@beam-network/sdk 0.7.0 → 0.8.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/README.md CHANGED
@@ -39,8 +39,7 @@ const transfer = await beam.createTransfer({
39
39
  secret_access_key: "aws-secret-key"
40
40
  })
41
41
  ],
42
- name: "r2-to-s3-report",
43
- testMode: true
42
+ name: "r2-to-s3-report"
44
43
  });
45
44
 
46
45
  const status = await beam.waitForTransfer(transfer.transfer_id);
@@ -49,7 +48,32 @@ await beam.close();
49
48
  ```
50
49
 
51
50
  The main `createTransfer` API is provider-aware and strictly typed for S3, R2, S3-compatible, Hippius, and Hugging Face configs.
52
- Use `testMode: true` to create a BeamCore test-mode transfer.
51
+
52
+ ## Storage Credentials
53
+
54
+ Source and destination credentials must not be restricted to specific IP addresses or networks (for example Cloudflare R2 API-token client IP filtering, S3 bucket policies with `aws:SourceIp`, or VPC-only endpoints). Beam moves data through many workers on different networks, so restricted credentials make the transfer fail.
55
+
56
+ ## Failed Transfers
57
+
58
+ `waitForTransfer` rejects a failed transfer with `BeamTransferFailedError`, whose `errorMessage` is BeamCore's `error_message` verbatim. When the storage refused Beam's requests, the error is the `BeamStorageAccessError` subclass, with `code` set to `source_access_denied` or `destination_access_denied`:
59
+
60
+ ```ts
61
+ import { BeamStorageAccessError, BeamTransferFailedError } from "@beam-network/sdk";
62
+
63
+ try {
64
+ await beam.waitForTransfer(transfer.transfer_id);
65
+ } catch (error) {
66
+ if (error instanceof BeamStorageAccessError) {
67
+ // For example: "destination_access_denied: The destination storage refused Beam's requests (403 AccessDenied). ..."
68
+ console.error(error.code, error.errorMessage);
69
+ } else if (error instanceof BeamTransferFailedError) {
70
+ console.error(error.errorMessage);
71
+ }
72
+ throw error;
73
+ }
74
+ ```
75
+
76
+ Callers that poll `transferStatus` themselves can pass a failed status to `transferFailedError(transferId, status.error_message)` to get the same classification.
53
77
 
54
78
  ## S3-Compatible Providers
55
79
 
package/dist/client.d.ts CHANGED
@@ -19,6 +19,33 @@ export declare class BeamProviderTransferError extends AggregateError {
19
19
  cleanupError?: unknown;
20
20
  });
21
21
  }
22
+ /** Failure codes BeamCore reports when source or destination storage refuses Beam's requests. */
23
+ export type BeamStorageAccessErrorCode = "source_access_denied" | "destination_access_denied";
24
+ /** A transfer that BeamCore reported as failed. */
25
+ export declare class BeamTransferFailedError extends Error {
26
+ readonly transferId: string;
27
+ /** The transfer's `error_message` from BeamCore, verbatim; null when BeamCore sent none. */
28
+ readonly errorMessage: string | null;
29
+ constructor(transferId: string, errorMessage: string | null);
30
+ }
31
+ /**
32
+ * The source or destination storage refused Beam's requests (`source_access_denied` or
33
+ * `destination_access_denied`). `errorMessage` carries BeamCore's explanation verbatim.
34
+ *
35
+ * Check that the credentials allow the operation on this bucket and path and are not restricted
36
+ * to specific IP addresses or networks (for example Cloudflare R2 API-token client IP filtering,
37
+ * S3 bucket policies with `aws:SourceIp`, or VPC-only endpoints). Beam moves data through many
38
+ * workers on different networks, so restricted credentials make the transfer fail.
39
+ */
40
+ export declare class BeamStorageAccessError extends BeamTransferFailedError {
41
+ readonly code: BeamStorageAccessErrorCode;
42
+ constructor(transferId: string, errorMessage: string, code: BeamStorageAccessErrorCode);
43
+ }
44
+ /**
45
+ * Builds the error for a failed transfer status: a {@link BeamStorageAccessError} when the
46
+ * server message starts with a storage access code, otherwise a {@link BeamTransferFailedError}.
47
+ */
48
+ export declare function transferFailedError(transferId: string, errorMessage: string | null): BeamTransferFailedError;
22
49
  export declare class BeamApiError extends Error {
23
50
  readonly status: number;
24
51
  readonly body: string;
@@ -29,7 +56,6 @@ type TransferPrepareInput = {
29
56
  sources: PreparedHttpSource[];
30
57
  destinations: PreparedDestination[];
31
58
  name?: string;
32
- testMode?: boolean;
33
59
  urlsExpiresAt?: string;
34
60
  signedUrlFlow?: SignedUrlFlow;
35
61
  idempotencyKey?: string;
@@ -54,22 +80,62 @@ export declare class BeamClient {
54
80
  constructor(options?: BeamClientOptions);
55
81
  close(): Promise<void>;
56
82
  openTransferTerminalWaiter(transferId: string): Promise<TransferTerminalSignalWaiter>;
83
+ /**
84
+ * Creates a transfer from raw source and destination configs (`transfer.create`).
85
+ *
86
+ * Source and destination credentials must not be restricted to specific IP addresses or
87
+ * networks (for example Cloudflare R2 API-token client IP filtering, S3 bucket policies with
88
+ * `aws:SourceIp`, or VPC-only endpoints). Beam moves data through many workers on different
89
+ * networks, so restricted credentials make the transfer fail.
90
+ */
57
91
  createRawTransfer(input: RawTransferCreateInput): Promise<TransferCreateResponse>;
92
+ /**
93
+ * Signs provider sources and destinations, prepares the transfer, streams its signed routes
94
+ * and, unless `distribute` is false, starts it. Alias of {@link prepareProviderTransfer}.
95
+ *
96
+ * Source and destination credentials must not be restricted to specific IP addresses or
97
+ * networks (for example Cloudflare R2 API-token client IP filtering, S3 bucket policies with
98
+ * `aws:SourceIp`, or VPC-only endpoints). Beam moves data through many workers on different
99
+ * networks, so restricted credentials make the transfer fail.
100
+ */
58
101
  createTransfer(input: ProviderTransferCreateInput): Promise<TransferPrepareResponse>;
102
+ /**
103
+ * Takes over a prepared provider transfer in a new process, reusing its multipart uploads.
104
+ *
105
+ * Source and destination credentials must not be restricted to specific IP addresses or
106
+ * networks (for example Cloudflare R2 API-token client IP filtering, S3 bucket policies with
107
+ * `aws:SourceIp`, or VPC-only endpoints). Beam moves data through many workers on different
108
+ * networks, so restricted credentials make the transfer fail.
109
+ */
59
110
  resumeProviderTransfer(input: ProviderTransferResumeInput): Promise<TransferPrepareResponse>;
60
111
  transferStatus(transferId: string): Promise<TransferStatusInfo>;
61
112
  distributeTransfer(transferId: string): Promise<DistributeResponse>;
62
113
  private requestTransferCancellation;
63
114
  cancelTransfer(transferId: string): Promise<TransferCancelResponse>;
115
+ /**
116
+ * Asks BeamCore for the compact plan a transfer would use without creating it (`transfer.plan`).
117
+ *
118
+ * Source and destination credentials must not be restricted to specific IP addresses or
119
+ * networks (for example Cloudflare R2 API-token client IP filtering, S3 bucket policies with
120
+ * `aws:SourceIp`, or VPC-only endpoints). Beam moves data through many workers on different
121
+ * networks, so restricted credentials make the transfer fail.
122
+ */
64
123
  planTransfer(input: {
65
124
  sources: PlanningHttpSource[];
66
125
  destinations: PreparedDestination[];
67
126
  name?: string;
68
- testMode?: boolean;
69
127
  urlsExpiresAt?: string;
70
128
  signedUrlFlow?: SignedUrlFlow;
71
129
  chunkSize?: number;
72
130
  }): Promise<TransferPlanResponse>;
131
+ /**
132
+ * Prepares a transfer from already-signed HTTP sources and destinations (`transfer.prepare`).
133
+ *
134
+ * Source and destination credentials must not be restricted to specific IP addresses or
135
+ * networks (for example Cloudflare R2 API-token client IP filtering, S3 bucket policies with
136
+ * `aws:SourceIp`, or VPC-only endpoints). Beam moves data through many workers on different
137
+ * networks, so restricted credentials make the transfer fail.
138
+ */
73
139
  prepareTransfer(input: TransferPrepareInput): Promise<TransferPrepareResponse>;
74
140
  private prepareTransferWithRequestKey;
75
141
  attachSignedUrls(transferId: string, input: {
@@ -87,6 +153,15 @@ export declare class BeamClient {
87
153
  urlsExpiresAt?: string;
88
154
  autoDistribute?: boolean;
89
155
  }): Promise<AttachSignedUrlsResponse>;
156
+ /**
157
+ * Signs provider sources and destinations, prepares the transfer, streams its signed routes
158
+ * and, unless `distribute` is false, starts it.
159
+ *
160
+ * Source and destination credentials must not be restricted to specific IP addresses or
161
+ * networks (for example Cloudflare R2 API-token client IP filtering, S3 bucket policies with
162
+ * `aws:SourceIp`, or VPC-only endpoints). Beam moves data through many workers on different
163
+ * networks, so restricted credentials make the transfer fail.
164
+ */
90
165
  prepareProviderTransfer(input: ProviderTransferCreateInput): Promise<TransferPrepareResponse>;
91
166
  private executeProviderTransfer;
92
167
  /**
@@ -113,7 +188,21 @@ export declare class BeamClient {
113
188
  /** Stop a transfer's recovery and integrity signers; with `owner`, only if that owner installed them. */
114
189
  private stopRecoverySigner;
115
190
  private stopAllRecoverySigners;
191
+ /**
192
+ * Creates a raw transfer and distributes it.
193
+ *
194
+ * Source and destination credentials must not be restricted to specific IP addresses or
195
+ * networks (for example Cloudflare R2 API-token client IP filtering, S3 bucket policies with
196
+ * `aws:SourceIp`, or VPC-only endpoints). Beam moves data through many workers on different
197
+ * networks, so restricted credentials make the transfer fail.
198
+ */
116
199
  createAndDistribute(input: RawTransferCreateInput): Promise<TransferCreateResponse>;
200
+ /**
201
+ * Waits until the transfer completes. A failed transfer rejects with a
202
+ * {@link BeamTransferFailedError} carrying BeamCore's `error_message` verbatim, or with its
203
+ * {@link BeamStorageAccessError} subclass when the source or destination storage refused
204
+ * Beam's requests (`source_access_denied`, `destination_access_denied`).
205
+ */
117
206
  waitForTransfer(transferId: string, options?: {
118
207
  timeoutMs?: number;
119
208
  pollIntervalMs?: number;
package/dist/client.js CHANGED
@@ -36,6 +36,54 @@ export class BeamProviderTransferError extends AggregateError {
36
36
  this.cause = input.cause;
37
37
  }
38
38
  }
39
+ const STORAGE_ACCESS_ERROR_CODES = [
40
+ "source_access_denied",
41
+ "destination_access_denied"
42
+ ];
43
+ /** A transfer that BeamCore reported as failed. */
44
+ export class BeamTransferFailedError extends Error {
45
+ transferId;
46
+ /** The transfer's `error_message` from BeamCore, verbatim; null when BeamCore sent none. */
47
+ errorMessage;
48
+ constructor(transferId, errorMessage) {
49
+ super(`Transfer ${transferId} failed: ${errorMessage ?? "unknown error"}`);
50
+ this.name = "BeamTransferFailedError";
51
+ this.transferId = transferId;
52
+ this.errorMessage = errorMessage;
53
+ }
54
+ }
55
+ /**
56
+ * The source or destination storage refused Beam's requests (`source_access_denied` or
57
+ * `destination_access_denied`). `errorMessage` carries BeamCore's explanation verbatim.
58
+ *
59
+ * Check that the credentials allow the operation on this bucket and path and are not restricted
60
+ * to specific IP addresses or networks (for example Cloudflare R2 API-token client IP filtering,
61
+ * S3 bucket policies with `aws:SourceIp`, or VPC-only endpoints). Beam moves data through many
62
+ * workers on different networks, so restricted credentials make the transfer fail.
63
+ */
64
+ export class BeamStorageAccessError extends BeamTransferFailedError {
65
+ code;
66
+ constructor(transferId, errorMessage, code) {
67
+ super(transferId, errorMessage);
68
+ this.name = "BeamStorageAccessError";
69
+ this.code = code;
70
+ }
71
+ }
72
+ /**
73
+ * Builds the error for a failed transfer status: a {@link BeamStorageAccessError} when the
74
+ * server message starts with a storage access code, otherwise a {@link BeamTransferFailedError}.
75
+ */
76
+ export function transferFailedError(transferId, errorMessage) {
77
+ const code = errorMessage === null ? undefined : storageAccessErrorCode(errorMessage);
78
+ return code && errorMessage !== null
79
+ ? new BeamStorageAccessError(transferId, errorMessage, code)
80
+ : new BeamTransferFailedError(transferId, errorMessage);
81
+ }
82
+ function storageAccessErrorCode(errorMessage) {
83
+ const separator = errorMessage.indexOf(":");
84
+ const prefix = (separator === -1 ? errorMessage : errorMessage.slice(0, separator)).trim();
85
+ return STORAGE_ACCESS_ERROR_CODES.find((code) => code === prefix);
86
+ }
39
87
  export class BeamApiError extends Error {
40
88
  status;
41
89
  body;
@@ -94,6 +142,14 @@ export class BeamClient {
94
142
  validateId(transferId, "transferId");
95
143
  return this.control.openTerminalSignalWaiter(transferId);
96
144
  }
145
+ /**
146
+ * Creates a transfer from raw source and destination configs (`transfer.create`).
147
+ *
148
+ * Source and destination credentials must not be restricted to specific IP addresses or
149
+ * networks (for example Cloudflare R2 API-token client IP filtering, S3 bucket policies with
150
+ * `aws:SourceIp`, or VPC-only endpoints). Beam moves data through many workers on different
151
+ * networks, so restricted credentials make the transfer fail.
152
+ */
97
153
  async createRawTransfer(input) {
98
154
  const transferId = await transferIdForIdempotencyKey(input.idempotencyKey);
99
155
  const body = compact({
@@ -106,7 +162,6 @@ export class BeamClient {
106
162
  merkle_root: input.merkleRoot,
107
163
  chunk_hashes: input.chunkHashes,
108
164
  callbacks: input.callbacks,
109
- test_mode: input.testMode || undefined,
110
165
  progressive_mode: input.progressiveMode || undefined,
111
166
  signed_url_flow: input.signedUrlFlow ?? "signed_url"
112
167
  });
@@ -115,9 +170,26 @@ export class BeamClient {
115
170
  idempotencyKey: `transfer:${transferId}:create`
116
171
  });
117
172
  }
173
+ /**
174
+ * Signs provider sources and destinations, prepares the transfer, streams its signed routes
175
+ * and, unless `distribute` is false, starts it. Alias of {@link prepareProviderTransfer}.
176
+ *
177
+ * Source and destination credentials must not be restricted to specific IP addresses or
178
+ * networks (for example Cloudflare R2 API-token client IP filtering, S3 bucket policies with
179
+ * `aws:SourceIp`, or VPC-only endpoints). Beam moves data through many workers on different
180
+ * networks, so restricted credentials make the transfer fail.
181
+ */
118
182
  createTransfer(input) {
119
183
  return this.prepareProviderTransfer(input);
120
184
  }
185
+ /**
186
+ * Takes over a prepared provider transfer in a new process, reusing its multipart uploads.
187
+ *
188
+ * Source and destination credentials must not be restricted to specific IP addresses or
189
+ * networks (for example Cloudflare R2 API-token client IP filtering, S3 bucket policies with
190
+ * `aws:SourceIp`, or VPC-only endpoints). Beam moves data through many workers on different
191
+ * networks, so restricted credentials make the transfer fail.
192
+ */
121
193
  async resumeProviderTransfer(input) {
122
194
  validateId(input.transferId, "transferId");
123
195
  return this.executeProviderTransfer(input, input);
@@ -159,12 +231,19 @@ export class BeamClient {
159
231
  this.stopRecoverySigner(transferId);
160
232
  return result;
161
233
  }
234
+ /**
235
+ * Asks BeamCore for the compact plan a transfer would use without creating it (`transfer.plan`).
236
+ *
237
+ * Source and destination credentials must not be restricted to specific IP addresses or
238
+ * networks (for example Cloudflare R2 API-token client IP filtering, S3 bucket policies with
239
+ * `aws:SourceIp`, or VPC-only endpoints). Beam moves data through many workers on different
240
+ * networks, so restricted credentials make the transfer fail.
241
+ */
162
242
  async planTransfer(input) {
163
243
  const result = await this.control.request("transfer.plan", compact({
164
244
  sources: input.sources,
165
245
  destinations: input.destinations,
166
246
  name: input.name,
167
- test_mode: input.testMode || undefined,
168
247
  chunk_size: input.chunkSize,
169
248
  urls_expires_at: input.urlsExpiresAt,
170
249
  signed_url_flow: input.signedUrlFlow ?? "signed_url"
@@ -173,6 +252,14 @@ export class BeamClient {
173
252
  validateCompactTransferPlan(result.plan_descriptor, result.signed_url_flow);
174
253
  return result;
175
254
  }
255
+ /**
256
+ * Prepares a transfer from already-signed HTTP sources and destinations (`transfer.prepare`).
257
+ *
258
+ * Source and destination credentials must not be restricted to specific IP addresses or
259
+ * networks (for example Cloudflare R2 API-token client IP filtering, S3 bucket policies with
260
+ * `aws:SourceIp`, or VPC-only endpoints). Beam moves data through many workers on different
261
+ * networks, so restricted credentials make the transfer fail.
262
+ */
176
263
  prepareTransfer(input) {
177
264
  return this.prepareTransferWithRequestKey(input);
178
265
  }
@@ -187,7 +274,6 @@ export class BeamClient {
187
274
  sources: input.sources,
188
275
  destinations: input.destinations,
189
276
  name: input.name,
190
- test_mode: input.testMode || undefined,
191
277
  chunk_size: input.chunkSize,
192
278
  urls_expires_at: input.urlsExpiresAt,
193
279
  signed_url_flow: input.signedUrlFlow ?? "signed_url"
@@ -274,6 +360,15 @@ export class BeamClient {
274
360
  releaseInitialStream();
275
361
  }
276
362
  }
363
+ /**
364
+ * Signs provider sources and destinations, prepares the transfer, streams its signed routes
365
+ * and, unless `distribute` is false, starts it.
366
+ *
367
+ * Source and destination credentials must not be restricted to specific IP addresses or
368
+ * networks (for example Cloudflare R2 API-token client IP filtering, S3 bucket policies with
369
+ * `aws:SourceIp`, or VPC-only endpoints). Beam moves data through many workers on different
370
+ * networks, so restricted credentials make the transfer fail.
371
+ */
277
372
  async prepareProviderTransfer(input) {
278
373
  return this.executeProviderTransfer(input);
279
374
  }
@@ -316,7 +411,6 @@ export class BeamClient {
316
411
  sources: preparedSources,
317
412
  destinations: preparedDestinations,
318
413
  name: input.name,
319
- testMode: input.testMode,
320
414
  chunkSize: huggingFace.chunkSize ?? input.chunkSize,
321
415
  signedUrlFlow: requestedSignedUrlFlow,
322
416
  ...(resume ? { transferId: resume.transferId } : { idempotencyKey: input.idempotencyKey, routeGenerationId: input.routeGenerationId })
@@ -1135,6 +1229,14 @@ export class BeamClient {
1135
1229
  for (const transferId of [...this.recoverySigners.keys()])
1136
1230
  this.stopRecoverySigner(transferId);
1137
1231
  }
1232
+ /**
1233
+ * Creates a raw transfer and distributes it.
1234
+ *
1235
+ * Source and destination credentials must not be restricted to specific IP addresses or
1236
+ * networks (for example Cloudflare R2 API-token client IP filtering, S3 bucket policies with
1237
+ * `aws:SourceIp`, or VPC-only endpoints). Beam moves data through many workers on different
1238
+ * networks, so restricted credentials make the transfer fail.
1239
+ */
1138
1240
  async createAndDistribute(input) {
1139
1241
  const transfer = await this.createRawTransfer(input);
1140
1242
  if (transfer.success) {
@@ -1142,6 +1244,12 @@ export class BeamClient {
1142
1244
  }
1143
1245
  return transfer;
1144
1246
  }
1247
+ /**
1248
+ * Waits until the transfer completes. A failed transfer rejects with a
1249
+ * {@link BeamTransferFailedError} carrying BeamCore's `error_message` verbatim, or with its
1250
+ * {@link BeamStorageAccessError} subclass when the source or destination storage refused
1251
+ * Beam's requests (`source_access_denied`, `destination_access_denied`).
1252
+ */
1145
1253
  async waitForTransfer(transferId, options = {}) {
1146
1254
  const timeoutMs = options.timeoutMs ?? 300_000;
1147
1255
  const pollIntervalMs = options.pollIntervalMs ?? 15_000;
@@ -1174,7 +1282,7 @@ export class BeamClient {
1174
1282
  return status;
1175
1283
  }
1176
1284
  if (status.status === "failed") {
1177
- throw new Error(`Transfer failed: ${status.error_message ?? "unknown error"}`);
1285
+ throw transferFailedError(transferId, status.error_message);
1178
1286
  }
1179
1287
  if (status.status === "cancelled") {
1180
1288
  throw new Error("Transfer cancelled");
package/dist/models.d.ts CHANGED
@@ -34,6 +34,14 @@ export interface BeamClientOptions {
34
34
  multipartControlConcurrency?: number;
35
35
  fetch?: typeof fetch;
36
36
  }
37
+ /**
38
+ * Raw transfer source.
39
+ *
40
+ * Source credentials must not be restricted to specific IP addresses or networks (for example
41
+ * Cloudflare R2 API-token client IP filtering, S3 bucket policies with `aws:SourceIp`, or
42
+ * VPC-only endpoints). Beam moves data through many workers on different networks, so
43
+ * restricted credentials make the transfer fail.
44
+ */
37
45
  export interface SourceConfig {
38
46
  type: string;
39
47
  bucket?: string;
@@ -47,6 +55,14 @@ export interface SourceConfig {
47
55
  url?: string;
48
56
  headers?: Record<string, string>;
49
57
  }
58
+ /**
59
+ * Raw transfer destination.
60
+ *
61
+ * Destination credentials must not be restricted to specific IP addresses or networks (for
62
+ * example Cloudflare R2 API-token client IP filtering, S3 bucket policies with `aws:SourceIp`, or
63
+ * VPC-only endpoints). Beam moves data through many workers on different networks, so
64
+ * restricted credentials make the transfer fail.
65
+ */
50
66
  export interface DestConfig {
51
67
  type: string;
52
68
  bucket?: string;
@@ -73,7 +89,6 @@ export interface TransferCreateRequest {
73
89
  merkle_root?: string;
74
90
  chunk_hashes?: string[];
75
91
  callbacks?: CallbackConfig[];
76
- test_mode?: boolean;
77
92
  progressive_mode?: boolean;
78
93
  signed_url_flow: SignedUrlFlow;
79
94
  }
@@ -86,10 +101,6 @@ export interface RawTransferCreateInput {
86
101
  merkleRoot?: string;
87
102
  chunkHashes?: string[];
88
103
  callbacks?: CallbackConfig[];
89
- /**
90
- * Maps to BeamCore test_mode.
91
- */
92
- testMode?: boolean;
93
104
  progressiveMode?: boolean;
94
105
  signedUrlFlow?: SignedUrlFlow;
95
106
  idempotencyKey?: string;
@@ -254,6 +265,14 @@ export interface TransferTerminalSignalWaiter {
254
265
  wait(timeoutMs: number): Promise<TransferTerminalEvent | null>;
255
266
  close(): Promise<void>;
256
267
  }
268
+ /**
269
+ * Amazon S3 source or destination.
270
+ *
271
+ * Credentials must not be restricted to specific IP addresses or networks (for example
272
+ * Cloudflare R2 API-token client IP filtering, S3 bucket policies with `aws:SourceIp`, or
273
+ * VPC-only endpoints). Beam moves data through many workers on different networks, so
274
+ * restricted credentials make the transfer fail.
275
+ */
257
276
  export interface S3ProviderConfig {
258
277
  /** Physical storage location; independent of the signing region. */
259
278
  storage_location?: string;
@@ -267,6 +286,14 @@ export interface S3ProviderConfig {
267
286
  session_token?: string;
268
287
  endpoint_url?: string;
269
288
  }
289
+ /**
290
+ * Cloudflare R2 source or destination.
291
+ *
292
+ * Credentials must not be restricted to specific IP addresses or networks (for example
293
+ * Cloudflare R2 API-token client IP filtering, S3 bucket policies with `aws:SourceIp`, or
294
+ * VPC-only endpoints). Beam moves data through many workers on different networks, so
295
+ * restricted credentials make the transfer fail.
296
+ */
270
297
  export interface R2ProviderConfig {
271
298
  /** Physical storage location; independent of the signing region. */
272
299
  storage_location?: string;
@@ -279,6 +306,14 @@ export interface R2ProviderConfig {
279
306
  account_id?: string;
280
307
  endpoint_url?: string;
281
308
  }
309
+ /**
310
+ * S3-compatible source or destination (MinIO, Wasabi, Backblaze B2, DigitalOcean Spaces and others).
311
+ *
312
+ * Credentials must not be restricted to specific IP addresses or networks (for example
313
+ * Cloudflare R2 API-token client IP filtering, S3 bucket policies with `aws:SourceIp`, or
314
+ * VPC-only endpoints). Beam moves data through many workers on different networks, so
315
+ * restricted credentials make the transfer fail.
316
+ */
282
317
  export interface S3CompatibleProviderConfig {
283
318
  /** Physical storage location; independent of the signing region. */
284
319
  storage_location?: string;
@@ -295,6 +330,14 @@ export interface S3CompatibleProviderConfig {
295
330
  force_path_style?: boolean;
296
331
  account_id?: string;
297
332
  }
333
+ /**
334
+ * Hippius source or destination.
335
+ *
336
+ * Credentials must not be restricted to specific IP addresses or networks (for example
337
+ * Cloudflare R2 API-token client IP filtering, S3 bucket policies with `aws:SourceIp`, or
338
+ * VPC-only endpoints). Beam moves data through many workers on different networks, so
339
+ * restricted credentials make the transfer fail.
340
+ */
298
341
  export interface HippiusProviderConfig {
299
342
  /** Physical storage location; independent of the signing region. */
300
343
  storage_location?: string;
@@ -306,6 +349,14 @@ export interface HippiusProviderConfig {
306
349
  base_url?: string;
307
350
  }
308
351
  export type HuggingFaceRepoType = "model" | "dataset" | "space" | "kernel" | "bucket";
352
+ /**
353
+ * Hugging Face Hub source or destination.
354
+ *
355
+ * The token and any credentials must not be restricted to specific IP addresses or networks (for example
356
+ * Cloudflare R2 API-token client IP filtering, S3 bucket policies with `aws:SourceIp`, or
357
+ * VPC-only endpoints). Beam moves data through many workers on different networks, so
358
+ * restricted credentials make the transfer fail.
359
+ */
309
360
  export interface HuggingFaceProviderConfig {
310
361
  /** Physical storage location; independent of the signing region. */
311
362
  storage_location?: string;
@@ -360,13 +411,19 @@ export declare const HuggingFaceProviderConfig: Readonly<{
360
411
  export interface ProviderTransferCreateInput {
361
412
  /** Ownership fence. Aborting stops signing/replay without cancelling a replacement owner. */
362
413
  signal?: AbortSignal;
414
+ /**
415
+ * Storage to read from. Source credentials must not be restricted to specific IP addresses or
416
+ * networks (for example Cloudflare R2 API-token client IP filtering, S3 bucket policies with
417
+ * `aws:SourceIp`, or VPC-only endpoints). Beam moves data through many workers on different
418
+ * networks, so restricted credentials make the transfer fail.
419
+ */
363
420
  sources: ProviderSourceConfig[];
364
- destinations: ProviderDestinationConfig[];
365
- name?: string;
366
421
  /**
367
- * Maps to BeamCore test_mode.
422
+ * Storage to write to. Destination credentials must not be restricted to specific IP addresses
423
+ * or networks, for the same reason as `sources`.
368
424
  */
369
- testMode?: boolean;
425
+ destinations: ProviderDestinationConfig[];
426
+ name?: string;
370
427
  expiresIn?: number;
371
428
  /**
372
429
  * Defaults to true. Set to false to only prepare and stream signed routes without distribution.
@@ -400,6 +457,11 @@ export interface ProviderMultipartGroupIdentity {
400
457
  expectedPartCount: number;
401
458
  expiresAt: string;
402
459
  }
460
+ /**
461
+ * HTTP source for planning and preparing. Its URL and headers must work from any network: Beam
462
+ * moves data through many workers on different networks, so IP- or network-restricted URLs make
463
+ * the transfer fail.
464
+ */
403
465
  export interface PlanningHttpSource {
404
466
  source_id: string;
405
467
  type: "http";
@@ -511,7 +573,6 @@ export interface TransferPrepareResponse {
511
573
  success: boolean;
512
574
  transfer_id: string;
513
575
  transfer_key?: string;
514
- test_mode?: boolean;
515
576
  chunk_size?: number;
516
577
  total_size?: number;
517
578
  total_sources?: number;
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@beam-network/sdk",
3
- "version": "0.7.0",
3
+ "version": "0.8.0",
4
4
  "description": "TypeScript SDK for BEAM transfer creation and management.",
5
5
  "type": "module",
6
6
  "license": "MIT",