@stapel/cdn-react 0.1.0 → 0.2.0

package/CHANGELOG.md

@@ -1 +1,65 @@
 # @stapel/cdn-react
+
+## 0.2.0
+
+### Minor Changes
+
+- 234a091: New pair: `@stapel/cdn-react` — the React half of `stapel-cdn`, and the end of
+  `profiles-react/src/api/cdnAvatarApi.ts`'s stated reason to exist.
+
+  The storefront spec's verdict was that the three upload implementations in this
+  fleet are three DIFFERENT contracts, not three copies of one algorithm, and this
+  package holds to it: it implements cdn's contract (multipart POST to an
+  authenticated origin), while the two genuinely contract-free bones the OTHER two
+  share stayed in `@stapel/core` (`putToForeignOrigin`, `useObjectUrlPreview`).
+  Only the second appears here — there is no foreign origin in this contract to
+  PUT to, and inventing a use for the first would have been the fourth copy in a
+  different disguise.
+
+  What cdn's contract has that the others do not is a content-addressed store with
+  a public "do you already have these bytes?" question, so the flow leads with it:
+
+  ```
+  validate ─┬─ refuse (client-side mirror of the deployment's own ceilings)
+            └─ hash ── file/exists/ ─┬─ HIT  → done, ZERO bytes sent
+                                     └─ MISS → multipart POST → wait for variants
+  ```
+
+  The hit leg is asserted by **counting requests**, which is the only assertion a
+  flow that merely looks right cannot pass. And a hit is checked three ways, not
+  one: `exists` alone answers about any object with those bytes, so the same file
+  stored earlier as a video — or as an avatar rather than a listing photo — is not
+  the row the POST would return, and short-circuiting on it would hand a composer
+  a reference to the wrong thing.
+
+  Surface:
+
+  - `useUploadQueue` / `<MediaUploader max={N}>` — the bag a listing composer
+    consumes. `refs` is the ordered `<type>/<hash>` list to store, `reorder` is the
+    only way that order moves, and `canAdd` / `settled` are `ActionAvailability`
+    so a switched-off Add and a switched-off Save each say which of the reasons
+    they are. Per-item cancel (including of an item still waiting for a
+    concurrency slot), retry, remove; a reopened draft starts from stored
+    references and makes no requests.
+  - `useUploadImage` / `<ImageUpload>` — the one-slot shape, built for
+    `profiles-react`'s `useSetAvatar` to sit on.
+  - `/default` — antd `<MediaGalleryField>` (grid, drag-reorder AND move buttons,
+    because drag reaches neither a keyboard nor a phone) and `<ImageUploadField>`.
+  - `toStapelImage` — the single place that knows stapel-cdn spells `tier` as an
+    int while `@stapel/image` spells it as a string.
+  - en inline, `./i18n/ru` and `./i18n/es` opt-in; the 11 error keys stapel-cdn
+    owns are authored here because upstream ships no `translations/` at all.
+
+  Two decisions recorded rather than papered over:
+
+  **No progress percentage.** `fetch` cannot observe request-body progress through
+  the injected client and `SubtleCrypto.digest` reports nothing mid-digest. A bar
+  would have meant forking onto `XMLHttpRequest` — a second transport with its own
+  auth, refresh and error handling — or animating a number nobody measured. The
+  bag names the PHASE instead.
+
+  **The pre-check is an optimisation and never fails the upload.** `file/exists/`
+  is `IsAuthenticated` while the upload endpoints take `IsNotAnonymousUser`, so a
+  guest reaches a 401 there and must still be able to post a photo; a page served
+  over plain `http://` has no `crypto.subtle` at all. Both fall through to the
+  POST and report `dedupSkipped` so a skin can explain it.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Stapel contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/llms.txt

@@ -1,4 +1,4 @@
-# @stapel/cdn-react 0.1.0
+# @stapel/cdn-react 0.2.0
 
 Headless React flow pair for stapel-cdn (contract >=0.12 <0.13) — business + state, zero visual opinion.
 Built on @stapel/core: typed client + StapelApiError envelope, auth token refresh,

package/manifest.json

@@ -1,7 +1,7 @@
 {
   "$generated": "by scripts/gen-manifest.mjs — do not edit; drift-gated (pnpm gen:manifest:check)",
   "package": "@stapel/cdn-react",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "backend": {
     "module": "stapel-cdn",
     "contract": ">=0.12 <0.13"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stapel/cdn-react",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Headless React pair for stapel-cdn: a typed media-upload client whose flow is dedup-first — SHA-256 the bytes, ask file/exists/, and skip the POST entirely when the CDN already holds them. A phase-shaped upload bag (validate → hash → check → upload → variants), an ordered queue with per-item cancel/retry/remove and a max, object-URL previews with the revoke built in (@stapel/core's useObjectUrlPreview), and the opaque `<type>/<hash>` reference every consuming module actually stores. Client-side limits mirror the backend's own declared ceilings and never refuse what the server would accept. Zero visual opinion in the main entry; an opt-in /default subpath ships the antd skin.",
   "license": "MIT",
   "repository": {
@@ -44,13 +44,6 @@
     "manifest.json",
     "llms.txt"
   ],
-  "scripts": {
-    "build": "tsc -p tsconfig.json",
-    "test": "tsc -p tsconfig.demo.json && vitest run --exclude test/prodBundlePurity.test.ts",
-    "test:pack": "vitest run test/prodBundlePurity.test.ts",
-    "lint": "eslint .",
-    "size": "size-limit"
-  },
   "size-limit": [
     {
       "name": "index — headless pair (client + dedup-first upload flow + queue), no antd",
@@ -94,11 +87,6 @@
   },
   "devDependencies": {
     "@size-limit/preset-small-lib": "^11.2.0",
-    "@stapel/core": "workspace:^",
-    "@stapel/image": "workspace:^",
-    "@stapel/showcase": "workspace:^",
-    "@stapel/tokens": "workspace:^",
-    "@stapel/tokens-antd": "workspace:^",
     "@tanstack/react-query": "^5.81.0",
     "@testing-library/react": "^16.3.0",
     "@types/react": "^19.1.0",
@@ -109,12 +97,24 @@
     "react-dom": "^19.1.0",
     "size-limit": "^11.2.0",
     "typescript": "^5.8.3",
-    "vitest": "^3.2.4"
+    "vitest": "^3.2.4",
+    "@stapel/core": "^0.15.0",
+    "@stapel/image": "^0.2.0",
+    "@stapel/showcase": "^0.2.0",
+    "@stapel/tokens": "^0.5.0",
+    "@stapel/tokens-antd": "^0.5.0"
   },
   "engines": {
     "node": ">=22"
   },
   "publishConfig": {
     "access": "public"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "test": "tsc -p tsconfig.demo.json && vitest run --exclude test/prodBundlePurity.test.ts",
+    "test:pack": "vitest run test/prodBundlePurity.test.ts",
+    "lint": "eslint .",
+    "size": "size-limit"
   }
-}
+}

package/src/analytics/generated/events.json

@@ -1,7 +1,7 @@
 {
   "$generated": "by scripts/gen-events.mjs — do not edit; drift-gated (pnpm gen:events:check)",
   "package": "@stapel/cdn-react",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "defined": [],
   "flows": []
 }