@panorama-industries/effect-vercel-blob 0.0.0-stage → 0.2.0

package/dist/contracts/blob-domain.js

@@ -0,0 +1,152 @@
+import { Data, Schema } from "effect";
+/** Whether a blob is readable by anyone with its URL (`public`) or only with credentials. */
+export const BlobAccess = Schema.Literals(["public", "private"]);
+/**
+ * Identifier of a Blob store without its `store_` prefix, as sent in `x-vercel-blob-store-id` and
+ * used in blob host names. Case-sensitive.
+ */
+export const StoreId = Schema.String.check(Schema.isPattern(/^(?!store_)[^\s_]+$/)).pipe(Schema.brand("StoreId"));
+/** Longest pathname a write accepts: the provider limit minus room for Vercel's suffixes. */
+export const maximumPathnameLength = 950;
+/**
+ * Where a write stores a blob inside its store, such as `avatars/user-1.png`: non-empty, at most
+ * {@link maximumPathnameLength} characters, and without `//`.
+ *
+ * Reads and deletes take any pathname or blob URL as a plain string, because stored pathnames may
+ * be longer once a random suffix is added.
+ */
+export const BlobPathname = Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(maximumPathnameLength), Schema.makeFilter((pathname) => !pathname.includes("//"), {
+    expected: 'a pathname without "//"',
+})).pipe(Schema.brand("BlobPathname"));
+/** Version tag of a blob's content, used for conditional writes, deletes and reads. */
+export const ETag = Schema.NonEmptyString.pipe(Schema.brand("ETag"));
+/** Position of a part in a multipart upload: an integer from 1 to 10000. */
+export const PartNumber = Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 10_000 })).pipe(Schema.brand("PartNumber"));
+/** A stored blob as returned by writes. */
+export class PutBlobResult extends Schema.Class("@effect-vercel/blob/PutBlobResult")({
+    url: Schema.URL,
+    /** The URL with `?download=1`, which makes browsers download instead of display. */
+    downloadUrl: Schema.URL,
+    pathname: Schema.String,
+    contentType: Schema.String,
+    contentDisposition: Schema.String,
+    etag: ETag,
+}) {
+}
+/** Everything known about a stored blob. */
+export class BlobMetadata extends Schema.Class("@effect-vercel/blob/BlobMetadata")({
+    url: Schema.URL,
+    downloadUrl: Schema.URL,
+    pathname: Schema.String,
+    /** Size in bytes. */
+    size: Schema.Int,
+    uploadedAt: Schema.DateTimeUtc,
+    contentType: Schema.String,
+    contentDisposition: Schema.String,
+    cacheControl: Schema.String,
+    etag: ETag,
+}) {
+}
+/** One entry of a listing. */
+export class ListedBlob extends Schema.Class("@effect-vercel/blob/ListedBlob")({
+    url: Schema.URL,
+    downloadUrl: Schema.URL,
+    pathname: Schema.String,
+    size: Schema.Int,
+    uploadedAt: Schema.DateTimeUtc,
+    etag: ETag,
+}) {
+}
+/** One page of a listing, in lexicographic pathname order. */
+export class ListPage extends Schema.Class("@effect-vercel/blob/ListPage")({
+    blobs: Schema.Array(ListedBlob),
+    /** Fully qualified folder pathnames directly under the prefix; empty unless `mode` is `folded`. */
+    folders: Schema.Array(Schema.String),
+    /** Pass to the next `list` call to continue; none on the last page. */
+    cursor: Schema.Option(Schema.String),
+    hasMore: Schema.Boolean,
+}) {
+}
+/** A folder created with `createFolder`. */
+export class CreateFolderResult extends Schema.Class("@effect-vercel/blob/CreateFolderResult")({
+    url: Schema.URL,
+    /** The folder pathname, ending in `/`. */
+    pathname: Schema.String,
+}) {
+}
+/** Metadata of a blob read with `get`, from its response headers. */
+export class FetchedBlob extends Schema.Class("@effect-vercel/blob/FetchedBlob")({
+    url: Schema.URL,
+    downloadUrl: Schema.URL,
+    pathname: Schema.String,
+    contentDisposition: Schema.String,
+    cacheControl: Schema.String,
+    /** `Last-Modified`, or the time of the read when the response had none. */
+    uploadedAt: Schema.DateTimeUtc,
+    etag: Schema.String,
+}) {
+}
+/** Constructors and matchers for {@link GetBlobResult}. */
+export const GetBlobResult = Data.taggedEnum();
+/**
+ * A multipart upload in progress. Every write option is kept so parts and completion send the same
+ * headers as creation; the value can be serialized and resumed by another process.
+ */
+export class MultipartUpload extends Schema.Class("@effect-vercel/blob/MultipartUpload")({
+    pathname: BlobPathname,
+    /** Identifies the blob object being assembled. */
+    key: Schema.String,
+    uploadId: Schema.String,
+    access: BlobAccess,
+    addRandomSuffix: Schema.optionalKey(Schema.Boolean),
+    allowOverwrite: Schema.optionalKey(Schema.Boolean),
+    contentType: Schema.optionalKey(Schema.String),
+    /** In seconds, as sent on the wire. */
+    cacheControlMaxAge: Schema.optionalKey(Schema.Int),
+}) {
+}
+/** A part uploaded to a multipart upload, needed to complete it. */
+export class UploadedPart extends Schema.Class("@effect-vercel/blob/UploadedPart")({
+    etag: Schema.String,
+    partNumber: PartNumber,
+}) {
+}
+/** Operations a signed token can delegate. */
+export const DelegationOperation = Schema.Literals(["get", "head", "put", "delete"]);
+/** Query parameters that authorize one presigned request instead of a bearer token. */
+export class PresignedUrlPayload extends Schema.Class("@effect-vercel/blob/PresignedUrlPayload")({
+    /** Public part of the signed token; the store id is read from it. */
+    delegationToken: Schema.String,
+    /** HMAC-SHA256 (base64url) of the request's canonical string, keyed by the client signing token. */
+    signature: Schema.String,
+    /** Signed constraints, sent as query parameters. */
+    params: Schema.Record(Schema.String, Schema.String),
+}) {
+}
+/** A short-lived token, issued by the Blob API, from which presigned URLs are signed locally. */
+export class SignedToken extends Schema.Class("@effect-vercel/blob/SignedToken")({
+    /** Public; embedded in every presigned URL. */
+    delegationToken: Schema.String,
+    /** Secret HMAC key for presigning. Never send it to clients. */
+    clientSigningToken: Schema.Redacted(Schema.String),
+    validUntil: Schema.DateTimeUtc,
+}) {
+}
+/** A token that lets a browser upload one pathname directly (`vercel_blob_client_…`). */
+export const ClientToken = Schema.String.check(Schema.isPattern(/^vercel_blob_client_/)).pipe(Schema.brand("ClientToken"));
+/** The blob store's notification that a browser upload finished. */
+export class UploadCompleted extends Schema.Class("@effect-vercel/blob/UploadCompleted")({
+    blob: PutBlobResult,
+    /** Data the server attached when it authorized the upload. */
+    tokenPayload: Schema.Option(Schema.String),
+}) {
+}
+/** What a browser asks for when it starts an upload through an upload route. */
+export class UploadRequest extends Schema.Class("@effect-vercel/blob/UploadRequest")({
+    pathname: Schema.String,
+    /** Data the browser sent along, such as a form id; untrusted. */
+    clientPayload: Schema.Option(Schema.String),
+    multipart: Schema.Boolean,
+}) {
+}
+//# sourceMappingURL=blob-domain.js.map

package/dist/contracts/blob-domain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"blob-domain.js","sourceRoot":"","sources":["../../src/contracts/blob-domain.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEtC,6FAA6F;AAC7F,MAAM,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;AAKjE;;;GAGG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,CACtF,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CACxB,CAAC;AAKF,6FAA6F;AAC7F,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAEzC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAC7C,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EACrB,MAAM,CAAC,WAAW,CAAC,qBAAqB,CAAC,EACzC,MAAM,CAAC,UAAU,CAAC,CAAC,QAAgB,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;IAChE,QAAQ,EAAE,yBAAyB;CACpC,CAAC,CACH,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;AAQrC,uFAAuF;AACvF,MAAM,CAAC,MAAM,IAAI,GAAG,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;AAKrE,4EAA4E;AAC5E,MAAM,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAChG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAC3B,CAAC;AA4DF,2CAA2C;AAC3C,MAAM,OAAO,aAAc,SAAQ,MAAM,CAAC,KAAK,CAAgB,mCAAmC,CAAC,CACjG;IACE,GAAG,EAAE,MAAM,CAAC,GAAG;IACf,oFAAoF;IACpF,WAAW,EAAE,MAAM,CAAC,GAAG;IACvB,QAAQ,EAAE,MAAM,CAAC,MAAM;IACvB,WAAW,EAAE,MAAM,CAAC,MAAM;IAC1B,kBAAkB,EAAE,MAAM,CAAC,MAAM;IACjC,IAAI,EAAE,IAAI;CACX,CACF;CAAG;AAEJ,4CAA4C;AAC5C,MAAM,OAAO,YAAa,SAAQ,MAAM,CAAC,KAAK,CAAe,kCAAkC,CAAC,CAAC;IAC/F,GAAG,EAAE,MAAM,CAAC,GAAG;IACf,WAAW,EAAE,MAAM,CAAC,GAAG;IACvB,QAAQ,EAAE,MAAM,CAAC,MAAM;IACvB,qBAAqB;IACrB,IAAI,EAAE,MAAM,CAAC,GAAG;IAChB,UAAU,EAAE,MAAM,CAAC,WAAW;IAC9B,WAAW,EAAE,MAAM,CAAC,MAAM;IAC1B,kBAAkB,EAAE,MAAM,CAAC,MAAM;IACjC,YAAY,EAAE,MAAM,CAAC,MAAM;IAC3B,IAAI,EAAE,IAAI;CACX,CAAC;CAAG;AAEL,8BAA8B;AAC9B,MAAM,OAAO,UAAW,SAAQ,MAAM,CAAC,KAAK,CAAa,gCAAgC,CAAC,CAAC;IACzF,GAAG,EAAE,MAAM,CAAC,GAAG;IACf,WAAW,EAAE,MAAM,CAAC,GAAG;IACvB,QAAQ,EAAE,MAAM,CAAC,MAAM;IACvB,IAAI,EAAE,MAAM,CAAC,GAAG;IAChB,UAAU,EAAE,MAAM,CAAC,WAAW;IAC9B,IAAI,EAAE,IAAI;CACX,CAAC;CAAG;AAEL,8DAA8D;AAC9D,MAAM,OAAO,QAAS,SAAQ,MAAM,CAAC,KAAK,CAAW,8BAA8B,CAAC,CAAC;IACnF,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC;IAC/B,mGAAmG;IACnG,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;IACpC,uEAAuE;IACvE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;IACpC,OAAO,EAAE,MAAM,CAAC,OAAO;CACxB,CAAC;CAAG;AAEL,4CAA4C;AAC5C,MAAM,OAAO,kBAAmB,SAAQ,MAAM,CAAC,KAAK,CAClD,wCAAwC,CACzC,CAAC;IACA,GAAG,EAAE,MAAM,CAAC,GAAG;IACf,0CAA0C;IAC1C,QAAQ,EAAE,MAAM,CAAC,MAAM;CACxB,CAAC;CAAG;AAEL,qEAAqE;AACrE,MAAM,OAAO,WAAY,SAAQ,MAAM,CAAC,KAAK,CAAc,iCAAiC,CAAC,CAAC;IAC5F,GAAG,EAAE,MAAM,CAAC,GAAG;IACf,WAAW,EAAE,MAAM,CAAC,GAAG;IACvB,QAAQ,EAAE,MAAM,CAAC,MAAM;IACvB,kBAAkB,EAAE,MAAM,CAAC,MAAM;IACjC,YAAY,EAAE,MAAM,CAAC,MAAM;IAC3B,2EAA2E;IAC3E,UAAU,EAAE,MAAM,CAAC,WAAW;IAC9B,IAAI,EAAE,MAAM,CAAC,MAAM;CACpB,CAAC;CAAG;AAsBL,2DAA2D;AAC3D,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,CAAC,UAAU,EAAiB,CAAC;AAE9D;;;GAGG;AACH,MAAM,OAAO,eAAgB,SAAQ,MAAM,CAAC,KAAK,CAC/C,qCAAqC,CACtC,CAAC;IACA,QAAQ,EAAE,YAAY;IACtB,kDAAkD;IAClD,GAAG,EAAE,MAAM,CAAC,MAAM;IAClB,QAAQ,EAAE,MAAM,CAAC,MAAM;IACvB,MAAM,EAAE,UAAU;IAClB,eAAe,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC;IACnD,cAAc,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC;IAClD,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC;IAC9C,uCAAuC;IACvC,kBAAkB,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC;CACnD,CAAC;CAAG;AAEL,oEAAoE;AACpE,MAAM,OAAO,YAAa,SAAQ,MAAM,CAAC,KAAK,CAAe,kCAAkC,CAAC,CAAC;IAC/F,IAAI,EAAE,MAAM,CAAC,MAAM;IACnB,UAAU,EAAE,UAAU;CACvB,CAAC;CAAG;AAEL,8CAA8C;AAC9C,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;AAKrF,uFAAuF;AACvF,MAAM,OAAO,mBAAoB,SAAQ,MAAM,CAAC,KAAK,CACnD,yCAAyC,CAC1C,CAAC;IACA,qEAAqE;IACrE,eAAe,EAAE,MAAM,CAAC,MAAM;IAC9B,oGAAoG;IACpG,SAAS,EAAE,MAAM,CAAC,MAAM;IACxB,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;CACpD,CAAC;CAAG;AAEL,iGAAiG;AACjG,MAAM,OAAO,WAAY,SAAQ,MAAM,CAAC,KAAK,CAAc,iCAAiC,CAAC,CAAC;IAC5F,+CAA+C;IAC/C,eAAe,EAAE,MAAM,CAAC,MAAM;IAC9B,gEAAgE;IAChE,kBAAkB,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;IAClD,UAAU,EAAE,MAAM,CAAC,WAAW;CAC/B,CAAC;CAAG;AAEL,yFAAyF;AACzF,MAAM,CAAC,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAC3F,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAC5B,CAAC;AAyBF,oEAAoE;AACpE,MAAM,OAAO,eAAgB,SAAQ,MAAM,CAAC,KAAK,CAC/C,qCAAqC,CACtC,CAAC;IACA,IAAI,EAAE,aAAa;IACnB,8DAA8D;IAC9D,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;CAC3C,CAAC;CAAG;AAEL,gFAAgF;AAChF,MAAM,OAAO,aAAc,SAAQ,MAAM,CAAC,KAAK,CAAgB,mCAAmC,CAAC,CACjG;IACE,QAAQ,EAAE,MAAM,CAAC,MAAM;IACvB,iEAAiE;IACjE,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;IAC3C,SAAS,EAAE,MAAM,CAAC,OAAO;CAC1B,CACF;CAAG"}

package/dist/contracts/blob-errors.d.ts

@@ -0,0 +1,125 @@
+import { Schema } from "effect";
+declare const BlobNotFound_base: Schema.Class<BlobNotFound, Schema.TaggedStruct<"BlobNotFound", {
+    /** The pathname or URL that was requested. */
+    readonly locator: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/** The blob does not exist (`not_found`). */
+export declare class BlobNotFound extends BlobNotFound_base {
+}
+declare const BlobStoreNotFound_base: Schema.Class<BlobStoreNotFound, Schema.TaggedStruct<"BlobStoreNotFound", {}>, import("effect/Cause").YieldableError>;
+/** The store addressed by the credentials does not exist (`store_not_found`). */
+export declare class BlobStoreNotFound extends BlobStoreNotFound_base {
+}
+declare const BlobStoreSuspended_base: Schema.Class<BlobStoreSuspended, Schema.TaggedStruct<"BlobStoreSuspended", {}>, import("effect/Cause").YieldableError>;
+/** The store has been suspended, for example for exceeding the Hobby quota (`store_suspended`). */
+export declare class BlobStoreSuspended extends BlobStoreSuspended_base {
+}
+declare const BlobStoreUnavailable_base: Schema.Class<BlobStoreUnavailable, Schema.TaggedStruct<"BlobStoreUnavailable", {
+    readonly reason: Schema.Union<readonly [typeof BlobStoreNotFound, typeof BlobStoreSuspended]>;
+}>, import("effect/Cause").YieldableError>;
+/** The store cannot serve any request. */
+export declare class BlobStoreUnavailable extends BlobStoreUnavailable_base {
+}
+declare const BlobPreconditionFailed_base: Schema.Class<BlobPreconditionFailed, Schema.TaggedStruct<"BlobPreconditionFailed", {}>, import("effect/Cause").YieldableError>;
+/** A conditional write or delete found a different ETag than `ifMatch` (`precondition_failed`). */
+export declare class BlobPreconditionFailed extends BlobPreconditionFailed_base {
+}
+declare const ContentTypeNotAllowed_base: Schema.Class<ContentTypeNotAllowed, Schema.TaggedStruct<"ContentTypeNotAllowed", {
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/** The upload's media type is not among the token's `allowedContentTypes`. */
+export declare class ContentTypeNotAllowed extends ContentTypeNotAllowed_base {
+}
+declare const FileTooLarge_base: Schema.Class<FileTooLarge, Schema.TaggedStruct<"FileTooLarge", {
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/** The upload is larger than `maximumSizeInBytes`, checked locally or by the store. */
+export declare class FileTooLarge extends FileTooLarge_base {
+}
+declare const PathnameMismatch_base: Schema.Class<PathnameMismatch, Schema.TaggedStruct<"PathnameMismatch", {
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/** The upload's pathname differs from the one the client token was issued for. */
+export declare class PathnameMismatch extends PathnameMismatch_base {
+}
+declare const ClientTokenExpired_base: Schema.Class<ClientTokenExpired, Schema.TaggedStruct<"ClientTokenExpired", {}>, import("effect/Cause").YieldableError>;
+/** The client token's `validUntil` has passed. */
+export declare class ClientTokenExpired extends ClientTokenExpired_base {
+}
+declare const BlobUploadRejected_base: Schema.Class<BlobUploadRejected, Schema.TaggedStruct<"BlobUploadRejected", {
+    readonly reason: Schema.Union<readonly [typeof ContentTypeNotAllowed, typeof FileTooLarge, typeof PathnameMismatch, typeof ClientTokenExpired]>;
+}>, import("effect/Cause").YieldableError>;
+/** The store refused an upload because it breaks a constraint of its token. */
+export declare class BlobUploadRejected extends BlobUploadRejected_base {
+}
+declare const BlobClientTokenNotAllowed_base: Schema.Class<BlobClientTokenNotAllowed, Schema.TaggedStruct<"BlobClientTokenNotAllowed", {
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/**
+ * The operation needs a read-write or OIDC token and was called with a client token
+ * (`client_token_not_allowed`), such as `rename`.
+ */
+export declare class BlobClientTokenNotAllowed extends BlobClientTokenNotAllowed_base {
+}
+declare const BlobOidcEnvironmentNotAllowed_base: Schema.Class<BlobOidcEnvironmentNotAllowed, Schema.TaggedStruct<"BlobOidcEnvironmentNotAllowed", {
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/**
+ * The project enables OIDC for Blob but not for the environment the token was issued in
+ * (`oidc_environment_not_allowed`). Enable it in the store's settings or use a read-write token.
+ */
+export declare class BlobOidcEnvironmentNotAllowed extends BlobOidcEnvironmentNotAllowed_base {
+}
+declare const BlobReadWriteTokenRequired_base: Schema.Class<BlobReadWriteTokenRequired, Schema.TaggedStruct<"BlobReadWriteTokenRequired", {
+    readonly operation: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/**
+ * The operation signs with the store's read-write token, and none is configured. OIDC is not
+ * enough for client tokens and their callbacks; set `BLOB_READ_WRITE_TOKEN`.
+ */
+export declare class BlobReadWriteTokenRequired extends BlobReadWriteTokenRequired_base {
+}
+declare const BlobPresignFailed_base: Schema.Class<BlobPresignFailed, Schema.TaggedStruct<"BlobPresignFailed", {
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/** A presigned URL could not be signed: the token's scope or the options do not allow it. */
+export declare class BlobPresignFailed extends BlobPresignFailed_base {
+}
+declare const SignatureMissing_base: Schema.Class<SignatureMissing, Schema.TaggedStruct<"SignatureMissing", {}>, import("effect/Cause").YieldableError>;
+/** The `x-vercel-signature` header is absent. */
+export declare class SignatureMissing extends SignatureMissing_base {
+}
+declare const SignatureInvalid_base: Schema.Class<SignatureInvalid, Schema.TaggedStruct<"SignatureInvalid", {}>, import("effect/Cause").YieldableError>;
+/** The `x-vercel-signature` header does not match the body. */
+export declare class SignatureInvalid extends SignatureInvalid_base {
+}
+declare const EventMalformed_base: Schema.Class<EventMalformed, Schema.TaggedStruct<"EventMalformed", {
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/** The request body is not a known upload event, or not JSON. */
+export declare class EventMalformed extends EventMalformed_base {
+}
+declare const WebhookPublicKeyMissing_base: Schema.Class<WebhookPublicKeyMissing, Schema.TaggedStruct<"WebhookPublicKeyMissing", {}>, import("effect/Cause").YieldableError>;
+/** The presigned flow has no webhook public key: set `BLOB_WEBHOOK_PUBLIC_KEY`. */
+export declare class WebhookPublicKeyMissing extends WebhookPublicKeyMissing_base {
+}
+declare const BlobUploadEventRejected_base: Schema.Class<BlobUploadEventRejected, Schema.TaggedStruct<"BlobUploadEventRejected", {
+    readonly reason: Schema.Union<readonly [typeof SignatureMissing, typeof SignatureInvalid, typeof EventMalformed, typeof WebhookPublicKeyMissing]>;
+}>, import("effect/Cause").YieldableError>;
+/**
+ * An upload route received a request it must refuse. Respond with a 4xx: the blob store retries an
+ * upload-completed callback that does not get a 200.
+ */
+export declare class BlobUploadEventRejected extends BlobUploadEventRejected_base {
+}
+declare const BlobUploadAuthorizationFailed_base: Schema.Class<BlobUploadAuthorizationFailed, Schema.TaggedStruct<"BlobUploadAuthorizationFailed", {
+    /** The route's status code; none when the request failed before a response. */
+    readonly status: Schema.Option<Schema.Int>;
+    readonly message: Schema.String;
+    readonly cause: Schema.optional<Schema.Defect>;
+}>, import("effect/Cause").YieldableError>;
+/** The browser could not get a client token or presigned URL from the upload route. */
+export declare class BlobUploadAuthorizationFailed extends BlobUploadAuthorizationFailed_base {
+}
+export {};
+//# sourceMappingURL=blob-errors.d.ts.map

package/dist/contracts/blob-errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"blob-errors.d.ts","sourceRoot":"","sources":["../../src/contracts/blob-errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;;IAI9B,8CAA8C;;;AAFhD,6CAA6C;AAC7C,qBAAa,YAAa,SAAQ,iBAGhC;CAAG;;AAEL,iFAAiF;AACjF,qBAAa,iBAAkB,SAAQ,sBAGtC;CAAG;;AAEJ,mGAAmG;AACnG,qBAAa,kBAAmB,SAAQ,uBAGvC;CAAG;;;;AAEJ,0CAA0C;AAC1C,qBAAa,oBAAqB,SAAQ,yBAKzC;CAAG;;AAEJ,mGAAmG;AACnG,qBAAa,sBAAuB,SAAQ,2BAG3C;CAAG;;;;AAEJ,8EAA8E;AAC9E,qBAAa,qBAAsB,SAAQ,0BAK1C;CAAG;;;;AAEJ,uFAAuF;AACvF,qBAAa,YAAa,SAAQ,iBAEhC;CAAG;;;;AAEL,kFAAkF;AAClF,qBAAa,gBAAiB,SAAQ,qBAEpC;CAAG;;AAEL,kDAAkD;AAClD,qBAAa,kBAAmB,SAAQ,uBAGvC;CAAG;;;;AAEJ,+EAA+E;AAC/E,qBAAa,kBAAmB,SAAQ,uBAUvC;CAAG;;;;AAEJ;;;GAGG;AACH,qBAAa,yBAA0B,SAAQ,8BAK9C;CAAG;;;;AAEJ;;;GAGG;AACH,qBAAa,6BAA8B,SAAQ,kCAKlD;CAAG;;;;AAEJ;;;GAGG;AACH,qBAAa,0BAA2B,SAAQ,+BAK/C;CAAG;;;;AAEJ,6FAA6F;AAC7F,qBAAa,iBAAkB,SAAQ,sBAKtC;CAAG;;AAEJ,iDAAiD;AACjD,qBAAa,gBAAiB,SAAQ,qBAGrC;CAAG;;AAEJ,+DAA+D;AAC/D,qBAAa,gBAAiB,SAAQ,qBAGrC;CAAG;;;;AAEJ,iEAAiE;AACjE,qBAAa,cAAe,SAAQ,mBAElC;CAAG;;AAEL,mFAAmF;AACnF,qBAAa,uBAAwB,SAAQ,4BAG5C;CAAG;;;;AAEJ;;;GAGG;AACH,qBAAa,uBAAwB,SAAQ,4BAU5C;CAAG;;IAMA,+EAA+E;;;;;AAJnF,uFAAuF;AACvF,qBAAa,6BAA8B,SAAQ,kCAQlD;CAAG"}

package/dist/contracts/blob-errors.js

@@ -0,0 +1,114 @@
+import { Schema } from "effect";
+/** The blob does not exist (`not_found`). */
+export class BlobNotFound extends Schema.TaggedError()("BlobNotFound", {
+    /** The pathname or URL that was requested. */
+    locator: Schema.String,
+}) {
+}
+/** The store addressed by the credentials does not exist (`store_not_found`). */
+export class BlobStoreNotFound extends Schema.TaggedError()("BlobStoreNotFound", {}) {
+}
+/** The store has been suspended, for example for exceeding the Hobby quota (`store_suspended`). */
+export class BlobStoreSuspended extends Schema.TaggedError()("BlobStoreSuspended", {}) {
+}
+/** The store cannot serve any request. */
+export class BlobStoreUnavailable extends Schema.TaggedError()("BlobStoreUnavailable", {
+    reason: Schema.Union([BlobStoreNotFound, BlobStoreSuspended]),
+}) {
+}
+/** A conditional write or delete found a different ETag than `ifMatch` (`precondition_failed`). */
+export class BlobPreconditionFailed extends Schema.TaggedError()("BlobPreconditionFailed", {}) {
+}
+/** The upload's media type is not among the token's `allowedContentTypes`. */
+export class ContentTypeNotAllowed extends Schema.TaggedError()("ContentTypeNotAllowed", {
+    message: Schema.String,
+}) {
+}
+/** The upload is larger than `maximumSizeInBytes`, checked locally or by the store. */
+export class FileTooLarge extends Schema.TaggedError()("FileTooLarge", {
+    message: Schema.String,
+}) {
+}
+/** The upload's pathname differs from the one the client token was issued for. */
+export class PathnameMismatch extends Schema.TaggedError()("PathnameMismatch", {
+    message: Schema.String,
+}) {
+}
+/** The client token's `validUntil` has passed. */
+export class ClientTokenExpired extends Schema.TaggedError()("ClientTokenExpired", {}) {
+}
+/** The store refused an upload because it breaks a constraint of its token. */
+export class BlobUploadRejected extends Schema.TaggedError()("BlobUploadRejected", {
+    reason: Schema.Union([
+        ContentTypeNotAllowed,
+        FileTooLarge,
+        PathnameMismatch,
+        ClientTokenExpired,
+    ]),
+}) {
+}
+/**
+ * The operation needs a read-write or OIDC token and was called with a client token
+ * (`client_token_not_allowed`), such as `rename`.
+ */
+export class BlobClientTokenNotAllowed extends Schema.TaggedError()("BlobClientTokenNotAllowed", {
+    message: Schema.String,
+}) {
+}
+/**
+ * The project enables OIDC for Blob but not for the environment the token was issued in
+ * (`oidc_environment_not_allowed`). Enable it in the store's settings or use a read-write token.
+ */
+export class BlobOidcEnvironmentNotAllowed extends Schema.TaggedError()("BlobOidcEnvironmentNotAllowed", {
+    message: Schema.String,
+}) {
+}
+/**
+ * The operation signs with the store's read-write token, and none is configured. OIDC is not
+ * enough for client tokens and their callbacks; set `BLOB_READ_WRITE_TOKEN`.
+ */
+export class BlobReadWriteTokenRequired extends Schema.TaggedError()("BlobReadWriteTokenRequired", {
+    operation: Schema.String,
+}) {
+}
+/** A presigned URL could not be signed: the token's scope or the options do not allow it. */
+export class BlobPresignFailed extends Schema.TaggedError()("BlobPresignFailed", {
+    message: Schema.String,
+}) {
+}
+/** The `x-vercel-signature` header is absent. */
+export class SignatureMissing extends Schema.TaggedError()("SignatureMissing", {}) {
+}
+/** The `x-vercel-signature` header does not match the body. */
+export class SignatureInvalid extends Schema.TaggedError()("SignatureInvalid", {}) {
+}
+/** The request body is not a known upload event, or not JSON. */
+export class EventMalformed extends Schema.TaggedError()("EventMalformed", {
+    message: Schema.String,
+}) {
+}
+/** The presigned flow has no webhook public key: set `BLOB_WEBHOOK_PUBLIC_KEY`. */
+export class WebhookPublicKeyMissing extends Schema.TaggedError()("WebhookPublicKeyMissing", {}) {
+}
+/**
+ * An upload route received a request it must refuse. Respond with a 4xx: the blob store retries an
+ * upload-completed callback that does not get a 200.
+ */
+export class BlobUploadEventRejected extends Schema.TaggedError()("BlobUploadEventRejected", {
+    reason: Schema.Union([
+        SignatureMissing,
+        SignatureInvalid,
+        EventMalformed,
+        WebhookPublicKeyMissing,
+    ]),
+}) {
+}
+/** The browser could not get a client token or presigned URL from the upload route. */
+export class BlobUploadAuthorizationFailed extends Schema.TaggedError()("BlobUploadAuthorizationFailed", {
+    /** The route's status code; none when the request failed before a response. */
+    status: Schema.Option(Schema.Int),
+    message: Schema.String,
+    cause: Schema.optional(Schema.Defect()),
+}) {
+}
+//# sourceMappingURL=blob-errors.js.map

package/dist/contracts/blob-errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"blob-errors.js","sourceRoot":"","sources":["../../src/contracts/blob-errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,6CAA6C;AAC7C,MAAM,OAAO,YAAa,SAAQ,MAAM,CAAC,WAAW,EAAgB,CAAC,cAAc,EAAE;IACnF,8CAA8C;IAC9C,OAAO,EAAE,MAAM,CAAC,MAAM;CACvB,CAAC;CAAG;AAEL,iFAAiF;AACjF,MAAM,OAAO,iBAAkB,SAAQ,MAAM,CAAC,WAAW,EAAqB,CAC5E,mBAAmB,EACnB,EAAE,CACH;CAAG;AAEJ,mGAAmG;AACnG,MAAM,OAAO,kBAAmB,SAAQ,MAAM,CAAC,WAAW,EAAsB,CAC9E,oBAAoB,EACpB,EAAE,CACH;CAAG;AAEJ,0CAA0C;AAC1C,MAAM,OAAO,oBAAqB,SAAQ,MAAM,CAAC,WAAW,EAAwB,CAClF,sBAAsB,EACtB;IACE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,iBAAiB,EAAE,kBAAkB,CAAC,CAAC;CAC9D,CACF;CAAG;AAEJ,mGAAmG;AACnG,MAAM,OAAO,sBAAuB,SAAQ,MAAM,CAAC,WAAW,EAA0B,CACtF,wBAAwB,EACxB,EAAE,CACH;CAAG;AAEJ,8EAA8E;AAC9E,MAAM,OAAO,qBAAsB,SAAQ,MAAM,CAAC,WAAW,EAAyB,CACpF,uBAAuB,EACvB;IACE,OAAO,EAAE,MAAM,CAAC,MAAM;CACvB,CACF;CAAG;AAEJ,uFAAuF;AACvF,MAAM,OAAO,YAAa,SAAQ,MAAM,CAAC,WAAW,EAAgB,CAAC,cAAc,EAAE;IACnF,OAAO,EAAE,MAAM,CAAC,MAAM;CACvB,CAAC;CAAG;AAEL,kFAAkF;AAClF,MAAM,OAAO,gBAAiB,SAAQ,MAAM,CAAC,WAAW,EAAoB,CAAC,kBAAkB,EAAE;IAC/F,OAAO,EAAE,MAAM,CAAC,MAAM;CACvB,CAAC;CAAG;AAEL,kDAAkD;AAClD,MAAM,OAAO,kBAAmB,SAAQ,MAAM,CAAC,WAAW,EAAsB,CAC9E,oBAAoB,EACpB,EAAE,CACH;CAAG;AAEJ,+EAA+E;AAC/E,MAAM,OAAO,kBAAmB,SAAQ,MAAM,CAAC,WAAW,EAAsB,CAC9E,oBAAoB,EACpB;IACE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC;QACnB,qBAAqB;QACrB,YAAY;QACZ,gBAAgB;QAChB,kBAAkB;KACnB,CAAC;CACH,CACF;CAAG;AAEJ;;;GAGG;AACH,MAAM,OAAO,yBAA0B,SAAQ,MAAM,CAAC,WAAW,EAA6B,CAC5F,2BAA2B,EAC3B;IACE,OAAO,EAAE,MAAM,CAAC,MAAM;CACvB,CACF;CAAG;AAEJ;;;GAGG;AACH,MAAM,OAAO,6BAA8B,SAAQ,MAAM,CAAC,WAAW,EAAiC,CACpG,+BAA+B,EAC/B;IACE,OAAO,EAAE,MAAM,CAAC,MAAM;CACvB,CACF;CAAG;AAEJ;;;GAGG;AACH,MAAM,OAAO,0BAA2B,SAAQ,MAAM,CAAC,WAAW,EAA8B,CAC9F,4BAA4B,EAC5B;IACE,SAAS,EAAE,MAAM,CAAC,MAAM;CACzB,CACF;CAAG;AAEJ,6FAA6F;AAC7F,MAAM,OAAO,iBAAkB,SAAQ,MAAM,CAAC,WAAW,EAAqB,CAC5E,mBAAmB,EACnB;IACE,OAAO,EAAE,MAAM,CAAC,MAAM;CACvB,CACF;CAAG;AAEJ,iDAAiD;AACjD,MAAM,OAAO,gBAAiB,SAAQ,MAAM,CAAC,WAAW,EAAoB,CAC1E,kBAAkB,EAClB,EAAE,CACH;CAAG;AAEJ,+DAA+D;AAC/D,MAAM,OAAO,gBAAiB,SAAQ,MAAM,CAAC,WAAW,EAAoB,CAC1E,kBAAkB,EAClB,EAAE,CACH;CAAG;AAEJ,iEAAiE;AACjE,MAAM,OAAO,cAAe,SAAQ,MAAM,CAAC,WAAW,EAAkB,CAAC,gBAAgB,EAAE;IACzF,OAAO,EAAE,MAAM,CAAC,MAAM;CACvB,CAAC;CAAG;AAEL,mFAAmF;AACnF,MAAM,OAAO,uBAAwB,SAAQ,MAAM,CAAC,WAAW,EAA2B,CACxF,yBAAyB,EACzB,EAAE,CACH;CAAG;AAEJ;;;GAGG;AACH,MAAM,OAAO,uBAAwB,SAAQ,MAAM,CAAC,WAAW,EAA2B,CACxF,yBAAyB,EACzB;IACE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC;QACnB,gBAAgB;QAChB,gBAAgB;QAChB,cAAc;QACd,uBAAuB;KACxB,CAAC;CACH,CACF;CAAG;AAEJ,uFAAuF;AACvF,MAAM,OAAO,6BAA8B,SAAQ,MAAM,CAAC,WAAW,EAAiC,CACpG,+BAA+B,EAC/B;IACE,+EAA+E;IAC/E,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC,MAAM;IACtB,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;CACxC,CACF;CAAG"}

package/dist/contracts/blob-signed-urls.d.ts

@@ -0,0 +1,83 @@
+import type { Array, DateTime, Effect } from "effect";
+import { Context } from "effect";
+import type { BlobAccess, DelegationOperation, ETag, PresignedUrlPayload, SignedToken } from "./blob-domain.ts";
+import type { BlobPresignFailed } from "./blob-errors.ts";
+import type { BlobRequestError } from "./blob-store.ts";
+/** Scope of a signed token. Every field narrows what presigned URLs signed from it may do. */
+export interface IssueSignedTokenOptions {
+    /** Pathname the token covers; `*` or omitted covers the whole store. */
+    readonly pathname?: string | undefined;
+    /** Operations the token delegates; the store defaults to `get`. Duplicates are removed. */
+    readonly operations?: Array.NonEmptyReadonlyArray<DelegationOperation> | undefined;
+    /** Expiry, in the future and at most 7 days away; the store defaults to one hour. */
+    readonly validUntil?: DateTime.Utc | undefined;
+    /** Largest upload a presigned `put` may send. */
+    readonly maximumSizeInBytes?: number | undefined;
+    /** Media types a presigned `put` may upload; wildcards such as `image/*` are allowed. */
+    readonly allowedContentTypes?: ReadonlyArray<string> | undefined;
+}
+/** Callback the store calls after a presigned upload completes. */
+export interface PresignUploadCompleted {
+    /** Absolute URL of the route that handles `blob.upload-completed`. */
+    readonly callbackUrl: string;
+    /** Data passed back to the callback, such as the uploading user's id. */
+    readonly tokenPayload?: string | undefined;
+}
+/** What one presigned URL authorizes. Constraints may only narrow the signed token's. */
+export type PresignOptions = {
+    readonly operation: "get";
+    readonly pathname: string;
+    /** Earlier expiry than the token's. */
+    readonly validUntil?: DateTime.Utc | undefined;
+    /** Add `cache=0` to read a private blob from origin storage; not signed. */
+    readonly useCache?: boolean | undefined;
+} | {
+    readonly operation: "head";
+    readonly pathname: string;
+    readonly validUntil?: DateTime.Utc | undefined;
+} | {
+    readonly operation: "put";
+    readonly pathname: string;
+    readonly validUntil?: DateTime.Utc | undefined;
+    readonly allowedContentTypes?: ReadonlyArray<string> | undefined;
+    readonly maximumSizeInBytes?: number | undefined;
+    readonly onUploadCompleted?: PresignUploadCompleted | undefined;
+    readonly allowOverwrite?: boolean | undefined;
+    readonly addRandomSuffix?: boolean | undefined;
+    /** In seconds, at most one year. */
+    readonly cacheControlMaxAge?: number | undefined;
+    readonly ifMatch?: ETag | undefined;
+} | {
+    readonly operation: "delete";
+    readonly pathname: string;
+    readonly validUntil?: DateTime.Utc | undefined;
+    readonly ifMatch?: ETag | undefined;
+};
+/** The secret and public halves of a signed token, as needed to presign. */
+export type SigningToken = Pick<SignedToken, "delegationToken" | "clientSigningToken">;
+declare const BlobSignedUrls_base: Context.ServiceClass<BlobSignedUrls, "@effect-vercel/blob/BlobSignedUrls", {
+    /** Ask the store for a signed token (`POST /signed-token`). */
+    readonly issueSignedToken: (options?: IssueSignedTokenOptions) => Effect.Effect<SignedToken, BlobRequestError>;
+    /**
+     * Sign one request. Fails with `BlobPresignFailed` when the token has expired, does not delegate
+     * the operation, covers another pathname, or allows less than the options ask for.
+     */
+    readonly presign: (token: SigningToken, options: PresignOptions) => Effect.Effect<PresignedUrlPayload, BlobPresignFailed>;
+    /**
+     * Sign one request and build its URL: the blob URL for `get` and `head`, the Blob API URL for
+     * `put` and `delete`.
+     */
+    readonly presignUrl: (token: SigningToken, options: PresignOptions & {
+        readonly access: BlobAccess;
+    }) => Effect.Effect<URL, BlobPresignFailed>;
+}>;
+/**
+ * Signed URLs: delegate one operation on one pathname to a holder of a URL, without credentials.
+ *
+ * Issue a {@link SignedToken} once (one API call) and cache it until shortly before it expires;
+ * presigning is local HMAC-SHA256 signing.
+ */
+export declare class BlobSignedUrls extends BlobSignedUrls_base {
+}
+export {};
+//# sourceMappingURL=blob-signed-urls.d.ts.map

package/dist/contracts/blob-signed-urls.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"blob-signed-urls.d.ts","sourceRoot":"","sources":["../../src/contracts/blob-signed-urls.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEtD,OAAO,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AAEjC,OAAO,KAAK,EACV,UAAU,EACV,mBAAmB,EACnB,IAAI,EACJ,mBAAmB,EACnB,WAAW,EACZ,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAExD,8FAA8F;AAC9F,MAAM,WAAW,uBAAuB;IACtC,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEvC,2FAA2F;IAC3F,QAAQ,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,qBAAqB,CAAC,mBAAmB,CAAC,GAAG,SAAS,CAAC;IAEnF,qFAAqF;IACrF,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,GAAG,GAAG,SAAS,CAAC;IAE/C,iDAAiD;IACjD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEjD,yFAAyF;IACzF,QAAQ,CAAC,mBAAmB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;CAClE;AAED,mEAAmE;AACnE,MAAM,WAAW,sBAAsB;IACrC,sEAAsE;IACtE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,yEAAyE;IACzE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5C;AAED,yFAAyF;AACzF,MAAM,MAAM,cAAc,GACtB;IACE,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,uCAAuC;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,GAAG,GAAG,SAAS,CAAC;IAC/C,4EAA4E;IAC5E,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACzC,GACD;IACE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,GAAG,GAAG,SAAS,CAAC;CAChD,GACD;IACE,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,GAAG,GAAG,SAAS,CAAC;IAC/C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;IACjE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,sBAAsB,GAAG,SAAS,CAAC;IAChE,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC/C,oCAAoC;IACpC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjD,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;CACrC,GACD;IACE,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,GAAG,GAAG,SAAS,CAAC;IAC/C,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;CACrC,CAAC;AAEN,4EAA4E;AAC5E,MAAM,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,EAAE,iBAAiB,GAAG,oBAAoB,CAAC,CAAC;;IAWnF,+DAA+D;+BACpC,CACzB,OAAO,CAAC,EAAE,uBAAuB,KAC9B,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,gBAAgB,CAAC;IAEjD;;;OAGG;sBACe,CAChB,KAAK,EAAE,YAAY,EACnB,OAAO,EAAE,cAAc,KACpB,MAAM,CAAC,MAAM,CAAC,mBAAmB,EAAE,iBAAiB,CAAC;IAE1D;;;OAGG;yBACkB,CACnB,KAAK,EAAE,YAAY,EACnB,OAAO,EAAE,cAAc,GAAG;QAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;KAAE,KACtD,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,iBAAiB,CAAC;;AA9B9C;;;;;GAKG;AACH,qBAAa,cAAe,SAAQ,mBA0BK;CAAG"}

package/dist/contracts/blob-signed-urls.js

@@ -0,0 +1,10 @@
+import { Context } from "effect";
+/**
+ * Signed URLs: delegate one operation on one pathname to a holder of a URL, without credentials.
+ *
+ * Issue a {@link SignedToken} once (one API call) and cache it until shortly before it expires;
+ * presigning is local HMAC-SHA256 signing.
+ */
+export class BlobSignedUrls extends Context.Service()("@effect-vercel/blob/BlobSignedUrls") {
+}
+//# sourceMappingURL=blob-signed-urls.js.map

package/dist/contracts/blob-signed-urls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"blob-signed-urls.js","sourceRoot":"","sources":["../../src/contracts/blob-signed-urls.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AA6EjC;;;;;GAKG;AACH,MAAM,OAAO,cAAe,SAAQ,OAAO,CAAC,OAAO,EA0BhD,CAAC,oCAAoC,CAAC;CAAG"}