@cloudinary/environment-config-mcp 0.6.0 → 0.6.1

package/src/hooks/cloudinaryAuthHook.ts

@@ -1,239 +1,86 @@
-import {CloudConfig} from "./cloudConfig.js";
-import {BeforeRequestContext, BeforeRequestHook} from "./types.js";
-
-export class CloudinaryAuthHook
-    implements BeforeRequestHook {
-
-    private readonly cloudConfig: CloudConfig;
-
-    constructor() {
-        this.cloudConfig = new CloudConfig();
+import { CloudConfig } from "./cloudConfig.js";
+import { BeforeRequestContext, BeforeRequestHook } from "./types.js";
+
+/**
+ * Attaches Cloudinary authentication to every outgoing request.
+ *
+ * Priority:
+ *   1. OAuth2 Bearer token (if provided via security source)
+ *   2. Basic auth (apiKey:apiSecret)
+ */
+export class CloudinaryAuthHook implements BeforeRequestHook {
+    private readonly config: CloudConfig;
+
+    constructor(config: CloudConfig) {
+        this.config = config;
     }
 
-    async beforeRequest(hookCtx: BeforeRequestContext, request: Request): Promise<Request> {
-        let security = hookCtx.securitySource;
-        // Resolve the security source if it's a function (for dynamic token refresh)
-        if (typeof security === 'function') {
-            security = await security();
-        }
-
-        // Prioritize OAuth2 bearer token if it's provided.
-        if (security && typeof security === 'object' && 'oauth2' in security && typeof security.oauth2 === 'string') {
-            const token = security.oauth2;
-            if (token) {
-                request.headers.set("Authorization", `Bearer ${token}`);
-                return request;
-            }
-        }
-
-        // Fallback to API key/secret signing if no OAuth token is present.
-        let { apiKey, apiSecret } = this.cloudConfig;
+    async beforeRequest(
+        hookCtx: BeforeRequestContext,
+        request: Request,
+    ): Promise<Request> {
+        const security = await this.resolveSecurity(hookCtx.securitySource);
 
-        // Optionally merge user-supplied security overrides
-        if (security) {
-            // Handle custom cloudinaryAuth format
-            if ('cloudinaryAuth' in security && security.cloudinaryAuth) {
-                // Support both camelCase and snake_case for compatibility
-                if (security.cloudinaryAuth.apiKey || security.cloudinaryAuth.api_key) {
-                    apiKey = security.cloudinaryAuth.apiKey || security.cloudinaryAuth.api_key;
-                }
-                if (security.cloudinaryAuth.apiSecret || security.cloudinaryAuth.api_secret) {
-                    apiSecret = security.cloudinaryAuth.apiSecret || security.cloudinaryAuth.api_secret;
-                }
-            }
-            // Handle standard SDK security format (used by MCP server)
-            else if ('apiKey' in security || 'apiSecret' in security) {
-                if ('apiKey' in security && security.apiKey) {
-                    apiKey = security.apiKey;
-                }
-                if ('apiSecret' in security && security.apiSecret) {
-                    apiSecret = security.apiSecret;
-                }
-            }
-        }
-
-        if (!apiKey || !apiSecret) {
+        // 1. OAuth2 Bearer token takes priority
+        if (this.isOAuth2Token(security)) {
+            request.headers.set("Authorization", `Bearer ${security.oauth2}`);
             return request;
         }
 
-        if (this.SIGNED_PATHS.every(path => request.url.indexOf(path) === -1)) {
-            // generate  Authorization header using basic auth where apiKey:apiSecret is encoded in base64
-            const authHeader = `Basic ${Buffer.from(`${apiKey}:${apiSecret}`).toString("base64")}`;
-            request.headers.set("Authorization", authHeader);
+        // 2. Resolve API key / secret (env → security overrides)
+        const { apiKey, apiSecret } = this.resolveCredentials(security);
+        if (!apiKey || !apiSecret) {
             return request;
         }
 
-        // Extract query parameters regardless of body existence
-        const url = new URL(request.url);
-        const queryParams = this.paramsFromQuery(url.searchParams);
-
-        // Handle case with only query parameters (no body)
-        if (!request.body) {
-            return this.signQueryOnlyRequest(request, apiKey, apiSecret, queryParams);
-        }
-
-        // if content-type is application/json, parse the body as json and add the signature, timestamp and apiKey to the body
-        if (request.headers.get("Content-Type") === "application/json") {
-            const preprocessedBody = await this.preprocessJsonRequest(request);
-            return this.signJsonRequest(request, apiKey, apiSecret, queryParams, preprocessedBody);
-        }
-
-        // if content-type is multipart/form-data, parse the body as form data and add the signature, timestamp and apiKey to the body
-        if (request.headers.get("Content-Type")?.startsWith("multipart/form-data")) {
-            return this.signFormDataRequest(request, apiKey, apiSecret, queryParams);
-        }
-
-        // Default case - just sign query parameters if any exist
-        if (queryParams.length > 0) {
-            return this.signQueryOnlyRequest(request, apiKey, apiSecret, queryParams);
-        }
+        const encoded = Buffer.from(`${apiKey}:${apiSecret}`).toString("base64");
+        request.headers.set("Authorization", `Basic ${encoded}`);
 
         return request;
     }
 
-    paramsFromQuery(searchParams: URLSearchParams): string[] {
-        const params = [];
-        for (const [key, value] of searchParams.entries()) {
-            if (key !== "file" && key !== "cloud_name" && key !== "resource_type" && key !== "api_key" && key !== "signature" && key !== "timestamp") {
-                params.push(`${key}=${value}`);
-            }
-        }
-        return params;
-    }
+    // --- Security resolution ---
 
-    async signQueryOnlyRequest(request: Request, apiKey: string, apiSecret: string, queryParams: string[]): Promise<Request> {
-        const url = new URL(request.url);
-        // Check if already signed
-        if (url.searchParams.has("signature")) {
-            return request;
-        }
-
-        const { signature, timestamp } = await this.computeSignature(queryParams, apiSecret);
-        url.searchParams.set("signature", signature);
-        url.searchParams.set("timestamp", timestamp.toString());
-        url.searchParams.set("api_key", apiKey);
-
-        return new Request(url.toString(), request);
+    private async resolveSecurity(source: unknown): Promise<unknown> {
+        return typeof source === "function" ? source() : source;
     }
 
-    async computeSignature(params: string[], apiSecret: string) {
-        const crypto = await import('node:crypto');
-        // Create a string with the parameters used in the POST request to Cloudinary:
-        //     All parameters added to the method call should be included except: file, cloud_name, resource_type and your api_key.
-        //     Sort all the parameters in alphabetical order.
-        //     Separate the parameter names from their values with an = and join the parameter/value pairs together with an &.
-        // Append your API secret to the end of the string.
-        // Create a hexadecimal message digest (hash value) of the string using an SHA cryptographic function.
-        const timestamp = Math.floor(Date.now() / 1000);
-        params.push(`timestamp=${timestamp}`);
-        params.sort();
-        const paramsString = params.join("&");
-        const signature = crypto.createHash('sha256').update(`${paramsString}${apiSecret}`).digest('hex');
-
-        return { signature, timestamp };
+    private isOAuth2Token(
+        security: unknown,
+    ): security is { oauth2: string } {
+        return (
+            typeof security === "object"
+            && security !== null
+            && "oauth2" in security
+            && typeof (security as any).oauth2 === "string"
+            && (security as any).oauth2.length > 0
+        );
     }
 
-    paramsToSignFormData(form: FormData) {
-        const params = [];
-        for (const [key, value] of form.entries()) {
-            if (key !== "file" && key !== "cloud_name" && key !== "resource_type" && key !== "api_key" && key !== "signature") {
-                params.push(`${key}=${value}`);
-            }
-        }
-        return params;
-    }
+    private resolveCredentials(security: unknown): {
+        apiKey: string;
+        apiSecret: string;
+    } {
+        let { apiKey, apiSecret } = this.config;
 
-    paramsToSignJson(json: Record<string, string>) {
-        const params = [];
-        for (const [key, value] of Object.entries(json)) {
-            if (key !== "file" && key !== "cloud_name" && key !== "resource_type" && key !== "api_key" && key !== "signature") {
-                params.push(`${key}=${value}`);
-            }
+        if (!security || typeof security !== "object") {
+            return { apiKey, apiSecret };
         }
-        return params;
-    }
-
-    async preprocessJsonRequest(request: Request): Promise<any> {
-        const body = await request.json();
-
-        // Handle file:// URLs by converting to base64 data URIs
-        if (body.file && typeof body.file === 'string' && body.file.startsWith('file://')) {
-            body.file = await this.convertFileToDataUri(body.file);
-        }
-
-        return body;
-    }
-
-    async signJsonRequest(request: Request, apiKey: string, apiSecret: string, queryParams: string[] = [], preprocessedBody?: any) {
-        const body = preprocessedBody || await request.json();
-        if (body.signature) {
-            return request;
-        }
-
-        const bodyParams = this.paramsToSignJson(body);
-        const allParams = [...bodyParams, ...queryParams];
-        const { signature, timestamp } = await this.computeSignature(allParams, apiSecret);
-        body.signature = signature;
-        body.timestamp = timestamp;
-        body.api_key = apiKey;
-        return new Request(request, { body: JSON.stringify(body) });
-    }
-
-    private async convertFileToDataUri(fileUrl: string): Promise<string> {
-        // Remove 'file://' prefix to get the actual file path
-        const filePath = fileUrl.replace(/^file:\/\//, '');
 
-        try {
-            // Import required Node.js modules
-            const { readFile } = await import('node:fs/promises');
+        const sec = security as Record<string, any>;
 
-            // Read the file as a buffer
-            const fileBuffer = await readFile(filePath);
-
-            // Convert to base64
-            const base64Data = fileBuffer.toString('base64');
-
-            // Use generic MIME type for all files
-            const mimeType = 'application/octet-stream';
-
-            // Return as data URI
-            return `data:${mimeType};base64,${base64Data}`;
-
-        } catch (error) {
-            // If file reading fails, log error and return original URL
-            console.error(`Failed to read file: ${filePath}`, error);
-            throw new Error(`Failed to read file: ${filePath}. ${error instanceof Error ? error.message : String(error)}`);
+        // cloudinaryAuth format (camelCase and snake_case)
+        if (sec["cloudinaryAuth"]) {
+            const auth = sec["cloudinaryAuth"];
+            apiKey = auth.apiKey || auth.api_key || apiKey;
+            apiSecret = auth.apiSecret || auth.api_secret || apiSecret;
         }
-    }
-
-    async signFormDataRequest(request: Request, apiKey: string, apiSecret: string, queryParams: string[] = []) {
-        const form = await request.clone().formData();
-        if (form.get("signature")) {
-            return request;
+        // Standard SDK security format (used by MCP server)
+        else if ("apiKey" in sec || "apiSecret" in sec) {
+            apiKey = sec["apiKey"] || apiKey;
+            apiSecret = sec["apiSecret"] || apiSecret;
         }
 
-        const bodyParams = this.paramsToSignFormData(form);
-        const allParams = [...bodyParams, ...queryParams];
-        const { signature, timestamp } = await this.computeSignature(allParams, apiSecret);
-
-        // add the signature, timestamp and apiKey to the URL as query parameters
-        const url = new URL(request.url);
-        url.searchParams.set("signature", signature);
-        url.searchParams.set("timestamp", timestamp.toString());
-        url.searchParams.set("api_key", apiKey);
-
-        // construct a new request with the same URL and the same form data and the same method
-        // remove the basic authentication header
-        const newHeaders = new Headers(request.headers);
-        newHeaders.delete("Authorization");
-        return new Request(url.toString(), request);
+        return { apiKey, apiSecret };
     }
-
-    SIGNED_ACTIONS = [
-        'explicit', 'upload', 'download', 'destroy', 'sprite', 'tags', 'context', 'metadata_update', 'text', 'multi', 'explode',
-        'rename', 'create_slideshow', 'create_video', 'create_collage', 'generate_archive'];
-
-    SIGNED_PATHS = ["image", "video", "raw", "auto", "asset"].flatMap(resourceType => this.SIGNED_ACTIONS.map(action => `${resourceType}/${action}`));
-
-
 }

package/src/hooks/customHeadersHook.ts

@@ -0,0 +1,30 @@
+import { BeforeRequestContext, BeforeRequestHook } from "./types.js";
+
+/**
+ * Injects custom headers into every outgoing request to the Cloudinary API.
+ *
+ * Headers are read from `hookCtx.options.customHeaders` (a Record<string, string>),
+ * which is set by mcp-service when constructing the SDK via getSDK.
+ *
+ * When no custom headers are configured, this hook is a no-op.
+ */
+export class CustomHeadersHook implements BeforeRequestHook {
+    async beforeRequest(
+        hookCtx: BeforeRequestContext,
+        request: Request,
+    ): Promise<Request> {
+        const customHeaders = (hookCtx.options as any)?.customHeaders as
+            | Record<string, string>
+            | undefined;
+
+        if (!customHeaders) {
+            return request;
+        }
+
+        for (const [name, value] of Object.entries(customHeaders)) {
+            request.headers.set(name, value);
+        }
+
+        return request;
+    }
+}

package/src/hooks/hooks.ts

@@ -1,5 +1,6 @@
 /*
  * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ * @generated-id: a2463fc6f69b
  */
 
 import { initHooks } from "./registration.js";

package/src/hooks/oauth2scopes.ts

@@ -1,5 +1,6 @@
 /*
  * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ * @generated-id: a709b8ce2ddb
  */
 
 /**

package/src/hooks/registration.ts

@@ -1,5 +1,8 @@
-import { Hooks } from "./types.js";
+import { CloudConfig } from "./cloudConfig.js";
 import { CloudinaryAuthHook } from "./cloudinaryAuthHook.js";
+import { CustomHeadersHook } from "./customHeadersHook.js";
+import { ResponseHeadersHook } from "./responseHeadersHook.js";
+import { Hooks } from "./types.js";
 import { UserAgentHook } from "./userAgentHook.js";
 /*
  * This file is only ever generated once on the first generation and then is free to be modified.
@@ -8,12 +11,11 @@ import { UserAgentHook } from "./userAgentHook.js";
  */
 
 export function initHooks(hooks: Hooks) {
-  // Add hooks by calling hooks.register{ClientInit/BeforeCreateRequest/BeforeRequest/AfterSuccess/AfterError}Hook
-  // with an instance of a hook that implements that specific Hook interface
-  // Hooks are registered per SDK instance, and are valid for the lifetime of the SDK instance
-    const cloudinaryAuthHook = new CloudinaryAuthHook();
-    hooks.registerBeforeRequestHook(cloudinaryAuthHook);
+  // Shared config — parsed once from CLOUDINARY_URL and env vars
+  const config = new CloudConfig();
 
-    const userAgentHook = new UserAgentHook();
-    hooks.registerSDKInitHook(userAgentHook);
+  hooks.registerBeforeRequestHook(new CloudinaryAuthHook(config));
+  hooks.registerBeforeRequestHook(new CustomHeadersHook());
+  hooks.registerSDKInitHook(new UserAgentHook());
+  hooks.registerAfterSuccessHook(new ResponseHeadersHook(config.collectHeaders));
 }

package/src/hooks/responseHeadersHook.ts

@@ -0,0 +1,98 @@
+import { CollectHeaders } from "./cloudConfig.js";
+import { AfterSuccessContext, AfterSuccessHook } from "./types.js";
+
+/**
+ * Checks whether a lowercased header name matches a single collect spec.
+ *
+ * Supported spec formats:
+ *   - `"prefix:<value>"`  → headerName.startsWith(value)
+ *   - `"regex:<pattern>"` → new RegExp(pattern).test(headerName)
+ *   - any other string    → exact match
+ *
+ * Both headerName and spec are expected to be lowercased already.
+ */
+function matchesSpec(headerName: string, spec: string): boolean {
+  if (spec.startsWith("prefix:")) {
+    return headerName.startsWith(spec.slice(7));
+  }
+  if (spec.startsWith("regex:")) {
+    try {
+      return new RegExp(spec.slice(6)).test(headerName);
+    } catch {
+      return false; // invalid regex — skip
+    }
+  }
+  return headerName === spec;
+}
+
+/**
+ * Captures response headers and injects them into the JSON body as `_headers`
+ * so they survive through the generated formatResult() and surface in MCP tool
+ * output. The set of headers to collect is driven by configuration:
+ *   - `true`      → collect every response header
+ *   - `string[]`  → collect only matching headers (exact name, prefix:, or regex:)
+ */
+export class ResponseHeadersHook implements AfterSuccessHook {
+  private readonly collectHeaders: CollectHeaders;
+
+  constructor(collectHeaders: CollectHeaders) {
+    this.collectHeaders = collectHeaders;
+  }
+
+  async afterSuccess(
+    hookCtx: AfterSuccessContext,
+    response: Response,
+  ): Promise<Response> {
+    // Per-request SDK options override the constructor config (used by mcp-service)
+    const optCollect = (hookCtx.options as any)?.collectHeaders as
+      | CollectHeaders
+      | undefined;
+    const effective = optCollect ?? this.collectHeaders;
+
+    // Not configured — exit early
+    if (effective !== true && effective.length === 0) {
+      return response;
+    }
+
+    const contentType = response.headers.get("content-type") ?? "";
+    if (!contentType.includes("json")) {
+      return response;
+    }
+
+    const hdrs: Record<string, string> = {};
+    let found = false;
+
+    if (effective === true) {
+      // Collect all response headers
+      for (const [name, value] of response.headers.entries()) {
+        hdrs[name] = value;
+        found = true;
+      }
+    } else {
+      // Match each response header against the specs (exact, prefix:, regex:)
+      for (const [name, value] of response.headers.entries()) {
+        for (const spec of effective) {
+          if (matchesSpec(name, spec)) {
+            hdrs[name] = value;
+            found = true;
+            break;
+          }
+        }
+      }
+    }
+
+    if (!found) {
+      return response;
+    }
+
+    // Read body, inject headers, return a new Response so the stream is fresh.
+    const body = await response.json();
+    body._headers = hdrs;
+
+    return new Response(JSON.stringify(body), {
+      status: response.status,
+      statusText: response.statusText,
+      headers: response.headers,
+    });
+  }
+}

package/src/hooks/types.ts

@@ -1,5 +1,6 @@
 /*
  * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ * @generated-id: 2a02d86ec24f
  */
 
 import { SDKOptions } from "../lib/config.js";

package/src/landing-page.ts

@@ -1,5 +1,6 @@
 /*
  * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ * @generated-id: ef64a6ee46d7
  */
 
 import {
@@ -18,8 +19,14 @@ export function landingPage(req: Request): Response {
 
 // express wrapper
 export function landingPageExpress(req: ExpressRequest, res: ExpressResponse) {
-  const origin = new URL(req.host).href;
-  res.type("html").send(landingPageHTML(origin));
+  const proto = req.get("x-forwarded-proto")?.split(",")[0]?.trim()
+    || req.protocol;
+  const host = req.get("host");
+  if (!host) {
+    res.status(400).send("Missing Host header");
+    return;
+  }
+  res.type("html").send(landingPageHTML(`${proto}://${host}`));
 }
 
 export function landingPageHTML(origin: string): string {
@@ -932,7 +939,7 @@ http_headers = { "api-key" = "YOUR_API_KEY", "api-secret" = "YOUR_API_SECRET", "
         <h1>Instructions</h1>
         <p>One-click installation for Claude Desktop users</p>
         <div class="instruction-item">
-          <a href="https://github.com/cloudinary/environment-config-mcp/releases/download/v0.6.0/mcp-server.mcpb" download="mcp-server.mcpb" class="action-button header-action" style="display: inline-flex; margin-bottom: 16px;">
+          <a href="https://github.com/cloudinary/environment-config-mcp/releases/download/v0.6.1/mcp-server.mcpb" download="mcp-server.mcpb" class="action-button header-action" style="display: inline-flex; margin-bottom: 16px;">
             📥 Download MCP Bundle
           </a>
         </div>

package/src/lib/base64.ts

@@ -1,5 +1,6 @@
 /*
  * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ * @generated-id: 598522066688
  */
 
 import * as z from "zod";

package/src/lib/config.ts

@@ -1,5 +1,6 @@
 /*
  * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ * @generated-id: 320761608fb3
  */
 
 import * as z from "zod";
@@ -111,9 +112,9 @@ export function serverURLFromOptions(options: SDKOptions): URL | null {
 
 export const SDK_METADATA = {
   language: "typescript",
-  openapiDocVersion: "0.4.0",
-  sdkVersion: "0.6.0",
-  genVersion: "2.865.2",
+  openapiDocVersion: "0.5.5",
+  sdkVersion: "0.6.1",
+  genVersion: "2.918.4",
   userAgent:
-    "speakeasy-sdk/mcp-typescript 0.6.0 2.865.2 0.4.0 @cloudinary/environment-config-mcp",
+    "speakeasy-sdk/mcp-typescript 0.6.1 2.918.4 0.5.5 @cloudinary/environment-config-mcp",
 } as const;

package/src/lib/encodings.ts

@@ -1,9 +1,10 @@
 /*
  * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ * @generated-id: 3bd8ead98afd
  */
 
 import { bytesToBase64 } from "./base64.js";
-import { isPlainObject } from "./is-plain-object.js";
+import { isPlainObject } from "./primitives.js";
 
 export class EncodingError extends Error {
   constructor(message: string) {
@@ -474,6 +475,23 @@ export const encodeSpaceDelimitedQuery = queryEncoder(encodeSpaceDelimited);
 export const encodePipeDelimitedQuery = queryEncoder(encodePipeDelimited);
 export const encodeDeepObjectQuery = queryEncoder(encodeDeepObject);
 
+function isBlobLike(val: unknown): val is Blob {
+  if (val instanceof Blob) {
+    return true;
+  }
+
+  if (typeof val !== "object" || val == null || !(Symbol.toStringTag in val)) {
+    return false;
+  }
+
+  const tag = val[Symbol.toStringTag];
+  if (tag !== "Blob" && tag !== "File") {
+    return false;
+  }
+
+  return "stream" in val && typeof val.stream === "function";
+}
+
 export function appendForm(
   fd: FormData,
   key: string,
@@ -482,11 +500,22 @@ export function appendForm(
 ): void {
   if (value == null) {
     return;
-  } else if (value instanceof Blob && fileName) {
-    fd.append(key, value, fileName);
-  } else if (value instanceof Blob) {
-    fd.append(key, value);
+  } else if (isBlobLike(value)) {
+    if (fileName) {
+      fd.append(key, value as Blob, fileName);
+    } else {
+      fd.append(key, value as Blob);
+    }
   } else {
     fd.append(key, String(value));
   }
 }
+
+export async function normalizeBlob(
+  value: Pick<Blob, "arrayBuffer" | "type">,
+): Promise<Blob> {
+  if (value instanceof Blob) {
+    return value;
+  }
+  return new Blob([await value.arrayBuffer()], { type: value.type });
+}

package/src/lib/env.ts

@@ -1,9 +1,8 @@
 /*
  * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ * @generated-id: c52972a3b198
  */
 
-import { dlv } from "./dlv.js";
-
 import * as z from "zod";
 import { SDKOptions } from "./config.js";
 
@@ -39,8 +38,13 @@ export function env(): Env {
     return envMemo;
   }
 
+  const globals = globalThis as {
+    process?: { env?: Record<string, string | undefined> };
+    Deno?: { env?: { toObject?: () => Record<string, string | undefined> } };
+  };
+
   envMemo = envSchema.parse(
-    dlv(globalThis, "process.env") ?? dlv(globalThis, "Deno.env") ?? {},
+    globals.process?.env ?? globals.Deno?.env?.toObject?.() ?? {},
   );
   return envMemo;
 }

package/src/lib/files.ts

@@ -1,5 +1,6 @@
 /*
  * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ * @generated-id: e5efa54fcb95
  */
 
 /**
@@ -80,3 +81,25 @@ export function getContentTypeFromFileName(fileName: string): string | null {
 
   return mimeTypes[ext] || null;
 }
+
+/**
+ * Creates a Blob from file content with the given MIME type.
+ *
+ * Node.js Buffers are Uint8Array subclasses that may share a pooled
+ * ArrayBuffer (byteOffset > 0, byteLength < buffer.byteLength). Passing
+ * such a Buffer directly to `new Blob([buf])` can include the entire
+ * underlying pool on some runtimes, producing a Blob with extra bytes
+ * that corrupts multipart uploads.
+ *
+ * Copying into a standalone Uint8Array ensures the Blob receives only the
+ * intended bytes regardless of runtime behaviour.
+ */
+export function bytesToBlob(
+  content: Uint8Array<ArrayBufferLike> | ArrayBuffer | Blob | string,
+  contentType: string,
+): Blob {
+  if (content instanceof Uint8Array) {
+    return new Blob([new Uint8Array(content)], { type: contentType });
+  }
+  return new Blob([content as BlobPart], { type: contentType });
+}