transloadit 4.12.0 → 4.13.0

package/dist/storagePublicPrefixes.d.ts

@@ -0,0 +1,62 @@
+import { z } from 'zod';
+/** Normalize a public directory, never implicit workspace-wide access. */
+export declare function normalizeStoragePublicPrefix(prefix: string): string;
+export declare const storagePublicPrefixesSchema: z.ZodObject<{
+    ok: z.ZodLiteral<"STORAGE_PUBLIC_PREFIXES_LISTED">;
+    public_prefixes: z.ZodArray<z.ZodObject<{
+        prefix: z.ZodEffects<z.ZodString, string, string>;
+        created_at: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        prefix: string;
+        created_at: string;
+    }, {
+        prefix: string;
+        created_at: string;
+    }>, "many">;
+}, "strip", z.ZodTypeAny, {
+    ok: "STORAGE_PUBLIC_PREFIXES_LISTED";
+    public_prefixes: {
+        prefix: string;
+        created_at: string;
+    }[];
+}, {
+    ok: "STORAGE_PUBLIC_PREFIXES_LISTED";
+    public_prefixes: {
+        prefix: string;
+        created_at: string;
+    }[];
+}>;
+export declare const storagePublicPrefixDeclaredSchema: z.ZodObject<{
+    prefix: z.ZodEffects<z.ZodString, string, string>;
+    created_at: z.ZodString;
+} & {
+    ok: z.ZodLiteral<"STORAGE_PUBLIC_PREFIX_DECLARED">;
+    created: z.ZodBoolean;
+}, "strip", z.ZodTypeAny, {
+    prefix: string;
+    ok: "STORAGE_PUBLIC_PREFIX_DECLARED";
+    created: boolean;
+    created_at: string;
+}, {
+    prefix: string;
+    ok: "STORAGE_PUBLIC_PREFIX_DECLARED";
+    created: boolean;
+    created_at: string;
+}>;
+export declare const storagePublicPrefixRevokedSchema: z.ZodObject<{
+    ok: z.ZodLiteral<"STORAGE_PUBLIC_PREFIX_REVOKED">;
+    prefix: z.ZodEffects<z.ZodString, string, string>;
+    deleted: z.ZodBoolean;
+}, "strip", z.ZodTypeAny, {
+    prefix: string;
+    ok: "STORAGE_PUBLIC_PREFIX_REVOKED";
+    deleted: boolean;
+}, {
+    prefix: string;
+    ok: "STORAGE_PUBLIC_PREFIX_REVOKED";
+    deleted: boolean;
+}>;
+export type StoragePublicPrefixes = z.infer<typeof storagePublicPrefixesSchema>;
+export type StoragePublicPrefixDeclared = z.infer<typeof storagePublicPrefixDeclaredSchema>;
+export type StoragePublicPrefixRevoked = z.infer<typeof storagePublicPrefixRevokedSchema>;
+//# sourceMappingURL=storagePublicPrefixes.d.ts.map

package/dist/storagePublicPrefixes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storagePublicPrefixes.d.ts","sourceRoot":"","sources":["../src/storagePublicPrefixes.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,0EAA0E;AAC1E,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAQnE;AAUD,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;EAGtC,CAAA;AACF,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;EAG5C,CAAA;AACF,eAAO,MAAM,gCAAgC;;;;;;;;;;;;EAI3C,CAAA;AAEF,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAA;AAC/E,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAA;AAC3F,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAA"}

package/dist/storagePublicPrefixes.js

@@ -0,0 +1,35 @@
+import { validateStoragePathPrefix } from '@transloadit/utils';
+import { z } from 'zod';
+/** Normalize a public directory, never implicit workspace-wide access. */
+export function normalizeStoragePublicPrefix(prefix) {
+    if (typeof prefix !== 'string' || prefix === '' || prefix === '/')
+        throw new TypeError('A public prefix must name a non-root directory');
+    const normalized = prefix.endsWith('/') ? prefix : `${prefix}/`;
+    validateStoragePathPrefix(normalized, 0, 'public prefix');
+    if (new TextEncoder().encode(normalized).byteLength > 512)
+        throw new TypeError('A public prefix must be at most 512 UTF-8 bytes');
+    return normalized;
+}
+const prefixSchema = z.string().refine((prefix) => {
+    try {
+        return normalizeStoragePublicPrefix(prefix) === prefix;
+    }
+    catch {
+        return false;
+    }
+}, 'Expected a normalized public directory');
+const publicPrefixSchema = z.object({ prefix: prefixSchema, created_at: z.string() });
+export const storagePublicPrefixesSchema = z.object({
+    ok: z.literal('STORAGE_PUBLIC_PREFIXES_LISTED'),
+    public_prefixes: z.array(publicPrefixSchema),
+});
+export const storagePublicPrefixDeclaredSchema = publicPrefixSchema.extend({
+    ok: z.literal('STORAGE_PUBLIC_PREFIX_DECLARED'),
+    created: z.boolean(),
+});
+export const storagePublicPrefixRevokedSchema = z.object({
+    ok: z.literal('STORAGE_PUBLIC_PREFIX_REVOKED'),
+    prefix: prefixSchema,
+    deleted: z.boolean(),
+});
+//# sourceMappingURL=storagePublicPrefixes.js.map

package/dist/storagePublicPrefixes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storagePublicPrefixes.js","sourceRoot":"","sources":["../src/storagePublicPrefixes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAA;AAC9D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,0EAA0E;AAC1E,MAAM,UAAU,4BAA4B,CAAC,MAAc;IACzD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,EAAE,IAAI,MAAM,KAAK,GAAG;QAC/D,MAAM,IAAI,SAAS,CAAC,gDAAgD,CAAC,CAAA;IACvE,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,CAAA;IAC/D,yBAAyB,CAAC,UAAU,EAAE,CAAC,EAAE,eAAe,CAAC,CAAA;IACzD,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,UAAU,GAAG,GAAG;QACvD,MAAM,IAAI,SAAS,CAAC,iDAAiD,CAAC,CAAA;IACxE,OAAO,UAAU,CAAA;AACnB,CAAC;AAED,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE;IAChD,IAAI,CAAC;QACH,OAAO,4BAA4B,CAAC,MAAM,CAAC,KAAK,MAAM,CAAA;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC,EAAE,wCAAwC,CAAC,CAAA;AAC5C,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;AACrF,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,gCAAgC,CAAC;IAC/C,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC;CAC7C,CAAC,CAAA;AACF,MAAM,CAAC,MAAM,iCAAiC,GAAG,kBAAkB,CAAC,MAAM,CAAC;IACzE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,gCAAgC,CAAC;IAC/C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACrB,CAAC,CAAA;AACF,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,+BAA+B,CAAC;IAC9C,MAAM,EAAE,YAAY;IACpB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACrB,CAAC,CAAA"}

package/dist/storageResults.d.ts

@@ -0,0 +1,31 @@
+import type { StoredAsset } from './alphalib/types/storageAsset.ts';
+import type { Transloadit } from './Transloadit.ts';
+/** Original-byte delivery, not a preview or transcode; authorize the application's asset first. */
+export interface StoredAssetUrlOptions {
+    /** True uses the receipt filename; a string supplies a different attachment filename. */
+    download?: boolean | string;
+    /** Maximum signed lifetime, from one second to 48 hours. Defaults to five minutes. */
+    lifetimeMs?: number;
+}
+/** Signs a retained original, including non-image media, without fetching or proxying its bytes. */
+export declare function getStoredAssetUrl(client: Transloadit, input: StoredAsset, options?: StoredAssetUrlOptions): string;
+/** Server-owned Assembly identity and expected Workspace, not values from an untrusted notification. */
+export interface GetStoredAssemblyResultsOptions {
+    assemblyId: string;
+    workspace: string;
+}
+/** A canonical stored asset with the producing result's provenance; one input can have many outputs. */
+export interface StoredAssemblyResult {
+    assembly_id: string;
+    step: string;
+    result_id: string;
+    original_id?: string | (string | null)[];
+    asset: StoredAsset;
+}
+/**
+ * Fetches a completed Assembly and verifies all retained results, including non-image media.
+ * The caller must first bind the Assembly to an authorized application upload. Register results
+ * idempotently by Assembly/step/result ID (or asset/version), not by filename or notification count.
+ */
+export declare function getStoredAssemblyResults(client: Transloadit, options: GetStoredAssemblyResultsOptions): Promise<StoredAssemblyResult[]>;
+//# sourceMappingURL=storageResults.d.ts.map

package/dist/storageResults.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storageResults.d.ts","sourceRoot":"","sources":["../src/storageResults.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAA;AACnE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AASnD,mGAAmG;AACnG,MAAM,WAAW,qBAAqB;IACpC,yFAAyF;IACzF,QAAQ,CAAC,EAAE,OAAO,GAAG,MAAM,CAAA;IAC3B,sFAAsF;IACtF,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,oGAAoG;AACpG,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,WAAW,EAClB,OAAO,GAAE,qBAA0B,GAClC,MAAM,CAuBR;AAED,wGAAwG;AACxG,MAAM,WAAW,+BAA+B;IAC9C,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,wGAAwG;AACxG,MAAM,WAAW,oBAAoB;IACnC,WAAW,EAAE,MAAM,CAAA;IACnB,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAA;IACxC,KAAK,EAAE,WAAW,CAAA;CACnB;AAWD;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE,+BAA+B,GACvC,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAsCjC"}

package/dist/storageResults.js

@@ -0,0 +1,79 @@
+import { z } from 'zod';
+import { ApiError } from "./ApiError.js";
+import { robotFileServeInstructionsSchema } from "./alphalib/types/robots/file-serve.js";
+import { storedAssetSchema } from "./alphalib/types/storageAsset.js";
+import InconsistentResponseError from "./InconsistentResponseError.js";
+/** Signs a retained original, including non-image media, without fetching or proxying its bytes. */
+export function getStoredAssetUrl(client, input, options = {}) {
+    const asset = storedAssetSchema.parse(input);
+    const lifetimeMs = options.lifetimeMs ?? 5 * 60_000;
+    if (!Number.isSafeInteger(lifetimeMs) || lifetimeMs < 1000 || lifetimeMs > 48 * 3600_000) {
+        throw new RangeError('lifetimeMs must be an integer between 1000 and 172800000');
+    }
+    const download = options.download === true ? asset.path.split('/').at(-1) : options.download;
+    if (download !== undefined && download !== false) {
+        robotFileServeInstructionsSchema.shape.download_name.unwrap().min(1).parse(download);
+        if (typeof download !== 'string' || /[\uD800-\uDFFF]/u.test(download))
+            throw new TypeError('download must contain a valid Unicode filename');
+    }
+    // Bunny includes the full query in its cache key. Rotate at most once a minute, never at
+    // the lifetime boundary where rounding could issue an almost-expired grant.
+    const rotationMs = Math.min(60_000, Math.floor(lifetimeMs / 2));
+    const expiresAt = Math.floor(Date.now() / rotationMs) * rotationMs + lifetimeMs;
+    return client.getSignedSmartCDNUrl({
+        workspace: asset.workspace,
+        template: 'builtin/storage-serve@0.0.3',
+        input: asset.asset_id,
+        urlParams: { v: asset.version_id, ...(typeof download === 'string' ? { download } : {}) },
+        expiresAt,
+    });
+}
+const requestSchema = z.object({
+    assemblyId: z.string().regex(/^[A-Za-z0-9_-]+$/),
+    workspace: z.string().min(1),
+});
+const resultSchema = storedAssetSchema.extend({
+    id: z.string().min(1),
+    original_id: z.union([z.string(), z.array(z.string().nullable())]).optional(),
+});
+/**
+ * Fetches a completed Assembly and verifies all retained results, including non-image media.
+ * The caller must first bind the Assembly to an authorized application upload. Register results
+ * idempotently by Assembly/step/result ID (or asset/version), not by filename or notification count.
+ */
+export async function getStoredAssemblyResults(client, options) {
+    const { assemblyId, workspace } = requestSchema.parse(options);
+    const assembly = await client.getAssembly(assemblyId);
+    if (assembly.assembly_id !== assemblyId) {
+        throw new InconsistentResponseError('The response did not match the requested Assembly');
+    }
+    if (typeof assembly.error === 'string')
+        throw new ApiError({ body: assembly });
+    if (assembly.ok !== 'ASSEMBLY_COMPLETED') {
+        throw new InconsistentResponseError(`The Storage Assembly is not complete (${assembly.ok})`);
+    }
+    if (assembly.results === undefined) {
+        throw new InconsistentResponseError('The completed Assembly did not contain results');
+    }
+    const results = [];
+    for (const [step, files] of Object.entries(assembly.results)) {
+        for (const file of files) {
+            // Ordinary temporary/exported outputs are not Storage receipts. Partial Storage records
+            // must fail validation rather than disappearing from an otherwise successful batch.
+            if (file.asset_id === undefined &&
+                file.version_id === undefined &&
+                file.workspace === undefined)
+                continue;
+            const parsed = resultSchema.safeParse(file);
+            if (!parsed.success || parsed.data.workspace !== workspace) {
+                throw new InconsistentResponseError('The Assembly returned an invalid or cross-Workspace Storage result', {
+                    cause: { assemblyId, step },
+                });
+            }
+            const { id, original_id, ...asset } = parsed.data;
+            results.push({ assembly_id: assemblyId, step, result_id: id, original_id, asset });
+        }
+    }
+    return results;
+}
+//# sourceMappingURL=storageResults.js.map

package/dist/storageResults.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storageResults.js","sourceRoot":"","sources":["../src/storageResults.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,EAAE,gCAAgC,EAAE,MAAM,uCAAuC,CAAA;AACxF,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAA;AACpE,OAAO,yBAAyB,MAAM,gCAAgC,CAAA;AAUtE,oGAAoG;AACpG,MAAM,UAAU,iBAAiB,CAC/B,MAAmB,EACnB,KAAkB,EAClB,UAAiC,EAAE;IAEnC,MAAM,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAC5C,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,CAAC,GAAG,MAAM,CAAA;IACnD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,IAAI,IAAI,UAAU,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QACzF,MAAM,IAAI,UAAU,CAAC,0DAA0D,CAAC,CAAA;IAClF,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAA;IAC5F,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;QACjD,gCAAgC,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;QACpF,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC;YACnE,MAAM,IAAI,SAAS,CAAC,gDAAgD,CAAC,CAAA;IACzE,CAAC;IACD,yFAAyF;IACzF,4EAA4E;IAC5E,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAA;IAC/D,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,GAAG,UAAU,GAAG,UAAU,CAAA;IAC/E,OAAO,MAAM,CAAC,oBAAoB,CAAC;QACjC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,6BAA6B;QACvC,KAAK,EAAE,KAAK,CAAC,QAAQ;QACrB,SAAS,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;QACzF,SAAS;KACV,CAAC,CAAA;AACJ,CAAC;AAiBD,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,kBAAkB,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC7B,CAAC,CAAA;AACF,MAAM,YAAY,GAAG,iBAAiB,CAAC,MAAM,CAAC;IAC5C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC9E,CAAC,CAAA;AAEF;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAmB,EACnB,OAAwC;IAExC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAC9D,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,CAAA;IACrD,IAAI,QAAQ,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QACxC,MAAM,IAAI,yBAAyB,CAAC,mDAAmD,CAAC,CAAA;IAC1F,CAAC;IACD,IAAI,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC9E,IAAI,QAAQ,CAAC,EAAE,KAAK,oBAAoB,EAAE,CAAC;QACzC,MAAM,IAAI,yBAAyB,CAAC,yCAAyC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAA;IAC9F,CAAC;IACD,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,IAAI,yBAAyB,CAAC,gDAAgD,CAAC,CAAA;IACvF,CAAC;IACD,MAAM,OAAO,GAA2B,EAAE,CAAA;IAC1C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,wFAAwF;YACxF,oFAAoF;YACpF,IACE,IAAI,CAAC,QAAQ,KAAK,SAAS;gBAC3B,IAAI,CAAC,UAAU,KAAK,SAAS;gBAC7B,IAAI,CAAC,SAAS,KAAK,SAAS;gBAE5B,SAAQ;YACV,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;YAC3C,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC3D,MAAM,IAAI,yBAAyB,CACjC,oEAAoE,EACpE;oBACE,KAAK,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;iBAC5B,CACF,CAAA;YACH,CAAC;YACD,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,GAAG,KAAK,EAAE,GAAG,MAAM,CAAC,IAAI,CAAA;YACjD,OAAO,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAA;QACpF,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "transloadit",
-  "version": "4.12.0",
+  "version": "4.13.0",
   "description": "Node.js SDK for Transloadit",
   "homepage": "https://github.com/transloadit/node-sdk/tree/main/packages/node",
   "bugs": {
@@ -29,15 +29,16 @@
   "author": "Tim Koschuetzki <tim@transloadit.com>",
   "packageManager": "yarn@4.12.0",
   "engines": {
-    "node": ">= 20"
+    "node": ">= 20.10.0"
   },
   "dependencies": {
     "@transloadit/sev-logger": "^0.1.9",
-    "@transloadit/utils": "^4.8.1",
+    "@transloadit/utils": "^4.9.0",
     "cacheable-lookup": "^7.0.0",
     "clipanion": "^4.0.0-rc.4",
     "debug": "^4.4.3",
     "dotenv": "^17.4.2",
+    "execa": "9.6.1",
     "form-data": "^4.0.5",
     "got": "14.6.6",
     "into-stream": "^9.1.0",
@@ -48,11 +49,15 @@
     "p-map": "^7.0.4",
     "p-queue": "^9.3.0",
     "recursive-readdir": "^2.2.3",
+    "thumbhash": "0.1.1",
     "tus-js-client": "^4.3.1",
     "typanion": "^3.14.0",
     "type-fest": "^5.6.0",
     "zod": "3.25.76"
   },
+  "optionalDependencies": {
+    "sharp": "0.35.4"
+  },
   "devDependencies": {
     "@types/debug": "^4.1.13",
     "@types/node": "^25.8.0",

package/src/Transloadit.ts

@@ -4,7 +4,9 @@ import type {
   CompileAssemblyInstructionsOptions,
   CompileAssemblyInstructionsResult,
 } from '@transloadit/utils'
+import type { SignatureAlgorithm } from '@transloadit/utils/node'
 import type { Delays, Headers, OptionsOfJSONResponseBody, RetryOptions } from 'got'
+import type { Input as IntoStreamInput } from 'into-stream'
 
 import type { TransloaditErrorResponseBody } from './ApiError.ts'
 import type {
@@ -12,6 +14,13 @@ import type {
   AssemblyIndexItem,
   AssemblyStatus,
 } from './alphalib/types/assemblyStatus.ts'
+import type {
+  GetStoredAssetOptions,
+  ListStoredAssetsOptions,
+  MoveStoredAssetOptions,
+  StoredAsset,
+  StoredAssetsPage,
+} from './alphalib/types/storageAsset.ts'
 import type {
   BaseResponse,
   BillResponse,
@@ -38,6 +47,21 @@ import type {
   LintAssemblyInstructionsInput,
   LintAssemblyInstructionsResult,
 } from './lintAssemblyInstructions.ts'
+import type {
+  GetStoredImageReceiptOptions,
+  StoredImageReceipt,
+  StoreImageOptions,
+} from './storageImage.ts'
+import type {
+  StoragePublicPrefixDeclared,
+  StoragePublicPrefixes,
+  StoragePublicPrefixRevoked,
+} from './storagePublicPrefixes.ts'
+import type {
+  GetStoredAssemblyResultsOptions,
+  StoredAssemblyResult,
+  StoredAssetUrlOptions,
+} from './storageResults.ts'
 import type { Stream, UploadBehavior } from './tus.ts'
 
 import * as assert from 'node:assert'
@@ -52,19 +76,37 @@ import { getSignedSmartCdnUrl, signParamsSync } from '@transloadit/utils/node'
 import debug from 'debug'
 import FormData from 'form-data'
 import got, { HTTPError, RequestError } from 'got'
-import intoStream, { type Input as IntoStreamInput } from 'into-stream'
+import intoStream from 'into-stream'
 import { isReadableStream, isStream } from 'is-stream'
 import pMap from 'p-map'
+import { z } from 'zod'
 
 import packageJson from '../package.json' with { type: 'json' }
 import { ApiError } from './ApiError.ts'
 import { assemblyIndexSchema, assemblyStatusSchema } from './alphalib/types/assemblyStatus.ts'
+import {
+  damAssetFoundResponseSchema,
+  damAssetGetOptionsSchema,
+  damAssetMoveOptionsSchema,
+  damAssetsListedResponseSchema,
+  damAssetsListOptionsSchema,
+  damIdSchema,
+  storedAssetSchema,
+} from './alphalib/types/storageAsset.ts'
 import { zodParseWithContext } from './alphalib/zodParseWithContext.ts'
 import { mintBearerTokenWithCredentials } from './bearerToken.ts'
 import InconsistentResponseError from './InconsistentResponseError.ts'
 import { lintAssemblyInstructions as lintAssemblyInstructionsInternal } from './lintAssemblyInstructions.ts'
 import PaginationStream from './PaginationStream.ts'
 import PollingTimeoutError from './PollingTimeoutError.ts'
+import { getStoredImageReceipt, storeImage } from './storageImage.ts'
+import {
+  normalizeStoragePublicPrefix,
+  storagePublicPrefixDeclaredSchema,
+  storagePublicPrefixesSchema,
+  storagePublicPrefixRevokedSchema,
+} from './storagePublicPrefixes.ts'
+import { getStoredAssemblyResults, getStoredAssetUrl } from './storageResults.ts'
 import { sendTusRequest } from './tus.ts'
 
 export type {
@@ -76,6 +118,13 @@ export type {
 } from '@transloadit/utils'
 
 export type { AssemblyStatus } from './alphalib/types/assemblyStatus.ts'
+export type {
+  GetStoredAssetOptions,
+  ListStoredAssetsOptions,
+  MoveStoredAssetOptions,
+  StoredAsset,
+  StoredAssetsPage,
+} from './alphalib/types/storageAsset.ts'
 export type {
   Base64Strategy,
   InputFile,
@@ -93,6 +142,22 @@ export type {
   RobotListResult,
   RobotParamHelp,
 } from './robots.ts'
+export type {
+  GetStoredImageReceiptOptions,
+  StoredImageExpectation,
+  StoredImageReceipt,
+  StoreImageOptions,
+} from './storageImage.ts'
+export type {
+  StoragePublicPrefixDeclared,
+  StoragePublicPrefixes,
+  StoragePublicPrefixRevoked,
+} from './storagePublicPrefixes.ts'
+export type {
+  GetStoredAssemblyResultsOptions,
+  StoredAssemblyResult,
+  StoredAssetUrlOptions,
+} from './storageResults.ts'
 
 export {
   buildCompileAssemblyInstructionsSystemPrompt,
@@ -382,6 +447,8 @@ type AuthToken = {
 }
 
 type BaseOptions = {
+  /** Use signatureAlgorithm: 'sha256' for new combined Smart CDN/Assembly keys; legacy default: sha384. */
+  signatureAlgorithm?: SignatureAlgorithm
   endpoint?: string
   maxRetries?: number
   timeout?: number
@@ -393,6 +460,7 @@ type BaseOptions = {
 export type Options = BaseOptions & (AuthKeySecret | AuthToken)
 
 export class Transloadit {
+  #signatureAlgorithm: SignatureAlgorithm
   private _authKey: string
 
   private _authSecret: string
@@ -413,6 +481,7 @@ export class Transloadit {
 
   private _validateResponses = false
 
+  /** Create a client; new combined keys require signatureAlgorithm: 'sha256' explicitly. */
   constructor(opts: Options) {
     const rawToken = typeof opts?.authToken === 'string' ? opts.authToken.trim() : ''
     const hasToken = rawToken.length > 0
@@ -433,6 +502,7 @@ export class Transloadit {
 
     this._authKey = opts.authKey ?? ''
     this._authSecret = opts.authSecret ?? ''
+    this.#signatureAlgorithm = opts.signatureAlgorithm ?? 'sha384'
     this._authToken = hasToken ? rawToken : null
     this._endpoint = opts.endpoint || 'https://api2.transloadit.com'
     this._maxRetries = opts.maxRetries != null ? opts.maxRetries : 5
@@ -453,6 +523,126 @@ export class Transloadit {
     this._defaultTimeout = timeout
   }
 
+  /** Stores one local original at an explicit path and returns its verified image metadata. */
+  storeImage(filePath: string, options: StoreImageOptions): Promise<StoredImageReceipt> {
+    return storeImage(this, filePath, options)
+  }
+
+  /** Reconstructs a verified receipt from authoritative Assembly status and trusted upload facts. */
+  getStoredImageReceipt(options: GetStoredImageReceiptOptions): Promise<StoredImageReceipt> {
+    return getStoredImageReceipt(this, options)
+  }
+
+  /** Verifies a completed batch's retained media and preserves result/input provenance. */
+  getStoredAssemblyResults(
+    options: GetStoredAssemblyResultsOptions,
+  ): Promise<StoredAssemblyResult[]> {
+    return getStoredAssemblyResults(this, options)
+  }
+
+  /** Signs exact original bytes after your app authorizes the asset. Use a 307 for fresh request-time authorization. */
+  getStoredAssetUrl(asset: StoredAsset, options?: StoredAssetUrlOptions): string {
+    return getStoredAssetUrl(this, asset, options)
+  }
+
+  /** Reads a live asset's current version, or the exact retained version when version_id is set. */
+  async getStoredAsset(
+    assetId: string,
+    options: GetStoredAssetOptions & { signal?: AbortSignal } = {},
+  ): Promise<StoredAsset> {
+    const id = damIdSchema.parse(assetId)
+    const params = damAssetGetOptionsSchema.parse(options)
+    const result = await this._remoteJson<unknown, OptionalAuthParams & GetStoredAssetOptions>({
+      urlSuffix: `/dam/assets/${id}`,
+      method: 'get',
+      params,
+      signal: options.signal,
+    })
+    checkResult(result)
+    const { asset } = damAssetFoundResponseSchema.parse(result)
+    if (
+      asset.asset_id !== id ||
+      (params.version_id !== undefined && asset.version_id !== params.version_id)
+    ) {
+      throw new InconsistentResponseError(
+        'The response did not match the requested Storage reference',
+      )
+    }
+    return asset
+  }
+
+  /** Reads one bounded catalog page without S3 credentials or a HEAD request per object. */
+  async listStoredAssets(
+    options: ListStoredAssetsOptions & { signal?: AbortSignal } = {},
+  ): Promise<StoredAssetsPage> {
+    const params = damAssetsListOptionsSchema.parse(options)
+    const result = await this._remoteJson<unknown, OptionalAuthParams & ListStoredAssetsOptions>({
+      urlSuffix: '/dam/assets',
+      method: 'get',
+      params,
+      signal: options.signal,
+    })
+    checkResult(result)
+    const page = damAssetsListedResponseSchema.parse(result)
+    if (page.assets.some((asset) => asset.workspace !== page.workspace)) {
+      throw new InconsistentResponseError('Storage catalog page contains a different Workspace')
+    }
+    return page
+  }
+
+  /** Moves or renames an asset natively, preserving asset and version identities. */
+  async moveStoredAsset(
+    assetId: string,
+    options: MoveStoredAssetOptions & { signal?: AbortSignal },
+  ): Promise<StoredAsset> {
+    const id = damIdSchema.parse(assetId)
+    const params = damAssetMoveOptionsSchema.parse(options)
+    if (params.filename === undefined && params.destination_folder_id === undefined) {
+      throw new TypeError('Provide filename or destination_folder_id for a Storage move')
+    }
+    const result = await this._remoteJson<unknown, OptionalAuthParams & MoveStoredAssetOptions>({
+      urlSuffix: `/dam/assets/${id}`,
+      method: 'patch',
+      params,
+      signal: options.signal,
+    })
+    checkResult(result)
+    const { asset } = z
+      .object({ ok: z.literal('DAM_ASSET_MOVED'), asset: storedAssetSchema })
+      .parse(result)
+    if (asset.asset_id !== id)
+      throw new InconsistentResponseError(
+        'The response did not match the requested Storage reference',
+      )
+    return asset
+  }
+
+  /** Soft-deletes an asset by identity, making retained versions unavailable for new reads. */
+  async deleteStoredAsset(
+    assetId: string,
+    options: { signal?: AbortSignal } = {},
+  ): Promise<{ asset_id: string; deleted_at: string }> {
+    const id = damIdSchema.parse(assetId)
+    const result = await this._remoteJson<unknown, OptionalAuthParams>({
+      urlSuffix: `/dam/assets/${id}`,
+      method: 'delete',
+      signal: options.signal,
+    })
+    checkResult(result)
+    const receipt = z
+      .object({
+        ok: z.literal('DAM_ASSET_DELETED'),
+        asset_id: damIdSchema,
+        deleted_at: z.string().datetime(),
+      })
+      .parse(result)
+    if (receipt.asset_id !== id)
+      throw new InconsistentResponseError(
+        'The response did not match the requested Storage reference',
+      )
+    return { asset_id: receipt.asset_id, deleted_at: receipt.deleted_at }
+  }
+
   /**
    * Create an Assembly
    *
@@ -1199,6 +1389,20 @@ export class Transloadit {
     })
   }
 
+  /** Revoke the signing Auth Key itself, without granting access to other workspace keys. */
+  async revokeOwnAuthKey(): Promise<void> {
+    const result = await this._remoteJson<
+      unknown,
+      OptionalAuthParams & { action: 'revoke_auth_key' }
+    >({
+      urlSuffix: '/auth_keys/self',
+      method: 'delete',
+      params: { action: 'revoke_auth_key' },
+    })
+    checkResult(result)
+    z.object({ ok: z.literal('AUTH_KEY_DELETED') }).parse(result)
+  }
+
   /**
    * Get an Assembly Template
    *
@@ -1232,6 +1436,49 @@ export class Transloadit {
     return new PaginationStream(async (page) => this.listTemplates({ ...params, page }))
   }
 
+  /** Declare a directory public for unsigned Storage Built-ins. Requires dam:write scope. */
+  async publishStoragePrefix(
+    prefix: string,
+    options?: { signal?: AbortSignal },
+  ): Promise<StoragePublicPrefixDeclared> {
+    const result = await this._remoteJson<unknown, OptionalAuthParams & { prefix: string }>({
+      urlSuffix: '/storage/public_prefixes',
+      method: 'post',
+      params: { prefix: normalizeStoragePublicPrefix(prefix) },
+      signal: options?.signal,
+    })
+    checkResult(result)
+    return storagePublicPrefixDeclaredSchema.parse(result)
+  }
+
+  /** Revoke origin access to a public directory; cached or downloaded bytes cannot be recalled. */
+  async unpublishStoragePrefix(
+    prefix: string,
+    options?: { signal?: AbortSignal },
+  ): Promise<StoragePublicPrefixRevoked> {
+    const result = await this._remoteJson<unknown, OptionalAuthParams & { prefix: string }>({
+      urlSuffix: '/storage/public_prefixes',
+      method: 'delete',
+      params: { prefix: normalizeStoragePublicPrefix(prefix) },
+      signal: options?.signal,
+    })
+    checkResult(result)
+    return storagePublicPrefixRevokedSchema.parse(result)
+  }
+
+  /** List the workspace's explicitly public directories through the ordinary signed API. */
+  async listPublicStoragePrefixes(options?: {
+    signal?: AbortSignal
+  }): Promise<StoragePublicPrefixes> {
+    const result = await this._remoteJson({
+      urlSuffix: '/storage/public_prefixes',
+      method: 'get',
+      signal: options?.signal,
+    })
+    checkResult(result)
+    return storagePublicPrefixesSchema.parse(result)
+  }
+
   /**
    * Get account Billing details for a specific month
    *
@@ -1274,7 +1521,7 @@ export class Transloadit {
     })
   }
 
-  private _calcSignature(toSign: string, algorithm = 'sha384'): string {
+  private _calcSignature(toSign: string, algorithm: string = this.#signatureAlgorithm): string {
     if (!this._authSecret) {
       throw new Error('Cannot sign params without authSecret.')
     }
@@ -1357,7 +1604,7 @@ export class Transloadit {
     url?: string
     isTrustedUrl?: boolean
     timeout?: Delays
-    method?: 'delete' | 'get' | 'post' | 'put'
+    method?: 'delete' | 'get' | 'patch' | 'post' | 'put'
     params?: TParams
     fields?: Fields
     headers?: Headers
@@ -1397,7 +1644,7 @@ export class Transloadit {
     for (let retryCount = 0; ; retryCount++) {
       let form: FormData | undefined
 
-      if (method === 'post' || method === 'put' || method === 'delete') {
+      if (method === 'post' || method === 'patch' || method === 'put' || method === 'delete') {
         form = new FormData()
         this._appendForm(form, params, fields)
       }