@ibanzajoe/uploader 0.2.0 → 1.1.0

package/README.md

@@ -64,6 +64,57 @@ Inline drop zone that can be embedded in a form.
 
 Headless hook — returns `{ open, uploading, files, errors }`.
 
+## Theming
+
+The picker is styled entirely from `--uploader-*` CSS custom properties, so a
+third-party app can restyle it to match its own brand. There are two ways to do
+it — pick whichever fits your stack.
+
+### 1. The `theme` prop (scoped, per-instance)
+
+Pass your design tokens as a plain object. They are applied as inline CSS
+variables on that component's root, so the override is **scoped to that
+instance** — two pickers on one page can carry different themes and nothing
+leaks to the rest of your app. Only the keys you set change; everything else
+falls back to the shipped defaults.
+
+```tsx
+import { PickerOverlay } from '@uploader/react'
+import '@uploader/react/styles.css'
+
+<PickerOverlay
+  apikey="pk_…"
+  open={open}
+  onClose={() => setOpen(false)}
+  theme={{
+    accent: '#4f46e5',          // your brand color
+    accentSoft: '#eef2ff',      // tinted hover/icon background
+    accentRing: 'rgba(79,70,229,.28)',
+    radius: '12px',
+    font: "'Inter', sans-serif",
+  }}
+/>
+```
+
+`DropPane` takes the same `theme` prop. See the `UploaderTheme` type for the
+full token list (accent set, surfaces, text, borders, semantic colors, shadows,
+radius, font, transition). A `themeToVars(theme)` helper is also exported if you
+want to apply the same variables to your own wrapper element.
+
+### 2. CSS variables (global / page-level)
+
+Override the variables in your own stylesheet to theme every instance at once:
+
+```css
+:root {
+  --uploader-accent: #4f46e5;
+  --uploader-accent-soft: #eef2ff;
+  --uploader-radius: 12px;
+}
+```
+
+Dark mode is handled automatically when any ancestor has `data-theme="dark"`.
+
 ## Camera capture
 
 Both `<PickerOverlay>` and `<DropPane>` can capture a photo straight from the

package/dist/{chunk-EM6NZZSU.js → chunk-QRUZUI5L.js}

@@ -30,6 +30,8 @@ function planChunks(file, chunkSize = DEFAULT_CHUNK_SIZE) {
 // src/core/client.ts
 var MAX_RETRIES = 3;
 var RETRY_BASE_MS = 200;
+var MAX_DIRECT_PUT_BYTES = 5 * 1024 * 1024 * 1024;
+var SHA256_MAX_BYTES = 64 * 1024 * 1024;
 function sleep(ms, signal) {
   return new Promise((resolve, reject) => {
     if (signal?.aborted) {
@@ -91,14 +93,153 @@ async function fetchWithRetry(url, init, signal, maxRetries = MAX_RETRIES) {
   }
   throw lastErr;
 }
+async function sha256Hex(blob) {
+  try {
+    const c = globalThis.crypto;
+    if (!c?.subtle || blob.size > SHA256_MAX_BYTES) return void 0;
+    const digest = await c.subtle.digest("SHA-256", await blob.arrayBuffer());
+    return Array.from(new Uint8Array(digest)).map((b) => b.toString(16).padStart(2, "0")).join("");
+  } catch {
+    return void 0;
+  }
+}
+function xhrPut(url, body, opts) {
+  return new Promise((resolve, reject) => {
+    if (opts.signal?.aborted) {
+      reject(new UploaderError("ABORTED", "Upload aborted"));
+      return;
+    }
+    const xhr = new XMLHttpRequest();
+    xhr.open("PUT", url);
+    xhr.setRequestHeader("Content-Type", opts.contentType);
+    if (opts.onProgress) {
+      xhr.upload.onprogress = (e) => {
+        if (e.lengthComputable) {
+          opts.onProgress(Math.round(e.loaded / e.total * 95));
+        }
+      };
+    }
+    xhr.onload = () => {
+      if (xhr.status >= 200 && xhr.status < 300) {
+        resolve();
+      } else {
+        const code = xhr.status >= 400 && xhr.status < 500 ? "CLIENT_ERROR" : "SERVER_ERROR";
+        reject(new UploaderError(code, `Bucket PUT failed: HTTP ${xhr.status}`, xhr.status));
+      }
+    };
+    xhr.onerror = () => reject(new UploaderError("NETWORK_ERROR", "Bucket PUT network error"));
+    xhr.onabort = () => reject(new UploaderError("ABORTED", "Upload aborted"));
+    if (opts.signal) {
+      opts.signal.addEventListener("abort", () => xhr.abort(), { once: true });
+    }
+    xhr.send(body);
+  });
+}
 var UploaderClient = class {
   apikey;
   apiUrl;
   security;
+  #directUploadOption;
+  /** Client-level default per-file delivery protection (docs/13). */
+  #deliveryProtection;
+  /** Client-level default per-file allowed origins (docs/13). */
+  #allowedOrigins;
+  /** Memoized capability probe — one request per client, shared across uploads. */
+  #capsPromise = null;
   constructor(options) {
     this.apikey = options.apikey;
     this.apiUrl = (options.apiUrl ?? "https://api.uploaderhq.io").replace(/\/$/, "");
     this.security = options.security;
+    this.#directUploadOption = options.directUpload;
+    this.#deliveryProtection = options.deliveryProtection;
+    this.#allowedOrigins = options.allowedOrigins;
+  }
+  /**
+   * Resolve the effective per-file protection for one upload: a per-upload value
+   * overrides the client-level default (docs/13). Returns an object carrying ONLY
+   * the keys that are set, so callers spread it into the request body and unset
+   * fields are omitted entirely — an old server ignores them and the file inherits
+   * the account mode (`null`).
+   */
+  #resolveProtection(opts) {
+    const out = {};
+    const mode = opts.deliveryProtection ?? this.#deliveryProtection;
+    if (mode !== void 0) out.deliveryProtection = mode;
+    const origins = opts.allowedOrigins ?? this.#allowedOrigins;
+    if (origins !== void 0) out.allowedOrigins = origins;
+    return out;
+  }
+  // ─── Capability negotiation ─────────────────────────────────────────────────
+  /**
+   * Probe GET /api/capabilities once per client and cache the result. Fails OPEN
+   * to the proxied flow ({ directUpload: false }) on any error/timeout, so a
+   * flaky probe never blocks uploads and old servers (404) are handled.
+   */
+  #getCapabilities() {
+    if (this.#directUploadOption === false) {
+      return Promise.resolve({ directUpload: false });
+    }
+    if (!this.#capsPromise) {
+      this.#capsPromise = fetch(`${this.apiUrl}/api/capabilities`, {
+        headers: this.#authHeaders()
+      }).then(async (res) => {
+        if (!res.ok) return { directUpload: false };
+        const body = await res.json().catch(() => ({}));
+        return { directUpload: body["directUpload"] === true };
+      }).catch(() => ({ directUpload: false }));
+    }
+    return this.#capsPromise;
+  }
+  // ─── Direct-to-bucket upload ────────────────────────────────────────────────
+  /**
+   * Presign → PUT-to-bucket → confirm. Bytes go browser → bucket directly; our
+   * server only signs and records. Used when the account has the directUpload
+   * capability and the file fits a single PUT.
+   */
+  async #uploadDirect(file, opts) {
+    const { onProgress, filename, signal } = opts;
+    const name = filename ?? (file instanceof File ? file.name : "upload");
+    const contentType = file instanceof File && file.type ? file.type : "application/octet-stream";
+    onProgress?.(0);
+    checkAbort(signal);
+    const protection = this.#resolveProtection(opts);
+    const presign = async () => {
+      const res = await fetchWithRetry(
+        `${this.apiUrl}/api/uploads/presign`,
+        {
+          method: "POST",
+          headers: { ...this.#authHeaders(), "Content-Type": "application/json" },
+          body: JSON.stringify({ filename: name, contentType, size: file.size, ...protection })
+        },
+        signal
+      );
+      return await res.json();
+    };
+    let signed = await presign();
+    const checksum = await sha256Hex(file);
+    try {
+      await xhrPut(signed.putUrl, file, { contentType: signed.contentType, onProgress, signal });
+    } catch (err) {
+      if (err instanceof UploaderError && err.statusCode === 403) {
+        signed = await presign();
+        await xhrPut(signed.putUrl, file, { contentType: signed.contentType, onProgress, signal });
+      } else {
+        throw err;
+      }
+    }
+    checkAbort(signal);
+    const confirmRes = await fetchWithRetry(
+      `${this.apiUrl}/api/uploads/confirm`,
+      {
+        method: "POST",
+        headers: { ...this.#authHeaders(), "Content-Type": "application/json" },
+        body: JSON.stringify({ handle: signed.handle, checksum })
+      },
+      signal
+    );
+    const body = await confirmRes.json();
+    onProgress?.(100);
+    return this.#parseFileResult(body);
   }
   // ─── Auth headers ──────────────────────────────────────────────────────────
   /**
@@ -126,6 +267,9 @@ var UploaderClient = class {
     const form = new FormData();
     form.append("file", file, filename ?? (file instanceof File ? file.name : "upload"));
     if (filename) form.append("filename", filename);
+    const protection = this.#resolveProtection(opts);
+    if (protection.deliveryProtection) form.append("deliveryProtection", protection.deliveryProtection);
+    if (protection.allowedOrigins) form.append("allowedOrigins", JSON.stringify(protection.allowedOrigins));
     const res = await fetchWithRetry(
       `${this.apiUrl}/api/store`,
       {
@@ -149,12 +293,13 @@ var UploaderClient = class {
     const mime = file instanceof File ? file.type : "application/octet-stream";
     onProgress?.(0);
     checkAbort(signal);
+    const protection = this.#resolveProtection(opts);
     const startRes = await fetchWithRetry(
       `${this.apiUrl}/api/upload/start`,
       {
         method: "POST",
         headers: { ...this.#authHeaders(), "Content-Type": "application/json" },
-        body: JSON.stringify({ filename: name, mimetype: mime, size: file.size })
+        body: JSON.stringify({ filename: name, mimetype: mime, size: file.size, ...protection })
       },
       signal
     );
@@ -217,6 +362,10 @@ var UploaderClient = class {
    *   CLIENT_ERROR | INVALID_RESPONSE
    */
   async upload(file, opts = {}) {
+    const caps = await this.#getCapabilities();
+    if (caps.directUpload && file.size <= MAX_DIRECT_PUT_BYTES) {
+      return this.#uploadDirect(file, opts);
+    }
     const plan = planChunks(file, opts.chunkSize);
     if (plan.mode === "single") {
       return this.#uploadSingleShot(file, opts);
@@ -296,6 +445,10 @@ function transformUrl({ handle, ops, apiUrl = "" }) {
   const chain = ops.map(serializeOp).join("/");
   return chain ? `${base}/${chain}/${handle}` : `${base}/${handle}`;
 }
+function withSignedPolicy(url, security) {
+  const sep = url.includes("?") ? "&" : "?";
+  return `${url}${sep}policy=${encodeURIComponent(security.policy)}&signature=${encodeURIComponent(security.signature)}`;
+}
 
 export {
   UploaderError,
@@ -310,6 +463,7 @@ export {
   flop,
   quality,
   output,
-  transformUrl
+  transformUrl,
+  withSignedPolicy
 };
-//# sourceMappingURL=chunk-EM6NZZSU.js.map
+//# sourceMappingURL=chunk-QRUZUI5L.js.map

package/dist/chunk-QRUZUI5L.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/core/errors.ts","../src/core/chunk.ts","../src/core/client.ts","../src/core/transform.ts"],"sourcesContent":["/**\n * Typed errors for UploaderClient.\n *\n * UploaderError is thrown by upload / uploadAll on any non-retried failure.\n * The caller can narrow on `err.code` for structured handling.\n */\n\nexport type UploaderErrorCode =\n  | 'ABORTED'          // AbortSignal fired\n  | 'NETWORK_ERROR'    // fetch() threw (no response)\n  | 'SERVER_ERROR'     // 5xx after all retries exhausted\n  | 'CLIENT_ERROR'     // 4xx (not retried)\n  | 'INVALID_RESPONSE' // response body did not match expected shape\n\nexport class UploaderError extends Error {\n  readonly code: UploaderErrorCode\n  /** HTTP status code when available (undefined for ABORTED / NETWORK_ERROR). */\n  readonly statusCode?: number\n\n  constructor(code: UploaderErrorCode, message: string, statusCode?: number) {\n    super(message)\n    this.name = 'UploaderError'\n    this.code = code\n    this.statusCode = statusCode\n  }\n}\n","/**\n * Chunk planner for multipart uploads.\n *\n * Decides single-shot vs multipart by comparing the file size against\n * MULTIPART_THRESHOLD. For multipart files, slices the Blob into parts of\n * `chunkSize` bytes.\n */\n\n/** Files ≤ this size use single-shot POST /api/store. */\nexport const MULTIPART_THRESHOLD = 5 * 1024 * 1024 // 5 MB\n\n/** Default part size for multipart uploads. */\nexport const DEFAULT_CHUNK_SIZE = 5 * 1024 * 1024 // 5 MB\n\nexport type ChunkPlan =\n  | { mode: 'single' }\n  | { mode: 'multipart'; parts: Blob[]; partSize: number }\n\n/**\n * Build a chunk plan for a file.\n *\n * @param file       The File or Blob to upload.\n * @param chunkSize  Desired part size in bytes (default DEFAULT_CHUNK_SIZE).\n * @returns          A plan describing whether to use single-shot or multipart.\n */\nexport function planChunks(file: File | Blob, chunkSize = DEFAULT_CHUNK_SIZE): ChunkPlan {\n  if (file.size <= MULTIPART_THRESHOLD) {\n    return { mode: 'single' }\n  }\n\n  const parts: Blob[] = []\n  let offset = 0\n  while (offset < file.size) {\n    parts.push(file.slice(offset, offset + chunkSize))\n    offset += chunkSize\n  }\n  return { mode: 'multipart', parts, partSize: chunkSize }\n}\n","/**\n * UploaderClient — headless upload client.\n *\n * Chooses single-shot (POST /api/store, multipart/form-data) vs multipart\n * (start/part/complete) based on file size relative to MULTIPART_THRESHOLD\n * (5 MB). Parts are retried individually with exponential backoff. Progress\n * is emitted as a 0–100 integer. AbortSignal cancels in-flight work.\n */\n\nimport type {\n  FileResult,\n  UploadStartResponse,\n  UploadPartResponse,\n  UploaderClientOptions,\n  UploadAllOptions,\n  UploadOptions,\n} from './types.js'\nimport { UploaderError } from './errors.js'\nimport { planChunks } from './chunk.js'\n\n// ─── Constants ────────────────────────────────────────────────────────────────\n\nconst MAX_RETRIES = 3\nconst RETRY_BASE_MS = 200\n\n/**\n * Single presigned PUT ceiling (mirrors the server's Phase-A limit). Files above\n * this fall back to the proxied multipart flow.\n */\nconst MAX_DIRECT_PUT_BYTES = 5 * 1024 * 1024 * 1024 // 5 GB\n\n/**\n * Skip the advisory client checksum above this size — SubtleCrypto has no\n * streaming API, so hashing would load the whole file into memory a second time.\n * The checksum is advisory only (the server can't verify it anyway).\n */\nconst SHA256_MAX_BYTES = 64 * 1024 * 1024 // 64 MB\n\n// ─── Internal helpers ─────────────────────────────────────────────────────────\n\n/** Sleep for `ms` milliseconds, resolving early if signal fires. */\nfunction sleep(ms: number, signal?: AbortSignal): Promise<void> {\n  return new Promise<void>((resolve, reject) => {\n    if (signal?.aborted) {\n      reject(new UploaderError('ABORTED', 'Upload aborted'))\n      return\n    }\n    const timer = setTimeout(resolve, ms)\n    signal?.addEventListener('abort', () => {\n      clearTimeout(timer)\n      reject(new UploaderError('ABORTED', 'Upload aborted'))\n    }, { once: true })\n  })\n}\n\n/** Throw UploaderError(ABORTED) if signal has already fired. */\nfunction checkAbort(signal?: AbortSignal): void {\n  if (signal?.aborted) {\n    throw new UploaderError('ABORTED', 'Upload aborted')\n  }\n}\n\n/**\n * Fetch with retry on network errors and 5xx responses.\n * 4xx responses are not retried — they surface immediately as CLIENT_ERROR.\n */\nasync function fetchWithRetry(\n  url: string,\n  init: RequestInit,\n  signal?: AbortSignal,\n  maxRetries = MAX_RETRIES,\n): Promise<Response> {\n  let lastErr: unknown\n  for (let attempt = 0; attempt < maxRetries; attempt++) {\n    checkAbort(signal)\n    try {\n      const res = await fetch(url, { ...init, signal })\n      if (res.status >= 400 && res.status < 500) {\n        // Client error — do not retry\n        const body = await res.text().catch(() => '')\n        throw new UploaderError(\n          'CLIENT_ERROR',\n          `HTTP ${res.status}: ${body}`,\n          res.status,\n        )\n      }\n      if (res.status >= 500) {\n        // Server error — retry with backoff\n        lastErr = new UploaderError(\n          'SERVER_ERROR',\n          `HTTP ${res.status}`,\n          res.status,\n        )\n        if (attempt < maxRetries - 1) {\n          await sleep(RETRY_BASE_MS * 2 ** attempt, signal)\n        }\n        continue\n      }\n      return res\n    } catch (err) {\n      if (err instanceof UploaderError) {\n        if (err.code === 'CLIENT_ERROR' || err.code === 'ABORTED') throw err\n        lastErr = err\n      } else {\n        // fetch() threw (network failure, CORS, etc.)\n        lastErr = new UploaderError(\n          'NETWORK_ERROR',\n          err instanceof Error ? err.message : String(err),\n        )\n      }\n      if (attempt < maxRetries - 1) {\n        await sleep(RETRY_BASE_MS * 2 ** attempt, signal)\n      }\n    }\n  }\n  throw lastErr\n}\n\n/**\n * Best-effort SHA-256 (hex) of a Blob for the advisory checksum sent at confirm.\n * Returns undefined when SubtleCrypto is unavailable (insecure context / older\n * runtime) or the file is large — never throws. The server treats this as a hint\n * only, so skipping it is safe.\n */\nasync function sha256Hex(blob: Blob): Promise<string | undefined> {\n  try {\n    const c = (globalThis as { crypto?: Crypto }).crypto\n    if (!c?.subtle || blob.size > SHA256_MAX_BYTES) return undefined\n    const digest = await c.subtle.digest('SHA-256', await blob.arrayBuffer())\n    return Array.from(new Uint8Array(digest))\n      .map((b) => b.toString(16).padStart(2, '0'))\n      .join('')\n  } catch {\n    return undefined\n  }\n}\n\n/**\n * PUT a body straight to a presigned bucket URL via XMLHttpRequest.\n *\n * XHR (not fetch) so real upload progress is reported (fetch cannot). The\n * Content-Type header MUST equal the value the server signed, or S3/R2 reject\n * the signature. Bytes go browser → bucket; our server never sees them.\n */\nfunction xhrPut(\n  url: string,\n  body: Blob,\n  opts: { contentType: string; onProgress?: (percent: number) => void; signal?: AbortSignal },\n): Promise<void> {\n  return new Promise<void>((resolve, reject) => {\n    if (opts.signal?.aborted) {\n      reject(new UploaderError('ABORTED', 'Upload aborted'))\n      return\n    }\n    const xhr = new XMLHttpRequest()\n    xhr.open('PUT', url)\n    xhr.setRequestHeader('Content-Type', opts.contentType)\n\n    if (opts.onProgress) {\n      xhr.upload.onprogress = (e: ProgressEvent) => {\n        if (e.lengthComputable) {\n          // Reserve the last 5% for the confirm round-trip.\n          opts.onProgress!(Math.round((e.loaded / e.total) * 95))\n        }\n      }\n    }\n    xhr.onload = () => {\n      if (xhr.status >= 200 && xhr.status < 300) {\n        resolve()\n      } else {\n        const code = xhr.status >= 400 && xhr.status < 500 ? 'CLIENT_ERROR' : 'SERVER_ERROR'\n        reject(new UploaderError(code, `Bucket PUT failed: HTTP ${xhr.status}`, xhr.status))\n      }\n    }\n    xhr.onerror = () => reject(new UploaderError('NETWORK_ERROR', 'Bucket PUT network error'))\n    xhr.onabort = () => reject(new UploaderError('ABORTED', 'Upload aborted'))\n\n    if (opts.signal) {\n      opts.signal.addEventListener('abort', () => xhr.abort(), { once: true })\n    }\n    xhr.send(body)\n  })\n}\n\n/** Shape returned by POST /api/uploads/presign. */\ntype PresignResponse = { handle: string; storageKey: string; putUrl: string; contentType: string }\n\n// ─── UploaderClient ────────────────────────────────────────────────────────────\n\nexport class UploaderClient {\n  readonly apikey: string\n  readonly apiUrl: string\n  readonly security: UploaderClientOptions['security']\n  readonly #directUploadOption?: boolean\n  /** Client-level default per-file delivery protection (docs/13). */\n  readonly #deliveryProtection?: UploaderClientOptions['deliveryProtection']\n  /** Client-level default per-file allowed origins (docs/13). */\n  readonly #allowedOrigins?: string[]\n\n  /** Memoized capability probe — one request per client, shared across uploads. */\n  #capsPromise: Promise<{ directUpload: boolean }> | null = null\n\n  constructor(options: UploaderClientOptions) {\n    this.apikey = options.apikey\n    this.apiUrl = (options.apiUrl ?? 'https://api.uploaderhq.io').replace(/\\/$/, '')\n    this.security = options.security\n    this.#directUploadOption = options.directUpload\n    this.#deliveryProtection = options.deliveryProtection\n    this.#allowedOrigins = options.allowedOrigins\n  }\n\n  /**\n   * Resolve the effective per-file protection for one upload: a per-upload value\n   * overrides the client-level default (docs/13). Returns an object carrying ONLY\n   * the keys that are set, so callers spread it into the request body and unset\n   * fields are omitted entirely — an old server ignores them and the file inherits\n   * the account mode (`null`).\n   */\n  #resolveProtection(opts: UploadOptions): {\n    deliveryProtection?: UploaderClientOptions['deliveryProtection']\n    allowedOrigins?: string[]\n  } {\n    const out: { deliveryProtection?: UploaderClientOptions['deliveryProtection']; allowedOrigins?: string[] } = {}\n    const mode = opts.deliveryProtection ?? this.#deliveryProtection\n    if (mode !== undefined) out.deliveryProtection = mode\n    const origins = opts.allowedOrigins ?? this.#allowedOrigins\n    if (origins !== undefined) out.allowedOrigins = origins\n    return out\n  }\n\n  // ─── Capability negotiation ─────────────────────────────────────────────────\n\n  /**\n   * Probe GET /api/capabilities once per client and cache the result. Fails OPEN\n   * to the proxied flow ({ directUpload: false }) on any error/timeout, so a\n   * flaky probe never blocks uploads and old servers (404) are handled.\n   */\n  #getCapabilities(): Promise<{ directUpload: boolean }> {\n    // Explicit opt-out — never probe, never use direct upload.\n    if (this.#directUploadOption === false) {\n      return Promise.resolve({ directUpload: false })\n    }\n    if (!this.#capsPromise) {\n      this.#capsPromise = fetch(`${this.apiUrl}/api/capabilities`, {\n        headers: this.#authHeaders(),\n      })\n        .then(async (res) => {\n          if (!res.ok) return { directUpload: false }\n          const body = (await res.json().catch(() => ({}))) as Record<string, unknown>\n          return { directUpload: body['directUpload'] === true }\n        })\n        .catch(() => ({ directUpload: false }))\n    }\n    return this.#capsPromise\n  }\n\n  // ─── Direct-to-bucket upload ────────────────────────────────────────────────\n\n  /**\n   * Presign → PUT-to-bucket → confirm. Bytes go browser → bucket directly; our\n   * server only signs and records. Used when the account has the directUpload\n   * capability and the file fits a single PUT.\n   */\n  async #uploadDirect(file: File | Blob, opts: UploadOptions): Promise<FileResult> {\n    const { onProgress, filename, signal } = opts\n    const name = filename ?? (file instanceof File ? file.name : 'upload')\n    // Must match the Content-Type we send on the PUT (the server signs it).\n    const contentType = file instanceof File && file.type ? file.type : 'application/octet-stream'\n\n    onProgress?.(0)\n    checkAbort(signal)\n\n    const protection = this.#resolveProtection(opts)\n    const presign = async (): Promise<PresignResponse> => {\n      const res = await fetchWithRetry(\n        `${this.apiUrl}/api/uploads/presign`,\n        {\n          method: 'POST',\n          headers: { ...this.#authHeaders(), 'Content-Type': 'application/json' },\n          body: JSON.stringify({ filename: name, contentType, size: file.size, ...protection }),\n        },\n        signal,\n      )\n      return (await res.json()) as PresignResponse\n    }\n\n    let signed = await presign()\n\n    // Advisory checksum (best-effort; unverifiable server-side).\n    const checksum = await sha256Hex(file)\n\n    // PUT straight to the bucket. A 403 means the short-lived signature lapsed\n    // (or a stale key) — re-presign once and retry before giving up.\n    try {\n      await xhrPut(signed.putUrl, file, { contentType: signed.contentType, onProgress, signal })\n    } catch (err) {\n      if (err instanceof UploaderError && err.statusCode === 403) {\n        signed = await presign()\n        await xhrPut(signed.putUrl, file, { contentType: signed.contentType, onProgress, signal })\n      } else {\n        throw err\n      }\n    }\n\n    // Confirm — server verifies the object exists, records usage, enqueues.\n    checkAbort(signal)\n    const confirmRes = await fetchWithRetry(\n      `${this.apiUrl}/api/uploads/confirm`,\n      {\n        method: 'POST',\n        headers: { ...this.#authHeaders(), 'Content-Type': 'application/json' },\n        body: JSON.stringify({ handle: signed.handle, checksum }),\n      },\n      signal,\n    )\n    const body = (await confirmRes.json()) as unknown\n    onProgress?.(100)\n    return this.#parseFileResult(body)\n  }\n\n  // ─── Auth headers ──────────────────────────────────────────────────────────\n\n  /**\n   * Build the auth headers shared by all requests.\n   * Attaches the API key and, when present, the signed policy pair.\n   */\n  #authHeaders(): Record<string, string> {\n    const headers: Record<string, string> = {\n      'X-Uploader-Key': this.apikey,\n    }\n    if (this.security) {\n      headers['X-Uploader-Policy'] = this.security.policy\n      headers['X-Uploader-Signature'] = this.security.signature\n    }\n    return headers\n  }\n\n  // ─── Single-shot upload ────────────────────────────────────────────────────\n\n  /**\n   * POST /api/store — multipart/form-data for files ≤ MULTIPART_THRESHOLD.\n   */\n  async #uploadSingleShot(\n    file: File | Blob,\n    opts: UploadOptions,\n  ): Promise<FileResult> {\n    const { onProgress, filename, signal } = opts\n\n    onProgress?.(0)\n    checkAbort(signal)\n\n    const form = new FormData()\n    form.append('file', file, filename ?? (file instanceof File ? file.name : 'upload'))\n    if (filename) form.append('filename', filename)\n    // Per-file delivery protection (docs/13) — sent as form fields; allowedOrigins\n    // is JSON-encoded to match the server's parse. Omitted when unset (inherit).\n    const protection = this.#resolveProtection(opts)\n    if (protection.deliveryProtection) form.append('deliveryProtection', protection.deliveryProtection)\n    if (protection.allowedOrigins) form.append('allowedOrigins', JSON.stringify(protection.allowedOrigins))\n\n    const res = await fetchWithRetry(\n      `${this.apiUrl}/api/store`,\n      {\n        method: 'POST',\n        headers: this.#authHeaders(),\n        body: form,\n      },\n      signal,\n    )\n\n    const body = await res.json() as unknown\n    onProgress?.(100)\n    return this.#parseFileResult(body)\n  }\n\n  // ─── Multipart upload ──────────────────────────────────────────────────────\n\n  /**\n   * start → parts (parallel with progress) → complete for files > MULTIPART_THRESHOLD.\n   */\n  async #uploadMultipart(\n    file: File | Blob,\n    parts: Blob[],\n    opts: UploadOptions,\n  ): Promise<FileResult> {\n    const { onProgress, filename, signal } = opts\n    const name = filename ?? (file instanceof File ? file.name : 'upload')\n    const mime = file instanceof File ? file.type : 'application/octet-stream'\n\n    onProgress?.(0)\n    checkAbort(signal)\n\n    // 1. Start\n    const protection = this.#resolveProtection(opts)\n    const startRes = await fetchWithRetry(\n      `${this.apiUrl}/api/upload/start`,\n      {\n        method: 'POST',\n        headers: { ...this.#authHeaders(), 'Content-Type': 'application/json' },\n        body: JSON.stringify({ filename: name, mimetype: mime, size: file.size, ...protection }),\n      },\n      signal,\n    )\n    const { uploadId } = await startRes.json() as UploadStartResponse\n\n    // 2. Upload parts sequentially (retried individually)\n    const etags: { partNumber: number; etag: string }[] = []\n    let uploadedBytes = 0\n\n    for (let i = 0; i < parts.length; i++) {\n      checkAbort(signal)\n      const partBlob = parts[i]!\n      const partNumber = i + 1\n\n      const partForm = new FormData()\n      partForm.append('uploadId', uploadId)\n      partForm.append('partNumber', String(partNumber))\n      partForm.append('part', partBlob)\n\n      const partRes = await fetchWithRetry(\n        `${this.apiUrl}/api/upload/part`,\n        {\n          method: 'POST',\n          headers: this.#authHeaders(),\n          body: partForm,\n        },\n        signal,\n      )\n      const { etag } = await partRes.json() as UploadPartResponse\n\n      etags.push({ partNumber, etag })\n      uploadedBytes += partBlob.size\n      onProgress?.(Math.round((uploadedBytes / file.size) * 95)) // reserve 5% for complete\n    }\n\n    // 3. Complete\n    checkAbort(signal)\n    const completeRes = await fetchWithRetry(\n      `${this.apiUrl}/api/upload/complete`,\n      {\n        method: 'POST',\n        headers: { ...this.#authHeaders(), 'Content-Type': 'application/json' },\n        body: JSON.stringify({ uploadId, parts: etags }),\n      },\n      signal,\n    )\n    const body = await completeRes.json() as unknown\n    onProgress?.(100)\n    return this.#parseFileResult(body)\n  }\n\n  // ─── Response parser ───────────────────────────────────────────────────────\n\n  #parseFileResult(body: unknown): FileResult {\n    if (\n      typeof body !== 'object' ||\n      body === null ||\n      typeof (body as Record<string, unknown>)['handle'] !== 'string' ||\n      typeof (body as Record<string, unknown>)['url'] !== 'string'\n    ) {\n      throw new UploaderError('INVALID_RESPONSE', 'Unexpected response shape from upload API')\n    }\n    return body as FileResult\n  }\n\n  // ─── Public API ───────────────────────────────────────────────────────────\n\n  /**\n   * Upload a single file.\n   *\n   * Automatically selects single-shot vs multipart upload based on file size.\n   * Emits progress via `opts.onProgress` (0–100). Respects `opts.signal` for\n   * cancellation. Retries network errors and 5xx responses up to 3 times with\n   * exponential backoff; 4xx errors are surfaced immediately.\n   *\n   * @throws {UploaderError} with code ABORTED | NETWORK_ERROR | SERVER_ERROR |\n   *   CLIENT_ERROR | INVALID_RESPONSE\n   */\n  async upload(\n    file: File | Blob,\n    opts: UploadOptions = {},\n  ): Promise<FileResult> {\n    // Prefer direct-to-bucket when the account supports it and the file fits a\n    // single PUT. The probe fails open, so an old server or a disabled account\n    // transparently uses the proxied flow below.\n    const caps = await this.#getCapabilities()\n    if (caps.directUpload && file.size <= MAX_DIRECT_PUT_BYTES) {\n      return this.#uploadDirect(file, opts)\n    }\n\n    const plan = planChunks(file, opts.chunkSize)\n    if (plan.mode === 'single') {\n      return this.#uploadSingleShot(file, opts)\n    }\n    return this.#uploadMultipart(file, plan.parts, opts)\n  }\n\n  /**\n   * Upload multiple files with concurrency limiting.\n   *\n   * Resolves once all uploads settle (fulfilled or rejected). The returned\n   * array preserves input order. `opts.concurrency` caps simultaneous\n   * in-flight uploads (default 3). Each file shares the same opts\n   * (including onProgress — the callback fires per-file, not aggregate).\n   *\n   * @returns Array of PromiseSettledResult in input order.\n   */\n  async uploadAll(\n    files: Array<File | Blob>,\n    opts: UploadAllOptions = {},\n  ): Promise<PromiseSettledResult<FileResult>[]> {\n    const concurrency = opts.concurrency ?? 3\n    const results: PromiseSettledResult<FileResult>[] = new Array(files.length)\n\n    let index = 0\n\n    async function worker(client: UploaderClient): Promise<void> {\n      while (index < files.length) {\n        const i = index++\n        const file = files[i]!\n        try {\n          results[i] = { status: 'fulfilled', value: await client.upload(file, opts) }\n        } catch (err) {\n          results[i] = { status: 'rejected', reason: err }\n        }\n      }\n    }\n\n    const workers = Array.from({ length: Math.min(concurrency, files.length) }, () =>\n      worker(this),\n    )\n    await Promise.all(workers)\n    return results\n  }\n}\n","/**\n * Delivery / transform URL builder.\n *\n * The API serves transformed derivatives at `GET /<chain>/<handle>`, where\n * <chain> is a slash-joined list of ops (e.g. `resize=w:200,h:200,fit:crop`).\n * These op builders + `transformUrl()` construct that URL from an uploaded file\n * handle, so consumers render an image at any size/format/quality without\n * hand-assembling URL strings.\n *\n * The op/param types and serialization mirror @uploader/shared EXACTLY — the\n * API's `parseTransformChain` is the other half of this contract, and\n * `contract.conformance.ts` asserts at typecheck time that they stay in sync.\n */\n\n// ─── Op vocabulary (mirrors @uploader/shared) ────────────────────────────────\n\nexport type TransformOpName =\n  | 'resize'\n  | 'crop'\n  | 'rotate'\n  | 'flip'\n  | 'flop'\n  | 'quality'\n  | 'output'\n\n/** Parameters for the resize operation. */\nexport type ResizeParams = {\n  w?: number\n  h?: number\n  fit?: 'cover' | 'contain' | 'fill' | 'inside' | 'outside' | 'crop'\n}\n\n/** Parameters for the crop operation. */\nexport type CropParams = {\n  /** \"x,y,w,h\" notation. */\n  dim: string\n  x?: number\n  y?: number\n  w?: number\n  h?: number\n}\n\n/** Parameters for the rotate operation. */\nexport type RotateParams = { deg: number }\n\n/** Parameters for the quality operation. */\nexport type QualityParams = { n: number }\n\n/** Parameters for the output operation. */\nexport type OutputParams = { format: string }\n\n/** A single transform operation with its typed params. */\nexport type TransformOp =\n  | { name: 'resize'; params: ResizeParams }\n  | { name: 'crop'; params: CropParams }\n  | { name: 'rotate'; params: RotateParams }\n  | { name: 'flip'; params: Record<string, never> }\n  | { name: 'flop'; params: Record<string, never> }\n  | { name: 'quality'; params: QualityParams }\n  | { name: 'output'; params: OutputParams }\n\n/** An ordered list of transform operations. */\nexport type TransformChain = { ops: TransformOp[] }\n\n// ─── Op builders ─────────────────────────────────────────────────────────────\n\n/** Resize to a width and/or height with an optional fit mode. */\nexport const resize = (params: ResizeParams): TransformOp => ({ name: 'resize', params })\n\n/** Crop a rectangular region: origin (x, y) and size w×h, in source pixels. */\nexport const crop = (rect: { x: number; y: number; w: number; h: number }): TransformOp => ({\n  name: 'crop',\n  params: { dim: `${rect.x},${rect.y},${rect.w},${rect.h}`, ...rect },\n})\n\n/** Rotate clockwise by `deg` degrees. */\nexport const rotate = (params: RotateParams): TransformOp => ({ name: 'rotate', params })\n\n/** Flip vertically (mirror top↔bottom). */\nexport const flip = (): TransformOp => ({ name: 'flip', params: {} })\n\n/** Flop horizontally (mirror left↔right). */\nexport const flop = (): TransformOp => ({ name: 'flop', params: {} })\n\n/** Set output quality 1–100 (ignored by lossless formats). */\nexport const quality = (params: QualityParams): TransformOp => ({ name: 'quality', params })\n\n/** Convert the output format, e.g. `{ format: 'webp' }`. */\nexport const output = (params: OutputParams): TransformOp => ({ name: 'output', params })\n\n// ─── Serialization (vendored from @uploader/shared, parser-compatible) ────────\n\nfunction serializeOp(op: TransformOp): string {\n  switch (op.name) {\n    case 'resize': {\n      const parts: string[] = []\n      if (op.params.w !== undefined) parts.push(`w:${op.params.w}`)\n      if (op.params.h !== undefined) parts.push(`h:${op.params.h}`)\n      if (op.params.fit !== undefined) parts.push(`fit:${op.params.fit}`)\n      return `resize=${parts.join(',')}`\n    }\n    case 'crop':\n      return `crop=dim:${op.params.dim}`\n    case 'rotate':\n      return `rotate=deg:${op.params.deg}`\n    case 'flip':\n      return 'flip'\n    case 'flop':\n      return 'flop'\n    case 'quality':\n      return `quality=n:${op.params.n}`\n    case 'output':\n      return `output=format:${op.params.format}`\n  }\n}\n\nexport type TransformUrlOptions = {\n  /** File handle from an upload (`FileResult.handle`). */\n  handle: string\n  /** Ordered transform ops to apply. Must contain at least one op. */\n  ops: TransformOp[]\n  /**\n   * Base API URL. Defaults to '' so the URL is relative — `/<chain>/<handle>` —\n   * and resolves same-origin (e.g. proxied to the API). Pass an absolute URL to\n   * point at a remote API directly.\n   */\n  apiUrl?: string\n}\n\n/**\n * Build a delivery URL that applies `ops` to the file identified by `handle`.\n *\n * @example\n * transformUrl({\n *   handle: file.handle,\n *   ops: [resize({ w: 200, h: 200, fit: 'crop' }), output({ format: 'webp' })],\n * })\n * // => \"/resize=w:200,h:200,fit:crop/output=format:webp/<handle>\"\n */\nexport function transformUrl({ handle, ops, apiUrl = '' }: TransformUrlOptions): string {\n  const base = apiUrl.replace(/\\/$/, '')\n  const chain = ops.map(serializeOp).join('/')\n  // The API's transform route requires at least one op segment before the\n  // handle; for the unmodified original, use FileResult.url instead.\n  return chain ? `${base}/${chain}/${handle}` : `${base}/${handle}`\n}\n\n/**\n * Append a signed read policy to a delivery/transform URL for accounts on the\n * `signed` delivery-protection tier (Private plan, docs/12).\n *\n * The `policy` + `signature` pair is produced SERVER-SIDE by the customer's\n * backend (HMAC over the account's api-key secret, via @uploader/shared). This\n * helper only assembles the URL — the SDK never signs and never sees the secret.\n *\n * @example\n *   const url = withSignedPolicy(\n *     transformUrl({ handle, ops: [resize({ w: 400 })], apiUrl }),\n *     { policy, signature }, // from your backend\n *   )\n */\nexport function withSignedPolicy(\n  url: string,\n  security: { policy: string; signature: string },\n): string {\n  const sep = url.includes('?') ? '&' : '?'\n  return `${url}${sep}policy=${encodeURIComponent(security.policy)}&signature=${encodeURIComponent(security.signature)}`\n}\n"],"mappings":";AAcO,IAAM,gBAAN,cAA4B,MAAM;AAAA,EAC9B;AAAA;AAAA,EAEA;AAAA,EAET,YAAY,MAAyB,SAAiB,YAAqB;AACzE,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,aAAa;AAAA,EACpB;AACF;;;AChBO,IAAM,sBAAsB,IAAI,OAAO;AAGvC,IAAM,qBAAqB,IAAI,OAAO;AAatC,SAAS,WAAW,MAAmB,YAAY,oBAA+B;AACvF,MAAI,KAAK,QAAQ,qBAAqB;AACpC,WAAO,EAAE,MAAM,SAAS;AAAA,EAC1B;AAEA,QAAM,QAAgB,CAAC;AACvB,MAAI,SAAS;AACb,SAAO,SAAS,KAAK,MAAM;AACzB,UAAM,KAAK,KAAK,MAAM,QAAQ,SAAS,SAAS,CAAC;AACjD,cAAU;AAAA,EACZ;AACA,SAAO,EAAE,MAAM,aAAa,OAAO,UAAU,UAAU;AACzD;;;ACfA,IAAM,cAAc;AACpB,IAAM,gBAAgB;AAMtB,IAAM,uBAAuB,IAAI,OAAO,OAAO;AAO/C,IAAM,mBAAmB,KAAK,OAAO;AAKrC,SAAS,MAAM,IAAY,QAAqC;AAC9D,SAAO,IAAI,QAAc,CAAC,SAAS,WAAW;AAC5C,QAAI,QAAQ,SAAS;AACnB,aAAO,IAAI,cAAc,WAAW,gBAAgB,CAAC;AACrD;AAAA,IACF;AACA,UAAM,QAAQ,WAAW,SAAS,EAAE;AACpC,YAAQ,iBAAiB,SAAS,MAAM;AACtC,mBAAa,KAAK;AAClB,aAAO,IAAI,cAAc,WAAW,gBAAgB,CAAC;AAAA,IACvD,GAAG,EAAE,MAAM,KAAK,CAAC;AAAA,EACnB,CAAC;AACH;AAGA,SAAS,WAAW,QAA4B;AAC9C,MAAI,QAAQ,SAAS;AACnB,UAAM,IAAI,cAAc,WAAW,gBAAgB;AAAA,EACrD;AACF;AAMA,eAAe,eACb,KACA,MACA,QACA,aAAa,aACM;AACnB,MAAI;AACJ,WAAS,UAAU,GAAG,UAAU,YAAY,WAAW;AACrD,eAAW,MAAM;AACjB,QAAI;AACF,YAAM,MAAM,MAAM,MAAM,KAAK,EAAE,GAAG,MAAM,OAAO,CAAC;AAChD,UAAI,IAAI,UAAU,OAAO,IAAI,SAAS,KAAK;AAEzC,cAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,EAAE;AAC5C,cAAM,IAAI;AAAA,UACR;AAAA,UACA,QAAQ,IAAI,MAAM,KAAK,IAAI;AAAA,UAC3B,IAAI;AAAA,QACN;AAAA,MACF;AACA,UAAI,IAAI,UAAU,KAAK;AAErB,kBAAU,IAAI;AAAA,UACZ;AAAA,UACA,QAAQ,IAAI,MAAM;AAAA,UAClB,IAAI;AAAA,QACN;AACA,YAAI,UAAU,aAAa,GAAG;AAC5B,gBAAM,MAAM,gBAAgB,KAAK,SAAS,MAAM;AAAA,QAClD;AACA;AAAA,MACF;AACA,aAAO;AAAA,IACT,SAAS,KAAK;AACZ,UAAI,eAAe,eAAe;AAChC,YAAI,IAAI,SAAS,kBAAkB,IAAI,SAAS,UAAW,OAAM;AACjE,kBAAU;AAAA,MACZ,OAAO;AAEL,kBAAU,IAAI;AAAA,UACZ;AAAA,UACA,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,QACjD;AAAA,MACF;AACA,UAAI,UAAU,aAAa,GAAG;AAC5B,cAAM,MAAM,gBAAgB,KAAK,SAAS,MAAM;AAAA,MAClD;AAAA,IACF;AAAA,EACF;AACA,QAAM;AACR;AAQA,eAAe,UAAU,MAAyC;AAChE,MAAI;AACF,UAAM,IAAK,WAAmC;AAC9C,QAAI,CAAC,GAAG,UAAU,KAAK,OAAO,iBAAkB,QAAO;AACvD,UAAM,SAAS,MAAM,EAAE,OAAO,OAAO,WAAW,MAAM,KAAK,YAAY,CAAC;AACxE,WAAO,MAAM,KAAK,IAAI,WAAW,MAAM,CAAC,EACrC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAC1C,KAAK,EAAE;AAAA,EACZ,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AASA,SAAS,OACP,KACA,MACA,MACe;AACf,SAAO,IAAI,QAAc,CAAC,SAAS,WAAW;AAC5C,QAAI,KAAK,QAAQ,SAAS;AACxB,aAAO,IAAI,cAAc,WAAW,gBAAgB,CAAC;AACrD;AAAA,IACF;AACA,UAAM,MAAM,IAAI,eAAe;AAC/B,QAAI,KAAK,OAAO,GAAG;AACnB,QAAI,iBAAiB,gBAAgB,KAAK,WAAW;AAErD,QAAI,KAAK,YAAY;AACnB,UAAI,OAAO,aAAa,CAAC,MAAqB;AAC5C,YAAI,EAAE,kBAAkB;AAEtB,eAAK,WAAY,KAAK,MAAO,EAAE,SAAS,EAAE,QAAS,EAAE,CAAC;AAAA,QACxD;AAAA,MACF;AAAA,IACF;AACA,QAAI,SAAS,MAAM;AACjB,UAAI,IAAI,UAAU,OAAO,IAAI,SAAS,KAAK;AACzC,gBAAQ;AAAA,MACV,OAAO;AACL,cAAM,OAAO,IAAI,UAAU,OAAO,IAAI,SAAS,MAAM,iBAAiB;AACtE,eAAO,IAAI,cAAc,MAAM,2BAA2B,IAAI,MAAM,IAAI,IAAI,MAAM,CAAC;AAAA,MACrF;AAAA,IACF;AACA,QAAI,UAAU,MAAM,OAAO,IAAI,cAAc,iBAAiB,0BAA0B,CAAC;AACzF,QAAI,UAAU,MAAM,OAAO,IAAI,cAAc,WAAW,gBAAgB,CAAC;AAEzE,QAAI,KAAK,QAAQ;AACf,WAAK,OAAO,iBAAiB,SAAS,MAAM,IAAI,MAAM,GAAG,EAAE,MAAM,KAAK,CAAC;AAAA,IACzE;AACA,QAAI,KAAK,IAAI;AAAA,EACf,CAAC;AACH;AAOO,IAAM,iBAAN,MAAqB;AAAA,EACjB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA;AAAA,EAGT,eAA0D;AAAA,EAE1D,YAAY,SAAgC;AAC1C,SAAK,SAAS,QAAQ;AACtB,SAAK,UAAU,QAAQ,UAAU,6BAA6B,QAAQ,OAAO,EAAE;AAC/E,SAAK,WAAW,QAAQ;AACxB,SAAK,sBAAsB,QAAQ;AACnC,SAAK,sBAAsB,QAAQ;AACnC,SAAK,kBAAkB,QAAQ;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,mBAAmB,MAGjB;AACA,UAAM,MAAuG,CAAC;AAC9G,UAAM,OAAO,KAAK,sBAAsB,KAAK;AAC7C,QAAI,SAAS,OAAW,KAAI,qBAAqB;AACjD,UAAM,UAAU,KAAK,kBAAkB,KAAK;AAC5C,QAAI,YAAY,OAAW,KAAI,iBAAiB;AAChD,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,mBAAuD;AAErD,QAAI,KAAK,wBAAwB,OAAO;AACtC,aAAO,QAAQ,QAAQ,EAAE,cAAc,MAAM,CAAC;AAAA,IAChD;AACA,QAAI,CAAC,KAAK,cAAc;AACtB,WAAK,eAAe,MAAM,GAAG,KAAK,MAAM,qBAAqB;AAAA,QAC3D,SAAS,KAAK,aAAa;AAAA,MAC7B,CAAC,EACE,KAAK,OAAO,QAAQ;AACnB,YAAI,CAAC,IAAI,GAAI,QAAO,EAAE,cAAc,MAAM;AAC1C,cAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC/C,eAAO,EAAE,cAAc,KAAK,cAAc,MAAM,KAAK;AAAA,MACvD,CAAC,EACA,MAAM,OAAO,EAAE,cAAc,MAAM,EAAE;AAAA,IAC1C;AACA,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,cAAc,MAAmB,MAA0C;AAC/E,UAAM,EAAE,YAAY,UAAU,OAAO,IAAI;AACzC,UAAM,OAAO,aAAa,gBAAgB,OAAO,KAAK,OAAO;AAE7D,UAAM,cAAc,gBAAgB,QAAQ,KAAK,OAAO,KAAK,OAAO;AAEpE,iBAAa,CAAC;AACd,eAAW,MAAM;AAEjB,UAAM,aAAa,KAAK,mBAAmB,IAAI;AAC/C,UAAM,UAAU,YAAsC;AACpD,YAAM,MAAM,MAAM;AAAA,QAChB,GAAG,KAAK,MAAM;AAAA,QACd;AAAA,UACE,QAAQ;AAAA,UACR,SAAS,EAAE,GAAG,KAAK,aAAa,GAAG,gBAAgB,mBAAmB;AAAA,UACtE,MAAM,KAAK,UAAU,EAAE,UAAU,MAAM,aAAa,MAAM,KAAK,MAAM,GAAG,WAAW,CAAC;AAAA,QACtF;AAAA,QACA;AAAA,MACF;AACA,aAAQ,MAAM,IAAI,KAAK;AAAA,IACzB;AAEA,QAAI,SAAS,MAAM,QAAQ;AAG3B,UAAM,WAAW,MAAM,UAAU,IAAI;AAIrC,QAAI;AACF,YAAM,OAAO,OAAO,QAAQ,MAAM,EAAE,aAAa,OAAO,aAAa,YAAY,OAAO,CAAC;AAAA,IAC3F,SAAS,KAAK;AACZ,UAAI,eAAe,iBAAiB,IAAI,eAAe,KAAK;AAC1D,iBAAS,MAAM,QAAQ;AACvB,cAAM,OAAO,OAAO,QAAQ,MAAM,EAAE,aAAa,OAAO,aAAa,YAAY,OAAO,CAAC;AAAA,MAC3F,OAAO;AACL,cAAM;AAAA,MACR;AAAA,IACF;AAGA,eAAW,MAAM;AACjB,UAAM,aAAa,MAAM;AAAA,MACvB,GAAG,KAAK,MAAM;AAAA,MACd;AAAA,QACE,QAAQ;AAAA,QACR,SAAS,EAAE,GAAG,KAAK,aAAa,GAAG,gBAAgB,mBAAmB;AAAA,QACtE,MAAM,KAAK,UAAU,EAAE,QAAQ,OAAO,QAAQ,SAAS,CAAC;AAAA,MAC1D;AAAA,MACA;AAAA,IACF;AACA,UAAM,OAAQ,MAAM,WAAW,KAAK;AACpC,iBAAa,GAAG;AAChB,WAAO,KAAK,iBAAiB,IAAI;AAAA,EACnC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,eAAuC;AACrC,UAAM,UAAkC;AAAA,MACtC,kBAAkB,KAAK;AAAA,IACzB;AACA,QAAI,KAAK,UAAU;AACjB,cAAQ,mBAAmB,IAAI,KAAK,SAAS;AAC7C,cAAQ,sBAAsB,IAAI,KAAK,SAAS;AAAA,IAClD;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,kBACJ,MACA,MACqB;AACrB,UAAM,EAAE,YAAY,UAAU,OAAO,IAAI;AAEzC,iBAAa,CAAC;AACd,eAAW,MAAM;AAEjB,UAAM,OAAO,IAAI,SAAS;AAC1B,SAAK,OAAO,QAAQ,MAAM,aAAa,gBAAgB,OAAO,KAAK,OAAO,SAAS;AACnF,QAAI,SAAU,MAAK,OAAO,YAAY,QAAQ;AAG9C,UAAM,aAAa,KAAK,mBAAmB,IAAI;AAC/C,QAAI,WAAW,mBAAoB,MAAK,OAAO,sBAAsB,WAAW,kBAAkB;AAClG,QAAI,WAAW,eAAgB,MAAK,OAAO,kBAAkB,KAAK,UAAU,WAAW,cAAc,CAAC;AAEtG,UAAM,MAAM,MAAM;AAAA,MAChB,GAAG,KAAK,MAAM;AAAA,MACd;AAAA,QACE,QAAQ;AAAA,QACR,SAAS,KAAK,aAAa;AAAA,QAC3B,MAAM;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAEA,UAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,iBAAa,GAAG;AAChB,WAAO,KAAK,iBAAiB,IAAI;AAAA,EACnC;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,iBACJ,MACA,OACA,MACqB;AACrB,UAAM,EAAE,YAAY,UAAU,OAAO,IAAI;AACzC,UAAM,OAAO,aAAa,gBAAgB,OAAO,KAAK,OAAO;AAC7D,UAAM,OAAO,gBAAgB,OAAO,KAAK,OAAO;AAEhD,iBAAa,CAAC;AACd,eAAW,MAAM;AAGjB,UAAM,aAAa,KAAK,mBAAmB,IAAI;AAC/C,UAAM,WAAW,MAAM;AAAA,MACrB,GAAG,KAAK,MAAM;AAAA,MACd;AAAA,QACE,QAAQ;AAAA,QACR,SAAS,EAAE,GAAG,KAAK,aAAa,GAAG,gBAAgB,mBAAmB;AAAA,QACtE,MAAM,KAAK,UAAU,EAAE,UAAU,MAAM,UAAU,MAAM,MAAM,KAAK,MAAM,GAAG,WAAW,CAAC;AAAA,MACzF;AAAA,MACA;AAAA,IACF;AACA,UAAM,EAAE,SAAS,IAAI,MAAM,SAAS,KAAK;AAGzC,UAAM,QAAgD,CAAC;AACvD,QAAI,gBAAgB;AAEpB,aAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,iBAAW,MAAM;AACjB,YAAM,WAAW,MAAM,CAAC;AACxB,YAAM,aAAa,IAAI;AAEvB,YAAM,WAAW,IAAI,SAAS;AAC9B,eAAS,OAAO,YAAY,QAAQ;AACpC,eAAS,OAAO,cAAc,OAAO,UAAU,CAAC;AAChD,eAAS,OAAO,QAAQ,QAAQ;AAEhC,YAAM,UAAU,MAAM;AAAA,QACpB,GAAG,KAAK,MAAM;AAAA,QACd;AAAA,UACE,QAAQ;AAAA,UACR,SAAS,KAAK,aAAa;AAAA,UAC3B,MAAM;AAAA,QACR;AAAA,QACA;AAAA,MACF;AACA,YAAM,EAAE,KAAK,IAAI,MAAM,QAAQ,KAAK;AAEpC,YAAM,KAAK,EAAE,YAAY,KAAK,CAAC;AAC/B,uBAAiB,SAAS;AAC1B,mBAAa,KAAK,MAAO,gBAAgB,KAAK,OAAQ,EAAE,CAAC;AAAA,IAC3D;AAGA,eAAW,MAAM;AACjB,UAAM,cAAc,MAAM;AAAA,MACxB,GAAG,KAAK,MAAM;AAAA,MACd;AAAA,QACE,QAAQ;AAAA,QACR,SAAS,EAAE,GAAG,KAAK,aAAa,GAAG,gBAAgB,mBAAmB;AAAA,QACtE,MAAM,KAAK,UAAU,EAAE,UAAU,OAAO,MAAM,CAAC;AAAA,MACjD;AAAA,MACA;AAAA,IACF;AACA,UAAM,OAAO,MAAM,YAAY,KAAK;AACpC,iBAAa,GAAG;AAChB,WAAO,KAAK,iBAAiB,IAAI;AAAA,EACnC;AAAA;AAAA,EAIA,iBAAiB,MAA2B;AAC1C,QACE,OAAO,SAAS,YAChB,SAAS,QACT,OAAQ,KAAiC,QAAQ,MAAM,YACvD,OAAQ,KAAiC,KAAK,MAAM,UACpD;AACA,YAAM,IAAI,cAAc,oBAAoB,2CAA2C;AAAA,IACzF;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,OACJ,MACA,OAAsB,CAAC,GACF;AAIrB,UAAM,OAAO,MAAM,KAAK,iBAAiB;AACzC,QAAI,KAAK,gBAAgB,KAAK,QAAQ,sBAAsB;AAC1D,aAAO,KAAK,cAAc,MAAM,IAAI;AAAA,IACtC;AAEA,UAAM,OAAO,WAAW,MAAM,KAAK,SAAS;AAC5C,QAAI,KAAK,SAAS,UAAU;AAC1B,aAAO,KAAK,kBAAkB,MAAM,IAAI;AAAA,IAC1C;AACA,WAAO,KAAK,iBAAiB,MAAM,KAAK,OAAO,IAAI;AAAA,EACrD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,UACJ,OACA,OAAyB,CAAC,GACmB;AAC7C,UAAM,cAAc,KAAK,eAAe;AACxC,UAAM,UAA8C,IAAI,MAAM,MAAM,MAAM;AAE1E,QAAI,QAAQ;AAEZ,mBAAe,OAAO,QAAuC;AAC3D,aAAO,QAAQ,MAAM,QAAQ;AAC3B,cAAM,IAAI;AACV,cAAM,OAAO,MAAM,CAAC;AACpB,YAAI;AACF,kBAAQ,CAAC,IAAI,EAAE,QAAQ,aAAa,OAAO,MAAM,OAAO,OAAO,MAAM,IAAI,EAAE;AAAA,QAC7E,SAAS,KAAK;AACZ,kBAAQ,CAAC,IAAI,EAAE,QAAQ,YAAY,QAAQ,IAAI;AAAA,QACjD;AAAA,MACF;AAAA,IACF;AAEA,UAAM,UAAU,MAAM;AAAA,MAAK,EAAE,QAAQ,KAAK,IAAI,aAAa,MAAM,MAAM,EAAE;AAAA,MAAG,MAC1E,OAAO,IAAI;AAAA,IACb;AACA,UAAM,QAAQ,IAAI,OAAO;AACzB,WAAO;AAAA,EACT;AACF;;;ACndO,IAAM,SAAS,CAAC,YAAuC,EAAE,MAAM,UAAU,OAAO;AAGhF,IAAM,OAAO,CAAC,UAAuE;AAAA,EAC1F,MAAM;AAAA,EACN,QAAQ,EAAE,KAAK,GAAG,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,GAAG,KAAK;AACpE;AAGO,IAAM,SAAS,CAAC,YAAuC,EAAE,MAAM,UAAU,OAAO;AAGhF,IAAM,OAAO,OAAoB,EAAE,MAAM,QAAQ,QAAQ,CAAC,EAAE;AAG5D,IAAM,OAAO,OAAoB,EAAE,MAAM,QAAQ,QAAQ,CAAC,EAAE;AAG5D,IAAM,UAAU,CAAC,YAAwC,EAAE,MAAM,WAAW,OAAO;AAGnF,IAAM,SAAS,CAAC,YAAuC,EAAE,MAAM,UAAU,OAAO;AAIvF,SAAS,YAAY,IAAyB;AAC5C,UAAQ,GAAG,MAAM;AAAA,IACf,KAAK,UAAU;AACb,YAAM,QAAkB,CAAC;AACzB,UAAI,GAAG,OAAO,MAAM,OAAW,OAAM,KAAK,KAAK,GAAG,OAAO,CAAC,EAAE;AAC5D,UAAI,GAAG,OAAO,MAAM,OAAW,OAAM,KAAK,KAAK,GAAG,OAAO,CAAC,EAAE;AAC5D,UAAI,GAAG,OAAO,QAAQ,OAAW,OAAM,KAAK,OAAO,GAAG,OAAO,GAAG,EAAE;AAClE,aAAO,UAAU,MAAM,KAAK,GAAG,CAAC;AAAA,IAClC;AAAA,IACA,KAAK;AACH,aAAO,YAAY,GAAG,OAAO,GAAG;AAAA,IAClC,KAAK;AACH,aAAO,cAAc,GAAG,OAAO,GAAG;AAAA,IACpC,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO,aAAa,GAAG,OAAO,CAAC;AAAA,IACjC,KAAK;AACH,aAAO,iBAAiB,GAAG,OAAO,MAAM;AAAA,EAC5C;AACF;AAyBO,SAAS,aAAa,EAAE,QAAQ,KAAK,SAAS,GAAG,GAAgC;AACtF,QAAM,OAAO,OAAO,QAAQ,OAAO,EAAE;AACrC,QAAM,QAAQ,IAAI,IAAI,WAAW,EAAE,KAAK,GAAG;AAG3C,SAAO,QAAQ,GAAG,IAAI,IAAI,KAAK,IAAI,MAAM,KAAK,GAAG,IAAI,IAAI,MAAM;AACjE;AAgBO,SAAS,iBACd,KACA,UACQ;AACR,QAAM,MAAM,IAAI,SAAS,GAAG,IAAI,MAAM;AACtC,SAAO,GAAG,GAAG,GAAG,GAAG,UAAU,mBAAmB,SAAS,MAAM,CAAC,cAAc,mBAAmB,SAAS,SAAS,CAAC;AACtH;","names":[]}

package/dist/core.cjs

@@ -32,7 +32,8 @@ __export(core_exports, {
   quality: () => quality,
   resize: () => resize,
   rotate: () => rotate,
-  transformUrl: () => transformUrl
+  transformUrl: () => transformUrl,
+  withSignedPolicy: () => withSignedPolicy
 });
 module.exports = __toCommonJS(core_exports);
 
@@ -68,6 +69,8 @@ function planChunks(file, chunkSize = DEFAULT_CHUNK_SIZE) {
 // src/core/client.ts
 var MAX_RETRIES = 3;
 var RETRY_BASE_MS = 200;
+var MAX_DIRECT_PUT_BYTES = 5 * 1024 * 1024 * 1024;
+var SHA256_MAX_BYTES = 64 * 1024 * 1024;
 function sleep(ms, signal) {
   return new Promise((resolve, reject) => {
     if (signal?.aborted) {
@@ -129,14 +132,153 @@ async function fetchWithRetry(url, init, signal, maxRetries = MAX_RETRIES) {
   }
   throw lastErr;
 }
+async function sha256Hex(blob) {
+  try {
+    const c = globalThis.crypto;
+    if (!c?.subtle || blob.size > SHA256_MAX_BYTES) return void 0;
+    const digest = await c.subtle.digest("SHA-256", await blob.arrayBuffer());
+    return Array.from(new Uint8Array(digest)).map((b) => b.toString(16).padStart(2, "0")).join("");
+  } catch {
+    return void 0;
+  }
+}
+function xhrPut(url, body, opts) {
+  return new Promise((resolve, reject) => {
+    if (opts.signal?.aborted) {
+      reject(new UploaderError("ABORTED", "Upload aborted"));
+      return;
+    }
+    const xhr = new XMLHttpRequest();
+    xhr.open("PUT", url);
+    xhr.setRequestHeader("Content-Type", opts.contentType);
+    if (opts.onProgress) {
+      xhr.upload.onprogress = (e) => {
+        if (e.lengthComputable) {
+          opts.onProgress(Math.round(e.loaded / e.total * 95));
+        }
+      };
+    }
+    xhr.onload = () => {
+      if (xhr.status >= 200 && xhr.status < 300) {
+        resolve();
+      } else {
+        const code = xhr.status >= 400 && xhr.status < 500 ? "CLIENT_ERROR" : "SERVER_ERROR";
+        reject(new UploaderError(code, `Bucket PUT failed: HTTP ${xhr.status}`, xhr.status));
+      }
+    };
+    xhr.onerror = () => reject(new UploaderError("NETWORK_ERROR", "Bucket PUT network error"));
+    xhr.onabort = () => reject(new UploaderError("ABORTED", "Upload aborted"));
+    if (opts.signal) {
+      opts.signal.addEventListener("abort", () => xhr.abort(), { once: true });
+    }
+    xhr.send(body);
+  });
+}
 var UploaderClient = class {
   apikey;
   apiUrl;
   security;
+  #directUploadOption;
+  /** Client-level default per-file delivery protection (docs/13). */
+  #deliveryProtection;
+  /** Client-level default per-file allowed origins (docs/13). */
+  #allowedOrigins;
+  /** Memoized capability probe — one request per client, shared across uploads. */
+  #capsPromise = null;
   constructor(options) {
     this.apikey = options.apikey;
     this.apiUrl = (options.apiUrl ?? "https://api.uploaderhq.io").replace(/\/$/, "");
     this.security = options.security;
+    this.#directUploadOption = options.directUpload;
+    this.#deliveryProtection = options.deliveryProtection;
+    this.#allowedOrigins = options.allowedOrigins;
+  }
+  /**
+   * Resolve the effective per-file protection for one upload: a per-upload value
+   * overrides the client-level default (docs/13). Returns an object carrying ONLY
+   * the keys that are set, so callers spread it into the request body and unset
+   * fields are omitted entirely — an old server ignores them and the file inherits
+   * the account mode (`null`).
+   */
+  #resolveProtection(opts) {
+    const out = {};
+    const mode = opts.deliveryProtection ?? this.#deliveryProtection;
+    if (mode !== void 0) out.deliveryProtection = mode;
+    const origins = opts.allowedOrigins ?? this.#allowedOrigins;
+    if (origins !== void 0) out.allowedOrigins = origins;
+    return out;
+  }
+  // ─── Capability negotiation ─────────────────────────────────────────────────
+  /**
+   * Probe GET /api/capabilities once per client and cache the result. Fails OPEN
+   * to the proxied flow ({ directUpload: false }) on any error/timeout, so a
+   * flaky probe never blocks uploads and old servers (404) are handled.
+   */
+  #getCapabilities() {
+    if (this.#directUploadOption === false) {
+      return Promise.resolve({ directUpload: false });
+    }
+    if (!this.#capsPromise) {
+      this.#capsPromise = fetch(`${this.apiUrl}/api/capabilities`, {
+        headers: this.#authHeaders()
+      }).then(async (res) => {
+        if (!res.ok) return { directUpload: false };
+        const body = await res.json().catch(() => ({}));
+        return { directUpload: body["directUpload"] === true };
+      }).catch(() => ({ directUpload: false }));
+    }
+    return this.#capsPromise;
+  }
+  // ─── Direct-to-bucket upload ────────────────────────────────────────────────
+  /**
+   * Presign → PUT-to-bucket → confirm. Bytes go browser → bucket directly; our
+   * server only signs and records. Used when the account has the directUpload
+   * capability and the file fits a single PUT.
+   */
+  async #uploadDirect(file, opts) {
+    const { onProgress, filename, signal } = opts;
+    const name = filename ?? (file instanceof File ? file.name : "upload");
+    const contentType = file instanceof File && file.type ? file.type : "application/octet-stream";
+    onProgress?.(0);
+    checkAbort(signal);
+    const protection = this.#resolveProtection(opts);
+    const presign = async () => {
+      const res = await fetchWithRetry(
+        `${this.apiUrl}/api/uploads/presign`,
+        {
+          method: "POST",
+          headers: { ...this.#authHeaders(), "Content-Type": "application/json" },
+          body: JSON.stringify({ filename: name, contentType, size: file.size, ...protection })
+        },
+        signal
+      );
+      return await res.json();
+    };
+    let signed = await presign();
+    const checksum = await sha256Hex(file);
+    try {
+      await xhrPut(signed.putUrl, file, { contentType: signed.contentType, onProgress, signal });
+    } catch (err) {
+      if (err instanceof UploaderError && err.statusCode === 403) {
+        signed = await presign();
+        await xhrPut(signed.putUrl, file, { contentType: signed.contentType, onProgress, signal });
+      } else {
+        throw err;
+      }
+    }
+    checkAbort(signal);
+    const confirmRes = await fetchWithRetry(
+      `${this.apiUrl}/api/uploads/confirm`,
+      {
+        method: "POST",
+        headers: { ...this.#authHeaders(), "Content-Type": "application/json" },
+        body: JSON.stringify({ handle: signed.handle, checksum })
+      },
+      signal
+    );
+    const body = await confirmRes.json();
+    onProgress?.(100);
+    return this.#parseFileResult(body);
   }
   // ─── Auth headers ──────────────────────────────────────────────────────────
   /**
@@ -164,6 +306,9 @@ var UploaderClient = class {
     const form = new FormData();
     form.append("file", file, filename ?? (file instanceof File ? file.name : "upload"));
     if (filename) form.append("filename", filename);
+    const protection = this.#resolveProtection(opts);
+    if (protection.deliveryProtection) form.append("deliveryProtection", protection.deliveryProtection);
+    if (protection.allowedOrigins) form.append("allowedOrigins", JSON.stringify(protection.allowedOrigins));
     const res = await fetchWithRetry(
       `${this.apiUrl}/api/store`,
       {
@@ -187,12 +332,13 @@ var UploaderClient = class {
     const mime = file instanceof File ? file.type : "application/octet-stream";
     onProgress?.(0);
     checkAbort(signal);
+    const protection = this.#resolveProtection(opts);
     const startRes = await fetchWithRetry(
       `${this.apiUrl}/api/upload/start`,
       {
         method: "POST",
         headers: { ...this.#authHeaders(), "Content-Type": "application/json" },
-        body: JSON.stringify({ filename: name, mimetype: mime, size: file.size })
+        body: JSON.stringify({ filename: name, mimetype: mime, size: file.size, ...protection })
       },
       signal
     );
@@ -255,6 +401,10 @@ var UploaderClient = class {
    *   CLIENT_ERROR | INVALID_RESPONSE
    */
   async upload(file, opts = {}) {
+    const caps = await this.#getCapabilities();
+    if (caps.directUpload && file.size <= MAX_DIRECT_PUT_BYTES) {
+      return this.#uploadDirect(file, opts);
+    }
     const plan = planChunks(file, opts.chunkSize);
     if (plan.mode === "single") {
       return this.#uploadSingleShot(file, opts);
@@ -334,6 +484,10 @@ function transformUrl({ handle, ops, apiUrl = "" }) {
   const chain = ops.map(serializeOp).join("/");
   return chain ? `${base}/${chain}/${handle}` : `${base}/${handle}`;
 }
+function withSignedPolicy(url, security) {
+  const sep = url.includes("?") ? "&" : "?";
+  return `${url}${sep}policy=${encodeURIComponent(security.policy)}&signature=${encodeURIComponent(security.signature)}`;
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   DEFAULT_CHUNK_SIZE,
@@ -348,6 +502,7 @@ function transformUrl({ handle, ops, apiUrl = "" }) {
   quality,
   resize,
   rotate,
-  transformUrl
+  transformUrl,
+  withSignedPolicy
 });
 //# sourceMappingURL=core.cjs.map