openAccess: "owner-or-admin enforced in-handler: only the owning subject (or admin:full) of the grant's object may revoke; unknown and unowned grants report the same 403"
-}), D = s({
+}), O = c({
 	name: "storage.listGrants",
 	input: i.Struct({ refId: i.String }),
-	output: i.Struct({ grants: i.Array(u) }),
+	output: i.Struct({ grants: i.Array(d) }),
 	error: t,
 	openAccess: "owner-or-admin enforced in-handler: who an object is shared with is readable only by the object's owner or admin:full"
-}), O = [
+}), k = [
 	{
 		tag: "storage.mintUrl",
 		kind: "action",
@@ -378,4 +399,4 @@ var c = i.Literal("user", "group", "apiKey"), l = i.Literal("read", "write"), u
 	}
 ];
 //#endregion
-export { S as abortMultipartUploadDescriptor, y as beginMultipartUploadDescriptor, v as beginResumableUploadDescriptor, x as completeMultipartUploadDescriptor, _ as finalizeUploadDescriptor, w as ingestUrlDescriptor, D as listGrantsDescriptor, f as listRefsDescriptor, g as mintPresignedUploadDescriptor, h as mintUploadTicketDescriptor, m as mintUploadUrlDescriptor, p as mintUrlDescriptor, E as revokeDescriptor, T as shareDescriptor, b as signMultipartPartDescriptor, O as storageRpcClientImports, C as uploadDescriptor };
+export { C as abortMultipartUploadDescriptor, b as beginMultipartUploadDescriptor, y as beginResumableUploadDescriptor, S as completeMultipartUploadDescriptor, v as finalizeUploadDescriptor, T as ingestUrlDescriptor, O as listGrantsDescriptor, p as listRefsDescriptor, _ as mintPresignedUploadDescriptor, g as mintUploadTicketDescriptor, h as mintUploadUrlDescriptor, m as mintUrlDescriptor, D as revokeDescriptor, E as shareDescriptor, x as signMultipartPartDescriptor, k as storageRpcClientImports, w as uploadDescriptor };

package/dist/types.d.ts

@@ -1,10 +1,13 @@
 import { Context } from 'effect';
 import { Effect } from 'effect';
 import { Schema } from 'effect';
+import { StorageAccessPolicy } from '@voltro/protocol';
+import { StorageAccessRule } from '@voltro/protocol';
 import { Stream } from 'effect';
 import { Subject } from '@voltro/protocol';
+import { YieldableError } from 'effect/Cause';
 
-export declare type AccessPolicy = ReadonlyArray<AccessRule>;
+export declare type AccessPolicy = StorageAccessPolicy;
 
 /**
  * One access rule. A rule GRANTS when EVERY present condition is satisfied
@@ -12,24 +15,7 @@ export declare type AccessPolicy = ReadonlyArray<AccessRule>;
  * grants (OR). An empty policy on a private object means owner-only (the
  * implicit owner check always applies).
  */
-export declare interface AccessRule {
-    /** `subject.id === ref.ownerId`. */
-    readonly owner?: boolean;
-    /** `subject.metadata.roles` intersects these. */
-    readonly roles?: ReadonlyArray<string>;
-    /** resolved groups (default `subject.metadata.groups`) intersect these. */
-    readonly groups?: ReadonlyArray<string>;
-    /** `subject.scopes` intersects these. */
-    readonly scopes?: ReadonlyArray<string>;
-    /** `subject.tenantId === ref.tenantId`. */
-    readonly tenant?: boolean;
-    /** subject is any authenticated api-key. */
-    readonly apiKey?: boolean;
-    /** a correct password was supplied (checked at mint, against passwordHash). */
-    readonly password?: boolean;
-    /** a named custom guard (`options.guards[name]`) returns true. */
-    readonly guard?: string;
-}
+export declare type AccessRule = StorageAccessRule;
 
 /**
  * A lazy stream of bytes — the streaming counterpart to {@link StoredObject}'s
@@ -178,12 +164,10 @@ export declare interface Rendition {
 export declare class StorageAccessDenied extends StorageAccessDenied_base {
 }
 
-declare const StorageAccessDenied_base: Schema.TaggedErrorClass<StorageAccessDenied, "StorageAccessDenied", {
-    readonly _tag: Schema.tag<"StorageAccessDenied">;
-} & {
-    refId: typeof Schema.String;
-    reason: typeof Schema.String;
-}>;
+declare const StorageAccessDenied_base: Schema.Class<StorageAccessDenied, Schema.TaggedStruct<"StorageAccessDenied", {
+    readonly refId: Schema.String;
+    readonly reason: Schema.String;
+}>, YieldableError>;
 
 /**
  * Storage failure. `transient` drives retry — `true` for 429 / 5xx /
@@ -193,14 +177,12 @@ declare const StorageAccessDenied_base: Schema.TaggedErrorClass<StorageAccessDen
 export declare class StorageError extends StorageError_base {
 }
 
-declare const StorageError_base: Schema.TaggedErrorClass<StorageError, "StorageError", {
-    readonly _tag: Schema.tag<"StorageError">;
-} & {
-    provider: typeof Schema.String;
-    message: typeof Schema.String;
-    transient: typeof Schema.Boolean;
-    status: Schema.optional<typeof Schema.Number>;
-}>;
+declare const StorageError_base: Schema.Class<StorageError, Schema.TaggedStruct<"StorageError", {
+    readonly provider: Schema.String;
+    readonly message: Schema.String;
+    readonly transient: Schema.Boolean;
+    readonly status: Schema.optional<Schema.Number>;
+}>, YieldableError>;
 
 /** A persisted, explicit share of one object with one principal. */
 export declare interface StorageGrant {
@@ -356,15 +338,14 @@ export declare interface StorageRef {
 /** An upload was rejected by a constraint (size / content-type / magic-byte
  *  mismatch). `reason` is a stable code; `detail` is human-readable. */
 export declare class StorageRejected extends StorageRejected_base {
+    get message(): string;
 }
 
-declare const StorageRejected_base: Schema.TaggedErrorClass<StorageRejected, "StorageRejected", {
-    readonly _tag: Schema.tag<"StorageRejected">;
-} & {
+declare const StorageRejected_base: Schema.Class<StorageRejected, Schema.TaggedStruct<"StorageRejected", {
     /** `'too-large' | 'content-type-not-allowed' | 'content-mismatch'` */
-    reason: typeof Schema.String;
-    detail: typeof Schema.String;
-}>;
+    readonly reason: Schema.String;
+    readonly detail: Schema.String;
+}>, YieldableError>;
 
 /** Scans bytes before they're stored. Return `{ clean:false, threat }` to
  *  reject the upload (fails with `StorageScanRejected`, nothing is stored). */
@@ -378,11 +359,9 @@ export declare type StorageScanner = (input: {
 export declare class StorageScanRejected extends StorageScanRejected_base {
 }
 
-declare const StorageScanRejected_base: Schema.TaggedErrorClass<StorageScanRejected, "StorageScanRejected", {
-    readonly _tag: Schema.tag<"StorageScanRejected">;
-} & {
-    threat: typeof Schema.String;
-}>;
+declare const StorageScanRejected_base: Schema.Class<StorageScanRejected, Schema.TaggedStruct<"StorageScanRejected", {
+    readonly threat: Schema.String;
+}>, YieldableError>;
 
 export declare interface StorageScanResult {
     readonly clean: boolean;
@@ -393,7 +372,7 @@ export declare interface StorageScanResult {
 export declare class StorageService extends StorageService_base {
 }
 
-declare const StorageService_base: Context.TagClass<StorageService, "@voltro/plugin-storage/StorageService", StorageServiceShape>;
+declare const StorageService_base: Context.ServiceClass<StorageService, "@voltro/plugin-storage/StorageService", StorageServiceShape>;
 
 /** The service handlers consume: `const storage = yield* StorageService`. */
 export declare interface StorageServiceShape {
@@ -583,6 +562,7 @@ export declare interface StorageServiceShape {
         readonly tenantId?: string | null;
         readonly ownerId?: string | null;
         readonly visibility?: StorageVisibility;
+        readonly access?: AccessPolicy;
         readonly folder?: string;
         readonly tags?: ReadonlyArray<string>;
         readonly alt?: string;
@@ -616,6 +596,7 @@ export declare interface StorageServiceShape {
         readonly tenantId?: string | null;
         readonly ownerId?: string | null;
         readonly visibility?: StorageVisibility;
+        readonly access?: AccessPolicy;
         readonly folder?: string;
         readonly tags?: ReadonlyArray<string>;
         readonly alt?: string;
@@ -665,6 +646,7 @@ export declare interface StorageServiceShape {
         readonly tenantId?: string | null;
         readonly ownerId?: string | null;
         readonly visibility?: StorageVisibility;
+        readonly access?: AccessPolicy;
         readonly folder?: string;
         readonly tags?: ReadonlyArray<string>;
         readonly alt?: string;

package/dist/types.js

@@ -11,6 +11,10 @@ var n = class extends t.TaggedError()("StorageError", {
 }) {}, i = class extends t.TaggedError()("StorageRejected", {
 	reason: t.String,
 	detail: t.String
-}) {}, a = class extends t.TaggedError()("StorageScanRejected", { threat: t.String }) {}, o = class extends e.Tag("@voltro/plugin-storage/StorageService")() {};
+}) {
+	get message() {
+		return this.detail;
+	}
+}, a = class extends t.TaggedError()("StorageScanRejected", { threat: t.String }) {}, o = class extends e.Service()("@voltro/plugin-storage/StorageService") {};
 //#endregion
 export { r as StorageAccessDenied, n as StorageError, i as StorageRejected, a as StorageScanRejected, o as StorageService };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/plugin-storage",
-  "version": "0.83.1",
+  "version": "0.85.0",
   "description": "File-storage plugin — one StorageProvider contract, switchable backends (S3 / MinIO / Azure / filesystem / memory / database). Public (CDN-direct) + private (access policy + per-object grants) objects, upload constraints, virus-scan hook, on-the-fly image transforms.",
   "keywords": [
     "voltro",
@@ -43,20 +43,20 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@voltro/database": "0.83.1",
-    "@voltro/env": "0.83.1",
-    "@voltro/protocol": "0.83.1",
-    "@voltro/runtime": "0.83.1"
+    "@voltro/database": "0.85.0",
+    "@voltro/env": "0.85.0",
+    "@voltro/protocol": "0.85.0",
+    "@voltro/runtime": "0.85.0"
   },
   "optionalDependencies": {
     "@aws-sdk/client-s3": "^3.1134.0",
     "@aws-sdk/lib-storage": "^3.1134.0",
     "@aws-sdk/s3-request-presigner": "^3.1134.0",
     "@azure/storage-blob": "^12.33.0",
-    "sharp": "^0.35.4"
+    "sharp": "^0.35.5"
   },
   "peerDependencies": {
-    "effect": "^3.22.2"
+    "effect": "4.0.1"
   },
   "publishConfig": {
     "access": "public"