@ibanzajoe/uploader 1.1.0 → 1.3.0

package/dist/{transform-BSPaC9-P.d.ts → client-CUmYuQ7Z.d.ts}

@@ -2,7 +2,7 @@
  * SDK-level option and result types for UploaderClient.
  *
  * The upload-contract types below are VENDORED from @uploader/shared so that
- * @uploader/react is self-contained for consumers outside this monorepo — one
+ * @ibanzajoe/uploader is self-contained for consumers outside this monorepo — one
  * install, no @uploader/* or zod transitive deps. They mirror the API contract
  * exactly; `contract.conformance.ts` asserts at typecheck time that they stay
  * structurally identical to the shared definitions, failing the build on drift.
@@ -151,133 +151,4 @@ declare class UploaderClient {
     uploadAll(files: Array<File | Blob>, opts?: UploadAllOptions): Promise<PromiseSettledResult<FileResult>[]>;
 }
 
-/**
- * Delivery / transform URL builder.
- *
- * The API serves transformed derivatives at `GET /<chain>/<handle>`, where
- * <chain> is a slash-joined list of ops (e.g. `resize=w:200,h:200,fit:crop`).
- * These op builders + `transformUrl()` construct that URL from an uploaded file
- * handle, so consumers render an image at any size/format/quality without
- * hand-assembling URL strings.
- *
- * The op/param types and serialization mirror @uploader/shared EXACTLY — the
- * API's `parseTransformChain` is the other half of this contract, and
- * `contract.conformance.ts` asserts at typecheck time that they stay in sync.
- */
-type TransformOpName = 'resize' | 'crop' | 'rotate' | 'flip' | 'flop' | 'quality' | 'output';
-/** Parameters for the resize operation. */
-type ResizeParams = {
-    w?: number;
-    h?: number;
-    fit?: 'cover' | 'contain' | 'fill' | 'inside' | 'outside' | 'crop';
-};
-/** Parameters for the crop operation. */
-type CropParams = {
-    /** "x,y,w,h" notation. */
-    dim: string;
-    x?: number;
-    y?: number;
-    w?: number;
-    h?: number;
-};
-/** Parameters for the rotate operation. */
-type RotateParams = {
-    deg: number;
-};
-/** Parameters for the quality operation. */
-type QualityParams = {
-    n: number;
-};
-/** Parameters for the output operation. */
-type OutputParams = {
-    format: string;
-};
-/** A single transform operation with its typed params. */
-type TransformOp = {
-    name: 'resize';
-    params: ResizeParams;
-} | {
-    name: 'crop';
-    params: CropParams;
-} | {
-    name: 'rotate';
-    params: RotateParams;
-} | {
-    name: 'flip';
-    params: Record<string, never>;
-} | {
-    name: 'flop';
-    params: Record<string, never>;
-} | {
-    name: 'quality';
-    params: QualityParams;
-} | {
-    name: 'output';
-    params: OutputParams;
-};
-/** An ordered list of transform operations. */
-type TransformChain = {
-    ops: TransformOp[];
-};
-/** Resize to a width and/or height with an optional fit mode. */
-declare const resize: (params: ResizeParams) => TransformOp;
-/** Crop a rectangular region: origin (x, y) and size w×h, in source pixels. */
-declare const crop: (rect: {
-    x: number;
-    y: number;
-    w: number;
-    h: number;
-}) => TransformOp;
-/** Rotate clockwise by `deg` degrees. */
-declare const rotate: (params: RotateParams) => TransformOp;
-/** Flip vertically (mirror top↔bottom). */
-declare const flip: () => TransformOp;
-/** Flop horizontally (mirror left↔right). */
-declare const flop: () => TransformOp;
-/** Set output quality 1–100 (ignored by lossless formats). */
-declare const quality: (params: QualityParams) => TransformOp;
-/** Convert the output format, e.g. `{ format: 'webp' }`. */
-declare const output: (params: OutputParams) => TransformOp;
-type TransformUrlOptions = {
-    /** File handle from an upload (`FileResult.handle`). */
-    handle: string;
-    /** Ordered transform ops to apply. Must contain at least one op. */
-    ops: TransformOp[];
-    /**
-     * Base API URL. Defaults to '' so the URL is relative — `/<chain>/<handle>` —
-     * and resolves same-origin (e.g. proxied to the API). Pass an absolute URL to
-     * point at a remote API directly.
-     */
-    apiUrl?: string;
-};
-/**
- * Build a delivery URL that applies `ops` to the file identified by `handle`.
- *
- * @example
- * transformUrl({
- *   handle: file.handle,
- *   ops: [resize({ w: 200, h: 200, fit: 'crop' }), output({ format: 'webp' })],
- * })
- * // => "/resize=w:200,h:200,fit:crop/output=format:webp/<handle>"
- */
-declare function transformUrl({ handle, ops, apiUrl }: TransformUrlOptions): string;
-/**
- * Append a signed read policy to a delivery/transform URL for accounts on the
- * `signed` delivery-protection tier (Private plan, docs/12).
- *
- * The `policy` + `signature` pair is produced SERVER-SIDE by the customer's
- * backend (HMAC over the account's api-key secret, via @uploader/shared). This
- * helper only assembles the URL — the SDK never signs and never sees the secret.
- *
- * @example
- *   const url = withSignedPolicy(
- *     transformUrl({ handle, ops: [resize({ w: 400 })], apiUrl }),
- *     { policy, signature }, // from your backend
- *   )
- */
-declare function withSignedPolicy(url: string, security: {
-    policy: string;
-    signature: string;
-}): string;
-
-export { type CropParams as C, type DeliveryProtection as D, type FileResult as F, type OutputParams as O, type PickerResponse as P, type QualityParams as Q, type ResizeParams as R, type TransformChain as T, type UploadAllOptions as U, type PolicySpec as a, type RotateParams as b, type TransformOp as c, type TransformOpName as d, type TransformUrlOptions as e, type UploadOptions as f, UploaderClient as g, type UploaderClientOptions as h, crop as i, flip as j, flop as k, rotate as l, output as o, quality as q, resize as r, transformUrl as t, withSignedPolicy as w };
+export { type DeliveryProtection as D, type FileResult as F, type PickerResponse as P, type UploadAllOptions as U, type PolicySpec as a, type UploadOptions as b, UploaderClient as c, type UploaderClientOptions as d };

package/dist/core.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/core/index.ts","../src/core/errors.ts","../src/core/chunk.ts","../src/core/client.ts","../src/core/transform.ts"],"sourcesContent":["/**\n * @uploader/react/core — headless client, no React dependency.\n *\n * Subpath export for environments that only need the upload engine.\n */\n\nexport { UploaderClient } from './client.js'\nexport { UploaderError } from './errors.js'\nexport { planChunks, MULTIPART_THRESHOLD, DEFAULT_CHUNK_SIZE } from './chunk.js'\nexport { resize, crop, rotate, flip, flop, quality, output, transformUrl, withSignedPolicy } from './transform.js'\nexport type { UploaderErrorCode } from './errors.js'\nexport type { ChunkPlan } from './chunk.js'\nexport type {\n  FileResult,\n  PickerResponse,\n  PolicySpec,\n  UploaderClientOptions,\n  UploadOptions,\n  UploadAllOptions,\n  DeliveryProtection,\n} from './types.js'\nexport type {\n  TransformOp,\n  TransformOpName,\n  TransformChain,\n  ResizeParams,\n  CropParams,\n  RotateParams,\n  QualityParams,\n  OutputParams,\n  TransformUrlOptions,\n} from './transform.js'\n","/**\n * Typed errors for UploaderClient.\n *\n * UploaderError is thrown by upload / uploadAll on any non-retried failure.\n * The caller can narrow on `err.code` for structured handling.\n */\n\nexport type UploaderErrorCode =\n  | 'ABORTED'          // AbortSignal fired\n  | 'NETWORK_ERROR'    // fetch() threw (no response)\n  | 'SERVER_ERROR'     // 5xx after all retries exhausted\n  | 'CLIENT_ERROR'     // 4xx (not retried)\n  | 'INVALID_RESPONSE' // response body did not match expected shape\n\nexport class UploaderError extends Error {\n  readonly code: UploaderErrorCode\n  /** HTTP status code when available (undefined for ABORTED / NETWORK_ERROR). */\n  readonly statusCode?: number\n\n  constructor(code: UploaderErrorCode, message: string, statusCode?: number) {\n    super(message)\n    this.name = 'UploaderError'\n    this.code = code\n    this.statusCode = statusCode\n  }\n}\n","/**\n * Chunk planner for multipart uploads.\n *\n * Decides single-shot vs multipart by comparing the file size against\n * MULTIPART_THRESHOLD. For multipart files, slices the Blob into parts of\n * `chunkSize` bytes.\n */\n\n/** Files ≤ this size use single-shot POST /api/store. */\nexport const MULTIPART_THRESHOLD = 5 * 1024 * 1024 // 5 MB\n\n/** Default part size for multipart uploads. */\nexport const DEFAULT_CHUNK_SIZE = 5 * 1024 * 1024 // 5 MB\n\nexport type ChunkPlan =\n  | { mode: 'single' }\n  | { mode: 'multipart'; parts: Blob[]; partSize: number }\n\n/**\n * Build a chunk plan for a file.\n *\n * @param file       The File or Blob to upload.\n * @param chunkSize  Desired part size in bytes (default DEFAULT_CHUNK_SIZE).\n * @returns          A plan describing whether to use single-shot or multipart.\n */\nexport function planChunks(file: File | Blob, chunkSize = DEFAULT_CHUNK_SIZE): ChunkPlan {\n  if (file.size <= MULTIPART_THRESHOLD) {\n    return { mode: 'single' }\n  }\n\n  const parts: Blob[] = []\n  let offset = 0\n  while (offset < file.size) {\n    parts.push(file.slice(offset, offset + chunkSize))\n    offset += chunkSize\n  }\n  return { mode: 'multipart', parts, partSize: chunkSize }\n}\n","/**\n * UploaderClient — headless upload client.\n *\n * Chooses single-shot (POST /api/store, multipart/form-data) vs multipart\n * (start/part/complete) based on file size relative to MULTIPART_THRESHOLD\n * (5 MB). Parts are retried individually with exponential backoff. Progress\n * is emitted as a 0–100 integer. AbortSignal cancels in-flight work.\n */\n\nimport type {\n  FileResult,\n  UploadStartResponse,\n  UploadPartResponse,\n  UploaderClientOptions,\n  UploadAllOptions,\n  UploadOptions,\n} from './types.js'\nimport { UploaderError } from './errors.js'\nimport { planChunks } from './chunk.js'\n\n// ─── Constants ────────────────────────────────────────────────────────────────\n\nconst MAX_RETRIES = 3\nconst RETRY_BASE_MS = 200\n\n/**\n * Single presigned PUT ceiling (mirrors the server's Phase-A limit). Files above\n * this fall back to the proxied multipart flow.\n */\nconst MAX_DIRECT_PUT_BYTES = 5 * 1024 * 1024 * 1024 // 5 GB\n\n/**\n * Skip the advisory client checksum above this size — SubtleCrypto has no\n * streaming API, so hashing would load the whole file into memory a second time.\n * The checksum is advisory only (the server can't verify it anyway).\n */\nconst SHA256_MAX_BYTES = 64 * 1024 * 1024 // 64 MB\n\n// ─── Internal helpers ─────────────────────────────────────────────────────────\n\n/** Sleep for `ms` milliseconds, resolving early if signal fires. */\nfunction sleep(ms: number, signal?: AbortSignal): Promise<void> {\n  return new Promise<void>((resolve, reject) => {\n    if (signal?.aborted) {\n      reject(new UploaderError('ABORTED', 'Upload aborted'))\n      return\n    }\n    const timer = setTimeout(resolve, ms)\n    signal?.addEventListener('abort', () => {\n      clearTimeout(timer)\n      reject(new UploaderError('ABORTED', 'Upload aborted'))\n    }, { once: true })\n  })\n}\n\n/** Throw UploaderError(ABORTED) if signal has already fired. */\nfunction checkAbort(signal?: AbortSignal): void {\n  if (signal?.aborted) {\n    throw new UploaderError('ABORTED', 'Upload aborted')\n  }\n}\n\n/**\n * Fetch with retry on network errors and 5xx responses.\n * 4xx responses are not retried — they surface immediately as CLIENT_ERROR.\n */\nasync function fetchWithRetry(\n  url: string,\n  init: RequestInit,\n  signal?: AbortSignal,\n  maxRetries = MAX_RETRIES,\n): Promise<Response> {\n  let lastErr: unknown\n  for (let attempt = 0; attempt < maxRetries; attempt++) {\n    checkAbort(signal)\n    try {\n      const res = await fetch(url, { ...init, signal })\n      if (res.status >= 400 && res.status < 500) {\n        // Client error — do not retry\n        const body = await res.text().catch(() => '')\n        throw new UploaderError(\n          'CLIENT_ERROR',\n          `HTTP ${res.status}: ${body}`,\n          res.status,\n        )\n      }\n      if (res.status >= 500) {\n        // Server error — retry with backoff\n        lastErr = new UploaderError(\n          'SERVER_ERROR',\n          `HTTP ${res.status}`,\n          res.status,\n        )\n        if (attempt < maxRetries - 1) {\n          await sleep(RETRY_BASE_MS * 2 ** attempt, signal)\n        }\n        continue\n      }\n      return res\n    } catch (err) {\n      if (err instanceof UploaderError) {\n        if (err.code === 'CLIENT_ERROR' || err.code === 'ABORTED') throw err\n        lastErr = err\n      } else {\n        // fetch() threw (network failure, CORS, etc.)\n        lastErr = new UploaderError(\n          'NETWORK_ERROR',\n          err instanceof Error ? err.message : String(err),\n        )\n      }\n      if (attempt < maxRetries - 1) {\n        await sleep(RETRY_BASE_MS * 2 ** attempt, signal)\n      }\n    }\n  }\n  throw lastErr\n}\n\n/**\n * Best-effort SHA-256 (hex) of a Blob for the advisory checksum sent at confirm.\n * Returns undefined when SubtleCrypto is unavailable (insecure context / older\n * runtime) or the file is large — never throws. The server treats this as a hint\n * only, so skipping it is safe.\n */\nasync function sha256Hex(blob: Blob): Promise<string | undefined> {\n  try {\n    const c = (globalThis as { crypto?: Crypto }).crypto\n    if (!c?.subtle || blob.size > SHA256_MAX_BYTES) return undefined\n    const digest = await c.subtle.digest('SHA-256', await blob.arrayBuffer())\n    return Array.from(new Uint8Array(digest))\n      .map((b) => b.toString(16).padStart(2, '0'))\n      .join('')\n  } catch {\n    return undefined\n  }\n}\n\n/**\n * PUT a body straight to a presigned bucket URL via XMLHttpRequest.\n *\n * XHR (not fetch) so real upload progress is reported (fetch cannot). The\n * Content-Type header MUST equal the value the server signed, or S3/R2 reject\n * the signature. Bytes go browser → bucket; our server never sees them.\n */\nfunction xhrPut(\n  url: string,\n  body: Blob,\n  opts: { contentType: string; onProgress?: (percent: number) => void; signal?: AbortSignal },\n): Promise<void> {\n  return new Promise<void>((resolve, reject) => {\n    if (opts.signal?.aborted) {\n      reject(new UploaderError('ABORTED', 'Upload aborted'))\n      return\n    }\n    const xhr = new XMLHttpRequest()\n    xhr.open('PUT', url)\n    xhr.setRequestHeader('Content-Type', opts.contentType)\n\n    if (opts.onProgress) {\n      xhr.upload.onprogress = (e: ProgressEvent) => {\n        if (e.lengthComputable) {\n          // Reserve the last 5% for the confirm round-trip.\n          opts.onProgress!(Math.round((e.loaded / e.total) * 95))\n        }\n      }\n    }\n    xhr.onload = () => {\n      if (xhr.status >= 200 && xhr.status < 300) {\n        resolve()\n      } else {\n        const code = xhr.status >= 400 && xhr.status < 500 ? 'CLIENT_ERROR' : 'SERVER_ERROR'\n        reject(new UploaderError(code, `Bucket PUT failed: HTTP ${xhr.status}`, xhr.status))\n      }\n    }\n    xhr.onerror = () => reject(new UploaderError('NETWORK_ERROR', 'Bucket PUT network error'))\n    xhr.onabort = () => reject(new UploaderError('ABORTED', 'Upload aborted'))\n\n    if (opts.signal) {\n      opts.signal.addEventListener('abort', () => xhr.abort(), { once: true })\n    }\n    xhr.send(body)\n  })\n}\n\n/** Shape returned by POST /api/uploads/presign. */\ntype PresignResponse = { handle: string; storageKey: string; putUrl: string; contentType: string }\n\n// ─── UploaderClient ────────────────────────────────────────────────────────────\n\nexport class UploaderClient {\n  readonly apikey: string\n  readonly apiUrl: string\n  readonly security: UploaderClientOptions['security']\n  readonly #directUploadOption?: boolean\n  /** Client-level default per-file delivery protection (docs/13). */\n  readonly #deliveryProtection?: UploaderClientOptions['deliveryProtection']\n  /** Client-level default per-file allowed origins (docs/13). */\n  readonly #allowedOrigins?: string[]\n\n  /** Memoized capability probe — one request per client, shared across uploads. */\n  #capsPromise: Promise<{ directUpload: boolean }> | null = null\n\n  constructor(options: UploaderClientOptions) {\n    this.apikey = options.apikey\n    this.apiUrl = (options.apiUrl ?? 'https://api.uploaderhq.io').replace(/\\/$/, '')\n    this.security = options.security\n    this.#directUploadOption = options.directUpload\n    this.#deliveryProtection = options.deliveryProtection\n    this.#allowedOrigins = options.allowedOrigins\n  }\n\n  /**\n   * Resolve the effective per-file protection for one upload: a per-upload value\n   * overrides the client-level default (docs/13). Returns an object carrying ONLY\n   * the keys that are set, so callers spread it into the request body and unset\n   * fields are omitted entirely — an old server ignores them and the file inherits\n   * the account mode (`null`).\n   */\n  #resolveProtection(opts: UploadOptions): {\n    deliveryProtection?: UploaderClientOptions['deliveryProtection']\n    allowedOrigins?: string[]\n  } {\n    const out: { deliveryProtection?: UploaderClientOptions['deliveryProtection']; allowedOrigins?: string[] } = {}\n    const mode = opts.deliveryProtection ?? this.#deliveryProtection\n    if (mode !== undefined) out.deliveryProtection = mode\n    const origins = opts.allowedOrigins ?? this.#allowedOrigins\n    if (origins !== undefined) out.allowedOrigins = origins\n    return out\n  }\n\n  // ─── Capability negotiation ─────────────────────────────────────────────────\n\n  /**\n   * Probe GET /api/capabilities once per client and cache the result. Fails OPEN\n   * to the proxied flow ({ directUpload: false }) on any error/timeout, so a\n   * flaky probe never blocks uploads and old servers (404) are handled.\n   */\n  #getCapabilities(): Promise<{ directUpload: boolean }> {\n    // Explicit opt-out — never probe, never use direct upload.\n    if (this.#directUploadOption === false) {\n      return Promise.resolve({ directUpload: false })\n    }\n    if (!this.#capsPromise) {\n      this.#capsPromise = fetch(`${this.apiUrl}/api/capabilities`, {\n        headers: this.#authHeaders(),\n      })\n        .then(async (res) => {\n          if (!res.ok) return { directUpload: false }\n          const body = (await res.json().catch(() => ({}))) as Record<string, unknown>\n          return { directUpload: body['directUpload'] === true }\n        })\n        .catch(() => ({ directUpload: false }))\n    }\n    return this.#capsPromise\n  }\n\n  // ─── Direct-to-bucket upload ────────────────────────────────────────────────\n\n  /**\n   * Presign → PUT-to-bucket → confirm. Bytes go browser → bucket directly; our\n   * server only signs and records. Used when the account has the directUpload\n   * capability and the file fits a single PUT.\n   */\n  async #uploadDirect(file: File | Blob, opts: UploadOptions): Promise<FileResult> {\n    const { onProgress, filename, signal } = opts\n    const name = filename ?? (file instanceof File ? file.name : 'upload')\n    // Must match the Content-Type we send on the PUT (the server signs it).\n    const contentType = file instanceof File && file.type ? file.type : 'application/octet-stream'\n\n    onProgress?.(0)\n    checkAbort(signal)\n\n    const protection = this.#resolveProtection(opts)\n    const presign = async (): Promise<PresignResponse> => {\n      const res = await fetchWithRetry(\n        `${this.apiUrl}/api/uploads/presign`,\n        {\n          method: 'POST',\n          headers: { ...this.#authHeaders(), 'Content-Type': 'application/json' },\n          body: JSON.stringify({ filename: name, contentType, size: file.size, ...protection }),\n        },\n        signal,\n      )\n      return (await res.json()) as PresignResponse\n    }\n\n    let signed = await presign()\n\n    // Advisory checksum (best-effort; unverifiable server-side).\n    const checksum = await sha256Hex(file)\n\n    // PUT straight to the bucket. A 403 means the short-lived signature lapsed\n    // (or a stale key) — re-presign once and retry before giving up.\n    try {\n      await xhrPut(signed.putUrl, file, { contentType: signed.contentType, onProgress, signal })\n    } catch (err) {\n      if (err instanceof UploaderError && err.statusCode === 403) {\n        signed = await presign()\n        await xhrPut(signed.putUrl, file, { contentType: signed.contentType, onProgress, signal })\n      } else {\n        throw err\n      }\n    }\n\n    // Confirm — server verifies the object exists, records usage, enqueues.\n    checkAbort(signal)\n    const confirmRes = await fetchWithRetry(\n      `${this.apiUrl}/api/uploads/confirm`,\n      {\n        method: 'POST',\n        headers: { ...this.#authHeaders(), 'Content-Type': 'application/json' },\n        body: JSON.stringify({ handle: signed.handle, checksum }),\n      },\n      signal,\n    )\n    const body = (await confirmRes.json()) as unknown\n    onProgress?.(100)\n    return this.#parseFileResult(body)\n  }\n\n  // ─── Auth headers ──────────────────────────────────────────────────────────\n\n  /**\n   * Build the auth headers shared by all requests.\n   * Attaches the API key and, when present, the signed policy pair.\n   */\n  #authHeaders(): Record<string, string> {\n    const headers: Record<string, string> = {\n      'X-Uploader-Key': this.apikey,\n    }\n    if (this.security) {\n      headers['X-Uploader-Policy'] = this.security.policy\n      headers['X-Uploader-Signature'] = this.security.signature\n    }\n    return headers\n  }\n\n  // ─── Single-shot upload ────────────────────────────────────────────────────\n\n  /**\n   * POST /api/store — multipart/form-data for files ≤ MULTIPART_THRESHOLD.\n   */\n  async #uploadSingleShot(\n    file: File | Blob,\n    opts: UploadOptions,\n  ): Promise<FileResult> {\n    const { onProgress, filename, signal } = opts\n\n    onProgress?.(0)\n    checkAbort(signal)\n\n    const form = new FormData()\n    form.append('file', file, filename ?? (file instanceof File ? file.name : 'upload'))\n    if (filename) form.append('filename', filename)\n    // Per-file delivery protection (docs/13) — sent as form fields; allowedOrigins\n    // is JSON-encoded to match the server's parse. Omitted when unset (inherit).\n    const protection = this.#resolveProtection(opts)\n    if (protection.deliveryProtection) form.append('deliveryProtection', protection.deliveryProtection)\n    if (protection.allowedOrigins) form.append('allowedOrigins', JSON.stringify(protection.allowedOrigins))\n\n    const res = await fetchWithRetry(\n      `${this.apiUrl}/api/store`,\n      {\n        method: 'POST',\n        headers: this.#authHeaders(),\n        body: form,\n      },\n      signal,\n    )\n\n    const body = await res.json() as unknown\n    onProgress?.(100)\n    return this.#parseFileResult(body)\n  }\n\n  // ─── Multipart upload ──────────────────────────────────────────────────────\n\n  /**\n   * start → parts (parallel with progress) → complete for files > MULTIPART_THRESHOLD.\n   */\n  async #uploadMultipart(\n    file: File | Blob,\n    parts: Blob[],\n    opts: UploadOptions,\n  ): Promise<FileResult> {\n    const { onProgress, filename, signal } = opts\n    const name = filename ?? (file instanceof File ? file.name : 'upload')\n    const mime = file instanceof File ? file.type : 'application/octet-stream'\n\n    onProgress?.(0)\n    checkAbort(signal)\n\n    // 1. Start\n    const protection = this.#resolveProtection(opts)\n    const startRes = await fetchWithRetry(\n      `${this.apiUrl}/api/upload/start`,\n      {\n        method: 'POST',\n        headers: { ...this.#authHeaders(), 'Content-Type': 'application/json' },\n        body: JSON.stringify({ filename: name, mimetype: mime, size: file.size, ...protection }),\n      },\n      signal,\n    )\n    const { uploadId } = await startRes.json() as UploadStartResponse\n\n    // 2. Upload parts sequentially (retried individually)\n    const etags: { partNumber: number; etag: string }[] = []\n    let uploadedBytes = 0\n\n    for (let i = 0; i < parts.length; i++) {\n      checkAbort(signal)\n      const partBlob = parts[i]!\n      const partNumber = i + 1\n\n      const partForm = new FormData()\n      partForm.append('uploadId', uploadId)\n      partForm.append('partNumber', String(partNumber))\n      partForm.append('part', partBlob)\n\n      const partRes = await fetchWithRetry(\n        `${this.apiUrl}/api/upload/part`,\n        {\n          method: 'POST',\n          headers: this.#authHeaders(),\n          body: partForm,\n        },\n        signal,\n      )\n      const { etag } = await partRes.json() as UploadPartResponse\n\n      etags.push({ partNumber, etag })\n      uploadedBytes += partBlob.size\n      onProgress?.(Math.round((uploadedBytes / file.size) * 95)) // reserve 5% for complete\n    }\n\n    // 3. Complete\n    checkAbort(signal)\n    const completeRes = await fetchWithRetry(\n      `${this.apiUrl}/api/upload/complete`,\n      {\n        method: 'POST',\n        headers: { ...this.#authHeaders(), 'Content-Type': 'application/json' },\n        body: JSON.stringify({ uploadId, parts: etags }),\n      },\n      signal,\n    )\n    const body = await completeRes.json() as unknown\n    onProgress?.(100)\n    return this.#parseFileResult(body)\n  }\n\n  // ─── Response parser ───────────────────────────────────────────────────────\n\n  #parseFileResult(body: unknown): FileResult {\n    if (\n      typeof body !== 'object' ||\n      body === null ||\n      typeof (body as Record<string, unknown>)['handle'] !== 'string' ||\n      typeof (body as Record<string, unknown>)['url'] !== 'string'\n    ) {\n      throw new UploaderError('INVALID_RESPONSE', 'Unexpected response shape from upload API')\n    }\n    return body as FileResult\n  }\n\n  // ─── Public API ───────────────────────────────────────────────────────────\n\n  /**\n   * Upload a single file.\n   *\n   * Automatically selects single-shot vs multipart upload based on file size.\n   * Emits progress via `opts.onProgress` (0–100). Respects `opts.signal` for\n   * cancellation. Retries network errors and 5xx responses up to 3 times with\n   * exponential backoff; 4xx errors are surfaced immediately.\n   *\n   * @throws {UploaderError} with code ABORTED | NETWORK_ERROR | SERVER_ERROR |\n   *   CLIENT_ERROR | INVALID_RESPONSE\n   */\n  async upload(\n    file: File | Blob,\n    opts: UploadOptions = {},\n  ): Promise<FileResult> {\n    // Prefer direct-to-bucket when the account supports it and the file fits a\n    // single PUT. The probe fails open, so an old server or a disabled account\n    // transparently uses the proxied flow below.\n    const caps = await this.#getCapabilities()\n    if (caps.directUpload && file.size <= MAX_DIRECT_PUT_BYTES) {\n      return this.#uploadDirect(file, opts)\n    }\n\n    const plan = planChunks(file, opts.chunkSize)\n    if (plan.mode === 'single') {\n      return this.#uploadSingleShot(file, opts)\n    }\n    return this.#uploadMultipart(file, plan.parts, opts)\n  }\n\n  /**\n   * Upload multiple files with concurrency limiting.\n   *\n   * Resolves once all uploads settle (fulfilled or rejected). The returned\n   * array preserves input order. `opts.concurrency` caps simultaneous\n   * in-flight uploads (default 3). Each file shares the same opts\n   * (including onProgress — the callback fires per-file, not aggregate).\n   *\n   * @returns Array of PromiseSettledResult in input order.\n   */\n  async uploadAll(\n    files: Array<File | Blob>,\n    opts: UploadAllOptions = {},\n  ): Promise<PromiseSettledResult<FileResult>[]> {\n    const concurrency = opts.concurrency ?? 3\n    const results: PromiseSettledResult<FileResult>[] = new Array(files.length)\n\n    let index = 0\n\n    async function worker(client: UploaderClient): Promise<void> {\n      while (index < files.length) {\n        const i = index++\n        const file = files[i]!\n        try {\n          results[i] = { status: 'fulfilled', value: await client.upload(file, opts) }\n        } catch (err) {\n          results[i] = { status: 'rejected', reason: err }\n        }\n      }\n    }\n\n    const workers = Array.from({ length: Math.min(concurrency, files.length) }, () =>\n      worker(this),\n    )\n    await Promise.all(workers)\n    return results\n  }\n}\n","/**\n * Delivery / transform URL builder.\n *\n * The API serves transformed derivatives at `GET /<chain>/<handle>`, where\n * <chain> is a slash-joined list of ops (e.g. `resize=w:200,h:200,fit:crop`).\n * These op builders + `transformUrl()` construct that URL from an uploaded file\n * handle, so consumers render an image at any size/format/quality without\n * hand-assembling URL strings.\n *\n * The op/param types and serialization mirror @uploader/shared EXACTLY — the\n * API's `parseTransformChain` is the other half of this contract, and\n * `contract.conformance.ts` asserts at typecheck time that they stay in sync.\n */\n\n// ─── Op vocabulary (mirrors @uploader/shared) ────────────────────────────────\n\nexport type TransformOpName =\n  | 'resize'\n  | 'crop'\n  | 'rotate'\n  | 'flip'\n  | 'flop'\n  | 'quality'\n  | 'output'\n\n/** Parameters for the resize operation. */\nexport type ResizeParams = {\n  w?: number\n  h?: number\n  fit?: 'cover' | 'contain' | 'fill' | 'inside' | 'outside' | 'crop'\n}\n\n/** Parameters for the crop operation. */\nexport type CropParams = {\n  /** \"x,y,w,h\" notation. */\n  dim: string\n  x?: number\n  y?: number\n  w?: number\n  h?: number\n}\n\n/** Parameters for the rotate operation. */\nexport type RotateParams = { deg: number }\n\n/** Parameters for the quality operation. */\nexport type QualityParams = { n: number }\n\n/** Parameters for the output operation. */\nexport type OutputParams = { format: string }\n\n/** A single transform operation with its typed params. */\nexport type TransformOp =\n  | { name: 'resize'; params: ResizeParams }\n  | { name: 'crop'; params: CropParams }\n  | { name: 'rotate'; params: RotateParams }\n  | { name: 'flip'; params: Record<string, never> }\n  | { name: 'flop'; params: Record<string, never> }\n  | { name: 'quality'; params: QualityParams }\n  | { name: 'output'; params: OutputParams }\n\n/** An ordered list of transform operations. */\nexport type TransformChain = { ops: TransformOp[] }\n\n// ─── Op builders ─────────────────────────────────────────────────────────────\n\n/** Resize to a width and/or height with an optional fit mode. */\nexport const resize = (params: ResizeParams): TransformOp => ({ name: 'resize', params })\n\n/** Crop a rectangular region: origin (x, y) and size w×h, in source pixels. */\nexport const crop = (rect: { x: number; y: number; w: number; h: number }): TransformOp => ({\n  name: 'crop',\n  params: { dim: `${rect.x},${rect.y},${rect.w},${rect.h}`, ...rect },\n})\n\n/** Rotate clockwise by `deg` degrees. */\nexport const rotate = (params: RotateParams): TransformOp => ({ name: 'rotate', params })\n\n/** Flip vertically (mirror top↔bottom). */\nexport const flip = (): TransformOp => ({ name: 'flip', params: {} })\n\n/** Flop horizontally (mirror left↔right). */\nexport const flop = (): TransformOp => ({ name: 'flop', params: {} })\n\n/** Set output quality 1–100 (ignored by lossless formats). */\nexport const quality = (params: QualityParams): TransformOp => ({ name: 'quality', params })\n\n/** Convert the output format, e.g. `{ format: 'webp' }`. */\nexport const output = (params: OutputParams): TransformOp => ({ name: 'output', params })\n\n// ─── Serialization (vendored from @uploader/shared, parser-compatible) ────────\n\nfunction serializeOp(op: TransformOp): string {\n  switch (op.name) {\n    case 'resize': {\n      const parts: string[] = []\n      if (op.params.w !== undefined) parts.push(`w:${op.params.w}`)\n      if (op.params.h !== undefined) parts.push(`h:${op.params.h}`)\n      if (op.params.fit !== undefined) parts.push(`fit:${op.params.fit}`)\n      return `resize=${parts.join(',')}`\n    }\n    case 'crop':\n      return `crop=dim:${op.params.dim}`\n    case 'rotate':\n      return `rotate=deg:${op.params.deg}`\n    case 'flip':\n      return 'flip'\n    case 'flop':\n      return 'flop'\n    case 'quality':\n      return `quality=n:${op.params.n}`\n    case 'output':\n      return `output=format:${op.params.format}`\n  }\n}\n\nexport type TransformUrlOptions = {\n  /** File handle from an upload (`FileResult.handle`). */\n  handle: string\n  /** Ordered transform ops to apply. Must contain at least one op. */\n  ops: TransformOp[]\n  /**\n   * Base API URL. Defaults to '' so the URL is relative — `/<chain>/<handle>` —\n   * and resolves same-origin (e.g. proxied to the API). Pass an absolute URL to\n   * point at a remote API directly.\n   */\n  apiUrl?: string\n}\n\n/**\n * Build a delivery URL that applies `ops` to the file identified by `handle`.\n *\n * @example\n * transformUrl({\n *   handle: file.handle,\n *   ops: [resize({ w: 200, h: 200, fit: 'crop' }), output({ format: 'webp' })],\n * })\n * // => \"/resize=w:200,h:200,fit:crop/output=format:webp/<handle>\"\n */\nexport function transformUrl({ handle, ops, apiUrl = '' }: TransformUrlOptions): string {\n  const base = apiUrl.replace(/\\/$/, '')\n  const chain = ops.map(serializeOp).join('/')\n  // The API's transform route requires at least one op segment before the\n  // handle; for the unmodified original, use FileResult.url instead.\n  return chain ? `${base}/${chain}/${handle}` : `${base}/${handle}`\n}\n\n/**\n * Append a signed read policy to a delivery/transform URL for accounts on the\n * `signed` delivery-protection tier (Private plan, docs/12).\n *\n * The `policy` + `signature` pair is produced SERVER-SIDE by the customer's\n * backend (HMAC over the account's api-key secret, via @uploader/shared). This\n * helper only assembles the URL — the SDK never signs and never sees the secret.\n *\n * @example\n *   const url = withSignedPolicy(\n *     transformUrl({ handle, ops: [resize({ w: 400 })], apiUrl }),\n *     { policy, signature }, // from your backend\n *   )\n */\nexport function withSignedPolicy(\n  url: string,\n  security: { policy: string; signature: string },\n): string {\n  const sep = url.includes('?') ? '&' : '?'\n  return `${url}${sep}policy=${encodeURIComponent(security.policy)}&signature=${encodeURIComponent(security.signature)}`\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACcO,IAAM,gBAAN,cAA4B,MAAM;AAAA,EAC9B;AAAA;AAAA,EAEA;AAAA,EAET,YAAY,MAAyB,SAAiB,YAAqB;AACzE,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,aAAa;AAAA,EACpB;AACF;;;AChBO,IAAM,sBAAsB,IAAI,OAAO;AAGvC,IAAM,qBAAqB,IAAI,OAAO;AAatC,SAAS,WAAW,MAAmB,YAAY,oBAA+B;AACvF,MAAI,KAAK,QAAQ,qBAAqB;AACpC,WAAO,EAAE,MAAM,SAAS;AAAA,EAC1B;AAEA,QAAM,QAAgB,CAAC;AACvB,MAAI,SAAS;AACb,SAAO,SAAS,KAAK,MAAM;AACzB,UAAM,KAAK,KAAK,MAAM,QAAQ,SAAS,SAAS,CAAC;AACjD,cAAU;AAAA,EACZ;AACA,SAAO,EAAE,MAAM,aAAa,OAAO,UAAU,UAAU;AACzD;;;ACfA,IAAM,cAAc;AACpB,IAAM,gBAAgB;AAMtB,IAAM,uBAAuB,IAAI,OAAO,OAAO;AAO/C,IAAM,mBAAmB,KAAK,OAAO;AAKrC,SAAS,MAAM,IAAY,QAAqC;AAC9D,SAAO,IAAI,QAAc,CAAC,SAAS,WAAW;AAC5C,QAAI,QAAQ,SAAS;AACnB,aAAO,IAAI,cAAc,WAAW,gBAAgB,CAAC;AACrD;AAAA,IACF;AACA,UAAM,QAAQ,WAAW,SAAS,EAAE;AACpC,YAAQ,iBAAiB,SAAS,MAAM;AACtC,mBAAa,KAAK;AAClB,aAAO,IAAI,cAAc,WAAW,gBAAgB,CAAC;AAAA,IACvD,GAAG,EAAE,MAAM,KAAK,CAAC;AAAA,EACnB,CAAC;AACH;AAGA,SAAS,WAAW,QAA4B;AAC9C,MAAI,QAAQ,SAAS;AACnB,UAAM,IAAI,cAAc,WAAW,gBAAgB;AAAA,EACrD;AACF;AAMA,eAAe,eACb,KACA,MACA,QACA,aAAa,aACM;AACnB,MAAI;AACJ,WAAS,UAAU,GAAG,UAAU,YAAY,WAAW;AACrD,eAAW,MAAM;AACjB,QAAI;AACF,YAAM,MAAM,MAAM,MAAM,KAAK,EAAE,GAAG,MAAM,OAAO,CAAC;AAChD,UAAI,IAAI,UAAU,OAAO,IAAI,SAAS,KAAK;AAEzC,cAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,EAAE;AAC5C,cAAM,IAAI;AAAA,UACR;AAAA,UACA,QAAQ,IAAI,MAAM,KAAK,IAAI;AAAA,UAC3B,IAAI;AAAA,QACN;AAAA,MACF;AACA,UAAI,IAAI,UAAU,KAAK;AAErB,kBAAU,IAAI;AAAA,UACZ;AAAA,UACA,QAAQ,IAAI,MAAM;AAAA,UAClB,IAAI;AAAA,QACN;AACA,YAAI,UAAU,aAAa,GAAG;AAC5B,gBAAM,MAAM,gBAAgB,KAAK,SAAS,MAAM;AAAA,QAClD;AACA;AAAA,MACF;AACA,aAAO;AAAA,IACT,SAAS,KAAK;AACZ,UAAI,eAAe,eAAe;AAChC,YAAI,IAAI,SAAS,kBAAkB,IAAI,SAAS,UAAW,OAAM;AACjE,kBAAU;AAAA,MACZ,OAAO;AAEL,kBAAU,IAAI;AAAA,UACZ;AAAA,UACA,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,QACjD;AAAA,MACF;AACA,UAAI,UAAU,aAAa,GAAG;AAC5B,cAAM,MAAM,gBAAgB,KAAK,SAAS,MAAM;AAAA,MAClD;AAAA,IACF;AAAA,EACF;AACA,QAAM;AACR;AAQA,eAAe,UAAU,MAAyC;AAChE,MAAI;AACF,UAAM,IAAK,WAAmC;AAC9C,QAAI,CAAC,GAAG,UAAU,KAAK,OAAO,iBAAkB,QAAO;AACvD,UAAM,SAAS,MAAM,EAAE,OAAO,OAAO,WAAW,MAAM,KAAK,YAAY,CAAC;AACxE,WAAO,MAAM,KAAK,IAAI,WAAW,MAAM,CAAC,EACrC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAC1C,KAAK,EAAE;AAAA,EACZ,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AASA,SAAS,OACP,KACA,MACA,MACe;AACf,SAAO,IAAI,QAAc,CAAC,SAAS,WAAW;AAC5C,QAAI,KAAK,QAAQ,SAAS;AACxB,aAAO,IAAI,cAAc,WAAW,gBAAgB,CAAC;AACrD;AAAA,IACF;AACA,UAAM,MAAM,IAAI,eAAe;AAC/B,QAAI,KAAK,OAAO,GAAG;AACnB,QAAI,iBAAiB,gBAAgB,KAAK,WAAW;AAErD,QAAI,KAAK,YAAY;AACnB,UAAI,OAAO,aAAa,CAAC,MAAqB;AAC5C,YAAI,EAAE,kBAAkB;AAEtB,eAAK,WAAY,KAAK,MAAO,EAAE,SAAS,EAAE,QAAS,EAAE,CAAC;AAAA,QACxD;AAAA,MACF;AAAA,IACF;AACA,QAAI,SAAS,MAAM;AACjB,UAAI,IAAI,UAAU,OAAO,IAAI,SAAS,KAAK;AACzC,gBAAQ;AAAA,MACV,OAAO;AACL,cAAM,OAAO,IAAI,UAAU,OAAO,IAAI,SAAS,MAAM,iBAAiB;AACtE,eAAO,IAAI,cAAc,MAAM,2BAA2B,IAAI,MAAM,IAAI,IAAI,MAAM,CAAC;AAAA,MACrF;AAAA,IACF;AACA,QAAI,UAAU,MAAM,OAAO,IAAI,cAAc,iBAAiB,0BAA0B,CAAC;AACzF,QAAI,UAAU,MAAM,OAAO,IAAI,cAAc,WAAW,gBAAgB,CAAC;AAEzE,QAAI,KAAK,QAAQ;AACf,WAAK,OAAO,iBAAiB,SAAS,MAAM,IAAI,MAAM,GAAG,EAAE,MAAM,KAAK,CAAC;AAAA,IACzE;AACA,QAAI,KAAK,IAAI;AAAA,EACf,CAAC;AACH;AAOO,IAAM,iBAAN,MAAqB;AAAA,EACjB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA;AAAA,EAGT,eAA0D;AAAA,EAE1D,YAAY,SAAgC;AAC1C,SAAK,SAAS,QAAQ;AACtB,SAAK,UAAU,QAAQ,UAAU,6BAA6B,QAAQ,OAAO,EAAE;AAC/E,SAAK,WAAW,QAAQ;AACxB,SAAK,sBAAsB,QAAQ;AACnC,SAAK,sBAAsB,QAAQ;AACnC,SAAK,kBAAkB,QAAQ;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,mBAAmB,MAGjB;AACA,UAAM,MAAuG,CAAC;AAC9G,UAAM,OAAO,KAAK,sBAAsB,KAAK;AAC7C,QAAI,SAAS,OAAW,KAAI,qBAAqB;AACjD,UAAM,UAAU,KAAK,kBAAkB,KAAK;AAC5C,QAAI,YAAY,OAAW,KAAI,iBAAiB;AAChD,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,mBAAuD;AAErD,QAAI,KAAK,wBAAwB,OAAO;AACtC,aAAO,QAAQ,QAAQ,EAAE,cAAc,MAAM,CAAC;AAAA,IAChD;AACA,QAAI,CAAC,KAAK,cAAc;AACtB,WAAK,eAAe,MAAM,GAAG,KAAK,MAAM,qBAAqB;AAAA,QAC3D,SAAS,KAAK,aAAa;AAAA,MAC7B,CAAC,EACE,KAAK,OAAO,QAAQ;AACnB,YAAI,CAAC,IAAI,GAAI,QAAO,EAAE,cAAc,MAAM;AAC1C,cAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC/C,eAAO,EAAE,cAAc,KAAK,cAAc,MAAM,KAAK;AAAA,MACvD,CAAC,EACA,MAAM,OAAO,EAAE,cAAc,MAAM,EAAE;AAAA,IAC1C;AACA,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,cAAc,MAAmB,MAA0C;AAC/E,UAAM,EAAE,YAAY,UAAU,OAAO,IAAI;AACzC,UAAM,OAAO,aAAa,gBAAgB,OAAO,KAAK,OAAO;AAE7D,UAAM,cAAc,gBAAgB,QAAQ,KAAK,OAAO,KAAK,OAAO;AAEpE,iBAAa,CAAC;AACd,eAAW,MAAM;AAEjB,UAAM,aAAa,KAAK,mBAAmB,IAAI;AAC/C,UAAM,UAAU,YAAsC;AACpD,YAAM,MAAM,MAAM;AAAA,QAChB,GAAG,KAAK,MAAM;AAAA,QACd;AAAA,UACE,QAAQ;AAAA,UACR,SAAS,EAAE,GAAG,KAAK,aAAa,GAAG,gBAAgB,mBAAmB;AAAA,UACtE,MAAM,KAAK,UAAU,EAAE,UAAU,MAAM,aAAa,MAAM,KAAK,MAAM,GAAG,WAAW,CAAC;AAAA,QACtF;AAAA,QACA;AAAA,MACF;AACA,aAAQ,MAAM,IAAI,KAAK;AAAA,IACzB;AAEA,QAAI,SAAS,MAAM,QAAQ;AAG3B,UAAM,WAAW,MAAM,UAAU,IAAI;AAIrC,QAAI;AACF,YAAM,OAAO,OAAO,QAAQ,MAAM,EAAE,aAAa,OAAO,aAAa,YAAY,OAAO,CAAC;AAAA,IAC3F,SAAS,KAAK;AACZ,UAAI,eAAe,iBAAiB,IAAI,eAAe,KAAK;AAC1D,iBAAS,MAAM,QAAQ;AACvB,cAAM,OAAO,OAAO,QAAQ,MAAM,EAAE,aAAa,OAAO,aAAa,YAAY,OAAO,CAAC;AAAA,MAC3F,OAAO;AACL,cAAM;AAAA,MACR;AAAA,IACF;AAGA,eAAW,MAAM;AACjB,UAAM,aAAa,MAAM;AAAA,MACvB,GAAG,KAAK,MAAM;AAAA,MACd;AAAA,QACE,QAAQ;AAAA,QACR,SAAS,EAAE,GAAG,KAAK,aAAa,GAAG,gBAAgB,mBAAmB;AAAA,QACtE,MAAM,KAAK,UAAU,EAAE,QAAQ,OAAO,QAAQ,SAAS,CAAC;AAAA,MAC1D;AAAA,MACA;AAAA,IACF;AACA,UAAM,OAAQ,MAAM,WAAW,KAAK;AACpC,iBAAa,GAAG;AAChB,WAAO,KAAK,iBAAiB,IAAI;AAAA,EACnC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,eAAuC;AACrC,UAAM,UAAkC;AAAA,MACtC,kBAAkB,KAAK;AAAA,IACzB;AACA,QAAI,KAAK,UAAU;AACjB,cAAQ,mBAAmB,IAAI,KAAK,SAAS;AAC7C,cAAQ,sBAAsB,IAAI,KAAK,SAAS;AAAA,IAClD;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,kBACJ,MACA,MACqB;AACrB,UAAM,EAAE,YAAY,UAAU,OAAO,IAAI;AAEzC,iBAAa,CAAC;AACd,eAAW,MAAM;AAEjB,UAAM,OAAO,IAAI,SAAS;AAC1B,SAAK,OAAO,QAAQ,MAAM,aAAa,gBAAgB,OAAO,KAAK,OAAO,SAAS;AACnF,QAAI,SAAU,MAAK,OAAO,YAAY,QAAQ;AAG9C,UAAM,aAAa,KAAK,mBAAmB,IAAI;AAC/C,QAAI,WAAW,mBAAoB,MAAK,OAAO,sBAAsB,WAAW,kBAAkB;AAClG,QAAI,WAAW,eAAgB,MAAK,OAAO,kBAAkB,KAAK,UAAU,WAAW,cAAc,CAAC;AAEtG,UAAM,MAAM,MAAM;AAAA,MAChB,GAAG,KAAK,MAAM;AAAA,MACd;AAAA,QACE,QAAQ;AAAA,QACR,SAAS,KAAK,aAAa;AAAA,QAC3B,MAAM;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAEA,UAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,iBAAa,GAAG;AAChB,WAAO,KAAK,iBAAiB,IAAI;AAAA,EACnC;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,iBACJ,MACA,OACA,MACqB;AACrB,UAAM,EAAE,YAAY,UAAU,OAAO,IAAI;AACzC,UAAM,OAAO,aAAa,gBAAgB,OAAO,KAAK,OAAO;AAC7D,UAAM,OAAO,gBAAgB,OAAO,KAAK,OAAO;AAEhD,iBAAa,CAAC;AACd,eAAW,MAAM;AAGjB,UAAM,aAAa,KAAK,mBAAmB,IAAI;AAC/C,UAAM,WAAW,MAAM;AAAA,MACrB,GAAG,KAAK,MAAM;AAAA,MACd;AAAA,QACE,QAAQ;AAAA,QACR,SAAS,EAAE,GAAG,KAAK,aAAa,GAAG,gBAAgB,mBAAmB;AAAA,QACtE,MAAM,KAAK,UAAU,EAAE,UAAU,MAAM,UAAU,MAAM,MAAM,KAAK,MAAM,GAAG,WAAW,CAAC;AAAA,MACzF;AAAA,MACA;AAAA,IACF;AACA,UAAM,EAAE,SAAS,IAAI,MAAM,SAAS,KAAK;AAGzC,UAAM,QAAgD,CAAC;AACvD,QAAI,gBAAgB;AAEpB,aAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,iBAAW,MAAM;AACjB,YAAM,WAAW,MAAM,CAAC;AACxB,YAAM,aAAa,IAAI;AAEvB,YAAM,WAAW,IAAI,SAAS;AAC9B,eAAS,OAAO,YAAY,QAAQ;AACpC,eAAS,OAAO,cAAc,OAAO,UAAU,CAAC;AAChD,eAAS,OAAO,QAAQ,QAAQ;AAEhC,YAAM,UAAU,MAAM;AAAA,QACpB,GAAG,KAAK,MAAM;AAAA,QACd;AAAA,UACE,QAAQ;AAAA,UACR,SAAS,KAAK,aAAa;AAAA,UAC3B,MAAM;AAAA,QACR;AAAA,QACA;AAAA,MACF;AACA,YAAM,EAAE,KAAK,IAAI,MAAM,QAAQ,KAAK;AAEpC,YAAM,KAAK,EAAE,YAAY,KAAK,CAAC;AAC/B,uBAAiB,SAAS;AAC1B,mBAAa,KAAK,MAAO,gBAAgB,KAAK,OAAQ,EAAE,CAAC;AAAA,IAC3D;AAGA,eAAW,MAAM;AACjB,UAAM,cAAc,MAAM;AAAA,MACxB,GAAG,KAAK,MAAM;AAAA,MACd;AAAA,QACE,QAAQ;AAAA,QACR,SAAS,EAAE,GAAG,KAAK,aAAa,GAAG,gBAAgB,mBAAmB;AAAA,QACtE,MAAM,KAAK,UAAU,EAAE,UAAU,OAAO,MAAM,CAAC;AAAA,MACjD;AAAA,MACA;AAAA,IACF;AACA,UAAM,OAAO,MAAM,YAAY,KAAK;AACpC,iBAAa,GAAG;AAChB,WAAO,KAAK,iBAAiB,IAAI;AAAA,EACnC;AAAA;AAAA,EAIA,iBAAiB,MAA2B;AAC1C,QACE,OAAO,SAAS,YAChB,SAAS,QACT,OAAQ,KAAiC,QAAQ,MAAM,YACvD,OAAQ,KAAiC,KAAK,MAAM,UACpD;AACA,YAAM,IAAI,cAAc,oBAAoB,2CAA2C;AAAA,IACzF;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,OACJ,MACA,OAAsB,CAAC,GACF;AAIrB,UAAM,OAAO,MAAM,KAAK,iBAAiB;AACzC,QAAI,KAAK,gBAAgB,KAAK,QAAQ,sBAAsB;AAC1D,aAAO,KAAK,cAAc,MAAM,IAAI;AAAA,IACtC;AAEA,UAAM,OAAO,WAAW,MAAM,KAAK,SAAS;AAC5C,QAAI,KAAK,SAAS,UAAU;AAC1B,aAAO,KAAK,kBAAkB,MAAM,IAAI;AAAA,IAC1C;AACA,WAAO,KAAK,iBAAiB,MAAM,KAAK,OAAO,IAAI;AAAA,EACrD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,UACJ,OACA,OAAyB,CAAC,GACmB;AAC7C,UAAM,cAAc,KAAK,eAAe;AACxC,UAAM,UAA8C,IAAI,MAAM,MAAM,MAAM;AAE1E,QAAI,QAAQ;AAEZ,mBAAe,OAAO,QAAuC;AAC3D,aAAO,QAAQ,MAAM,QAAQ;AAC3B,cAAM,IAAI;AACV,cAAM,OAAO,MAAM,CAAC;AACpB,YAAI;AACF,kBAAQ,CAAC,IAAI,EAAE,QAAQ,aAAa,OAAO,MAAM,OAAO,OAAO,MAAM,IAAI,EAAE;AAAA,QAC7E,SAAS,KAAK;AACZ,kBAAQ,CAAC,IAAI,EAAE,QAAQ,YAAY,QAAQ,IAAI;AAAA,QACjD;AAAA,MACF;AAAA,IACF;AAEA,UAAM,UAAU,MAAM;AAAA,MAAK,EAAE,QAAQ,KAAK,IAAI,aAAa,MAAM,MAAM,EAAE;AAAA,MAAG,MAC1E,OAAO,IAAI;AAAA,IACb;AACA,UAAM,QAAQ,IAAI,OAAO;AACzB,WAAO;AAAA,EACT;AACF;;;ACndO,IAAM,SAAS,CAAC,YAAuC,EAAE,MAAM,UAAU,OAAO;AAGhF,IAAM,OAAO,CAAC,UAAuE;AAAA,EAC1F,MAAM;AAAA,EACN,QAAQ,EAAE,KAAK,GAAG,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,GAAG,KAAK;AACpE;AAGO,IAAM,SAAS,CAAC,YAAuC,EAAE,MAAM,UAAU,OAAO;AAGhF,IAAM,OAAO,OAAoB,EAAE,MAAM,QAAQ,QAAQ,CAAC,EAAE;AAG5D,IAAM,OAAO,OAAoB,EAAE,MAAM,QAAQ,QAAQ,CAAC,EAAE;AAG5D,IAAM,UAAU,CAAC,YAAwC,EAAE,MAAM,WAAW,OAAO;AAGnF,IAAM,SAAS,CAAC,YAAuC,EAAE,MAAM,UAAU,OAAO;AAIvF,SAAS,YAAY,IAAyB;AAC5C,UAAQ,GAAG,MAAM;AAAA,IACf,KAAK,UAAU;AACb,YAAM,QAAkB,CAAC;AACzB,UAAI,GAAG,OAAO,MAAM,OAAW,OAAM,KAAK,KAAK,GAAG,OAAO,CAAC,EAAE;AAC5D,UAAI,GAAG,OAAO,MAAM,OAAW,OAAM,KAAK,KAAK,GAAG,OAAO,CAAC,EAAE;AAC5D,UAAI,GAAG,OAAO,QAAQ,OAAW,OAAM,KAAK,OAAO,GAAG,OAAO,GAAG,EAAE;AAClE,aAAO,UAAU,MAAM,KAAK,GAAG,CAAC;AAAA,IAClC;AAAA,IACA,KAAK;AACH,aAAO,YAAY,GAAG,OAAO,GAAG;AAAA,IAClC,KAAK;AACH,aAAO,cAAc,GAAG,OAAO,GAAG;AAAA,IACpC,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO,aAAa,GAAG,OAAO,CAAC;AAAA,IACjC,KAAK;AACH,aAAO,iBAAiB,GAAG,OAAO,MAAM;AAAA,EAC5C;AACF;AAyBO,SAAS,aAAa,EAAE,QAAQ,KAAK,SAAS,GAAG,GAAgC;AACtF,QAAM,OAAO,OAAO,QAAQ,OAAO,EAAE;AACrC,QAAM,QAAQ,IAAI,IAAI,WAAW,EAAE,KAAK,GAAG;AAG3C,SAAO,QAAQ,GAAG,IAAI,IAAI,KAAK,IAAI,MAAM,KAAK,GAAG,IAAI,IAAI,MAAM;AACjE;AAgBO,SAAS,iBACd,KACA,UACQ;AACR,QAAM,MAAM,IAAI,SAAS,GAAG,IAAI,MAAM;AACtC,SAAO,GAAG,GAAG,GAAG,GAAG,UAAU,mBAAmB,SAAS,MAAM,CAAC,cAAc,mBAAmB,SAAS,SAAS,CAAC;AACtH;","names":[]}
+{"version":3,"sources":["../src/core/index.ts","../src/core/errors.ts","../src/core/chunk.ts","../src/core/client.ts","../src/core/transform.ts"],"sourcesContent":["/**\n * @ibanzajoe/uploader/core — headless client, no React dependency.\n *\n * Subpath export for environments that only need the upload engine.\n */\n\nexport { UploaderClient } from './client.js'\nexport { UploaderError } from './errors.js'\nexport { planChunks, MULTIPART_THRESHOLD, DEFAULT_CHUNK_SIZE } from './chunk.js'\nexport { resize, crop, rotate, flip, flop, quality, output, transformUrl, withSignedPolicy } from './transform.js'\nexport type { UploaderErrorCode } from './errors.js'\nexport type { ChunkPlan } from './chunk.js'\nexport type {\n  FileResult,\n  PickerResponse,\n  PolicySpec,\n  UploaderClientOptions,\n  UploadOptions,\n  UploadAllOptions,\n  DeliveryProtection,\n} from './types.js'\nexport type {\n  TransformOp,\n  TransformOpName,\n  TransformChain,\n  ResizeParams,\n  CropParams,\n  RotateParams,\n  QualityParams,\n  OutputParams,\n  TransformUrlOptions,\n} from './transform.js'\n","/**\n * Typed errors for UploaderClient.\n *\n * UploaderError is thrown by upload / uploadAll on any non-retried failure.\n * The caller can narrow on `err.code` for structured handling.\n */\n\nexport type UploaderErrorCode =\n  | 'ABORTED'          // AbortSignal fired\n  | 'NETWORK_ERROR'    // fetch() threw (no response)\n  | 'SERVER_ERROR'     // 5xx after all retries exhausted\n  | 'CLIENT_ERROR'     // 4xx (not retried)\n  | 'INVALID_RESPONSE' // response body did not match expected shape\n\nexport class UploaderError extends Error {\n  readonly code: UploaderErrorCode\n  /** HTTP status code when available (undefined for ABORTED / NETWORK_ERROR). */\n  readonly statusCode?: number\n\n  constructor(code: UploaderErrorCode, message: string, statusCode?: number) {\n    super(message)\n    this.name = 'UploaderError'\n    this.code = code\n    this.statusCode = statusCode\n  }\n}\n","/**\n * Chunk planner for multipart uploads.\n *\n * Decides single-shot vs multipart by comparing the file size against\n * MULTIPART_THRESHOLD. For multipart files, slices the Blob into parts of\n * `chunkSize` bytes.\n */\n\n/** Files ≤ this size use single-shot POST /api/store. */\nexport const MULTIPART_THRESHOLD = 5 * 1024 * 1024 // 5 MB\n\n/** Default part size for multipart uploads. */\nexport const DEFAULT_CHUNK_SIZE = 5 * 1024 * 1024 // 5 MB\n\nexport type ChunkPlan =\n  | { mode: 'single' }\n  | { mode: 'multipart'; parts: Blob[]; partSize: number }\n\n/**\n * Build a chunk plan for a file.\n *\n * @param file       The File or Blob to upload.\n * @param chunkSize  Desired part size in bytes (default DEFAULT_CHUNK_SIZE).\n * @returns          A plan describing whether to use single-shot or multipart.\n */\nexport function planChunks(file: File | Blob, chunkSize = DEFAULT_CHUNK_SIZE): ChunkPlan {\n  if (file.size <= MULTIPART_THRESHOLD) {\n    return { mode: 'single' }\n  }\n\n  const parts: Blob[] = []\n  let offset = 0\n  while (offset < file.size) {\n    parts.push(file.slice(offset, offset + chunkSize))\n    offset += chunkSize\n  }\n  return { mode: 'multipart', parts, partSize: chunkSize }\n}\n","/**\n * UploaderClient — headless upload client.\n *\n * Chooses single-shot (POST /api/store, multipart/form-data) vs multipart\n * (start/part/complete) based on file size relative to MULTIPART_THRESHOLD\n * (5 MB). Parts are retried individually with exponential backoff. Progress\n * is emitted as a 0–100 integer. AbortSignal cancels in-flight work.\n */\n\nimport type {\n  FileResult,\n  UploadStartResponse,\n  UploadPartResponse,\n  UploaderClientOptions,\n  UploadAllOptions,\n  UploadOptions,\n} from './types.js'\nimport { UploaderError } from './errors.js'\nimport { planChunks } from './chunk.js'\n\n// ─── Constants ────────────────────────────────────────────────────────────────\n\nconst MAX_RETRIES = 3\nconst RETRY_BASE_MS = 200\n\n/**\n * Single presigned PUT ceiling (mirrors the server's Phase-A limit). Files above\n * this fall back to the proxied multipart flow.\n */\nconst MAX_DIRECT_PUT_BYTES = 5 * 1024 * 1024 * 1024 // 5 GB\n\n/**\n * Skip the advisory client checksum above this size — SubtleCrypto has no\n * streaming API, so hashing would load the whole file into memory a second time.\n * The checksum is advisory only (the server can't verify it anyway).\n */\nconst SHA256_MAX_BYTES = 64 * 1024 * 1024 // 64 MB\n\n// ─── Internal helpers ─────────────────────────────────────────────────────────\n\n/** Sleep for `ms` milliseconds, resolving early if signal fires. */\nfunction sleep(ms: number, signal?: AbortSignal): Promise<void> {\n  return new Promise<void>((resolve, reject) => {\n    if (signal?.aborted) {\n      reject(new UploaderError('ABORTED', 'Upload aborted'))\n      return\n    }\n    const timer = setTimeout(resolve, ms)\n    signal?.addEventListener('abort', () => {\n      clearTimeout(timer)\n      reject(new UploaderError('ABORTED', 'Upload aborted'))\n    }, { once: true })\n  })\n}\n\n/** Throw UploaderError(ABORTED) if signal has already fired. */\nfunction checkAbort(signal?: AbortSignal): void {\n  if (signal?.aborted) {\n    throw new UploaderError('ABORTED', 'Upload aborted')\n  }\n}\n\n/**\n * Fetch with retry on network errors and 5xx responses.\n * 4xx responses are not retried — they surface immediately as CLIENT_ERROR.\n */\nasync function fetchWithRetry(\n  url: string,\n  init: RequestInit,\n  signal?: AbortSignal,\n  maxRetries = MAX_RETRIES,\n): Promise<Response> {\n  let lastErr: unknown\n  for (let attempt = 0; attempt < maxRetries; attempt++) {\n    checkAbort(signal)\n    try {\n      const res = await fetch(url, { ...init, signal })\n      if (res.status >= 400 && res.status < 500) {\n        // Client error — do not retry\n        const body = await res.text().catch(() => '')\n        throw new UploaderError(\n          'CLIENT_ERROR',\n          `HTTP ${res.status}: ${body}`,\n          res.status,\n        )\n      }\n      if (res.status >= 500) {\n        // Server error — retry with backoff\n        lastErr = new UploaderError(\n          'SERVER_ERROR',\n          `HTTP ${res.status}`,\n          res.status,\n        )\n        if (attempt < maxRetries - 1) {\n          await sleep(RETRY_BASE_MS * 2 ** attempt, signal)\n        }\n        continue\n      }\n      return res\n    } catch (err) {\n      if (err instanceof UploaderError) {\n        if (err.code === 'CLIENT_ERROR' || err.code === 'ABORTED') throw err\n        lastErr = err\n      } else {\n        // fetch() threw (network failure, CORS, etc.)\n        lastErr = new UploaderError(\n          'NETWORK_ERROR',\n          err instanceof Error ? err.message : String(err),\n        )\n      }\n      if (attempt < maxRetries - 1) {\n        await sleep(RETRY_BASE_MS * 2 ** attempt, signal)\n      }\n    }\n  }\n  throw lastErr\n}\n\n/**\n * Best-effort SHA-256 (hex) of a Blob for the advisory checksum sent at confirm.\n * Returns undefined when SubtleCrypto is unavailable (insecure context / older\n * runtime) or the file is large — never throws. The server treats this as a hint\n * only, so skipping it is safe.\n */\nasync function sha256Hex(blob: Blob): Promise<string | undefined> {\n  try {\n    const c = (globalThis as { crypto?: Crypto }).crypto\n    if (!c?.subtle || blob.size > SHA256_MAX_BYTES) return undefined\n    const digest = await c.subtle.digest('SHA-256', await blob.arrayBuffer())\n    return Array.from(new Uint8Array(digest))\n      .map((b) => b.toString(16).padStart(2, '0'))\n      .join('')\n  } catch {\n    return undefined\n  }\n}\n\n/**\n * PUT a body straight to a presigned bucket URL via XMLHttpRequest.\n *\n * XHR (not fetch) so real upload progress is reported (fetch cannot). The\n * Content-Type header MUST equal the value the server signed, or S3/R2 reject\n * the signature. Bytes go browser → bucket; our server never sees them.\n */\nfunction xhrPut(\n  url: string,\n  body: Blob,\n  opts: { contentType: string; onProgress?: (percent: number) => void; signal?: AbortSignal },\n): Promise<void> {\n  return new Promise<void>((resolve, reject) => {\n    if (opts.signal?.aborted) {\n      reject(new UploaderError('ABORTED', 'Upload aborted'))\n      return\n    }\n    const xhr = new XMLHttpRequest()\n    xhr.open('PUT', url)\n    xhr.setRequestHeader('Content-Type', opts.contentType)\n\n    if (opts.onProgress) {\n      xhr.upload.onprogress = (e: ProgressEvent) => {\n        if (e.lengthComputable) {\n          // Reserve the last 5% for the confirm round-trip.\n          opts.onProgress!(Math.round((e.loaded / e.total) * 95))\n        }\n      }\n    }\n    xhr.onload = () => {\n      if (xhr.status >= 200 && xhr.status < 300) {\n        resolve()\n      } else {\n        const code = xhr.status >= 400 && xhr.status < 500 ? 'CLIENT_ERROR' : 'SERVER_ERROR'\n        reject(new UploaderError(code, `Bucket PUT failed: HTTP ${xhr.status}`, xhr.status))\n      }\n    }\n    xhr.onerror = () => reject(new UploaderError('NETWORK_ERROR', 'Bucket PUT network error'))\n    xhr.onabort = () => reject(new UploaderError('ABORTED', 'Upload aborted'))\n\n    if (opts.signal) {\n      opts.signal.addEventListener('abort', () => xhr.abort(), { once: true })\n    }\n    xhr.send(body)\n  })\n}\n\n/** Shape returned by POST /api/uploads/presign. */\ntype PresignResponse = { handle: string; storageKey: string; putUrl: string; contentType: string }\n\n// ─── UploaderClient ────────────────────────────────────────────────────────────\n\nexport class UploaderClient {\n  readonly apikey: string\n  readonly apiUrl: string\n  readonly security: UploaderClientOptions['security']\n  readonly #directUploadOption?: boolean\n  /** Client-level default per-file delivery protection (docs/13). */\n  readonly #deliveryProtection?: UploaderClientOptions['deliveryProtection']\n  /** Client-level default per-file allowed origins (docs/13). */\n  readonly #allowedOrigins?: string[]\n\n  /** Memoized capability probe — one request per client, shared across uploads. */\n  #capsPromise: Promise<{ directUpload: boolean }> | null = null\n\n  constructor(options: UploaderClientOptions) {\n    this.apikey = options.apikey\n    this.apiUrl = (options.apiUrl ?? 'https://api.uploaderhq.io').replace(/\\/$/, '')\n    this.security = options.security\n    this.#directUploadOption = options.directUpload\n    this.#deliveryProtection = options.deliveryProtection\n    this.#allowedOrigins = options.allowedOrigins\n  }\n\n  /**\n   * Resolve the effective per-file protection for one upload: a per-upload value\n   * overrides the client-level default (docs/13). Returns an object carrying ONLY\n   * the keys that are set, so callers spread it into the request body and unset\n   * fields are omitted entirely — an old server ignores them and the file inherits\n   * the account mode (`null`).\n   */\n  #resolveProtection(opts: UploadOptions): {\n    deliveryProtection?: UploaderClientOptions['deliveryProtection']\n    allowedOrigins?: string[]\n  } {\n    const out: { deliveryProtection?: UploaderClientOptions['deliveryProtection']; allowedOrigins?: string[] } = {}\n    const mode = opts.deliveryProtection ?? this.#deliveryProtection\n    if (mode !== undefined) out.deliveryProtection = mode\n    const origins = opts.allowedOrigins ?? this.#allowedOrigins\n    if (origins !== undefined) out.allowedOrigins = origins\n    return out\n  }\n\n  // ─── Capability negotiation ─────────────────────────────────────────────────\n\n  /**\n   * Probe GET /api/capabilities once per client and cache the result. Fails OPEN\n   * to the proxied flow ({ directUpload: false }) on any error/timeout, so a\n   * flaky probe never blocks uploads and old servers (404) are handled.\n   */\n  #getCapabilities(): Promise<{ directUpload: boolean }> {\n    // Explicit opt-out — never probe, never use direct upload.\n    if (this.#directUploadOption === false) {\n      return Promise.resolve({ directUpload: false })\n    }\n    if (!this.#capsPromise) {\n      this.#capsPromise = fetch(`${this.apiUrl}/api/capabilities`, {\n        headers: this.#authHeaders(),\n      })\n        .then(async (res) => {\n          if (!res.ok) return { directUpload: false }\n          const body = (await res.json().catch(() => ({}))) as Record<string, unknown>\n          return { directUpload: body['directUpload'] === true }\n        })\n        .catch(() => ({ directUpload: false }))\n    }\n    return this.#capsPromise\n  }\n\n  // ─── Direct-to-bucket upload ────────────────────────────────────────────────\n\n  /**\n   * Presign → PUT-to-bucket → confirm. Bytes go browser → bucket directly; our\n   * server only signs and records. Used when the account has the directUpload\n   * capability and the file fits a single PUT.\n   */\n  async #uploadDirect(file: File | Blob, opts: UploadOptions): Promise<FileResult> {\n    const { onProgress, filename, signal } = opts\n    const name = filename ?? (file instanceof File ? file.name : 'upload')\n    // Must match the Content-Type we send on the PUT (the server signs it).\n    const contentType = file instanceof File && file.type ? file.type : 'application/octet-stream'\n\n    onProgress?.(0)\n    checkAbort(signal)\n\n    const protection = this.#resolveProtection(opts)\n    const presign = async (): Promise<PresignResponse> => {\n      const res = await fetchWithRetry(\n        `${this.apiUrl}/api/uploads/presign`,\n        {\n          method: 'POST',\n          headers: { ...this.#authHeaders(), 'Content-Type': 'application/json' },\n          body: JSON.stringify({ filename: name, contentType, size: file.size, ...protection }),\n        },\n        signal,\n      )\n      return (await res.json()) as PresignResponse\n    }\n\n    let signed = await presign()\n\n    // Advisory checksum (best-effort; unverifiable server-side).\n    const checksum = await sha256Hex(file)\n\n    // PUT straight to the bucket. A 403 means the short-lived signature lapsed\n    // (or a stale key) — re-presign once and retry before giving up.\n    try {\n      await xhrPut(signed.putUrl, file, { contentType: signed.contentType, onProgress, signal })\n    } catch (err) {\n      if (err instanceof UploaderError && err.statusCode === 403) {\n        signed = await presign()\n        await xhrPut(signed.putUrl, file, { contentType: signed.contentType, onProgress, signal })\n      } else {\n        throw err\n      }\n    }\n\n    // Confirm — server verifies the object exists, records usage, enqueues.\n    checkAbort(signal)\n    const confirmRes = await fetchWithRetry(\n      `${this.apiUrl}/api/uploads/confirm`,\n      {\n        method: 'POST',\n        headers: { ...this.#authHeaders(), 'Content-Type': 'application/json' },\n        body: JSON.stringify({ handle: signed.handle, checksum }),\n      },\n      signal,\n    )\n    const body = (await confirmRes.json()) as unknown\n    onProgress?.(100)\n    return this.#parseFileResult(body)\n  }\n\n  // ─── Auth headers ──────────────────────────────────────────────────────────\n\n  /**\n   * Build the auth headers shared by all requests.\n   * Attaches the API key and, when present, the signed policy pair.\n   */\n  #authHeaders(): Record<string, string> {\n    const headers: Record<string, string> = {\n      'X-Uploader-Key': this.apikey,\n    }\n    if (this.security) {\n      headers['X-Uploader-Policy'] = this.security.policy\n      headers['X-Uploader-Signature'] = this.security.signature\n    }\n    return headers\n  }\n\n  // ─── Single-shot upload ────────────────────────────────────────────────────\n\n  /**\n   * POST /api/store — multipart/form-data for files ≤ MULTIPART_THRESHOLD.\n   */\n  async #uploadSingleShot(\n    file: File | Blob,\n    opts: UploadOptions,\n  ): Promise<FileResult> {\n    const { onProgress, filename, signal } = opts\n\n    onProgress?.(0)\n    checkAbort(signal)\n\n    const form = new FormData()\n    form.append('file', file, filename ?? (file instanceof File ? file.name : 'upload'))\n    if (filename) form.append('filename', filename)\n    // Per-file delivery protection (docs/13) — sent as form fields; allowedOrigins\n    // is JSON-encoded to match the server's parse. Omitted when unset (inherit).\n    const protection = this.#resolveProtection(opts)\n    if (protection.deliveryProtection) form.append('deliveryProtection', protection.deliveryProtection)\n    if (protection.allowedOrigins) form.append('allowedOrigins', JSON.stringify(protection.allowedOrigins))\n\n    const res = await fetchWithRetry(\n      `${this.apiUrl}/api/store`,\n      {\n        method: 'POST',\n        headers: this.#authHeaders(),\n        body: form,\n      },\n      signal,\n    )\n\n    const body = await res.json() as unknown\n    onProgress?.(100)\n    return this.#parseFileResult(body)\n  }\n\n  // ─── Multipart upload ──────────────────────────────────────────────────────\n\n  /**\n   * start → parts (parallel with progress) → complete for files > MULTIPART_THRESHOLD.\n   */\n  async #uploadMultipart(\n    file: File | Blob,\n    parts: Blob[],\n    opts: UploadOptions,\n  ): Promise<FileResult> {\n    const { onProgress, filename, signal } = opts\n    const name = filename ?? (file instanceof File ? file.name : 'upload')\n    const mime = file instanceof File ? file.type : 'application/octet-stream'\n\n    onProgress?.(0)\n    checkAbort(signal)\n\n    // 1. Start\n    const protection = this.#resolveProtection(opts)\n    const startRes = await fetchWithRetry(\n      `${this.apiUrl}/api/upload/start`,\n      {\n        method: 'POST',\n        headers: { ...this.#authHeaders(), 'Content-Type': 'application/json' },\n        body: JSON.stringify({ filename: name, mimetype: mime, size: file.size, ...protection }),\n      },\n      signal,\n    )\n    const { uploadId } = await startRes.json() as UploadStartResponse\n\n    // 2. Upload parts sequentially (retried individually)\n    const etags: { partNumber: number; etag: string }[] = []\n    let uploadedBytes = 0\n\n    for (let i = 0; i < parts.length; i++) {\n      checkAbort(signal)\n      const partBlob = parts[i]!\n      const partNumber = i + 1\n\n      const partForm = new FormData()\n      partForm.append('uploadId', uploadId)\n      partForm.append('partNumber', String(partNumber))\n      partForm.append('part', partBlob)\n\n      const partRes = await fetchWithRetry(\n        `${this.apiUrl}/api/upload/part`,\n        {\n          method: 'POST',\n          headers: this.#authHeaders(),\n          body: partForm,\n        },\n        signal,\n      )\n      const { etag } = await partRes.json() as UploadPartResponse\n\n      etags.push({ partNumber, etag })\n      uploadedBytes += partBlob.size\n      onProgress?.(Math.round((uploadedBytes / file.size) * 95)) // reserve 5% for complete\n    }\n\n    // 3. Complete\n    checkAbort(signal)\n    const completeRes = await fetchWithRetry(\n      `${this.apiUrl}/api/upload/complete`,\n      {\n        method: 'POST',\n        headers: { ...this.#authHeaders(), 'Content-Type': 'application/json' },\n        body: JSON.stringify({ uploadId, parts: etags }),\n      },\n      signal,\n    )\n    const body = await completeRes.json() as unknown\n    onProgress?.(100)\n    return this.#parseFileResult(body)\n  }\n\n  // ─── Response parser ───────────────────────────────────────────────────────\n\n  #parseFileResult(body: unknown): FileResult {\n    if (\n      typeof body !== 'object' ||\n      body === null ||\n      typeof (body as Record<string, unknown>)['handle'] !== 'string' ||\n      typeof (body as Record<string, unknown>)['url'] !== 'string'\n    ) {\n      throw new UploaderError('INVALID_RESPONSE', 'Unexpected response shape from upload API')\n    }\n    return body as FileResult\n  }\n\n  // ─── Public API ───────────────────────────────────────────────────────────\n\n  /**\n   * Upload a single file.\n   *\n   * Automatically selects single-shot vs multipart upload based on file size.\n   * Emits progress via `opts.onProgress` (0–100). Respects `opts.signal` for\n   * cancellation. Retries network errors and 5xx responses up to 3 times with\n   * exponential backoff; 4xx errors are surfaced immediately.\n   *\n   * @throws {UploaderError} with code ABORTED | NETWORK_ERROR | SERVER_ERROR |\n   *   CLIENT_ERROR | INVALID_RESPONSE\n   */\n  async upload(\n    file: File | Blob,\n    opts: UploadOptions = {},\n  ): Promise<FileResult> {\n    // Prefer direct-to-bucket when the account supports it and the file fits a\n    // single PUT. The probe fails open, so an old server or a disabled account\n    // transparently uses the proxied flow below.\n    const caps = await this.#getCapabilities()\n    if (caps.directUpload && file.size <= MAX_DIRECT_PUT_BYTES) {\n      return this.#uploadDirect(file, opts)\n    }\n\n    const plan = planChunks(file, opts.chunkSize)\n    if (plan.mode === 'single') {\n      return this.#uploadSingleShot(file, opts)\n    }\n    return this.#uploadMultipart(file, plan.parts, opts)\n  }\n\n  /**\n   * Upload multiple files with concurrency limiting.\n   *\n   * Resolves once all uploads settle (fulfilled or rejected). The returned\n   * array preserves input order. `opts.concurrency` caps simultaneous\n   * in-flight uploads (default 3). Each file shares the same opts\n   * (including onProgress — the callback fires per-file, not aggregate).\n   *\n   * @returns Array of PromiseSettledResult in input order.\n   */\n  async uploadAll(\n    files: Array<File | Blob>,\n    opts: UploadAllOptions = {},\n  ): Promise<PromiseSettledResult<FileResult>[]> {\n    const concurrency = opts.concurrency ?? 3\n    const results: PromiseSettledResult<FileResult>[] = new Array(files.length)\n\n    let index = 0\n\n    async function worker(client: UploaderClient): Promise<void> {\n      while (index < files.length) {\n        const i = index++\n        const file = files[i]!\n        try {\n          results[i] = { status: 'fulfilled', value: await client.upload(file, opts) }\n        } catch (err) {\n          results[i] = { status: 'rejected', reason: err }\n        }\n      }\n    }\n\n    const workers = Array.from({ length: Math.min(concurrency, files.length) }, () =>\n      worker(this),\n    )\n    await Promise.all(workers)\n    return results\n  }\n}\n","/**\n * Delivery / transform URL builder.\n *\n * The API serves transformed derivatives at `GET /<chain>/<handle>`, where\n * <chain> is a slash-joined list of ops (e.g. `resize=w:200,h:200,fit:crop`).\n * These op builders + `transformUrl()` construct that URL from an uploaded file\n * handle, so consumers render an image at any size/format/quality without\n * hand-assembling URL strings.\n *\n * The op/param types and serialization mirror @uploader/shared EXACTLY — the\n * API's `parseTransformChain` is the other half of this contract, and\n * `contract.conformance.ts` asserts at typecheck time that they stay in sync.\n */\n\n// ─── Op vocabulary (mirrors @uploader/shared) ────────────────────────────────\n\nexport type TransformOpName =\n  | 'resize'\n  | 'crop'\n  | 'rotate'\n  | 'flip'\n  | 'flop'\n  | 'quality'\n  | 'output'\n\n/** Parameters for the resize operation. */\nexport type ResizeParams = {\n  w?: number\n  h?: number\n  fit?: 'cover' | 'contain' | 'fill' | 'inside' | 'outside' | 'crop'\n}\n\n/** Parameters for the crop operation. */\nexport type CropParams = {\n  /** \"x,y,w,h\" notation. */\n  dim: string\n  x?: number\n  y?: number\n  w?: number\n  h?: number\n}\n\n/** Parameters for the rotate operation. */\nexport type RotateParams = { deg: number }\n\n/** Parameters for the quality operation. */\nexport type QualityParams = { n: number }\n\n/** Parameters for the output operation. */\nexport type OutputParams = { format: string }\n\n/** A single transform operation with its typed params. */\nexport type TransformOp =\n  | { name: 'resize'; params: ResizeParams }\n  | { name: 'crop'; params: CropParams }\n  | { name: 'rotate'; params: RotateParams }\n  | { name: 'flip'; params: Record<string, never> }\n  | { name: 'flop'; params: Record<string, never> }\n  | { name: 'quality'; params: QualityParams }\n  | { name: 'output'; params: OutputParams }\n\n/** An ordered list of transform operations. */\nexport type TransformChain = { ops: TransformOp[] }\n\n// ─── Op builders ─────────────────────────────────────────────────────────────\n\n/** Resize to a width and/or height with an optional fit mode. */\nexport const resize = (params: ResizeParams): TransformOp => ({ name: 'resize', params })\n\n/** Crop a rectangular region: origin (x, y) and size w×h, in source pixels. */\nexport const crop = (rect: { x: number; y: number; w: number; h: number }): TransformOp => ({\n  name: 'crop',\n  params: { dim: `${rect.x},${rect.y},${rect.w},${rect.h}`, ...rect },\n})\n\n/** Rotate clockwise by `deg` degrees. */\nexport const rotate = (params: RotateParams): TransformOp => ({ name: 'rotate', params })\n\n/** Flip vertically (mirror top↔bottom). */\nexport const flip = (): TransformOp => ({ name: 'flip', params: {} })\n\n/** Flop horizontally (mirror left↔right). */\nexport const flop = (): TransformOp => ({ name: 'flop', params: {} })\n\n/** Set output quality 1–100 (ignored by lossless formats). */\nexport const quality = (params: QualityParams): TransformOp => ({ name: 'quality', params })\n\n/** Convert the output format, e.g. `{ format: 'webp' }`. */\nexport const output = (params: OutputParams): TransformOp => ({ name: 'output', params })\n\n// ─── Serialization (vendored from @uploader/shared, parser-compatible) ────────\n\nfunction serializeOp(op: TransformOp): string {\n  switch (op.name) {\n    case 'resize': {\n      const parts: string[] = []\n      if (op.params.w !== undefined) parts.push(`w:${op.params.w}`)\n      if (op.params.h !== undefined) parts.push(`h:${op.params.h}`)\n      if (op.params.fit !== undefined) parts.push(`fit:${op.params.fit}`)\n      return `resize=${parts.join(',')}`\n    }\n    case 'crop':\n      return `crop=dim:${op.params.dim}`\n    case 'rotate':\n      return `rotate=deg:${op.params.deg}`\n    case 'flip':\n      return 'flip'\n    case 'flop':\n      return 'flop'\n    case 'quality':\n      return `quality=n:${op.params.n}`\n    case 'output':\n      return `output=format:${op.params.format}`\n  }\n}\n\nexport type TransformUrlOptions = {\n  /** File handle from an upload (`FileResult.handle`). */\n  handle: string\n  /** Ordered transform ops to apply. Must contain at least one op. */\n  ops: TransformOp[]\n  /**\n   * Base API URL. Defaults to '' so the URL is relative — `/<chain>/<handle>` —\n   * and resolves same-origin (e.g. proxied to the API). Pass an absolute URL to\n   * point at a remote API directly.\n   */\n  apiUrl?: string\n}\n\n/**\n * Build a delivery URL that applies `ops` to the file identified by `handle`.\n *\n * @example\n * transformUrl({\n *   handle: file.handle,\n *   ops: [resize({ w: 200, h: 200, fit: 'crop' }), output({ format: 'webp' })],\n * })\n * // => \"/resize=w:200,h:200,fit:crop/output=format:webp/<handle>\"\n */\nexport function transformUrl({ handle, ops, apiUrl = '' }: TransformUrlOptions): string {\n  const base = apiUrl.replace(/\\/$/, '')\n  const chain = ops.map(serializeOp).join('/')\n  // The API's transform route requires at least one op segment before the\n  // handle; for the unmodified original, use FileResult.url instead.\n  return chain ? `${base}/${chain}/${handle}` : `${base}/${handle}`\n}\n\n/**\n * Append a signed read policy to a delivery/transform URL for accounts on the\n * `signed` delivery-protection tier (Private plan, docs/12).\n *\n * The `policy` + `signature` pair is produced SERVER-SIDE by the customer's\n * backend (HMAC over the account's api-key secret, via @uploader/shared). This\n * helper only assembles the URL — the SDK never signs and never sees the secret.\n *\n * @example\n *   const url = withSignedPolicy(\n *     transformUrl({ handle, ops: [resize({ w: 400 })], apiUrl }),\n *     { policy, signature }, // from your backend\n *   )\n */\nexport function withSignedPolicy(\n  url: string,\n  security: { policy: string; signature: string },\n): string {\n  const sep = url.includes('?') ? '&' : '?'\n  return `${url}${sep}policy=${encodeURIComponent(security.policy)}&signature=${encodeURIComponent(security.signature)}`\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACcO,IAAM,gBAAN,cAA4B,MAAM;AAAA,EAC9B;AAAA;AAAA,EAEA;AAAA,EAET,YAAY,MAAyB,SAAiB,YAAqB;AACzE,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,aAAa;AAAA,EACpB;AACF;;;AChBO,IAAM,sBAAsB,IAAI,OAAO;AAGvC,IAAM,qBAAqB,IAAI,OAAO;AAatC,SAAS,WAAW,MAAmB,YAAY,oBAA+B;AACvF,MAAI,KAAK,QAAQ,qBAAqB;AACpC,WAAO,EAAE,MAAM,SAAS;AAAA,EAC1B;AAEA,QAAM,QAAgB,CAAC;AACvB,MAAI,SAAS;AACb,SAAO,SAAS,KAAK,MAAM;AACzB,UAAM,KAAK,KAAK,MAAM,QAAQ,SAAS,SAAS,CAAC;AACjD,cAAU;AAAA,EACZ;AACA,SAAO,EAAE,MAAM,aAAa,OAAO,UAAU,UAAU;AACzD;;;ACfA,IAAM,cAAc;AACpB,IAAM,gBAAgB;AAMtB,IAAM,uBAAuB,IAAI,OAAO,OAAO;AAO/C,IAAM,mBAAmB,KAAK,OAAO;AAKrC,SAAS,MAAM,IAAY,QAAqC;AAC9D,SAAO,IAAI,QAAc,CAAC,SAAS,WAAW;AAC5C,QAAI,QAAQ,SAAS;AACnB,aAAO,IAAI,cAAc,WAAW,gBAAgB,CAAC;AACrD;AAAA,IACF;AACA,UAAM,QAAQ,WAAW,SAAS,EAAE;AACpC,YAAQ,iBAAiB,SAAS,MAAM;AACtC,mBAAa,KAAK;AAClB,aAAO,IAAI,cAAc,WAAW,gBAAgB,CAAC;AAAA,IACvD,GAAG,EAAE,MAAM,KAAK,CAAC;AAAA,EACnB,CAAC;AACH;AAGA,SAAS,WAAW,QAA4B;AAC9C,MAAI,QAAQ,SAAS;AACnB,UAAM,IAAI,cAAc,WAAW,gBAAgB;AAAA,EACrD;AACF;AAMA,eAAe,eACb,KACA,MACA,QACA,aAAa,aACM;AACnB,MAAI;AACJ,WAAS,UAAU,GAAG,UAAU,YAAY,WAAW;AACrD,eAAW,MAAM;AACjB,QAAI;AACF,YAAM,MAAM,MAAM,MAAM,KAAK,EAAE,GAAG,MAAM,OAAO,CAAC;AAChD,UAAI,IAAI,UAAU,OAAO,IAAI,SAAS,KAAK;AAEzC,cAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,EAAE;AAC5C,cAAM,IAAI;AAAA,UACR;AAAA,UACA,QAAQ,IAAI,MAAM,KAAK,IAAI;AAAA,UAC3B,IAAI;AAAA,QACN;AAAA,MACF;AACA,UAAI,IAAI,UAAU,KAAK;AAErB,kBAAU,IAAI;AAAA,UACZ;AAAA,UACA,QAAQ,IAAI,MAAM;AAAA,UAClB,IAAI;AAAA,QACN;AACA,YAAI,UAAU,aAAa,GAAG;AAC5B,gBAAM,MAAM,gBAAgB,KAAK,SAAS,MAAM;AAAA,QAClD;AACA;AAAA,MACF;AACA,aAAO;AAAA,IACT,SAAS,KAAK;AACZ,UAAI,eAAe,eAAe;AAChC,YAAI,IAAI,SAAS,kBAAkB,IAAI,SAAS,UAAW,OAAM;AACjE,kBAAU;AAAA,MACZ,OAAO;AAEL,kBAAU,IAAI;AAAA,UACZ;AAAA,UACA,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,QACjD;AAAA,MACF;AACA,UAAI,UAAU,aAAa,GAAG;AAC5B,cAAM,MAAM,gBAAgB,KAAK,SAAS,MAAM;AAAA,MAClD;AAAA,IACF;AAAA,EACF;AACA,QAAM;AACR;AAQA,eAAe,UAAU,MAAyC;AAChE,MAAI;AACF,UAAM,IAAK,WAAmC;AAC9C,QAAI,CAAC,GAAG,UAAU,KAAK,OAAO,iBAAkB,QAAO;AACvD,UAAM,SAAS,MAAM,EAAE,OAAO,OAAO,WAAW,MAAM,KAAK,YAAY,CAAC;AACxE,WAAO,MAAM,KAAK,IAAI,WAAW,MAAM,CAAC,EACrC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAC1C,KAAK,EAAE;AAAA,EACZ,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AASA,SAAS,OACP,KACA,MACA,MACe;AACf,SAAO,IAAI,QAAc,CAAC,SAAS,WAAW;AAC5C,QAAI,KAAK,QAAQ,SAAS;AACxB,aAAO,IAAI,cAAc,WAAW,gBAAgB,CAAC;AACrD;AAAA,IACF;AACA,UAAM,MAAM,IAAI,eAAe;AAC/B,QAAI,KAAK,OAAO,GAAG;AACnB,QAAI,iBAAiB,gBAAgB,KAAK,WAAW;AAErD,QAAI,KAAK,YAAY;AACnB,UAAI,OAAO,aAAa,CAAC,MAAqB;AAC5C,YAAI,EAAE,kBAAkB;AAEtB,eAAK,WAAY,KAAK,MAAO,EAAE,SAAS,EAAE,QAAS,EAAE,CAAC;AAAA,QACxD;AAAA,MACF;AAAA,IACF;AACA,QAAI,SAAS,MAAM;AACjB,UAAI,IAAI,UAAU,OAAO,IAAI,SAAS,KAAK;AACzC,gBAAQ;AAAA,MACV,OAAO;AACL,cAAM,OAAO,IAAI,UAAU,OAAO,IAAI,SAAS,MAAM,iBAAiB;AACtE,eAAO,IAAI,cAAc,MAAM,2BAA2B,IAAI,MAAM,IAAI,IAAI,MAAM,CAAC;AAAA,MACrF;AAAA,IACF;AACA,QAAI,UAAU,MAAM,OAAO,IAAI,cAAc,iBAAiB,0BAA0B,CAAC;AACzF,QAAI,UAAU,MAAM,OAAO,IAAI,cAAc,WAAW,gBAAgB,CAAC;AAEzE,QAAI,KAAK,QAAQ;AACf,WAAK,OAAO,iBAAiB,SAAS,MAAM,IAAI,MAAM,GAAG,EAAE,MAAM,KAAK,CAAC;AAAA,IACzE;AACA,QAAI,KAAK,IAAI;AAAA,EACf,CAAC;AACH;AAOO,IAAM,iBAAN,MAAqB;AAAA,EACjB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA;AAAA,EAGT,eAA0D;AAAA,EAE1D,YAAY,SAAgC;AAC1C,SAAK,SAAS,QAAQ;AACtB,SAAK,UAAU,QAAQ,UAAU,6BAA6B,QAAQ,OAAO,EAAE;AAC/E,SAAK,WAAW,QAAQ;AACxB,SAAK,sBAAsB,QAAQ;AACnC,SAAK,sBAAsB,QAAQ;AACnC,SAAK,kBAAkB,QAAQ;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,mBAAmB,MAGjB;AACA,UAAM,MAAuG,CAAC;AAC9G,UAAM,OAAO,KAAK,sBAAsB,KAAK;AAC7C,QAAI,SAAS,OAAW,KAAI,qBAAqB;AACjD,UAAM,UAAU,KAAK,kBAAkB,KAAK;AAC5C,QAAI,YAAY,OAAW,KAAI,iBAAiB;AAChD,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,mBAAuD;AAErD,QAAI,KAAK,wBAAwB,OAAO;AACtC,aAAO,QAAQ,QAAQ,EAAE,cAAc,MAAM,CAAC;AAAA,IAChD;AACA,QAAI,CAAC,KAAK,cAAc;AACtB,WAAK,eAAe,MAAM,GAAG,KAAK,MAAM,qBAAqB;AAAA,QAC3D,SAAS,KAAK,aAAa;AAAA,MAC7B,CAAC,EACE,KAAK,OAAO,QAAQ;AACnB,YAAI,CAAC,IAAI,GAAI,QAAO,EAAE,cAAc,MAAM;AAC1C,cAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC/C,eAAO,EAAE,cAAc,KAAK,cAAc,MAAM,KAAK;AAAA,MACvD,CAAC,EACA,MAAM,OAAO,EAAE,cAAc,MAAM,EAAE;AAAA,IAC1C;AACA,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,cAAc,MAAmB,MAA0C;AAC/E,UAAM,EAAE,YAAY,UAAU,OAAO,IAAI;AACzC,UAAM,OAAO,aAAa,gBAAgB,OAAO,KAAK,OAAO;AAE7D,UAAM,cAAc,gBAAgB,QAAQ,KAAK,OAAO,KAAK,OAAO;AAEpE,iBAAa,CAAC;AACd,eAAW,MAAM;AAEjB,UAAM,aAAa,KAAK,mBAAmB,IAAI;AAC/C,UAAM,UAAU,YAAsC;AACpD,YAAM,MAAM,MAAM;AAAA,QAChB,GAAG,KAAK,MAAM;AAAA,QACd;AAAA,UACE,QAAQ;AAAA,UACR,SAAS,EAAE,GAAG,KAAK,aAAa,GAAG,gBAAgB,mBAAmB;AAAA,UACtE,MAAM,KAAK,UAAU,EAAE,UAAU,MAAM,aAAa,MAAM,KAAK,MAAM,GAAG,WAAW,CAAC;AAAA,QACtF;AAAA,QACA;AAAA,MACF;AACA,aAAQ,MAAM,IAAI,KAAK;AAAA,IACzB;AAEA,QAAI,SAAS,MAAM,QAAQ;AAG3B,UAAM,WAAW,MAAM,UAAU,IAAI;AAIrC,QAAI;AACF,YAAM,OAAO,OAAO,QAAQ,MAAM,EAAE,aAAa,OAAO,aAAa,YAAY,OAAO,CAAC;AAAA,IAC3F,SAAS,KAAK;AACZ,UAAI,eAAe,iBAAiB,IAAI,eAAe,KAAK;AAC1D,iBAAS,MAAM,QAAQ;AACvB,cAAM,OAAO,OAAO,QAAQ,MAAM,EAAE,aAAa,OAAO,aAAa,YAAY,OAAO,CAAC;AAAA,MAC3F,OAAO;AACL,cAAM;AAAA,MACR;AAAA,IACF;AAGA,eAAW,MAAM;AACjB,UAAM,aAAa,MAAM;AAAA,MACvB,GAAG,KAAK,MAAM;AAAA,MACd;AAAA,QACE,QAAQ;AAAA,QACR,SAAS,EAAE,GAAG,KAAK,aAAa,GAAG,gBAAgB,mBAAmB;AAAA,QACtE,MAAM,KAAK,UAAU,EAAE,QAAQ,OAAO,QAAQ,SAAS,CAAC;AAAA,MAC1D;AAAA,MACA;AAAA,IACF;AACA,UAAM,OAAQ,MAAM,WAAW,KAAK;AACpC,iBAAa,GAAG;AAChB,WAAO,KAAK,iBAAiB,IAAI;AAAA,EACnC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,eAAuC;AACrC,UAAM,UAAkC;AAAA,MACtC,kBAAkB,KAAK;AAAA,IACzB;AACA,QAAI,KAAK,UAAU;AACjB,cAAQ,mBAAmB,IAAI,KAAK,SAAS;AAC7C,cAAQ,sBAAsB,IAAI,KAAK,SAAS;AAAA,IAClD;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,kBACJ,MACA,MACqB;AACrB,UAAM,EAAE,YAAY,UAAU,OAAO,IAAI;AAEzC,iBAAa,CAAC;AACd,eAAW,MAAM;AAEjB,UAAM,OAAO,IAAI,SAAS;AAC1B,SAAK,OAAO,QAAQ,MAAM,aAAa,gBAAgB,OAAO,KAAK,OAAO,SAAS;AACnF,QAAI,SAAU,MAAK,OAAO,YAAY,QAAQ;AAG9C,UAAM,aAAa,KAAK,mBAAmB,IAAI;AAC/C,QAAI,WAAW,mBAAoB,MAAK,OAAO,sBAAsB,WAAW,kBAAkB;AAClG,QAAI,WAAW,eAAgB,MAAK,OAAO,kBAAkB,KAAK,UAAU,WAAW,cAAc,CAAC;AAEtG,UAAM,MAAM,MAAM;AAAA,MAChB,GAAG,KAAK,MAAM;AAAA,MACd;AAAA,QACE,QAAQ;AAAA,QACR,SAAS,KAAK,aAAa;AAAA,QAC3B,MAAM;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAEA,UAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,iBAAa,GAAG;AAChB,WAAO,KAAK,iBAAiB,IAAI;AAAA,EACnC;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,iBACJ,MACA,OACA,MACqB;AACrB,UAAM,EAAE,YAAY,UAAU,OAAO,IAAI;AACzC,UAAM,OAAO,aAAa,gBAAgB,OAAO,KAAK,OAAO;AAC7D,UAAM,OAAO,gBAAgB,OAAO,KAAK,OAAO;AAEhD,iBAAa,CAAC;AACd,eAAW,MAAM;AAGjB,UAAM,aAAa,KAAK,mBAAmB,IAAI;AAC/C,UAAM,WAAW,MAAM;AAAA,MACrB,GAAG,KAAK,MAAM;AAAA,MACd;AAAA,QACE,QAAQ;AAAA,QACR,SAAS,EAAE,GAAG,KAAK,aAAa,GAAG,gBAAgB,mBAAmB;AAAA,QACtE,MAAM,KAAK,UAAU,EAAE,UAAU,MAAM,UAAU,MAAM,MAAM,KAAK,MAAM,GAAG,WAAW,CAAC;AAAA,MACzF;AAAA,MACA;AAAA,IACF;AACA,UAAM,EAAE,SAAS,IAAI,MAAM,SAAS,KAAK;AAGzC,UAAM,QAAgD,CAAC;AACvD,QAAI,gBAAgB;AAEpB,aAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,iBAAW,MAAM;AACjB,YAAM,WAAW,MAAM,CAAC;AACxB,YAAM,aAAa,IAAI;AAEvB,YAAM,WAAW,IAAI,SAAS;AAC9B,eAAS,OAAO,YAAY,QAAQ;AACpC,eAAS,OAAO,cAAc,OAAO,UAAU,CAAC;AAChD,eAAS,OAAO,QAAQ,QAAQ;AAEhC,YAAM,UAAU,MAAM;AAAA,QACpB,GAAG,KAAK,MAAM;AAAA,QACd;AAAA,UACE,QAAQ;AAAA,UACR,SAAS,KAAK,aAAa;AAAA,UAC3B,MAAM;AAAA,QACR;AAAA,QACA;AAAA,MACF;AACA,YAAM,EAAE,KAAK,IAAI,MAAM,QAAQ,KAAK;AAEpC,YAAM,KAAK,EAAE,YAAY,KAAK,CAAC;AAC/B,uBAAiB,SAAS;AAC1B,mBAAa,KAAK,MAAO,gBAAgB,KAAK,OAAQ,EAAE,CAAC;AAAA,IAC3D;AAGA,eAAW,MAAM;AACjB,UAAM,cAAc,MAAM;AAAA,MACxB,GAAG,KAAK,MAAM;AAAA,MACd;AAAA,QACE,QAAQ;AAAA,QACR,SAAS,EAAE,GAAG,KAAK,aAAa,GAAG,gBAAgB,mBAAmB;AAAA,QACtE,MAAM,KAAK,UAAU,EAAE,UAAU,OAAO,MAAM,CAAC;AAAA,MACjD;AAAA,MACA;AAAA,IACF;AACA,UAAM,OAAO,MAAM,YAAY,KAAK;AACpC,iBAAa,GAAG;AAChB,WAAO,KAAK,iBAAiB,IAAI;AAAA,EACnC;AAAA;AAAA,EAIA,iBAAiB,MAA2B;AAC1C,QACE,OAAO,SAAS,YAChB,SAAS,QACT,OAAQ,KAAiC,QAAQ,MAAM,YACvD,OAAQ,KAAiC,KAAK,MAAM,UACpD;AACA,YAAM,IAAI,cAAc,oBAAoB,2CAA2C;AAAA,IACzF;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,OACJ,MACA,OAAsB,CAAC,GACF;AAIrB,UAAM,OAAO,MAAM,KAAK,iBAAiB;AACzC,QAAI,KAAK,gBAAgB,KAAK,QAAQ,sBAAsB;AAC1D,aAAO,KAAK,cAAc,MAAM,IAAI;AAAA,IACtC;AAEA,UAAM,OAAO,WAAW,MAAM,KAAK,SAAS;AAC5C,QAAI,KAAK,SAAS,UAAU;AAC1B,aAAO,KAAK,kBAAkB,MAAM,IAAI;AAAA,IAC1C;AACA,WAAO,KAAK,iBAAiB,MAAM,KAAK,OAAO,IAAI;AAAA,EACrD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,UACJ,OACA,OAAyB,CAAC,GACmB;AAC7C,UAAM,cAAc,KAAK,eAAe;AACxC,UAAM,UAA8C,IAAI,MAAM,MAAM,MAAM;AAE1E,QAAI,QAAQ;AAEZ,mBAAe,OAAO,QAAuC;AAC3D,aAAO,QAAQ,MAAM,QAAQ;AAC3B,cAAM,IAAI;AACV,cAAM,OAAO,MAAM,CAAC;AACpB,YAAI;AACF,kBAAQ,CAAC,IAAI,EAAE,QAAQ,aAAa,OAAO,MAAM,OAAO,OAAO,MAAM,IAAI,EAAE;AAAA,QAC7E,SAAS,KAAK;AACZ,kBAAQ,CAAC,IAAI,EAAE,QAAQ,YAAY,QAAQ,IAAI;AAAA,QACjD;AAAA,MACF;AAAA,IACF;AAEA,UAAM,UAAU,MAAM;AAAA,MAAK,EAAE,QAAQ,KAAK,IAAI,aAAa,MAAM,MAAM,EAAE;AAAA,MAAG,MAC1E,OAAO,IAAI;AAAA,IACb;AACA,UAAM,QAAQ,IAAI,OAAO;AACzB,WAAO;AAAA,EACT;AACF;;;ACndO,IAAM,SAAS,CAAC,YAAuC,EAAE,MAAM,UAAU,OAAO;AAGhF,IAAM,OAAO,CAAC,UAAuE;AAAA,EAC1F,MAAM;AAAA,EACN,QAAQ,EAAE,KAAK,GAAG,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,GAAG,KAAK;AACpE;AAGO,IAAM,SAAS,CAAC,YAAuC,EAAE,MAAM,UAAU,OAAO;AAGhF,IAAM,OAAO,OAAoB,EAAE,MAAM,QAAQ,QAAQ,CAAC,EAAE;AAG5D,IAAM,OAAO,OAAoB,EAAE,MAAM,QAAQ,QAAQ,CAAC,EAAE;AAG5D,IAAM,UAAU,CAAC,YAAwC,EAAE,MAAM,WAAW,OAAO;AAGnF,IAAM,SAAS,CAAC,YAAuC,EAAE,MAAM,UAAU,OAAO;AAIvF,SAAS,YAAY,IAAyB;AAC5C,UAAQ,GAAG,MAAM;AAAA,IACf,KAAK,UAAU;AACb,YAAM,QAAkB,CAAC;AACzB,UAAI,GAAG,OAAO,MAAM,OAAW,OAAM,KAAK,KAAK,GAAG,OAAO,CAAC,EAAE;AAC5D,UAAI,GAAG,OAAO,MAAM,OAAW,OAAM,KAAK,KAAK,GAAG,OAAO,CAAC,EAAE;AAC5D,UAAI,GAAG,OAAO,QAAQ,OAAW,OAAM,KAAK,OAAO,GAAG,OAAO,GAAG,EAAE;AAClE,aAAO,UAAU,MAAM,KAAK,GAAG,CAAC;AAAA,IAClC;AAAA,IACA,KAAK;AACH,aAAO,YAAY,GAAG,OAAO,GAAG;AAAA,IAClC,KAAK;AACH,aAAO,cAAc,GAAG,OAAO,GAAG;AAAA,IACpC,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO,aAAa,GAAG,OAAO,CAAC;AAAA,IACjC,KAAK;AACH,aAAO,iBAAiB,GAAG,OAAO,MAAM;AAAA,EAC5C;AACF;AAyBO,SAAS,aAAa,EAAE,QAAQ,KAAK,SAAS,GAAG,GAAgC;AACtF,QAAM,OAAO,OAAO,QAAQ,OAAO,EAAE;AACrC,QAAM,QAAQ,IAAI,IAAI,WAAW,EAAE,KAAK,GAAG;AAG3C,SAAO,QAAQ,GAAG,IAAI,IAAI,KAAK,IAAI,MAAM,KAAK,GAAG,IAAI,IAAI,MAAM;AACjE;AAgBO,SAAS,iBACd,KACA,UACQ;AACR,QAAM,MAAM,IAAI,SAAS,GAAG,IAAI,MAAM;AACtC,SAAO,GAAG,GAAG,GAAG,GAAG,UAAU,mBAAmB,SAAS,MAAM,CAAC,cAAc,mBAAmB,SAAS,SAAS,CAAC;AACtH;","names":[]}

package/dist/core.d.cts

@@ -1,4 +1,5 @@
-export { C as CropParams, D as DeliveryProtection, F as FileResult, O as OutputParams, P as PickerResponse, a as PolicySpec, Q as QualityParams, R as ResizeParams, b as RotateParams, T as TransformChain, c as TransformOp, d as TransformOpName, e as TransformUrlOptions, U as UploadAllOptions, f as UploadOptions, g as UploaderClient, h as UploaderClientOptions, i as crop, j as flip, k as flop, o as output, q as quality, r as resize, l as rotate, t as transformUrl, w as withSignedPolicy } from './transform-BSPaC9-P.cjs';
+export { D as DeliveryProtection, F as FileResult, P as PickerResponse, a as PolicySpec, U as UploadAllOptions, b as UploadOptions, c as UploaderClient, d as UploaderClientOptions } from './client-CUmYuQ7Z.cjs';
+export { C as CropParams, O as OutputParams, Q as QualityParams, R as ResizeParams, a as RotateParams, T as TransformChain, b as TransformOp, c as TransformOpName, d as TransformUrlOptions, e as crop, f as flip, g as flop, o as output, q as quality, r as resize, h as rotate, t as transformUrl, w as withSignedPolicy } from './transform-BTZ0kodO.cjs';
 
 /**
  * Typed errors for UploaderClient.

package/dist/core.d.ts

@@ -1,4 +1,5 @@
-export { C as CropParams, D as DeliveryProtection, F as FileResult, O as OutputParams, P as PickerResponse, a as PolicySpec, Q as QualityParams, R as ResizeParams, b as RotateParams, T as TransformChain, c as TransformOp, d as TransformOpName, e as TransformUrlOptions, U as UploadAllOptions, f as UploadOptions, g as UploaderClient, h as UploaderClientOptions, i as crop, j as flip, k as flop, o as output, q as quality, r as resize, l as rotate, t as transformUrl, w as withSignedPolicy } from './transform-BSPaC9-P.js';
+export { D as DeliveryProtection, F as FileResult, P as PickerResponse, a as PolicySpec, U as UploadAllOptions, b as UploadOptions, c as UploaderClient, d as UploaderClientOptions } from './client-CUmYuQ7Z.js';
+export { C as CropParams, O as OutputParams, Q as QualityParams, R as ResizeParams, a as RotateParams, T as TransformChain, b as TransformOp, c as TransformOpName, d as TransformUrlOptions, e as crop, f as flip, g as flop, o as output, q as quality, r as resize, h as rotate, t as transformUrl, w as withSignedPolicy } from './transform-BTZ0kodO.js';
 
 /**
  * Typed errors for UploaderClient.

package/dist/core.js

@@ -3,17 +3,19 @@ import {
   MULTIPART_THRESHOLD,
   UploaderClient,
   UploaderError,
+  planChunks
+} from "./chunk-6AJTZNOI.js";
+import {
   crop,
   flip,
   flop,
   output,
-  planChunks,
   quality,
   resize,
   rotate,
   transformUrl,
   withSignedPolicy
-} from "./chunk-QRUZUI5L.js";
+} from "./chunk-DJK2SQ5I.js";
 export {
   DEFAULT_CHUNK_SIZE,
   MULTIPART_THRESHOLD,

package/dist/index.cjs

@@ -506,11 +506,22 @@ function nextId() {
 function usePicker(opts) {
   const [files, setFiles] = (0, import_react.useState)([]);
   const clientRef = (0, import_react.useRef)(null);
-  if (!clientRef.current || clientRef.current.apikey !== opts.apikey || clientRef.current.apiUrl !== (opts.apiUrl ?? "https://api.uploaderhq.io")) {
+  const clientSigRef = (0, import_react.useRef)("");
+  const clientSig = JSON.stringify({
+    apikey: opts.apikey,
+    apiUrl: opts.apiUrl ?? null,
+    security: opts.security ?? null,
+    deliveryProtection: opts.deliveryProtection ?? null,
+    allowedOrigins: opts.allowedOrigins ?? null
+  });
+  if (!clientRef.current || clientSigRef.current !== clientSig) {
+    clientSigRef.current = clientSig;
     clientRef.current = new UploaderClient({
       apikey: opts.apikey,
       apiUrl: opts.apiUrl,
-      security: opts.security
+      security: opts.security,
+      deliveryProtection: opts.deliveryProtection,
+      allowedOrigins: opts.allowedOrigins
     });
   }
   const addFiles = (0, import_react.useCallback)(
@@ -1613,6 +1624,8 @@ function PickerOverlay({
   apikey,
   apiUrl,
   security,
+  deliveryProtection,
+  allowedOrigins,
   pickerOptions,
   onUploadDone,
   onFileUploadFinished,
@@ -1631,6 +1644,8 @@ function PickerOverlay({
     apikey,
     apiUrl,
     security,
+    deliveryProtection,
+    allowedOrigins,
     pickerOptions,
     onUploadDone,
     onFileUploadFinished,
@@ -1913,6 +1928,8 @@ function DropPane({
   apikey,
   apiUrl,
   security,
+  deliveryProtection,
+  allowedOrigins,
   pickerOptions,
   onUploadDone,
   onFileUploadFinished,
@@ -1930,6 +1947,8 @@ function DropPane({
     apikey,
     apiUrl,
     security,
+    deliveryProtection,
+    allowedOrigins,
     pickerOptions,
     onUploadDone,
     onFileUploadFinished,