@limrun/api 0.65.1 → 0.67.0

package/src/resources/assets.ts

@@ -7,6 +7,20 @@ import { RequestOptions } from '../internal/request-options';
 import { path } from '../internal/utils/path';
 
 export class Assets extends APIResource {
+  /** Obtain upload URLs and the existing file MD5. Downloads require read permission. */
+  createUploadURL(assetID: string, options?: RequestOptions): APIPromise<AssetUploadURLs> {
+    return this._client.get(path`/v1/assets/${assetID}/upload_urls`, options);
+  }
+
+  /** Update editable metadata. The lookup name cannot be changed. */
+  update(assetID: string, body: AssetUpdateParams, options?: RequestOptions): APIPromise<void> {
+    return this._client.patch(path`/v1/assets/${assetID}`, {
+      body,
+      ...options,
+      headers: buildHeaders([{ Accept: '*/*' }, options?.headers]),
+    });
+  }
+
   /**
    * List organization's all assets with given filters. If none given, return all
    * assets.
@@ -99,8 +113,10 @@ export interface AssetGetOrCreateResponse {
 
   name: string;
 
+  /** Empty unless the credential grants read. */
   signedDownloadUrl: string;
 
+  /** Empty unless the credential grants upload. */
   signedUploadUrl: string;
 
   /**
@@ -235,5 +251,27 @@ export declare namespace Assets {
     type AssetListParams as AssetListParams,
     type AssetGetParams as AssetGetParams,
     type AssetGetOrCreateParams as AssetGetOrCreateParams,
+    type AssetUpdateParams as AssetUpdateParams,
+    type AssetUploadURLs as AssetUploadURLs,
   };
 }
+
+export interface AssetUpdateParams {
+  displayName?: string;
+  bundleIdentifier?: string;
+  shortVersion?: string;
+  buildVersion?: string;
+  deeplink?: string;
+  targetSdk?: string;
+  ttl?: string;
+}
+
+export interface AssetUploadURLs {
+  /** Existing file MD5. Omitted when no file exists; storage-check failures return an error. */
+  md5?: string;
+  signedUploadUrl: string;
+  /** Upload the icon PNG with PUT and Content-Type: image/png. No other headers are required. */
+  signedIconUploadUrl: string;
+  /** Included only with read permission. */
+  iconUrl?: string;
+}

package/src/resources/daemon-client-shared.ts

@@ -71,54 +71,9 @@ export type SyncResult = {
 
 export type AssetUploadUrls = { id: string; signedUploadUrl: string; signedDownloadUrl: string };
 
-/**
- * App metadata recorded on the asset at upload time, for bundles that don't
- * go through limbuild (which extracts and records it automatically). The
- * registry's OTA install flow reads the manifest identity from these fields.
- */
-export type AssetUploadOptions = {
-  /** Human-readable app title users see on iOS. */
-  displayName?: string;
-  /** CFBundleIdentifier of the uploaded app bundle. */
-  bundleIdentifier?: string;
-  /** CFBundleShortVersionString, e.g. 1.2.3. */
-  shortVersion?: string;
-  /** CFBundleVersion, e.g. 42. */
-  buildVersion?: string;
-  /** The app's primary URL scheme, e.g. "myapp" for myapp:// deep links. */
-  deeplink?: string;
-};
-
-/**
- * Default TTL for build-product uploads. Every build upload without an
- * explicit ttl pushes the asset's expiry to 14 days from that upload, so
- * abandoned build artifacts don't accumulate in Asset Storage forever.
- * Assets uploaded through the general asset API keep no expiry by default.
- */
-export const DEFAULT_BUILD_ASSET_TTL = '336h';
-
-/**
- * Mints presigned upload/download URLs for a named asset via assets.getOrCreate,
- * wrapping failures with the asset name (and the original error as cause).
- * All build-product upload paths (xcodebuild, gradlebuild, RBE) go through
- * here, which is what scopes DEFAULT_BUILD_ASSET_TTL to build uploads.
- */
-export function mintAssetUploadUrls(
-  assets: {
-    getOrCreate: (body: { name: string; ttl?: string } & AssetUploadOptions) => Promise<AssetUploadUrls>;
-  },
-  name: string,
-  ttl?: string,
-  uploadOptions?: AssetUploadOptions,
-): Promise<AssetUploadUrls> {
-  return assets.getOrCreate({ name, ttl: ttl || DEFAULT_BUILD_ASSET_TTL, ...uploadOptions }).catch((err) => {
-    const message = `Failed to create upload URL for asset '${name}': ${
-      err instanceof Error ? err.message : err
-    }`;
-    // @ts-ignore - not all envs have native support for cause yet
-    throw new Error(message, { cause: err });
-  });
-}
+// Compatibility exports for callers that imported build-upload metadata here.
+export type { AssetUploadMetadata as AssetUploadOptions } from '../lib/asset-permissions';
+export { DEFAULT_BUILD_ASSET_TTL } from '../lib/asset-permissions';
 
 const logLevels: LogLevel[] = ['none', 'error', 'warn', 'info', 'debug'];
 

package/src/resources/gradle-instances-helpers.ts

@@ -1,4 +1,5 @@
 import { pullBuildFile } from '../internal/build-pull-file';
+import { normalizeAssetUpload, type BuildUpload } from '../lib/asset-permissions';
 import { GradleInstances, type GradleInstance } from './gradle-instances';
 import { APIPromise } from '../core/api-promise';
 import { RequestOptions } from '../internal/request-options';
@@ -24,7 +25,6 @@ import {
   type BuildRunOptions,
   createDaemonLogger,
   deriveBasisCache,
-  mintAssetUploadUrls,
   type BuildLog,
   type LogLevel,
   type SyncResult,
@@ -72,19 +72,7 @@ export type GradleBuildOptions = {
   /** Relative path to the Gradle root when auto-discovery is ambiguous. */
   projectPath?: string;
   /** Upload the built artifact as a named org asset, or to a presigned URL. */
-  upload?:
-    | {
-        assetName: string;
-        /**
-         * Asset TTL as a Go duration (e.g. "24h", "30m"; "1d" is invalid),
-         * forwarded to assets.getOrCreate. Defaults to 336h (14 days): each
-         * build upload without an explicit ttl pushes the asset's expiry to
-         * 14 days from that upload.
-         */
-        ttl?: string;
-        signedUploadUrl?: never;
-      }
-    | { signedUploadUrl: string; assetName?: never; ttl?: never };
+  upload?: BuildUpload;
   /** React Native / Expo tuning. */
   reactNative?: GradleReactNativeConfig;
   /** Release signing config; presence makes bundleRelease the default task. */
@@ -227,22 +215,7 @@ class GradleInstancesHelpers extends GradleInstances {
           ...(options?.playstore && { playstore: options.playstore }),
         };
 
-        if (options?.upload && 'assetName' in options.upload) {
-          const requestPromise = mintAssetUploadUrls(
-            client.assets,
-            options.upload.assetName,
-            options.upload.ttl,
-          ).then((asset) => {
-            request.signedUploadUrl = asset.signedUploadUrl;
-            request.additionalMetadata = { signedDownloadUrl: asset.signedDownloadUrl };
-            return request;
-          });
-          return exec(requestPromise, { apiUrl, token, log });
-        }
-
-        if (options?.upload && 'signedUploadUrl' in options.upload) {
-          request.signedUploadUrl = options.upload.signedUploadUrl;
-        }
+        if (options?.upload) Object.assign(request, normalizeAssetUpload(options.upload));
 
         return exec(request, { apiUrl, token, log });
       },

package/src/resources/gradle-instances.ts

@@ -139,6 +139,12 @@ export namespace GradleInstanceCreateParams {
   }
 
   export interface Spec {
+    /** Inline instance role. Omit for the organization's compatibility default. */
+    role?: {
+      /** Asset permissions delegated by the creator. An empty array grants nothing. */
+      permissions: Array<string>;
+    };
+
     /**
      * ClientLocation takes precedence over ClientIP regardless of clue order. Without
      * either clue, routing uses Cloudflare visitor coordinates, then its client IP.

package/src/resources/index.ts

@@ -97,3 +97,5 @@ export {
   type GradleBuildOptions,
   type GradleBuildLog,
 } from './gradle-instances-helpers';
+
+export { AccessTokens, type AccessToken, type AccessTokenCreateParams } from './access-tokens';

package/src/resources/ios-instances.ts

@@ -174,6 +174,12 @@ export namespace IosInstanceCreateParams {
   }
 
   export interface Spec {
+    /** Inline instance role. Omit for the organization's compatibility default. */
+    role?: {
+      /** Asset permissions delegated by the creator. An empty array grants nothing. */
+      permissions: Array<string>;
+    };
+
     /**
      * ClientLocation takes precedence over ClientIP regardless of clue order. Without
      * either clue, routing uses Cloudflare visitor coordinates, then its client IP.

package/src/resources/scoped-tokens.ts

@@ -1,15 +1,16 @@
 // File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
 
+import type { AccessTokenCreateParams } from './access-tokens';
 import { APIResource } from '../core/resource';
 import { APIPromise } from '../core/api-promise';
 import { RequestOptions } from '../internal/request-options';
 
 export class ScopedTokens extends APIResource {
   /**
-   * Mint a short-lived scoped token whose scopes limit what the holder can do, e.g.
+   * Mint a short-lived scoped token whose permissions limit what the holder can do, e.g.
    * install a specific asset on a device through the registry. The token is verified
-   * offline by services holding the token signing public key and cannot be revoked,
-   * so keep TTLs short. It is bound to the authenticated caller's organization.
+   * by services holding the signing public key. It is bound to the caller's organization.
+   * Prefer accessTokens.create for new code.
    */
   create(body: ScopedTokenCreateParams, options?: RequestOptions): APIPromise<ScopedToken> {
     return this._client.post('/v1/scoped_tokens', { body, ...options });
@@ -24,24 +25,16 @@ export interface ScopedToken {
 
   expiresAt: string;
 
-  scopes: Array<string>;
-}
+  /** Permissions granted to this credential. */
+  permissions?: Array<string>;
 
-export interface ScopedTokenCreateParams {
-  /**
-   * Scopes in the form `<resource>:<id|*>:<action>`, e.g. `device:*:install`,
-   * `asset:asset_01h455vb4pex5vsknk084sn02q:read` or `applerelay:*:connect`.
-   * Resource IDs are the customer-visible IDs returned by the API.
-   */
+  /** @deprecated Use permissions. */
   scopes: Array<string>;
-
-  /**
-   * How long the token stays valid. Defaults to 3600 (1 hour), maximum is 14400 (4
-   * hours).
-   */
-  ttlSeconds?: number;
 }
 
+/** @deprecated Use AccessTokenCreateParams. */
+export type ScopedTokenCreateParams = AccessTokenCreateParams;
+
 export declare namespace ScopedTokens {
   export { type ScopedToken as ScopedToken, type ScopedTokenCreateParams as ScopedTokenCreateParams };
 }

package/src/resources/xcode-instances-helpers.ts

@@ -1,4 +1,5 @@
 import { pullBuildFile } from '../internal/build-pull-file';
+import { normalizeAssetUpload, type BuildUpload } from '../lib/asset-permissions';
 import {
   XcodeInstances as GeneratedXcodeInstances,
   type XcodeInstance,
@@ -48,8 +49,6 @@ import {
   type BuildRunOptions,
   createDaemonLogger,
   deriveBasisCache,
-  mintAssetUploadUrls,
-  type AssetUploadOptions,
   type BuildLog,
   type LogLevel,
   type SyncResult,
@@ -238,25 +237,7 @@ export type ReactNativeBuildConfig = {
 };
 
 export type XcodeBuildOptions = {
-  upload?:
-    | {
-        assetName: string;
-        /**
-         * Asset TTL as a Go duration (e.g. "24h", "30m"; "1d" is invalid),
-         * forwarded to assets.getOrCreate. Defaults to 336h (14 days): each
-         * build upload without an explicit ttl pushes the asset's expiry to
-         * 14 days from that upload.
-         */
-        ttl?: string;
-        /**
-         * App metadata to record on the asset up front. limbuild extracts
-         * the same metadata from the built bundle after the build and
-         * overwrites whatever it found; values set here survive only for
-         * fields the bundle doesn't declare (e.g. a deep link scheme).
-         */
-        uploadOptions?: AssetUploadOptions;
-      }
-    | { signedUploadUrl: string };
+  upload?: BuildUpload;
   signing?: XcodeSigningConfig;
   cloudSigning?: XcodeCloudSigningConfig;
   /**
@@ -457,32 +438,14 @@ export type RbeInstallResult = {
   installDurationMs?: number;
 };
 
-export type RbeUploadOptions =
-  | {
-      /** Upload as a named asset: the SDK mints the presigned upload URL via assets.getOrCreate. */
-      assetName: string;
-      /**
-       * Optional asset TTL as a Go duration (e.g. "24h", "30m"; "1d" is
-       * invalid), forwarded to assets.getOrCreate. Defaults to 336h (14
-       * days): each upload without an explicit ttl pushes the asset's
-       * expiry to 14 days from that upload.
-       */
-      ttl?: string;
-      signedUploadUrl?: never;
-    }
-  | {
-      /** Upload to a caller-minted presigned Limrun asset storage URL. */
-      signedUploadUrl: string;
-      assetName?: never;
-      ttl?: never;
-    };
+export type RbeUploadOptions = BuildUpload;
 
 export type RbeUploadResult = {
   /** The .app bundle name of the uploaded build; it is the root directory of the uploaded tar.gz. */
   appName: string;
   /** CFBundleIdentifier of the uploaded app, when known. */
   bundleId?: string;
-  /** Presigned download URL of the asset; present when uploading by assetName. */
+  /** @deprecated Target uploads do not return a download URL. Request one separately with read permission. */
   signedDownloadUrl?: string;
 };
 
@@ -958,7 +921,7 @@ export class XcodeInstances extends GeneratedXcodeInstances {
       iosInstanceId: string;
       simulator: IosInstance;
     }> => {
-      const simulator = await client.iosInstances.create({ wait: true });
+      const simulator = await client.iosInstances.create({ wait: true, spec: { role: { permissions: [] } } });
       // The sim exists from here; if attach fails, delete it so we never leak an
       // orphan the caller can't reap.
       try {
@@ -1064,25 +1027,7 @@ export class XcodeInstances extends GeneratedXcodeInstances {
           ...(options?.onXctestEvent && { onXctestEvent: options.onXctestEvent }),
         };
 
-        if (options?.upload && 'assetName' in options.upload) {
-          const requestPromise = mintAssetUploadUrls(
-            client.assets,
-            options.upload.assetName,
-            options.upload.ttl,
-            options.upload.uploadOptions,
-          ).then((asset) => {
-            request.signedUploadUrl = asset.signedUploadUrl;
-            // Lets limbuild record the built app's metadata on the asset.
-            request.assetId = asset.id;
-            request.additionalMetadata = { signedDownloadUrl: asset.signedDownloadUrl };
-            return request;
-          });
-          return exec(requestPromise, execOptions);
-        }
-
-        if (options?.upload && 'signedUploadUrl' in options.upload) {
-          request.signedUploadUrl = options.upload.signedUploadUrl;
-        }
+        if (options?.upload) Object.assign(request, normalizeAssetUpload(options.upload));
 
         return exec(request, execOptions);
       },
@@ -1176,18 +1121,7 @@ export class XcodeInstances extends GeneratedXcodeInstances {
       },
 
       async uploadLatestRbeBuild(opts: RbeUploadOptions): Promise<RbeUploadResult> {
-        let signedUploadUrl: string;
-        let signedDownloadUrl: string | undefined;
-        if (opts.assetName !== undefined) {
-          if (!opts.assetName) {
-            throw new Error('assetName must not be empty');
-          }
-          const asset = await mintAssetUploadUrls(client.assets, opts.assetName, opts.ttl);
-          signedUploadUrl = asset.signedUploadUrl;
-          signedDownloadUrl = asset.signedDownloadUrl;
-        } else {
-          signedUploadUrl = opts.signedUploadUrl;
-        }
+        const body = normalizeAssetUpload(opts);
 
         const post = async (): Promise<{ appName: string; bundleId?: string }> => {
           // The daemon uploads to asset storage before responding, so this
@@ -1198,7 +1132,7 @@ export class XcodeInstances extends GeneratedXcodeInstances {
               'Content-Type': 'application/json',
               Authorization: `Bearer ${token}`,
             },
-            body: JSON.stringify({ signedUploadUrl }),
+            body: JSON.stringify(body),
           });
           if (res.status === 404) {
             // A vanished instance and a limbuild that predates the endpoint
@@ -1221,7 +1155,7 @@ export class XcodeInstances extends GeneratedXcodeInstances {
           isTransientError(err) ||
           (isDirectInstanceHttpError(err, 400) && /no successful RBE app build/i.test(err.body));
         const result = await retryTransient(post, { retryOn });
-        return { ...result, ...(signedDownloadUrl && { signedDownloadUrl }) };
+        return result;
       },
 
       async getActiveRbeBuilds(): Promise<RbeActiveBuild[]> {

package/src/resources/xcode-instances.ts

@@ -138,6 +138,12 @@ export namespace XcodeInstanceCreateParams {
   }
 
   export interface Spec {
+    /** Inline instance role. Omit for the organization's compatibility default. */
+    role?: {
+      /** Asset permissions delegated by the creator. An empty array grants nothing. */
+      permissions: Array<string>;
+    };
+
     /**
      * ClientLocation takes precedence over ClientIP regardless of clue order. Without
      * either clue, routing uses Cloudflare visitor coordinates, then its client IP.

package/src/version.ts

@@ -1 +1 @@
-export const VERSION = '0.65.1'; // x-release-please-version
+export const VERSION = '0.67.0'; // x-release-please-version

package/version.d.mts

@@ -1,2 +1,2 @@
-export declare const VERSION = "0.65.1";
+export declare const VERSION = "0.67.0";
 //# sourceMappingURL=version.d.mts.map

package/version.d.ts

@@ -1,2 +1,2 @@
-export declare const VERSION = "0.65.1";
+export declare const VERSION = "0.67.0";
 //# sourceMappingURL=version.d.ts.map

package/version.js

@@ -1,5 +1,5 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.VERSION = void 0;
-exports.VERSION = '0.65.1'; // x-release-please-version
+exports.VERSION = '0.67.0'; // x-release-please-version
 //# sourceMappingURL=version.js.map

package/version.mjs

@@ -1,2 +1,2 @@
-export const VERSION = '0.65.1'; // x-release-please-version
+export const VERSION = '0.67.0'; // x-release-please-version
 //# sourceMappingURL=version.mjs.map