nuxt-media-library 0.0.49 → 0.0.51

package/README.md

@@ -47,8 +47,11 @@ export default defineNuxtConfig({
   mediaLibrary: {
     // Auto-register Vue components from src/runtime/components
     components: true,
-    // Chunk uploader config (used by MlFileUpload)
-    baseURL: 'https://api.example.com',
+    // Where the Nuxt server reaches the media library (with /v1). Server-side
+    // only, never sent to browsers; prefer NUXT_MEDIA_LIBRARY_BASE_URL.
+    baseURL: 'http://media-library.internal/v1',
+    // Only for direct browser uploads (proxyUploads: false): a public address.
+    // publicBaseURL: 'https://media.example.com/v1',
     // Uploads always go through Nuxt server (/api/media-library/uploads/*)
     routes: {
       createSession: '/uploads/sessions',
@@ -60,11 +63,18 @@ export default defineNuxtConfig({
     partSize: 8 * 1024 * 1024,
     concurrency: 3,
     checksum: { algorithm: 'SHA-256', perPart: true, final: true },
-    headers: {},
+    // Sent to browsers too, except credentials: Authorization, Cookie,
+    // Proxy-Authorization and X-Api-Key stay server-side (the proxies add them).
+    headers: { 'X-Tenant': 'acme' },
   },
 })
 ```
 
+Nuxt puts the public runtime config in every page, so the module never copies
+`baseURL` or credential headers there. Set the media library's internal
+address and any service token only server-side
+(`NUXT_MEDIA_LIBRARY_BASE_URL`, `NUXT_MEDIA_LIBRARY_SERVICE_TOKEN`).
+
 ### Nuxt usage
 
 ```vue
@@ -153,6 +163,51 @@ addMediaGrants(lesson.mediaGrant, profile.mediaGrant) // "mlg_…" or { grant, e
   grants are added.
 - Grants live in the browser only, never in server-side state.
 
+### Uploads started by your backend services
+
+When a backend service starts the upload (the Python client's
+`create_upload_router`), the service creates the session and returns a grant
+for it, and `useMLServiceUpload` sends the parts. Where the parts go is the
+app's decision, not the service's:
+
+```ts
+// nuxt.config.ts
+export default defineNuxtConfig({
+  mediaLibrary: {
+    // server side only: set NUXT_MEDIA_LIBRARY_BASE_URL (e.g. http://media-library.internal/v1)
+    serviceUploads: { proxy: true },             // parts go through /api/media-library/service-uploads
+    // or, direct to the media library (needs CORS for the site):
+    // serviceUploads: { baseURL: 'https://media.example.com/v1' },
+  },
+})
+```
+
+```ts
+const { upload, progress } = useMLServiceUpload()
+const { sessionId, assetId } = await upload(file, {
+  start: '/api/videos/uploads',
+  body: { profile: 'lesson-video', context: { lessonId } },
+})
+await $fetch(`/api/videos/lessons/${lessonId}/video`, { method: 'PUT', body: { sessionId, assetId } })
+```
+
+- The upload base is, in order: `upload(file, { baseURL })`,
+  `useMLServiceUpload({ baseURL })`, `serviceUploads.baseURL`
+  (`NUXT_PUBLIC_MEDIA_LIBRARY_SERVICE_UPLOAD_BASE_URL`), the pass-through
+  route when `serviceUploads.proxy` is on, and last the `uploadBaseUrl` an
+  older service returns. With none, `upload` fails before any part is sent.
+- The pass-through route (`serviceUploads.proxy: true`) forwards only a
+  session's `GET`, parts `PUT`, `finalize` and `abort` to the private
+  `mediaLibrary.baseURL`. It requires the browser's `Bearer mlg_…` grant and
+  forwards it and `X-Tenant` untouched (the static `X-Tenant` when the
+  browser sends none). It never adds the service token, static auth headers
+  or a Nuxt-issued grant, drops cookies, and streams request bodies. Mount it
+  yourself with `createMLServiceUploadsProxy()` from
+  `nuxt-media-library/server` for another path.
+- Don't send these uploads through `createMLCatchAllProxy` with `authorize`:
+  grant mode replaces the browser's grant with its own, and the service's
+  `claim_upload` rejects the session.
+
 ### Vue installation (non-Nuxt)
 
 ```bash

package/dist/module.d.mts

@@ -14,7 +14,17 @@ interface ChunkUploaderRoutesConfig {
 }
 interface ModuleOptions {
     components?: boolean;
+    /**
+     * Where the Nuxt server reaches the media library, with `/v1` (often an
+     * internal address). Server-side only: never sent to browsers. Prefer
+     * NUXT_MEDIA_LIBRARY_BASE_URL at runtime.
+     */
     baseURL?: string;
+    /**
+     * The media library address browsers use for direct uploads
+     * (`proxyUploads: false`), with `/v1`. Public: only set a public address.
+     */
+    publicBaseURL?: string;
     routes?: ChunkUploaderRoutesConfig;
     partSize?: number;
     concurrency?: number;
@@ -24,8 +34,21 @@ interface ModuleOptions {
         final?: boolean;
     };
     headers?: Record<string, string> | (() => Record<string, string>);
+    /**
+     * Uploads started by the app's backend services (`useMLServiceUpload`).
+     * `proxy: true` adds `/api/media-library/service-uploads/**`, a same-origin
+     * pass-through that forwards the browser's media grant and nothing else.
+     * `baseURL` is where the browser sends those uploads (the media library's
+     * public API root with `/v1`, or a proxy route); with `proxy` it defaults
+     * to the pass-through route.
+     */
+    serviceUploads?: {
+        proxy?: boolean;
+        baseURL?: string;
+    };
 }
+declare const SERVICE_UPLOADS_ROUTE = "/api/media-library/service-uploads";
 declare const _default: _nuxt_schema.NuxtModule<ModuleOptions, ModuleOptions, false>;
 
-export { _default as default };
+export { SERVICE_UPLOADS_ROUTE, _default as default };
 export type { ChunkUploaderRoutesConfig, ModuleOptions };

package/dist/module.d.ts

@@ -14,7 +14,17 @@ interface ChunkUploaderRoutesConfig {
 }
 interface ModuleOptions {
     components?: boolean;
+    /**
+     * Where the Nuxt server reaches the media library, with `/v1` (often an
+     * internal address). Server-side only: never sent to browsers. Prefer
+     * NUXT_MEDIA_LIBRARY_BASE_URL at runtime.
+     */
     baseURL?: string;
+    /**
+     * The media library address browsers use for direct uploads
+     * (`proxyUploads: false`), with `/v1`. Public: only set a public address.
+     */
+    publicBaseURL?: string;
     routes?: ChunkUploaderRoutesConfig;
     partSize?: number;
     concurrency?: number;
@@ -24,8 +34,21 @@ interface ModuleOptions {
         final?: boolean;
     };
     headers?: Record<string, string> | (() => Record<string, string>);
+    /**
+     * Uploads started by the app's backend services (`useMLServiceUpload`).
+     * `proxy: true` adds `/api/media-library/service-uploads/**`, a same-origin
+     * pass-through that forwards the browser's media grant and nothing else.
+     * `baseURL` is where the browser sends those uploads (the media library's
+     * public API root with `/v1`, or a proxy route); with `proxy` it defaults
+     * to the pass-through route.
+     */
+    serviceUploads?: {
+        proxy?: boolean;
+        baseURL?: string;
+    };
 }
+declare const SERVICE_UPLOADS_ROUTE = "/api/media-library/service-uploads";
 declare const _default: _nuxt_schema.NuxtModule<ModuleOptions, ModuleOptions, false>;
 
-export { _default as default };
+export { SERVICE_UPLOADS_ROUTE, _default as default };
 export type { ChunkUploaderRoutesConfig, ModuleOptions };

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "media-library",
   "configKey": "mediaLibrary",
-  "version": "0.0.49",
+  "version": "0.0.51",
   "builder": {
     "@nuxt/module-builder": "1.0.2",
     "unbuild": "3.6.1"

package/dist/module.mjs

@@ -1,9 +1,25 @@
-import { defineNuxtModule, createResolver, addImportsDir, addComponentsDir, addServerHandler, addPlugin } from '@nuxt/kit';
+import { defineNuxtModule, createResolver, addImportsDir, addComponentsDir, addServerHandler, useLogger, addPlugin } from '@nuxt/kit';
 export * from '../dist/runtime/types/resourcePolicy.js';
 export * from '../dist/runtime/types/uploader.js';
 export * from '../dist/runtime/types/preview.js';
 export * from '../dist/runtime/types/asset.js';
 
+const CREDENTIAL_HEADERS = ["authorization", "proxy-authorization", "cookie", "x-api-key"];
+function browserHeaders(headers) {
+  if (!headers || typeof headers !== "object") return { headers: {}, dropped: [] };
+  const kept = {};
+  const dropped = [];
+  for (const [name, value] of Object.entries(headers)) {
+    if (CREDENTIAL_HEADERS.includes(name.toLowerCase())) dropped.push(name);
+    else kept[name] = value;
+  }
+  return { headers: kept, dropped };
+}
+function browserBaseURL(existingPublic, publicBaseURL) {
+  return existingPublic ?? publicBaseURL ?? "";
+}
+
+const SERVICE_UPLOADS_ROUTE = "/api/media-library/service-uploads";
 const module$1 = defineNuxtModule({
   meta: {
     name: "media-library",
@@ -37,7 +53,10 @@ const module$1 = defineNuxtModule({
     const envTenantHeader = process.env.NUXT_MEDIA_LIBRARY_HEADERS_X_TENANT;
     const envHeaders = envTenantHeader ? { "X-tenant": envTenantHeader } : {};
     const existingHeaders = typeof existingPrivate.headers === "object" ? existingPrivate.headers : {};
-    const resolvedHeaders = { ...existingHeaders };
+    const optionCredentials = Object.fromEntries(
+      browserHeaders(options.headers).dropped.map((name) => [name, options.headers[name]])
+    );
+    const resolvedHeaders = { ...optionCredentials, ...existingHeaders };
     for (const [key, value] of Object.entries(envHeaders)) {
       if (!resolvedHeaders[key]) {
         resolvedHeaders[key] = value;
@@ -89,6 +108,12 @@ const module$1 = defineNuxtModule({
       route: "/api/media-library/manage/processing/**",
       handler: resolver.resolve("./runtime/server/processing-proxy")
     });
+    if (options.serviceUploads?.proxy) {
+      addServerHandler({
+        route: `${SERVICE_UPLOADS_ROUTE}/**`,
+        handler: resolver.resolve("./runtime/server/service-uploads-proxy")
+      });
+    }
     nuxt.options.runtimeConfig.mediaLibrary = {
       ...existingPrivate,
       baseURL: existingPrivate.baseURL ?? envBaseURL ?? options.baseURL ?? "",
@@ -98,9 +123,17 @@ const module$1 = defineNuxtModule({
       // grants). Declared so NUXT_MEDIA_LIBRARY_SERVICE_TOKEN applies.
       serviceToken: existingPrivate.serviceToken ?? ""
     };
+    const logger = useLogger("media-library");
+    const publicHeaders = browserHeaders(existingPublic.headers ?? options.headers);
+    if (publicHeaders.dropped.length) {
+      logger.warn(`mediaLibrary.headers: ${publicHeaders.dropped.join(", ")} kept server-side, not sent to browsers.`);
+    }
+    if (existingPublic.proxyUploads === false && !existingPublic.baseURL && !options.publicBaseURL) {
+      logger.warn("proxyUploads is false but no public media library address is set: set mediaLibrary.publicBaseURL. baseURL is server-side only.");
+    }
     nuxt.options.runtimeConfig.public.mediaLibrary = {
       ...existingPublic,
-      baseURL: existingPublic.baseURL ?? options.baseURL ?? "",
+      baseURL: browserBaseURL(existingPublic.baseURL, options.publicBaseURL),
       routes: existingPublic.routes ?? routes,
       proxyUploads: existingPublic.proxyUploads ?? true,
       partSize: existingPublic.partSize ?? options.partSize ?? 8 * 1024 * 1024,
@@ -110,7 +143,9 @@ const module$1 = defineNuxtModule({
         perPart: existingPublic.checksum?.perPart ?? options.checksum?.perPart ?? true,
         final: existingPublic.checksum?.final ?? options.checksum?.final ?? true
       },
-      headers: existingPublic.headers ?? options.headers ?? {}
+      headers: publicHeaders.headers,
+      // Where useMLServiceUpload sends parts (NUXT_PUBLIC_MEDIA_LIBRARY_SERVICE_UPLOAD_BASE_URL).
+      serviceUploadBaseURL: existingPublic.serviceUploadBaseURL || options.serviceUploads?.baseURL || (options.serviceUploads?.proxy ? SERVICE_UPLOADS_ROUTE : "")
     };
     addPlugin({
       src: resolver.resolve("./runtime/plugins/config")
@@ -118,4 +153,4 @@ const module$1 = defineNuxtModule({
   }
 });
 
-export { module$1 as default };
+export { SERVICE_UPLOADS_ROUTE, module$1 as default };

package/dist/runtime/components/MLMedia/Dropzone.d.vue.ts

@@ -39,13 +39,13 @@ declare const __VLS_base: import("vue").DefineComponent<__VLS_Props, {
     onFiles?: ((files: File[]) => any) | undefined;
     onRejected?: ((files: RejectedFile[]) => any) | undefined;
 }>, {
-    title: string;
-    accept: string;
-    maxSize: number | null;
     variant: "area" | "overlay";
     compact: boolean;
     disabled: boolean;
     multiple: boolean;
+    title: string;
+    accept: string;
+    maxSize: number | null;
     maxFiles: number | null;
     hint: string;
     buttonLabel: string;

package/dist/runtime/components/MLMedia/Dropzone.vue.d.ts

@@ -39,13 +39,13 @@ declare const __VLS_base: import("vue").DefineComponent<__VLS_Props, {
     onFiles?: ((files: File[]) => any) | undefined;
     onRejected?: ((files: RejectedFile[]) => any) | undefined;
 }>, {
-    title: string;
-    accept: string;
-    maxSize: number | null;
     variant: "area" | "overlay";
     compact: boolean;
     disabled: boolean;
     multiple: boolean;
+    title: string;
+    accept: string;
+    maxSize: number | null;
     maxFiles: number | null;
     hint: string;
     buttonLabel: string;

package/dist/runtime/components/MLMedia/Field.d.vue.ts

@@ -41,19 +41,19 @@ declare const __VLS_export: import("vue").DefineComponent<__VLS_PublicProps, {},
     "onUpdate:modelValue"?: ((value: string | null) => any) | undefined;
     "onUpdate:alt"?: ((value: string | undefined) => any) | undefined;
 }>, {
-    visibility: "private" | "restricted" | "public";
+    disabled: boolean;
+    visibility: "private" | "public" | "restricted";
     label: string;
     accept: readonly string[] | string;
     maxSize: number | null;
+    required: boolean;
+    removeLabel: string;
     processingConfig: {
         stepOptions?: Record<string, Record<string, unknown>> | null;
         useFilenameAsAssetId?: boolean;
         enableTranscription?: boolean;
     };
     collectionName: string | null;
-    disabled: boolean;
-    required: boolean;
-    removeLabel: string;
     hint: string;
     missingAlt: boolean;
     picker: boolean;

package/dist/runtime/components/MLMedia/Field.vue.d.ts

@@ -41,19 +41,19 @@ declare const __VLS_export: import("vue").DefineComponent<__VLS_PublicProps, {},
     "onUpdate:modelValue"?: ((value: string | null) => any) | undefined;
     "onUpdate:alt"?: ((value: string | undefined) => any) | undefined;
 }>, {
-    visibility: "private" | "restricted" | "public";
+    disabled: boolean;
+    visibility: "private" | "public" | "restricted";
     label: string;
     accept: readonly string[] | string;
     maxSize: number | null;
+    required: boolean;
+    removeLabel: string;
     processingConfig: {
         stepOptions?: Record<string, Record<string, unknown>> | null;
         useFilenameAsAssetId?: boolean;
         enableTranscription?: boolean;
     };
     collectionName: string | null;
-    disabled: boolean;
-    required: boolean;
-    removeLabel: string;
     hint: string;
     missingAlt: boolean;
     picker: boolean;

package/dist/runtime/components/MLMedia/FilePicker.d.vue.ts

@@ -14,9 +14,9 @@ declare const __VLS_export: import("vue").DefineComponent<__VLS_Props, {}, {}, {
 }>, {
     title: string;
     accept: readonly string[] | string;
-    maxSize: number | null;
     max: number;
     selected: readonly string[];
+    maxSize: number | null;
     upload: MediaUploadOptions;
 }, {}, {}, {}, string, import("vue").ComponentProvideOptions, false, {}, any>;
 declare const _default: typeof __VLS_export;

package/dist/runtime/components/MLMedia/FilePicker.vue.d.ts

@@ -14,9 +14,9 @@ declare const __VLS_export: import("vue").DefineComponent<__VLS_Props, {}, {}, {
 }>, {
     title: string;
     accept: readonly string[] | string;
-    maxSize: number | null;
     max: number;
     selected: readonly string[];
+    maxSize: number | null;
     upload: MediaUploadOptions;
 }, {}, {}, {}, string, import("vue").ComponentProvideOptions, false, {}, any>;
 declare const _default: typeof __VLS_export;

package/dist/runtime/components/MLMedia/FilePickerPanel.d.vue.ts

@@ -23,9 +23,9 @@ declare const __VLS_export: import("vue").DefineComponent<__VLS_Props, {}, {}, {
 }>, {
     title: string;
     accept: readonly string[] | string;
-    maxSize: number | null;
     max: number;
     selected: readonly string[];
+    maxSize: number | null;
     upload: MediaUploadOptions;
     bodyClass: string;
 }, {}, {}, {}, string, import("vue").ComponentProvideOptions, false, {}, any>;

package/dist/runtime/components/MLMedia/FilePickerPanel.vue.d.ts

@@ -23,9 +23,9 @@ declare const __VLS_export: import("vue").DefineComponent<__VLS_Props, {}, {}, {
 }>, {
     title: string;
     accept: readonly string[] | string;
-    maxSize: number | null;
     max: number;
     selected: readonly string[];
+    maxSize: number | null;
     upload: MediaUploadOptions;
     bodyClass: string;
 }, {}, {}, {}, string, import("vue").ComponentProvideOptions, false, {}, any>;

package/dist/runtime/components/MLMedia/Gallery.d.vue.ts

@@ -51,10 +51,12 @@ declare const __VLS_export: import("vue").DefineComponent<__VLS_PublicProps, {},
     "onUpdate:alt"?: ((value: Record<string, string> | undefined) => any) | undefined;
     "onUpdate:profiles"?: ((profiles: MediaGalleryProfiles) => any) | undefined;
 }>, {
-    visibility: "private" | "restricted" | "public";
+    disabled: boolean;
     title: string;
+    visibility: "private" | "public" | "restricted";
     profile: string | null;
     accept: readonly string[] | string;
+    max: number | null;
     maxSize: number | null;
     processingConfig: {
         stepOptions?: Record<string, Record<string, unknown>> | null;
@@ -62,8 +64,6 @@ declare const __VLS_export: import("vue").DefineComponent<__VLS_PublicProps, {},
         enableTranscription?: boolean;
     };
     collectionName: string | null;
-    disabled: boolean;
-    max: number | null;
     hint: string;
     picker: boolean;
     onPick: () => void;

package/dist/runtime/components/MLMedia/Gallery.vue.d.ts

@@ -51,10 +51,12 @@ declare const __VLS_export: import("vue").DefineComponent<__VLS_PublicProps, {},
     "onUpdate:alt"?: ((value: Record<string, string> | undefined) => any) | undefined;
     "onUpdate:profiles"?: ((profiles: MediaGalleryProfiles) => any) | undefined;
 }>, {
-    visibility: "private" | "restricted" | "public";
+    disabled: boolean;
     title: string;
+    visibility: "private" | "public" | "restricted";
     profile: string | null;
     accept: readonly string[] | string;
+    max: number | null;
     maxSize: number | null;
     processingConfig: {
         stepOptions?: Record<string, Record<string, unknown>> | null;
@@ -62,8 +64,6 @@ declare const __VLS_export: import("vue").DefineComponent<__VLS_PublicProps, {},
         enableTranscription?: boolean;
     };
     collectionName: string | null;
-    disabled: boolean;
-    max: number | null;
     hint: string;
     picker: boolean;
     onPick: () => void;

package/dist/runtime/components/MLMedia/GallerySection.d.vue.ts

@@ -66,21 +66,21 @@ declare const __VLS_base: import("vue").DefineComponent<__VLS_PublicProps, {
     "onUpdate:modelValue"?: ((value: string[]) => any) | undefined;
     "onUpdate:alt"?: ((value: Record<string, string> | undefined) => any) | undefined;
 }>, {
-    visibility: "private" | "restricted" | "public";
+    disabled: boolean;
+    highlight: ReadonlySet<string> | null;
     title: string;
+    visibility: "private" | "public" | "restricted";
     profile: string | null;
     accept: readonly string[] | string;
+    max: number | null;
     maxSize: number | null;
+    removeLabel: string;
     processingConfig: {
         stepOptions?: Record<string, Record<string, unknown>> | null;
         useFilenameAsAssetId?: boolean;
         enableTranscription?: boolean;
     };
     collectionName: string | null;
-    disabled: boolean;
-    highlight: ReadonlySet<string> | null;
-    removeLabel: string;
-    max: number | null;
     onAdd: (assetId: string, tag: string | undefined) => void;
     hint: string;
     picker: boolean;

package/dist/runtime/components/MLMedia/GallerySection.vue.d.ts

@@ -66,21 +66,21 @@ declare const __VLS_base: import("vue").DefineComponent<__VLS_PublicProps, {
     "onUpdate:modelValue"?: ((value: string[]) => any) | undefined;
     "onUpdate:alt"?: ((value: Record<string, string> | undefined) => any) | undefined;
 }>, {
-    visibility: "private" | "restricted" | "public";
+    disabled: boolean;
+    highlight: ReadonlySet<string> | null;
     title: string;
+    visibility: "private" | "public" | "restricted";
     profile: string | null;
     accept: readonly string[] | string;
+    max: number | null;
     maxSize: number | null;
+    removeLabel: string;
     processingConfig: {
         stepOptions?: Record<string, Record<string, unknown>> | null;
         useFilenameAsAssetId?: boolean;
         enableTranscription?: boolean;
     };
     collectionName: string | null;
-    disabled: boolean;
-    highlight: ReadonlySet<string> | null;
-    removeLabel: string;
-    max: number | null;
     onAdd: (assetId: string, tag: string | undefined) => void;
     hint: string;
     picker: boolean;

package/dist/runtime/components/MLMedia/KindBadge.d.vue.ts

@@ -9,7 +9,7 @@ type __VLS_Props = {
     variant?: BadgeProps['variant'];
 };
 declare const __VLS_export: import("vue").DefineComponent<__VLS_Props, {}, {}, {}, {}, import("vue").ComponentOptionsMixin, import("vue").ComponentOptionsMixin, {}, string, import("vue").PublicProps, Readonly<__VLS_Props> & Readonly<{}>, {
-    size: "md" | "xs" | "sm" | "lg" | "xl";
+    size: "xs" | "sm" | "md" | "lg" | "xl";
     variant: "solid" | "outline" | "soft" | "subtle";
     icon: boolean;
 }, {}, {}, {}, string, import("vue").ComponentProvideOptions, false, {}, any>;

package/dist/runtime/components/MLMedia/KindBadge.vue.d.ts

@@ -9,7 +9,7 @@ type __VLS_Props = {
     variant?: BadgeProps['variant'];
 };
 declare const __VLS_export: import("vue").DefineComponent<__VLS_Props, {}, {}, {}, {}, import("vue").ComponentOptionsMixin, import("vue").ComponentOptionsMixin, {}, string, import("vue").PublicProps, Readonly<__VLS_Props> & Readonly<{}>, {
-    size: "md" | "xs" | "sm" | "lg" | "xl";
+    size: "xs" | "sm" | "md" | "lg" | "xl";
     variant: "solid" | "outline" | "soft" | "subtle";
     icon: boolean;
 }, {}, {}, {}, string, import("vue").ComponentProvideOptions, false, {}, any>;

package/dist/runtime/components/MLMedia/MediaTile.d.vue.ts

@@ -40,10 +40,10 @@ declare const __VLS_base: import("vue").DefineComponent<__VLS_Props, {}, {}, {},
     asset: AssetDetail | DeliveryAsset | null;
     src: string | null;
     progress: number | null;
-    name: string;
+    disabled: boolean;
     kind: string | null;
+    name: string;
     phase: ProgressVeilPhase | null;
-    disabled: boolean;
     selected: boolean;
     missingAlt: boolean;
     onOpen: () => void;

package/dist/runtime/components/MLMedia/MediaTile.vue.d.ts

@@ -40,10 +40,10 @@ declare const __VLS_base: import("vue").DefineComponent<__VLS_Props, {}, {}, {},
     asset: AssetDetail | DeliveryAsset | null;
     src: string | null;
     progress: number | null;
-    name: string;
+    disabled: boolean;
     kind: string | null;
+    name: string;
     phase: ProgressVeilPhase | null;
-    disabled: boolean;
     selected: boolean;
     missingAlt: boolean;
     onOpen: () => void;

package/dist/runtime/components/MLMedia/PickerCard.d.vue.ts

@@ -24,11 +24,11 @@ declare const __VLS_base: import("vue").DefineComponent<__VLS_Props, {}, {}, {},
 }>, {
     asset: AssetDetail | DeliveryAsset | null;
     src: string | null;
-    name: string;
-    kind: string | null;
     disabled: boolean;
-    meta: string;
+    kind: string | null;
+    name: string;
     selected: boolean;
+    meta: string;
     disabledReason: string;
     onPreview: () => void;
 }, {}, {}, {}, string, import("vue").ComponentProvideOptions, false, {}, any>;

package/dist/runtime/components/MLMedia/PickerCard.vue.d.ts

@@ -24,11 +24,11 @@ declare const __VLS_base: import("vue").DefineComponent<__VLS_Props, {}, {}, {},
 }>, {
     asset: AssetDetail | DeliveryAsset | null;
     src: string | null;
-    name: string;
-    kind: string | null;
     disabled: boolean;
-    meta: string;
+    kind: string | null;
+    name: string;
     selected: boolean;
+    meta: string;
     disabledReason: string;
     onPreview: () => void;
 }, {}, {}, {}, string, import("vue").ComponentProvideOptions, false, {}, any>;

package/dist/runtime/components/MLMedia/PickerRow.d.vue.ts

@@ -20,9 +20,9 @@ declare const __VLS_export: import("vue").DefineComponent<__VLS_Props, {}, {}, {
     size: string;
     asset: AssetDetail | DeliveryAsset | null;
     src: string | null;
-    name: string;
-    kind: string | null;
     disabled: boolean;
+    kind: string | null;
+    name: string;
     selected: boolean;
     date: string;
     disabledReason: string;

package/dist/runtime/components/MLMedia/PickerRow.vue.d.ts

@@ -20,9 +20,9 @@ declare const __VLS_export: import("vue").DefineComponent<__VLS_Props, {}, {}, {
     size: string;
     asset: AssetDetail | DeliveryAsset | null;
     src: string | null;
-    name: string;
-    kind: string | null;
     disabled: boolean;
+    kind: string | null;
+    name: string;
     selected: boolean;
     date: string;
     disabledReason: string;

package/dist/runtime/components/MLMedia/ProgressVeil.d.vue.ts

@@ -15,8 +15,8 @@ type __VLS_Props = {
 };
 declare const __VLS_export: import("vue").DefineComponent<__VLS_Props, {}, {}, {}, {}, import("vue").ComponentOptionsMixin, import("vue").ComponentOptionsMixin, {}, string, import("vue").PublicProps, Readonly<__VLS_Props> & Readonly<{}>, {
     progress: number | null;
-    label: string;
     compact: boolean;
+    label: string;
     onCancel: () => void;
     onRetry: () => void;
     detail: string;

package/dist/runtime/components/MLMedia/ProgressVeil.vue.d.ts

@@ -15,8 +15,8 @@ type __VLS_Props = {
 };
 declare const __VLS_export: import("vue").DefineComponent<__VLS_Props, {}, {}, {}, {}, import("vue").ComponentOptionsMixin, import("vue").ComponentOptionsMixin, {}, string, import("vue").PublicProps, Readonly<__VLS_Props> & Readonly<{}>, {
     progress: number | null;
-    label: string;
     compact: boolean;
+    label: string;
     onCancel: () => void;
     onRetry: () => void;
     detail: string;

package/dist/runtime/components/MLMedia/StatusBadge.d.vue.ts

@@ -8,7 +8,7 @@ type __VLS_Props = {
     variant?: BadgeProps['variant'];
 };
 declare const __VLS_export: import("vue").DefineComponent<__VLS_Props, {}, {}, {}, {}, import("vue").ComponentOptionsMixin, import("vue").ComponentOptionsMixin, {}, string, import("vue").PublicProps, Readonly<__VLS_Props> & Readonly<{}>, {
-    size: "md" | "xs" | "sm" | "lg" | "xl";
+    size: "xs" | "sm" | "md" | "lg" | "xl";
     progress: number | null;
     variant: "solid" | "outline" | "soft" | "subtle";
     icon: boolean;

package/dist/runtime/components/MLMedia/StatusBadge.vue.d.ts

@@ -8,7 +8,7 @@ type __VLS_Props = {
     variant?: BadgeProps['variant'];
 };
 declare const __VLS_export: import("vue").DefineComponent<__VLS_Props, {}, {}, {}, {}, import("vue").ComponentOptionsMixin, import("vue").ComponentOptionsMixin, {}, string, import("vue").PublicProps, Readonly<__VLS_Props> & Readonly<{}>, {
-    size: "md" | "xs" | "sm" | "lg" | "xl";
+    size: "xs" | "sm" | "md" | "lg" | "xl";
     progress: number | null;
     variant: "solid" | "outline" | "soft" | "subtle";
     icon: boolean;

package/dist/runtime/composables/useMLServiceUpload.d.ts

@@ -16,10 +16,18 @@ export type { ServiceUploadOptions, ServiceUploadResult } from '../utils/uploade
  * await $fetch(`/api/videos/lessons/${lessonId}/video`, { method: 'PUT', body: { sessionId, assetId } })
  * ```
  *
+ * Parts go to, in order: `upload(file, { baseURL })`, `useMLServiceUpload({
+ * baseURL })`, the app's `mediaLibrary.serviceUploads` (`baseURL`, or the
+ * pass-through route with `proxy: true`), then the URL the service returned.
+ * Direct calls need the media library to allow the site's origin (CORS);
+ * the pass-through route does not.
+ *
  * One upload at a time per call of the composable; call it once per
- * upload field. The media library must allow the site's origin (CORS).
+ * upload field.
  */
-export declare function useMLServiceUpload(): {
+export declare function useMLServiceUpload(defaults?: {
+    baseURL?: string;
+}): {
     upload: (file: File, options: ServiceUploadOptions) => Promise<ServiceUploadResult>;
     abort: () => void;
     uploading: import("vue").Ref<boolean, boolean>;

package/dist/runtime/composables/useMLServiceUpload.js

@@ -1,11 +1,14 @@
 import { ref } from "vue";
+import { useRuntimeConfig } from "#imports";
 import { ChunkUploader } from "../utils/uploader/uploader.js";
 import { createServiceUpload } from "../utils/uploader/serviceUpload.js";
-export function useMLServiceUpload() {
+export function useMLServiceUpload(defaults = {}) {
   const uploading = ref(false);
   const progress = ref(null);
   const error = ref(null);
+  const configured = useRuntimeConfig().public?.mediaLibrary?.serviceUploadBaseURL;
   const runner = createServiceUpload({
+    baseURL: defaults.baseURL || configured || void 0,
     fetch: (url, opts) => $fetch(url, opts),
     createUploader: (cfg) => new ChunkUploader(cfg)
   });

package/dist/runtime/server/index.d.ts

@@ -1,4 +1,6 @@
 export { createMLProxy, createMLCatchAllProxy } from './create-ml-proxy.js';
+export { createMLServiceUploadsProxy } from './service-uploads-proxy.js';
+export type { MLServiceUploadsProxyOptions } from './service-uploads-proxy.js';
 export type { MLProxyType, MLProxyOptions } from './create-ml-proxy.js';
 export { cachedIssuer, grantNeed, MLGrantIssueError, serviceTokenIssuer, specFromNeed, } from './grants.js';
 export type { MLAuthorize, MLGrantNeed, MLGrantProfile, MLGrantScope, MLGrantSpec, MLIssueGrant, MLIssuedGrant, } from './grants.js';

package/dist/runtime/server/index.js

@@ -1,4 +1,5 @@
 export { createMLProxy, createMLCatchAllProxy } from "./create-ml-proxy.js";
+export { createMLServiceUploadsProxy } from "./service-uploads-proxy.js";
 export {
   cachedIssuer,
   grantNeed,

package/dist/runtime/server/service-uploads-proxy.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Same-origin pass-through for uploads started by the app's backend services
+ * (py_client `create_upload_router`, `useMLServiceUpload`).
+ *
+ * The service created the session and gave the browser a media grant for it;
+ * this route only carries the browser's own requests to the media library:
+ *
+ * - only `GET …/sessions/{id}`, `PUT …/sessions/{id}/parts/{n}`,
+ *   `POST …/sessions/{id}/finalize` and `POST …/sessions/{id}/abort`
+ *   (never session creation: the service does that);
+ * - the browser's `Authorization: Bearer mlg_…` is required and forwarded
+ *   untouched, with its `X-Tenant`; no service token, static auth header or
+ *   Nuxt-issued grant is ever added, and cookies are not forwarded;
+ * - request bodies are streamed (parts are megabytes, files gigabytes).
+ */
+export interface MLServiceUploadsProxyOptions {
+    /** The media library API root with `/v1`. Default: private `mediaLibrary.baseURL`. */
+    baseURL?: string;
+    /** `X-Tenant` when the browser sends none. Default: the static `X-Tenant` header. */
+    tenant?: string;
+}
+/** The upstream path and method for a request, or null when it is not a session route. */
+export declare function serviceUploadRoute(pathname: string, method: string): {
+    path: string;
+    method: string;
+} | null;
+/** The headers sent upstream: the grant, the tenant, and the upload headers. */
+export declare function serviceUploadHeaders(incoming: Record<string, string | undefined>, tenant?: string): Record<string, string> | null;
+export declare function createMLServiceUploadsProxy(options?: MLServiceUploadsProxyOptions): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;
+export default _default;

package/dist/runtime/server/service-uploads-proxy.js

@@ -0,0 +1,61 @@
+import { createError, defineEventHandler, getRequestHeaders, getRequestURL, getRequestWebStream, sendProxy } from "h3";
+import { useRuntimeConfig } from "#imports";
+const SESSION_PATH = /\/manage\/uploads\/sessions\/([^/]+)(\/parts\/\d+|\/finalize|\/abort)?\/?$/;
+const GRANT = /^Bearer mlg_[\w.-]+$/;
+const FORWARDED = ["content-type", "content-length", "content-range", "x-part-sha256", "accept"];
+export function serviceUploadRoute(pathname, method) {
+  const match = pathname.match(SESSION_PATH);
+  if (!match) return null;
+  const [, sessionId, action = ""] = match;
+  const expected = action.startsWith("/parts/") ? "PUT" : action ? "POST" : "GET";
+  if (method !== expected) return null;
+  return { path: `/manage/uploads/sessions/${sessionId}${action}`, method };
+}
+export function serviceUploadHeaders(incoming, tenant) {
+  const lower = Object.fromEntries(Object.entries(incoming).map(([k, v]) => [k.toLowerCase(), v]));
+  const authorization = lower.authorization;
+  if (!authorization || !GRANT.test(authorization)) return null;
+  const headers = { authorization };
+  const xTenant = lower["x-tenant"] || tenant;
+  if (xTenant) headers["x-tenant"] = xTenant;
+  for (const name of FORWARDED) {
+    const value = lower[name];
+    if (value) headers[name] = value;
+  }
+  return headers;
+}
+export function createMLServiceUploadsProxy(options = {}) {
+  return defineEventHandler((event) => proxyServiceUpload(event, options));
+}
+async function proxyServiceUpload(event, options) {
+  const method = (event.node.req.method || "GET").toUpperCase();
+  const reqUrl = getRequestURL(event);
+  const route = serviceUploadRoute(reqUrl.pathname, method);
+  if (!route) throw createError({ statusCode: 404, statusMessage: "Not found" });
+  const config = useRuntimeConfig().mediaLibrary || {};
+  const baseURL = options.baseURL ?? config.baseURL;
+  if (!baseURL || !/^https?:\/\//.test(baseURL)) {
+    throw createError({ statusCode: 500, statusMessage: "mediaLibrary.baseURL must be an absolute http(s) URL." });
+  }
+  const headers = serviceUploadHeaders(getRequestHeaders(event), options.tenant ?? staticTenant(config.headers));
+  if (!headers) throw createError({ statusCode: 401, statusMessage: "A media grant (Bearer mlg_\u2026) is required" });
+  const upstream = new URL(`${baseURL.replace(/\/+$/, "")}${route.path}`);
+  upstream.search = reqUrl.search;
+  const fetchOptions = { method, headers };
+  if (method !== "GET") {
+    fetchOptions.body = getRequestWebStream(event);
+    fetchOptions.duplex = "half";
+  }
+  const result = await sendProxy(event, upstream.toString(), { fetchOptions });
+  if (event.node.res.statusCode >= 400) {
+    console.error(`[media-library] service-uploads-proxy upstream responded ${event.node.res.statusCode} for ${method} ${upstream}`);
+  }
+  return result;
+}
+function staticTenant(headers) {
+  const resolved = typeof headers === "function" ? headers() : headers;
+  if (!resolved || typeof resolved !== "object") return void 0;
+  const entry = Object.entries(resolved).find(([k]) => k.toLowerCase() === "x-tenant");
+  return entry?.[1] || void 0;
+}
+export default createMLServiceUploadsProxy();

package/dist/runtime/utils/uploader/serviceUpload.d.ts

@@ -11,7 +11,12 @@ export interface ServiceUploadStart {
     sessionId: string;
     grant: string;
     expiresAt: string;
-    uploadBaseUrl: string;
+    /**
+     * Where the service says to upload. Used only when the app configures no
+     * upload base (`baseURL` option, or `mediaLibrary.serviceUploads`); newer
+     * services leave it out.
+     */
+    uploadBaseUrl?: string;
     tenant: string;
     partSizeBytes?: number;
 }
@@ -24,6 +29,13 @@ export interface ServiceUploadGrant {
 export interface ServiceUploadOptions {
     /** The service's start endpoint, e.g. `/api/videos/uploads`. */
     start: string;
+    /**
+     * Where to send the parts: the media library's public API root with
+     * `/v1`, or a same-origin pass-through route such as
+     * `/api/media-library/service-uploads`. Default: the app's configured
+     * upload base, then the service's `uploadBaseUrl`.
+     */
+    baseURL?: string;
     /**
      * Extra fields for the start request, e.g. `{ profile, context }`.
      * `mimeType`, `sizeBytes` and `filename` are taken from the file
@@ -59,12 +71,14 @@ interface UploaderLike {
 }
 export interface ServiceUploadDeps {
     fetch: FetchLike;
+    /** The app's configured upload base (used when an upload passes no `baseURL`). */
+    baseURL?: string;
     createUploader: (cfg: ChunkUploaderConfig) => UploaderLike;
     now?: () => number;
     setTimer?: (fn: () => void, ms: number) => unknown;
     clearTimer?: (handle: unknown) => void;
 }
-/** The media library routes a session grant allows (relative to `uploadBaseUrl`). */
+/** The media library routes a session grant allows (relative to the upload base). */
 export declare const serviceUploadRoutes: {
     createSession: string;
     getSession: (id: string) => string;

package/dist/runtime/utils/uploader/serviceUpload.js

@@ -41,6 +41,10 @@ export function createServiceUpload(deps) {
       }
     });
     if (run.aborted) throw abortError();
+    const baseURL = (options.baseURL || deps.baseURL || started.uploadBaseUrl || "").replace(/\/+$/, "");
+    if (!baseURL) {
+      throw new Error("No upload base URL: pass baseURL, or set mediaLibrary.serviceUploads (baseURL or proxy) in nuxt.config.");
+    }
     const sessionId = started.sessionId;
     const refreshUrl = typeof options.refresh === "function" ? options.refresh(sessionId) : options.refresh ?? `${start}/${encodeURIComponent(sessionId)}/grant`;
     let grant = started.grant;
@@ -73,7 +77,7 @@ export function createServiceUpload(deps) {
       timer = null;
     };
     const uploader = deps.createUploader({
-      baseURL: started.uploadBaseUrl.replace(/\/+$/, ""),
+      baseURL,
       routes: serviceUploadRoutes,
       partSize: started.partSizeBytes ?? DEFAULT_PART_SIZE,
       concurrency: options.concurrency ?? 3,

package/dist/types.d.mts

@@ -1,4 +1,4 @@
-export { default } from './module.mjs'
+export { type SERVICE_UPLOADS_ROUTE, default } from './module.mjs'
 
 export { type ChunkUploaderRoutesConfig, type ModuleOptions } from './module.mjs'
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nuxt-media-library",
-  "version": "0.0.49",
+  "version": "0.0.51",
   "description": "Nuxt module for media library management — chunked uploads, asset previews, and resource policies",
   "repository": {
     "type": "git",