feat(cli): mint bearer tokens (#330)

* feat(cli): mint bearer tokens

* chore: update transloadit parity baseline

* fix(cli): harden auth token

* fix: keep transloadit parity + knip happy

* refactor(cli): harden auth token + dedupe creds

Author: kvz

.changeset/auth-token-cli.md

@@ -0,0 +1,6 @@
+---
+'@transloadit/node': patch
+'transloadit': patch
+---
+
+feat(cli): add `transloadit auth token` to mint bearer tokens for hosted MCP (with HTTPS/redirect safety guards)

docs/fingerprint/transloadit-baseline.json

@@ -1,13 +1,13 @@
 {
   "packageDir": "/home/kvz/code/node-sdk/packages/transloadit",
   "tarball": {
-    "filename": "transloadit-4.7.1.tgz",
-    "sizeBytes": 1239686,
-    "sha256": "e0e4926af34a37737feb90f3536be69f1111e38e4525b056e2c72ec4456d0a6b"
+    "filename": "transloadit-4.7.2.tgz",
+    "sizeBytes": 1244695,
+    "sha256": "42d5f0f20b27a3c3a761b43f68b61b4acf5b0c800f723928803f3949246ebfe9"
   },
   "packageJson": {
     "name": "transloadit",
-    "version": "4.7.1",
+    "version": "4.7.2",
     "main": "./dist/Transloadit.js",
     "exports": {
       ".": "./dist/Transloadit.js",
@@ -128,8 +128,8 @@
     },
     {
       "path": "dist/cli/commands/auth.js",
-      "sizeBytes": 10190,
-      "sha256": "882912a557268b70fba276804fecab686e259bb78c167c175c3e1e67cceea3b6"
+      "sizeBytes": 15785,
+      "sha256": "3fcef85fa789d41e4620eec82555eb94ca52ae70367d519272103fd6019a7661"
     },
     {
       "path": "dist/alphalib/types/robots/azure-import.js",
@@ -153,8 +153,8 @@
     },
     {
       "path": "dist/cli/commands/BaseCommand.js",
-      "sizeBytes": 1895,
-      "sha256": "1141a59a8ec2f47f6e5d4257b81e44fad8f50d693d1d22d6a0d6a2a08b5f8792"
+      "sizeBytes": 1883,
+      "sha256": "af4d62f394df456f5137627e8c4f241344fbe7c7796e427bc6ec493de5984762"
     },
     {
       "path": "dist/alphalib/types/bill.js",
@@ -328,8 +328,8 @@
     },
     {
       "path": "dist/cli/helpers.js",
-      "sizeBytes": 2277,
-      "sha256": "f503e1fa45e284955f3e10316ceebe417de30abba13d9cde3e5047be89b77bcc"
+      "sizeBytes": 2625,
+      "sha256": "8555420c31526195f54151c481bd00d2a1fcf67dacbad3f988a4c6538fa67f21"
     },
     {
       "path": "dist/alphalib/types/robots/html-convert.js",
@@ -388,8 +388,8 @@
     },
     {
       "path": "dist/cli/commands/index.js",
-      "sizeBytes": 2099,
-      "sha256": "26ffd3f1d1bf5f9e6ea350cebcb6593fa748bcbc814ee60dcfc7313a97fe54f0"
+      "sizeBytes": 2145,
+      "sha256": "b44764be9d6a803669bbc1a937f553566ce91993ed283c7f6d5ef65cbff6b263"
     },
     {
       "path": "dist/inputFiles.js",
@@ -684,7 +684,7 @@
     {
       "path": "package.json",
       "sizeBytes": 2730,
-      "sha256": "061fbd4b1e3fbbc7ded678f2d27b9ac3e0dbcc903b5e70c31c61166a6a24764e"
+      "sha256": "818a4a0e1e9d5020e29d5cafcbc584a380fbb264508518835bab2e017f5fd101"
     },
     {
       "path": "dist/alphalib/types/robots/_index.d.ts.map",
@@ -898,13 +898,13 @@
     },
     {
       "path": "dist/cli/commands/auth.d.ts.map",
-      "sizeBytes": 749,
-      "sha256": "f31c0a86129f7fa44aed415e85e46a04935801f03140c8d73c57897d2ee609f7"
+      "sizeBytes": 996,
+      "sha256": "478ac46eb7ddbe624235a21c0a0a059cdefa91381281198ad51f7bd21c8f1b09"
     },
     {
       "path": "dist/cli/commands/auth.js.map",
-      "sizeBytes": 9151,
-      "sha256": "92fb82422a8e746658deb008d95d656a2cb87e86a761ff5dc0776cbda96c7cca"
+      "sizeBytes": 14501,
+      "sha256": "891418720d6f855eea37a07ca197c55a9d8d010c905f6c7bdda9ee7f4f9d6332"
     },
     {
       "path": "dist/alphalib/types/robots/azure-import.d.ts.map",
@@ -948,13 +948,13 @@
     },
     {
       "path": "dist/cli/commands/BaseCommand.d.ts.map",
-      "sizeBytes": 853,
-      "sha256": "22f956bf0d909d109be49926c456031c783bafccc688056d1911b7440cdf77c3"
+      "sizeBytes": 854,
+      "sha256": "7795327eb88bff243fbadaa473286c7d6c4bb24e4d0b11d7d7ff314dc9460112"
     },
     {
       "path": "dist/cli/commands/BaseCommand.js.map",
-      "sizeBytes": 1740,
-      "sha256": "14ec91bb62f94bc02328d085cf1d6b7541f3e17d10703c39f85df40969cd84eb"
+      "sizeBytes": 1771,
+      "sha256": "ea85d352f6620d0688afa1bb3c82f2c9c09b3bec6c06bfcc29d6d9f14f12578a"
     },
     {
       "path": "dist/alphalib/types/bill.d.ts.map",
@@ -1298,13 +1298,13 @@
     },
     {
       "path": "dist/cli/helpers.d.ts.map",
-      "sizeBytes": 1009,
-      "sha256": "82e3c44365f968ff76a7424812b2e21fc82a69205c50611242c9fb97990e90f3"
+      "sizeBytes": 1177,
+      "sha256": "0f65f407f35fe35bc23481feaf7146d051d3946557ae80008228844d563e41d5"
     },
     {
       "path": "dist/cli/helpers.js.map",
-      "sizeBytes": 2826,
-      "sha256": "6729657286fe0467eab3544fda8f702a9e06a9da8cbedf0083276608ff805c52"
+      "sizeBytes": 3067,
+      "sha256": "d644704a139a2ac26a8c7a2ba27b7eee939aecd8506d437ed616cc764eabe8c2"
     },
     {
       "path": "dist/alphalib/types/robots/html-convert.d.ts.map",
@@ -1419,12 +1419,12 @@
     {
       "path": "dist/cli/commands/index.d.ts.map",
       "sizeBytes": 198,
-      "sha256": "7f72c6762c95dac3b7e6cd256abab44c210c471e40a0558ad20020cf15fdd983"
+      "sha256": "3f955192e7d7832d6fd0c8ee0244b153e42c947686425750c7c8c58d6657f2a7"
     },
     {
       "path": "dist/cli/commands/index.js.map",
-      "sizeBytes": 1889,
-      "sha256": "47f1867c39793eebbafb7229433aff4b573e408690ffdeb11457533a71dd54aa"
+      "sizeBytes": 1940,
+      "sha256": "1cad8333ee5fd6c34071a6d8528a7b55399be0626baf1754e28453d714836868"
     },
     {
       "path": "dist/inputFiles.d.ts.map",
@@ -2008,8 +2008,8 @@
     },
     {
       "path": "README.md",
-      "sizeBytes": 35551,
-      "sha256": "442743aa79f063ee5da4e50601debb28b492377b3359aa4c2596f4adefbd372a"
+      "sizeBytes": 35827,
+      "sha256": "4eeaaee318cb9336246280c4f3247c27de0df83d6738863123f5c9eac9429908"
     },
     {
       "path": "dist/alphalib/types/robots/_index.d.ts",
@@ -2223,13 +2223,13 @@
     },
     {
       "path": "dist/cli/commands/auth.d.ts",
-      "sizeBytes": 936,
-      "sha256": "20a1d35fb55fad8af33fb6decede3cbf2cd621007fe443d2866e9975bbe23b20"
+      "sizeBytes": 1406,
+      "sha256": "885d57814cc0ac4f6554576811748beee3902a8ef63b70746a76c22aff2b0acc"
     },
     {
       "path": "src/cli/commands/auth.ts",
-      "sizeBytes": 10626,
-      "sha256": "b5f4d2404f455ad2e3354cd963a3468bb2d57a1808ce715f715cea1ad87b2245"
+      "sizeBytes": 16193,
+      "sha256": "42ebd9ee94e5a21001f456c47d9f722f73df6b7b06f5ce82fab857e93b77f70c"
     },
     {
       "path": "dist/alphalib/types/robots/azure-import.d.ts",
@@ -2278,8 +2278,8 @@
     },
     {
       "path": "src/cli/commands/BaseCommand.ts",
-      "sizeBytes": 2146,
-      "sha256": "d0cab4ebb72ce5d555be82bf3de4ba1f09dd223b71702bc53527928cf1c7ac91"
+      "sizeBytes": 2101,
+      "sha256": "8716f8a22898d35c025986a31a9234b43a8eaed09f7120b8f6424ff8d045fd50"
     },
     {
       "path": "dist/alphalib/types/bill.d.ts",
@@ -2623,13 +2623,13 @@
     },
     {
       "path": "dist/cli/helpers.d.ts",
-      "sizeBytes": 898,
-      "sha256": "d225c538d7cd4d73e88045729fc6f59b66de8af9304b039cdd496e1487860eb6"
+      "sizeBytes": 1073,
+      "sha256": "aeed9d1c1186c561cd846c905bac2d9738e88c80e5527c125f47ad6b332d10ee"
     },
     {
       "path": "src/cli/helpers.ts",
-      "sizeBytes": 2799,
-      "sha256": "0d43593eb6e5d985287d67fec8e758d8fcc903fd1ce86cc2a9b8152b66998059"
+      "sizeBytes": 3340,
+      "sha256": "9741aa20b83f837889d248d5b095e6ec2336186bc5ab2b6caa23174950562919"
     },
     {
       "path": "dist/alphalib/types/robots/html-convert.d.ts",
@@ -2748,8 +2748,8 @@
     },
     {
       "path": "src/cli/commands/index.ts",
-      "sizeBytes": 2001,
-      "sha256": "762f6b157cbb43839b496850ec5918c4e0efb94e88be3c45e06171e3771a7e8f"
+      "sizeBytes": 2044,
+      "sha256": "b6752fa800c6a91e662b75a0c0973f0ba513f263d4a96d5e46a0d3e1f1a9f828"
     },
     {
       "path": "dist/inputFiles.d.ts",

docs/fingerprint/transloadit-baseline.package.json

@@ -1,6 +1,6 @@
 {
   "name": "transloadit",
-  "version": "4.7.1",
+  "version": "4.7.2",
   "description": "Node.js SDK for Transloadit",
   "homepage": "https://github.com/transloadit/node-sdk/tree/main/packages/node",
   "bugs": {

packages/node/README.md

@@ -57,6 +57,16 @@ export TRANSLOADIT_SECRET="YOUR_TRANSLOADIT_SECRET"
 npx transloadit --help
 ```
 
+### Minting Bearer Tokens (Hosted MCP)
+
+If you want to connect an agent to the Transloadit-hosted MCP endpoint, mint a short-lived bearer
+token via `POST /token`:
+
+```bash
+# Prints JSON to stdout (stderr may include npx/npm noise)
+npx -y transloadit auth token --aud mcp
+```
+
 ### Processing Media
 
 Create Assemblies to process files using Assembly Instructions (steps) or Templates:

packages/node/src/cli/commands/BaseCommand.ts

@@ -2,7 +2,7 @@ import 'dotenv/config'
 import process from 'node:process'
 import { Command, Option } from 'clipanion'
 import { Transloadit as TransloaditClient } from '../../Transloadit.ts'
-import { getEnvCredentials } from '../helpers.ts'
+import { requireEnvCredentials } from '../helpers.ts'
 import type { IOutputCtl } from '../OutputCtl.ts'
 import OutputCtl, { LOG_LEVEL_DEFAULT, LOG_LEVEL_NAMES, parseLogLevel } from '../OutputCtl.ts'
 
@@ -32,17 +32,18 @@ abstract class BaseCommand extends Command {
   }
 
   protected setupClient(): boolean {
-    const creds = getEnvCredentials()
-    if (!creds) {
-      this.output.error(
-        'Please provide API authentication in the environment variables TRANSLOADIT_KEY and TRANSLOADIT_SECRET',
-      )
+    const credsResult = requireEnvCredentials()
+    if (!credsResult.ok) {
+      this.output.error(credsResult.error)
       return false
     }
 
     const endpoint = this.endpoint || process.env.TRANSLOADIT_ENDPOINT
 
-    this.client = new TransloaditClient({ ...creds, ...(endpoint && { endpoint }) })
+    this.client = new TransloaditClient({
+      ...credsResult.credentials,
+      ...(endpoint && { endpoint }),
+    })
     return true
   }