Namespace quotas

CDN has three controls, all enforced by the backend:

1. Account policy: tier media access, per-file sizes, total storage, monthly published uploads, processing dimensions/duration, variants, file count and concurrent uploads. An administrator can override these in the admin account's CDN tab.
2. Namespace byte limits: an optional slice of the account allowance. Namespace limits can only narrow the effective account limits; multiple namespaces cannot multiply the account pool.
3. Namespace credit budget: an optional cdn service quota in the existing credit system. Storage and delivery still debit the owning account wallet. Workspace compute grants and monthly VM pools do not cover CDN usage.

Defaults and overrides

await oblien.cdn.setQuotaDefaults({
  cdn_max_bytes: 2 * 1024 ** 3,
  cdn_monthly_bytes: 10 * 1024 ** 3,
  policy: { maxFileBytes: { video: 256 * 1024 ** 2 } },
});
await oblien.cdn.setNamespaceQuota('customer-123', {
  cdn_max_bytes: 5 * 1024 ** 3,
  policy: { allowedKinds: ['image', 'video', 'document'] },
});

An omitted field preserves its current value. null storage/upload overrides inherit the account default, then the account plan ceiling. Zero is a real zero allowance, never unlimited. Namespace policy fields inherit individually; an explicit field replaces that template value but is clamped to the account ceiling. Removing a policy override uses policy: null.

HTTP routes:

• GET / PUT /cdn/quota-defaults
• GET /cdn/namespaces?search=&page=1&limit=20
• PUT /cdn/namespaces/quota with {namespace, cdn_max_bytes, cdn_monthly_bytes, policy}
• GET /cdn/policy?namespace=customer-123
• GET /cdn/usage?namespace=customer-123

The namespace resource module and CDN quota API expose the same storage/upload limits for registered namespaces. Other workspace limits remain unchanged when editing CDN quotas. CDN tags may also be used before a platform namespace is registered. Tags are exact, case-sensitive identities, at most 64 UTF-8 bytes, without control characters or leading/trailing whitespace.

Build a SaaS

Create one registered namespace per customer and issue a namespace-scoped API key. Set defaults once, then override byte limits and the existing cdn credit quota for that customer. The reseller's backend mints scoped upload permits; browsers receive only that permit. Your backend reads the authoritative result and saves its file ID in your application database.

Namespace credentials cannot read, delete, restore, list, or upload into another namespace, including by changing query parameters. Account-level custom-domain management and quota changes require account scope. Omitting a namespace with an account credential lists all owned files; scope=personal restricts supported file/usage reads to unassigned files. Omitting it during upload stores an unassigned file.

Use the existing signed credit-quota events for service: 'cdn' to warn customers near their spending threshold or when exhausted. Storage and monthly upload percentages are also available from /cdn/usage and displayed in the dashboard. Handle webhook retries idempotently. Offer an account/namespace top-up through the existing billing contract; do not calculate or grant a second CDN wallet yourself.

Enforcement and lifecycle

Upload permits reserve bytes atomically across account and namespace. The actual original/variant footprint is checked again before publication. Lowering a quota does not delete existing files, but can reject a pending upload. All copies retained by the CDN count toward storage, including trash. Monthly published-upload usage is not refunded by deleting a file, and resets at the UTC calendar-month boundary.

Credit exhaustion blocks new uploads and new origin delivery authorization. Storage already retained remains metered until physical removal. Public cached copies and transfers already in progress may outlive a block. See billing and traffic and expiry.