@mindstudio-ai/agent 0.1.83 → 0.1.84

package/dist/index.d.ts

@@ -1294,7 +1294,8 @@ interface Db {
 
 /**
  * Access level of a file store. `private` (the default) → reads are signed /
- * session-authorized; `public` → CDN-served (public serving ships later).
+ * session-authorized; `public` → world-readable, CDN-served on the app's own
+ * domain (and resizable via image query params).
  */
 type FileAccess = 'public' | 'private';
 /** Options for {@link Store.put}. */
@@ -1401,6 +1402,17 @@ declare class Store {
     }>;
     /** Delete an object. No-op if it doesn't exist. */
     delete(key: string): Promise<void>;
+    /**
+     * Mint an ABSOLUTE, signed share URL for a key — works with **no** active
+     * session (email it, or embed it on another site). Expires (default 24h).
+     * Private stores only.
+     *
+     * The same link is available as `file.shareUrl()` on a {@link StoredFile};
+     * this convenience skips the `head()` when you already hold just the key.
+     */
+    shareUrl(key: string, options?: {
+        expiresIn?: number;
+    }): Promise<string>;
     /**
      * Mint an {@link UploadToken} for a **client-direct** upload — the browser
      * POSTs the file straight to storage, so the bytes never pass through the
@@ -1412,6 +1424,10 @@ declare class Store {
      * `contentType` is set — an exact content-type match. When the store declares
      * `contentTypes`, `contentType` must be one of them.
      *
+     * Note: a presigned POST can pin exactly ONE content-type per token, so the
+     * *allowlist* is declared on `defineStore({ contentTypes })` and each token
+     * pins one type from it. This is by design, not a per-token limitation.
+     *
      * @example
      * ```ts
      * // backend method
@@ -1456,8 +1472,9 @@ declare class Store {
 interface DefineStoreOptions {
     /**
      * Access level. **Defaults to `'private'`** (signed / session-authorized
-     * reads). `'public'` marks the store CDN-served (public serving ships in a
-     * later phase). Pinned at define-time — no `put()` can change it.
+     * reads). `'public'` marks the store world-readable and CDN-served on the
+     * app's own domain (resizable via image query params). Pinned at define-time
+     * — no `put()` can change it.
      */
     access?: FileAccess;
     /**

package/dist/index.js

@@ -2011,6 +2011,23 @@ var Store = class {
       key
     });
   }
+  /**
+   * Mint an ABSOLUTE, signed share URL for a key — works with **no** active
+   * session (email it, or embed it on another site). Expires (default 24h).
+   * Private stores only.
+   *
+   * The same link is available as `file.shareUrl()` on a {@link StoredFile};
+   * this convenience skips the `head()` when you already hold just the key.
+   */
+  async shareUrl(key, options) {
+    const res = await this._call("sign", {
+      store: this._store,
+      access: this._access,
+      key,
+      ...options?.expiresIn ? { expiresIn: options.expiresIn } : {}
+    });
+    return res.url;
+  }
   /**
    * Mint an {@link UploadToken} for a **client-direct** upload — the browser
    * POSTs the file straight to storage, so the bytes never pass through the
@@ -2022,6 +2039,10 @@ var Store = class {
    * `contentType` is set — an exact content-type match. When the store declares
    * `contentTypes`, `contentType` must be one of them.
    *
+   * Note: a presigned POST can pin exactly ONE content-type per token, so the
+   * *allowlist* is declared on `defineStore({ contentTypes })` and each token
+   * pins one type from it. This is by design, not a per-token limitation.
+   *
    * @example
    * ```ts
    * // backend method