@convert-buddy/cloud-client 0.1.0-beta.1

package/LICENSE

@@ -0,0 +1,64 @@
+Convert Buddy Free Distribution License 1.0
+
+Copyright (c) Convert Buddy copyright holders. All rights reserved, except as
+expressly granted below or by an applicable separate license.
+
+1. Scope
+This license applies to first-party material in official Convert Buddy package
+distributions carrying this license (the Software), to the extent its copyright
+holders have authority to license that material on these terms. It does not grant
+access to the private development repository or license undistributed source code.
+Previously licensed material and third-party components are addressed in section 5.
+
+2. Free application use
+You may download, install, copy, run, and use the Software without a license fee
+for personal, educational, nonprofit, internal business, and commercial purposes,
+including commercial applications and hosted services. There are no per-user,
+per-record, or revenue limits under this license.
+
+You may bundle and redistribute the Software as part of your applications, SDK
+integrations, websites, and hosted services, including through application stores
+and CDNs. You may modify distributed JavaScript and other distributed integration
+files as needed for those uses, including compilation, bundling, and minification.
+You may mirror unmodified official packages for dependency installation and
+archiving, including private registries and public package caches.
+
+Keep this license and all applicable copyright and third-party notices with
+redistributed copies, or in an accompanying, accessible legal-notices file or page
+when bundling prevents retaining individual files. Identify your modifications
+without implying that the modified distribution is an official Convert Buddy release.
+
+3. Reserved rights
+This is a proprietary distribution license, not an open-source license. Except
+as allowed above, you may not distribute or sublicense the Software as a standalone
+library, engine, or replacement Convert Buddy package, or rebrand or sell it as
+your own standalone software product. This does not restrict selling your own
+applications or services that integrate the Software as permitted in section 2.
+No rights to unpublished source code, trademarks, or an endorsement are granted.
+Rights not expressly granted are reserved. Statutory rights that cannot lawfully
+be excluded or limited by agreement remain unaffected.
+
+4. Hosted services
+This license does not include Convert Buddy Cloud subscriptions, hosted quotas,
+support commitments, or service-level guarantees. Those services have separate
+terms. Their availability or pricing does not change the free-use grant for a
+copy of the Software obtained under this license.
+
+5. Earlier releases and third-party material
+This license does not revoke, replace, or restrict rights already granted under
+MIT or any other separate license. Earlier Convert Buddy releases and portions
+made available under MIT retain those permissions; see NOTICE and accompanying
+license files. Where that material is included in this distribution, its separate
+license continues to apply to that material. Third-party libraries, models,
+datasets, generated bindings, and other separately licensed material retain their
+own terms. These restrictions apply only to first-party material that is not
+already available to you under a broader applicable license. You must comply with
+the applicable notices and licenses for each included component.
+
+6. No warranty or liability
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND
+NONINFRINGEMENT. TO THE MAXIMUM EXTENT PERMITTED BY LAW, THE COPYRIGHT HOLDERS
+ARE NOT LIABLE FOR ANY CLAIM, DAMAGES, OR OTHER LIABILITY ARISING FROM, OUT OF,
+OR IN CONNECTION WITH THE SOFTWARE OR ITS USE, WHETHER IN CONTRACT, TORT, OR
+OTHERWISE.

package/NOTICE

@@ -0,0 +1,33 @@
+Convert Buddy distribution notices
+
+Earlier Convert Buddy releases and portions licensed under MIT retain their
+original permissions. The free distribution license does not revoke those rights.
+The following is the original repository license text, preserved for that material.
+It is not a grant of MIT rights for new proprietary material.
+
+MIT License
+
+Copyright (c) Convert Buddy contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+Third-party components retain their own licenses and copyright notices. Keep all
+accompanying third-party license files when redistributing. OCR model weights and
+other separately obtained assets require their own license review; this notice
+is not a grant of rights to those assets.

package/README.md

@@ -0,0 +1,13 @@
+# Convert Buddy Cloud client
+
+The browser client supports **Cloud API v2 only**. A publishable key alone cannot authorize a request.
+
+Use `ConvertBuddyWidgetClient` with `apiUrl`, `publishableKey`, and a short-lived `sessionToken` supplied by your authorized backend. The backend mints a session with an environment server key at `POST /v2/server/widget-sessions`. Keep server credentials out of browser code; keep widget tokens in memory.
+
+The client uses generated widget endpoint types, rejects redirects, bounds metadata responses, and validates batch receipts. Delivery retries keep the same body and identity. In-flight or uncertain delivery is not an acknowledgement. Cancellation and completion require an active authorized session.
+
+The React importer exposes `getSession({ sessionId?, signal })`. For reload recovery, the host must verify the requesting user's ownership and renew the same session through the server-only renewal endpoint. Renewal preserves the version, destination, budgets, and receipts, and is limited to the original 24-hour horizon. A new session cannot recover an old import.
+
+V1 exports, key-only calls, and AI-mapping endpoints have been removed. `TargetSchemaV1` and the signed delivery protocol retain their own independent version numbers.
+
+See [the public guide](https://convert-buddy.app/docs/cloud/v2). Package publication and hosted production activation remain separate release gates.

package/dist/chunk-DIBGYTC7.js

@@ -0,0 +1,372 @@
+// src/processing.ts
+function blobFile(blob) {
+  return {
+    size: blob.size,
+    async read(offset, length, signal) {
+      signal?.throwIfAborted();
+      const bytes = new Uint8Array(
+        await blob.slice(offset, offset + length).arrayBuffer()
+      );
+      signal?.throwIfAborted();
+      return bytes;
+    }
+  };
+}
+var ProcessingCloudError = class extends Error {
+  constructor(code, status, requestId) {
+    super(code);
+    this.code = code;
+    this.status = status;
+    this.requestId = requestId;
+    this.name = "ProcessingCloudError";
+  }
+  code;
+  status;
+  requestId;
+};
+var uuid = /^[a-f0-9]{8}-(?:[a-f0-9]{4}-){3}[a-f0-9]{12}$/i;
+function identifier(value) {
+  if (!uuid.test(value)) throw new TypeError("Invalid resource ID");
+  return value;
+}
+function sleep(ms, signal) {
+  return new Promise((resolve, reject) => {
+    const abort = () => {
+      clearTimeout(timer);
+      reject(signal?.reason);
+    };
+    const timer = setTimeout(() => {
+      signal?.removeEventListener("abort", abort);
+      resolve();
+    }, ms);
+    if (signal?.aborted) abort();
+    else signal?.addEventListener("abort", abort, { once: true });
+  });
+}
+async function json(response) {
+  const reader = response.body?.getReader();
+  const chunks = [];
+  let length = 0;
+  try {
+    if (!reader) throw new ProcessingCloudError("INVALID_RESPONSE");
+    for (; ; ) {
+      const next = await reader.read();
+      if (next.done) break;
+      length += next.value.length;
+      if (length > 1024 * 1024)
+        throw new ProcessingCloudError("RESPONSE_LIMIT");
+      chunks.push(next.value);
+    }
+    const bytes = new Uint8Array(length);
+    let offset = 0;
+    for (const chunk of chunks) {
+      bytes.set(chunk, offset);
+      offset += chunk.length;
+    }
+    try {
+      return JSON.parse(new TextDecoder().decode(bytes));
+    } catch {
+      throw new ProcessingCloudError("INVALID_RESPONSE");
+    }
+  } finally {
+    await reader?.cancel().catch(() => void 0);
+    reader?.releaseLock();
+  }
+}
+function validJob(value) {
+  if (!value || !uuid.test(value.jobId) || ![
+    "queued",
+    "running",
+    "succeeded",
+    "failed",
+    "cancelling",
+    "cancelled"
+  ].includes(value.status) || !Array.isArray(value.artifacts) || value.artifacts.some((a) => !uuid.test(a.artifactId)))
+    throw new ProcessingCloudError("INVALID_RESPONSE");
+  return value;
+}
+var ProcessingClient = class {
+  constructor(options) {
+    this.options = options;
+    this.#origin = new URL(options.apiUrl);
+    const u = this.#origin;
+    if (u.username || u.password || u.search || u.hash || u.pathname !== "/" || u.protocol !== "https:" && !(u.protocol === "http:" && ["localhost", "127.0.0.1"].includes(u.hostname)))
+      throw new TypeError(
+        "API URL must be an HTTPS origin or local HTTP origin"
+      );
+    this.#fetch = options.fetch ?? globalThis.fetch.bind(globalThis);
+  }
+  options;
+  #origin;
+  #fetch;
+  async #response(path, init) {
+    const headers = new Headers(await this.options.authorization());
+    new Headers(init.headers).forEach((value, key) => headers.set(key, value));
+    const response = await this.#fetch(
+      new URL(`/v2/processing${path}`, this.#origin),
+      {
+        ...init,
+        headers,
+        credentials: "omit",
+        redirect: "manual",
+        cache: "no-store"
+      }
+    );
+    if (response.type === "opaqueredirect" || response.status >= 300 && response.status < 400 && response.status !== 304) {
+      await response.body?.cancel();
+      throw new ProcessingCloudError("REDIRECT_DENIED", response.status);
+    }
+    return response;
+  }
+  async #metadata(path, method, body, signal, headers) {
+    const requestHeaders = new Headers(headers);
+    requestHeaders.set("content-type", "application/json");
+    const response = await this.#response(path, {
+      method,
+      body: body === void 0 ? void 0 : JSON.stringify(body),
+      signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(3e4)]) : AbortSignal.timeout(3e4),
+      headers: requestHeaders
+    });
+    const value = await json(response);
+    if (!response.ok) {
+      const code = value && typeof value === "object" && "error" in value && value.error && typeof value.error === "object" && "code" in value.error && typeof value.error.code === "string" ? value.error.code : "HTTP_ERROR";
+      throw new ProcessingCloudError(
+        code,
+        response.status,
+        response.headers.get("x-request-id") ?? void 0
+      );
+    }
+    return value;
+  }
+  getUpload(uploadId, after = 0, signal) {
+    return this.#metadata(
+      `/uploads/${identifier(uploadId)}?after=${after}`,
+      "GET",
+      void 0,
+      signal
+    );
+  }
+  createSession(grant, signal) {
+    return this.#metadata("/sessions", "POST", grant, signal);
+  }
+  renewSession(id, grant, signal) {
+    return this.#metadata(
+      `/sessions/${identifier(id)}/renew`,
+      "POST",
+      grant,
+      signal
+    );
+  }
+  revokeSession(id, signal) {
+    return this.#metadata(
+      `/sessions/${identifier(id)}/revoke`,
+      "POST",
+      {},
+      signal
+    );
+  }
+  abortUpload(uploadId, signal) {
+    return this.#metadata(
+      `/uploads/${identifier(uploadId)}`,
+      "DELETE",
+      {},
+      signal
+    );
+  }
+  async upload(source, options) {
+    const file = source instanceof Blob ? blobFile(source) : source;
+    if (!Number.isSafeInteger(file.size) || file.size <= 0)
+      throw new TypeError(
+        "A nonempty replayable file with a known size is required"
+      );
+    const upload = await this.#metadata(
+      "/uploads",
+      "POST",
+      {
+        clientKey: identifier(options.clientKey),
+        operation: options.operation,
+        bytes: file.size,
+        contentType: options.contentType ?? "application/octet-stream"
+      },
+      options.signal
+    );
+    if (!upload || !uuid.test(upload.uploadId) || upload.bytes !== file.size || !Number.isSafeInteger(upload.partBytes) || upload.partBytes < 1 || upload.partBytes > 32 * 1024 ** 2 || upload.partCount !== Math.ceil(file.size / upload.partBytes))
+      throw new ProcessingCloudError("INVALID_RESPONSE");
+    if (upload.jobId && uuid.test(upload.jobId)) return upload;
+    if (upload.status === "deleted" || upload.status === "deleting")
+      throw new ProcessingCloudError("UPLOAD_EXPIRED", 410);
+    let page;
+    for (let part = 1; part <= upload.partCount; part++) {
+      options.signal?.throwIfAborted();
+      if (!page || page.nextPart !== null && part > page.nextPart)
+        page = await this.getUpload(upload.uploadId, part - 1, options.signal);
+      const offset = (part - 1) * upload.partBytes, expected = Math.min(upload.partBytes, file.size - offset);
+      const bytes = new Uint8Array(
+        await file.read(offset, expected, options.signal)
+      );
+      if (bytes.length !== expected)
+        throw new TypeError("File reader returned an incorrect range");
+      const hash = Array.from(
+        new Uint8Array(await crypto.subtle.digest("SHA-256", bytes)),
+        (value) => value.toString(16).padStart(2, "0")
+      ).join("");
+      const existing = page.parts.find((p) => p.partNumber === part);
+      if (existing && (existing.sha256 !== hash || existing.bytes !== bytes.length))
+        throw new ProcessingCloudError("LOCAL_FILE_CHANGED", 409);
+      if (!existing) {
+        if (upload.status !== "uploading")
+          throw new ProcessingCloudError("UPLOAD_CLOSED", 409);
+        for (let attempt = 0; ; attempt++) {
+          try {
+            const response = await this.#response(
+              `/uploads/${upload.uploadId}/parts/${part}`,
+              {
+                method: "PUT",
+                body: bytes,
+                signal: options.signal,
+                headers: {
+                  "content-type": "application/octet-stream",
+                  "X-Part-Sha256": hash
+                }
+              }
+            );
+            const receipt = await json(response);
+            if (!response.ok)
+              throw new ProcessingCloudError(
+                receipt.error?.code ?? "UPLOAD_FAILED",
+                response.status
+              );
+            if (receipt.bytes !== bytes.length || receipt.partNumber !== part)
+              throw new ProcessingCloudError("INVALID_RESPONSE");
+            break;
+          } catch (error) {
+            if (attempt >= 4 || options.signal?.aborted || error instanceof ProcessingCloudError && ![429, 500, 502, 503, 504].includes(error.status ?? 0) && !["PART_IN_FLIGHT", "PART_NOT_ACKNOWLEDGED"].includes(
+              error.code
+            ))
+              throw error;
+            await sleep(Math.min(3e4, 1e3 * 2 ** attempt), options.signal);
+          }
+        }
+      }
+      options.onProgress?.(offset + bytes.length, file.size);
+    }
+    return upload;
+  }
+  async submit(request, idempotencyKey, signal) {
+    if (!/^[A-Za-z0-9._:-]{1,128}$/.test(idempotencyKey))
+      throw new TypeError("Invalid idempotency key");
+    return validJob(
+      await this.#metadata("/jobs", "POST", request, signal, {
+        "Idempotency-Key": idempotencyKey
+      })
+    );
+  }
+  async getJob(id, signal) {
+    return validJob(
+      await this.#metadata(`/jobs/${identifier(id)}`, "GET", void 0, signal)
+    );
+  }
+  async cancel(id, signal) {
+    return validJob(
+      await this.#metadata(
+        `/jobs/${identifier(id)}/cancel`,
+        "POST",
+        {},
+        signal
+      )
+    );
+  }
+  async retry(id, expectedGeneration, signal) {
+    return validJob(
+      await this.#metadata(
+        `/jobs/${identifier(id)}/retry`,
+        "POST",
+        { expectedGeneration },
+        signal
+      )
+    );
+  }
+  async wait(id, options = {}) {
+    let delay = 1e3, etag = null;
+    for (; ; ) {
+      const response = await this.#response(`/jobs/${identifier(id)}`, {
+        method: "GET",
+        signal: options.signal,
+        headers: etag ? { "If-None-Match": etag } : {}
+      });
+      if (response.status === 304) await response.body?.cancel();
+      else {
+        if (!response.ok) {
+          await response.body?.cancel();
+          throw new ProcessingCloudError("STATUS_UNAVAILABLE", response.status);
+        }
+        const job = validJob(await json(response));
+        etag = response.headers.get("etag");
+        options.onProgress?.(job);
+        if (["succeeded", "failed", "cancelled"].includes(job.status))
+          return job;
+      }
+      await sleep(delay + Math.random() * 250, options.signal);
+      delay = Math.min(1e4, delay * 1.5);
+    }
+  }
+  async download(jobId, artifactId, options = {}) {
+    if (options.offset !== void 0 && (!Number.isSafeInteger(options.offset) || options.offset < 0 || !options.etag))
+      throw new TypeError(
+        "Resuming requires a nonnegative offset and the original ETag"
+      );
+    const headers = options.offset !== void 0 ? { Range: `bytes=${options.offset}-`, "If-Range": options.etag } : void 0;
+    const response = await this.#response(
+      `/jobs/${identifier(jobId)}/artifacts/${identifier(artifactId)}`,
+      { method: "GET", headers, signal: options.signal }
+    );
+    if (!response.ok || !response.body) {
+      await response.body?.cancel();
+      throw new ProcessingCloudError("DOWNLOAD_UNAVAILABLE", response.status);
+    }
+    if (options.offset !== void 0 && (response.status !== 206 || response.headers.get("etag") !== options.etag || !response.headers.get("content-range")?.startsWith(`bytes ${options.offset}-`))) {
+      await response.body.cancel();
+      throw new ProcessingCloudError("DOWNLOAD_CHANGED", 409);
+    }
+    return response;
+  }
+};
+function createBrowserProcessingClient(options) {
+  return new ProcessingClient({
+    ...options,
+    async authorization() {
+      const token = await options.sessionToken();
+      if (!/^cb_ps_[a-f0-9]{64}\.[A-Za-z0-9_-]{43}$/.test(token))
+        throw new TypeError("A short-lived processing session is required");
+      return {
+        authorization: `Bearer ${token}`,
+        "X-Processing-Identity": "session"
+      };
+    }
+  });
+}
+function createWidgetProcessingClient(options) {
+  return new ProcessingClient({
+    ...options,
+    async authorization() {
+      const token = await options.sessionToken(), route = /^cb_ws_([a-f0-9]{64})\.[A-Za-z0-9_-]{43}$/.exec(token), key = /^cb_pk_([a-f0-9]{64})\.[A-Za-z0-9_-]{43}$/.exec(
+        options.publishableKey
+      );
+      if (!route || !key || route[1] !== key[1])
+        throw new TypeError("Matching widget credentials are required");
+      return {
+        authorization: `Bearer ${token}`,
+        "X-Processing-Identity": "widget",
+        "X-Convert-Buddy-Key": options.publishableKey
+      };
+    }
+  });
+}
+
+export {
+  blobFile,
+  ProcessingCloudError,
+  ProcessingClient,
+  createBrowserProcessingClient,
+  createWidgetProcessingClient
+};