@voltro/plugin-storage 0.84.0 → 0.86.0

package/dist/types.d.ts

@@ -1,10 +1,13 @@
 import { Context } from 'effect';
 import { Effect } from 'effect';
 import { Schema } from 'effect';
+import { StorageAccessPolicy } from '@voltro/protocol';
+import { StorageAccessRule } from '@voltro/protocol';
 import { Stream } from 'effect';
 import { Subject } from '@voltro/protocol';
+import { YieldableError } from 'effect/Cause';
 
-export declare type AccessPolicy = ReadonlyArray<AccessRule>;
+export declare type AccessPolicy = StorageAccessPolicy;
 
 /**
  * One access rule. A rule GRANTS when EVERY present condition is satisfied
@@ -12,24 +15,7 @@ export declare type AccessPolicy = ReadonlyArray<AccessRule>;
  * grants (OR). An empty policy on a private object means owner-only (the
  * implicit owner check always applies).
  */
-export declare interface AccessRule {
-    /** `subject.id === ref.ownerId`. */
-    readonly owner?: boolean;
-    /** `subject.metadata.roles` intersects these. */
-    readonly roles?: ReadonlyArray<string>;
-    /** resolved groups (default `subject.metadata.groups`) intersect these. */
-    readonly groups?: ReadonlyArray<string>;
-    /** `subject.scopes` intersects these. */
-    readonly scopes?: ReadonlyArray<string>;
-    /** `subject.tenantId === ref.tenantId`. */
-    readonly tenant?: boolean;
-    /** subject is any authenticated api-key. */
-    readonly apiKey?: boolean;
-    /** a correct password was supplied (checked at mint, against passwordHash). */
-    readonly password?: boolean;
-    /** a named custom guard (`options.guards[name]`) returns true. */
-    readonly guard?: string;
-}
+export declare type AccessRule = StorageAccessRule;
 
 /**
  * A lazy stream of bytes — the streaming counterpart to {@link StoredObject}'s
@@ -178,12 +164,10 @@ export declare interface Rendition {
 export declare class StorageAccessDenied extends StorageAccessDenied_base {
 }
 
-declare const StorageAccessDenied_base: Schema.TaggedErrorClass<StorageAccessDenied, "StorageAccessDenied", {
-    readonly _tag: Schema.tag<"StorageAccessDenied">;
-} & {
-    refId: typeof Schema.String;
-    reason: typeof Schema.String;
-}>;
+declare const StorageAccessDenied_base: Schema.Class<StorageAccessDenied, Schema.TaggedStruct<"StorageAccessDenied", {
+    readonly refId: Schema.String;
+    readonly reason: Schema.String;
+}>, YieldableError>;
 
 /**
  * Storage failure. `transient` drives retry — `true` for 429 / 5xx /
@@ -193,14 +177,12 @@ declare const StorageAccessDenied_base: Schema.TaggedErrorClass<StorageAccessDen
 export declare class StorageError extends StorageError_base {
 }
 
-declare const StorageError_base: Schema.TaggedErrorClass<StorageError, "StorageError", {
-    readonly _tag: Schema.tag<"StorageError">;
-} & {
-    provider: typeof Schema.String;
-    message: typeof Schema.String;
-    transient: typeof Schema.Boolean;
-    status: Schema.optional<typeof Schema.Number>;
-}>;
+declare const StorageError_base: Schema.Class<StorageError, Schema.TaggedStruct<"StorageError", {
+    readonly provider: Schema.String;
+    readonly message: Schema.String;
+    readonly transient: Schema.Boolean;
+    readonly status: Schema.optional<Schema.Number>;
+}>, YieldableError>;
 
 /** A persisted, explicit share of one object with one principal. */
 export declare interface StorageGrant {
@@ -226,6 +208,8 @@ export declare type StorageGuard = (ctx: {
  * access policy.
  */
 export declare interface StorageProvider {
+    /** Stable physical object-key namespace; exclude credentials and plugin aliases. */
+    readonly objectNamespace: Effect.Effect<string, StorageError>;
     /**
      * Where a FILESYSTEM provider writes. Absent for every other provider.
      *
@@ -356,15 +340,14 @@ export declare interface StorageRef {
 /** An upload was rejected by a constraint (size / content-type / magic-byte
  *  mismatch). `reason` is a stable code; `detail` is human-readable. */
 export declare class StorageRejected extends StorageRejected_base {
+    get message(): string;
 }
 
-declare const StorageRejected_base: Schema.TaggedErrorClass<StorageRejected, "StorageRejected", {
-    readonly _tag: Schema.tag<"StorageRejected">;
-} & {
+declare const StorageRejected_base: Schema.Class<StorageRejected, Schema.TaggedStruct<"StorageRejected", {
     /** `'too-large' | 'content-type-not-allowed' | 'content-mismatch'` */
-    reason: typeof Schema.String;
-    detail: typeof Schema.String;
-}>;
+    readonly reason: Schema.String;
+    readonly detail: Schema.String;
+}>, YieldableError>;
 
 /** Scans bytes before they're stored. Return `{ clean:false, threat }` to
  *  reject the upload (fails with `StorageScanRejected`, nothing is stored). */
@@ -378,11 +361,9 @@ export declare type StorageScanner = (input: {
 export declare class StorageScanRejected extends StorageScanRejected_base {
 }
 
-declare const StorageScanRejected_base: Schema.TaggedErrorClass<StorageScanRejected, "StorageScanRejected", {
-    readonly _tag: Schema.tag<"StorageScanRejected">;
-} & {
-    threat: typeof Schema.String;
-}>;
+declare const StorageScanRejected_base: Schema.Class<StorageScanRejected, Schema.TaggedStruct<"StorageScanRejected", {
+    readonly threat: Schema.String;
+}>, YieldableError>;
 
 export declare interface StorageScanResult {
     readonly clean: boolean;
@@ -393,10 +374,12 @@ export declare interface StorageScanResult {
 export declare class StorageService extends StorageService_base {
 }
 
-declare const StorageService_base: Context.TagClass<StorageService, "@voltro/plugin-storage/StorageService", StorageServiceShape>;
+declare const StorageService_base: Context.ServiceClass<StorageService, "@voltro/plugin-storage/StorageService", StorageServiceShape>;
 
 /** The service handlers consume: `const storage = yield* StorageService`. */
 export declare interface StorageServiceShape {
+    /** Opaque destination binding for manually signed upload-family credentials. */
+    readonly uploadTicketScope: () => Effect.Effect<string, StorageError>;
     /** Store bytes. The result is the ref plus this call's `outcome`. */
     readonly put: (input: PutInput) => Effect.Effect<StoredRef, StorageError | StorageRejected | StorageScanRejected>;
     /** Fetch an object's bytes by id. Enforces the tenant guard ONLY — it does
@@ -583,6 +566,7 @@ export declare interface StorageServiceShape {
         readonly tenantId?: string | null;
         readonly ownerId?: string | null;
         readonly visibility?: StorageVisibility;
+        readonly access?: AccessPolicy;
         readonly folder?: string;
         readonly tags?: ReadonlyArray<string>;
         readonly alt?: string;
@@ -616,6 +600,7 @@ export declare interface StorageServiceShape {
         readonly tenantId?: string | null;
         readonly ownerId?: string | null;
         readonly visibility?: StorageVisibility;
+        readonly access?: AccessPolicy;
         readonly folder?: string;
         readonly tags?: ReadonlyArray<string>;
         readonly alt?: string;
@@ -665,6 +650,7 @@ export declare interface StorageServiceShape {
         readonly tenantId?: string | null;
         readonly ownerId?: string | null;
         readonly visibility?: StorageVisibility;
+        readonly access?: AccessPolicy;
         readonly folder?: string;
         readonly tags?: ReadonlyArray<string>;
         readonly alt?: string;

package/dist/types.js

@@ -11,6 +11,10 @@ var n = class extends t.TaggedError()("StorageError", {
 }) {}, i = class extends t.TaggedError()("StorageRejected", {
 	reason: t.String,
 	detail: t.String
-}) {}, a = class extends t.TaggedError()("StorageScanRejected", { threat: t.String }) {}, o = class extends e.Tag("@voltro/plugin-storage/StorageService")() {};
+}) {
+	get message() {
+		return this.detail;
+	}
+}, a = class extends t.TaggedError()("StorageScanRejected", { threat: t.String }) {}, o = class extends e.Service()("@voltro/plugin-storage/StorageService") {};
 //#endregion
 export { r as StorageAccessDenied, n as StorageError, i as StorageRejected, a as StorageScanRejected, o as StorageService };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/plugin-storage",
-  "version": "0.84.0",
+  "version": "0.86.0",
   "description": "File-storage plugin — one StorageProvider contract, switchable backends (S3 / MinIO / Azure / filesystem / memory / database). Public (CDN-direct) + private (access policy + per-object grants) objects, upload constraints, virus-scan hook, on-the-fly image transforms.",
   "keywords": [
     "voltro",
@@ -43,10 +43,10 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@voltro/database": "0.84.0",
-    "@voltro/env": "0.84.0",
-    "@voltro/protocol": "0.84.0",
-    "@voltro/runtime": "0.84.0"
+    "@voltro/database": "0.86.0",
+    "@voltro/env": "0.86.0",
+    "@voltro/protocol": "0.86.0",
+    "@voltro/runtime": "0.86.0"
   },
   "optionalDependencies": {
     "@aws-sdk/client-s3": "^3.1134.0",
@@ -56,7 +56,7 @@
     "sharp": "^0.35.5"
   },
   "peerDependencies": {
-    "effect": "^3.22.2"
+    "effect": "4.0.1"
   },
   "publishConfig": {
     "access": "public"