@cedarjs/uploads 7.0.0-canary.3114

package/dist/providers/db.d.ts

@@ -0,0 +1,9 @@
+import type { StorageProvider } from '../types.js';
+/**
+ * Marks a target whose bytes live inline in the `Upload.data` column. The
+ * provider itself owns no storage: `storeFile()` writes the row and the
+ * `@withSignedUrl` / `@withDataUri` directives read it back as a `data:` URI.
+ * Every method that would need external storage throws.
+ */
+export declare function createDbProvider(): StorageProvider;
+//# sourceMappingURL=db.d.ts.map

package/dist/providers/db.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/providers/db.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAElD;;;;;GAKG;AACH,wBAAgB,gBAAgB,IAAI,eAAe,CAoDlD"}

package/dist/providers/db.js

@@ -0,0 +1,41 @@
+import { UploadError } from "../errors.js";
+function createDbProvider() {
+  const notSupported = (operation) => new UploadError(
+    "NOT_SUPPORTED",
+    `The DB storage target '${provider.name}' keeps bytes inline in the Upload row, so \`${operation}\` is not available. Use storeFile() to write and the Upload row itself to read.`
+  );
+  const provider = {
+    name: "",
+    providerType: "db",
+    async write() {
+      throw notSupported("write");
+    },
+    async read() {
+      throw notSupported("read");
+    },
+    async delete() {
+    },
+    async exists() {
+      return false;
+    },
+    async getObjectSize() {
+      return null;
+    },
+    async getSignedReadUrl() {
+      throw notSupported("getSignedReadUrl");
+    },
+    async getPresignedUploadUrl() {
+      throw new UploadError(
+        "PRESIGN_NOT_SUPPORTED",
+        `The DB storage target '${provider.name}' does not support presigned uploads. Send the file as base64 through GraphQL and call storeFile() in the service.`
+      );
+    },
+    getConfig() {
+      return {};
+    }
+  };
+  return provider;
+}
+export {
+  createDbProvider
+};

package/dist/providers/fs.d.ts

@@ -0,0 +1,34 @@
+import type { StorageProvider } from '../types.js';
+export interface FsProviderOptions {
+    /** Directory files are written to. Created on first write. */
+    uploadDir: string;
+    /**
+     * Origin (and optional path) the api server is reachable at, for example
+     * `https://api.example.com`. Required for `getSignedReadUrl()`. Signed
+     * URLs carry a bearer token, so the origin must use `https:` unless it
+     * is a loopback address used in development.
+     */
+    serveBaseUrl?: string;
+    /**
+     * Secret that signs serve URLs. Use the same value the upload plugin is
+     * given as `tokenSecret`, because the serve route verifies with that.
+     */
+    signSecret?: string;
+    /**
+     * Prefix the upload plugin is registered under. Defaults to `/upload`.
+     */
+    routePrefix?: string;
+}
+/**
+ * Validates the origin signed URLs are built on. Plain `http:` is only
+ * accepted for loopback hosts, so a bearer token never travels in clear
+ * text to a real network address.
+ */
+export declare function assertServeBaseUrl(serveBaseUrl: string, targetName: string): void;
+/**
+ * Stores files on the local filesystem. Uploads reach it through the upload
+ * plugin's `POST {prefix}/fs` route and are served by
+ * `GET {prefix}/serve?token=...`.
+ */
+export declare function createFsProvider(opts: FsProviderOptions): StorageProvider;
+//# sourceMappingURL=fs.d.ts.map

package/dist/providers/fs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs.d.ts","sourceRoot":"","sources":["../../src/providers/fs.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAElD,MAAM,WAAW,iBAAiB;IAChC,8DAA8D;IAC9D,SAAS,EAAE,MAAM,CAAA;IACjB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAaD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,QA0B1E;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,GAAG,eAAe,CAgHzE"}

package/dist/providers/fs.js

@@ -0,0 +1,125 @@
+import { createReadStream } from "node:fs";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { UploadError } from "../errors.js";
+import { assertSafeKey, trimTrailingSlashes } from "../keys.js";
+import {
+  createServeToken,
+  DEFAULT_SERVE_URL_EXPIRES_IN,
+  SERVE_ROUTE_PATH,
+  SERVE_TOKEN_PARAM
+} from "../serveToken.js";
+const LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]", "::1"]);
+function isNotFound(e) {
+  return typeof e === "object" && e !== null && "code" in e && (e.code === "ENOENT" || e.code === "ENOTDIR");
+}
+function assertServeBaseUrl(serveBaseUrl, targetName) {
+  let parsed;
+  try {
+    parsed = new URL(serveBaseUrl);
+  } catch {
+    throw new UploadError(
+      "CONFIGURATION",
+      `The FS storage target '${targetName}' has an invalid serveBaseUrl: '${serveBaseUrl}'.`
+    );
+  }
+  const secure = parsed.protocol === "https:" || parsed.protocol === "http:" && LOOPBACK_HOSTS.has(parsed.hostname.toLowerCase());
+  if (!secure) {
+    throw new UploadError(
+      "CONFIGURATION",
+      `The FS storage target '${targetName}' has serveBaseUrl '${serveBaseUrl}'. Signed URLs carry a bearer token, so the origin must use https, or http on localhost for development.`
+    );
+  }
+}
+function createFsProvider(opts) {
+  const { uploadDir, serveBaseUrl, signSecret, routePrefix = "/upload" } = opts;
+  const filePath = (key) => {
+    assertSafeKey(key);
+    return path.join(uploadDir, key);
+  };
+  const provider = {
+    name: "",
+    providerType: "fs",
+    async write(key, data) {
+      const target = filePath(key);
+      await fs.mkdir(uploadDir, { recursive: true });
+      await fs.writeFile(target, data);
+    },
+    async read(key) {
+      return fs.readFile(filePath(key));
+    },
+    async readStream(key) {
+      const target = filePath(key);
+      await fs.access(target);
+      return createReadStream(target);
+    },
+    async delete(key) {
+      try {
+        await fs.unlink(filePath(key));
+      } catch (e) {
+        if (!isNotFound(e)) {
+          throw e;
+        }
+      }
+    },
+    async exists(key) {
+      try {
+        await fs.access(filePath(key));
+        return true;
+      } catch (e) {
+        if (isNotFound(e)) {
+          return false;
+        }
+        throw e;
+      }
+    },
+    async getObjectSize(key) {
+      try {
+        const stat = await fs.stat(filePath(key));
+        return stat.size;
+      } catch (e) {
+        if (isNotFound(e)) {
+          return null;
+        }
+        throw e;
+      }
+    },
+    async getSignedReadUrl(key, options = {}) {
+      assertSafeKey(key);
+      if (!signSecret || !serveBaseUrl) {
+        throw new UploadError(
+          "CONFIGURATION",
+          `The FS storage target '${provider.name}' needs both \`serveBaseUrl\` and \`signSecret\` to generate signed read URLs.`
+        );
+      }
+      assertServeBaseUrl(serveBaseUrl, provider.name);
+      const {
+        expiresIn = DEFAULT_SERVE_URL_EXPIRES_IN,
+        disposition = "attachment"
+      } = options;
+      const token = createServeToken({
+        payload: { target: provider.name, key, disposition },
+        secret: signSecret,
+        expiresIn
+      });
+      const base = trimTrailingSlashes(serveBaseUrl);
+      const prefix = trimTrailingSlashes(routePrefix);
+      const params = new URLSearchParams({ [SERVE_TOKEN_PARAM]: token });
+      return `${base}${prefix}${SERVE_ROUTE_PATH}?${params}`;
+    },
+    async getPresignedUploadUrl() {
+      throw new UploadError(
+        "PRESIGN_NOT_SUPPORTED",
+        `The FS storage target '${provider.name}' does not support presigned uploads. Upload through the \`POST {prefix}/fs\` route.`
+      );
+    },
+    getConfig() {
+      return { uploadDir };
+    }
+  };
+  return provider;
+}
+export {
+  assertServeBaseUrl,
+  createFsProvider
+};

package/dist/providers/s3.d.ts

@@ -0,0 +1,25 @@
+import type { S3Client } from '@aws-sdk/client-s3';
+import type { StorageProvider } from '../types.js';
+export interface S3ProviderOptions {
+    /** The app's own S3 client. It stays available for provider-specific work. */
+    client: S3Client;
+    bucket: string;
+    /**
+     * Region of the bucket, reported by `getConfig()` for third-party
+     * integrations. The client's own region setting is used for requests.
+     */
+    region?: string;
+    /** Prepended to every key, for example `avatars/`. */
+    keyPrefix?: string;
+    /** Lifetime of presigned upload URLs, in seconds. Defaults to 300. */
+    uploadUrlExpiresIn?: number;
+    /** Lifetime of signed read URLs, in seconds. Defaults to 3600. */
+    readUrlExpiresIn?: number;
+}
+/**
+ * Stores files in an S3 bucket (or any S3-compatible service) with the AWS
+ * SDK. Import it from `@cedarjs/uploads/s3`; the SDK packages are optional
+ * peer dependencies.
+ */
+export declare function createS3Provider(opts: S3ProviderOptions): StorageProvider;
+//# sourceMappingURL=s3.d.ts.map

package/dist/providers/s3.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"s3.d.ts","sourceRoot":"","sources":["../../src/providers/s3.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAGlD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAElD,MAAM,WAAW,iBAAiB;IAChC,8EAA8E;IAC9E,MAAM,EAAE,QAAQ,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,sDAAsD;IACtD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,sEAAsE;IACtE,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,kEAAkE;IAClE,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAmBD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,GAAG,eAAe,CAwHzE"}

package/dist/providers/s3.js

@@ -0,0 +1,117 @@
+import {
+  DeleteObjectCommand,
+  GetObjectCommand,
+  HeadObjectCommand,
+  PutObjectCommand
+} from "@aws-sdk/client-s3";
+import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
+function isNotFound(e) {
+  if (typeof e !== "object" || e === null) {
+    return false;
+  }
+  const name = "name" in e ? e.name : void 0;
+  const status = "$metadata" in e && typeof e.$metadata === "object" && e.$metadata !== null && "httpStatusCode" in e.$metadata ? e.$metadata.httpStatusCode : void 0;
+  return name === "NotFound" || name === "NoSuchKey" || status === 404;
+}
+function createS3Provider(opts) {
+  const {
+    client,
+    bucket,
+    region,
+    keyPrefix = "",
+    uploadUrlExpiresIn = 300,
+    readUrlExpiresIn = 3600
+  } = opts;
+  const fullKey = (key) => `${keyPrefix}${key}`;
+  const provider = {
+    name: "",
+    providerType: "s3",
+    async write(key, data, { contentType }) {
+      await client.send(
+        new PutObjectCommand({
+          Bucket: bucket,
+          Key: fullKey(key),
+          Body: data,
+          ContentType: contentType
+        })
+      );
+    },
+    async read(key) {
+      const res = await client.send(
+        new GetObjectCommand({ Bucket: bucket, Key: fullKey(key) })
+      );
+      if (!res.Body) {
+        return Buffer.alloc(0);
+      }
+      return Buffer.from(await res.Body.transformToByteArray());
+    },
+    async readStream(key) {
+      const res = await client.send(
+        new GetObjectCommand({ Bucket: bucket, Key: fullKey(key) })
+      );
+      return res.Body;
+    },
+    async delete(key) {
+      await client.send(
+        new DeleteObjectCommand({ Bucket: bucket, Key: fullKey(key) })
+      );
+    },
+    async exists(key) {
+      return await provider.getObjectSize(key) !== null;
+    },
+    async getObjectSize(key) {
+      try {
+        const res = await client.send(
+          new HeadObjectCommand({ Bucket: bucket, Key: fullKey(key) })
+        );
+        return typeof res.ContentLength === "number" ? res.ContentLength : null;
+      } catch (e) {
+        if (isNotFound(e)) {
+          return null;
+        }
+        throw e;
+      }
+    },
+    async getSignedReadUrl(key, options = {}) {
+      const { expiresIn = readUrlExpiresIn, disposition = "attachment" } = options;
+      return getSignedUrl(
+        client,
+        new GetObjectCommand({
+          Bucket: bucket,
+          Key: fullKey(key),
+          // The stored MIME type is client-asserted, so inline is opt-in
+          ResponseContentDisposition: disposition
+        }),
+        { expiresIn }
+      );
+    },
+    async getPresignedUploadUrl(key, { contentType, expiresIn }) {
+      const url = await getSignedUrl(
+        client,
+        new PutObjectCommand({
+          Bucket: bucket,
+          Key: fullKey(key),
+          ContentType: contentType
+        }),
+        {
+          expiresIn: expiresIn ?? uploadUrlExpiresIn,
+          // Sign the content type as a header so the upload must send the
+          // exact type the URL was issued for
+          signableHeaders: /* @__PURE__ */ new Set(["content-type"])
+        }
+      );
+      return {
+        url,
+        method: "PUT",
+        headers: { "Content-Type": contentType }
+      };
+    },
+    getConfig() {
+      return { bucket, region, keyPrefix };
+    }
+  };
+  return provider;
+}
+export {
+  createS3Provider
+};

package/dist/s3.d.ts

@@ -0,0 +1,3 @@
+export { createS3Provider } from './providers/s3.js';
+export type { S3ProviderOptions } from './providers/s3.js';
+//# sourceMappingURL=s3.d.ts.map

package/dist/s3.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"s3.d.ts","sourceRoot":"","sources":["../src/s3.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AACpD,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA"}

package/dist/s3.js

@@ -0,0 +1,4 @@
+import { createS3Provider } from "./providers/s3.js";
+export {
+  createS3Provider
+};

package/dist/serialize.d.ts

@@ -0,0 +1,10 @@
+import type { SerializedUpload, UploadRecord } from './types.js';
+/** Builds a `data:` URI from a MIME type and raw bytes. */
+export declare function toDataUri(mimeType: string, data: Uint8Array): string;
+/**
+ * Converts an `Upload` row into plain JSON: `size` becomes a string (it is a
+ * `BigInt`), dates become ISO strings, and the inline `data` and `tokenId`
+ * columns are left out.
+ */
+export declare function serializeUpload(upload: UploadRecord): SerializedUpload;
+//# sourceMappingURL=serialize.d.ts.map

package/dist/serialize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serialize.d.ts","sourceRoot":"","sources":["../src/serialize.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAEhE,2DAA2D;AAC3D,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,MAAM,CAEpE;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,gBAAgB,CActE"}

package/dist/serialize.js

@@ -0,0 +1,22 @@
+function toDataUri(mimeType, data) {
+  return `data:${mimeType};base64,${Buffer.from(data).toString("base64")}`;
+}
+function serializeUpload(upload) {
+  return {
+    id: upload.id,
+    target: upload.target,
+    status: upload.status,
+    filename: upload.filename,
+    mimeType: upload.mimeType,
+    size: upload.size.toString(),
+    storageKey: upload.storageKey,
+    userId: upload.userId,
+    organizationId: upload.organizationId,
+    createdAt: upload.createdAt.toISOString(),
+    updatedAt: upload.updatedAt.toISOString()
+  };
+}
+export {
+  serializeUpload,
+  toDataUri
+};

package/dist/serveToken.d.ts

@@ -0,0 +1,36 @@
+import type { ContentDisposition } from './types.js';
+/** Purpose claim for the signed URLs the FS serve route accepts. */
+export declare const SERVE_TOKEN_PURPOSE = "cedar-upload-serve";
+/** Default lifetime of a signed serve URL, in seconds. */
+export declare const DEFAULT_SERVE_URL_EXPIRES_IN = 3600;
+/** Route (relative to the plugin prefix) that serves files by token. */
+export declare const SERVE_ROUTE_PATH = "/serve";
+/**
+ * Query parameter the serve route reads the token from. The token is a JWT,
+ * which is longer than Fastify's default limit for path parameters.
+ */
+export declare const SERVE_TOKEN_PARAM = "token";
+export interface ServeTokenPayload {
+    target: string;
+    key: string;
+    disposition: ContentDisposition;
+}
+/**
+ * Signs a serve token. The disposition is part of the signed payload, so
+ * inline rendering is granted by whoever signs the URL, never by whoever
+ * requests it.
+ */
+export declare function createServeToken({ payload, secret, expiresIn, }: {
+    payload: ServeTokenPayload;
+    secret: string;
+    /** Seconds. */
+    expiresIn?: number;
+}): string;
+/**
+ * Verifies a serve token. Every failure is reported as `NOT_FOUND` so the
+ * serve route does not distinguish an expired link from a forged one.
+ */
+export declare function verifyServeToken(token: string | null | undefined, { secret }: {
+    secret: string;
+}): ServeTokenPayload;
+//# sourceMappingURL=serveToken.d.ts.map

package/dist/serveToken.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serveToken.d.ts","sourceRoot":"","sources":["../src/serveToken.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAEpD,oEAAoE;AACpE,eAAO,MAAM,mBAAmB,uBAAuB,CAAA;AAEvD,0DAA0D;AAC1D,eAAO,MAAM,4BAA4B,OAAO,CAAA;AAEhD,wEAAwE;AACxE,eAAO,MAAM,gBAAgB,WAAW,CAAA;AAExC;;;GAGG;AACH,eAAO,MAAM,iBAAiB,UAAU,CAAA;AAExC,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAA;IACd,GAAG,EAAE,MAAM,CAAA;IACX,WAAW,EAAE,kBAAkB,CAAA;CAChC;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,EAC/B,OAAO,EACP,MAAM,EACN,SAAwC,GACzC,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,eAAe;IACf,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,GAAG,MAAM,CAOT;AAgBD;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,EAAE,MAAM,EAAE,EAAE;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAC7B,iBAAiB,CAcnB"}

package/dist/serveToken.js

@@ -0,0 +1,45 @@
+import { createSignedToken, verifySignedToken } from "@cedarjs/api";
+import { UploadError } from "./errors.js";
+const SERVE_TOKEN_PURPOSE = "cedar-upload-serve";
+const DEFAULT_SERVE_URL_EXPIRES_IN = 3600;
+const SERVE_ROUTE_PATH = "/serve";
+const SERVE_TOKEN_PARAM = "token";
+function createServeToken({
+  payload,
+  secret,
+  expiresIn = DEFAULT_SERVE_URL_EXPIRES_IN
+}) {
+  return createSignedToken({
+    payload,
+    purpose: SERVE_TOKEN_PURPOSE,
+    expiresIn,
+    secret
+  });
+}
+function isServeTokenPayload(value) {
+  if (typeof value !== "object" || value === null) {
+    return false;
+  }
+  const p = value;
+  return typeof p.target === "string" && typeof p.key === "string" && (p.disposition === "attachment" || p.disposition === "inline");
+}
+function verifyServeToken(token, { secret }) {
+  let payload;
+  try {
+    payload = verifySignedToken(token, { purpose: SERVE_TOKEN_PURPOSE, secret });
+  } catch (e) {
+    throw new UploadError("NOT_FOUND", "File not found.", e);
+  }
+  if (!isServeTokenPayload(payload)) {
+    throw new UploadError("NOT_FOUND", "File not found.");
+  }
+  return payload;
+}
+export {
+  DEFAULT_SERVE_URL_EXPIRES_IN,
+  SERVE_ROUTE_PATH,
+  SERVE_TOKEN_PARAM,
+  SERVE_TOKEN_PURPOSE,
+  createServeToken,
+  verifyServeToken
+};

package/dist/services.d.ts

@@ -0,0 +1,70 @@
+import type { UploadProfiles } from './profiles.js';
+import type { StorageTargets, UploadDatabase, UploadRecord } from './types.js';
+import type { UploadTokenPayload } from './uploadToken.js';
+/** The identity a token is issued to. */
+export interface UploadActor {
+    id: string | number;
+    organizationId?: string | null;
+}
+export interface IssueUploadTokenOptions {
+    profiles: UploadProfiles;
+    /** Name of the profile the client asked for. */
+    profile: string;
+    secret: string;
+    /** The requesting user. Tokens are always bound to a user. */
+    currentUser: UploadActor | null | undefined;
+    /** The organization to bind the token to, in multi-tenant apps. */
+    organizationId?: string | null;
+}
+export interface UploadTokenResponse {
+    token: string;
+    allowedMimeTypes: string[];
+    maxFileSize: bigint;
+    maxFiles: number;
+}
+/**
+ * Issues an upload token for a server-defined profile, bound to the
+ * requesting user. This is what the generated `requestUploadToken` resolver
+ * calls. The response echoes the profile's constraints for client-side UX;
+ * the authoritative copy is inside the signed token.
+ */
+export declare function issueUploadToken({ profiles, profile: profileName, secret, currentUser, organizationId, }: IssueUploadTokenOptions): UploadTokenResponse;
+export interface CreatePresignedUploadInput {
+    filename: string;
+    contentType: string;
+    size: bigint | number | string;
+}
+export interface CreatePresignedUploadOptions {
+    db: UploadDatabase;
+    targets: StorageTargets;
+    /** The validated token, as attached to context by `@requireUploadToken`. */
+    tokenPayload: UploadTokenPayload;
+    input: CreatePresignedUploadInput;
+}
+export interface PresignedUploadResponse {
+    uploadId: string;
+    url: string;
+    method: string;
+    headers: Record<string, string>;
+}
+/**
+ * Validates a file against the token, creates its `pending` row, and returns
+ * a presigned URL the client PUTs the bytes to. This is what the generated
+ * `createPresignedUploadUrl` resolver calls.
+ */
+export declare function createPresignedUpload({ db, targets, tokenPayload, input, }: CreatePresignedUploadOptions): Promise<PresignedUploadResponse>;
+export interface ConfirmUploadOptions {
+    db: UploadDatabase;
+    targets: StorageTargets;
+    uploadId: string;
+    currentUser: UploadActor | null | undefined;
+}
+/**
+ * Client-side confirmation of a direct upload. Verifies that the object
+ * exists in storage and that its size matches what the token authorized,
+ * then flips the row `pending` to `completed`. On a size mismatch the row is
+ * claimed `failed` and the object deleted. Only the user (and organization)
+ * the upload was issued to can confirm it.
+ */
+export declare function confirmUpload({ db, targets, uploadId, currentUser, }: ConfirmUploadOptions): Promise<UploadRecord>;
+//# sourceMappingURL=services.d.ts.map

package/dist/services.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"services.d.ts","sourceRoot":"","sources":["../src/services.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAEnD,OAAO,KAAK,EAEV,cAAc,EACd,cAAc,EACd,YAAY,EACb,MAAM,YAAY,CAAA;AAEnB,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAE1D,yCAAyC;AACzC,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,GAAG,MAAM,CAAA;IACnB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC/B;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,cAAc,CAAA;IACxB,gDAAgD;IAChD,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,8DAA8D;IAC9D,WAAW,EAAE,WAAW,GAAG,IAAI,GAAG,SAAS,CAAA;IAC3C,mEAAmE;IACnE,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC/B;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAA;IACb,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,EAC/B,QAAQ,EACR,OAAO,EAAE,WAAW,EACpB,MAAM,EACN,WAAW,EACX,cAAc,GACf,EAAE,uBAAuB,GAAG,mBAAmB,CA+B/C;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAA;CAC/B;AAED,MAAM,WAAW,4BAA4B;IAC3C,EAAE,EAAE,cAAc,CAAA;IAClB,OAAO,EAAE,cAAc,CAAA;IACvB,4EAA4E;IAC5E,YAAY,EAAE,kBAAkB,CAAA;IAChC,KAAK,EAAE,0BAA0B,CAAA;CAClC;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,CAAA;IAChB,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAChC;AAUD;;;;GAIG;AACH,wBAAsB,qBAAqB,CAAC,EAC1C,EAAE,EACF,OAAO,EACP,YAAY,EACZ,KAAK,GACN,EAAE,4BAA4B,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAkCjE;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,cAAc,CAAA;IAClB,OAAO,EAAE,cAAc,CAAA;IACvB,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,WAAW,GAAG,IAAI,GAAG,SAAS,CAAA;CAC5C;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,EAClC,EAAE,EACF,OAAO,EACP,QAAQ,EACR,WAAW,GACZ,EAAE,oBAAoB,GAAG,OAAO,CAAC,YAAY,CAAC,CAoE9C"}