Storage: declarative policies and cacheable delivery #7

Guiding rule for this phase: every capability ships as an open-source interface with a working zero-configuration default. Hosted infrastructure is a different implementation behind that same interface — never the only implementation, and never a different API.

Storage runs on S3, GCS and local disk, with resumable uploads and image transforms. Two things are worth adding: policies that are declared rather than coded, and delivery that something can cache.

Work

• Declarative per-path policies, so storage access is described the same way collection access is. storageAuthorize stays as the escape hatch for rules that need code
• Cacheable delivery. Emit correct Cache-Control, ETag and range handling on the direct-serve path, so a reverse proxy or CDN works in front of it without changing how the server behaves — packages/server/src/storage/routes.ts:606
• Durable transform cache. Derived renditions are held in an in-process LRU today, so they are per-instance and cold after every deploy. Write them back to the storage source instead
• An S3-compatible protocol endpoint, so existing S3 tooling can talk to a Rebase bucket
• Upload and finalize triggers, so a function can run when an object lands