@transloadit/utils 4.5.0 → 4.6.0

package/README.md

@@ -10,8 +10,11 @@ npm install @transloadit/utils
 
 ## Web / Edge usage
 
+Everything in the root export runs on WebCrypto, so it works in browsers (secure origins only:
+`https://` or `localhost`), edge runtimes, and Node.
+
 ```ts
-import { signParams, verifyWebhookSignature } from '@transloadit/utils'
+import { getSignedSmartCdnUrl, signParams, verifyWebhookSignature } from '@transloadit/utils'
 
 const signature = await signParams(paramsString, authSecret)
 const verified = await verifyWebhookSignature({
@@ -19,6 +22,13 @@ const verified = await verifyWebhookSignature({
   signatureHeader,
   authSecret,
 })
+const url = await getSignedSmartCdnUrl({
+  workspace,
+  template,
+  input,
+  authKey,
+  authSecret,
+})
 ```
 
 ## Node usage
@@ -47,13 +57,20 @@ const imageCandidates = getSignedSmartCdnImageCandidates({
   widths: [320, 640, 960],
   workspace,
 })
+
+for (const source of imageCandidates.sources) {
+  console.log(source.format, source.quality, source.candidates)
+}
 ```
 
 ## API
 
-- `signParams(paramsString, authSecret, algorithm?)`: WebCrypto-based HMAC signature for params.
+- `signParams(paramsString, authSecret, algorithm?)`: WebCrypto-based HMAC signature for params
+  (`sha1`, `sha256`, `sha384`, `sha512`).
 - `verifyWebhookSignature({ rawBody, signatureHeader, authSecret })`: validates webhook signatures.
+- `getSignedSmartCdnUrl(options)`: async, WebCrypto-based Smart CDN URL signer. Byte-identical to
+  the Node variant below.
 - `signParamsSync(paramsString, authSecret, algorithm?)`: Node-only sync signature helper.
-- `getSignedSmartCdnUrl(options)`: Node-only Smart CDN URL signer.
-- `getSignedSmartCdnImageCandidates(options)`: deterministic signed AVIF and WebP `srcset`
+- `getSignedSmartCdnUrl(options)` from `@transloadit/utils/node`: synchronous Smart CDN URL signer.
+- `getSignedSmartCdnImageCandidates(options)`: deterministic structured, signed AVIF and WebP
   candidates plus the original fallback URL.

package/dist/index.d.ts

@@ -1,4 +1,6 @@
-export type SignatureAlgorithm = 'sha1' | 'sha256' | 'sha384';
+import type { SmartCdnUrlOptions } from './smartCdn.ts';
+export type SignatureAlgorithm = 'sha1' | 'sha256' | 'sha384' | 'sha512';
+export type { SmartCdnUrlOptions } from './smartCdn.ts';
 export * from './assemblyInstructionsCompiler.ts';
 export declare const signParams: (paramsString: string, authSecret: string, algorithm?: SignatureAlgorithm) => Promise<string>;
 export type VerifyWebhookSignatureOptions = {
@@ -7,4 +9,9 @@ export type VerifyWebhookSignatureOptions = {
     authSecret: string;
 };
 export declare const verifyWebhookSignature: (options: VerifyWebhookSignatureOptions) => Promise<boolean>;
+/**
+ * Signs a Smart CDN URL with WebCrypto, so it works in browsers, edge runtimes and Node alike.
+ * Produces the same URL as the synchronous `getSignedSmartCdnUrl` from `@transloadit/utils/node`.
+ */
+export declare const getSignedSmartCdnUrl: (opts: SmartCdnUrlOptions) => Promise<string>;
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAA;AAE7D,cAAc,mCAAmC,CAAA;AAiDjD,eAAO,MAAM,UAAU,GACrB,cAAc,MAAM,EACpB,YAAY,MAAM,EAClB,YAAW,kBAA6B,KACvC,OAAO,CAAC,MAAM,CAOhB,CAAA;AAED,MAAM,MAAM,6BAA6B,GAAG;IAC1C,OAAO,EAAE,MAAM,CAAA;IACf,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,UAAU,EAAE,MAAM,CAAA;CACnB,CAAA;AAED,eAAO,MAAM,sBAAsB,GACjC,SAAS,6BAA6B,KACrC,OAAO,CAAC,OAAO,CAkBjB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAA;AAIvD,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAA;AAExE,YAAY,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAA;AAEvD,cAAc,mCAAmC,CAAA;AAqDjD,eAAO,MAAM,UAAU,GACrB,cAAc,MAAM,EACpB,YAAY,MAAM,EAClB,YAAW,kBAA6B,KACvC,OAAO,CAAC,MAAM,CAOhB,CAAA;AAED,MAAM,MAAM,6BAA6B,GAAG;IAC1C,OAAO,EAAE,MAAM,CAAA;IACf,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,UAAU,EAAE,MAAM,CAAA;CACnB,CAAA;AAED,eAAO,MAAM,sBAAsB,GACjC,SAAS,6BAA6B,KACrC,OAAO,CAAC,OAAO,CAkBjB,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,oBAAoB,GAAU,MAAM,kBAAkB,KAAG,OAAO,CAAC,MAAM,CAInF,CAAA"}

package/dist/index.js

@@ -1,14 +1,17 @@
+import { finishSmartCdnUrl, prepareSmartCdnUrl } from "./smartCdn.js";
 export * from "./assemblyInstructionsCompiler.js";
 const algorithmMap = {
     sha1: 'SHA-1',
     sha256: 'SHA-256',
     sha384: 'SHA-384',
+    sha512: 'SHA-512',
 };
-const isSignatureAlgorithm = (value) => value === 'sha1' || value === 'sha256' || value === 'sha384';
+const isSignatureAlgorithm = (value) => value === 'sha1' || value === 'sha256' || value === 'sha384' || value === 'sha512';
 const getSubtle = () => {
     const subtle = globalThis.crypto?.subtle;
     if (!subtle) {
-        throw new Error('Web Crypto is required to sign Transloadit payloads');
+        // Browsers only expose crypto.subtle on secure origins (https:// or localhost).
+        throw new Error('Web Crypto is required to sign Transloadit payloads; browsers only provide crypto.subtle on secure origins (https:// or localhost)');
     }
     return subtle;
 };
@@ -55,3 +58,12 @@ export const verifyWebhookSignature = async (options) => {
     const expected = await hmacHex(normalized, options.authSecret, options.rawBody);
     return safeCompare(expected, signature);
 };
+/**
+ * Signs a Smart CDN URL with WebCrypto, so it works in browsers, edge runtimes and Node alike.
+ * Produces the same URL as the synchronous `getSignedSmartCdnUrl` from `@transloadit/utils/node`.
+ */
+export const getSignedSmartCdnUrl = async (opts) => {
+    const prepared = prepareSmartCdnUrl(opts);
+    const signature = await hmacHex('sha256', opts.authSecret, prepared.stringToSign);
+    return finishSmartCdnUrl(prepared, signature);
+};

package/dist/node.d.ts

@@ -1,10 +1,25 @@
 import type { SignatureAlgorithm } from './index.ts';
+import type { SmartCdnUrlOptions } from './smartCdn.ts';
 export type { SignatureAlgorithm } from './index.ts';
+export type { SmartCdnUrlOptions } from './smartCdn.ts';
 export type SignatureAlgorithmInput = SignatureAlgorithm | (string & {});
-type SmartCdnImageFormat = 'avif' | 'png' | 'webp';
-interface SmartCdnImageCandidates {
-    fallback: string;
-    sources: Partial<Record<SmartCdnImageFormat, string>>;
+/** Image formats supported by the responsive-image Built-in. */
+export type SmartCdnImageFormat = 'avif' | 'png' | 'webp';
+/** One signed Smart CDN rendition at a specific intrinsic width. */
+export interface SmartCdnImageCandidate {
+    url: string;
+    width: number;
+}
+/** Ordered candidates for one image format and quality. */
+export interface SmartCdnImageSource {
+    candidates: readonly SmartCdnImageCandidate[];
+    format: SmartCdnImageFormat;
+    quality: number;
+}
+/** Structured data for rendering a responsive image. */
+export interface SmartCdnImageCandidates {
+    fallbackUrl: string;
+    sources: readonly SmartCdnImageSource[];
 }
 /** Options for deterministic, server-generated Smart CDN image candidates. */
 export interface SmartCdnImageCandidatesOptions {
@@ -25,38 +40,8 @@ export interface SmartCdnImageCandidatesOptions {
     /** Workspace slug. */
     workspace: string;
 }
-export type SmartCdnUrlOptions = {
-    /**
-     * Workspace slug.
-     */
-    workspace: string;
-    /**
-     * Template slug or template ID.
-     */
-    template: string;
-    /**
-     * Input value that is provided as `${fields.input}` in the template.
-     */
-    input: string;
-    /**
-     * Additional parameters for the URL query string.
-     */
-    urlParams?: Record<string, boolean | number | string | (boolean | number | string)[]>;
-    /**
-     * Expiration timestamp of the signature in milliseconds since UNIX epoch.
-     * Defaults to 1 hour from now.
-     */
-    expiresAt?: number;
-    /**
-     * Transloadit auth key used to sign the URL.
-     */
-    authKey: string;
-    /**
-     * Transloadit auth secret used to sign the URL.
-     */
-    authSecret: string;
-};
 export declare const signParamsSync: (paramsString: string, authSecret: string, algorithm?: SignatureAlgorithmInput) => string;
+/** Synchronous Smart CDN URL signer (Node). The root export has an async WebCrypto twin. */
 export declare const getSignedSmartCdnUrl: (opts: SmartCdnUrlOptions) => string;
 /**
  * Builds deterministic signed Smart CDN candidates for server-rendered `<picture>` elements.

package/dist/node.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../src/node.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAIpD,YAAY,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAEpD,MAAM,MAAM,uBAAuB,GAAG,kBAAkB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;AAExE,KAAK,mBAAmB,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,CAAA;AAElD,UAAU,uBAAuB;IAC/B,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC,CAAA;CACtD;AAED,8EAA8E;AAC9E,MAAM,WAAW,8BAA8B;IAC7C,6DAA6D;IAC7D,OAAO,EAAE,MAAM,CAAA;IACf,gEAAgE;IAChE,UAAU,EAAE,MAAM,CAAA;IAClB,uFAAuF;IACvF,SAAS,EAAE,MAAM,CAAA;IACjB,yEAAyE;IACzE,OAAO,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC,CAAC,CAAA;IAChE,6EAA6E;IAC7E,KAAK,EAAE,MAAM,CAAA;IACb,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,oFAAoF;IACpF,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;IACzB,sBAAsB;IACtB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B;;OAEG;IACH,SAAS,EAAE,MAAM,CAAA;IACjB;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAA;IAChB;;OAEG;IACH,KAAK,EAAE,MAAM,CAAA;IACb;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,CAAA;IACrF;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IACf;;OAEG;IACH,UAAU,EAAE,MAAM,CAAA;CACnB,CAAA;AAkED,eAAO,MAAM,cAAc,GACzB,cAAc,MAAM,EACpB,YAAY,MAAM,EAClB,YAAW,uBAAkC,KAC5C,MAKF,CAAA;AAED,eAAO,MAAM,oBAAoB,GAAI,MAAM,kBAAkB,KAAG,MA8B/D,CAAA;AAED;;;;;GAKG;AACH,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,8BAA8B,GACnC,uBAAuB,CAsDzB"}
+{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../src/node.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AACpD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAA;AAMvD,YAAY,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AACpD,YAAY,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAA;AAEvD,MAAM,MAAM,uBAAuB,GAAG,kBAAkB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;AAExE,gEAAgE;AAChE,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,CAAA;AAEzD,oEAAoE;AACpE,MAAM,WAAW,sBAAsB;IACrC,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;CACd;AAED,2DAA2D;AAC3D,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,SAAS,sBAAsB,EAAE,CAAA;IAC7C,MAAM,EAAE,mBAAmB,CAAA;IAC3B,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,wDAAwD;AACxD,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,SAAS,mBAAmB,EAAE,CAAA;CACxC;AAED,8EAA8E;AAC9E,MAAM,WAAW,8BAA8B;IAC7C,6DAA6D;IAC7D,OAAO,EAAE,MAAM,CAAA;IACf,gEAAgE;IAChE,UAAU,EAAE,MAAM,CAAA;IAClB,uFAAuF;IACvF,SAAS,EAAE,MAAM,CAAA;IACjB,yEAAyE;IACzE,OAAO,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC,CAAC,CAAA;IAChE,6EAA6E;IAC7E,KAAK,EAAE,MAAM,CAAA;IACb,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,oFAAoF;IACpF,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;IACzB,sBAAsB;IACtB,SAAS,EAAE,MAAM,CAAA;CAClB;AAkED,eAAO,MAAM,cAAc,GACzB,cAAc,MAAM,EACpB,YAAY,MAAM,EAClB,YAAW,uBAAkC,KAC5C,MAKF,CAAA;AAED,4FAA4F;AAC5F,eAAO,MAAM,oBAAoB,GAAI,MAAM,kBAAkB,KAAG,MAM/D,CAAA;AAED;;;;;GAKG;AACH,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,8BAA8B,GACnC,uBAAuB,CAsDzB"}

package/dist/node.js

@@ -1,4 +1,5 @@
 import { createHmac } from 'node:crypto';
+import { finishSmartCdnUrl, prepareSmartCdnUrl } from "./smartCdn.js";
 const defaultSmartCdnImageFormats = {
     avif: 45,
     webp: 75,
@@ -57,35 +58,13 @@ export const signParamsSync = (paramsString, authSecret, algorithm = 'sha384') =
         .digest('hex');
     return `${algorithm}:${signature}`;
 };
+/** Synchronous Smart CDN URL signer (Node). The root export has an async WebCrypto twin. */
 export const getSignedSmartCdnUrl = (opts) => {
-    if (opts.workspace == null || opts.workspace === '')
-        throw new TypeError('workspace is required');
-    if (opts.template == null || opts.template === '')
-        throw new TypeError('template is required');
-    if (opts.input == null)
-        throw new TypeError('input is required');
-    const workspaceSlug = encodeURIComponent(opts.workspace);
-    const templateSlug = encodeURIComponent(opts.template);
-    const inputField = encodeURIComponent(opts.input);
-    const expiresAt = opts.expiresAt || Date.now() + 60 * 60 * 1000;
-    const queryParams = new URLSearchParams();
-    for (const [key, value] of Object.entries(opts.urlParams || {})) {
-        if (Array.isArray(value)) {
-            for (const val of value) {
-                queryParams.append(key, `${val}`);
-            }
-        }
-        else {
-            queryParams.append(key, `${value}`);
-        }
-    }
-    queryParams.set('auth_key', opts.authKey);
-    queryParams.set('exp', `${expiresAt}`);
-    queryParams.sort();
-    const stringToSign = `${workspaceSlug}/${templateSlug}/${inputField}?${queryParams}`;
-    const signature = createHmac('sha256', opts.authSecret).update(stringToSign).digest('hex');
-    queryParams.set('sig', `sha256:${signature}`);
-    return `https://${workspaceSlug}.tlcdn.com/${templateSlug}/${inputField}?${queryParams}`;
+    const prepared = prepareSmartCdnUrl(opts);
+    const signature = createHmac('sha256', opts.authSecret)
+        .update(prepared.stringToSign)
+        .digest('hex');
+    return finishSmartCdnUrl(prepared, signature);
 };
 /**
  * Builds deterministic signed Smart CDN candidates for server-rendered `<picture>` elements.
@@ -120,7 +99,7 @@ export function getSignedSmartCdnImageCandidates(opts) {
     const formats = opts.formats ?? defaultSmartCdnImageFormats;
     validateSmartCdnImageFormats(formats);
     widths.sort((left, right) => left - right);
-    const sources = {};
+    const sources = [];
     for (const format of smartCdnImageFormats) {
         const quality = formats[format];
         if (quality == null) {
@@ -137,9 +116,9 @@ export function getSignedSmartCdnImageCandidates(opts) {
                 urlParams: { f: format, q: quality, r: 'fit', w: width },
                 workspace: opts.workspace,
             });
-            candidates.push(`${url} ${width}w`);
+            candidates.push({ url, width });
         }
-        sources[format] = candidates.join(', ');
+        sources.push({ candidates, format, quality });
     }
-    return { fallback: opts.input, sources };
+    return { fallbackUrl: opts.input, sources };
 }

package/dist/smartCdn.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Smart CDN URL building shared by the synchronous Node signer (`@transloadit/utils/node`) and the
+ * asynchronous WebCrypto signer (`@transloadit/utils`). Only the HMAC differs between the two, so
+ * the string-to-sign and the final URL are assembled here and cannot drift apart.
+ */
+export type SmartCdnUrlOptions = {
+    /**
+     * Workspace slug.
+     */
+    workspace: string;
+    /**
+     * Template slug or template ID.
+     */
+    template: string;
+    /**
+     * Input value that is provided as `${fields.input}` in the template.
+     */
+    input: string;
+    /**
+     * Additional parameters for the URL query string.
+     */
+    urlParams?: Record<string, boolean | number | string | (boolean | number | string)[]>;
+    /**
+     * Expiration timestamp of the signature in milliseconds since UNIX epoch.
+     * Defaults to 1 hour from now.
+     */
+    expiresAt?: number;
+    /**
+     * Transloadit auth key used to sign the URL.
+     */
+    authKey: string;
+    /**
+     * Transloadit auth secret used to sign the URL.
+     */
+    authSecret: string;
+};
+/** A Smart CDN URL with everything but its signature in place. */
+export interface PreparedSmartCdnUrl {
+    /** `workspace/template/input?sortedQuery`, the message the auth secret signs with HMAC-SHA256. */
+    stringToSign: string;
+    /** URL-encoded path segments and the sorted query (without `sig`). */
+    parts: {
+        workspaceSlug: string;
+        templateSlug: string;
+        inputField: string;
+        queryParams: URLSearchParams;
+    };
+}
+/** Validates the options and assembles the string to sign; the caller supplies the HMAC. */
+export declare const prepareSmartCdnUrl: (opts: SmartCdnUrlOptions) => PreparedSmartCdnUrl;
+/** Appends the `sig` parameter and returns the final `https://{workspace}.tlcdn.com/…` URL. */
+export declare const finishSmartCdnUrl: ({ parts }: PreparedSmartCdnUrl, signatureHex: string) => string;
+//# sourceMappingURL=smartCdn.d.ts.map

package/dist/smartCdn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"smartCdn.d.ts","sourceRoot":"","sources":["../src/smartCdn.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,MAAM,kBAAkB,GAAG;IAC/B;;OAEG;IACH,SAAS,EAAE,MAAM,CAAA;IACjB;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAA;IAChB;;OAEG;IACH,KAAK,EAAE,MAAM,CAAA;IACb;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,CAAA;IACrF;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IACf;;OAEG;IACH,UAAU,EAAE,MAAM,CAAA;CACnB,CAAA;AAED,kEAAkE;AAClE,MAAM,WAAW,mBAAmB;IAClC,kGAAkG;IAClG,YAAY,EAAE,MAAM,CAAA;IACpB,sEAAsE;IACtE,KAAK,EAAE;QACL,aAAa,EAAE,MAAM,CAAA;QACrB,YAAY,EAAE,MAAM,CAAA;QACpB,UAAU,EAAE,MAAM,CAAA;QAClB,WAAW,EAAE,eAAe,CAAA;KAC7B,CAAA;CACF;AAED,4FAA4F;AAC5F,eAAO,MAAM,kBAAkB,GAAI,MAAM,kBAAkB,KAAG,mBA6B7D,CAAA;AAED,+FAA+F;AAC/F,eAAO,MAAM,iBAAiB,GAAI,WAAW,mBAAmB,EAAE,cAAc,MAAM,KAAG,MAIxF,CAAA"}

package/dist/smartCdn.js

@@ -0,0 +1,42 @@
+/**
+ * Smart CDN URL building shared by the synchronous Node signer (`@transloadit/utils/node`) and the
+ * asynchronous WebCrypto signer (`@transloadit/utils`). Only the HMAC differs between the two, so
+ * the string-to-sign and the final URL are assembled here and cannot drift apart.
+ */
+/** Validates the options and assembles the string to sign; the caller supplies the HMAC. */
+export const prepareSmartCdnUrl = (opts) => {
+    if (opts.workspace == null || opts.workspace === '')
+        throw new TypeError('workspace is required');
+    if (opts.template == null || opts.template === '')
+        throw new TypeError('template is required');
+    if (opts.input == null)
+        throw new TypeError('input is required');
+    const workspaceSlug = encodeURIComponent(opts.workspace);
+    const templateSlug = encodeURIComponent(opts.template);
+    const inputField = encodeURIComponent(opts.input);
+    const expiresAt = opts.expiresAt || Date.now() + 60 * 60 * 1000;
+    const queryParams = new URLSearchParams();
+    for (const [key, value] of Object.entries(opts.urlParams || {})) {
+        if (Array.isArray(value)) {
+            for (const val of value) {
+                queryParams.append(key, `${val}`);
+            }
+        }
+        else {
+            queryParams.append(key, `${value}`);
+        }
+    }
+    queryParams.set('auth_key', opts.authKey);
+    queryParams.set('exp', `${expiresAt}`);
+    queryParams.sort();
+    return {
+        stringToSign: `${workspaceSlug}/${templateSlug}/${inputField}?${queryParams}`,
+        parts: { workspaceSlug, templateSlug, inputField, queryParams },
+    };
+};
+/** Appends the `sig` parameter and returns the final `https://{workspace}.tlcdn.com/…` URL. */
+export const finishSmartCdnUrl = ({ parts }, signatureHex) => {
+    const { workspaceSlug, templateSlug, inputField, queryParams } = parts;
+    queryParams.set('sig', `sha256:${signatureHex}`);
+    return `https://${workspaceSlug}.tlcdn.com/${templateSlug}/${inputField}?${queryParams}`;
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@transloadit/utils",
-  "version": "4.5.0",
+  "version": "4.6.0",
   "description": "Transloadit shared utilities",
   "type": "module",
   "license": "MIT",