@abyss-project/tools 2.10.0 → 2.12.0

package/src/api/board-label.api.ts

@@ -55,7 +55,10 @@ export const createBoardLabel = async (
   body: ICreateBoardLabelBody,
 ): Promise<ICreateBoardLabelResponse> => {
   return (
-    await AbyssToolsCore.axios.post<ICreateBoardLabelResponse>(`board/${params.boardId}/label`, body)
+    await AbyssToolsCore.axios.post<ICreateBoardLabelResponse>(
+      `board/${params.boardId}/label`,
+      body,
+    )
   ).data;
 };
 
@@ -82,6 +85,7 @@ export const removeBoardLabel = async (
 export const listBoardLabels = async (
   params: IListBoardLabelParams,
 ): Promise<IListBoardLabelResponse> => {
-  return (await AbyssToolsCore.axios.get<IListBoardLabelResponse>(`board/${params.boardId}/label/list`))
-    .data;
+  return (
+    await AbyssToolsCore.axios.get<IListBoardLabelResponse>(`board/${params.boardId}/label/list`)
+  ).data;
 };

package/src/api/board.api.ts

@@ -31,7 +31,8 @@ export const getBoard = async (params: IGetBoardParams): Promise<IGetBoardRespon
 export const getBySlugBoard = async (
   params: IGetBySlugBoardParams,
 ): Promise<IGetBySlugBoardResponse> => {
-  return (await AbyssToolsCore.axios.get<IGetBySlugBoardResponse>(`board/slug/${params.slug}`)).data;
+  return (await AbyssToolsCore.axios.get<IGetBySlugBoardResponse>(`board/slug/${params.slug}`))
+    .data;
 };
 
 export const deleteBoard = async (params: IDeleteBoardParams): Promise<IDeleteBoardResponse> => {
@@ -42,7 +43,8 @@ export const updateBoard = async (
   params: IUpdateBoardParams,
   body: IUpdateBoardBody,
 ): Promise<IUpdateBoardResponse> => {
-  return (await AbyssToolsCore.axios.put<IUpdateBoardResponse>(`board/${params.boardId}`, body)).data;
+  return (await AbyssToolsCore.axios.put<IUpdateBoardResponse>(`board/${params.boardId}`, body))
+    .data;
 };
 
 export const createBoard = async (body: ICreateBoardBody): Promise<ICreateBoardResponse> => {
@@ -54,12 +56,18 @@ export const createForOrganizationBoard = async (
   body: ICreateBoardBody,
 ): Promise<ICreateBoardResponse> => {
   return (
-    await AbyssToolsCore.axios.post<ICreateBoardResponse>(`board/organization/${params.organizationId}`, body)
+    await AbyssToolsCore.axios.post<ICreateBoardResponse>(
+      `board/organization/${params.organizationId}`,
+      body,
+    )
   ).data;
 };
 
-export const listBoard = async (query?: { sharedWithMe?: boolean }): Promise<IListBoardUserResponse> => {
-  return (await AbyssToolsCore.axios.get<IListBoardUserResponse>('board/list', { params: query })).data;
+export const listBoard = async (query?: {
+  sharedWithMe?: boolean;
+}): Promise<IListBoardUserResponse> => {
+  return (await AbyssToolsCore.axios.get<IListBoardUserResponse>('board/list', { params: query }))
+    .data;
 };
 
 export const listBoardProject = async (params: {
@@ -71,8 +79,9 @@ export const listBoardProject = async (params: {
 };
 
 export const getNextCardPreviewBoard = async (): Promise<IGetNextCardPreviewBoardResponse> => {
-  return (await AbyssToolsCore.axios.post<IGetNextCardPreviewBoardResponse>(`board/next-card-preview`))
-    .data;
+  return (
+    await AbyssToolsCore.axios.post<IGetNextCardPreviewBoardResponse>(`board/next-card-preview`)
+  ).data;
 };
 
 export const listBoardOrganization = async (
@@ -111,9 +120,9 @@ export const transferBoard = async (
   ).data;
 };
 
-export const countOrganizationBoard = async (
-  params: { organizationId: string },
-): Promise<ICountOrganizationResponse> => {
+export const countOrganizationBoard = async (params: {
+  organizationId: string;
+}): Promise<ICountOrganizationResponse> => {
   return (
     await AbyssToolsCore.axios.get<ICountOrganizationResponse>(
       `board/organization/${params.organizationId}/count`,

package/src/api/draw.api.ts

@@ -29,9 +29,12 @@ export const paginateProjectDraw = async (
   query: IPaginateDrawQuery,
 ): Promise<IPaginateDrawResponse> => {
   return (
-    await AbyssToolsCore.axios.get<IPaginateDrawResponse>(`project/${params.projectId}/draw/paginate`, {
-      params: query,
-    })
+    await AbyssToolsCore.axios.get<IPaginateDrawResponse>(
+      `project/${params.projectId}/draw/paginate`,
+      {
+        params: query,
+      },
+    )
   ).data;
 };
 
@@ -58,8 +61,12 @@ export const createForOrganizationDraw = async (
   params: ICreateForOrganizationDrawParams,
   body: ICreateDrawBody,
 ): Promise<ICreateDrawResponse> => {
-  return (await AbyssToolsCore.axios.post<ICreateDrawResponse>(`draw/organization/${params.organizationId}`, body))
-    .data;
+  return (
+    await AbyssToolsCore.axios.post<ICreateDrawResponse>(
+      `draw/organization/${params.organizationId}`,
+      body,
+    )
+  ).data;
 };
 
 export const paginateOrganizationDraw = async (
@@ -79,16 +86,13 @@ export const transferDraw = async (
   body: ITransferContentBody,
 ): Promise<ITransferDrawResponse> => {
   return (
-    await AbyssToolsCore.axios.post<ITransferDrawResponse>(
-      `draw/${params.drawId}/transfer`,
-      body,
-    )
+    await AbyssToolsCore.axios.post<ITransferDrawResponse>(`draw/${params.drawId}/transfer`, body)
   ).data;
 };
 
-export const countOrganizationDraw = async (
-  params: { organizationId: string },
-): Promise<ICountOrganizationResponse> => {
+export const countOrganizationDraw = async (params: {
+  organizationId: string;
+}): Promise<ICountOrganizationResponse> => {
   return (
     await AbyssToolsCore.axios.get<ICountOrganizationResponse>(
       `draw/organization/${params.organizationId}/count`,

package/src/api/draw.public.api.ts

@@ -15,7 +15,9 @@ export const getDrawPublic = async (
   params: IGetDrawPublicParams,
 ): Promise<IGetDrawPublicResponse> => {
   return (
-    await AbyssToolsCore.axios.get<IGetDrawPublicResponse>(`draw/public/${params.publicAccessToken}`)
+    await AbyssToolsCore.axios.get<IGetDrawPublicResponse>(
+      `draw/public/${params.publicAccessToken}`,
+    )
   ).data;
 };
 

package/src/api/extraction-plan-preset.api.ts

@@ -11,11 +11,7 @@
 // ──────────────────────────────────────────────
 
 import { AbyssToolsCore } from '..';
-import type {
-  ICreatePlanPresetBody,
-  IUpdatePlanPresetBody,
-  IListPlanPresetQuery,
-} from '../types';
+import type { ICreatePlanPresetBody, IUpdatePlanPresetBody, IListPlanPresetQuery } from '../types';
 import type {
   IListModesResponse,
   IListPlanPresetsResponse,
@@ -30,22 +26,72 @@ function authHeader(apiKey?: string): Record<string, string> {
 }
 
 export const listModes = async (apiKey?: string): Promise<IListModesResponse> =>
-  (await AbyssToolsCore.axios.get<IListModesResponse>(`extract/modes`, { headers: authHeader(apiKey) })).data;
+  (
+    await AbyssToolsCore.axios.get<IListModesResponse>(`extract/modes`, {
+      headers: authHeader(apiKey),
+    })
+  ).data;
 
-export const listExtractionPlanPresets = async (query: IListPlanPresetQuery = {}, apiKey?: string): Promise<IListPlanPresetsResponse> =>
-  (await AbyssToolsCore.axios.get<IListPlanPresetsResponse>(`extract/plans`, { params: query, headers: authHeader(apiKey) })).data;
+export const listExtractionPlanPresets = async (
+  query: IListPlanPresetQuery = {},
+  apiKey?: string,
+): Promise<IListPlanPresetsResponse> =>
+  (
+    await AbyssToolsCore.axios.get<IListPlanPresetsResponse>(`extract/plans`, {
+      params: query,
+      headers: authHeader(apiKey),
+    })
+  ).data;
 
-export const getExtractionPlanPreset = async (id: string, apiKey?: string): Promise<IGetPlanPresetResponse> =>
-  (await AbyssToolsCore.axios.get<IGetPlanPresetResponse>(`extract/plans/${id}`, { headers: authHeader(apiKey) })).data;
+export const getExtractionPlanPreset = async (
+  id: string,
+  apiKey?: string,
+): Promise<IGetPlanPresetResponse> =>
+  (
+    await AbyssToolsCore.axios.get<IGetPlanPresetResponse>(`extract/plans/${id}`, {
+      headers: authHeader(apiKey),
+    })
+  ).data;
 
-export const createExtractionPlanPreset = async (body: ICreatePlanPresetBody, apiKey?: string): Promise<IGetPlanPresetResponse> =>
-  (await AbyssToolsCore.axios.post<IGetPlanPresetResponse>(`extract/plans`, body, { headers: authHeader(apiKey) })).data;
+export const createExtractionPlanPreset = async (
+  body: ICreatePlanPresetBody,
+  apiKey?: string,
+): Promise<IGetPlanPresetResponse> =>
+  (
+    await AbyssToolsCore.axios.post<IGetPlanPresetResponse>(`extract/plans`, body, {
+      headers: authHeader(apiKey),
+    })
+  ).data;
 
-export const updateExtractionPlanPreset = async (id: string, body: IUpdatePlanPresetBody, apiKey?: string): Promise<IGetPlanPresetResponse> =>
-  (await AbyssToolsCore.axios.put<IGetPlanPresetResponse>(`extract/plans/${id}`, body, { headers: authHeader(apiKey) })).data;
+export const updateExtractionPlanPreset = async (
+  id: string,
+  body: IUpdatePlanPresetBody,
+  apiKey?: string,
+): Promise<IGetPlanPresetResponse> =>
+  (
+    await AbyssToolsCore.axios.put<IGetPlanPresetResponse>(`extract/plans/${id}`, body, {
+      headers: authHeader(apiKey),
+    })
+  ).data;
 
-export const deleteExtractionPlanPreset = async (id: string, apiKey?: string): Promise<IDeletePlanPresetResponse> =>
-  (await AbyssToolsCore.axios.delete<IDeletePlanPresetResponse>(`extract/plans/${id}`, { headers: authHeader(apiKey) })).data;
+export const deleteExtractionPlanPreset = async (
+  id: string,
+  apiKey?: string,
+): Promise<IDeletePlanPresetResponse> =>
+  (
+    await AbyssToolsCore.axios.delete<IDeletePlanPresetResponse>(`extract/plans/${id}`, {
+      headers: authHeader(apiKey),
+    })
+  ).data;
 
-export const setDefaultExtractionPlanPreset = async (id: string, apiKey?: string): Promise<IGetPlanPresetResponse> =>
-  (await AbyssToolsCore.axios.post<IGetPlanPresetResponse>(`extract/plans/${id}/default`, {}, { headers: authHeader(apiKey) })).data;
+export const setDefaultExtractionPlanPreset = async (
+  id: string,
+  apiKey?: string,
+): Promise<IGetPlanPresetResponse> =>
+  (
+    await AbyssToolsCore.axios.post<IGetPlanPresetResponse>(
+      `extract/plans/${id}/default`,
+      {},
+      { headers: authHeader(apiKey) },
+    )
+  ).data;

package/src/api/extraction-settings.api.ts

@@ -9,14 +9,8 @@
 // ──────────────────────────────────────────────
 
 import { AbyssToolsCore } from '..';
-import type {
-  IGetExtractionSettingsQuery,
-  IUpsertExtractionSettingsBody,
-} from '../types';
-import type {
-  IGetExtractionSettingsResponse,
-  IUpsertExtractionSettingsResponse,
-} from '../types';
+import type { IGetExtractionSettingsQuery, IUpsertExtractionSettingsBody } from '../types';
+import type { IGetExtractionSettingsResponse, IUpsertExtractionSettingsResponse } from '../types';
 
 const DEFAULT_API_KEY_HEADER = 'abyss-api-key';
 

package/src/api/extraction.api.ts

@@ -164,11 +164,54 @@ const postExtract = async (
   }
   const params = serializeParams(scope);
   if (body.pdf) {
-    const { form, formHeaders } = await buildExtractMultipart(body);
+    const isBrowser = typeof window !== 'undefined' && typeof FormData !== 'undefined';
+    const filename = body.pdf_filename ?? 'document.pdf';
+    if (isBrowser) {
+      const form = new FormData();
+      const blob = new Blob([body.pdf as Uint8Array], { type: 'application/pdf' });
+      form.append('file', blob, filename);
+      appendIf(form, 'mode', body.mode);
+      if (body.hint) form.append('hint', JSON.stringify(body.hint));
+      appendIf(form, 'template_id', body.template_id);
+      if (body.template) form.append('template', JSON.stringify(body.template));
+      appendIf(form, 'user_external_id', body.user_external_id);
+      if (body.user_metadata) form.append('user_metadata', JSON.stringify(body.user_metadata));
+      if (typeof body.archive === 'boolean') form.append('archive', String(body.archive));
+      if (typeof body.force === 'boolean') form.append('force', String(body.force));
+      if (body.processing) form.append('processing', body.processing);
+      return (
+        await AbyssToolsCore.axios.post(`extract/extract`, form, {
+          params,
+          headers: { ...authHeader(apiKey), ...extraHeaders },
+          maxBodyLength: Infinity,
+          maxContentLength: Infinity,
+        })
+      ).data;
+    }
+    const FormDataCtor = await loadFormData();
+    const form = new FormDataCtor();
+    const buf = Buffer.isBuffer(body.pdf) ? body.pdf : Buffer.from(body.pdf);
+    form.append('file', buf, {
+      filename,
+      contentType: 'application/pdf',
+    });
+    appendIf(form, 'mode', body.mode);
+    if (body.hint) form.append('hint', JSON.stringify(body.hint));
+    appendIf(form, 'template_id', body.template_id);
+    if (body.template) form.append('template', JSON.stringify(body.template));
+    appendIf(form, 'user_external_id', body.user_external_id);
+    if (body.user_metadata) form.append('user_metadata', JSON.stringify(body.user_metadata));
+    if (typeof body.archive === 'boolean') form.append('archive', String(body.archive));
+    if (typeof body.force === 'boolean') form.append('force', String(body.force));
+    if (body.processing) form.append('processing', body.processing);
     return (
       await AbyssToolsCore.axios.post(`extract/extract`, form, {
         params,
-        headers: { ...formHeaders, ...authHeader(apiKey), ...extraHeaders },
+        headers: {
+          ...(typeof form.getHeaders === 'function' ? form.getHeaders() : {}),
+          ...authHeader(apiKey),
+          ...extraHeaders,
+        },
         maxBodyLength: Infinity,
         maxContentLength: Infinity,
       })
@@ -190,56 +233,6 @@ function appendIf(form: any, key: string, value: unknown): void {
   form.append(key, String(value));
 }
 
-/** Append the shared extract text fields (all optional) onto a multipart form. */
-function appendExtractFields(form: any, body: IExtractBody): void {
-  appendIf(form, 'mode', body.mode);
-  if (body.hint) form.append('hint', JSON.stringify(body.hint));
-  appendIf(form, 'template_id', body.template_id);
-  if (body.template) form.append('template', JSON.stringify(body.template));
-  appendIf(form, 'user_external_id', body.user_external_id);
-  if (body.user_metadata) form.append('user_metadata', JSON.stringify(body.user_metadata));
-  if (typeof body.archive === 'boolean') form.append('archive', String(body.archive));
-  if (typeof body.force === 'boolean') form.append('force', String(body.force));
-  if (body.processing) form.append('processing', body.processing);
-}
-
-/**
- * Build the multipart form for an extract upload — browser `FormData`/`Blob`
- * or Node `Buffer` + lazy-required `form-data` — shared by the personal and
- * application extract clients. Returns the form plus the content-type headers
- * it needs (empty for the browser, which sets its own boundary;
- * `form.getHeaders()` for Node). Scope params + auth headers are added by the
- * caller. Requires `body.pdf` to be set.
- */
-export async function buildExtractMultipart(
-  body: IExtractBody,
-): Promise<{ form: any; formHeaders: Record<string, string> }> {
-  const pdf = body.pdf;
-  if (!pdf) {
-    // Precondition: only the multipart-upload path calls this (both callers
-    // guard on `body.pdf` first). Enforced here so the helper is self-contained.
-    throw new Error('buildExtractMultipart requires body.pdf');
-  }
-  const isBrowser = typeof window !== 'undefined' && typeof FormData !== 'undefined';
-  const filename = body.pdf_filename ?? 'document.pdf';
-  if (isBrowser) {
-    const form = new FormData();
-    const blob = new Blob([pdf as Uint8Array], { type: 'application/pdf' });
-    form.append('file', blob, filename);
-    appendExtractFields(form, body);
-    return { form, formHeaders: {} };
-  }
-  const FormDataCtor = await loadFormData();
-  const form = new FormDataCtor();
-  const buf = Buffer.isBuffer(pdf) ? pdf : Buffer.from(pdf);
-  form.append('file', buf, { filename, contentType: 'application/pdf' });
-  appendExtractFields(form, body);
-  return {
-    form,
-    formHeaders: typeof form.getHeaders === 'function' ? form.getHeaders() : {},
-  };
-}
-
 export const extractBulk = async (
   body: IExtractBulkBody,
   scope: IExtractionContentScopeQuery = {},

package/src/api/index.ts

@@ -46,7 +46,6 @@ export * from './tag.api';
 
 // Extraction
 export * from './extraction.api';
-export * from './extraction.application.api';
 export * from './extraction-settings.api';
 export * from './extraction-plan-preset.api';
 

package/src/api/probe-scan.api.test.ts

@@ -18,4 +18,30 @@ void _scanAsync;
 void _getScan;
 void _listScans;
 
+// The accepted file inputs (#519). A Blob covers the browser's File and Node's
+// file-backed fs.openAsBlob(path); raw bytes are accepted as a Uint8Array (and
+// therefore a Buffer). A Node stream is refused AT COMPILE TIME: the body is a
+// spec FormData, whose parts need a known length, so honouring a stream would
+// mean buffering up to 2 GiB in memory.
+declare const blob: Blob;
+declare const bytes: Uint8Array;
+declare const buffer: Buffer;
+declare const stream: NodeJS.ReadableStream;
+
+const _fromBlob: api.ProbeScanFileInput = blob;
+const _fromBytes: api.ProbeScanFileInput = bytes;
+const _fromBuffer: api.ProbeScanFileInput = buffer;
+// @ts-expect-error a Readable stream is not an accepted scan input since 2.12.0
+const _fromStream: api.ProbeScanFileInput = stream;
+
+void _fromBlob;
+void _fromBytes;
+void _fromBuffer;
+void _fromStream;
+
+// buildScanForm returns the FormData alone — axios sets the multipart
+// content type and boundary, so there are no headers to merge in.
+const _form: FormData = api.buildScanForm(blob, { filename: 'f.bin' });
+void _form;
+
 export {};

package/src/api/probe-scan.api.ts

@@ -6,13 +6,20 @@
 // add no extra path segment (`@Controller({ prefixPath: '/scan' })`), so
 // these calls hit `scan`/`scan/:id` directly — no `probe/` prefix.
 //
-// File-upload dual environment handling (browser `FormData`/`Blob` vs Node
-// `Buffer`/stream + the `form-data` package) mirrors this package's own
-// extraction.api.ts (`detect`/`postExtract`): AbyssProbe is meant to be
-// called from the abyss-main UI (a browser) as well as from Node services
-// (abyss-storage, external integrators). `form-data` is lazy-`require`d
-// (never statically imported) so a browser bundle never tries to resolve
-// the Node-only package.
+// Multipart bodies are built with the global `FormData` + `Blob` — the same
+// code in a browser and on Node, mirroring this package's own
+// extraction.api.ts. axios serializes a spec-compliant FormData on both and
+// sets the multipart boundary itself, so no content-type header is ever set by
+// hand. AbyssProbe is called from the abyss-main UI (a browser) as well as
+// from Node services (abyss-storage, external integrators).
+//
+// A Node caller holding a file ON DISK passes `await fs.openAsBlob(path)`,
+// which requires Node >= 19.8 — hence `engines.node` in package.json.
+// `FormData` and `Blob` alone would only need Node 18, but openAsBlob is this
+// client's documented way to send a file, and promising 18.x only to fail at
+// runtime is worse than refusing the install. A caller that already holds its
+// bytes passes a `Buffer`/`Uint8Array` and has no such constraint (see
+// {@link ProbeScanFileInput}).
 //
 // `authHeader`/`serializeProbeQuery` are kept LOCAL and unexported (not a
 // shared utils file) — same convention as every other extract/*.api.ts file
@@ -61,60 +68,65 @@ function serializeProbeQuery<T extends object>(query: T): Record<string, unknown
   return out;
 }
 
-/** Anything `sdk.probe.scan` accepts as the file to submit. */
-export type ProbeScanFileInput = Buffer | Uint8Array | NodeJS.ReadableStream | Blob;
-
-function isBrowserEnv(): boolean {
-  return typeof window !== 'undefined' && typeof FormData !== 'undefined';
-}
-
-async function loadNodeFormData(): Promise<any> {
-  // Indirect eval so bundlers (esbuild/vite/webpack) do not try to resolve
-  // the Node-only "form-data" package when this file is included in a
-  // browser bundle. The require only ever runs at runtime on Node.
-  // eslint-disable-next-line @typescript-eslint/no-implied-eval, no-new-func
-  const nodeRequire: NodeRequire = new Function('return require')();
-  return nodeRequire('form-data');
-}
+/**
+ * Anything `sdk.probe.scan` accepts as the file to submit.
+ *
+ * `Blob` covers the browser's `File` (a `Blob` subclass) and, on Node, a
+ * FILE-BACKED blob from `await fs.openAsBlob(path)` (Node >= 19.8): its bytes
+ * are read from disk as the request body is written, so scanning a file at the
+ * 2 GiB ceiling never holds the file in memory. `Uint8Array` (and therefore
+ * `Buffer`) is for a caller that already holds the bytes.
+ *
+ * A Node `Readable` is NOT accepted. The body is a spec `FormData`, whose
+ * parts must have a known length, so a stream could only be honoured by
+ * buffering it whole — precisely what a 2 GiB scan must not do. A caller
+ * holding a path passes `await fs.openAsBlob(path)` instead.
+ */
+export type ProbeScanFileInput = Blob | Uint8Array;
 
-export interface BuiltScanForm {
-  form: unknown;
-  headers: Record<string, string>;
+/**
+ * The file as one multipart part.
+ *
+ * A `Blob` is used as-is, keeping whatever streaming its implementation gives
+ * (a file-backed `openAsBlob` reads from disk lazily); raw bytes are wrapped
+ * in a `Blob` carrying `mimeType`. `Buffer` is never named here — this code
+ * also runs in a browser bundle, where the global does not exist — and
+ * `Buffer` is a `Uint8Array` subclass, so the check below already covers it.
+ *
+ * Anything else is refused with an actionable message. Until 2.12.0 the same
+ * call died on Node with `ReferenceError: require is not defined`, thrown by a
+ * `form-data` loader before any request was made (#519): it named neither the
+ * cause nor the fix.
+ */
+function toScanFilePart(file: ProbeScanFileInput, mimeType?: string): Blob {
+  if (file instanceof Blob) return file;
+  if (file instanceof Uint8Array) return new Blob([file], { type: mimeType ?? '' });
+
+  const isStream = typeof (file as { pipe?: unknown } | null | undefined)?.pipe === 'function';
+  throw new TypeError(
+    `A probe scan file must be a Blob (a browser File, or fs.openAsBlob(path) on Node), ` +
+      `a Buffer or a Uint8Array — received ${isStream ? 'a stream' : typeof file}. ` +
+      `On Node, pass \`await fs.openAsBlob(path)\`: a file-backed Blob is streamed from ` +
+      `disk, so the file is never buffered in memory.`,
+  );
 }
 
 /**
  * Exported (not just this file's own `scan` internals) so
  * probe-scan.application.api.ts reuses this EXACT multipart-building logic
- * (browser `FormData`/`Blob` vs Node `Buffer`/stream + lazy-required
- * `form-data`) rather than duplicating it — the file-upload contract is
- * identical for a personal/org caller and an application caller; only the
- * URL/auth differ (see that file's header comment).
+ * rather than duplicating it — the file-upload contract is identical for a
+ * personal/org caller and an application caller; only the URL/auth differ
+ * (see that file's header comment).
+ *
+ * Returns the form alone: axios sets the multipart content type, boundary
+ * included, so there is no header for the caller to merge in.
  */
-export async function buildScanForm(
-  file: ProbeScanFileInput,
-  options: IScanOptions,
-): Promise<BuiltScanForm> {
-  const filename = options.filename ?? 'file';
-
-  if (isBrowserEnv()) {
-    const form = new FormData();
-    const blob =
-      file instanceof Blob ? file : new Blob([file as BlobPart], { type: options.mimeType });
-    form.append('file', blob, filename);
-    if (options.context) form.append('context', JSON.stringify(options.context));
-    if (options.callbackUrl) form.append('callbackUrl', options.callbackUrl);
-    return { form, headers: {} };
-  }
-
-  const FormDataCtor = await loadNodeFormData();
-  const form = new FormDataCtor();
-  const filePart =
-    Buffer.isBuffer(file) || file instanceof Uint8Array ? Buffer.from(file as Uint8Array) : file;
-  form.append('file', filePart, { filename, contentType: options.mimeType });
+export function buildScanForm(file: ProbeScanFileInput, options: IScanOptions): FormData {
+  const form = new FormData();
+  form.append('file', toScanFilePart(file, options.mimeType), options.filename ?? 'file');
   if (options.context) form.append('context', JSON.stringify(options.context));
   if (options.callbackUrl) form.append('callbackUrl', options.callbackUrl);
-  const headers = typeof form.getHeaders === 'function' ? form.getHeaders() : {};
-  return { form, headers };
+  return form;
 }
 
 /**
@@ -134,11 +146,11 @@ export const scan = async (
   options: IScanOptions = {},
   apiKey?: string,
 ): Promise<IScanResponse> => {
-  const { form, headers } = await buildScanForm(file, options);
+  const form = buildScanForm(file, options);
   return (
     await AbyssToolsCore.axios.post<IScanResponse>('scan', form, {
       params: serializeProbeQuery({ mode: options.mode, organizationId: options.organizationId }),
-      headers: { ...headers, ...authHeader(apiKey) },
+      headers: authHeader(apiKey),
       maxBodyLength: Infinity,
       maxContentLength: Infinity,
     })

package/src/api/probe-scan.application.api.test.ts

@@ -18,4 +18,18 @@ void _scanAsync;
 void _getScan;
 void _listScans;
 
+// The application client takes the SAME file input as the personal one (it
+// reuses buildScanForm verbatim) — abyss-storage, its main caller, hands over
+// `await fs.openAsBlob(path)`. A stream is refused at compile time (#519); see
+// probe-scan.api.test.ts for the full input matrix.
+declare const blob: Blob;
+declare const stream: NodeJS.ReadableStream;
+
+const _fromBlob: Parameters<typeof api.scanSyncApplication>[1] = blob;
+// @ts-expect-error a Readable stream is not an accepted scan input since 2.12.0
+const _fromStream: Parameters<typeof api.scanSyncApplication>[1] = stream;
+
+void _fromBlob;
+void _fromStream;
+
 export {};

package/src/api/probe-scan.application.api.ts

@@ -8,9 +8,9 @@
 // (abyss-storage, external integrations) authenticating with a project API
 // key instead of a personal/org session.
 //
-// Reuses probe-scan.api.ts's `buildScanForm` (same dual-environment
-// multipart handling — browser `FormData`/`Blob` vs Node `Buffer`/stream +
-// lazy-required `form-data`) and every request/response TYPE verbatim
+// Reuses probe-scan.api.ts's `buildScanForm` (the global `FormData` + `Blob`,
+// one code path for the browser and for Node — see that file's header for what
+// a Node caller passes) and every request/response TYPE verbatim
 // (`IScanOptions`, `IListScansQuery`, `IScanResponse`, `IScanSyncResponse`,
 // `IScanAsyncResponse`, `IGetScanResponse`, `IPaginateScanResponse`) — never
 // redefined here. `organizationId` is `Omit`'d from every option/query type
@@ -79,11 +79,11 @@ export const scanApplication = async (
   options: Omit<IScanOptions, 'organizationId'> = {},
   applicationApiKey?: string,
 ): Promise<IScanResponse> => {
-  const { form, headers } = await buildScanForm(file, options);
+  const form = buildScanForm(file, options);
   return (
     await AbyssToolsCore.axios.post<IScanResponse>(`application/${applicationId}/scan`, form, {
       params: serializeProbeQuery({ mode: options.mode }),
-      headers: { ...headers, ...authHeaderApplication(applicationApiKey) },
+      headers: authHeaderApplication(applicationApiKey),
       maxBodyLength: Infinity,
       maxContentLength: Infinity,
     })