@panorama-industries/effect-vercel-blob 0.0.0-stage → 0.2.0

package/dist/internal/presign.d.ts

@@ -0,0 +1,123 @@
+import { Effect, Option, Schema } from "effect";
+import type { BlobAccess, DelegationOperation, StoreId } from "../contracts/blob-domain.ts";
+import type { PresignOptions, SigningToken } from "../contracts/blob-signed-urls.ts";
+import { PresignedUrlPayload } from "../contracts/blob-domain.ts";
+import { BlobPresignFailed } from "../contracts/blob-errors.ts";
+/** Signed expiry of one URL, when earlier than the delegation's. */
+export declare const presignQueryValidUntil = "vercel-blob-valid-until";
+/** Largest upload a presigned `put` accepts. */
+export declare const presignQueryMaximumSize = "vercel-blob-maximum-size-in-bytes";
+/** Media types a presigned `put` accepts, sorted and comma-separated. */
+export declare const presignQueryAllowedContentTypes = "vercel-blob-allowed-content-types";
+/** `true`/`false`. */
+export declare const presignQueryAddRandomSuffix = "vercel-blob-add-random-suffix";
+/** `true`/`false`. */
+export declare const presignQueryAllowOverwrite = "vercel-blob-allow-overwrite";
+/** Seconds. */
+export declare const presignQueryCacheControlMaxAge = "vercel-blob-cache-control-max-age";
+/** ETag a presigned `put` or `delete` requires. */
+export declare const presignQueryIfMatch = "vercel-blob-if-match";
+/** Where the store sends `blob.upload-completed`. */
+export declare const presignQueryCallbackUrl = "vercel-blob-callback-url";
+/** `tokenPayload` of the upload-completed callback. */
+export declare const presignQueryCallbackTokenPayload = "vercel-blob-callback-token-payload";
+/** Every signed constraint, in UTF-8 order, as the SDK's `PRESIGN_CANONICAL_QUERY_KEYS`. */
+export declare const presignCanonicalQueryKeys: readonly ["vercel-blob-add-random-suffix", "vercel-blob-allow-overwrite", "vercel-blob-allowed-content-types", "vercel-blob-cache-control-max-age", "vercel-blob-callback-token-payload", "vercel-blob-callback-url", "vercel-blob-if-match", "vercel-blob-maximum-size-in-bytes", "vercel-blob-valid-until"];
+/** Longest `onUploadCompleted.callbackUrl` a presigned URL may carry. */
+export declare const maximumPresignCallbackUrlLength = 4096;
+/** Longest `onUploadCompleted.tokenPayload` a presigned URL may carry. */
+export declare const maximumPresignCallbackTokenPayloadLength = 8192;
+/** Largest `cacheControlMaxAge` a presigned URL may carry: one year, in seconds. */
+export declare const maximumPresignCacheControlMaxAge: number;
+/** One signed query parameter. */
+export type PresignQueryEntry = readonly [key: string, value: string];
+/** What a delegation token's payload constrains, as the SDK reads it for presigning. */
+export declare const DelegationScope: Schema.Struct<{
+    readonly pathname: Schema.optionalKey<Schema.String>;
+    readonly operations: Schema.optionalKey<Schema.$Array<Schema.String>>;
+    /** Epoch milliseconds. */
+    readonly validUntil: Schema.optionalKey<Schema.Number>;
+    readonly maximumSizeInBytes: Schema.optionalKey<Schema.Number>;
+    readonly allowedContentTypes: Schema.optionalKey<Schema.$Array<Schema.String>>;
+}>;
+/** What a delegation token's payload constrains. */
+export type DelegationScope = typeof DelegationScope.Type;
+/**
+ * Read the scope of a delegation token: the base64url JSON before its first `.`. Standard base64
+ * characters and padding are accepted, as the SDK's decoder accepts them.
+ *
+ * @returns None when the token has no `.` or the segment is not base64url JSON of an object.
+ */
+export declare const delegationScope: (delegationToken: string) => Option.Option<DelegationScope>;
+/**
+ * The string a presigned URL's signature covers, as the SDK's `canonicalString`: `operation=…`,
+ * `pathname=…` and every non-empty signed entry as `key=value`, sorted bytewise and joined by `\n`.
+ */
+export declare const canonicalString: (pathname: string, entries: ReadonlyArray<PresignQueryEntry>, operation: DelegationOperation) => string;
+/** HMAC-SHA256 of `data` keyed by `secret` (both UTF-8), as unpadded base64url. */
+export declare const hmacSha256Base64Url: (secret: string, data: string) => Effect.Effect<string, never, never>;
+/** Signed constraints of one presigned URL, in epoch milliseconds and seconds as on the wire. */
+export interface PresignUrlConstraints {
+    readonly validUntil?: number | undefined;
+    readonly allowedContentTypes?: ReadonlyArray<string> | undefined;
+    readonly maximumSizeInBytes?: number | undefined;
+    readonly addRandomSuffix?: boolean | undefined;
+    readonly allowOverwrite?: boolean | undefined;
+    readonly cacheControlMaxAge?: number | undefined;
+    readonly ifMatch?: string | undefined;
+    readonly onUploadCompleted?: {
+        readonly callbackUrl: string;
+        readonly tokenPayload?: string | null | undefined;
+    } | undefined;
+}
+/** What the delegation allows, as the SDK's `DelegationScopeForPresign`. */
+export interface PresignDelegation {
+    /** Epoch milliseconds; none when the delegation states no expiry. */
+    readonly validUntil: number | undefined;
+    readonly maximumSizeInBytes?: number | undefined;
+    readonly allowedContentTypes?: ReadonlyArray<string> | undefined;
+}
+/**
+ * The signed query entries of one presigned URL, as the SDK's `buildPresignCanonicalQueryEntries`,
+ * in the same order. `vercel-blob-valid-until` is left out when it equals the delegation's expiry;
+ * `get` and `head` sign only the expiry, `delete` also `ifMatch`, and `put` every constraint after
+ * checking that each one only narrows the delegation's.
+ */
+export declare const presignCanonicalQueryEntries: (args: {
+    readonly operation: DelegationOperation;
+    readonly delegation: PresignDelegation;
+    readonly urlOptions: PresignUrlConstraints;
+    readonly now: number;
+}) => Effect.Effect<PresignQueryEntry[], BlobPresignFailed, never>;
+/**
+ * Sign one request with a signed token, as the SDK's `presign`: check the delegation's pathname,
+ * expiry and operations, build the signed query entries, and HMAC their canonical string with the
+ * client signing token.
+ *
+ * @param now - Current time in epoch milliseconds.
+ * @returns The payload, or `BlobPresignFailed` with the SDK's message.
+ */
+export declare const presignPayload: (token: SigningToken, options: PresignOptions, now: number) => Effect.Effect<PresignedUrlPayload, BlobPresignFailed, never>;
+/** `url` with the payload's params, `vercel-blob-delegation` and `vercel-blob-signature` set. */
+export declare const withPresignedParams: (url: URL, payload: PresignedUrlPayload) => URL;
+/**
+ * The presigned URL of a `get` or `head`, as the SDK's `buildPresignedGetUrl`: a blob URL is used
+ * as is, a pathname is resolved under the delegation's store (`blobBaseUrl`); `cache=0` (unsigned)
+ * is added for a private `get` with `useCache: false`.
+ *
+ * @returns None when the delegation token carries no valid store id, which the SDK requires even
+ *   for a blob URL.
+ */
+export declare const presignedBlobUrl: (args: {
+    readonly pathnameOrUrl: string;
+    readonly payload: PresignedUrlPayload;
+    readonly access: BlobAccess;
+    readonly useCache: boolean | undefined;
+    readonly blobBaseUrl: (storeId: StoreId, access: BlobAccess) => URL;
+}) => Option.Option<URL>;
+/**
+ * The presigned URL of a `put` or `delete`, as the SDK's `buildPresignedPutUrl`: the Blob API's
+ * `/?pathname=…` (trailing slashes of `apiUrl` removed) plus the payload's params.
+ */
+export declare const presignedApiUrl: (apiUrl: URL, pathname: string, payload: PresignedUrlPayload) => URL;
+//# sourceMappingURL=presign.d.ts.map

package/dist/internal/presign.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"presign.d.ts","sourceRoot":"","sources":["../../src/internal/presign.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,MAAM,EAAE,MAAM,EAAoB,MAAM,EAAE,MAAM,QAAQ,CAAC;AAG5E,OAAO,KAAK,EAAE,UAAU,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAC;AAC5F,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAErF,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAUhE,oEAAoE;AACpE,eAAO,MAAM,sBAAsB,4BAA4B,CAAC;AAChE,gDAAgD;AAChD,eAAO,MAAM,uBAAuB,sCAAsC,CAAC;AAC3E,yEAAyE;AACzE,eAAO,MAAM,+BAA+B,sCAAsC,CAAC;AACnF,sBAAsB;AACtB,eAAO,MAAM,2BAA2B,kCAAkC,CAAC;AAC3E,sBAAsB;AACtB,eAAO,MAAM,0BAA0B,gCAAgC,CAAC;AACxE,eAAe;AACf,eAAO,MAAM,8BAA8B,sCAAsC,CAAC;AAClF,mDAAmD;AACnD,eAAO,MAAM,mBAAmB,yBAAyB,CAAC;AAC1D,qDAAqD;AACrD,eAAO,MAAM,uBAAuB,6BAA6B,CAAC;AAClE,uDAAuD;AACvD,eAAO,MAAM,gCAAgC,uCAAuC,CAAC;AAErF,4FAA4F;AAC5F,eAAO,MAAM,yBAAyB,+SAU5B,CAAC;AAEX,yEAAyE;AACzE,eAAO,MAAM,+BAA+B,OAAO,CAAC;AAEpD,0EAA0E;AAC1E,eAAO,MAAM,wCAAwC,OAAO,CAAC;AAE7D,oFAAoF;AACpF,eAAO,MAAM,gCAAgC,QAAqB,CAAC;AASnE,kCAAkC;AAClC,MAAM,MAAM,iBAAiB,GAAG,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AAEtE,wFAAwF;AACxF,eAAO,MAAM,eAAe;;;IAG1B,0BAA0B;;;;EAI1B,CAAC;AAEH,oDAAoD;AACpD,MAAM,MAAM,eAAe,GAAG,OAAO,eAAe,CAAC,IAAI,CAAC;AAI1D;;;;;GAKG;AACH,eAAO,MAAM,eAAe,oBAAqB,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,eAAe,CAWtF,CAAC;AAkBF;;;GAGG;AACH,eAAO,MAAM,eAAe,aAChB,MAAM,WACP,aAAa,CAAC,iBAAiB,CAAC,aAC9B,mBAAmB,KAC7B,MASF,CAAC;AAEF,mFAAmF;AACnF,eAAO,MAAM,mBAAmB,uEAc9B,CAAC;AAIH,iGAAiG;AACjG,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;IACjE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjD,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC/C,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,iBAAiB,CAAC,EACvB;QAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;KAAE,GACnF,SAAS,CAAC;CACf;AAED,4EAA4E;AAC5E,MAAM,WAAW,iBAAiB;IAChC,qEAAqE;IACrE,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjD,QAAQ,CAAC,mBAAmB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;CAClE;AAiGD;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B;wBACnB,mBAAmB;yBAClB,iBAAiB;yBACjB,qBAAqB;kBAC5B,MAAM;kEAsDpB,CAAC;AAoCH;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,6HA2CzB,CAAC;AAEH,iGAAiG;AACjG,eAAO,MAAM,mBAAmB,QAAS,GAAG,WAAW,mBAAmB,KAAG,GAQ5E,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,SAAU;IACrC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,KAAK,GAAG,CAAC;CACrE,KAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CASjB,CAAC;AAEL;;;GAGG;AACH,eAAO,MAAM,eAAe,WAClB,GAAG,YACD,MAAM,WACP,mBAAmB,KAC3B,GAMF,CAAC"}

package/dist/internal/presign.js

@@ -0,0 +1,345 @@
+import { DateTime, Effect, Option, Redacted, Result, Schema } from "effect";
+import { Base64Url } from "effect/encoding";
+import { PresignedUrlPayload } from "../contracts/blob-domain.js";
+import { BlobPresignFailed } from "../contracts/blob-errors.js";
+import { storeIdFromDelegationToken } from "./store-id.js";
+import { blobUrl, isUrl } from "./urls.js";
+/*
+ * Presigned URLs, ported from the SDK's `signed-token.ts` (`presign`, `presignUrl`,
+ * `canonicalString`) and `presign-query-params.ts`. The canonical string and query entries must
+ * stay aligned with the Blob API and proxy that verify them.
+ */
+/** Signed expiry of one URL, when earlier than the delegation's. */
+export const presignQueryValidUntil = "vercel-blob-valid-until";
+/** Largest upload a presigned `put` accepts. */
+export const presignQueryMaximumSize = "vercel-blob-maximum-size-in-bytes";
+/** Media types a presigned `put` accepts, sorted and comma-separated. */
+export const presignQueryAllowedContentTypes = "vercel-blob-allowed-content-types";
+/** `true`/`false`. */
+export const presignQueryAddRandomSuffix = "vercel-blob-add-random-suffix";
+/** `true`/`false`. */
+export const presignQueryAllowOverwrite = "vercel-blob-allow-overwrite";
+/** Seconds. */
+export const presignQueryCacheControlMaxAge = "vercel-blob-cache-control-max-age";
+/** ETag a presigned `put` or `delete` requires. */
+export const presignQueryIfMatch = "vercel-blob-if-match";
+/** Where the store sends `blob.upload-completed`. */
+export const presignQueryCallbackUrl = "vercel-blob-callback-url";
+/** `tokenPayload` of the upload-completed callback. */
+export const presignQueryCallbackTokenPayload = "vercel-blob-callback-token-payload";
+/** Every signed constraint, in UTF-8 order, as the SDK's `PRESIGN_CANONICAL_QUERY_KEYS`. */
+export const presignCanonicalQueryKeys = [
+    presignQueryAddRandomSuffix,
+    presignQueryAllowOverwrite,
+    presignQueryAllowedContentTypes,
+    presignQueryCacheControlMaxAge,
+    presignQueryCallbackTokenPayload,
+    presignQueryCallbackUrl,
+    presignQueryIfMatch,
+    presignQueryMaximumSize,
+    presignQueryValidUntil,
+];
+/** Longest `onUploadCompleted.callbackUrl` a presigned URL may carry. */
+export const maximumPresignCallbackUrlLength = 4096;
+/** Longest `onUploadCompleted.tokenPayload` a presigned URL may carry. */
+export const maximumPresignCallbackTokenPayloadLength = 8192;
+/** Largest `cacheControlMaxAge` a presigned URL may carry: one year, in seconds. */
+export const maximumPresignCacheControlMaxAge = 365 * 24 * 60 * 60;
+const maximumIfMatchLength = 256;
+// oxlint-disable-next-line no-control-regex -- control characters are what it rejects
+const ifMatchControlCharacters = /[\x00-\x1f\x7f]/;
+const label = "presignUrl";
+/** What a delegation token's payload constrains, as the SDK reads it for presigning. */
+export const DelegationScope = Schema.Struct({
+    pathname: Schema.optionalKey(Schema.String),
+    operations: Schema.optionalKey(Schema.Array(Schema.String)),
+    /** Epoch milliseconds. */
+    validUntil: Schema.optionalKey(Schema.Number),
+    maximumSizeInBytes: Schema.optionalKey(Schema.Number),
+    allowedContentTypes: Schema.optionalKey(Schema.Array(Schema.String)),
+});
+const decodeScope = Schema.decodeUnknownOption(Schema.fromJsonString(DelegationScope));
+/**
+ * Read the scope of a delegation token: the base64url JSON before its first `.`. Standard base64
+ * characters and padding are accepted, as the SDK's decoder accepts them.
+ *
+ * @returns None when the token has no `.` or the segment is not base64url JSON of an object.
+ */
+export const delegationScope = (delegationToken) => {
+    const dot = delegationToken.indexOf(".");
+    if (dot < 0) {
+        return Option.none();
+    }
+    const segment = delegationToken
+        .slice(0, dot)
+        .replace(/\+/g, "-")
+        .replace(/\//g, "_")
+        .replace(/=+$/, "");
+    return Result.getSuccess(Base64Url.decodeString(segment)).pipe(Option.flatMap(decodeScope));
+};
+const utf8 = new TextEncoder();
+/** Bytewise UTF-8 order, as the SDK's `compareUtf8` (Go string order). */
+const compareUtf8 = (a, b) => {
+    const left = utf8.encode(a);
+    const right = utf8.encode(b);
+    const length = Math.min(left.length, right.length);
+    for (let i = 0; i < length; i++) {
+        const difference = left[i] - right[i];
+        if (difference !== 0) {
+            return difference;
+        }
+    }
+    return left.length - right.length;
+};
+/**
+ * The string a presigned URL's signature covers, as the SDK's `canonicalString`: `operation=…`,
+ * `pathname=…` and every non-empty signed entry as `key=value`, sorted bytewise and joined by `\n`.
+ */
+export const canonicalString = (pathname, entries, operation) => {
+    const lines = [`operation=${operation}`, `pathname=${pathname}`];
+    for (const key of presignCanonicalQueryKeys) {
+        const value = entries.find(([entry]) => entry === key)?.[1];
+        if (value) {
+            lines.push(`${key}=${value}`);
+        }
+    }
+    return lines.sort(compareUtf8).join("\n");
+};
+/** HMAC-SHA256 of `data` keyed by `secret` (both UTF-8), as unpadded base64url. */
+export const hmacSha256Base64Url = Effect.fnUntraced(function* (secret, data) {
+    const key = yield* Effect.promise(() => globalThis.crypto.subtle.importKey("raw", utf8.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]));
+    const signature = yield* Effect.promise(() => globalThis.crypto.subtle.sign("HMAC", key, utf8.encode(data)));
+    return Base64Url.encode(new Uint8Array(signature));
+});
+const failed = (message) => Effect.fail(new BlobPresignFailed({ message }));
+const contentTypeAllowed = (contentType, allowed) => {
+    const [type] = contentType.split("/");
+    return allowed.includes(contentType) || (type ? allowed.includes(`${type}/*`) : false);
+};
+/**
+ * The URL's expiry, as the SDK's `resolvePresignUrlValidUntilMs`: the requested one capped to the
+ * delegation's, which must be after `now`. A delegation without an expiry and no requested one
+ * yields `NaN`, as in the SDK, which then signs no expiry.
+ */
+const resolveValidUntil = (delegationValidUntil, requested, now) => {
+    let until = Math.trunc(requested ?? delegationValidUntil ?? Number.NaN);
+    if (delegationValidUntil !== undefined && Number.isFinite(delegationValidUntil)) {
+        until = Math.min(until, Math.trunc(delegationValidUntil));
+    }
+    if (until <= now) {
+        return failed(`${label}: resolved URL expiry is not after the current time; issue a new delegation token or pass a later validUntil.`);
+    }
+    return Effect.succeed(until);
+};
+const validateUploadConstraints = Effect.fnUntraced(function* (options, delegation) {
+    const allowed = delegation.allowedContentTypes;
+    if (options.allowedContentTypes?.length && allowed?.length) {
+        for (const contentType of options.allowedContentTypes) {
+            if (!contentTypeAllowed(contentType, allowed)) {
+                return yield* failed(`${label}: allowedContentTypes entry "${contentType}" is not permitted by the delegation token.`);
+            }
+        }
+    }
+    if (options.maximumSizeInBytes !== undefined &&
+        delegation.maximumSizeInBytes !== undefined &&
+        options.maximumSizeInBytes > delegation.maximumSizeInBytes) {
+        return yield* failed(`${label}: maximumSizeInBytes must be ≤ delegation (${String(delegation.maximumSizeInBytes)}).`);
+    }
+    const maxAge = options.cacheControlMaxAge;
+    if (maxAge !== undefined &&
+        (!Number.isInteger(maxAge) || maxAge < 0 || maxAge > maximumPresignCacheControlMaxAge)) {
+        return yield* failed(`${label}: cacheControlMaxAge must be an integer between 0 and ${maximumPresignCacheControlMaxAge}.`);
+    }
+    const ifMatch = options.ifMatch;
+    if (ifMatch !== undefined) {
+        if (ifMatch.length === 0) {
+            return yield* failed(`${label}: ifMatch must be a non-empty string.`);
+        }
+        if (ifMatch.length > maximumIfMatchLength) {
+            return yield* failed(`${label}: ifMatch is too long.`);
+        }
+        if (ifMatchControlCharacters.test(ifMatch)) {
+            return yield* failed(`${label}: ifMatch contains disallowed control characters.`);
+        }
+    }
+    const callback = options.onUploadCompleted;
+    if (callback !== undefined) {
+        if (callback.callbackUrl.length === 0) {
+            return yield* failed(`${label}: onUploadCompleted.callbackUrl must be a non-empty string.`);
+        }
+        if (callback.callbackUrl.length > maximumPresignCallbackUrlLength) {
+            return yield* failed(`${label}: onUploadCompleted.callbackUrl is too long.`);
+        }
+        if (!URL.canParse(callback.callbackUrl)) {
+            return yield* failed(`${label}: onUploadCompleted.callbackUrl must be a valid URL.`);
+        }
+        if (callback.tokenPayload !== undefined &&
+            callback.tokenPayload !== null &&
+            callback.tokenPayload.length > maximumPresignCallbackTokenPayloadLength) {
+            return yield* failed(`${label}: onUploadCompleted.tokenPayload is too long.`);
+        }
+    }
+});
+const sortedCsv = (types) => [...types].sort((a, b) => (a < b ? -1 : a > b ? 1 : 0)).join(",");
+/**
+ * The signed query entries of one presigned URL, as the SDK's `buildPresignCanonicalQueryEntries`,
+ * in the same order. `vercel-blob-valid-until` is left out when it equals the delegation's expiry;
+ * `get` and `head` sign only the expiry, `delete` also `ifMatch`, and `put` every constraint after
+ * checking that each one only narrows the delegation's.
+ */
+export const presignCanonicalQueryEntries = Effect.fnUntraced(function* (args) {
+    const { operation, delegation, urlOptions, now } = args;
+    const until = yield* resolveValidUntil(delegation.validUntil, urlOptions.validUntil, now);
+    const entries = [];
+    if (until < Math.trunc(delegation.validUntil ?? Number.NaN)) {
+        entries.push([presignQueryValidUntil, String(until)]);
+    }
+    if (operation === "delete") {
+        if (urlOptions.ifMatch !== undefined) {
+            entries.push([presignQueryIfMatch, urlOptions.ifMatch]);
+        }
+        return entries;
+    }
+    if (operation !== "put") {
+        return entries;
+    }
+    yield* validateUploadConstraints(urlOptions, delegation);
+    if (urlOptions.allowedContentTypes !== undefined) {
+        const csv = sortedCsv(urlOptions.allowedContentTypes);
+        if (csv.length > 16_384) {
+            return yield* failed(`${label}: allowedContentTypes query value is too long.`);
+        }
+        entries.push([presignQueryAllowedContentTypes, csv]);
+    }
+    if (urlOptions.maximumSizeInBytes !== undefined) {
+        entries.push([presignQueryMaximumSize, String(Math.trunc(urlOptions.maximumSizeInBytes))]);
+    }
+    if (urlOptions.addRandomSuffix !== undefined) {
+        entries.push([presignQueryAddRandomSuffix, urlOptions.addRandomSuffix ? "true" : "false"]);
+    }
+    if (urlOptions.allowOverwrite !== undefined) {
+        entries.push([presignQueryAllowOverwrite, urlOptions.allowOverwrite ? "true" : "false"]);
+    }
+    if (urlOptions.cacheControlMaxAge !== undefined) {
+        entries.push([
+            presignQueryCacheControlMaxAge,
+            String(Math.trunc(urlOptions.cacheControlMaxAge)),
+        ]);
+    }
+    if (urlOptions.ifMatch !== undefined) {
+        entries.push([presignQueryIfMatch, urlOptions.ifMatch]);
+    }
+    if (urlOptions.onUploadCompleted !== undefined) {
+        const { callbackUrl, tokenPayload } = urlOptions.onUploadCompleted;
+        entries.push([presignQueryCallbackUrl, callbackUrl]);
+        if (tokenPayload !== undefined && tokenPayload !== null && tokenPayload !== "") {
+            entries.push([presignQueryCallbackTokenPayload, tokenPayload]);
+        }
+    }
+    return entries;
+});
+const epochMillis = (value) => value === undefined ? undefined : DateTime.toEpochMillis(value);
+/** The signed constraints of {@link PresignOptions}, in wire units. */
+const urlConstraints = (options) => {
+    const validUntil = epochMillis(options.validUntil);
+    switch (options.operation) {
+        case "get":
+        case "head":
+            return { validUntil };
+        case "delete":
+            return { validUntil, ifMatch: options.ifMatch };
+        case "put":
+            return {
+                validUntil,
+                allowedContentTypes: options.allowedContentTypes,
+                maximumSizeInBytes: options.maximumSizeInBytes,
+                addRandomSuffix: options.addRandomSuffix,
+                allowOverwrite: options.allowOverwrite,
+                cacheControlMaxAge: options.cacheControlMaxAge,
+                ifMatch: options.ifMatch,
+                onUploadCompleted: options.onUploadCompleted,
+            };
+    }
+};
+const operationNotDelegated = {
+    get: 'The delegation token is not valid for `GET` requests. Include `"get"` in `operations` when calling `issueSignedToken`.',
+    head: 'The delegation token is not valid for `HEAD` requests. Include `"head"` in `operations` when calling `issueSignedToken`.',
+    put: 'The delegation token is not valid for presigned write requests. Include `"put"` in `operations` when calling `issueSignedToken`.',
+    delete: 'The delegation token is not valid for presigned delete requests. Include `"delete"` in `operations` when calling `issueSignedToken`.',
+};
+/**
+ * Sign one request with a signed token, as the SDK's `presign`: check the delegation's pathname,
+ * expiry and operations, build the signed query entries, and HMAC their canonical string with the
+ * client signing token.
+ *
+ * @param now - Current time in epoch milliseconds.
+ * @returns The payload, or `BlobPresignFailed` with the SDK's message.
+ */
+export const presignPayload = Effect.fnUntraced(function* (token, options, now) {
+    const clientSigningToken = Redacted.value(token.clientSigningToken);
+    if (!clientSigningToken || !token.delegationToken) {
+        return yield* failed("`clientSigningToken` and `delegationToken` from `issueSignedToken` are required.");
+    }
+    const scope = delegationScope(token.delegationToken);
+    if (Option.isNone(scope)) {
+        return yield* failed("Invalid or unreadable `delegationToken` payload.");
+    }
+    const { pathname, validUntil, operations, maximumSizeInBytes, allowedContentTypes } = scope.value;
+    if (pathname && pathname !== "*" && options.pathname !== pathname) {
+        return yield* failed(`Blob path does not match the signed token scope; expected \`${pathname}\`, got \`${options.pathname}\`.`);
+    }
+    if (validUntil !== undefined && Number.isFinite(validUntil) && now > validUntil) {
+        return yield* failed("The signed delegation has expired; issue a new token first.");
+    }
+    if (!operations?.includes(options.operation)) {
+        return yield* failed(operationNotDelegated[options.operation]);
+    }
+    const entries = yield* presignCanonicalQueryEntries({
+        operation: options.operation,
+        delegation: { validUntil, maximumSizeInBytes, allowedContentTypes },
+        urlOptions: urlConstraints(options),
+        now,
+    });
+    const signature = yield* hmacSha256Base64Url(clientSigningToken, canonicalString(options.pathname, entries, options.operation));
+    return new PresignedUrlPayload({
+        delegationToken: token.delegationToken,
+        signature,
+        params: Object.fromEntries(entries),
+    });
+});
+/** `url` with the payload's params, `vercel-blob-delegation` and `vercel-blob-signature` set. */
+export const withPresignedParams = (url, payload) => {
+    const result = new URL(url);
+    for (const [key, value] of Object.entries(payload.params)) {
+        result.searchParams.set(key, value);
+    }
+    result.searchParams.set("vercel-blob-delegation", payload.delegationToken);
+    result.searchParams.set("vercel-blob-signature", payload.signature);
+    return result;
+};
+/**
+ * The presigned URL of a `get` or `head`, as the SDK's `buildPresignedGetUrl`: a blob URL is used
+ * as is, a pathname is resolved under the delegation's store (`blobBaseUrl`); `cache=0` (unsigned)
+ * is added for a private `get` with `useCache: false`.
+ *
+ * @returns None when the delegation token carries no valid store id, which the SDK requires even
+ *   for a blob URL.
+ */
+export const presignedBlobUrl = (args) => Option.map(storeIdFromDelegationToken(args.payload.delegationToken), (storeId) => {
+    const url = isUrl(args.pathnameOrUrl)
+        ? new URL(args.pathnameOrUrl)
+        : blobUrl(args.blobBaseUrl(storeId, args.access), args.pathnameOrUrl);
+    if (args.useCache === false && args.access === "private") {
+        url.searchParams.set("cache", "0");
+    }
+    return withPresignedParams(url, args.payload);
+});
+/**
+ * The presigned URL of a `put` or `delete`, as the SDK's `buildPresignedPutUrl`: the Blob API's
+ * `/?pathname=…` (trailing slashes of `apiUrl` removed) plus the payload's params.
+ */
+export const presignedApiUrl = (apiUrl, pathname, payload) => {
+    const base = apiUrl.href.replace(/\/+$/, "");
+    return withPresignedParams(new URL(`${base}/?${new URLSearchParams({ pathname }).toString()}`), payload);
+};
+//# sourceMappingURL=presign.js.map

package/dist/internal/presign.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"presign.js","sourceRoot":"","sources":["../../src/internal/presign.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC5E,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAK5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAE3C;;;;GAIG;AAEH,oEAAoE;AACpE,MAAM,CAAC,MAAM,sBAAsB,GAAG,yBAAyB,CAAC;AAChE,gDAAgD;AAChD,MAAM,CAAC,MAAM,uBAAuB,GAAG,mCAAmC,CAAC;AAC3E,yEAAyE;AACzE,MAAM,CAAC,MAAM,+BAA+B,GAAG,mCAAmC,CAAC;AACnF,sBAAsB;AACtB,MAAM,CAAC,MAAM,2BAA2B,GAAG,+BAA+B,CAAC;AAC3E,sBAAsB;AACtB,MAAM,CAAC,MAAM,0BAA0B,GAAG,6BAA6B,CAAC;AACxE,eAAe;AACf,MAAM,CAAC,MAAM,8BAA8B,GAAG,mCAAmC,CAAC;AAClF,mDAAmD;AACnD,MAAM,CAAC,MAAM,mBAAmB,GAAG,sBAAsB,CAAC;AAC1D,qDAAqD;AACrD,MAAM,CAAC,MAAM,uBAAuB,GAAG,0BAA0B,CAAC;AAClE,uDAAuD;AACvD,MAAM,CAAC,MAAM,gCAAgC,GAAG,oCAAoC,CAAC;AAErF,4FAA4F;AAC5F,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,2BAA2B;IAC3B,0BAA0B;IAC1B,+BAA+B;IAC/B,8BAA8B;IAC9B,gCAAgC;IAChC,uBAAuB;IACvB,mBAAmB;IACnB,uBAAuB;IACvB,sBAAsB;CACd,CAAC;AAEX,yEAAyE;AACzE,MAAM,CAAC,MAAM,+BAA+B,GAAG,IAAI,CAAC;AAEpD,0EAA0E;AAC1E,MAAM,CAAC,MAAM,wCAAwC,GAAG,IAAI,CAAC;AAE7D,oFAAoF;AACpF,MAAM,CAAC,MAAM,gCAAgC,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAEnE,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAEjC,sFAAsF;AACtF,MAAM,wBAAwB,GAAG,iBAAiB,CAAC;AAEnD,MAAM,KAAK,GAAG,YAAY,CAAC;AAK3B,wFAAwF;AACxF,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC;IAC3C,UAAU,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3D,0BAA0B;IAC1B,UAAU,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC;IAC7C,kBAAkB,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC;IACrD,mBAAmB,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;CACrE,CAAC,CAAC;AAKH,MAAM,WAAW,GAAG,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC,CAAC;AAEvF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,eAAuB,EAAkC,EAAE;IACzF,MAAM,GAAG,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;QACZ,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IACvB,CAAC;IACD,MAAM,OAAO,GAAG,eAAe;SAC5B,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;SACb,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtB,OAAO,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;AAC9F,CAAC,CAAC;AAEF,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC;AAE/B,0EAA0E;AAC1E,MAAM,WAAW,GAAG,CAAC,CAAS,EAAE,CAAS,EAAU,EAAE;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACnD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAChC,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAE,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACxC,IAAI,UAAU,KAAK,CAAC,EAAE,CAAC;YACrB,OAAO,UAAU,CAAC;QACpB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;AACpC,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,QAAgB,EAChB,OAAyC,EACzC,SAA8B,EACtB,EAAE;IACV,MAAM,KAAK,GAAG,CAAC,aAAa,SAAS,EAAE,EAAE,YAAY,QAAQ,EAAE,CAAC,CAAC;IACjE,KAAK,MAAM,GAAG,IAAI,yBAAyB,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5D,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5C,CAAC,CAAC;AAEF,mFAAmF;AACnF,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,MAAc,EAAE,IAAY;IAC1F,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CACrC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAChC,KAAK,EACL,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EACnB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CACF,CAAC;IACF,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAC3C,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAC9D,CAAC;IACF,OAAO,SAAS,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;AACrD,CAAC,CAAC,CAAC;AAEH,MAAM,MAAM,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;AAwBpF,MAAM,kBAAkB,GAAG,CAAC,WAAmB,EAAE,OAA8B,EAAW,EAAE;IAC1F,MAAM,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtC,OAAO,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AACzF,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,CACxB,oBAAwC,EACxC,SAA6B,EAC7B,GAAW,EACX,EAAE;IACF,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,oBAAoB,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC;IACxE,IAAI,oBAAoB,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;QAChF,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,KAAK,IAAI,GAAG,EAAE,CAAC;QACjB,OAAO,MAAM,CACX,GAAG,KAAK,+GAA+G,CACxH,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC,CAAC;AAEF,MAAM,yBAAyB,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAC3D,OAA8B,EAC9B,UAA6B;IAE7B,MAAM,OAAO,GAAG,UAAU,CAAC,mBAAmB,CAAC;IAC/C,IAAI,OAAO,CAAC,mBAAmB,EAAE,MAAM,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;QAC3D,KAAK,MAAM,WAAW,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC;YACtD,IAAI,CAAC,kBAAkB,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE,CAAC;gBAC9C,OAAO,KAAK,CAAC,CAAC,MAAM,CAClB,GAAG,KAAK,gCAAgC,WAAW,6CAA6C,CACjG,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,IACE,OAAO,CAAC,kBAAkB,KAAK,SAAS;QACxC,UAAU,CAAC,kBAAkB,KAAK,SAAS;QAC3C,OAAO,CAAC,kBAAkB,GAAG,UAAU,CAAC,kBAAkB,EAC1D,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,MAAM,CAClB,GAAG,KAAK,8CAA8C,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,CAChG,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAC1C,IACE,MAAM,KAAK,SAAS;QACpB,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,gCAAgC,CAAC,EACtF,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,MAAM,CAClB,GAAG,KAAK,yDAAyD,gCAAgC,GAAG,CACrG,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAChC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,KAAK,uCAAuC,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,GAAG,oBAAoB,EAAE,CAAC;YAC1C,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,KAAK,wBAAwB,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3C,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,KAAK,mDAAmD,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAC3C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,QAAQ,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtC,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,KAAK,6DAA6D,CAAC,CAAC;QAC9F,CAAC;QACD,IAAI,QAAQ,CAAC,WAAW,CAAC,MAAM,GAAG,+BAA+B,EAAE,CAAC;YAClE,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,KAAK,8CAA8C,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACxC,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,KAAK,sDAAsD,CAAC,CAAC;QACvF,CAAC;QACD,IACE,QAAQ,CAAC,YAAY,KAAK,SAAS;YACnC,QAAQ,CAAC,YAAY,KAAK,IAAI;YAC9B,QAAQ,CAAC,YAAY,CAAC,MAAM,GAAG,wCAAwC,EACvE,CAAC;YACD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,KAAK,+CAA+C,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,CAAC,KAA4B,EAAU,EAAE,CACzD,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAEpE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,IAKxE;IACC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACxD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IAC1F,MAAM,OAAO,GAA6B,EAAE,CAAC;IAC7C,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5D,OAAO,CAAC,IAAI,CAAC,CAAC,sBAAsB,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC3B,IAAI,UAAU,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO,CAAC,IAAI,CAAC,CAAC,mBAAmB,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;QACxB,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,CAAC,yBAAyB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAEzD,IAAI,UAAU,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;QACjD,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC;QACtD,IAAI,GAAG,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;YACxB,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,KAAK,gDAAgD,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,+BAA+B,EAAE,GAAG,CAAC,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,UAAU,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QAChD,OAAO,CAAC,IAAI,CAAC,CAAC,uBAAuB,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,UAAU,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAC7C,OAAO,CAAC,IAAI,CAAC,CAAC,2BAA2B,EAAE,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,UAAU,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QAC5C,OAAO,CAAC,IAAI,CAAC,CAAC,0BAA0B,EAAE,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,UAAU,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QAChD,OAAO,CAAC,IAAI,CAAC;YACX,8BAA8B;YAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;SAClD,CAAC,CAAC;IACL,CAAC;IACD,IAAI,UAAU,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACrC,OAAO,CAAC,IAAI,CAAC,CAAC,mBAAmB,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,UAAU,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC/C,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,UAAU,CAAC,iBAAiB,CAAC;QACnE,OAAO,CAAC,IAAI,CAAC,CAAC,uBAAuB,EAAE,WAAW,CAAC,CAAC,CAAC;QACrD,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,EAAE,EAAE,CAAC;YAC/E,OAAO,CAAC,IAAI,CAAC,CAAC,gCAAgC,EAAE,YAAY,CAAC,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC,CAAC;AAEH,MAAM,WAAW,GAAG,CAAC,KAA+B,EAAsB,EAAE,CAC1E,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;AAElE,uEAAuE;AACvE,MAAM,cAAc,GAAG,CAAC,OAAuB,EAAyB,EAAE;IACxE,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACnD,QAAQ,OAAO,CAAC,SAAS,EAAE,CAAC;QAC1B,KAAK,KAAK,CAAC;QACX,KAAK,MAAM;YACT,OAAO,EAAE,UAAU,EAAE,CAAC;QACxB,KAAK,QAAQ;YACX,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;QAClD,KAAK,KAAK;YACR,OAAO;gBACL,UAAU;gBACV,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;gBAChD,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;gBAC9C,eAAe,EAAE,OAAO,CAAC,eAAe;gBACxC,cAAc,EAAE,OAAO,CAAC,cAAc;gBACtC,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;gBAC9C,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;aAC7C,CAAC;IACN,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,qBAAqB,GAAwC;IACjE,GAAG,EAAE,wHAAwH;IAC7H,IAAI,EAAE,0HAA0H;IAChI,GAAG,EAAE,kIAAkI;IACvI,MAAM,EACJ,sIAAsI;CACzI,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EACvD,KAAmB,EACnB,OAAuB,EACvB,GAAW;IAEX,MAAM,kBAAkB,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACpE,IAAI,CAAC,kBAAkB,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;QAClD,OAAO,KAAK,CAAC,CAAC,MAAM,CAClB,kFAAkF,CACnF,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IACrD,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,kDAAkD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC;IAClG,IAAI,QAAQ,IAAI,QAAQ,KAAK,GAAG,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClE,OAAO,KAAK,CAAC,CAAC,MAAM,CAClB,+DAA+D,QAAQ,aAAa,OAAO,CAAC,QAAQ,KAAK,CAC1G,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,UAAU,EAAE,CAAC;QAChF,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,6DAA6D,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7C,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,qBAAqB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,4BAA4B,CAAC;QAClD,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,UAAU,EAAE,EAAE,UAAU,EAAE,kBAAkB,EAAE,mBAAmB,EAAE;QACnE,UAAU,EAAE,cAAc,CAAC,OAAO,CAAC;QACnC,GAAG;KACJ,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAC1C,kBAAkB,EAClB,eAAe,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAC9D,CAAC;IACF,OAAO,IAAI,mBAAmB,CAAC;QAC7B,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,SAAS;QACT,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC;KACpC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,iGAAiG;AACjG,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,GAAQ,EAAE,OAA4B,EAAO,EAAE;IACjF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1D,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACtC,CAAC;IACD,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,wBAAwB,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IAC3E,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IACpE,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,IAMhC,EAAsB,EAAE,CACvB,MAAM,CAAC,GAAG,CAAC,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE;IAC/E,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC;QACnC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC;QAC7B,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;IACxE,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACzD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;AAChD,CAAC,CAAC,CAAC;AAEL;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,MAAW,EACX,QAAgB,EAChB,OAA4B,EACvB,EAAE;IACP,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC7C,OAAO,mBAAmB,CACxB,IAAI,GAAG,CAAC,GAAG,IAAI,KAAK,IAAI,eAAe,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,EACnE,OAAO,CACR,CAAC;AACJ,CAAC,CAAC"}

package/dist/internal/store-id.d.ts

@@ -0,0 +1,38 @@
+import { Option } from "effect";
+import { StoreId } from "../contracts/blob-domain.ts";
+/**
+ * Strip the optional `store_` prefix from a store id. `BLOB_STORE_ID` (as written by
+ * `vercel env pull`) and the `storeId` option accept `store_<id>` or `<id>`; the API wants the bare
+ * id, case preserved.
+ */
+export declare const normalizeStoreId: (storeId: string) => string;
+/**
+ * Validate a store id given in either form (`store_<id>` or `<id>`).
+ *
+ * @returns The bare id, or none when it is empty or contains whitespace or `_`.
+ */
+export declare const parseStoreId: (storeId: string) => Option.Option<StoreId>;
+/**
+ * The store id embedded in a read-write token (`vercel_blob_rw_<storeId>_<secret>`): the fourth
+ * `_`-separated segment, as the SDK's `parseStoreIdFromReadWriteToken`.
+ *
+ * @returns None when the token has no valid fourth segment.
+ */
+export declare const storeIdFromReadWriteToken: (token: string) => Option.Option<StoreId>;
+/**
+ * The store id embedded in a client token (`vercel_blob_client_<storeId>_<payload>`). The SDK reads
+ * it with the same fourth-segment rule as read-write tokens.
+ */
+export declare const storeIdFromClientToken: (token: string) => Option.Option<StoreId>;
+/**
+ * Read the store id from a delegation token, the public half of a signed token that every presigned
+ * URL carries in `vercel-blob-delegation`. The token's payload is the base64url JSON before the first
+ * `.`; its `storeId` field is returned without the `store_` prefix.
+ *
+ * Works in browsers, so a client can address the right store from a presigned payload alone.
+ *
+ * @returns None when the token has no `.`, its payload is not base64url JSON, or it has no
+ *   non-empty `storeId` string that is a valid store id.
+ */
+export declare const storeIdFromDelegationToken: (delegationToken: string) => Option.Option<StoreId>;
+//# sourceMappingURL=store-id.d.ts.map

package/dist/internal/store-id.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-id.d.ts","sourceRoot":"","sources":["../../src/internal/store-id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAkB,MAAM,QAAQ,CAAC;AAGhD,OAAO,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAC;AAItD;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,YAAa,MAAM,KAAG,MACsB,CAAC;AAE1E;;;;GAIG;AACH,eAAO,MAAM,YAAY,YAAa,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAC1B,CAAC;AAE3C;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,UAAW,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CACH,CAAC;AAE7E;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,OAAO,CAClD,CAAC;AAM5B;;;;;;;;;GASG;AACH,eAAO,MAAM,0BAA0B,oBAAqB,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAezF,CAAC"}

package/dist/internal/store-id.js

@@ -0,0 +1,54 @@
+import { Option, Result, Schema } from "effect";
+import { Base64Url } from "effect/encoding";
+import { StoreId } from "../contracts/blob-domain.js";
+const decodeStoreId = Schema.decodeUnknownOption(StoreId);
+/**
+ * Strip the optional `store_` prefix from a store id. `BLOB_STORE_ID` (as written by
+ * `vercel env pull`) and the `storeId` option accept `store_<id>` or `<id>`; the API wants the bare
+ * id, case preserved.
+ */
+export const normalizeStoreId = (storeId) => storeId.startsWith("store_") ? storeId.slice("store_".length) : storeId;
+/**
+ * Validate a store id given in either form (`store_<id>` or `<id>`).
+ *
+ * @returns The bare id, or none when it is empty or contains whitespace or `_`.
+ */
+export const parseStoreId = (storeId) => decodeStoreId(normalizeStoreId(storeId));
+/**
+ * The store id embedded in a read-write token (`vercel_blob_rw_<storeId>_<secret>`): the fourth
+ * `_`-separated segment, as the SDK's `parseStoreIdFromReadWriteToken`.
+ *
+ * @returns None when the token has no valid fourth segment.
+ */
+export const storeIdFromReadWriteToken = (token) => Option.flatMap(Option.fromUndefinedOr(token.split("_")[3]), decodeStoreId);
+/**
+ * The store id embedded in a client token (`vercel_blob_client_<storeId>_<payload>`). The SDK reads
+ * it with the same fourth-segment rule as read-write tokens.
+ */
+export const storeIdFromClientToken = storeIdFromReadWriteToken;
+const DelegationPayload = Schema.fromJsonString(Schema.Struct({ storeId: Schema.NonEmptyString }));
+const decodeDelegationPayload = Schema.decodeUnknownOption(DelegationPayload);
+/**
+ * Read the store id from a delegation token, the public half of a signed token that every presigned
+ * URL carries in `vercel-blob-delegation`. The token's payload is the base64url JSON before the first
+ * `.`; its `storeId` field is returned without the `store_` prefix.
+ *
+ * Works in browsers, so a client can address the right store from a presigned payload alone.
+ *
+ * @returns None when the token has no `.`, its payload is not base64url JSON, or it has no
+ *   non-empty `storeId` string that is a valid store id.
+ */
+export const storeIdFromDelegationToken = (delegationToken) => {
+    const dot = delegationToken.indexOf(".");
+    if (dot < 0) {
+        return Option.none();
+    }
+    // The SDK's decoder also accepts standard base64 characters; normalize them to base64url.
+    const segment = delegationToken
+        .slice(0, dot)
+        .replace(/\+/g, "-")
+        .replace(/\//g, "_")
+        .replace(/=+$/, "");
+    return Result.getSuccess(Base64Url.decodeString(segment)).pipe(Option.flatMap(decodeDelegationPayload), Option.flatMap((payload) => parseStoreId(payload.storeId)));
+};
+//# sourceMappingURL=store-id.js.map

package/dist/internal/store-id.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-id.js","sourceRoot":"","sources":["../../src/internal/store-id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAC;AAEtD,MAAM,aAAa,GAAG,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;AAE1D;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAAe,EAAU,EAAE,CAC1D,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;AAE1E;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAAe,EAA0B,EAAE,CACtE,aAAa,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;AAE3C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,KAAa,EAA0B,EAAE,CACjF,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;AAE7E;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GACjC,yBAAyB,CAAC;AAE5B,MAAM,iBAAiB,GAAG,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;AAEnG,MAAM,uBAAuB,GAAG,MAAM,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;AAE9E;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,eAAuB,EAA0B,EAAE;IAC5F,MAAM,GAAG,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;QACZ,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IACvB,CAAC;IACD,0FAA0F;IAC1F,MAAM,OAAO,GAAG,eAAe;SAC5B,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;SACb,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtB,OAAO,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAC5D,MAAM,CAAC,OAAO,CAAC,uBAAuB,CAAC,EACvC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAC3D,CAAC;AACJ,CAAC,CAAC"}

package/dist/internal/urls.d.ts

@@ -0,0 +1,26 @@
+import type { BlobAccess, StoreId } from "../contracts/blob-domain.ts";
+/** The production Blob API, used unless `VERCEL_BLOB_API_URL` or an option overrides it. */
+export declare const defaultApiUrl = "https://vercel.com/api/blob";
+/** Where a store serves its blobs: `https://<storeId>.<access>.blob.vercel-storage.com/`. */
+export declare const defaultBlobBaseUrl: (storeId: StoreId, access: BlobAccess) => URL;
+/**
+ * The URL of the blob at `pathname` under a store's base URL (`BlobConfig.blobBaseUrl`), as the
+ * SDK's `constructBlobUrl`: the pathname is appended as is, so URL syntax in it (`?`, `#`) keeps its
+ * URL meaning exactly as with the SDK.
+ */
+export declare const blobUrl: (baseUrl: URL, pathname: string) => URL;
+/** True for strings the SDK treats as URLs rather than pathnames (`http://` or `https://`). */
+export declare const isUrl: (urlOrPathname: string) => boolean;
+/**
+ * Whether `get` may send credentials to `url`: hosts under `.blob.vercel-storage.com`, and, when
+ * the API URL is overridden (an emulator or a test server), that API URL's origin.
+ *
+ * @param apiUrl - The configured API URL; the production default allows no extra origin.
+ */
+export declare const isAllowedBlobUrl: (url: URL, apiUrl: URL) => boolean;
+/**
+ * The URL that makes browsers download a blob instead of displaying it: the blob URL with
+ * `download=1` in its query.
+ */
+export declare const downloadUrl: (url: URL | string) => URL;
+//# sourceMappingURL=urls.d.ts.map

package/dist/internal/urls.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"urls.d.ts","sourceRoot":"","sources":["../../src/internal/urls.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAC;AAEvE,4FAA4F;AAC5F,eAAO,MAAM,aAAa,gCAAgC,CAAC;AAE3D,6FAA6F;AAC7F,eAAO,MAAM,kBAAkB,YAAa,OAAO,UAAU,UAAU,KAAG,GACR,CAAC;AAEnE;;;;GAIG;AACH,eAAO,MAAM,OAAO,YAAa,GAAG,YAAY,MAAM,KAAG,GAGxD,CAAC;AAEF,+FAA+F;AAC/F,eAAO,MAAM,KAAK,kBAAmB,MAAM,KAAG,OAC+B,CAAC;AAE9E;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,QAAS,GAAG,UAAU,GAAG,KAAG,OAEsB,CAAC;AAEhF;;;GAGG;AACH,eAAO,MAAM,WAAW,QAAS,GAAG,GAAG,MAAM,KAAG,GAI/C,CAAC"}