@beam-network/sdk 0.5.17-dev.1 → 0.5.17-dev.3

package/README.md

@@ -12,7 +12,7 @@ Example:
 import { BeamClient, R2ProviderConfig, S3ProviderConfig } from "@beam-network/sdk";
 
 const beam = new BeamClient({
-  apiKey: "bk_your_key"
+  apiKey: "b1m_your_key"
 });
 
 const transfer = await beam.createTransfer({
@@ -155,9 +155,13 @@ The client signs up to 64 routes concurrently by default and emits 2,048-route l
 
 Callers that need durable recovery accounting can provide `onMultipartGroupReady`. The SDK invokes it after creating a multipart upload and before streaming that group’s signed routes. Its payload contains transfer, source, destination, object-key, upload, size, part-count, and expiry identities only; it never includes credentials, request headers, or signed URLs. A rejected callback aborts the newly created upload and fails preparation closed.
 
+`resumeProviderTransfer` requires the complete saved callback payloads in `multipartGroups`. It validates every transfer/source/destination/object/size/part coordinate, then uses the same route-stream implementation as creation with those upload IDs. Missing, duplicate, or changed identities fail before new provider uploads or route publication. If a process died before recording an upload identity, treat it as uncertain cleanup instead of inventing a replacement. The `onPrepared` callback also runs during resume, before routes are streamed.
+
+Create and resume accept an ownership `signal`. Aborting it stops initial routes, multipart creation, and recovery signing/replay; it does not cancel the transfer or abort a replacement owner's uploads. User cancellation still uses `cancelTransfer` and verified provider cleanup. `prepareProviderSource` accepts the same signal for metadata requests.
+
 The stream ID derives from the transfer, selected flow, and immutable plan identity, and each ordered batch ID includes its route-coordinate checksum. Manual multi-destination attachment requires `delivery_index` on every route. Lifecycle mutations retry transient failures up to three times with the same request identity. A non-recoverable provider setup or route failure raises `BeamProviderTransferError`, whose `errors`, `transferCancelled`, and `multipartCleanupComplete` fields retain the original provider, cancellation, and cleanup outcomes. `waitForTransfer` subscribes to the API-key-owned, at-most-once terminal signal before its first status read and reconciles every signal through authoritative status; subscription failure degrades to the same jittered 15-to-30-second status fallback. Call `close()` when the client is no longer needed; it also closes outstanding terminal waiters.
 
-On completed provider transfers, Runtime may include an `integrity_audit_challenge` in status. Before releasing provider signing state, the TypeScript client signs exact read-only source and final-destination GET ranges and submits `transfer.integrity_audit_grants`; audit submission failures are best-effort and do not change transfer completion.
+During the pre-completion `integrity_check` phase, Runtime may include an `integrity_audit_challenge` in status. The TypeScript client signs exact read-only source and final-destination GET ranges and submits `transfer.integrity_audit_grants`. S3-compatible source and destination grants use the prepared source ETag and Runtime-verified final-object ETag as `If-Match` conditions. Submission failures retry on the next status poll; the transfer completes with a warning if the check cannot finish by its deadline.
 
 Hippius uses canonical non-multipart `signed_url` routes, so its manifest is empty and group-level final HEAD verification is not available from that provider flow.
 

package/dist/client.d.ts

@@ -56,6 +56,7 @@ export declare class BeamClient {
     resumeProviderTransfer(input: ProviderTransferResumeInput): Promise<TransferPrepareResponse>;
     transferStatus(transferId: string): Promise<TransferStatusInfo>;
     distributeTransfer(transferId: string): Promise<DistributeResponse>;
+    private requestTransferCancellation;
     cancelTransfer(transferId: string): Promise<TransferCancelResponse>;
     planTransfer(input: {
         sources: PlanningHttpSource[];
@@ -84,6 +85,7 @@ export declare class BeamClient {
         autoDistribute?: boolean;
     }): Promise<AttachSignedUrlsResponse>;
     prepareProviderTransfer(input: ProviderTransferCreateInput): Promise<TransferPrepareResponse>;
+    private executeProviderTransfer;
     /**
      * Negotiate every Hugging Face destination before the plan exists.
      *

package/dist/client.js

@@ -115,68 +115,15 @@ export class BeamClient {
     }
     async resumeProviderTransfer(input) {
         validateId(input.transferId, "transferId");
-        const expiresIn = input.expiresIn ?? 3600;
-        const requestedSignedUrlFlow = input.signedUrlFlow ?? "signed_url";
-        const retainedRecoveryInput = {
-            ...input,
-            sources: input.sources.map((source) => ({ ...source })),
-            destinations: input.destinations.map((destination) => ({ ...destination }))
-        };
-        const preparedDestinations = retainedRecoveryInput.destinations.map((destination, index) => prepareProviderDestination(destination, { index }));
-        const destinationsById = new Map();
-        preparedDestinations.forEach((preparedDestination, index) => {
-            const destination = retainedRecoveryInput.destinations[index];
-            if (!destination) {
-                throw new Error(`missing provider destination config for prepared destination ${preparedDestination.destination_id}`);
-            }
-            destinationsById.set(preparedDestination.destination_id, destination);
-        });
-        const preparedSources = await Promise.all(retainedRecoveryInput.sources.map((source, index) => prepareProviderSource(source, { index, expiresIn, fetchImpl: this.fetchImpl })));
-        const resumePrepareRequestKey = `transfer:${input.transferId}:prepare:resume:${randomUuid()}`;
-        const prepared = await this.prepareTransferWithRequestKey({
-            transferId: input.transferId,
-            sources: preparedSources,
-            destinations: preparedDestinations,
-            name: input.name,
-            testMode: input.testMode,
-            signedUrlFlow: requestedSignedUrlFlow
-        }, resumePrepareRequestKey);
-        if (!prepared.success)
-            return prepared;
-        if (prepared.transfer_id !== input.transferId) {
-            throw new Error("resumed provider transfer id mismatch");
-        }
-        const sourcesById = new Map();
-        preparedSources.forEach((preparedSource, index) => {
-            const source = retainedRecoveryInput.sources[index];
-            if (!source) {
-                throw new Error(`missing provider source config for prepared source ${preparedSource.source_id}`);
-            }
-            sourcesById.set(preparedSource.source_id, source);
-        });
-        await this.startProviderRouteRecoverySigner({
-            prepared,
-            sourcesById,
-            destinationsById,
-            multipartUploads: new Map(),
-            expiresIn
-        });
-        this.control.registerRecoveryLease({
-            transferId: prepared.transfer_id,
-            planFingerprint: prepared.plan_fingerprint,
-            coordinateChecksum: prepared.coordinate_checksum,
-            replayRoutes: async () => {
-                throw new Error("route replay is unavailable after provider action resume; route signing remains available");
-            },
-            disposeSecrets: () => clearProviderResumeSecrets(retainedRecoveryInput)
-        });
-        return prepared;
+        return this.executeProviderTransfer(input, input);
     }
     async transferStatus(transferId) {
         validateId(transferId, "transferId");
         const status = await this.control.request("transfer.status", { transfer_id: transferId }, { transferId });
-        if (["completed", "failed", "cancelled"].includes(status.status)) {
+        if (status.integrity_audit_challenge) {
             await this.submitIntegrityAuditGrantsIfPresent(status).catch(() => undefined);
+        }
+        if (["completed", "failed", "cancelled"].includes(status.status)) {
             this.control.releaseRecoveryLease(transferId);
             this.stopRecoverySigner(transferId);
         }
@@ -189,12 +136,15 @@ export class BeamClient {
             idempotencyKey: `transfer:${transferId}:distribute`
         });
     }
-    async cancelTransfer(transferId) {
+    requestTransferCancellation(transferId) {
         validateId(transferId, "transferId");
-        const result = await this.control.request("transfer.cancel", { transfer_id: transferId }, {
+        return this.control.request("transfer.cancel", { transfer_id: transferId }, {
             transferId,
             idempotencyKey: `transfer:${transferId}:cancel`
         });
+    }
+    async cancelTransfer(transferId) {
+        const result = await this.requestTransferCancellation(transferId);
         this.control.releaseRecoveryLease(transferId);
         this.stopRecoverySigner(transferId);
         return result;
@@ -314,6 +264,10 @@ export class BeamClient {
         }
     }
     async prepareProviderTransfer(input) {
+        return this.executeProviderTransfer(input);
+    }
+    async executeProviderTransfer(input, resume) {
+        input.signal?.throwIfAborted();
         const expiresIn = input.expiresIn ?? 3600;
         const requestedSignedUrlFlow = input.signedUrlFlow ?? "signed_url";
         const retainedRecoveryInput = {
@@ -335,7 +289,7 @@ export class BeamClient {
             destinationsById.set(preparedDestination.destination_id, destination);
         });
         await input.throwIfCancelled?.();
-        const preparedSources = await Promise.all(retainedRecoveryInput.sources.map((source, index) => prepareProviderSource(source, { index, expiresIn, fetchImpl: this.fetchImpl })));
+        const preparedSources = await Promise.all(retainedRecoveryInput.sources.map((source, index) => prepareProviderSource(source, { index, expiresIn, fetchImpl: this.fetchImpl, signal: input.signal })));
         await input.throwIfCancelled?.();
         const huggingFace = await this.planHuggingFaceUploads({
             sources: retainedRecoveryInput.sources,
@@ -345,16 +299,22 @@ export class BeamClient {
         });
         await input.throwIfCancelled?.();
         await input.onBeforeTransferPrepare?.();
-        const prepared = await this.prepareTransfer({
+        input.signal?.throwIfAborted();
+        const prepareInput = {
             sources: preparedSources,
             destinations: preparedDestinations,
             name: input.name,
             testMode: input.testMode,
             chunkSize: huggingFace.chunkSize ?? input.chunkSize,
             signedUrlFlow: requestedSignedUrlFlow,
-            idempotencyKey: input.idempotencyKey,
-            routeGenerationId: input.routeGenerationId
-        });
+            ...(resume ? { transferId: resume.transferId } : { idempotencyKey: input.idempotencyKey, routeGenerationId: input.routeGenerationId })
+        };
+        const prepared = resume
+            ? await this.prepareTransferWithRequestKey(prepareInput, `transfer:${resume.transferId}:prepare:resume:${randomUuid()}`)
+            : await this.prepareTransfer(prepareInput);
+        if (resume && prepared.transfer_id !== resume.transferId)
+            throw new Error("resumed provider transfer id mismatch");
+        input.signal?.throwIfAborted();
         if (!prepared.success) {
             return prepared;
         }
@@ -372,9 +332,12 @@ export class BeamClient {
             sourcesById.set(preparedSource.source_id, source);
         });
         const multipartUploads = new Map();
+        if (resume)
+            restoreProviderMultipartIdentities(prepared, destinationsById, resume.multipartGroups, multipartUploads);
         const recoveryMultipartUploads = new Map();
         const autoDistribute = input.distribute !== false;
         let initialThrowIfCancelled = input.throwIfCancelled;
+        const assertOwnership = () => input.signal?.throwIfAborted();
         const routeStreamLock = new AsyncMutex();
         const releaseInitialStream = await routeStreamLock.acquire();
         const streamPreparedRoutes = async (routeGenerationId, recoveryReplay) => {
@@ -387,9 +350,12 @@ export class BeamClient {
             let multipartManifestTask = null;
             let multipartGroupWaiters = new Map();
             let foregroundCancelled = false;
-            const throwIfCancelled = recoveryReplay || !initialThrowIfCancelled ? undefined : async (transferId) => {
+            assertOwnership();
+            const throwIfCancelled = async (transferId) => {
                 try {
-                    await initialThrowIfCancelled?.(transferId);
+                    assertOwnership();
+                    if (!recoveryReplay)
+                        await initialThrowIfCancelled?.(transferId);
                 }
                 catch (error) {
                     foregroundCancelled = true;
@@ -424,7 +390,9 @@ export class BeamClient {
                     expiresIn,
                     signedUrlFlow: requestedSignedUrlFlow,
                     concurrency: this.multipartControlConcurrency,
+                    signal: input.signal,
                     onGroupReady: async (state) => {
+                        assertOwnership();
                         recoveryMultipartUploads.set(state.manifest.multipart_group_id, state);
                         validateMultipartGroupManifest([state.manifest], prepared.transfer_id);
                         await input.onMultipartGroupReady?.(multipartGroupIdentity(prepared.transfer_id, state.manifest));
@@ -436,6 +404,7 @@ export class BeamClient {
                 const streamNextCompletedRoute = async () => {
                     const settled = await Promise.race([...pendingRoutes].map((pending) => pending.then((route) => ({ pending, route }))));
                     pendingRoutes.delete(settled.pending);
+                    assertOwnership();
                     await routeStream.addRoute(settled.route);
                     signedInWindow += 1;
                     if (signedInWindow === ROUTE_STREAM_BATCH_ROUTES) {
@@ -493,12 +462,21 @@ export class BeamClient {
                     await streamNextCompletedRoute();
                 const multipartGroupManifest = await multipartManifestTask;
                 validateMultipartGroupManifest(multipartGroupManifest, prepared.transfer_id);
+                assertOwnership();
                 const attached = await routeStream.complete();
                 if (!attached.success) {
                     throw new Error(attached.error ?? attached.message ?? "route stream failed");
                 }
             }
             catch (error) {
+                if (input.signal?.aborted) {
+                    this.stopRecoverySigner(prepared.transfer_id);
+                    this.control.releaseRecoveryLease(prepared.transfer_id);
+                    await Promise.allSettled(pendingRoutes);
+                    if (multipartManifestTask)
+                        await Promise.allSettled([multipartManifestTask]);
+                    throw input.signal.reason;
+                }
                 if (routeStream)
                     await routeStream.abort().catch(() => undefined);
                 await Promise.allSettled(pendingRoutes);
@@ -513,15 +491,22 @@ export class BeamClient {
                         throw new BeamRouteRecoveryPendingError(prepared.transfer_id, error);
                     }
                     else {
-                        this.control.releaseRecoveryLease(prepared.transfer_id);
-                        await cancelAndAbortProviderFailure({
-                            client: this,
-                            transferId: prepared.transfer_id,
-                            cause: error,
-                            uploads: multipartUploads,
-                            abortBeforeCancel: !routeStreamBeginAttempted,
-                            cleanupConcurrency: this.multipartControlConcurrency
-                        });
+                        try {
+                            await cancelAndAbortProviderFailure({
+                                cancelTransfer: () => this.requestTransferCancellation(prepared.transfer_id),
+                                transferId: prepared.transfer_id,
+                                cause: error,
+                                uploads: multipartUploads,
+                                abortBeforeCancel: !routeStreamBeginAttempted,
+                                cleanupConcurrency: this.multipartControlConcurrency
+                            });
+                        }
+                        finally {
+                            // The retained recovery input owns the same destination objects used by
+                            // multipart cleanup. Releasing it earlier scrubs their scoped credentials
+                            // before abortMultipartUpload can clean up already-created uploads.
+                            this.control.releaseRecoveryLease(prepared.transfer_id);
+                        }
                     }
                 }
                 throw error;
@@ -532,8 +517,14 @@ export class BeamClient {
             sourcesById,
             destinationsById,
             multipartUploads: recoveryMultipartUploads,
+            signal: input.signal,
             expiresIn
         });
+        const stopOwnedRecovery = () => {
+            this.stopRecoverySigner(prepared.transfer_id);
+            this.control.releaseRecoveryLease(prepared.transfer_id);
+        };
+        input.signal?.addEventListener("abort", stopOwnedRecovery, { once: true });
         this.control.registerRecoveryLease({
             transferId: prepared.transfer_id,
             planFingerprint: prepared.plan_fingerprint,
@@ -541,10 +532,14 @@ export class BeamClient {
             replayRoutes: async (routeGenerationId) => {
                 await routeStreamLock.run(() => streamPreparedRoutes(routeGenerationId, true));
             },
-            disposeSecrets: () => clearRecoverySecrets(retainedRecoveryInput)
+            disposeSecrets: () => {
+                input.signal?.removeEventListener("abort", stopOwnedRecovery);
+                clearRecoverySecrets(retainedRecoveryInput);
+            }
         });
         try {
             try {
+                assertOwnership();
                 await input.onPrepared?.(prepared);
             }
             catch (error) {
@@ -788,9 +783,11 @@ export class BeamClient {
     async startProviderRouteRecoverySigner(input) {
         this.stopRecoverySigner(input.prepared.transfer_id);
         const stop = await this.control.serveRouteRecoverySigner(input.prepared.transfer_id, async (payload) => {
+            input.signal?.throwIfAborted();
             if (payload.route_generation_id.length === 0)
                 throw new Error("route recovery generation is required");
             const routes = await mapOrderedWithConcurrency(payload.chunks, this.routeSigningConcurrency, async (requested) => {
+                input.signal?.throwIfAborted();
                 if (requested.route_generation_id !== payload.route_generation_id) {
                     throw new Error("route recovery chunk generation mismatch");
                 }
@@ -940,7 +937,13 @@ export class BeamClient {
         }
         const submission = signer(challenge);
         this.integrityAuditSubmissions.set(challenge.audit_id, submission);
-        await submission;
+        try {
+            await submission;
+        }
+        catch (error) {
+            this.integrityAuditSubmissions.delete(challenge.audit_id);
+            throw error;
+        }
     }
     async submitProviderIntegrityAuditGrants(input) {
         if (input.challenge.transfer_id !== input.prepared.transfer_id) {
@@ -963,12 +966,17 @@ export class BeamClient {
             }
             const source = input.sourcesById.get(chunk.source_id);
             const destination = input.destinationsById.get(chunk.destination_id);
+            const plannedSource = input.prepared.plan_descriptor.sources.find((candidate) => candidate.source_id === chunk.source_id);
             if (!source || !destination) {
                 throw new Error("integrity audit provider configuration is unavailable");
             }
+            const sourceEtag = plannedSource?.metadata?.etag;
+            const sourceVersionId = plannedSource?.metadata?.version_id;
             const [sourceGrant, destinationGrant] = await Promise.all([
                 signSourceReadRange({
                     source,
+                    ...(typeof sourceEtag === "string" ? { ifMatch: sourceEtag } : {}),
+                    ...(typeof sourceVersionId === "string" ? { versionId: sourceVersionId } : {}),
                     offset: chunk.source_offset,
                     length: chunk.range_length,
                     expiresIn: input.expiresIn,
@@ -977,6 +985,7 @@ export class BeamClient {
                 signDestinationReadRange({
                     destination,
                     objectKey: chunk.final_object_key,
+                    ...(chunk.final_object_etag ? { ifMatch: chunk.final_object_etag } : {}),
                     offset: chunk.destination_offset,
                     length: chunk.range_length,
                     expiresIn: input.expiresIn,
@@ -1408,9 +1417,9 @@ async function sha256Bytes(value) {
 function hex(bytes) {
     return [...bytes].map((byte) => byte.toString(16).padStart(2, "0")).join("");
 }
-async function cancelTransferAfterProviderFailure(client, transferId, cause) {
+async function cancelTransferAfterProviderFailure(cancelTransfer, transferId, cause) {
     try {
-        const result = await client.cancelTransfer(transferId);
+        const result = await cancelTransfer();
         if (!result.success) {
             throw new Error(result.message ?? `Beam rejected cancellation for ${transferId}`);
         }
@@ -1433,7 +1442,7 @@ async function cancelAndAbortProviderFailure(input) {
         }
     }
     try {
-        await cancelTransferAfterProviderFailure(input.client, input.transferId, input.cause);
+        await cancelTransferAfterProviderFailure(input.cancelTransfer, input.transferId, input.cause);
     }
     catch (error) {
         cancelError = error;
@@ -1505,6 +1514,37 @@ function createMultipartGroupWaiters(prepared, destinationsById) {
     }
     return waiters;
 }
+function restoreProviderMultipartIdentities(prepared, destinations, identities, uploads) {
+    if (!Array.isArray(identities))
+        throw new Error("provider_multipart_recovery_identity_required");
+    const expected = new Map();
+    for (const source of prepared.plan_descriptor.sources) {
+        for (const target of prepared.plan_descriptor.destinations) {
+            const destination = destinations.get(target.destination_id);
+            if (!destination)
+                throw new Error("provider_multipart_recovery_destination_invalid");
+            if (isDirectPutDestination(destination))
+                continue;
+            const objectKey = target.final_object_keys[source.source_id];
+            if (!objectKey)
+                throw new Error("provider_multipart_recovery_object_invalid");
+            const key = multipartGroupStateKey(prepared.transfer_id, target.destination_id, source.source_id, objectKey);
+            expected.set(key, { destination, objectKey, source, destinationId: target.destination_id });
+        }
+    }
+    if (expected.size !== identities.length)
+        throw new Error("provider_multipart_recovery_incomplete");
+    for (const identity of identities) {
+        const group = expected.get(identity.multipartGroupId);
+        if (!group || uploads.has(identity.multipartGroupId) || identity.transferId !== prepared.transfer_id ||
+            identity.sourceId !== group.source.source_id || identity.destinationId !== group.destinationId ||
+            identity.objectKey !== group.objectKey || identity.expectedObjectSize !== group.source.size ||
+            identity.expectedPartCount !== group.source.chunk_count || !identity.uploadId?.trim()) {
+            throw new Error("provider_multipart_recovery_identity_invalid");
+        }
+        uploads.set(identity.multipartGroupId, { destination: group.destination, objectKey: group.objectKey, uploadId: identity.uploadId });
+    }
+}
 async function createMultipartGroupManifest(input) {
     const groups = input.prepared.plan_descriptor.sources.flatMap((source) => input.prepared.plan_descriptor.destinations.map((destination) => ({ source, destination })));
     const results = await mapOrderedWithConcurrency(groups, input.concurrency, async ({ source, destination }) => {
@@ -1523,11 +1563,13 @@ async function createMultipartGroupManifest(input) {
             }
             multipartGroupId = multipartGroupStateKey(input.prepared.transfer_id, destination.destination_id, source.source_id, finalObjectKey);
             const finalObjectMetadata = { "beam-transfer-id": input.prepared.transfer_id };
+            input.signal?.throwIfAborted();
             const retainedUpload = input.multipartUploads.get(multipartGroupId);
             const uploadId = retainedUpload?.uploadId ?? await createMultipartUpload({
                 destination: destinationConfig,
                 objectKey: finalObjectKey,
-                metadata: finalObjectMetadata
+                metadata: finalObjectMetadata,
+                signal: input.signal
             });
             const createdUpload = !retainedUpload;
             if (createdUpload) {
@@ -1574,7 +1616,7 @@ async function createMultipartGroupManifest(input) {
                 return { ok: true, state };
             }
             catch (error) {
-                if (createdUpload) {
+                if (createdUpload && !input.signal?.aborted) {
                     try {
                         await abortMultipartUpload(destinationConfig, finalObjectKey, uploadId);
                         input.multipartUploads.delete(multipartGroupId);
@@ -1858,13 +1900,3 @@ function clearRecoverySecrets(input) {
         }
     }
 }
-function clearProviderResumeSecrets(input) {
-    const secretKeys = new Set(["access_key_id", "secret_access_key", "session_token", "api_token", "token", "password"]);
-    for (const provider of [...input.sources, ...input.destinations]) {
-        const record = provider;
-        for (const key of secretKeys) {
-            if (key in record)
-                record[key] = "";
-        }
-    }
-}

package/dist/models.d.ts

@@ -132,6 +132,7 @@ export interface IntegrityAuditChallengeChunk {
     destination_offset: number;
     range_length: number;
     final_object_key: string;
+    final_object_etag: string | null;
 }
 export interface IntegrityAuditChallenge {
     audit_id: string;
@@ -171,19 +172,10 @@ export interface TransferStatusInfo {
     };
     integrity_audit_challenge?: IntegrityAuditChallenge;
 }
-export interface ProviderTransferResumeInput {
+export interface ProviderTransferResumeInput extends Omit<ProviderTransferCreateInput, "idempotencyKey" | "routeGenerationId"> {
     transferId: string;
-    sources: ProviderSourceConfig[];
-    destinations: ProviderDestinationConfig[];
-    name?: string;
-    /**
-     * Maps to BeamCore test_mode. Must match the original prepared transfer.
-     */
-    testMode?: boolean;
-    expiresIn?: number;
-    signedUrlFlow?: SignedUrlFlow;
-    /** Requested plan chunk size. BeamCore may raise it; the response carries the effective value. */
-    chunkSize?: number;
+    /** Complete durable multipart identities from onMultipartGroupReady; resume never creates replacement uploads. */
+    multipartGroups: ProviderMultipartGroupIdentity[];
 }
 export interface TransferTerminalEvent {
     schema_version: "transfer-client-control/v6";
@@ -290,6 +282,8 @@ export declare const HuggingFaceProviderConfig: Readonly<{
     create(input: HuggingFaceProviderConfigInput): HuggingFaceProviderConfig;
 }>;
 export interface ProviderTransferCreateInput {
+    /** Ownership fence. Aborting stops signing/replay without cancelling a replacement owner. */
+    signal?: AbortSignal;
     sources: ProviderSourceConfig[];
     destinations: ProviderDestinationConfig[];
     name?: string;

package/dist/provider-signing.d.ts

@@ -6,6 +6,7 @@ export declare function prepareProviderSource(source: ProviderSourceConfig, opti
     index?: number;
     expiresIn?: number;
     fetchImpl?: typeof fetch;
+    signal?: AbortSignal;
 }): Promise<PreparedHttpSource>;
 export declare function prepareProviderSourceForPlan(source: ProviderSourceConfig, options?: {
     index?: number;
@@ -90,6 +91,7 @@ export declare function signSourceReadRange(input: {
 export declare function signDestinationReadRange(input: {
     destination: ProviderDestinationConfig;
     objectKey: string;
+    ifMatch?: string;
     offset: number;
     length: number;
     expiresIn: number;

package/dist/provider-signing.js

@@ -10,10 +10,15 @@ export function expiresAtIso(expiresIn) {
 export async function prepareProviderSource(source, options = {}) {
     const index = options.index ?? 0;
     const expiresIn = options.expiresIn ?? 3600;
+    options.signal?.throwIfAborted();
+    const baseFetch = options.fetchImpl ?? globalThis.fetch;
+    const fetchImpl = options.signal
+        ? (input, init) => baseFetch(input, { ...init, signal: AbortSignal.any([options.signal, ...(init?.signal ? [init.signal] : [])]) })
+        : baseFetch;
     if (isS3CompatibleProvider(source)) {
         const endpoint = s3CompatibleEndpoint(source);
         const client = createS3CompatibleClient(source, endpoint);
-        const head = await client.send(new HeadObjectCommand({ Bucket: source.bucket, Key: source.key }));
+        const head = await client.send(new HeadObjectCommand({ Bucket: source.bucket, Key: source.key }), { abortSignal: options.signal });
         const getUrl = await getSignedUrl(client, new GetObjectCommand({ Bucket: source.bucket, Key: source.key }), { expiresIn });
         return {
             source_id: source.id ?? `src_${index}`,
@@ -33,7 +38,6 @@ export async function prepareProviderSource(source, options = {}) {
         };
     }
     if (isHippiusProvider(source)) {
-        const fetchImpl = options.fetchImpl ?? globalThis.fetch;
         const baseUrl = source.base_url ?? "https://api.hippius.com";
         const size = await hippiusObjectSize(fetchImpl, baseUrl, source.api_token, source.bucket, source.key);
         const url = await hippiusPresign(fetchImpl, baseUrl, source.api_token, source.bucket, source.key, "get", expiresIn);
@@ -49,7 +53,7 @@ export async function prepareProviderSource(source, options = {}) {
         };
     }
     if (isHuggingFaceProvider(source)) {
-        const metadata = await huggingFaceFileMetadata(options.fetchImpl ?? globalThis.fetch, source);
+        const metadata = await huggingFaceFileMetadata(fetchImpl, source);
         return {
             source_id: source.id ?? `src_${index}`,
             type: "http",
@@ -333,11 +337,14 @@ export async function signDestinationReadRange(input) {
             url: await getSignedUrl(client, new GetObjectCommand({
                 Bucket: input.destination.bucket,
                 Key: input.objectKey,
-                Range: range
+                Range: range,
+                IfMatch: input.ifMatch
             }), { expiresIn: input.expiresIn }),
-            headers: { Range: range }
+            headers: { Range: range, ...(input.ifMatch ? { "If-Match": input.ifMatch } : {}) }
         };
     }
+    if (input.ifMatch)
+        throw new Error("conditional destination ranges require S3-compatible storage");
     if (isHippiusProvider(input.destination)) {
         return {
             url: await hippiusPresign(input.fetchImpl ?? globalThis.fetch, input.destination.base_url ?? "https://api.hippius.com", input.destination.api_token, input.destination.bucket, input.objectKey, "get", input.expiresIn),

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@beam-network/sdk",
-    "version": "0.5.17-dev.1",
+    "version": "0.5.17-dev.3",
     "description": "TypeScript SDK for BEAM transfer creation and management.",
     "type": "module",
     "license": "MIT",