@transloadit/zod 5.0.1 → 7.0.0

package/dist/v3/robots/mega-store.d.ts

@@ -68,7 +68,7 @@ export declare const robotMegaStoreInstructionsSchema: z.ZodObject<{
 } & {
     robot: z.ZodLiteral<"/mega/store">;
     path: z.ZodDefault<z.ZodString>;
-    acl: z.ZodDefault<z.ZodEnum<["private", "public-read"]>>;
+    acl: z.ZodDefault<z.ZodDefault<z.ZodEnum<["private", "public-read"]>>>;
     headers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
     sign_urls_for: z.ZodOptional<z.ZodNumber>;
 }, "strict", z.ZodTypeAny, {
@@ -202,7 +202,7 @@ export declare const robotMegaStoreInstructionsWithHiddenFieldsSchema: z.ZodObje
     secret: z.ZodOptional<z.ZodString>;
     robot: z.ZodLiteral<"/mega/store">;
     path: z.ZodDefault<z.ZodString>;
-    acl: z.ZodDefault<z.ZodEnum<["private", "public-read"]>>;
+    acl: z.ZodDefault<z.ZodDefault<z.ZodEnum<["private", "public-read"]>>>;
     headers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
     sign_urls_for: z.ZodOptional<z.ZodNumber>;
 } & {
@@ -337,7 +337,7 @@ export declare const robotMegaStoreInstructionsWithHiddenFieldsSchema: z.ZodObje
     secret: z.ZodOptional<z.ZodString>;
     robot: z.ZodLiteral<"/mega/store">;
     path: z.ZodDefault<z.ZodString>;
-    acl: z.ZodDefault<z.ZodUnion<[z.ZodString, z.ZodEnum<["private", "public-read"]>]>>;
+    acl: z.ZodDefault<z.ZodDefault<z.ZodUnion<[z.ZodString, z.ZodEnum<["private", "public-read"]>]>>>;
     headers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
     sign_urls_for: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodNumber]>>;
 }, "strict", z.ZodTypeAny, {
@@ -469,7 +469,7 @@ export declare const robotMegaStoreInstructionsWithHiddenFieldsSchema: z.ZodObje
     secret: z.ZodOptional<z.ZodString>;
     robot: z.ZodLiteral<"/mega/store">;
     path: z.ZodDefault<z.ZodString>;
-    acl: z.ZodDefault<z.ZodUnion<[z.ZodString, z.ZodEnum<["private", "public-read"]>]>>;
+    acl: z.ZodDefault<z.ZodDefault<z.ZodUnion<[z.ZodString, z.ZodEnum<["private", "public-read"]>]>>>;
     headers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
     sign_urls_for: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodNumber]>>;
     result: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodUnion<[z.ZodString, z.ZodLiteral<"debug">]>, z.ZodDefault<z.ZodUnion<[z.ZodString, z.ZodBoolean]>>]>>;

package/dist/v3/robots/mega-store.js

@@ -19,7 +19,7 @@ export const robotMegaStoreInstructionsSchema = robotBase
 The URL to the result file will be returned in the <dfn>Assembly Status JSON</dfn>.
 `),
     path: storeFilePath,
-    acl: storageAcl,
+    acl: storageAcl.default('private'),
     headers: z
         .record(z.string())
         .default({ 'Content-Type': '${file.mime}' })

package/dist/v3/robots/s3-store.d.ts

@@ -68,7 +68,7 @@ export declare const robotS3StoreInstructionsSchema: z.ZodObject<{
     robot: z.ZodLiteral<"/s3/store">;
     path: z.ZodDefault<z.ZodString>;
     url_prefix: z.ZodDefault<z.ZodString>;
-    acl: z.ZodDefault<z.ZodEnum<["bucket-default", "private", "public", "public-read"]>>;
+    acl: z.ZodDefault<z.ZodEnum<["authenticated-read", "aws-exec-read", "bucket-default", "bucket-owner-full-control", "bucket-owner-read", "private", "public", "public-read", "public-read-write"]>>;
     check_integrity: z.ZodDefault<z.ZodBoolean>;
     headers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
     tags: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
@@ -86,7 +86,7 @@ export declare const robotS3StoreInstructionsSchema: z.ZodObject<{
     host: string;
     headers: Record<string, string>;
     url_prefix: string;
-    acl: "private" | "public-read" | "bucket-default" | "public";
+    acl: "private" | "public-read" | "authenticated-read" | "bucket-owner-full-control" | "aws-exec-read" | "bucket-default" | "bucket-owner-read" | "public" | "public-read-write";
     check_integrity: boolean;
     tags: Record<string, string>;
     no_vhost: boolean;
@@ -147,7 +147,7 @@ export declare const robotS3StoreInstructionsSchema: z.ZodObject<{
     headers?: Record<string, string> | undefined;
     sign_urls_for?: number | undefined;
     url_prefix?: string | undefined;
-    acl?: "private" | "public-read" | "bucket-default" | "public" | undefined;
+    acl?: "private" | "public-read" | "authenticated-read" | "bucket-owner-full-control" | "aws-exec-read" | "bucket-default" | "bucket-owner-read" | "public" | "public-read-write" | undefined;
     check_integrity?: boolean | undefined;
     tags?: Record<string, string> | undefined;
     no_vhost?: boolean | undefined;
@@ -220,7 +220,7 @@ export declare const robotS3StoreInstructionsWithHiddenFieldsSchema: z.ZodObject
     robot: z.ZodLiteral<"/s3/store">;
     path: z.ZodDefault<z.ZodString>;
     url_prefix: z.ZodDefault<z.ZodString>;
-    acl: z.ZodDefault<z.ZodEnum<["bucket-default", "private", "public", "public-read"]>>;
+    acl: z.ZodDefault<z.ZodEnum<["authenticated-read", "aws-exec-read", "bucket-default", "bucket-owner-full-control", "bucket-owner-read", "private", "public", "public-read", "public-read-write"]>>;
     check_integrity: z.ZodDefault<z.ZodBoolean>;
     headers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
     tags: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
@@ -240,7 +240,7 @@ export declare const robotS3StoreInstructionsWithHiddenFieldsSchema: z.ZodObject
     host: string;
     headers: Record<string, string>;
     url_prefix: string;
-    acl: "private" | "public-read" | "bucket-default" | "public";
+    acl: "private" | "public-read" | "authenticated-read" | "bucket-owner-full-control" | "aws-exec-read" | "bucket-default" | "bucket-owner-read" | "public" | "public-read-write";
     check_integrity: boolean;
     tags: Record<string, string>;
     no_vhost: boolean;
@@ -303,7 +303,7 @@ export declare const robotS3StoreInstructionsWithHiddenFieldsSchema: z.ZodObject
     headers?: Record<string, string> | undefined;
     sign_urls_for?: number | undefined;
     url_prefix?: string | undefined;
-    acl?: "private" | "public-read" | "bucket-default" | "public" | undefined;
+    acl?: "private" | "public-read" | "authenticated-read" | "bucket-owner-full-control" | "aws-exec-read" | "bucket-default" | "bucket-owner-read" | "public" | "public-read-write" | undefined;
     check_integrity?: boolean | undefined;
     tags?: Record<string, string> | undefined;
     no_vhost?: boolean | undefined;
@@ -373,7 +373,7 @@ export declare const robotS3StoreInstructionsWithHiddenFieldsSchema: z.ZodObject
     robot: z.ZodLiteral<"/s3/store">;
     path: z.ZodDefault<z.ZodString>;
     url_prefix: z.ZodDefault<z.ZodString>;
-    acl: z.ZodDefault<z.ZodUnion<[z.ZodString, z.ZodEnum<["bucket-default", "private", "public", "public-read"]>]>>;
+    acl: z.ZodDefault<z.ZodUnion<[z.ZodString, z.ZodEnum<["authenticated-read", "aws-exec-read", "bucket-default", "bucket-owner-full-control", "bucket-owner-read", "private", "public", "public-read", "public-read-write"]>]>>;
     check_integrity: z.ZodDefault<z.ZodUnion<[z.ZodString, z.ZodBoolean]>>;
     headers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
     tags: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
@@ -520,7 +520,7 @@ export declare const robotS3StoreInstructionsWithHiddenFieldsSchema: z.ZodObject
     robot: z.ZodLiteral<"/s3/store">;
     path: z.ZodDefault<z.ZodString>;
     url_prefix: z.ZodDefault<z.ZodString>;
-    acl: z.ZodDefault<z.ZodUnion<[z.ZodString, z.ZodEnum<["bucket-default", "private", "public", "public-read"]>]>>;
+    acl: z.ZodDefault<z.ZodUnion<[z.ZodString, z.ZodEnum<["authenticated-read", "aws-exec-read", "bucket-default", "bucket-owner-full-control", "bucket-owner-read", "private", "public", "public-read", "public-read-write"]>]>>;
     check_integrity: z.ZodDefault<z.ZodUnion<[z.ZodString, z.ZodBoolean]>>;
     headers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
     tags: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;

package/dist/v3/robots/s3-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"s3-store.d.ts","sourceRoot":"","sources":["../../../src/v3/robots/s3-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,+BAA+B,EAC/B,cAAc,EACd,uBAAuB,EACxB,MAAM,+BAA+B,CAAA;AAEtC,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAA;AAgB1B,eAAO,MAAM,IAAI,EAAE,cAYlB,CAAA;AAED,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4GhC,CAAA;AAEX,QAAA,MAAM,YAAY;;CAOjB,CAAA;AAED,eAAO,MAAM,eAAe,EAAE,+BAA+B,CAC3D,OAAO,8BAA8B,CAAC,KAAK,EAC3C,OAAO,YAAY,CAC8D,CAAA;AAEnF,eAAO,MACa,8CAA8C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAChD,4CAA4C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAC5B,4DAA4D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAC3E,CAAA;AAEnB,KAAK,YAAY,GAAG,uBAAuB,CAAC,OAAO,eAAe,CAAC,CAAA;AAEnE,MAAM,MAAM,wBAAwB,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAA;AAC7D,MAAM,MAAM,6BAA6B,GAAG,YAAY,CAAC,OAAO,CAAC,CAAA;AACjE,MAAM,MAAM,wCAAwC,GAAG,YAAY,CAAC,cAAc,CAAC,CAAA;AACnF,MAAM,MAAM,sCAAsC,GAAG,YAAY,CAAC,qBAAqB,CAAC,CAAA;AACxF,MAAM,MAAM,2CAA2C,GAAG,YAAY,CAAC,qBAAqB,CAAC,CAAA;AAC7F,MAAM,MAAM,sDAAsD,GAChE,YAAY,CAAC,4BAA4B,CAAC,CAAA;AAC5C,MAAM,MAAM,2DAA2D,GACrE,YAAY,CAAC,2BAA2B,CAAC,CAAA"}
+{"version":3,"file":"s3-store.d.ts","sourceRoot":"","sources":["../../../src/v3/robots/s3-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,+BAA+B,EAC/B,cAAc,EACd,uBAAuB,EACxB,MAAM,+BAA+B,CAAA;AAEtC,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAA;AA4B1B,eAAO,MAAM,IAAI,EAAE,cAYlB,CAAA;AAED,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgHhC,CAAA;AAEX,QAAA,MAAM,YAAY;;CAOjB,CAAA;AAED,eAAO,MAAM,eAAe,EAAE,+BAA+B,CAC3D,OAAO,8BAA8B,CAAC,KAAK,EAC3C,OAAO,YAAY,CAC8D,CAAA;AAEnF,eAAO,MACa,8CAA8C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAChD,4CAA4C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAC5B,4DAA4D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAC3E,CAAA;AAEnB,KAAK,YAAY,GAAG,uBAAuB,CAAC,OAAO,eAAe,CAAC,CAAA;AAEnE,MAAM,MAAM,wBAAwB,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAA;AAC7D,MAAM,MAAM,6BAA6B,GAAG,YAAY,CAAC,OAAO,CAAC,CAAA;AACjE,MAAM,MAAM,wCAAwC,GAAG,YAAY,CAAC,cAAc,CAAC,CAAA;AACnF,MAAM,MAAM,sCAAsC,GAAG,YAAY,CAAC,qBAAqB,CAAC,CAAA;AACxF,MAAM,MAAM,2CAA2C,GAAG,YAAY,CAAC,qBAAqB,CAAC,CAAA;AAC7F,MAAM,MAAM,sDAAsD,GAChE,YAAY,CAAC,4BAA4B,CAAC,CAAA;AAC5C,MAAM,MAAM,2DAA2D,GACrE,YAAY,CAAC,2BAA2B,CAAC,CAAA"}

package/dist/v3/robots/s3-store.js

@@ -1,7 +1,19 @@
 import { z } from 'zod/v3';
 import { createStorageStoreExample, defineRobotWithHiddenFields, robotBase, robotStoreMeta, robotUse, s3Base, storeFilePath, } from "./_instructions-primitives.js";
 const s3StoreAclSchema = z
-    .enum(['bucket-default', 'private', 'public', 'public-read'])
+    // AWS object canned ACLs, plus the existing omission sentinel and legacy `public` value.
+    // `log-delivery-write` is bucket-only: https://docs.aws.amazon.com/AmazonS3/latest/userguide/acl-overview.html#canned-acl
+    .enum([
+    'authenticated-read',
+    'aws-exec-read',
+    'bucket-default',
+    'bucket-owner-full-control',
+    'bucket-owner-read',
+    'private',
+    'public',
+    'public-read',
+    'public-read-write',
+])
     .default('public-read');
 export const meta = {
     ...robotStoreMeta,
@@ -20,48 +32,54 @@ export const robotS3StoreInstructionsSchema = robotBase
     .merge(robotUse)
     .merge(s3Base)
     .extend({
+    // URL rewriting does not fix bucket addressing, and custom paths need not use file.url_name.
+    // Keep the bucket warning separate from the old blanket filename-sanitization claim.
     robot: z.literal('/s3/store').describe(`
 If you are new to Amazon S3, see our tutorial on [using your own S3 bucket](/docs/faq/how-to-set-up-an-amazon-s3-bucket/).
 
-The URL to the result file in your S3 bucket will be returned in the <dfn>Assembly Status JSON</dfn>. If your S3 bucket has versioning enabled, the version ID of the file will be returned within \`meta.version_id\`
+The URL to the result file in your S3 bucket will be returned in the <dfn>Assembly Status JSON</dfn>. A returned URL does not make a private object public or grant read access. If your S3 bucket has versioning enabled, the version ID of the file will be returned within \`meta.version_id\`.
 
 > [!Warning]
-> **Avoid permission errors.** By default, \`acl\` is set to \`"${s3StoreAclSchema.parse(undefined)}"\`. AWS S3 has a bucket setting called \`Block new public ACLs and uploading public objects\`. Set this to <strong>False</strong> in your bucket if you intend to leave \`acl\` as \`"${s3StoreAclSchema.parse(undefined)}"\`. Otherwise, you’ll receive permission errors in your Assemblies despite your S3 credentials being configured correctly.
+> **Configure private buckets explicitly.** The Robot’s default \`acl\` is still \`"${s3StoreAclSchema.parse(undefined)}"\`. For a private bucket, set \`acl: "bucket-default"\` and do not supply ACL or grant headers. This omits the generated ACL header and works with [Bucket owner enforced Object Ownership](https://docs.aws.amazon.com/AmazonS3/latest/userguide/about-object-ownership.html), where ACLs are disabled. Keep S3 Block Public Access enabled. Setting \`acl: "private"\` still sends an ACL and is not equivalent to omitting it.
 
 > [!Warning]
-> **Use DNS-compliant bucket names.** Your bucket name [must be DNS-compliant](https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucketnamingrules.html) and must not contain uppercase letters. Any non-alphanumeric characters in the file names will be replaced with an underscore, and spaces will be replaced with dashes. If your existing S3 bucket contains uppercase letters or is otherwise not DNS-compliant, rewrite the result URLs using the <dfn>Robot</dfn>’s \`url_prefix\` parameter.
+> **Use DNS-compliant bucket names.** Follow AWS’s [bucket naming rules](https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucketnamingrules.html). The \`url_prefix\` parameter changes returned URLs; it does not change the bucket or its access permissions.
 
 <span id="minimum-s3-iam-permissions" aria-hidden="true"></span>
 
 ## Limit access
 
-You will also need to add permissions to your bucket so that Transloadit can access it properly. Here is an example IAM policy that you can use. Following the [principle of least privilege](https://en.wikipedia.org/wiki/Principle_of_least_privilege), it contains the **minimum required permissions** to export a file to your S3 bucket using Transloadit. You may require more permissions (especially viewing permissions) depending on your application.
+Use a dedicated AWS identity with access limited to the destination bucket and object prefix. Do not use [AWS root access keys](https://docs.aws.amazon.com/IAM/latest/UserGuide/root-user-best-practices.html). Store its access key ID, secret access key, bucket name and region as \`key\`, \`secret\`, \`bucket\` and \`bucket_region\` in <dfn>Template Credentials</dfn>, then reference their name with \`credentials\`. Trusted backend integrations can instead supply those parameters directly; do not expose AWS secrets in browser instructions.
 
-Please change \`{BUCKET_NAME}\` in the values for \`Sid\` and \`Resource\` accordingly. Also, this policy will grant the minimum required permissions to all your users. We advise you to create a separate Amazon IAM user, and use its User ARN (can be found in the "Summary" tab of a user [here](https://console.aws.amazon.com/iam/home#users)) for the \`Principal\` value. More information about this can be found [here](https://docs.aws.amazon.com/AmazonS3/latest/dev/AccessPolicyLanguage_UseCases_s3_a.html).
+The following is an [identity-based IAM policy](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html), attached to that dedicated identity, not a bucket policy. It intentionally has no \`Principal\`. Replace \`{BUCKET_NAME}\` and use a Robot \`path\` beginning with \`uploads/\`, or adapt both the policy prefix and the path together.
+
+This example covers uploads and failed multipart-upload cleanup with an explicit \`bucket_region\`, \`acl: "bucket-default"\`, no ACL/grant headers, no tags and S3-managed encryption (SSE-S3). Existing bucket policies, organization controls or endpoint policies can still deny access.
 
 \`\`\`json
 {
   "Version": "2012-10-17",
   "Statement": [
     {
-      "Sid": "AllowTransloaditToStoreFilesIn{BUCKET_NAME}Bucket",
+      "Sid": "UploadAndAbortWithinPrefix",
       "Effect": "Allow",
-      "Action": ["s3:GetBucketLocation", "s3:ListBucket", "s3:PutObject", "s3:PutObjectAcl"],
-      "Resource": ["arn:aws:s3:::{BUCKET_NAME}", "arn:aws:s3:::{BUCKET_NAME}/*"]
+      "Action": ["s3:PutObject", "s3:AbortMultipartUpload"],
+      "Resource": "arn:aws:s3:::{BUCKET_NAME}/uploads/*"
     }
   ]
 }
 \`\`\`
 
-The \`Sid\` value is just an identifier for you to recognize the rule later. You can name it anything you like.
+The uploader uses either \`PutObject\` or \`CreateMultipartUpload\`, \`UploadPart\` and \`CompleteMultipartUpload\`; failed multipart uploads can trigger \`AbortMultipartUpload\`. AWS maps the successful upload operations to \`s3:PutObject\`. Write access can **overwrite an existing object key**; it is not add-only. Choose unique object paths and consider versioning for recovery.
 
-The policy needs to be separated into two parts, because the \`ListBucket\` action requires permissions on the bucket while the other actions require permissions on the objects in the bucket. When targeting the objects there's a trailing slash and an asterisk in the \`Resource\` parameter, whereas when the policy targets the bucket, the slash and the asterisk are omitted.
+Add permissions only for features you use, following AWS’s [operation permission reference](https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-with-s3-policy-actions.html):
 
-Please note that if you give the <dfn>Robot</dfn>'s \`acl\` parameter a value of \`"bucket-default"\`, then you do not need the \`"s3:PutObjectAcl"\` permission in your bucket policy.
+- Without an explicit \`bucket_region\`, region discovery can require \`s3:GetBucketLocation\` and fallback \`s3:ListBucket\` on the bucket ARN, \`arn:aws:s3:::{BUCKET_NAME}\`, without an object suffix. Supplying the correct region avoids these discovery requests.
+- ACL or grant headers require \`s3:PutObjectAcl\`; tags require \`s3:PutObjectTagging\` on the allowed object prefix. \`bucket-default\` does not remove ACL/grant headers you supply in \`headers\`.
+- Downloading private results requires separate read authorization. Even a URL generated with \`sign_urls_for\` needs the signing identity to have the appropriate read permissions.
 
-In order to build proper result URLs we need to know the region in which your S3 bucket resides. For this we require the \`GetBucketLocation\` permission. Figuring out your bucket's region this way will also slow down your Assemblies. To make this much faster and to also not require the \`GetBucketLocation\` permission, we have added the \`bucket_region\` parameter to the /s3/store and /s3/import Robots. We recommend using them at all times.
+S3 applies its [bucket encryption configuration](https://docs.aws.amazon.com/AmazonS3/latest/userguide/default-bucket-encryption.html) when no encryption override is sent. You can request SSE-KMS through \`headers\`, using \`x-amz-server-side-encryption: aws:kms\` and \`x-amz-server-side-encryption-aws-kms-key-id\`. When either bucket default encryption or request headers select [SSE-KMS](https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingKMSEncryption.html), the uploading identity needs \`kms:GenerateDataKey\` on the relevant key, plus \`kms:Decrypt\` for multipart uploads. For a customer-managed key, grant these permissions with a compatible KMS key policy; the base S3 policy above does not include them. Do not add blanket \`kms:*\` or \`sts:*\` grants.
 
-Please keep in mind that if you use bucket encryption you may also need to add \`"sts:*"\` and \`"kms:*"\` to the bucket policy. Please read [here](https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html) and [here](https://aws.amazon.com/blogs/security/how-to-restrict-amazon-s3-bucket-access-to-a-specific-iam-role/) in case you run into trouble with our example bucket policy.
+Short-lived AWS credentials are a matching set of \`key\`, \`secret\` and \`session_token\`. Have a trusted backend obtain and refresh all three, then supply them together when it creates the Assembly. It can pass them directly in Robot instructions or save and update them together through the [Template Credentials API](/docs/api/template-credentials-post/). Keep all three out of browser instructions; replacing only the session token does not refresh expired access keys. This Robot passes the supplied credentials to S3; it does not assume a role or refresh expired credentials. Keep temporary credentials valid for the upload.
 `),
     path: storeFilePath,
     url_prefix: z
@@ -71,9 +89,7 @@ Please keep in mind that if you use bucket encryption you may also need to add \
 The URL prefix used for the returned URL, such as \`"http://my.cdn.com/some/path/"\`.
 `),
     acl: s3StoreAclSchema.describe(`
-The permissions used for this file.
-
-Please keep in mind that the default value \`"${s3StoreAclSchema.parse(undefined)}"\` can lead to permission errors due to the \`"Block all public access"\` checkbox that is checked by default when creating a new Amazon S3 Bucket in the AWS console.
+The ACL used for this file. Supports AWS’s [canned ACLs for objects](https://docs.aws.amazon.com/AmazonS3/latest/userguide/acl-overview.html#canned-acl). Other S3-compatible providers may support different ACLs. The default remains \`"${s3StoreAclSchema.parse(undefined)}"\`, which can conflict with S3 Block Public Access and disabled ACLs. For modern private buckets, explicitly set \`"bucket-default"\` to omit the generated ACL header, and do not supply ACL/grant headers in \`headers\`. \`"private"\` still sends an ACL.
 `),
     check_integrity: z
         .boolean()
@@ -121,7 +137,7 @@ This parameter provides signed URLs in the result JSON (in the \`signed_url\` an
         .string()
         .optional()
         .describe(`
-The session token to use for the S3 store. This is only used if the credentials are from an IAM user with the \`sts:AssumeRole\` permission.
+The session token belonging to the temporary AWS access key ID and secret access key supplied for this upload. The Robot does not assume a role or refresh these credentials; they must remain valid for the upload.
 `),
 })
     .strict();

package/dist/v3/robots/speech-transcribe.d.ts

@@ -69,12 +69,12 @@ export declare const robotSpeechTranscribeInstructionsSchema: z.ZodObject<{
     target_language: z.ZodOptional<z.ZodString>;
 }, "strict", z.ZodTypeAny, {
     result: boolean;
+    provider: "aws" | "gcp" | "replicate" | "auto";
     robot: "/speech/transcribe";
     user_meta: Record<string, unknown>;
     force_accept: boolean;
     ignore_errors: string[];
     format: "json" | "text" | "meta" | "srt" | "webvtt";
-    provider: "aws" | "gcp" | "replicate" | "auto";
     granularity: "full" | "list";
     speaker_labels: boolean;
     max_speakers: number;
@@ -100,6 +100,7 @@ export declare const robotSpeechTranscribeInstructionsSchema: z.ZodObject<{
 }, {
     robot: "/speech/transcribe";
     result?: boolean | undefined;
+    provider?: "aws" | "gcp" | "replicate" | "auto" | undefined;
     use?: string | string[] | {
         name: string;
         fields?: string | undefined;
@@ -121,7 +122,6 @@ export declare const robotSpeechTranscribeInstructionsSchema: z.ZodObject<{
     force_accept?: boolean | undefined;
     ignore_errors?: boolean | ("meta" | "execute")[] | undefined;
     format?: "json" | "text" | "meta" | "srt" | "webvtt" | undefined;
-    provider?: "aws" | "gcp" | "replicate" | "auto" | undefined;
     granularity?: "full" | "list" | undefined;
     target_language?: string | undefined;
     speaker_labels?: boolean | undefined;
@@ -200,17 +200,18 @@ export declare const robotSpeechTranscribeInstructionsWithHiddenFieldsSchema: z.
     model: z.ZodOptional<z.ZodEnum<["whisper-large-v3"]>>;
     provider: z.ZodDefault<z.ZodEnum<["auto", "aws", "gcp", "replicate", "transloadit"]>>;
 }, "strict", z.ZodTypeAny, {
+    provider: "aws" | "gcp" | "replicate" | "auto" | "transloadit";
     robot: "/speech/transcribe";
     user_meta: Record<string, unknown>;
     force_accept: boolean;
     ignore_errors: string[];
     format: "json" | "text" | "meta" | "srt" | "webvtt";
-    provider: "aws" | "gcp" | "replicate" | "auto" | "transloadit";
     granularity: "full" | "list";
     speaker_labels: boolean;
     max_speakers: number;
     source_language: string;
     result?: boolean | "debug" | undefined;
+    model?: "whisper-large-v3" | undefined;
     use?: string | string[] | {
         name: string;
         fields?: string | undefined;
@@ -228,11 +229,12 @@ export declare const robotSpeechTranscribeInstructionsWithHiddenFieldsSchema: z.
     interpolate?: boolean | Record<string, boolean> | undefined;
     output_meta?: boolean | string[] | Record<string, boolean> | undefined;
     queue?: "batch" | undefined;
-    model?: "whisper-large-v3" | undefined;
     target_language?: string | undefined;
 }, {
     robot: "/speech/transcribe";
     result?: boolean | "debug" | undefined;
+    provider?: "aws" | "gcp" | "replicate" | "auto" | "transloadit" | undefined;
+    model?: "whisper-large-v3" | undefined;
     use?: string | string[] | {
         name: string;
         fields?: string | undefined;
@@ -253,9 +255,7 @@ export declare const robotSpeechTranscribeInstructionsWithHiddenFieldsSchema: z.
     queue?: "batch" | undefined;
     force_accept?: boolean | undefined;
     ignore_errors?: boolean | ("meta" | "execute")[] | undefined;
-    model?: "whisper-large-v3" | undefined;
     format?: "json" | "text" | "meta" | "srt" | "webvtt" | undefined;
-    provider?: "aws" | "gcp" | "replicate" | "auto" | "transloadit" | undefined;
     granularity?: "full" | "list" | undefined;
     target_language?: string | undefined;
     speaker_labels?: boolean | undefined;
@@ -327,12 +327,12 @@ export declare const robotSpeechTranscribeInstructionsWithHiddenFieldsSchema: z.
     target_language: z.ZodOptional<z.ZodString>;
 }, "strict", z.ZodTypeAny, {
     result: string | boolean;
+    provider: string;
     robot: "/speech/transcribe";
     user_meta: Record<string, unknown>;
     force_accept: string | boolean;
     ignore_errors: string | string[];
     format: string;
-    provider: string;
     granularity: string;
     speaker_labels: string | boolean;
     max_speakers: string | number;
@@ -358,6 +358,7 @@ export declare const robotSpeechTranscribeInstructionsWithHiddenFieldsSchema: z.
 }, {
     robot: "/speech/transcribe";
     result?: string | boolean | undefined;
+    provider?: string | undefined;
     use?: string | string[] | {
         name: string;
         fields?: string | undefined;
@@ -379,7 +380,6 @@ export declare const robotSpeechTranscribeInstructionsWithHiddenFieldsSchema: z.
     force_accept?: string | boolean | undefined;
     ignore_errors?: string | boolean | ("meta" | "execute")[] | undefined;
     format?: string | undefined;
-    provider?: string | undefined;
     granularity?: string | undefined;
     target_language?: string | undefined;
     speaker_labels?: string | boolean | undefined;
@@ -451,17 +451,18 @@ export declare const robotSpeechTranscribeInstructionsWithHiddenFieldsSchema: z.
     model: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodEnum<["whisper-large-v3"]>]>>;
     provider: z.ZodDefault<z.ZodUnion<[z.ZodString, z.ZodEnum<["auto", "aws", "gcp", "replicate", "transloadit"]>]>>;
 }, "strict", z.ZodTypeAny, {
+    provider: string;
     robot: "/speech/transcribe";
     user_meta: Record<string, unknown>;
     force_accept: string | boolean;
     ignore_errors: string | string[];
     format: string;
-    provider: string;
     granularity: string;
     speaker_labels: string | boolean;
     max_speakers: string | number;
     source_language: string;
     result?: string | boolean | undefined;
+    model?: string | undefined;
     use?: string | string[] | {
         name: string;
         fields?: string | undefined;
@@ -479,11 +480,12 @@ export declare const robotSpeechTranscribeInstructionsWithHiddenFieldsSchema: z.
     interpolate?: boolean | Record<string, boolean> | undefined;
     output_meta?: string | boolean | string[] | Record<string, string | boolean> | undefined;
     queue?: string | undefined;
-    model?: string | undefined;
     target_language?: string | undefined;
 }, {
     robot: "/speech/transcribe";
     result?: string | boolean | undefined;
+    provider?: string | undefined;
+    model?: string | undefined;
     use?: string | string[] | {
         name: string;
         fields?: string | undefined;
@@ -504,9 +506,7 @@ export declare const robotSpeechTranscribeInstructionsWithHiddenFieldsSchema: z.
     queue?: string | undefined;
     force_accept?: string | boolean | undefined;
     ignore_errors?: string | boolean | ("meta" | "execute")[] | undefined;
-    model?: string | undefined;
     format?: string | undefined;
-    provider?: string | undefined;
     granularity?: string | undefined;
     target_language?: string | undefined;
     speaker_labels?: string | boolean | undefined;

package/dist/v3/robots/text-speak.d.ts

@@ -67,11 +67,11 @@ export declare const robotTextSpeakInstructionsSchema: z.ZodObject<{
     ssml: z.ZodDefault<z.ZodBoolean>;
 }, "strict", z.ZodTypeAny, {
     result: boolean;
+    provider: "aws" | "gcp" | "auto";
     robot: "/text/speak";
     user_meta: Record<string, unknown>;
     force_accept: boolean;
     ignore_errors: string[];
-    provider: "aws" | "gcp" | "auto";
     target_language: string;
     voice: "female-1" | "female-2" | "female-3" | "female-child-1" | "male-1" | "male-child-1";
     ssml: boolean;
@@ -96,6 +96,7 @@ export declare const robotTextSpeakInstructionsSchema: z.ZodObject<{
 }, {
     robot: "/text/speak";
     result?: boolean | undefined;
+    provider?: "aws" | "gcp" | "auto" | undefined;
     use?: string | string[] | {
         name: string;
         fields?: string | undefined;
@@ -116,7 +117,6 @@ export declare const robotTextSpeakInstructionsSchema: z.ZodObject<{
     queue?: "batch" | undefined;
     force_accept?: boolean | undefined;
     ignore_errors?: boolean | ("meta" | "execute")[] | undefined;
-    provider?: "aws" | "gcp" | "auto" | undefined;
     prompt?: string | null | undefined;
     target_language?: string | undefined;
     voice?: "female-1" | "female-2" | "female-3" | "female-child-1" | "male-1" | "male-child-1" | undefined;
@@ -187,11 +187,11 @@ export declare const robotTextSpeakInstructionsWithHiddenFieldsSchema: z.ZodObje
 } & {
     result: z.ZodOptional<z.ZodUnion<[z.ZodLiteral<"debug">, z.ZodDefault<z.ZodBoolean>]>>;
 }, "strict", z.ZodTypeAny, {
+    provider: "aws" | "gcp" | "auto";
     robot: "/text/speak";
     user_meta: Record<string, unknown>;
     force_accept: boolean;
     ignore_errors: string[];
-    provider: "aws" | "gcp" | "auto";
     target_language: string;
     voice: "female-1" | "female-2" | "female-3" | "female-child-1" | "male-1" | "male-child-1";
     ssml: boolean;
@@ -217,6 +217,7 @@ export declare const robotTextSpeakInstructionsWithHiddenFieldsSchema: z.ZodObje
 }, {
     robot: "/text/speak";
     result?: boolean | "debug" | undefined;
+    provider?: "aws" | "gcp" | "auto" | undefined;
     use?: string | string[] | {
         name: string;
         fields?: string | undefined;
@@ -237,7 +238,6 @@ export declare const robotTextSpeakInstructionsWithHiddenFieldsSchema: z.ZodObje
     queue?: "batch" | undefined;
     force_accept?: boolean | undefined;
     ignore_errors?: boolean | ("meta" | "execute")[] | undefined;
-    provider?: "aws" | "gcp" | "auto" | undefined;
     prompt?: string | null | undefined;
     target_language?: string | undefined;
     voice?: "female-1" | "female-2" | "female-3" | "female-child-1" | "male-1" | "male-child-1" | undefined;
@@ -306,11 +306,11 @@ export declare const robotTextSpeakInstructionsWithHiddenFieldsSchema: z.ZodObje
     ssml: z.ZodDefault<z.ZodUnion<[z.ZodString, z.ZodBoolean]>>;
 }, "strict", z.ZodTypeAny, {
     result: string | boolean;
+    provider: string;
     robot: "/text/speak";
     user_meta: Record<string, unknown>;
     force_accept: string | boolean;
     ignore_errors: string | string[];
-    provider: string;
     target_language: string;
     voice: string;
     ssml: string | boolean;
@@ -335,6 +335,7 @@ export declare const robotTextSpeakInstructionsWithHiddenFieldsSchema: z.ZodObje
 }, {
     robot: "/text/speak";
     result?: string | boolean | undefined;
+    provider?: string | undefined;
     use?: string | string[] | {
         name: string;
         fields?: string | undefined;
@@ -355,7 +356,6 @@ export declare const robotTextSpeakInstructionsWithHiddenFieldsSchema: z.ZodObje
     queue?: string | undefined;
     force_accept?: string | boolean | undefined;
     ignore_errors?: string | boolean | ("meta" | "execute")[] | undefined;
-    provider?: string | undefined;
     prompt?: string | null | undefined;
     target_language?: string | undefined;
     voice?: string | undefined;
@@ -423,11 +423,11 @@ export declare const robotTextSpeakInstructionsWithHiddenFieldsSchema: z.ZodObje
     ssml: z.ZodDefault<z.ZodUnion<[z.ZodString, z.ZodBoolean]>>;
     result: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodUnion<[z.ZodString, z.ZodLiteral<"debug">]>, z.ZodDefault<z.ZodUnion<[z.ZodString, z.ZodBoolean]>>]>>;
 }, "strict", z.ZodTypeAny, {
+    provider: string;
     robot: "/text/speak";
     user_meta: Record<string, unknown>;
     force_accept: string | boolean;
     ignore_errors: string | string[];
-    provider: string;
     target_language: string;
     voice: string;
     ssml: string | boolean;
@@ -453,6 +453,7 @@ export declare const robotTextSpeakInstructionsWithHiddenFieldsSchema: z.ZodObje
 }, {
     robot: "/text/speak";
     result?: string | boolean | undefined;
+    provider?: string | undefined;
     use?: string | string[] | {
         name: string;
         fields?: string | undefined;
@@ -473,7 +474,6 @@ export declare const robotTextSpeakInstructionsWithHiddenFieldsSchema: z.ZodObje
     queue?: string | undefined;
     force_accept?: string | boolean | undefined;
     ignore_errors?: string | boolean | ("meta" | "execute")[] | undefined;
-    provider?: string | undefined;
     prompt?: string | null | undefined;
     target_language?: string | undefined;
     voice?: string | undefined;