@transloadit/node 4.2.0 → 4.3.1

package/README.md

@@ -1,9 +1,6 @@
 [![Build Status](https://github.com/transloadit/node-sdk/actions/workflows/ci.yml/badge.svg)](https://github.com/transloadit/node-sdk/actions/workflows/ci.yml)
 [![Coverage](https://codecov.io/gh/transloadit/node-sdk/branch/main/graph/badge.svg)](https://codecov.io/gh/transloadit/node-sdk)
 
-> **Stability: Experimental.** This scoped package is new and may change without notice.  
-> For the stable SDK, use the unscoped `transloadit` package.
-
 <a href="https://transloadit.com/?utm_source=github&utm_medium=referral&utm_campaign=sdks&utm_content=node_sdk">
   <picture>
     <source media="(prefers-color-scheme: dark)" srcset="https://assets.transloadit.com/assets/images/sponsorships/logo-dark.svg">
@@ -112,6 +109,76 @@ npx transloadit assemblies replay --steps new-steps.json ASSEMBLY_ID
 npx transloadit assemblies replay --reparse-template ASSEMBLY_ID
 ```
 
+### Linting Assembly Instructions
+
+Lint Assembly Instructions locally using the same linter as the API.
+
+```bash
+# From a JSON file (full instructions or steps-only)
+npx transloadit assemblies lint --steps steps.json
+
+# From stdin
+cat steps.json | npx transloadit assemblies lint
+
+# Merge template content before linting
+npx transloadit assemblies lint --template TEMPLATE_ID --steps steps.json
+
+# Treat warnings as fatal; apply fixes (overwrites files / stdout for stdin)
+npx transloadit assemblies lint --fatal warning --fix --steps steps.json
+```
+
+When both `--template` and steps input are provided, Transloadit merges the template content with
+the provided steps before linting, matching the API's runtime behavior. If the template sets
+`allow_steps_override=false`, providing steps will fail with `TEMPLATE_DENIES_STEPS_OVERRIDE`.
+
+## SDK Helpers
+
+### prepareInputFiles
+
+`prepareInputFiles()` converts mixed file inputs into `files`, `uploads`, and optional
+`/http/import` steps so you can pass them directly into `createAssembly()` or
+`resumeAssemblyUploads()`.
+
+```ts
+import { prepareInputFiles } from '@transloadit/node'
+
+const prepared = await prepareInputFiles({
+  inputFiles: [
+    { kind: 'path', field: 'video', path: '/tmp/video.mp4' },
+    { kind: 'base64', field: 'logo', filename: 'logo.png', base64: '...' },
+    { kind: 'url', field: 'remote', url: 'https://example.com/file.jpg' },
+  ],
+  params: {
+    steps: {
+      ':original': { robot: '/upload/handle' },
+      encode: { robot: '/video/encode', use: ':original' },
+    },
+  },
+  base64Strategy: 'tempfile',
+  urlStrategy: 'import-if-present',
+  maxBase64Bytes: 512_000,
+  allowPrivateUrls: true,
+})
+
+await client.createAssembly({
+  params: prepared.params,
+  files: prepared.files,
+  uploads: prepared.uploads,
+})
+```
+
+Options:
+
+- `inputFiles` – Array of `{ kind, field, ... }` entries for `path`, `base64`, or `url` inputs.
+- `params` – Assembly instructions; steps will be extended when URL imports are injected.
+- `fields` – Extra form fields to merge into `params.fields`.
+- `base64Strategy` – `'buffer'` (default) or `'tempfile'` for base64 inputs.
+- `urlStrategy` – `'import'`, `'download'`, or `'import-if-present'` (default `'import'`).
+- `maxBase64Bytes` – Optional size cap (decoded bytes). Overages throw before decoding.
+- `allowPrivateUrls` – Allow downloading private/loopback URLs when using `urlStrategy: 'download'`
+  (default `true`). Hosted deployments should disable this.
+- `tempDir` – Optional temp directory base when `base64Strategy: 'tempfile'`.
+
 ### Managing Templates
 
 ```bash
@@ -268,7 +335,8 @@ names stable and pass the same files. Only path-based inputs resume; Buffer/stri
 start a new tus upload automatically.
 
 You can pass the same upload and progress options as `createAssembly` (such as `chunkSize`,
-`uploadConcurrency`, `waitForCompletion`, `timeout`, `onUploadProgress`, and `onAssemblyProgress`).
+`uploadConcurrency`, `uploadBehavior`, `waitForCompletion`, `timeout`, `onUploadProgress`, and
+`onAssemblyProgress`).
 When `waitForCompletion` is `true`, the SDK will poll and resolve once the Assembly is finished.
 
 ```javascript
@@ -354,9 +422,17 @@ You can provide the following keys inside the `options` object:
 - `onAssemblyProgress` - Once the Assembly has started processing this will be periodically called with the _Assembly Execution Status_ (result of `getAssembly`) **only if `waitForCompletion` is `true`**.
 - `chunkSize` - (for uploads) a number indicating the maximum size of a tus `PATCH` request body in bytes. Default to `Infinity` for file uploads and 50MB for streams of unknown length. See [tus-js-client](https://github.com/tus/tus-js-client/blob/master/docs/api.md#chunksize).
 - `uploadConcurrency` - Maximum number of concurrent tus file uploads to occur at any given time (default 10.)
+- `uploadBehavior` - Controls how uploads are handled:
+  - `await` (default) waits for all uploads to finish.
+  - `background` starts uploads and returns once upload URLs are created.
+  - `none` returns upload URLs without uploading any bytes.
+  - When `uploadBehavior` is not `await`, `waitForCompletion` is ignored.
 
 **NOTE**: Make sure the key in `files` and `uploads` is not one of `signature`, `params` or `max_size`.
 
+When `uploadBehavior` is `background` or `none`, the resolved Assembly object includes
+`upload_urls` with a map of field names to tus upload URLs.
+
 Example code showing all options:
 
 ```js
@@ -416,6 +492,42 @@ See also:
 - [API documentation](https://transloadit.com/docs/api/assemblies-post/)
 - Error codes and retry logic below
 
+#### async lintAssemblyInstructions(options)
+
+Lint Assembly Instructions locally using the same linter as the API.
+If you provide a `templateId`, the template content is fetched and merged with your instructions
+before linting (matching the API's runtime merge behavior). If the template sets
+`allow_steps_override=false`, providing steps will throw `TEMPLATE_DENIES_STEPS_OVERRIDE`.
+
+The `options` object accepts:
+
+- `assemblyInstructions` - Assembly Instructions as a JSON string, a full instructions object, or a steps-only object.
+  If no `steps` property is present, the object is treated as steps.
+- `templateId` - Optional template ID to merge before linting.
+- `fatal` - `'error' | 'warning'` (default: `'error'`). When set to `'warning'`, warnings are treated as fatal.
+- `fix` - Apply auto-fixes where possible. If `true`, the result includes `fixedInstructions`.
+
+The method returns:
+
+- `success` - `true` when no fatal issues are found.
+- `issues` - Array of lint issues (each includes `code`, `type`, `row`, `column`, and `desc`).
+- `fixedInstructions` - The fixed JSON string when `fix` is `true` (steps-only inputs return steps-only JSON).
+
+Example:
+
+```js
+const result = await transloadit.lintAssemblyInstructions({
+  assemblyInstructions: {
+    resize: { robot: '/image/resize', use: ':original', width: 100, height: 100 },
+  },
+  fatal: 'warning',
+})
+
+if (!result.success) {
+  console.log(result.issues)
+}
+```
+
 #### async listAssemblies(params)
 
 Retrieve Assemblies according to the given `params`.

package/dist/Transloadit.d.ts

@@ -5,15 +5,28 @@ import { ApiError } from './ApiError.ts';
 import type { AssemblyIndexItem, AssemblyStatus } from './alphalib/types/assemblyStatus.ts';
 import type { BaseResponse, BillResponse, CreateAssemblyParams, CreateTemplateCredentialParams, CreateTemplateParams, EditTemplateParams, ListAssembliesParams, ListedTemplate, ListTemplateCredentialsParams, ListTemplatesParams, OptionalAuthParams, PaginationListWithCount, ReplayAssemblyNotificationParams, ReplayAssemblyNotificationResponse, ReplayAssemblyParams, ReplayAssemblyResponse, TemplateCredentialResponse, TemplateCredentialsResponse, TemplateResponse } from './apiTypes.ts';
 import InconsistentResponseError from './InconsistentResponseError.ts';
+import type { LintAssemblyInstructionsInput, LintAssemblyInstructionsResult } from './lintAssemblyInstructions.ts';
 import PaginationStream from './PaginationStream.ts';
+import type { UploadBehavior } from './tus.ts';
 export { HTTPError, MaxRedirectsError, ParseError, ReadError, RequestError, TimeoutError, UploadError, } from 'got';
+export { goldenTemplates } from './alphalib/goldenTemplates.ts';
 export type { AssemblyStatus } from './alphalib/types/assemblyStatus.ts';
 export * from './apiTypes.ts';
 export { InconsistentResponseError, ApiError };
+export { mergeTemplateContent } from './alphalib/templateMerge.ts';
+export type { Base64Strategy, InputFile, PrepareInputFilesOptions, PrepareInputFilesResult, UploadInput, UrlStrategy, } from './inputFiles.ts';
+export { prepareInputFiles } from './inputFiles.ts';
+export type { LintAssemblyInstructionsResult, LintFatalLevel } from './lintAssemblyInstructions.ts';
+export type { RobotHelp, RobotHelpOptions, RobotListItem, RobotListOptions, RobotListResult, RobotParamHelp, } from './robots.ts';
+export { getRobotHelp, listRobots } from './robots.ts';
 export interface UploadProgress {
     uploadedBytes?: number | undefined;
     totalBytes?: number | undefined;
 }
+export type { UploadBehavior };
+export type AssemblyStatusWithUploadUrls = AssemblyStatus & {
+    upload_urls?: Record<string, string>;
+};
 export type AssemblyProgress = (assembly: AssemblyStatus) => void;
 interface AssemblyUploadOptions {
     files?: {
@@ -22,6 +35,7 @@ interface AssemblyUploadOptions {
     uploads?: {
         [name: string]: Readable | IntoStreamInput;
     };
+    uploadBehavior?: UploadBehavior;
     waitForCompletion?: boolean;
     chunkSize?: number;
     uploadConcurrency?: number;
@@ -63,6 +77,12 @@ export interface AwaitAssemblyCompletionOptions {
      */
     onPoll?: () => boolean | undefined;
 }
+export interface LintAssemblyInstructionsOptions extends Omit<LintAssemblyInstructionsInput, 'template'> {
+    /**
+     * Template ID to merge with the provided instructions before linting.
+     */
+    templateId?: string;
+}
 export interface SmartCDNUrlOptions {
     /**
      * Workspace slug
@@ -87,21 +107,31 @@ export interface SmartCDNUrlOptions {
     expiresAt?: number;
 }
 export type Fields = Record<string, string | number>;
-interface CreateAssemblyPromise extends Promise<AssemblyStatus> {
+interface CreateAssemblyPromise extends Promise<AssemblyStatusWithUploadUrls> {
     assemblyId: string;
 }
-export interface Options {
+type AuthKeySecret = {
     authKey: string;
     authSecret: string;
+    authToken?: undefined;
+};
+type AuthToken = {
+    authToken: string;
+    authKey?: string;
+    authSecret?: string;
+};
+type BaseOptions = {
     endpoint?: string;
     maxRetries?: number;
     timeout?: number;
     gotRetry?: Partial<RetryOptions>;
     validateResponses?: boolean;
-}
+};
+export type Options = BaseOptions & (AuthKeySecret | AuthToken);
 export declare class Transloadit {
     private _authKey;
     private _authSecret;
+    private _authToken;
     private _endpoint;
     private _maxRetries;
     private _defaultTimeout;
@@ -117,7 +147,18 @@ export declare class Transloadit {
      * @param opts assembly options
      */
     createAssembly(opts?: CreateAssemblyOptions): CreateAssemblyPromise;
-    resumeAssemblyUploads(opts: ResumeAssemblyUploadsOptions): Promise<AssemblyStatus>;
+    /**
+     * Lint Assembly Instructions locally.
+     *
+     * If a templateId is provided, the template content is merged with the instructions,
+     * just like the API. When a template sets `allow_steps_override=false`, providing
+     * `steps` will throw a TEMPLATE_DENIES_STEPS_OVERRIDE error.
+     *
+     * The `assemblyInstructions` input may be a JSON string, a full instructions object,
+     * or a steps-only object (missing the `steps` property).
+     */
+    lintAssemblyInstructions(options: LintAssemblyInstructionsOptions): Promise<LintAssemblyInstructionsResult>;
+    resumeAssemblyUploads(opts: ResumeAssemblyUploadsOptions): Promise<AssemblyStatusWithUploadUrls>;
     awaitAssemblyCompletion(assemblyId: string, { onAssemblyProgress, timeout, startTimeMs, interval, assemblyUrl, signal, onPoll, }?: AwaitAssemblyCompletionOptions): Promise<AssemblyStatus>;
     maybeThrowInconsistentResponseError(message: string): void;
     /**

package/dist/Transloadit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Transloadit.d.ts","sourceRoot":"","sources":["../src/Transloadit.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAK3C,OAAO,KAAK,EAA8C,YAAY,EAAE,MAAM,KAAK,CAAA;AAEnF,OAAmB,EAAE,KAAK,KAAK,IAAI,eAAe,EAAE,MAAM,aAAa,CAAA;AAKvE,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,KAAK,EAEV,iBAAiB,EACjB,cAAc,EACf,MAAM,oCAAoC,CAAA;AAG3C,OAAO,KAAK,EACV,YAAY,EACZ,YAAY,EACZ,oBAAoB,EACpB,8BAA8B,EAC9B,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,cAAc,EACd,6BAA6B,EAC7B,mBAAmB,EACnB,kBAAkB,EAClB,uBAAuB,EACvB,gCAAgC,EAChC,kCAAkC,EAClC,oBAAoB,EACpB,sBAAsB,EACtB,0BAA0B,EAC1B,2BAA2B,EAC3B,gBAAgB,EACjB,MAAM,eAAe,CAAA;AACtB,OAAO,yBAAyB,MAAM,gCAAgC,CAAA;AACtE,OAAO,gBAAgB,MAAM,uBAAuB,CAAA;AAOpD,OAAO,EACL,SAAS,EACT,iBAAiB,EACjB,UAAU,EACV,SAAS,EACT,YAAY,EACZ,YAAY,EACZ,WAAW,GACZ,MAAM,KAAK,CAAA;AAEZ,YAAY,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAA;AACxE,cAAc,eAAe,CAAA;AAC7B,OAAO,EAAE,yBAAyB,EAAE,QAAQ,EAAE,CAAA;AAK9C,MAAM,WAAW,cAAc;IAC7B,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAClC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAChC;AAID,MAAM,MAAM,gBAAgB,GAAG,CAAC,QAAQ,EAAE,cAAc,KAAK,IAAI,CAAA;AAoEjE,UAAU,qBAAqB;IAC7B,KAAK,CAAC,EAAE;QACN,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAA;KACvB,CAAA;IACD,OAAO,CAAC,EAAE;QACR,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,eAAe,CAAA;KAC3C,CAAA;IACD,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,gBAAgB,CAAC,EAAE,CAAC,cAAc,EAAE,cAAc,KAAK,IAAI,CAAA;IAC3D,kBAAkB,CAAC,EAAE,gBAAgB,CAAA;IACrC;;;OAGG;IACH,MAAM,CAAC,EAAE,WAAW,CAAA;CACrB;AAED,MAAM,WAAW,qBAAsB,SAAQ,qBAAqB;IAClE,MAAM,CAAC,EAAE,oBAAoB,CAAA;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,4BAA6B,SAAQ,qBAAqB;IACzE,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,8BAA8B;IAC7C,kBAAkB,CAAC,EAAE,gBAAgB,CAAA;IACrC,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;OAGG;IACH,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,OAAO,GAAG,SAAS,CAAA;CACnC;AAED,MAAM,WAAW,kBAAkB;IACjC;;OAEG;IACH,SAAS,EAAE,MAAM,CAAA;IACjB;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAA;IAChB;;OAEG;IACH,KAAK,EAAE,MAAM,CAAA;IACb;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,CAAA;IACrF;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAA;AAGpD,UAAU,qBAAsB,SAAQ,OAAO,CAAC,cAAc,CAAC;IAC7D,UAAU,EAAE,MAAM,CAAA;CACnB;AAkCD,MAAM,WAAW,OAAO;IACtB,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,CAAA;IAChC,iBAAiB,CAAC,EAAE,OAAO,CAAA;CAC5B;AAED,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAQ;IAExB,OAAO,CAAC,WAAW,CAAQ;IAE3B,OAAO,CAAC,SAAS,CAAQ;IAEzB,OAAO,CAAC,WAAW,CAAQ;IAE3B,OAAO,CAAC,eAAe,CAAQ;IAE/B,OAAO,CAAC,SAAS,CAAuB;IAExC,OAAO,CAAC,oBAAoB,CAAK;IAEjC,OAAO,CAAC,kBAAkB,CAAQ;gBAEtB,IAAI,EAAE,OAAO;IAyBzB,sBAAsB,IAAI,MAAM;IAIhC,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAIxC;;;;OAIG;IACH,cAAc,CAAC,IAAI,GAAE,qBAA0B,GAAG,qBAAqB;IAmHjE,qBAAqB,CAAC,IAAI,EAAE,4BAA4B,GAAG,OAAO,CAAC,cAAc,CAAC;IAsHlF,uBAAuB,CAC3B,UAAU,EAAE,MAAM,EAClB,EACE,kBAA6B,EAC7B,OAAO,EACP,WAA2B,EAC3B,QAAe,EACf,WAAW,EACX,MAAM,EACN,MAAM,GACP,GAAE,8BAAmC,GACrC,OAAO,CAAC,cAAc,CAAC;IAqE1B,mCAAmC,CAAC,OAAO,EAAE,MAAM;IAenD;;;;;OAKG;IACG,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAmBjE;;;;;;OAMG;IACG,cAAc,CAClB,UAAU,EAAE,MAAM,EAClB,MAAM,GAAE,oBAAyB,GAChC,OAAO,CAAC,sBAAsB,CAAC;IAUlC;;;;;;OAMG;IACG,0BAA0B,CAC9B,UAAU,EAAE,MAAM,EAClB,MAAM,GAAE,gCAAqC,GAC5C,OAAO,CAAC,kCAAkC,CAAC;IAQ9C;;;;;OAKG;IACG,cAAc,CAClB,MAAM,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,uBAAuB,CAAC,iBAAiB,CAAC,CAAC;IAkCtD,gBAAgB,CAAC,MAAM,EAAE,oBAAoB,GAAG,QAAQ;IAIxD;;;;;;OAMG;IACG,WAAW,CACf,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,GACjC,OAAO,CAAC,cAAc,CAAC;YAOZ,oBAAoB;IA4BlC;;;;;OAKG;IACG,wBAAwB,CAC5B,MAAM,EAAE,8BAA8B,GACrC,OAAO,CAAC,0BAA0B,CAAC;IAQtC;;;;;;OAMG;IACG,sBAAsB,CAC1B,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,8BAA8B,GACrC,OAAO,CAAC,0BAA0B,CAAC;IAQtC;;;;;OAKG;IACG,wBAAwB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAO3E;;;;;OAKG;IACG,qBAAqB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,CAAC;IAOtF;;;;;OAKG;IACG,uBAAuB,CAC3B,MAAM,CAAC,EAAE,6BAA6B,GACrC,OAAO,CAAC,2BAA2B,CAAC;IAQvC,yBAAyB,CAAC,MAAM,EAAE,6BAA6B;IAM/D;;;;;OAKG;IACG,cAAc,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAQ7E;;;;;;OAMG;IACG,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAQ7F;;;;;OAKG;IACG,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAO/D;;;;;OAKG;IACG,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAOhE;;;;;OAKG;IACG,aAAa,CACjB,MAAM,CAAC,EAAE,mBAAmB,GAC3B,OAAO,CAAC,uBAAuB,CAAC,cAAc,CAAC,CAAC;IAQnD,eAAe,CAAC,MAAM,CAAC,EAAE,mBAAmB,GAAG,gBAAgB,CAAC,cAAc,CAAC;IAI/E;;;;;;OAMG;IACG,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAQnD,aAAa,CACX,MAAM,EAAE,kBAAkB,EAC1B,SAAS,CAAC,EAAE,MAAM,GACjB;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;IAOxC;;OAEG;IACH,oBAAoB,CAAC,IAAI,EAAE,kBAAkB,GAAG,MAAM;IAQtD,OAAO,CAAC,cAAc;IAMtB,OAAO,CAAC,WAAW;IAkBnB,OAAO,CAAC,kBAAkB;IAS1B,OAAO,CAAC,cAAc;IAmBtB,OAAO,CAAC,eAAe;YAST,WAAW;CAoH1B"}
+{"version":3,"file":"Transloadit.d.ts","sourceRoot":"","sources":["../src/Transloadit.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAK3C,OAAO,KAAK,EAA8C,YAAY,EAAE,MAAM,KAAK,CAAA;AAEnF,OAAmB,EAAE,KAAK,KAAK,IAAI,eAAe,EAAE,MAAM,aAAa,CAAA;AAKvE,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,KAAK,EAEV,iBAAiB,EACjB,cAAc,EACf,MAAM,oCAAoC,CAAA;AAG3C,OAAO,KAAK,EACV,YAAY,EACZ,YAAY,EACZ,oBAAoB,EACpB,8BAA8B,EAC9B,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,cAAc,EACd,6BAA6B,EAC7B,mBAAmB,EACnB,kBAAkB,EAClB,uBAAuB,EACvB,gCAAgC,EAChC,kCAAkC,EAClC,oBAAoB,EACpB,sBAAsB,EACtB,0BAA0B,EAC1B,2BAA2B,EAC3B,gBAAgB,EACjB,MAAM,eAAe,CAAA;AACtB,OAAO,yBAAyB,MAAM,gCAAgC,CAAA;AACtE,OAAO,KAAK,EACV,6BAA6B,EAC7B,8BAA8B,EAC/B,MAAM,+BAA+B,CAAA;AAEtC,OAAO,gBAAgB,MAAM,uBAAuB,CAAA;AAEpD,OAAO,KAAK,EAAU,cAAc,EAAE,MAAM,UAAU,CAAA;AAKtD,OAAO,EACL,SAAS,EACT,iBAAiB,EACjB,UAAU,EACV,SAAS,EACT,YAAY,EACZ,YAAY,EACZ,WAAW,GACZ,MAAM,KAAK,CAAA;AACZ,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAA;AAC/D,YAAY,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAA;AACxE,cAAc,eAAe,CAAA;AAC7B,OAAO,EAAE,yBAAyB,EAAE,QAAQ,EAAE,CAAA;AAC9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAClE,YAAY,EACV,cAAc,EACd,SAAS,EACT,wBAAwB,EACxB,uBAAuB,EACvB,WAAW,EACX,WAAW,GACZ,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACnD,YAAY,EAAE,8BAA8B,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA;AACnG,YAAY,EACV,SAAS,EACT,gBAAgB,EAChB,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,cAAc,GACf,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAKtD,MAAM,WAAW,cAAc;IAC7B,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAClC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAChC;AAED,YAAY,EAAE,cAAc,EAAE,CAAA;AAE9B,MAAM,MAAM,4BAA4B,GAAG,cAAc,GAAG;IAC1D,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACrC,CAAA;AAID,MAAM,MAAM,gBAAgB,GAAG,CAAC,QAAQ,EAAE,cAAc,KAAK,IAAI,CAAA;AAoEjE,UAAU,qBAAqB;IAC7B,KAAK,CAAC,EAAE;QACN,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAA;KACvB,CAAA;IACD,OAAO,CAAC,EAAE;QACR,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,eAAe,CAAA;KAC3C,CAAA;IACD,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,gBAAgB,CAAC,EAAE,CAAC,cAAc,EAAE,cAAc,KAAK,IAAI,CAAA;IAC3D,kBAAkB,CAAC,EAAE,gBAAgB,CAAA;IACrC;;;OAGG;IACH,MAAM,CAAC,EAAE,WAAW,CAAA;CACrB;AAED,MAAM,WAAW,qBAAsB,SAAQ,qBAAqB;IAClE,MAAM,CAAC,EAAE,oBAAoB,CAAA;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,4BAA6B,SAAQ,qBAAqB;IACzE,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,8BAA8B;IAC7C,kBAAkB,CAAC,EAAE,gBAAgB,CAAA;IACrC,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;OAGG;IACH,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,OAAO,GAAG,SAAS,CAAA;CACnC;AAED,MAAM,WAAW,+BACf,SAAQ,IAAI,CAAC,6BAA6B,EAAE,UAAU,CAAC;IACvD;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC;;OAEG;IACH,SAAS,EAAE,MAAM,CAAA;IACjB;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAA;IAChB;;OAEG;IACH,KAAK,EAAE,MAAM,CAAA;IACb;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,CAAA;IACrF;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAA;AAGpD,UAAU,qBAAsB,SAAQ,OAAO,CAAC,4BAA4B,CAAC;IAC3E,UAAU,EAAE,MAAM,CAAA;CACnB;AAkCD,KAAK,aAAa,GAAG;IACnB,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,SAAS,CAAA;CACtB,CAAA;AAED,KAAK,SAAS,GAAG;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB,CAAA;AAED,KAAK,WAAW,GAAG;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,CAAA;IAChC,iBAAiB,CAAC,EAAE,OAAO,CAAA;CAC5B,CAAA;AAED,MAAM,MAAM,OAAO,GAAG,WAAW,GAAG,CAAC,aAAa,GAAG,SAAS,CAAC,CAAA;AAE/D,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAQ;IAExB,OAAO,CAAC,WAAW,CAAQ;IAE3B,OAAO,CAAC,UAAU,CAAe;IAEjC,OAAO,CAAC,SAAS,CAAQ;IAEzB,OAAO,CAAC,WAAW,CAAQ;IAE3B,OAAO,CAAC,eAAe,CAAQ;IAE/B,OAAO,CAAC,SAAS,CAAuB;IAExC,OAAO,CAAC,oBAAoB,CAAK;IAEjC,OAAO,CAAC,kBAAkB,CAAQ;gBAEtB,IAAI,EAAE,OAAO;IA+BzB,sBAAsB,IAAI,MAAM;IAIhC,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAIxC;;;;OAIG;IACH,cAAc,CAAC,IAAI,GAAE,qBAA0B,GAAG,qBAAqB;IAyHvE;;;;;;;;;OASG;IACG,wBAAwB,CAC5B,OAAO,EAAE,+BAA+B,GACvC,OAAO,CAAC,8BAA8B,CAAC;IAapC,qBAAqB,CACzB,IAAI,EAAE,4BAA4B,GACjC,OAAO,CAAC,4BAA4B,CAAC;IAsIlC,uBAAuB,CAC3B,UAAU,EAAE,MAAM,EAClB,EACE,kBAA6B,EAC7B,OAAO,EACP,WAA2B,EAC3B,QAAe,EACf,WAAW,EACX,MAAM,EACN,MAAM,GACP,GAAE,8BAAmC,GACrC,OAAO,CAAC,cAAc,CAAC;IAqE1B,mCAAmC,CAAC,OAAO,EAAE,MAAM;IAenD;;;;;OAKG;IACG,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAoBjE;;;;;;OAMG;IACG,cAAc,CAClB,UAAU,EAAE,MAAM,EAClB,MAAM,GAAE,oBAAyB,GAChC,OAAO,CAAC,sBAAsB,CAAC;IAUlC;;;;;;OAMG;IACG,0BAA0B,CAC9B,UAAU,EAAE,MAAM,EAClB,MAAM,GAAE,gCAAqC,GAC5C,OAAO,CAAC,kCAAkC,CAAC;IAQ9C;;;;;OAKG;IACG,cAAc,CAClB,MAAM,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,uBAAuB,CAAC,iBAAiB,CAAC,CAAC;IAkCtD,gBAAgB,CAAC,MAAM,EAAE,oBAAoB,GAAG,QAAQ;IAIxD;;;;;;OAMG;IACG,WAAW,CACf,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,GACjC,OAAO,CAAC,cAAc,CAAC;YAOZ,oBAAoB;IA6BlC;;;;;OAKG;IACG,wBAAwB,CAC5B,MAAM,EAAE,8BAA8B,GACrC,OAAO,CAAC,0BAA0B,CAAC;IAQtC;;;;;;OAMG;IACG,sBAAsB,CAC1B,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,8BAA8B,GACrC,OAAO,CAAC,0BAA0B,CAAC;IAQtC;;;;;OAKG;IACG,wBAAwB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAO3E;;;;;OAKG;IACG,qBAAqB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,CAAC;IAOtF;;;;;OAKG;IACG,uBAAuB,CAC3B,MAAM,CAAC,EAAE,6BAA6B,GACrC,OAAO,CAAC,2BAA2B,CAAC;IAQvC,yBAAyB,CAAC,MAAM,EAAE,6BAA6B;IAM/D;;;;;OAKG;IACG,cAAc,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAQ7E;;;;;;OAMG;IACG,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAQ7F;;;;;OAKG;IACG,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAO/D;;;;;OAKG;IACG,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAOhE;;;;;OAKG;IACG,aAAa,CACjB,MAAM,CAAC,EAAE,mBAAmB,GAC3B,OAAO,CAAC,uBAAuB,CAAC,cAAc,CAAC,CAAC;IAQnD,eAAe,CAAC,MAAM,CAAC,EAAE,mBAAmB,GAAG,gBAAgB,CAAC,cAAc,CAAC;IAI/E;;;;;;OAMG;IACG,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAQnD,aAAa,CACX,MAAM,EAAE,kBAAkB,EAC1B,SAAS,CAAC,EAAE,MAAM,GACjB;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;IAUxC;;OAEG;IACH,oBAAoB,CAAC,IAAI,EAAE,kBAAkB,GAAG,MAAM;IAWtD,OAAO,CAAC,cAAc;IAStB,OAAO,CAAC,WAAW;IA0BnB,OAAO,CAAC,kBAAkB;IAe1B,OAAO,CAAC,cAAc;IAmBtB,OAAO,CAAC,eAAe;YAST,WAAW;CA8H1B"}

package/dist/Transloadit.js

@@ -16,14 +16,19 @@ import { ApiError } from "./ApiError.js";
 import { assemblyIndexSchema, assemblyStatusSchema } from "./alphalib/types/assemblyStatus.js";
 import { zodParseWithContext } from "./alphalib/zodParseWithContext.js";
 import InconsistentResponseError from "./InconsistentResponseError.js";
+import { lintAssemblyInstructions as lintAssemblyInstructionsInternal } from "./lintAssemblyInstructions.js";
 import PaginationStream from "./PaginationStream.js";
 import PollingTimeoutError from "./PollingTimeoutError.js";
 import { sendTusRequest } from "./tus.js";
 // See https://github.com/sindresorhus/got/tree/v11.8.6?tab=readme-ov-file#errors
 // Expose relevant errors
 export { HTTPError, MaxRedirectsError, ParseError, ReadError, RequestError, TimeoutError, UploadError, } from 'got';
+export { goldenTemplates } from "./alphalib/goldenTemplates.js";
 export * from "./apiTypes.js";
 export { InconsistentResponseError, ApiError };
+export { mergeTemplateContent } from "./alphalib/templateMerge.js";
+export { prepareInputFiles } from "./inputFiles.js";
+export { getRobotHelp, listRobots } from "./robots.js";
 const log = debug('transloadit');
 const logWarn = debug('transloadit:warn');
 const { version } = packageJson;
@@ -105,6 +110,7 @@ function checkResult(result) {
 export class Transloadit {
     _authKey;
     _authSecret;
+    _authToken;
     _endpoint;
     _maxRetries;
     _defaultTimeout;
@@ -112,17 +118,22 @@ export class Transloadit {
     _lastUsedAssemblyUrl = '';
     _validateResponses = false;
     constructor(opts) {
-        if (opts?.authKey == null) {
-            throw new Error('Please provide an authKey');
-        }
-        if (opts.authSecret == null) {
-            throw new Error('Please provide an authSecret');
-        }
+        const rawToken = typeof opts?.authToken === 'string' ? opts.authToken.trim() : '';
+        const hasToken = rawToken.length > 0;
         if (opts.endpoint?.endsWith('/')) {
             throw new Error('Trailing slash in endpoint is not allowed');
         }
-        this._authKey = opts.authKey;
-        this._authSecret = opts.authSecret;
+        if (!hasToken) {
+            if (opts?.authKey == null) {
+                throw new Error('Please provide an authKey');
+            }
+            if (opts.authSecret == null) {
+                throw new Error('Please provide an authSecret');
+            }
+        }
+        this._authKey = opts.authKey ?? '';
+        this._authSecret = opts.authSecret ?? '';
+        this._authToken = hasToken ? rawToken : null;
         this._endpoint = opts.endpoint || 'https://api2.transloadit.com';
         this._maxRetries = opts.maxRetries != null ? opts.maxRetries : 5;
         this._defaultTimeout = opts.timeout != null ? opts.timeout : 60000;
@@ -144,7 +155,7 @@ export class Transloadit {
      */
     createAssembly(opts = {}) {
         const { params = {}, waitForCompletion = false, chunkSize: requestedChunkSize = Number.POSITIVE_INFINITY, uploadConcurrency = 10, timeout = 24 * 60 * 60 * 1000, // 1 day
-        onUploadProgress = () => { }, onAssemblyProgress = () => { }, files = {}, uploads = {}, assemblyId, signal, } = opts;
+        onUploadProgress = () => { }, onAssemblyProgress = () => { }, files = {}, uploads = {}, assemblyId, signal, uploadBehavior = 'await', } = opts;
         // Keep track of how long the request took
         const startTimeMs = getHrTimeMs();
         // Undocumented feature to allow specifying a custom assembly id from the client
@@ -198,16 +209,21 @@ export class Transloadit {
                 });
                 checkResult(result);
                 if (Object.keys(allStreamsMap).length > 0) {
-                    await sendTusRequest({
+                    const { uploadUrls } = await sendTusRequest({
                         streamsMap: allStreamsMap,
                         assembly: result,
                         onProgress: onUploadProgress,
                         requestedChunkSize,
                         uploadConcurrency,
                         signal,
+                        uploadBehavior,
                     });
+                    if (uploadBehavior !== 'await' && Object.keys(uploadUrls).length > 0) {
+                        result.upload_urls = uploadUrls;
+                    }
                 }
-                if (!waitForCompletion)
+                const shouldWaitForCompletion = waitForCompletion && uploadBehavior === 'await';
+                if (!shouldWaitForCompletion)
                     return result;
                 if (result.assembly_id == null) {
                     throw new InconsistentResponseError('Server returned an assembly response without an assembly_id after creation');
@@ -226,12 +242,36 @@ export class Transloadit {
         // This allows the user to use or log the assemblyId even before it has been created for easier debugging
         return Object.assign(promise, { assemblyId: effectiveAssemblyId });
     }
+    /**
+     * Lint Assembly Instructions locally.
+     *
+     * If a templateId is provided, the template content is merged with the instructions,
+     * just like the API. When a template sets `allow_steps_override=false`, providing
+     * `steps` will throw a TEMPLATE_DENIES_STEPS_OVERRIDE error.
+     *
+     * The `assemblyInstructions` input may be a JSON string, a full instructions object,
+     * or a steps-only object (missing the `steps` property).
+     */
+    async lintAssemblyInstructions(options) {
+        const { templateId, ...rest } = options;
+        if (!templateId) {
+            return await lintAssemblyInstructionsInternal(rest);
+        }
+        const template = await this.getTemplate(templateId);
+        return await lintAssemblyInstructionsInternal({
+            ...rest,
+            template: template.content,
+        });
+    }
     async resumeAssemblyUploads(opts) {
         const { assemblyUrl, files = {}, uploads = {}, chunkSize: requestedChunkSize = Number.POSITIVE_INFINITY, uploadConcurrency = 10, timeout = 24 * 60 * 60 * 1000, // 1 day
-        waitForCompletion = false, onUploadProgress = () => { }, onAssemblyProgress = () => { }, signal, } = opts;
+        waitForCompletion = false, onUploadProgress = () => { }, onAssemblyProgress = () => { }, signal, uploadBehavior = 'await', } = opts;
         const startTimeMs = getHrTimeMs();
         getAssemblyIdFromUrl(assemblyUrl);
-        const assembly = await this._fetchAssemblyStatus({ url: assemblyUrl, signal });
+        const assembly = await this._fetchAssemblyStatus({
+            url: assemblyUrl,
+            signal,
+        });
         const statusUrl = assembly.assembly_ssl_url ?? assembly.assembly_url ?? assemblyUrl;
         const finishedKeys = new Set();
         for (const upload of assembly.uploads ?? []) {
@@ -302,11 +342,23 @@ export class Transloadit {
                 onProgress: onUploadProgress,
                 signal,
                 uploadUrls: uploadUrlsByLabel,
+                uploadBehavior,
             });
             await Promise.race([uploadPromise, streamErrorPromise]);
+            const { uploadUrls } = await uploadPromise;
+            if (uploadBehavior !== 'await' && Object.keys(uploadUrls).length > 0) {
+                assembly.upload_urls = uploadUrls;
+            }
+        }
+        const latestAssembly = await this._fetchAssemblyStatus({
+            url: statusUrl,
+            signal,
+        });
+        if (uploadBehavior !== 'await' && assembly.upload_urls) {
+            latestAssembly.upload_urls = assembly.upload_urls;
         }
-        const latestAssembly = await this._fetchAssemblyStatus({ url: statusUrl, signal });
-        if (!waitForCompletion)
+        const shouldWaitForCompletion = waitForCompletion && uploadBehavior === 'await';
+        if (!shouldWaitForCompletion)
             return latestAssembly;
         if (latestAssembly.assembly_id == null) {
             throw new InconsistentResponseError('Server returned an assembly response without an assembly_id after resuming uploads');
@@ -398,6 +450,7 @@ export class Transloadit {
         const { assembly_ssl_url: url } = await this.getAssembly(assemblyId);
         const rawResult = await this._remoteJson({
             url,
+            isTrustedUrl: true,
             method: 'delete',
         });
         const parsedResult = zodParseWithContext(assemblyStatusSchema, rawResult);
@@ -483,6 +536,7 @@ export class Transloadit {
         const rawResult = await this._remoteJson({
             url,
             urlSuffix: url ? undefined : `/assemblies/${assemblyId}`,
+            isTrustedUrl: Boolean(url),
             signal,
         });
         const parsedResult = zodParseWithContext(assemblyStatusSchema, rawResult);
@@ -644,6 +698,9 @@ export class Transloadit {
         });
     }
     calcSignature(params, algorithm) {
+        if (!this._authKey || !this._authSecret) {
+            throw new Error('Cannot sign params without authKey and authSecret.');
+        }
         const jsonParams = this._prepareParams(params);
         const signature = this._calcSignature(jsonParams, algorithm);
         return { signature, params: jsonParams };
@@ -652,6 +709,9 @@ export class Transloadit {
      * Construct a signed Smart CDN URL. See https://transloadit.com/docs/topics/signature-authentication/#smart-cdn.
      */
     getSignedSmartCDNUrl(opts) {
+        if (!this._authKey || !this._authSecret) {
+            throw new Error('authKey and authSecret are required to sign Smart CDN URLs.');
+        }
         return getSignedSmartCdnUrl({
             ...opts,
             authKey: this._authKey,
@@ -659,27 +719,42 @@ export class Transloadit {
         });
     }
     _calcSignature(toSign, algorithm = 'sha384') {
+        if (!this._authSecret) {
+            throw new Error('Cannot sign params without authSecret.');
+        }
         return signParamsSync(toSign, this._authSecret, algorithm);
     }
     // Sets the multipart/form-data for POST, PUT and DELETE requests, including
     // the streams, the signed params, and any additional fields.
     _appendForm(form, params, fields) {
-        const sigData = this.calcSignature(params);
-        const jsonParams = sigData.params;
-        const { signature } = sigData;
+        const shouldSign = Boolean(this._authKey && this._authSecret);
+        let jsonParams = JSON.stringify(params ?? {});
+        let signature;
+        if (shouldSign) {
+            const sigData = this.calcSignature(params);
+            jsonParams = sigData.params;
+            signature = sigData.signature;
+        }
         form.append('params', jsonParams);
         if (fields != null) {
             for (const [key, val] of Object.entries(fields)) {
                 form.append(key, val);
             }
         }
-        form.append('signature', signature);
+        if (signature) {
+            form.append('signature', signature);
+        }
     }
     // Implements HTTP GET query params, handling the case where the url already
     // has params.
     _appendParamsToUrl(url, params) {
-        const { signature, params: jsonParams } = this.calcSignature(params);
         const prefix = url.indexOf('?') === -1 ? '?' : '&';
+        const shouldSign = Boolean(this._authKey && this._authSecret);
+        if (!shouldSign) {
+            const jsonParams = JSON.stringify(params ?? {});
+            return `${url}${prefix}params=${encodeURIComponent(jsonParams)}`;
+        }
+        const { signature, params: jsonParams } = this.calcSignature(params);
         return `${url}${prefix}signature=${signature}&params=${encodeURIComponent(jsonParams)}`;
     }
     // Responsible for including auth parameters in all requests
@@ -709,11 +784,18 @@ export class Transloadit {
     // PUT or DELETE requests. Automatically adds signature parameters to all
     // requests. Also automatically parses the JSON response.
     async _remoteJson(opts) {
-        const { urlSuffix, url: urlInput, timeout = { request: this._defaultTimeout }, method = 'get', params = {}, fields, headers, signal, } = opts;
+        const { urlSuffix, url: urlInput, isTrustedUrl = false, timeout = { request: this._defaultTimeout }, method = 'get', params = {}, fields, headers, signal, } = opts;
         // Allow providing either a `urlSuffix` or a full `url`
         if (!urlSuffix && !urlInput)
             throw new Error('No URL provided');
         let url = urlInput || `${this._endpoint}${urlSuffix}`;
+        if (urlInput && !isTrustedUrl) {
+            const allowed = new URL(this._endpoint);
+            const candidate = new URL(urlInput);
+            if (allowed.origin !== candidate.origin) {
+                throw new Error(`Untrusted URL: ${candidate.origin}`);
+            }
+        }
         if (method === 'get') {
             url = this._appendParamsToUrl(url, params);
         }
@@ -733,6 +815,7 @@ export class Transloadit {
                 headers: {
                     'Transloadit-Client': `node-sdk:${version}`,
                     'User-Agent': undefined, // Remove got's user-agent
+                    ...(this._authToken ? { Authorization: `Bearer ${this._authToken}` } : {}),
                     ...headers,
                 },
                 responseType: 'json',