deepspace 0.19.5 → 0.20.0

package/dist/server.d.ts

@@ -207,13 +207,9 @@ declare const UPLOAD_PART_BYTES: number;
 /**
  * The highest part number the server accepts.
  *
- * The handler holds no per-session state, so this — not the declared total —
- * is what bounds an in-flight upload. It is computed against
- * {@link UPLOAD_PART_BYTES}, which is why the server refuses a part larger
- * than that even though a whole small file may be 25 MiB: admitting 25 MiB
- * parts would make the real in-flight bound 52 × 25 MiB = 1300 MiB while the
- * advertised ceiling stayed 1 GiB. With both numbers agreeing, a session's
- * worst case is 52 × 20 MiB = 1040 MiB — the ceiling plus one part.
+ * The server derives the only valid part number and byte length from the
+ * declared total and {@link UPLOAD_PART_BYTES}. The maximum part count is
+ * therefore the exact number needed to reach the file ceiling.
  *
  * R2 allows 10,000 parts, so this is far inside what the API permits.
  */
@@ -253,6 +249,25 @@ declare function storageQuotaMessage(incomingBytes: number, usedBytes: number, l
 declare const MAX_DEPLOY_ASSET_FILE_BYTES: number;
 declare function formatBytes(bytes: number): string;
 
+/**
+ * Everything the files handler needs to enforce one account allocation.
+ *
+ * `quotaKey` is required because an exact scan followed by an uncoordinated
+ * write cannot enforce a limit under concurrency. Callers that do not want a
+ * quota omit `storage`; callers that do want one must name its serialized
+ * summary.
+ */
+interface StorageAdmission {
+    /** The app prefix receiving this request's write. */
+    prefix: string;
+    /** Internal R2 key for the account's ETag-serialized usage summary. */
+    quotaKey: string;
+    /** Resolve the account's limit. `null` fails writes closed. */
+    limitBytes: () => Promise<number | null>;
+    /** Resolve the other app prefixes in the account. `null` fails closed. */
+    siblingPrefixes?: () => Promise<string[] | null>;
+}
+
 /**
  * Shared Scoped R2 Files Handler
  *
@@ -296,6 +311,7 @@ interface ScopeContext {
 }
 type PrefixResult = {
     prefix: string;
+    excludedPrefixes?: readonly string[];
     error?: undefined;
 } | {
     prefix?: undefined;
@@ -318,32 +334,12 @@ interface ScopedR2Config {
  * mount. The handler is the enforcer; the mount only knows whose limit
  * applies.
  */
-interface StorageAdmission {
-    /** This app's own prefix — the one the incoming write lands under. */
-    prefix: string;
-    /**
-     * Resolve the owner's limit in bytes. `null` means the lookup failed;
-     * writes then fail closed (503) rather than admitting unmetered storage.
-     */
-    limitBytes: () => Promise<number | null>;
-    /**
-     * The OTHER app prefixes this owner's storage spans, if any.
-     *
-     * The limit is per ACCOUNT, not per app: an owner's allocation is the total
-     * across everything they own, so admission has to see the siblings too. `[]`
-     * for an owner with one app, which is the common case and costs exactly what
-     * it did when this was a per-app limit.
-     *
-     * Returning `null` means the owner's apps could not be enumerated. Like a
-     * failed limit lookup that fails the write closed rather than admitting a
-     * write against an allocation we cannot measure.
-     */
-    siblingPrefixes?: () => Promise<string[] | null>;
-}
 interface ScopedR2Auth {
     userId: string | null;
     /** Absent = no quota on this mount (e.g. an app's own bucket). */
     storage?: StorageAdmission;
+    /** Account-wide quota details are private to an authorized owner surface. */
+    includeStorageUsage?: boolean;
 }
 type ScopedR2Handler = (request: Request, url: URL, bucket: R2Bucket, auth: ScopedR2Auth) => Promise<Response>;
 declare function isFilesVerbPath(method: string, subpath: string): boolean;