@devultur/self-host 0.0.0-stage → 1.0.0

package/dist/index.d.ts

@@ -0,0 +1,530 @@
+import * as hono_types from 'hono/types';
+import { Context, MiddlewareHandler, Hono } from 'hono';
+import { Visibility, SecurityPolicy, CacheRule, TranscodeSettings, TranscodeOutputKeys, TranscodeOutputUrls } from '@devultur/core';
+import { T as TranscodeContainerNamespace } from './cloudflare-kZ7J3LQ2.js';
+
+/** What an upload token allows (claims `res`, `visibility`, `max_bytes`, `max_files`, `file_ttl`). */
+interface UploadGrant {
+    /** Token's `jti`: best-effort counter for `maxFiles`. */
+    tokenId: string;
+    /** Prefix relative to the storage prefix, without visibility, with a trailing `/` (`asset/exports/inst-1/`). */
+    pathPrefix: string;
+    visibility: Visibility;
+    maxBytes?: number;
+    maxFiles?: number;
+    /** TTL (seconds) of each file uploaded with the token. */
+    fileExpiresIn?: number;
+}
+
+/** A download link as the Worker hands it to plugins. */
+interface DownloadLinkInfo {
+    /** Storage prefix the link was issued under. */
+    storagePrefix: string;
+    /** Key of the file (`{visibility}/…`), relative to the storage prefix. */
+    key: string;
+    /** Plugin context of the request that issued the link, as it was stored. */
+    context?: PluginContext;
+}
+/** The transcode job a runner callback belongs to (from the job ticket the Worker signed at launch). */
+interface TranscodeJob {
+    /** Unique per launch: a re-encode of the same video is another run. */
+    runId: string;
+    videoId: string;
+    /** Launch time (epoch ms, second precision). */
+    startedAt: number;
+    /** Plugin context of the request that launched the job, as it was. */
+    context?: PluginContext;
+}
+interface RouteResult {
+    /** `GET /v1/download/{id}` redeemed this link (one use spent). */
+    redeemedLink?: DownloadLinkInfo;
+    /** `transcode.complete` deleted the video's original (`config.transcode.deleteOriginalOnSuccess`). */
+    originalDeleted?: boolean;
+    /** The transcode callback carried a valid job ticket: the job it belongs to. */
+    transcodeJob?: TranscodeJob;
+}
+type AnyContext$3 = Context<any>;
+declare function getRouteResult(context: AnyContext$3): RouteResult;
+
+interface WorkerEnv {
+    MEDIA_BUCKET: R2Bucket;
+    KEYS_BUCKET?: R2Bucket;
+    MEDIA_KV: KVNamespace;
+    DELIVERY_SIGN_SECRET: string;
+    TRANSCODE_RUNNER?: string;
+    FLY_API_TOKEN?: string;
+    FLY_APP_NAME?: string;
+    FLY_TRANSCODE_IMAGE?: string;
+    FLY_REGION?: string;
+    FLY_TRANSCODE_CPU_KIND?: string;
+    FLY_TRANSCODE_CPUS?: string;
+    FLY_TRANSCODE_MEMORY_MB?: string;
+    TRANSCODE_CONTAINER?: TranscodeContainerNamespace;
+    CF_TRANSCODE_INSTANCE?: string;
+    TRANSCODE_RUNNER_URL?: string;
+    TRANSCODE_RUNNER_SECRET?: string;
+    TRANSCODE_RUNNER_CPUS?: string;
+    GROQ_API_KEY: string;
+    MISTRAL_API_KEY: string;
+    WORKER_AUTH_SECRET?: string;
+    TRANSCODE_WEBHOOK_SECRET?: string;
+    DOWNLOAD_LINKS?: DurableObjectNamespace;
+    IMAGE_TRANSFORMS?: string;
+    IMAGE_TRANSFORMS_MAX_MEGAPIXELS?: string;
+}
+declare const MaxResolution: {
+    readonly P720: "720p";
+    readonly P1080: "1080p";
+    readonly P4K: "4k";
+};
+type MaxResolution = (typeof MaxResolution)[keyof typeof MaxResolution];
+interface UploadTypeRule {
+    maxSizeBytes?: number;
+    accept?: string[];
+    visibility?: Visibility;
+}
+interface UploadRules {
+    video?: UploadTypeRule;
+    image?: UploadTypeRule;
+    file?: UploadTypeRule;
+}
+/** R2 storage classes the worker uses for the video raw. */
+type RawStorageClass = "Standard" | "InfrequentAccess";
+interface WorkerVariables {
+    /** Request state (storage prefix, rules, access, credentials, plugin context): see request-state.ts. */
+    requestState?: RequestState;
+    /** Hooks of the plugins (plugin-hooks.ts). */
+    pluginHooks?: PluginHooks;
+    /** What the route did (route-result.ts). */
+    routeResult?: RouteResult;
+}
+type WorkerApp = {
+    Bindings: WorkerEnv;
+    Variables: WorkerVariables;
+};
+
+/** Any JSON value. */
+type Json = string | number | boolean | null | Json[] | {
+    [key: string]: Json;
+};
+/**
+ * Data that plugins attach to a request. The Worker stores it with the uploads and download links the request creates
+ * and in the transcode job ticket, and hands it back when they are used (`getRouteResult`, the pending upload): a
+ * credential-less request has nothing else to tell who started it. The Worker never reads it.
+ *
+ * Augment the interface to type your plugin's keys:
+ *
+ * ```ts
+ * declare module "@devultur/self-host" {
+ *   interface PluginContext { appId?: string }
+ * }
+ * ```
+ */
+interface PluginContext {
+    [key: string]: Json | undefined;
+}
+interface TranscodeConfig {
+    /** Named presets and the default one, used when a request names no preset. */
+    presets?: TranscodeSettings;
+    /** Highest rung of the adaptive ladder. Unset: a `hls-*` alias derives it from its name, a spec asks up to 4k. */
+    maxResolution?: MaxResolution;
+    /** Delete the original once a transcode completes (never after a failure). Unset: the original is kept. */
+    deleteOriginalOnSuccess?: boolean;
+    /** Base of the output URLs in the client webhook. Unset: the origin of the transcode request. */
+    outputBaseUrl?: string;
+}
+/** Rules the routes enforce. */
+interface WorkerConfig {
+    /** Default security policy (session/IP binding, encryption at rest). Unset: secure default. */
+    security?: SecurityPolicy;
+    /** Per media type: size limit, accepted content types and default visibility. */
+    uploadRules?: UploadRules;
+    /** Allowed caption locales. Unset or empty: any. */
+    captionsLocales?: string[];
+    /** `Cache-Control` per prefix of the `asset/` namespace (the longest one wins). */
+    cacheRules?: CacheRule[];
+    /** R2 storage class of an uploaded video original. Unset: Standard. Fixed at upload time. */
+    originalStorageClass?: RawStorageClass;
+    /**
+     * Longest lifetime, in seconds, of a file uploaded in the request: it is the default TTL and a shorter `expiresIn`
+     * (or upload token `fileExpiresIn`) still wins. For a demo or scratch Worker whose uploads clean themselves up.
+     * Unset: files only expire when the upload asks for it.
+     */
+    maxFileLifetimeSeconds?: number;
+    /**
+     * R2 custom metadata added to every object the request uploads (also on the later credential-less PUT), for example
+     * which app or user uploaded it. Keys the Worker owns (integrity `sha256*`, `expiresAt`, `security`, `enc`,
+     * `derivedFrom`) are dropped from it.
+     */
+    uploadMetadata?: Record<string, string>;
+    transcode?: TranscodeConfig;
+}
+/** What an auth plugin established about the request's credential. */
+interface RequestAccess {
+    /**
+     * The request's credential was verified. Without it, an upload URL (`/v1/upload/<key>`) only acts on the upload
+     * that an authenticated `POST /v1/upload` created (the `?u=` id of that URL), never on a key of its own.
+     */
+    authenticated?: boolean;
+    /**
+     * The request is a trusted read (the backend with its own credential, already authorized): private media is
+     * served without a viewer token. Never set it from a `?token=` query: its credential would end up in URLs.
+     */
+    trustedRead?: boolean;
+    /** The credential is an upload token: `POST /v1/upload` only creates files under its prefix. */
+    uploadGrant?: UploadGrant;
+}
+interface RequestState {
+    /** Prefix of every storage key the request touches (`""` = the bucket root). */
+    storagePrefix: string;
+    config?: WorkerConfig;
+    access?: RequestAccess;
+    /**
+     * Bearer the transcode runner uploads its outputs with. `workerSecretAuth()` sets the Worker secret; an auth
+     * plugin of your own can hand the runner a narrower credential.
+     */
+    runnerCredential?: string;
+    /**
+     * Bearer sent to the request's `callbackUrl` (client webhook of a transcode or captions job). Unset: the runner
+     * credential; `""`: no `Authorization` header.
+     */
+    webhookCredential?: string;
+    context?: PluginContext;
+}
+interface RequestStatePatch extends Partial<Omit<RequestState, "config" | "access" | "context">> {
+    config?: Omit<WorkerConfig, "transcode"> & {
+        transcode?: TranscodeConfig;
+    };
+    access?: RequestAccess;
+    context?: PluginContext;
+}
+type AnyContext$2 = Context<any>;
+/** State of the request. Without one set, the bucket root and no rules. */
+declare function getRequestState(context: AnyContext$2): RequestState;
+/** Did an auth plugin verify the request's credential (`access.authenticated`)? */
+declare function isAuthenticated(context: AnyContext$2): boolean;
+/**
+ * Narrows the state of the request. Top-level fields replace; `config` (and `config.transcode`), `access` and
+ * `context` merge field by field.
+ */
+declare function updateRequestState(context: AnyContext$2, patch: RequestStatePatch): RequestState;
+
+/** What is being issued: a viewer token, an upload token, a download link or the transcode runner's token. */
+type CredentialKind = "viewer" | "upload" | "download-link" | "service";
+interface CredentialRequest {
+    kind: CredentialKind;
+    /** Scopes the credential will carry. */
+    scopes: string[];
+    /** What it is bound to: the upload prefix (`asset/…/`), the download link's key or the original being transcoded. */
+    path?: string;
+    /** Expiry the request asked for (epoch ms). */
+    expiresAt: number;
+}
+type CredentialDecision = 
+/** Refuse: `response` is returned as is. */
+{
+    allow: false;
+    response: Response;
+}
+/**
+ * Issue it. `expiresAt` (epoch ms) caps the expiry: the Worker uses the earliest of it and the requested one.
+ * `claims` are added to a token's payload (never over the claims the Worker sets itself).
+ */
+ | {
+    allow: true;
+    expiresAt?: number;
+    claims?: Record<string, Json>;
+};
+type AllowedCredential = Extract<CredentialDecision, {
+    allow: true;
+}>;
+type AnyContext$1 = Context<any>;
+type IssueCredentialHook = (context: AnyContext$1, request: CredentialRequest) => CredentialDecision | Promise<CredentialDecision>;
+/** A response refuses the redemption (returned as is, and the use is NOT spent); `null` lets it go on. */
+type BeforeLinkRedeemHook = (context: AnyContext$1, link: DownloadLinkInfo) => Response | null | Promise<Response | null>;
+/** The hooks of every plugin, in plugin order. */
+interface PluginHooks {
+    issueCredential: IssueCredentialHook[];
+    beforeLinkRedeem: BeforeLinkRedeemHook[];
+}
+
+type AnyMiddleware = MiddlewareHandler<any>;
+type AnyApp = Hono<any>;
+/**
+ * Where a plugin's middleware runs. Every request goes through all plugins' `beforeAuth`, then their `auth`, then
+ * their `afterAuth` (each phase in plugin order), and then the route.
+ */
+interface PluginMiddleware {
+    /** Before authentication: request normalization, routing by host, endpoints a plugin answers on its own. */
+    beforeAuth?: AnyMiddleware[];
+    /** Authentication: who is calling, and what the request may touch (`updateRequestState`). */
+    auth?: AnyMiddleware[];
+    /** After authentication: authorization, limits, per-request rules, and work after `await next()` (logs, metrics). */
+    afterAuth?: AnyMiddleware[];
+}
+interface PluginRoute {
+    /** Mount path (`/v1/reports`). Mounted after the Worker's own routes, behind every plugin's middleware. */
+    path: string;
+    app: AnyApp;
+}
+interface WorkerPlugin {
+    /** Unique name, for errors and logs. */
+    name: string;
+    middleware?: PluginMiddleware;
+    routes?: PluginRoute[];
+    /** Before the Worker issues a viewer token, an upload token, a download link or the runner's service token. */
+    issueCredential?: IssueCredentialHook;
+    /** Before `GET /v1/download/{id}` spends a use of a link that still has one. */
+    beforeLinkRedeem?: BeforeLinkRedeemHook;
+}
+interface ComposedPlugins {
+    middleware: AnyMiddleware[];
+    routes: PluginRoute[];
+    hooks: PluginHooks;
+}
+
+interface DownloadLinkRecord {
+    /** Full storage key (with the storage prefix). */
+    storageKey: string;
+    /** Virtual key (`{visibility}/…`). */
+    key: string;
+    /** Epoch ms. */
+    expiresAt: number;
+    maxUses: number;
+    uses: number;
+    filename?: string;
+    /** Storage prefix the link was issued under. */
+    storagePrefix: string;
+    /** Plugin context of the request that issued the link (opaque to the Worker). */
+    context?: PluginContext;
+}
+/** Storage surface of a DO that the class uses (the Workers one satisfies it; tests pass a Map). */
+interface DownloadLinkStorage {
+    get<T>(key: string): Promise<T | undefined>;
+    put<T>(key: string, value: T): Promise<void>;
+    deleteAll(): Promise<void>;
+    setAlarm(scheduledTime: number): Promise<void>;
+}
+/** Surface of the `DurableObjectState` the class uses. */
+interface DownloadLinkState {
+    storage: DownloadLinkStorage;
+    blockConcurrencyWhile<T>(callback: () => Promise<T>): Promise<T>;
+}
+declare class DownloadLink {
+    private readonly state;
+    private readonly storage;
+    constructor(state: DownloadLinkState);
+    fetch(request: Request): Promise<Response>;
+    private create;
+    /** The record if it still has a use left, or the response explaining why not: 404 if it never existed (or the alarm already
+     *  cleared it), 410 if it expired or was already used. */
+    private usableRecord;
+    private peek;
+    /** Consumes ONE use. */
+    private redeem;
+    alarm(): Promise<void>;
+}
+
+declare function storageKey(context: Context<WorkerApp>, key: string): string;
+/**
+ * True when a verified token payload is the Worker's own service token (by its `typ` claim, never its `sub`): a read
+ * the Worker makes for itself, not a viewer's.
+ */
+declare function isServiceToken(payload: Record<string, unknown> | null | undefined): boolean;
+/**
+ * Verifies a viewer token (HMAC-SHA256 with `DELIVERY_SIGN_SECRET`) for the private delivery gate:
+ * checks signature and expiration. Returns the payload if valid, `null` if not. Pure with respect to the
+ * worker (it receives the secret) so it can be unit-tested. It does NOT check fingerprint/ip — that's the delivery
+ * gate's job (`bindingMismatch` in routes/media.ts) after reading the object; here it's only "is this token authentic and current?".
+ */
+declare function verifyViewerToken(token: string | undefined, secret: string): Promise<Record<string, unknown> | null>;
+declare function hashKey(key: string): Promise<string>;
+declare function deletePrefix(bucket: R2Bucket, prefix: string): Promise<number>;
+
+interface ImageTransformParams {
+    width?: number;
+    height?: number;
+    fit?: string;
+    format?: string;
+    quality?: number;
+}
+declare function parseTransformParams(url: URL): ImageTransformParams | null;
+
+/** Everything derived from an original (variants, mezzanine, and their L4 keys) lives under this prefix. */
+declare function variantPrefix(fullKey: string): string;
+declare function isVariantKey(key: string): boolean;
+
+/** The original that Cloudflare re-requests: its URL (without query) and the storage prefix it belongs to. */
+interface ImageOrigin {
+    url: URL;
+    scope: string;
+}
+/** `Authorization` for Cloudflare's subrequest: `Bearer dvo.<scope>.<signature of scope + URL>`. */
+declare function imageOriginAuthorization(secret: string, origin: ImageOrigin): Promise<string>;
+/**
+ * If the request is Cloudflare Images' subrequest asking for an original, the signed storage prefix; otherwise null.
+ * `Via` alone is NOT enough (a client can send it): it has to carry the signature for THIS URL.
+ */
+declare function readImageOriginScope(request: Request, secret: string | undefined): Promise<string | null>;
+/** Is this Cloudflare Images' signed subrequest? It's not delivery to the client: it isn't gated or counted. */
+declare function isImageOriginRequest(request: Request, secret: string | undefined): Promise<boolean>;
+
+interface CredentialPolicyOptions {
+    /** Longest lifetime, in seconds, per kind of credential. A longer request is shortened to it, not refused. */
+    maxTtlSeconds?: Partial<Record<CredentialKind, number>>;
+}
+declare function credentialPolicy(options?: CredentialPolicyOptions): WorkerPlugin;
+
+declare function downloadLinks(): WorkerPlugin;
+
+/** Applies `config` to every request. Put it first: plugins after it narrow it, field by field. */
+declare function staticConfig(config: WorkerConfig): WorkerPlugin;
+
+declare const WorkerAuthErrorCode: {
+    readonly SECRET_MISSING: "worker_auth_secret_missing";
+    readonly UNAUTHORIZED: "unauthorized";
+};
+/**
+ * Routes that never need a credential. Pure.
+ * - `/health` and the playback metrics endpoint: public by design.
+ * - Media delivery: public media is tokenless; the route itself requires a viewer token for private media.
+ * - Download links: the opaque link id is the credential.
+ * - Webhooks: they check their own shared secret.
+ */
+declare function isOpenRoute(method: string, path: string): boolean;
+/**
+ * An upload URL (`/v1/upload/<key>`): the URL that `POST /v1/upload` returned is the credential. Without an
+ * authenticated request it only acts on that upload (see `RequestAccess.authenticated`). Pure.
+ */
+declare function isUploadUrl(path: string): boolean;
+/** The default authentication: `Authorization: Bearer <WORKER_AUTH_SECRET>` on control routes. */
+declare function workerSecretAuth(): WorkerPlugin;
+
+/**
+ * The plugins `createWorker()` uses when given none: `config` for every request, the worker-secret auth, the default
+ * credential policy and download links. Spread them to add your own, or keep only the ones you want.
+ */
+declare function defaultPlugins(config?: WorkerConfig): WorkerPlugin[];
+
+declare const MAX_ASSET_LIST_LIMIT = 1000;
+interface AssetListEntry {
+    key: string;
+    path: string;
+    size: number;
+    etag: string;
+    sha256: string | null;
+    sha256Verified: boolean;
+    uploaded: string;
+    cacheControl: string | null;
+    visibility: Visibility;
+}
+
+/** The unit's tag: a hash (Cloudflare's tags are case-insensitive but paths aren't). */
+declare function edgeCacheTag(storagePrefix: string, virtualKey: string): Promise<string>;
+
+/** `Cache-Control` served: the one stored on the object (for private, no shared caches) or the one for a generated id. */
+declare function servedCacheControl(stored: string | undefined, isPrivate: boolean): string;
+
+/** Has the object expired (TTL)? From then on we respond 410 even if the sweeper hasn't deleted it yet. Pure. */
+declare function isObjectExpired(customMetadata: Record<string, string> | undefined, now?: number): boolean;
+
+declare const UPLOAD_TOKEN_TYPE = "upload";
+/** Short-lived: it's a JWT (an auth layer can also reject it if the credential that issued it is no longer valid). */
+declare const MAX_UPLOAD_TOKEN_TTL_SECONDS: number;
+/** Grant of the claims of a verified upload token. `null` if it isn't a valid upload token. Pure. */
+declare function uploadGrantFromClaims(payload: Record<string, unknown>): UploadGrant | null;
+
+/** `customMetadata` keys on the R2 object (strings). */
+declare const ObjectMeta: {
+    readonly SHA256: "sha256";
+    /** `"true"` = the worker hashed the bytes; `"false"` = sha256 declared by the client (multipart). */
+    readonly SHA256_VERIFIED: "sha256Verified";
+    /** Epoch ms. From then on the gate responds 410 (and an external sweeper may delete it). */
+    readonly EXPIRES_AT: "expiresAt";
+};
+
+/** The upload an upload URL (`/v1/upload/<key>?u=<id>`) points to, as plugins see it. */
+interface PendingUploadInfo {
+    /** Key of the file (`{visibility}/…`), relative to the storage prefix. */
+    key: string;
+    /** Full storage key, with the storage prefix of the request that created it. */
+    storageKey: string;
+    contentType: string;
+    filename?: string;
+    /** A multipart upload was started on it. */
+    isMultipart: boolean;
+    /** The file expires at this time (epoch ms). */
+    expiresAt?: number;
+    /** An `asset/` upload that replaces the file at its path. */
+    isOverwrite: boolean;
+    /** Plugin context of the `POST /v1/upload` that created it. */
+    context?: PluginContext;
+}
+type AnyContext = Context<any>;
+/**
+ * The upload this request's upload URL points to, for a plugin that runs before the route (the route deletes it once
+ * the file is complete). `undefined` = not an upload URL, or one without an id; `null` = an id that does not resolve
+ * (malformed, unknown, expired or issued for another key).
+ */
+declare function getPendingUpload(context: AnyContext): Promise<PendingUploadInfo | null | undefined>;
+/**
+ * Cancels the upload behind an upload URL that `POST /v1/upload` returned: the URL stops working. For a plugin that
+ * rejects the created upload after the route ran.
+ */
+declare function cancelPendingUpload(context: AnyContext, uploadUrl: string): Promise<void>;
+
+/** Code of every refusal of a valid token: which claim failed is logged, never told to the caller. */
+declare const TOKEN_REJECTED_CODE = "token_rejected";
+
+/**
+ * Scopes of a verified token, from its `scope` claim. `undefined` = the token carries no `scope` (not limited by it);
+ * a claim that is not a string carries no scope at all. Pure.
+ */
+declare function readTokenScopes(payload: Record<string, unknown>): string[] | undefined;
+
+interface EncodeMetrics {
+    /** Wall-clock seconds of the ladder's FFmpeg (no download, upload or thumbnail). */
+    encodeSeconds: number;
+    /** vCPUs of the runner (0 = unknown). */
+    cpus: number;
+    /** Duration of the source, in seconds. */
+    durationSeconds: number;
+    /** Highest rendition generated (`360p`…`4k`). */
+    topRung?: string;
+    runner?: string;
+    /** Per-title encoding: complexity 0 (simple) to 1 (complex). Absent = no probe (short clip, opt-out). */
+    complexity?: number;
+    /** Wall-clock seconds of the complexity probe. */
+    probeSeconds?: number;
+    /** CRF and maxrate chosen per rung (rungs at CRF; an MP4 with the spec's bitrate doesn't appear). */
+    encodeParams?: EncodeParam[];
+}
+interface EncodeParam {
+    rung: string;
+    crf: number;
+    maxrateKbps: number;
+}
+/** The encode measurement of a `transcode.complete`. Null if the event doesn't carry it or it's invalid. */
+declare function parseEncodeMetrics(event: unknown): EncodeMetrics | null;
+/** vCPU-seconds per minute of video (assumes the CPU saturated during the encode). Null without vCPUs or duration. */
+declare function vcpuSecondsPerVideoMinute(metrics: EncodeMetrics): number | null;
+/** Structured log line (grep `[transcode-metrics]`) to measure vCPU-s/min without extra infrastructure. */
+declare function logEncodeMetrics(videoId: string, metrics: EncodeMetrics): void;
+
+type Raw = Record<string, unknown>;
+/** Storyboard key from a `transcode.complete` (any plan), or null if there was no storyboard. */
+declare function readStoryboardKey(event: unknown): string | null;
+/** Outputs (keys) from a `transcode.complete`, or null if the event doesn't report them (`hls-*` alias, old script). */
+declare function readTranscodeOutputKeys(event: unknown): TranscodeOutputKeys | null;
+/** Outputs in their public form (URLs built from `baseUrl`), or null if the event doesn't report them. */
+declare function readTranscodeOutputs(event: unknown, baseUrl: string): TranscodeOutputUrls | null;
+/** Event with the outputs in their public form (renditions with `url`, `posterUrls`). No outputs → unchanged. */
+declare function withOutputUrls(event: Raw, baseUrl: string): Raw;
+
+interface CreateWorkerOptions {
+    /** Plugins, composed in order (see plugin.ts). Omitted: `defaultPlugins()`. */
+    plugins?: WorkerPlugin[];
+}
+declare function createWorker(options?: CreateWorkerOptions): Hono<WorkerApp, hono_types.BlankSchema, "/">;
+
+export { type AllowedCredential, type AssetListEntry, type BeforeLinkRedeemHook, type ComposedPlugins, type CreateWorkerOptions, type CredentialDecision, type CredentialKind, type CredentialPolicyOptions, type CredentialRequest, DownloadLink, type DownloadLinkInfo, type DownloadLinkRecord, type DownloadLinkStorage, type EncodeMetrics, type ImageTransformParams, type IssueCredentialHook, type Json, MAX_ASSET_LIST_LIMIT, MAX_UPLOAD_TOKEN_TTL_SECONDS, MaxResolution, ObjectMeta, type PendingUploadInfo, type PluginContext, type PluginMiddleware, type PluginRoute, type RawStorageClass, type RequestAccess, type RequestState, type RequestStatePatch, type RouteResult, TOKEN_REJECTED_CODE, type TranscodeConfig, type TranscodeJob, UPLOAD_TOKEN_TYPE, type UploadGrant, type UploadRules, type UploadTypeRule, type WorkerApp, WorkerAuthErrorCode, type WorkerConfig, type WorkerEnv, type WorkerPlugin, type WorkerVariables, cancelPendingUpload, createWorker, credentialPolicy, defaultPlugins, deletePrefix, downloadLinks, edgeCacheTag, getPendingUpload, getRequestState, getRouteResult, hashKey, imageOriginAuthorization, isAuthenticated, isImageOriginRequest, isObjectExpired, isOpenRoute, isServiceToken, isUploadUrl, isVariantKey, logEncodeMetrics, parseEncodeMetrics, parseTransformParams, readImageOriginScope, readStoryboardKey, readTokenScopes, readTranscodeOutputKeys, readTranscodeOutputs, servedCacheControl, staticConfig, storageKey, updateRequestState, uploadGrantFromClaims, variantPrefix, vcpuSecondsPerVideoMinute, verifyViewerToken, withOutputUrls, workerSecretAuth };