Group stored originals and renditions in one query

[kvz]

Why

Consumers should not have to page raw Storage receipts, scan an Assembly's first 500 results, and
reimplement source-identity joins just to render a photo/video gallery. Renditions also should not
occupy gallery pages by themselves.

#44 is squashmerged as c6896ca8a18510b4035c22bb8a5246981385a157. This PR is now based on main; integration commit fe1d151bff5d8c950db1352b8d7bb89f12f9bcbd has the exact same source tree (5156f0beed8705ee71da5607eb47a64603132791) as the reviewed #45 head. The squash-history conflicts were resolved to that existing grouped-query implementation, without reintroducing #44's removed Assembly scan or auto-pagination.

Changes

• Add typed Transloadit.listStoredMedia: page originals and attach named, optional renditions by
  exact Assembly/source/upload/user/album/Workspace provenance. Missing or ambiguous roles stay absent.
• Use two indexes over existing receipt fields and convex-helpers' existing merged pagination.
  Preserve legacy original producers, deletion visibility, reactive ranges and required page splits.
• Bound producer/role fanout and page growth; preserve the existing asset APIs and ingestion format.
• Remove the wedding demo's bounded Assembly scan, join bookkeeping and automatic empty-page skipping.
  Live guest authorization, server-owned upload-prefix checks and Use private Storage for all wedding media #44's media-type check still
  apply to every returned original and rendition.
• Include generated component bindings, usage documentation and a minor Changeset.

Validation

• Fresh integrated yarn check: 269 tests, TypeScript and lint pass. An initial invocation during unresolved merge conflicts failed on conflict-marker syntax; after resolving and verifying exact tree equality, the complete check passed. yarn example:build passed. Official component
  codegen used an isolated loopback backend.
• Regression coverage: original-first one-item pages, >500 sibling receipts, cross-scope/multi-input
  joins, duplicates/tombstones, interleaved legacy originals, frozen-range inserts/deletes/splits,
  100/200 page/read caps, anonymous/expired/revoked access, out-of-prefix renditions and non-media
  originals (merged from Use private Storage for all wedding media #44).
• Local Opus security review found no authorization regression. Council on this change found no
  grouped-query blocker. After merging Use private Storage for all wedding media #44's grant renewal and media-type fixes, a council round
  on the integrated branch found no issues.
• The UI toy fixture passes at 1440/390 px with no console or network errors. This is not live
  Convex/CDN or iOS coverage; convex-test exercises the actual query and handler paths.
• CI on the integrated branch passes all nine checks. Its cloud QA covers this preview, which has
  uploads disabled; it is not live Storage/CDN playback.

Release complete — October 15

Squashmerged as d19cf6be92a3263bb828a8c8231ed7e192af71f4. Main CI and production-demo run 38741148602 passed, including the normal Convex/Vercel deployment and the unchanged real gallery test with E2E_EXPECT_STORAGE=1, uploads enabled, at 13:19:09Z. Current commit reached Vercel production in deployment 7093658949. This validates grouped media with real private originals/video/posters, Range/seek, original-byte hashes and anonymous/logout denial; it supersedes the earlier upload-disabled preview limitation for this deployed version.

The demo is deployed. npm publication is separate: the successful Changesets workflow opened #46 for @transloadit/convex@0.5.0; that PR remains unmerged. No API2 deploy, new Workspace enrollment, credentials, Template change, R2 migration or retention change was performed.

Execution — October 15

#44's main/demo run 38740447868 passed real production Storage acceptance at 13:13:43Z. This PR's integrated CI run 38740787826 also passed. The reviewed source tree is unchanged, and its separate squashmerge and automatic demo deployment completed under the existing authorization.

Kevin reconfirmed execution of the previously authorized ordered #44 → #45 squashmerges, including the existing automatic demo deployments. API2 production, Workspace changes, new credentials and retention changes remain outside this task. Update this PR and the single living API2 plan with actual merge/deployment outcomes.

Documentation consolidation, October 15: the two branch-local notes are removed in favor of the living DAM plan in API2 (API2 #9915). Local yarn check passes on this docs-only update (269 tests, types and lint). Product changes, release gates and draft status are unchanged; no new product merge or deployment in this documentation task.

_{🤖 Claimed by kvz on studio1/convex since 2026-10-15 · resume: codex resume 019fa2ee-f994-79d0-9d50-071bf2cb7ad6}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
convex	Ready	Preview	Oct 15, 2026 1:13pm UTC