@transloadit/utils 4.7.1 → 4.8.1

package/dist/assemblyInstructionsCompiler.d.ts

@@ -1,4 +1,4 @@
-export declare const COMPILE_ASSEMBLY_INSTRUCTIONS_DEFAULT_MODEL = "openai/gpt-5.6-sol";
+export declare const COMPILE_ASSEMBLY_INSTRUCTIONS_DEFAULT_MODEL = "openai/gpt-6-astra";
 export declare const COMPILE_ASSEMBLY_INSTRUCTIONS_DEFAULT_REASONING_EFFORT = "medium";
 export declare const COMPILE_ASSEMBLY_INSTRUCTIONS_DEFAULT_MAX_ATTEMPTS = 3;
 export declare const COMPILE_ASSEMBLY_INSTRUCTIONS_MCP_ALLOWED_TOOLS: readonly ["transloadit_get_robot_help", "transloadit_lint_assembly_instructions", "transloadit_list_robots"];

package/dist/assemblyInstructionsCompiler.js

@@ -1,4 +1,4 @@
-export const COMPILE_ASSEMBLY_INSTRUCTIONS_DEFAULT_MODEL = 'openai/gpt-5.6-sol';
+export const COMPILE_ASSEMBLY_INSTRUCTIONS_DEFAULT_MODEL = 'openai/gpt-6-astra';
 export const COMPILE_ASSEMBLY_INSTRUCTIONS_DEFAULT_REASONING_EFFORT = 'medium';
 export const COMPILE_ASSEMBLY_INSTRUCTIONS_DEFAULT_MAX_ATTEMPTS = 3;
 export const COMPILE_ASSEMBLY_INSTRUCTIONS_MCP_ALLOWED_TOOLS = [

package/dist/index.d.ts

@@ -17,4 +17,6 @@ export declare const verifyWebhookSignature: (options: VerifyWebhookSignatureOpt
  * Produces the same URL as the synchronous `getSignedSmartCdnUrl` from `@transloadit/utils/node`.
  */
 export declare const getSignedSmartCdnUrl: (opts: SmartCdnUrlOptions) => Promise<string>;
+export type { StorageGrantClaims, StorageGrantScope } from './storageGrant.ts';
+export { decodeStorageGrant, normalizeStorageGrantPrefix, parseStorageGrantClaims, STORAGE_GRANT_SCOPES, } from './storageGrant.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAA;AAIvD,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAA;AAExE,YAAY,EACV,iBAAiB,EACjB,uBAAuB,EACvB,0BAA0B,EAC1B,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,eAAe,CAAA;AACtB,YAAY,EACV,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EACvB,mBAAmB,EACnB,0BAA0B,EAC1B,oBAAoB,EACpB,0BAA0B,EAC1B,wBAAwB,EACxB,mBAAmB,EACnB,6BAA6B,GAC9B,MAAM,oBAAoB,CAAA;AAE3B,cAAc,mCAAmC,CAAA;AACjD,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AACnF,OAAO,EACL,6BAA6B,EAC7B,2BAA2B,EAC3B,0BAA0B,EAC1B,yBAAyB,GAC1B,MAAM,oBAAoB,CAAA;AAqD3B,eAAO,MAAM,UAAU,GACrB,cAAc,MAAM,EACpB,YAAY,MAAM,EAClB,YAAW,kBAA6B,KACvC,OAAO,CAAC,MAAM,CAOhB,CAAA;AAED,MAAM,MAAM,6BAA6B,GAAG;IAC1C,OAAO,EAAE,MAAM,CAAA;IACf,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,UAAU,EAAE,MAAM,CAAA;CACnB,CAAA;AAED,eAAO,MAAM,sBAAsB,GACjC,SAAS,6BAA6B,KACrC,OAAO,CAAC,OAAO,CAkBjB,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,oBAAoB,GAAU,MAAM,kBAAkB,KAAG,OAAO,CAAC,MAAM,CAInF,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAA;AAIvD,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAA;AAExE,YAAY,EACV,iBAAiB,EACjB,uBAAuB,EACvB,0BAA0B,EAC1B,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,eAAe,CAAA;AACtB,YAAY,EACV,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EACvB,mBAAmB,EACnB,0BAA0B,EAC1B,oBAAoB,EACpB,0BAA0B,EAC1B,wBAAwB,EACxB,mBAAmB,EACnB,6BAA6B,GAC9B,MAAM,oBAAoB,CAAA;AAE3B,cAAc,mCAAmC,CAAA;AACjD,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AACnF,OAAO,EACL,6BAA6B,EAC7B,2BAA2B,EAC3B,0BAA0B,EAC1B,yBAAyB,GAC1B,MAAM,oBAAoB,CAAA;AAqD3B,eAAO,MAAM,UAAU,GACrB,cAAc,MAAM,EACpB,YAAY,MAAM,EAClB,YAAW,kBAA6B,KACvC,OAAO,CAAC,MAAM,CAOhB,CAAA;AAED,MAAM,MAAM,6BAA6B,GAAG;IAC1C,OAAO,EAAE,MAAM,CAAA;IACf,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,UAAU,EAAE,MAAM,CAAA;CACnB,CAAA;AAED,eAAO,MAAM,sBAAsB,GACjC,SAAS,6BAA6B,KACrC,OAAO,CAAC,OAAO,CAkBjB,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,oBAAoB,GAAU,MAAM,kBAAkB,KAAG,OAAO,CAAC,MAAM,CAInF,CAAA;AAED,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAE9E,OAAO,EACL,kBAAkB,EAClB,2BAA2B,EAC3B,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,mBAAmB,CAAA"}

package/dist/index.js

@@ -69,3 +69,4 @@ export const getSignedSmartCdnUrl = async (opts) => {
     const signature = await hmacHex('sha256', opts.authSecret, prepared.stringToSign);
     return finishSmartCdnUrl(prepared, signature);
 };
+export { decodeStorageGrant, normalizeStorageGrantPrefix, parseStorageGrantClaims, STORAGE_GRANT_SCOPES, } from "./storageGrant.js";

package/dist/node.d.ts

@@ -1,6 +1,7 @@
 import type { SignatureAlgorithm } from './index.ts';
 import type { SmartCdnUrlOptions } from './smartCdn.ts';
 import type { SmartCdnImageCandidates, SmartCdnImagePolicyOptions } from './smartCdnImage.ts';
+import type { StorageGrantClaims, StorageGrantScope } from './storageGrant.ts';
 export type { SignatureAlgorithm } from './index.ts';
 export type { ParsedSmartCdnUrl, ParseSmartCdnUrlOptions, SmartCdnUnsignedUrlOptions, SmartCdnUrlOptions, SmartCdnUrlParams, } from './smartCdn.ts';
 export type { SignSmartCdnImageRequest, SmartCdnImageCandidate, SmartCdnImageCandidates, SmartCdnImageFormat, SmartCdnImageFormatQuality, SmartCdnImageFormats, SmartCdnImagePolicyOptions, SmartCdnImageSignRequest, SmartCdnImageSource, SmartCdnImageSourceDimensions, } from './smartCdnImage.ts';
@@ -26,4 +27,35 @@ export declare const getSignedSmartCdnUrl: (opts: SmartCdnUrlOptions) => string;
  * rendition above the backend's width or derived-height limits.
  */
 export declare function getSignedSmartCdnImageCandidates(opts: SmartCdnImageCandidatesOptions): SmartCdnImageCandidates;
+export type { StorageGrantClaims, StorageGrantScope } from './storageGrant.ts';
+export { decodeStorageGrant, normalizeStorageGrantPrefix, parseStorageGrantClaims, STORAGE_GRANT_SCOPES, } from './storageGrant.ts';
+export type SignStorageGrantOptions = {
+    /** The workspace slug ("bucket" in S3 terms). */
+    bucket: string;
+    /** Key prefix to confine the session to. Default: the whole workspace. */
+    prefix?: string;
+    /** Default: read-only. */
+    scopes?: StorageGrantScope[];
+    /** Who the grant is minted for (informational). */
+    sub?: string;
+    /** Grant lifetime. Default: 900 (15 minutes). */
+    expiresInSeconds?: number;
+    /** Clock override for tests. */
+    nowMs?: number;
+};
+/**
+ * Mints a storage grant: an HS256 JWT with the v1 claim set, byte-compatible
+ * with api2's `StorageGrantManager` (same header, claim order and encoding).
+ */
+export declare const signStorageGrant: (options: SignStorageGrantOptions, secret: string) => {
+    grant: string;
+    claims: StorageGrantClaims;
+};
+/**
+ * Verifies a storage grant: HS256 signature (timing-safe), strict v1 claim
+ * shape, and expiry. Throws with a stable message on any failure.
+ */
+export declare const verifyStorageGrant: (token: string, secret: string, { nowMs }?: {
+    nowMs?: number;
+}) => StorageGrantClaims;
 //# sourceMappingURL=node.d.ts.map

package/dist/node.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../src/node.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AACpD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAA;AACvD,OAAO,KAAK,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAA;AAO7F,YAAY,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AACpD,YAAY,EACV,iBAAiB,EACjB,uBAAuB,EACvB,0BAA0B,EAC1B,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,eAAe,CAAA;AACtB,YAAY,EACV,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EACvB,mBAAmB,EACnB,0BAA0B,EAC1B,oBAAoB,EACpB,0BAA0B,EAC1B,wBAAwB,EACxB,mBAAmB,EACnB,6BAA6B,GAC9B,MAAM,oBAAoB,CAAA;AAE3B,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AACnF,OAAO,EACL,2BAA2B,EAC3B,0BAA0B,EAC1B,yBAAyB,GAC1B,MAAM,oBAAoB,CAAA;AAE3B,MAAM,MAAM,uBAAuB,GAAG,kBAAkB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;AAExE,8EAA8E;AAC9E,MAAM,WAAW,8BAA+B,SAAQ,0BAA0B;IAChF,6DAA6D;IAC7D,OAAO,EAAE,MAAM,CAAA;IACf,gEAAgE;IAChE,UAAU,EAAE,MAAM,CAAA;IAClB,sBAAsB;IACtB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,eAAO,MAAM,cAAc,GACzB,cAAc,MAAM,EACpB,YAAY,MAAM,EAClB,YAAW,uBAAkC,KAC5C,MAKF,CAAA;AAED,4FAA4F;AAC5F,eAAO,MAAM,oBAAoB,GAAI,MAAM,kBAAkB,KAAG,MAM/D,CAAA;AAED;;;;;GAKG;AACH,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,8BAA8B,GACnC,uBAAuB,CAsBzB"}
+{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../src/node.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AACpD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAA;AACvD,OAAO,KAAK,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAA;AAC7F,OAAO,KAAK,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAS9E,YAAY,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AACpD,YAAY,EACV,iBAAiB,EACjB,uBAAuB,EACvB,0BAA0B,EAC1B,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,eAAe,CAAA;AACtB,YAAY,EACV,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EACvB,mBAAmB,EACnB,0BAA0B,EAC1B,oBAAoB,EACpB,0BAA0B,EAC1B,wBAAwB,EACxB,mBAAmB,EACnB,6BAA6B,GAC9B,MAAM,oBAAoB,CAAA;AAE3B,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AACnF,OAAO,EACL,2BAA2B,EAC3B,0BAA0B,EAC1B,yBAAyB,GAC1B,MAAM,oBAAoB,CAAA;AAE3B,MAAM,MAAM,uBAAuB,GAAG,kBAAkB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;AAExE,8EAA8E;AAC9E,MAAM,WAAW,8BAA+B,SAAQ,0BAA0B;IAChF,6DAA6D;IAC7D,OAAO,EAAE,MAAM,CAAA;IACf,gEAAgE;IAChE,UAAU,EAAE,MAAM,CAAA;IAClB,sBAAsB;IACtB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,eAAO,MAAM,cAAc,GACzB,cAAc,MAAM,EACpB,YAAY,MAAM,EAClB,YAAW,uBAAkC,KAC5C,MAKF,CAAA;AAED,4FAA4F;AAC5F,eAAO,MAAM,oBAAoB,GAAI,MAAM,kBAAkB,KAAG,MAM/D,CAAA;AAED;;;;;GAKG;AACH,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,8BAA8B,GACnC,uBAAuB,CAsBzB;AAID,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAE9E,OAAO,EACL,kBAAkB,EAClB,2BAA2B,EAC3B,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,mBAAmB,CAAA;AAK1B,MAAM,MAAM,uBAAuB,GAAG;IACpC,iDAAiD;IACjD,MAAM,EAAE,MAAM,CAAA;IACd,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,0BAA0B;IAC1B,MAAM,CAAC,EAAE,iBAAiB,EAAE,CAAA;IAC5B,mDAAmD;IACnD,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,iDAAiD;IACjD,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,gCAAgC;IAChC,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,gBAAgB,GAC3B,SAAS,uBAAuB,EAChC,QAAQ,MAAM,KACb;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,kBAAkB,CAAA;CAiB7C,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,kBAAkB,GAC7B,OAAO,MAAM,EACb,QAAQ,MAAM,EACd,YAAwB;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAO,KAC9C,kBA6BF,CAAA"}

package/dist/node.js

@@ -1,6 +1,8 @@
-import { createHmac } from 'node:crypto';
+import { Buffer } from 'node:buffer';
+import { createHmac, timingSafeEqual } from 'node:crypto';
 import { finishSmartCdnUrl, prepareSmartCdnUrl } from "./smartCdn.js";
 import { createSmartCdnImageCandidates } from "./smartCdnImage.js";
+import { parseStorageGrantClaims } from "./storageGrant.js";
 export { getSmartCdnUrl, parseSmartCdnUrl, stripSmartCdnAuth } from "./smartCdn.js";
 export { resolveSmartCdnImageFormats, resolveSmartCdnImageWidths, smartCdnImageMaxDimension, } from "./smartCdnImage.js";
 export const signParamsSync = (paramsString, authSecret, algorithm = 'sha384') => {
@@ -43,3 +45,60 @@ export function getSignedSmartCdnImageCandidates(opts) {
         workspace,
     }));
 }
+export { decodeStorageGrant, normalizeStorageGrantPrefix, parseStorageGrantClaims, STORAGE_GRANT_SCOPES, } from "./storageGrant.js";
+const base64url = (value) => (typeof value === 'string' ? Buffer.from(value) : value).toString('base64url');
+/**
+ * Mints a storage grant: an HS256 JWT with the v1 claim set, byte-compatible
+ * with api2's `StorageGrantManager` (same header, claim order and encoding).
+ */
+export const signStorageGrant = (options, secret) => {
+    const { bucket, prefix = '', scopes = ['read'], sub, expiresInSeconds = 900 } = options;
+    const iat = Math.floor((options.nowMs ?? Date.now()) / 1000);
+    const claims = {
+        v: 1,
+        bucket,
+        prefix,
+        scopes: [...new Set(scopes)],
+        ...(sub === undefined ? {} : { sub }),
+        iat,
+        exp: iat + expiresInSeconds,
+    };
+    const signingInput = `${base64url(JSON.stringify({ alg: 'HS256', typ: 'JWT' }))}.${base64url(JSON.stringify(claims))}`;
+    const signature = base64url(createHmac('sha256', secret).update(signingInput).digest());
+    return { grant: `${signingInput}.${signature}`, claims };
+};
+/**
+ * Verifies a storage grant: HS256 signature (timing-safe), strict v1 claim
+ * shape, and expiry. Throws with a stable message on any failure.
+ */
+export const verifyStorageGrant = (token, secret, { nowMs = Date.now() } = {}) => {
+    const [headerPart, payloadPart, signaturePart, ...rest] = token.split('.');
+    if (!headerPart || !payloadPart || !signaturePart || rest.length > 0) {
+        throw new Error('Invalid storage grant');
+    }
+    const expected = createHmac('sha256', secret).update(`${headerPart}.${payloadPart}`).digest();
+    const actual = Buffer.from(signaturePart, 'base64url');
+    if (actual.length !== expected.length || !timingSafeEqual(actual, expected)) {
+        throw new Error('Invalid storage grant signature');
+    }
+    let header;
+    let payload;
+    try {
+        header = JSON.parse(Buffer.from(headerPart, 'base64url').toString('utf8'));
+        payload = JSON.parse(Buffer.from(payloadPart, 'base64url').toString('utf8'));
+    }
+    catch {
+        throw new Error('Invalid storage grant');
+    }
+    if (typeof header !== 'object' ||
+        header === null ||
+        header.alg !== 'HS256') {
+        throw new Error('Invalid storage grant algorithm');
+    }
+    const claims = parseStorageGrantClaims(payload);
+    if (claims === null)
+        throw new Error('Invalid storage grant claims');
+    if (claims.exp <= Math.floor(nowMs / 1000))
+        throw new Error('The storage grant has expired');
+    return claims;
+};

package/dist/storageGrant.d.ts

@@ -0,0 +1,40 @@
+/**
+ * The Transloadit Storage grant: a short-lived HS256 JWT an integrator's
+ * server mints (or api2's `POST /storage/grants` mints for it) and
+ * Companion's S3 provider verifies. This module is the one wire contract —
+ * claim shape, decoding, and (in `@transloadit/utils/node`) minting and
+ * verification — so the implementations cannot drift apart.
+ *
+ * Everything in this file is browser-safe: the client may *read* a grant's
+ * claims to decide what UI to show, but verification is the server's job.
+ */
+export declare const STORAGE_GRANT_SCOPES: readonly ["read", "write"];
+export type StorageGrantScope = (typeof STORAGE_GRANT_SCOPES)[number];
+export type StorageGrantClaims = {
+    v: 1;
+    /** The workspace slug ("bucket" in S3 terms). */
+    bucket: string;
+    /** Key prefix the session is confined to; may be empty. */
+    prefix: string;
+    scopes: StorageGrantScope[];
+    /** Who the grant was minted for (informational). */
+    sub?: string;
+    /** Unix seconds. */
+    iat?: number;
+    /** Unix seconds. */
+    exp: number;
+};
+/**
+ * Validates a decoded JWT payload against the grant contract. Returns the
+ * claims (scopes deduplicated) or null when the shape is not a v1 grant.
+ */
+export declare const parseStorageGrantClaims: (payload: unknown) => StorageGrantClaims | null;
+/** Companion's prefix policy: no leading slashes, a trailing slash unless empty. */
+export declare const normalizeStorageGrantPrefix: (prefix: string) => string;
+/**
+ * Reads a grant's payload without verifying the signature — for clients that
+ * only need to know what the session will be allowed to do. Returns null for
+ * anything that does not decode to a v1 grant.
+ */
+export declare const decodeStorageGrant: (token: string) => StorageGrantClaims | null;
+//# sourceMappingURL=storageGrant.d.ts.map

package/dist/storageGrant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storageGrant.d.ts","sourceRoot":"","sources":["../src/storageGrant.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,eAAO,MAAM,oBAAoB,4BAA6B,CAAA;AAC9D,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAA;AAErE,MAAM,MAAM,kBAAkB,GAAG;IAC/B,CAAC,EAAE,CAAC,CAAA;IACJ,iDAAiD;IACjD,MAAM,EAAE,MAAM,CAAA;IACd,2DAA2D;IAC3D,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,iBAAiB,EAAE,CAAA;IAC3B,oDAAoD;IACpD,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,oBAAoB;IACpB,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,oBAAoB;IACpB,GAAG,EAAE,MAAM,CAAA;CACZ,CAAA;AAKD;;;GAGG;AACH,eAAO,MAAM,uBAAuB,GAAI,SAAS,OAAO,KAAG,kBAAkB,GAAG,IAyB/E,CAAA;AAED,oFAAoF;AACpF,eAAO,MAAM,2BAA2B,GAAI,QAAQ,MAAM,KAAG,MAG5D,CAAA;AASD;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,GAAI,OAAO,MAAM,KAAG,kBAAkB,GAAG,IAQvE,CAAA"}

package/dist/storageGrant.js

@@ -0,0 +1,64 @@
+/**
+ * The Transloadit Storage grant: a short-lived HS256 JWT an integrator's
+ * server mints (or api2's `POST /storage/grants` mints for it) and
+ * Companion's S3 provider verifies. This module is the one wire contract —
+ * claim shape, decoding, and (in `@transloadit/utils/node`) minting and
+ * verification — so the implementations cannot drift apart.
+ *
+ * Everything in this file is browser-safe: the client may *read* a grant's
+ * claims to decide what UI to show, but verification is the server's job.
+ */
+export const STORAGE_GRANT_SCOPES = ['read', 'write'];
+const isRecord = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
+/**
+ * Validates a decoded JWT payload against the grant contract. Returns the
+ * claims (scopes deduplicated) or null when the shape is not a v1 grant.
+ */
+export const parseStorageGrantClaims = (payload) => {
+    if (!isRecord(payload) ||
+        payload.v !== 1 ||
+        typeof payload.bucket !== 'string' ||
+        payload.bucket.length === 0 ||
+        typeof payload.prefix !== 'string' ||
+        !Array.isArray(payload.scopes) ||
+        !payload.scopes.every((scope) => typeof scope === 'string' && STORAGE_GRANT_SCOPES.includes(scope)) ||
+        typeof payload.exp !== 'number') {
+        return null;
+    }
+    return {
+        v: 1,
+        bucket: payload.bucket,
+        prefix: payload.prefix,
+        scopes: [...new Set(payload.scopes)],
+        ...(typeof payload.sub === 'string' && { sub: payload.sub }),
+        ...(typeof payload.iat === 'number' && { iat: payload.iat }),
+        exp: payload.exp,
+    };
+};
+/** Companion's prefix policy: no leading slashes, a trailing slash unless empty. */
+export const normalizeStorageGrantPrefix = (prefix) => {
+    const cleaned = prefix.replace(/^\/+/, '');
+    return cleaned.length === 0 || cleaned.endsWith('/') ? cleaned : `${cleaned}/`;
+};
+const decodeBase64UrlToUtf8 = (input) => {
+    const base64 = input.replace(/-/g, '+').replace(/_/g, '/');
+    const padded = base64 + '='.repeat((4 - (base64.length % 4)) % 4);
+    const binary = atob(padded);
+    return new TextDecoder().decode(Uint8Array.from(binary, (char) => char.charCodeAt(0)));
+};
+/**
+ * Reads a grant's payload without verifying the signature — for clients that
+ * only need to know what the session will be allowed to do. Returns null for
+ * anything that does not decode to a v1 grant.
+ */
+export const decodeStorageGrant = (token) => {
+    try {
+        const payload = token.split('.')[1];
+        if (payload === undefined || payload.length === 0)
+            return null;
+        return parseStorageGrantClaims(JSON.parse(decodeBase64UrlToUtf8(payload)));
+    }
+    catch {
+        return null;
+    }
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@transloadit/utils",
-  "version": "4.7.1",
+  "version": "4.8.1",
   "description": "Transloadit shared utilities",
   "type": "module",
   "license": "MIT",