transloadit 5.0.0 → 5.0.1

package/README.md

@@ -108,9 +108,9 @@ Most commands can authenticate with either `TRANSLOADIT_AUTH_TOKEN` or `TRANSLOA
 
 ### Storage images for Next.js
 
-`@transloadit/viewer` is currently an unpublished, private preview. Follow the
-[local package instructions](https://github.com/transloadit/node-sdk/blob/img-onboard/docs/img-dogfood.md)
-until release. In a Next.js 16.3.3+ App Router project with Storage enabled, run:
+`@transloadit/viewer` is a published alpha. Follow the
+[Viewer Quickstart](https://github.com/transloadit/node-sdk/blob/main/packages/img/README.md)
+to install it. In a Next.js 16.3.3+ App Router project with Storage enabled, run:
 
 ```bash
 yarn transloadit auth login
@@ -143,6 +143,9 @@ Images are never decoded locally. Add `--placeholder blur` to request a server T
 omission or `--placeholder empty` performs no extraction. Successful extraction adds metadata
 usage equal to 20% of the file's bytes. Viewer's separate `placeholder="blur"` opts into rendering.
 Extraction is best-effort: a missing hash does not fail the upload or trigger another one.
+For live user-upload galleries, use [dynamic React receipts](https://github.com/transloadit/node-sdk/blob/main/packages/img/docs/react-storage.md)
+instead of a committed catalog. Authorize preview access before returning a receipt's ThumbHash;
+the hash contains recognizable image data.
 An occupied path conflicts unless `--overwrite` is explicit; prefer `--hashed` for immutable
 filenames. Matching receipts skip repeat uploads; changed bytes get a new name.
 Storage receipts pin the returned `asset_id` and `version_id`. The image URL selects that exact

package/dist/alphalib/types/storageResults.d.ts

@@ -0,0 +1,29 @@
+import type { StoredAsset } from './storageAsset.ts';
+import { z } from 'zod';
+/** Server-owned Assembly identity and expected Workspace, never untrusted notification fields. */
+export declare const storedAssemblyResultsOptionsSchema: z.ZodObject<{
+    assemblyId: z.ZodString;
+    workspace: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    workspace: string;
+    assemblyId: string;
+}, {
+    workspace: string;
+    assemblyId: string;
+}>;
+export type GetStoredAssemblyResultsOptions = z.infer<typeof storedAssemblyResultsOptionsSchema>;
+/** Canonical retained receipt and producing result provenance, for idempotent registration. */
+export interface StoredAssemblyResult {
+    assembly_id: string;
+    step: string;
+    result_id: string;
+    original_id?: string | (string | null)[];
+    asset: StoredAsset;
+}
+/**
+ * Pure extraction from a fetched/verified Assembly bound to an authorized app upload. Validates
+ * every retained result atomically; temporary outputs are ignored, partial receipts are rejected.
+ * This does not authenticate notifications or check application permissions.
+ */
+export declare function extractStoredAssemblyResults(input: unknown, options: GetStoredAssemblyResultsOptions): StoredAssemblyResult[];
+//# sourceMappingURL=storageResults.d.ts.map

package/dist/alphalib/types/storageResults.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storageResults.d.ts","sourceRoot":"","sources":["../../../src/alphalib/types/storageResults.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAEpD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAOvB,kGAAkG;AAClG,eAAO,MAAM,kCAAkC;;;;;;;;;EAG7C,CAAA;AAEF,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAA;AAEhG,+FAA+F;AAC/F,MAAM,WAAW,oBAAoB;IACnC,WAAW,EAAE,MAAM,CAAA;IACnB,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAA;IACxC,KAAK,EAAE,WAAW,CAAA;CACnB;AAaD;;;;GAIG;AACH,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,+BAA+B,GACvC,oBAAoB,EAAE,CA6BxB"}

package/dist/alphalib/types/storageResults.js

@@ -0,0 +1,53 @@
+import { z } from 'zod';
+import { storedAssetSchema } from "./storageAsset.js";
+// SDK-owned extraction is outside alphalib-sync's explicit node-sdk syncIncludes. Co-location
+// reuses canonical schemas and their Types/Zod generation without adding a runtime package.
+/** Server-owned Assembly identity and expected Workspace, never untrusted notification fields. */
+export const storedAssemblyResultsOptionsSchema = z.object({
+    assemblyId: z.string().regex(/^[A-Za-z0-9_-]+$/),
+    workspace: z.string().min(1),
+});
+const resultSchema = storedAssetSchema.extend({
+    id: z.string().min(1),
+    original_id: z.union([z.string(), z.array(z.string().nullable())]).optional(),
+});
+const assemblySchema = z.object({
+    assembly_id: z.string(),
+    ok: z.string().nullable().optional(),
+    error: z.string().optional(),
+    results: z.record(z.array(z.record(z.unknown()))).optional(),
+});
+/**
+ * Pure extraction from a fetched/verified Assembly bound to an authorized app upload. Validates
+ * every retained result atomically; temporary outputs are ignored, partial receipts are rejected.
+ * This does not authenticate notifications or check application permissions.
+ */
+export function extractStoredAssemblyResults(input, options) {
+    const { assemblyId, workspace } = storedAssemblyResultsOptionsSchema.parse(options);
+    const assembly = assemblySchema.parse(input);
+    if (assembly.assembly_id !== assemblyId)
+        throw new Error('The response did not match the requested Assembly');
+    if (assembly.error !== undefined || assembly.ok !== 'ASSEMBLY_COMPLETED')
+        throw new Error(`The Storage Assembly is not complete (${assembly.error ?? assembly.ok})`);
+    if (assembly.results === undefined)
+        throw new Error('The completed Assembly did not contain results');
+    const results = [];
+    for (const [step, files] of Object.entries(assembly.results)) {
+        for (const file of files) {
+            if (file.asset_id === undefined &&
+                file.version_id === undefined &&
+                file.workspace === undefined)
+                continue;
+            const parsed = resultSchema.safeParse(file);
+            if (!parsed.success || parsed.data.workspace !== workspace) {
+                throw new Error('The Assembly returned an invalid or cross-Workspace Storage result', {
+                    cause: { assemblyId, step },
+                });
+            }
+            const { id, original_id, ...asset } = parsed.data;
+            results.push({ assembly_id: assemblyId, step, result_id: id, original_id, asset });
+        }
+    }
+    return results;
+}
+//# sourceMappingURL=storageResults.js.map

package/dist/alphalib/types/storageResults.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storageResults.js","sourceRoot":"","sources":["../../../src/alphalib/types/storageResults.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAErD,8FAA8F;AAC9F,4FAA4F;AAE5F,kGAAkG;AAClG,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,kBAAkB,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC7B,CAAC,CAAA;AAaF,MAAM,YAAY,GAAG,iBAAiB,CAAC,MAAM,CAAC;IAC5C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC9E,CAAC,CAAA;AACF,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACpC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC7D,CAAC,CAAA;AAEF;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAC1C,KAAc,EACd,OAAwC;IAExC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,kCAAkC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IACnF,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAC5C,IAAI,QAAQ,CAAC,WAAW,KAAK,UAAU;QACrC,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;IACtE,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,IAAI,QAAQ,CAAC,EAAE,KAAK,oBAAoB;QACtE,MAAM,IAAI,KAAK,CAAC,yCAAyC,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAA;IAC5F,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS;QAChC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;IACnE,MAAM,OAAO,GAA2B,EAAE,CAAA;IAC1C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IACE,IAAI,CAAC,QAAQ,KAAK,SAAS;gBAC3B,IAAI,CAAC,UAAU,KAAK,SAAS;gBAC7B,IAAI,CAAC,SAAS,KAAK,SAAS;gBAE5B,SAAQ;YACV,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;YAC3C,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC3D,MAAM,IAAI,KAAK,CAAC,oEAAoE,EAAE;oBACpF,KAAK,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;iBAC5B,CAAC,CAAA;YACJ,CAAC;YACD,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,GAAG,KAAK,EAAE,GAAG,MAAM,CAAC,IAAI,CAAA;YACjD,OAAO,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAA;QACpF,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/dist/storageResults.d.ts

@@ -1,4 +1,5 @@
 import type { StoredAsset } from './alphalib/types/storageAsset.ts';
+import type { GetStoredAssemblyResultsOptions, StoredAssemblyResult } from './alphalib/types/storageResults.ts';
 import type { Transloadit } from './Transloadit.ts';
 /** Original-byte delivery, not a preview or transcode; authorize the application's asset first. */
 export interface StoredAssetUrlOptions {
@@ -9,19 +10,7 @@ export interface StoredAssetUrlOptions {
 }
 /** Signs a retained original, including non-image media, without fetching or proxying its bytes. */
 export declare function getStoredAssetUrl(client: Transloadit, input: StoredAsset, options?: StoredAssetUrlOptions): string;
-/** Server-owned Assembly identity and expected Workspace, not values from an untrusted notification. */
-export interface GetStoredAssemblyResultsOptions {
-    assemblyId: string;
-    workspace: string;
-}
-/** A canonical stored asset with the producing result's provenance; one input can have many outputs. */
-export interface StoredAssemblyResult {
-    assembly_id: string;
-    step: string;
-    result_id: string;
-    original_id?: string | (string | null)[];
-    asset: StoredAsset;
-}
+export type { GetStoredAssemblyResultsOptions, StoredAssemblyResult, } from './alphalib/types/storageResults.ts';
 /**
  * Fetches a completed Assembly and verifies all retained results, including non-image media.
  * The caller must first bind the Assembly to an authorized application upload. Register results

package/dist/storageResults.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"storageResults.d.ts","sourceRoot":"","sources":["../src/storageResults.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAA;AACnE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AASnD,mGAAmG;AACnG,MAAM,WAAW,qBAAqB;IACpC,yFAAyF;IACzF,QAAQ,CAAC,EAAE,OAAO,GAAG,MAAM,CAAA;IAC3B,sFAAsF;IACtF,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,oGAAoG;AACpG,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,WAAW,EAClB,OAAO,GAAE,qBAA0B,GAClC,MAAM,CAuBR;AAED,wGAAwG;AACxG,MAAM,WAAW,+BAA+B;IAC9C,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,wGAAwG;AACxG,MAAM,WAAW,oBAAoB;IACnC,WAAW,EAAE,MAAM,CAAA;IACnB,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAA;IACxC,KAAK,EAAE,WAAW,CAAA;CACnB;AAWD;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE,+BAA+B,GACvC,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAsCjC"}
+{"version":3,"file":"storageResults.d.ts","sourceRoot":"","sources":["../src/storageResults.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAA;AACnE,OAAO,KAAK,EACV,+BAA+B,EAC/B,oBAAoB,EACrB,MAAM,oCAAoC,CAAA;AAC3C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAWnD,mGAAmG;AACnG,MAAM,WAAW,qBAAqB;IACpC,yFAAyF;IACzF,QAAQ,CAAC,EAAE,OAAO,GAAG,MAAM,CAAA;IAC3B,sFAAsF;IACtF,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,oGAAoG;AACpG,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,WAAW,EAClB,OAAO,GAAE,qBAA0B,GAClC,MAAM,CAuBR;AAED,YAAY,EACV,+BAA+B,EAC/B,oBAAoB,GACrB,MAAM,oCAAoC,CAAA;AAE3C;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE,+BAA+B,GACvC,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAcjC"}

package/dist/storageResults.js

@@ -1,7 +1,7 @@
-import { z } from 'zod';
 import { ApiError } from "./ApiError.js";
 import { robotFileServeInstructionsSchema } from "./alphalib/types/robots/file-serve.js";
 import { storedAssetSchema } from "./alphalib/types/storageAsset.js";
+import { extractStoredAssemblyResults, storedAssemblyResultsOptionsSchema, } from "./alphalib/types/storageResults.js";
 import InconsistentResponseError from "./InconsistentResponseError.js";
 /** Signs a retained original, including non-image media, without fetching or proxying its bytes. */
 export function getStoredAssetUrl(client, input, options = {}) {
@@ -28,52 +28,27 @@ export function getStoredAssetUrl(client, input, options = {}) {
         expiresAt,
     });
 }
-const requestSchema = z.object({
-    assemblyId: z.string().regex(/^[A-Za-z0-9_-]+$/),
-    workspace: z.string().min(1),
-});
-const resultSchema = storedAssetSchema.extend({
-    id: z.string().min(1),
-    original_id: z.union([z.string(), z.array(z.string().nullable())]).optional(),
-});
 /**
  * Fetches a completed Assembly and verifies all retained results, including non-image media.
  * The caller must first bind the Assembly to an authorized application upload. Register results
  * idempotently by Assembly/step/result ID (or asset/version), not by filename or notification count.
  */
 export async function getStoredAssemblyResults(client, options) {
-    const { assemblyId, workspace } = requestSchema.parse(options);
+    const { assemblyId, workspace } = storedAssemblyResultsOptionsSchema.parse(options);
     const assembly = await client.getAssembly(assemblyId);
     if (assembly.assembly_id !== assemblyId) {
         throw new InconsistentResponseError('The response did not match the requested Assembly');
     }
     if (typeof assembly.error === 'string')
         throw new ApiError({ body: assembly });
-    if (assembly.ok !== 'ASSEMBLY_COMPLETED') {
-        throw new InconsistentResponseError(`The Storage Assembly is not complete (${assembly.ok})`);
+    try {
+        return extractStoredAssemblyResults(assembly, { assemblyId, workspace });
     }
-    if (assembly.results === undefined) {
-        throw new InconsistentResponseError('The completed Assembly did not contain results');
+    catch (error) {
+        // Keep the Node SDK error contract while sharing strict extraction with Web runtimes.
+        if (!(error instanceof Error))
+            throw new Error('Invalid Assembly response', { cause: error });
+        throw new InconsistentResponseError(error.message, { cause: error.cause ?? error });
     }
-    const results = [];
-    for (const [step, files] of Object.entries(assembly.results)) {
-        for (const file of files) {
-            // Ordinary temporary/exported outputs are not Storage receipts. Partial Storage records
-            // must fail validation rather than disappearing from an otherwise successful batch.
-            if (file.asset_id === undefined &&
-                file.version_id === undefined &&
-                file.workspace === undefined)
-                continue;
-            const parsed = resultSchema.safeParse(file);
-            if (!parsed.success || parsed.data.workspace !== workspace) {
-                throw new InconsistentResponseError('The Assembly returned an invalid or cross-Workspace Storage result', {
-                    cause: { assemblyId, step },
-                });
-            }
-            const { id, original_id, ...asset } = parsed.data;
-            results.push({ assembly_id: assemblyId, step, result_id: id, original_id, asset });
-        }
-    }
-    return results;
 }
 //# sourceMappingURL=storageResults.js.map

package/dist/storageResults.js.map

@@ -1 +1 @@
-{"version":3,"file":"storageResults.js","sourceRoot":"","sources":["../src/storageResults.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,EAAE,gCAAgC,EAAE,MAAM,uCAAuC,CAAA;AACxF,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAA;AACpE,OAAO,yBAAyB,MAAM,gCAAgC,CAAA;AAUtE,oGAAoG;AACpG,MAAM,UAAU,iBAAiB,CAC/B,MAAmB,EACnB,KAAkB,EAClB,UAAiC,EAAE;IAEnC,MAAM,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAC5C,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,CAAC,GAAG,MAAM,CAAA;IACnD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,IAAI,IAAI,UAAU,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QACzF,MAAM,IAAI,UAAU,CAAC,0DAA0D,CAAC,CAAA;IAClF,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAA;IAC5F,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;QACjD,gCAAgC,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;QACpF,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC;YACnE,MAAM,IAAI,SAAS,CAAC,gDAAgD,CAAC,CAAA;IACzE,CAAC;IACD,yFAAyF;IACzF,4EAA4E;IAC5E,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAA;IAC/D,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,GAAG,UAAU,GAAG,UAAU,CAAA;IAC/E,OAAO,MAAM,CAAC,oBAAoB,CAAC;QACjC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,6BAA6B;QACvC,KAAK,EAAE,KAAK,CAAC,QAAQ;QACrB,SAAS,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;QACzF,SAAS;KACV,CAAC,CAAA;AACJ,CAAC;AAiBD,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,kBAAkB,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC7B,CAAC,CAAA;AACF,MAAM,YAAY,GAAG,iBAAiB,CAAC,MAAM,CAAC;IAC5C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC9E,CAAC,CAAA;AAEF;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAmB,EACnB,OAAwC;IAExC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAC9D,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,CAAA;IACrD,IAAI,QAAQ,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QACxC,MAAM,IAAI,yBAAyB,CAAC,mDAAmD,CAAC,CAAA;IAC1F,CAAC;IACD,IAAI,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC9E,IAAI,QAAQ,CAAC,EAAE,KAAK,oBAAoB,EAAE,CAAC;QACzC,MAAM,IAAI,yBAAyB,CAAC,yCAAyC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAA;IAC9F,CAAC;IACD,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,IAAI,yBAAyB,CAAC,gDAAgD,CAAC,CAAA;IACvF,CAAC;IACD,MAAM,OAAO,GAA2B,EAAE,CAAA;IAC1C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,wFAAwF;YACxF,oFAAoF;YACpF,IACE,IAAI,CAAC,QAAQ,KAAK,SAAS;gBAC3B,IAAI,CAAC,UAAU,KAAK,SAAS;gBAC7B,IAAI,CAAC,SAAS,KAAK,SAAS;gBAE5B,SAAQ;YACV,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;YAC3C,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC3D,MAAM,IAAI,yBAAyB,CACjC,oEAAoE,EACpE;oBACE,KAAK,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;iBAC5B,CACF,CAAA;YACH,CAAC;YACD,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,GAAG,KAAK,EAAE,GAAG,MAAM,CAAC,IAAI,CAAA;YACjD,OAAO,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAA;QACpF,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC"}
+{"version":3,"file":"storageResults.js","sourceRoot":"","sources":["../src/storageResults.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,EAAE,gCAAgC,EAAE,MAAM,uCAAuC,CAAA;AACxF,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAA;AACpE,OAAO,EACL,4BAA4B,EAC5B,kCAAkC,GACnC,MAAM,oCAAoC,CAAA;AAC3C,OAAO,yBAAyB,MAAM,gCAAgC,CAAA;AAUtE,oGAAoG;AACpG,MAAM,UAAU,iBAAiB,CAC/B,MAAmB,EACnB,KAAkB,EAClB,UAAiC,EAAE;IAEnC,MAAM,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAC5C,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,CAAC,GAAG,MAAM,CAAA;IACnD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,IAAI,IAAI,UAAU,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QACzF,MAAM,IAAI,UAAU,CAAC,0DAA0D,CAAC,CAAA;IAClF,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAA;IAC5F,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;QACjD,gCAAgC,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;QACpF,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC;YACnE,MAAM,IAAI,SAAS,CAAC,gDAAgD,CAAC,CAAA;IACzE,CAAC;IACD,yFAAyF;IACzF,4EAA4E;IAC5E,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAA;IAC/D,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,GAAG,UAAU,GAAG,UAAU,CAAA;IAC/E,OAAO,MAAM,CAAC,oBAAoB,CAAC;QACjC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,6BAA6B;QACvC,KAAK,EAAE,KAAK,CAAC,QAAQ;QACrB,SAAS,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;QACzF,SAAS;KACV,CAAC,CAAA;AACJ,CAAC;AAOD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAmB,EACnB,OAAwC;IAExC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,kCAAkC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IACnF,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,CAAA;IACrD,IAAI,QAAQ,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QACxC,MAAM,IAAI,yBAAyB,CAAC,mDAAmD,CAAC,CAAA;IAC1F,CAAC;IACD,IAAI,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC9E,IAAI,CAAC;QACH,OAAO,4BAA4B,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAA;IAC1E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,sFAAsF;QACtF,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;QAC7F,MAAM,IAAI,yBAAyB,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,KAAK,EAAE,CAAC,CAAA;IACrF,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "transloadit",
-  "version": "5.0.0",
+  "version": "5.0.1",
   "description": "Node.js SDK for Transloadit",
   "homepage": "https://github.com/transloadit/node-sdk/tree/main/packages/node",
   "bugs": {

package/src/alphalib/types/storageResults.ts

@@ -0,0 +1,75 @@
+import type { StoredAsset } from './storageAsset.ts'
+
+import { z } from 'zod'
+
+import { storedAssetSchema } from './storageAsset.ts'
+
+// SDK-owned extraction is outside alphalib-sync's explicit node-sdk syncIncludes. Co-location
+// reuses canonical schemas and their Types/Zod generation without adding a runtime package.
+
+/** Server-owned Assembly identity and expected Workspace, never untrusted notification fields. */
+export const storedAssemblyResultsOptionsSchema = z.object({
+  assemblyId: z.string().regex(/^[A-Za-z0-9_-]+$/),
+  workspace: z.string().min(1),
+})
+
+export type GetStoredAssemblyResultsOptions = z.infer<typeof storedAssemblyResultsOptionsSchema>
+
+/** Canonical retained receipt and producing result provenance, for idempotent registration. */
+export interface StoredAssemblyResult {
+  assembly_id: string
+  step: string
+  result_id: string
+  original_id?: string | (string | null)[]
+  asset: StoredAsset
+}
+
+const resultSchema = storedAssetSchema.extend({
+  id: z.string().min(1),
+  original_id: z.union([z.string(), z.array(z.string().nullable())]).optional(),
+})
+const assemblySchema = z.object({
+  assembly_id: z.string(),
+  ok: z.string().nullable().optional(),
+  error: z.string().optional(),
+  results: z.record(z.array(z.record(z.unknown()))).optional(),
+})
+
+/**
+ * Pure extraction from a fetched/verified Assembly bound to an authorized app upload. Validates
+ * every retained result atomically; temporary outputs are ignored, partial receipts are rejected.
+ * This does not authenticate notifications or check application permissions.
+ */
+export function extractStoredAssemblyResults(
+  input: unknown,
+  options: GetStoredAssemblyResultsOptions,
+): StoredAssemblyResult[] {
+  const { assemblyId, workspace } = storedAssemblyResultsOptionsSchema.parse(options)
+  const assembly = assemblySchema.parse(input)
+  if (assembly.assembly_id !== assemblyId)
+    throw new Error('The response did not match the requested Assembly')
+  if (assembly.error !== undefined || assembly.ok !== 'ASSEMBLY_COMPLETED')
+    throw new Error(`The Storage Assembly is not complete (${assembly.error ?? assembly.ok})`)
+  if (assembly.results === undefined)
+    throw new Error('The completed Assembly did not contain results')
+  const results: StoredAssemblyResult[] = []
+  for (const [step, files] of Object.entries(assembly.results)) {
+    for (const file of files) {
+      if (
+        file.asset_id === undefined &&
+        file.version_id === undefined &&
+        file.workspace === undefined
+      )
+        continue
+      const parsed = resultSchema.safeParse(file)
+      if (!parsed.success || parsed.data.workspace !== workspace) {
+        throw new Error('The Assembly returned an invalid or cross-Workspace Storage result', {
+          cause: { assemblyId, step },
+        })
+      }
+      const { id, original_id, ...asset } = parsed.data
+      results.push({ assembly_id: assemblyId, step, result_id: id, original_id, asset })
+    }
+  }
+  return results
+}

package/src/storageResults.ts

@@ -1,11 +1,17 @@
 import type { StoredAsset } from './alphalib/types/storageAsset.ts'
+import type {
+  GetStoredAssemblyResultsOptions,
+  StoredAssemblyResult,
+} from './alphalib/types/storageResults.ts'
 import type { Transloadit } from './Transloadit.ts'
 
-import { z } from 'zod'
-
 import { ApiError } from './ApiError.ts'
 import { robotFileServeInstructionsSchema } from './alphalib/types/robots/file-serve.ts'
 import { storedAssetSchema } from './alphalib/types/storageAsset.ts'
+import {
+  extractStoredAssemblyResults,
+  storedAssemblyResultsOptionsSchema,
+} from './alphalib/types/storageResults.ts'
 import InconsistentResponseError from './InconsistentResponseError.ts'
 
 /** Original-byte delivery, not a preview or transcode; authorize the application's asset first. */
@@ -46,29 +52,10 @@ export function getStoredAssetUrl(
   })
 }
 
-/** Server-owned Assembly identity and expected Workspace, not values from an untrusted notification. */
-export interface GetStoredAssemblyResultsOptions {
-  assemblyId: string
-  workspace: string
-}
-
-/** A canonical stored asset with the producing result's provenance; one input can have many outputs. */
-export interface StoredAssemblyResult {
-  assembly_id: string
-  step: string
-  result_id: string
-  original_id?: string | (string | null)[]
-  asset: StoredAsset
-}
-
-const requestSchema = z.object({
-  assemblyId: z.string().regex(/^[A-Za-z0-9_-]+$/),
-  workspace: z.string().min(1),
-})
-const resultSchema = storedAssetSchema.extend({
-  id: z.string().min(1),
-  original_id: z.union([z.string(), z.array(z.string().nullable())]).optional(),
-})
+export type {
+  GetStoredAssemblyResultsOptions,
+  StoredAssemblyResult,
+} from './alphalib/types/storageResults.ts'
 
 /**
  * Fetches a completed Assembly and verifies all retained results, including non-image media.
@@ -79,41 +66,17 @@ export async function getStoredAssemblyResults(
   client: Transloadit,
   options: GetStoredAssemblyResultsOptions,
 ): Promise<StoredAssemblyResult[]> {
-  const { assemblyId, workspace } = requestSchema.parse(options)
+  const { assemblyId, workspace } = storedAssemblyResultsOptionsSchema.parse(options)
   const assembly = await client.getAssembly(assemblyId)
   if (assembly.assembly_id !== assemblyId) {
     throw new InconsistentResponseError('The response did not match the requested Assembly')
   }
   if (typeof assembly.error === 'string') throw new ApiError({ body: assembly })
-  if (assembly.ok !== 'ASSEMBLY_COMPLETED') {
-    throw new InconsistentResponseError(`The Storage Assembly is not complete (${assembly.ok})`)
-  }
-  if (assembly.results === undefined) {
-    throw new InconsistentResponseError('The completed Assembly did not contain results')
-  }
-  const results: StoredAssemblyResult[] = []
-  for (const [step, files] of Object.entries(assembly.results)) {
-    for (const file of files) {
-      // Ordinary temporary/exported outputs are not Storage receipts. Partial Storage records
-      // must fail validation rather than disappearing from an otherwise successful batch.
-      if (
-        file.asset_id === undefined &&
-        file.version_id === undefined &&
-        file.workspace === undefined
-      )
-        continue
-      const parsed = resultSchema.safeParse(file)
-      if (!parsed.success || parsed.data.workspace !== workspace) {
-        throw new InconsistentResponseError(
-          'The Assembly returned an invalid or cross-Workspace Storage result',
-          {
-            cause: { assemblyId, step },
-          },
-        )
-      }
-      const { id, original_id, ...asset } = parsed.data
-      results.push({ assembly_id: assemblyId, step, result_id: id, original_id, asset })
-    }
+  try {
+    return extractStoredAssemblyResults(assembly, { assemblyId, workspace })
+  } catch (error) {
+    // Keep the Node SDK error contract while sharing strict extraction with Web runtimes.
+    if (!(error instanceof Error)) throw new Error('Invalid Assembly response', { cause: error })
+    throw new InconsistentResponseError(error.message, { cause: error.cause ?? error })
   }
-  return results
 }