@sixb/core 0.0.1

package/dist/authorization/errors.d.ts

@@ -0,0 +1,10 @@
+/** Thrown when a scoped operation is not covered by the principal's grants. Maps to HTTP 403. */
+export declare class AuthorizationError extends Error {
+    /** Stable key of the missing grant, e.g. `view:object:Contract`. */
+    readonly grantKey: string;
+    readonly name = "AuthorizationError";
+    constructor(
+    /** Stable key of the missing grant, e.g. `view:object:Contract`. */
+    grantKey: string, message: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/authorization/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/authorization/errors.ts"],"names":[],"mappings":"AAAA,iGAAiG;AACjG,qBAAa,kBAAmB,SAAQ,KAAK;IAIzC,oEAAoE;IACpE,QAAQ,CAAC,QAAQ,EAAE,MAAM;IAJ3B,QAAQ,CAAC,IAAI,wBAAuB;;IAGlC,oEAAoE;IAC3D,QAAQ,EAAE,MAAM,EACzB,OAAO,EAAE,MAAM;CAIlB"}

package/dist/authorization/event-visibility.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Event visibility derived from grants.
+ *
+ * There is no standalone "view events" capability: a principal sees a domain
+ * event only when it can view/apply/run the event's subject. A privileged
+ * caller (no authorization context) sees everything.
+ *
+ * The topic switch is fail-closed: an unrecognized topic is hidden, because a
+ * topic we don't yet model may carry a subject the principal is not allowed to
+ * see. Adding an event topic therefore requires an explicit visibility decision
+ * here, never a silent default.
+ */
+import type { StoredDomainEvent } from "../events";
+import type { AuthorizationContext } from "./types";
+export declare function canViewEvent(authorization: AuthorizationContext | null | undefined, event: StoredDomainEvent): boolean;
+//# sourceMappingURL=event-visibility.d.ts.map

package/dist/authorization/event-visibility.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"event-visibility.d.ts","sourceRoot":"","sources":["../../src/authorization/event-visibility.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAElD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAA;AAEnD,wBAAgB,YAAY,CAC1B,aAAa,EAAE,oBAAoB,GAAG,IAAI,GAAG,SAAS,EACtD,KAAK,EAAE,iBAAiB,GACvB,OAAO,CA8ET"}

package/dist/authorization/grant-kinds.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Grant kinds: the single source of truth for the (capability, target) space.
+ *
+ * Every grant collapses to one `GrantKind` discriminant — the same
+ * `capability:target` string the decision engine uses as a grant key (e.g.
+ * `view:object`, `run:sync`). Resolution, validation, enforcement, and the
+ * resolved `GrantIndex` all key off it, so adding a grant family is a single
+ * entry in `GRANT_KINDS` plus the compile errors that forces at every consumer.
+ */
+import type { GrantDefinition } from "../security/types";
+export type GrantKind = "access:application" | "view:object" | "view:dataset" | "edit:object" | "append:telemetry" | "apply:action" | "run:workflow" | "run:sync" | "run:pipeline" | "run:agent" | "observe:logs";
+/** Registered id universes a grant kind ranges over, plus subtype expansion. */
+export interface GrantUniverse {
+    readonly applicationIds: ReadonlySet<string>;
+    readonly objectTypeIds: ReadonlySet<string>;
+    readonly datasetIds: ReadonlySet<string>;
+    readonly actionIds: ReadonlySet<string>;
+    readonly workflowIds: ReadonlySet<string>;
+    readonly syncIds: ReadonlySet<string>;
+    readonly pipelineIds: ReadonlySet<string>;
+    readonly agentIds: ReadonlySet<string>;
+    readonly observableIds: ReadonlySet<string>;
+    readonly getSubTypes: (objectTypeId: string) => readonly string[];
+}
+/** The registered-id sets a grant kind validates against (no subtype hook). */
+export type GrantUniverseKey = Exclude<keyof GrantUniverse, "getSubTypes">;
+interface GrantKindSpec {
+    /** Registered universe the grant's ids must belong to. */
+    readonly universeKey: GrantUniverseKey;
+    /** Subject noun used in validation errors ("unknown <subject> '<id>'"). */
+    readonly subject: string;
+    /** Actionable hint appended to the "unknown <subject>" error. */
+    readonly fix: string;
+    /** Only object-type grants also expand to subtypes. */
+    readonly expandsSubtypes?: true;
+}
+/**
+ * The exhaustive grant-kind table. A new grant family is one entry here; the
+ * `Record<GrantKind, …>` makes every omission a compile error.
+ */
+export declare const GRANT_KINDS: Record<GrantKind, GrantKindSpec>;
+export declare const GRANT_KIND_KEYS: readonly GrantKind[];
+/** The grant kind a stored grant resolves to. */
+export declare function grantKindOf(grant: GrantDefinition): GrantKind;
+/** A fresh, mutable grant index with one empty id set per kind. */
+export declare function emptyGrantSets(): Record<GrantKind, Set<string>>;
+export {};
+//# sourceMappingURL=grant-kinds.d.ts.map

package/dist/authorization/grant-kinds.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-kinds.d.ts","sourceRoot":"","sources":["../../src/authorization/grant-kinds.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAExD,MAAM,MAAM,SAAS,GACjB,oBAAoB,GACpB,aAAa,GACb,cAAc,GACd,aAAa,GACb,kBAAkB,GAClB,cAAc,GACd,cAAc,GACd,UAAU,GACV,cAAc,GACd,WAAW,GACX,cAAc,CAAA;AAElB,gFAAgF;AAChF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,cAAc,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC5C,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC3C,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACxC,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACvC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACzC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACrC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACzC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACtC,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC3C,QAAQ,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,SAAS,MAAM,EAAE,CAAA;CAClE;AAED,+EAA+E;AAC/E,MAAM,MAAM,gBAAgB,GAAG,OAAO,CAAC,MAAM,aAAa,EAAE,aAAa,CAAC,CAAA;AAE1E,UAAU,aAAa;IACrB,0DAA0D;IAC1D,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAA;IACtC,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,iEAAiE;IACjE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,uDAAuD;IACvD,QAAQ,CAAC,eAAe,CAAC,EAAE,IAAI,CAAA;CAChC;AAED;;;GAGG;AACH,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,SAAS,EAAE,aAAa,CA4DxD,CAAA;AAED,eAAO,MAAM,eAAe,EAA+B,SAAS,SAAS,EAAE,CAAA;AAE/E,iDAAiD;AACjD,wBAAgB,WAAW,CAAC,KAAK,EAAE,eAAe,GAAG,SAAS,CAiB7D;AAED,mEAAmE;AACnE,wBAAgB,cAAc,IAAI,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAM/D"}

package/dist/authorization/index.d.ts

@@ -0,0 +1,11 @@
+export { canAccessApplication, isApplicationAccessControlled } from "./application-access";
+export type { AuthzDecision, AuthzRequest } from "./decision";
+export { assertAuthorized, assertCanAppendTelemetry, assertCanEdit, assertPrivileged, evaluate, isAllowed, } from "./decision";
+export { AuthorizationError } from "./errors";
+export { canViewEvent } from "./event-visibility";
+export type { GrantKind, GrantUniverse } from "./grant-kinds";
+export { resolveAuthorizationContext, resolveRoleGrants } from "./resolve";
+export { canViewActionRun, canViewPipelineRun, canViewProjection, canViewProjectionRun, canViewWorkflowIntervention, canViewWorkflowRun, } from "./run-visibility";
+export type { AuthorizationContext, GrantIndex, ResolvedRole } from "./types";
+export { emptyGrantIndex } from "./types";
+//# sourceMappingURL=index.d.ts.map

package/dist/authorization/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/authorization/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,6BAA6B,EAAE,MAAM,sBAAsB,CAAA;AAC1F,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAC7D,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,aAAa,EACb,gBAAgB,EAChB,QAAQ,EACR,SAAS,GACV,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7D,OAAO,EAAE,2BAA2B,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAC1E,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,EAC3B,kBAAkB,GACnB,MAAM,kBAAkB,CAAA;AACzB,YAAY,EAAE,oBAAoB,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAC7E,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA"}

package/dist/authorization/index.js

@@ -0,0 +1,48 @@
+// @bun
+import {
+  AuthorizationError,
+  assertAuthorized,
+  assertCanAppendTelemetry,
+  assertCanEdit,
+  assertPrivileged,
+  canAccessApplication,
+  canViewActionRun,
+  canViewEvent,
+  canViewPipelineRun,
+  canViewProjection,
+  canViewProjectionRun,
+  canViewWorkflowIntervention,
+  canViewWorkflowRun,
+  emptyGrantIndex,
+  evaluate,
+  isAllowed,
+  isApplicationAccessControlled,
+  resolveAuthorizationContext,
+  resolveRoleGrants
+} from "../chunk-0fygrz37.js";
+import"../chunk-btpe64e4.js";
+import"../chunk-1vffvydj.js";
+import"../chunk-y64skrwp.js";
+export {
+  resolveRoleGrants,
+  resolveAuthorizationContext,
+  isApplicationAccessControlled,
+  isAllowed,
+  evaluate,
+  emptyGrantIndex,
+  canViewWorkflowRun,
+  canViewWorkflowIntervention,
+  canViewProjectionRun,
+  canViewProjection,
+  canViewPipelineRun,
+  canViewEvent,
+  canViewActionRun,
+  canAccessApplication,
+  assertPrivileged,
+  assertCanEdit,
+  assertCanAppendTelemetry,
+  assertAuthorized,
+  AuthorizationError
+};
+
+//# debugId=DAA8E258AFF4972564756E2164756E21

package/dist/authorization/index.js.map

@@ -0,0 +1,9 @@
+{
+  "version": 3,
+  "sources": [],
+  "sourcesContent": [
+  ],
+  "mappings": "",
+  "debugId": "DAA8E258AFF4972564756E2164756E21",
+  "names": []
+}

package/dist/authorization/resolve.d.ts

@@ -0,0 +1,28 @@
+import type { Principal } from "../auth/types";
+import type { RoleDefinition } from "../security";
+import { type GrantUniverse } from "./grant-kinds";
+import type { AuthorizationContext, GrantIndex, ResolvedRole } from "./types";
+/**
+ * Expand a role's grants into concrete id sets once at startup.
+ *
+ * Broad grants (`every.object().except([...])`) expand against the registered
+ * universe; object-type grants also expand to subtypes. The result holds only
+ * `Set`s, so per-request resolution and runtime checks stay simple `set.has`.
+ * The per-kind universe and subtype rules come from the `GRANT_KINDS` table, so
+ * this loop never enumerates targets by hand.
+ */
+export declare function resolveRoleGrants(role: RoleDefinition, universe: GrantUniverse): GrantIndex;
+/**
+ * Resolve a principal's authorization context from its group memberships.
+ *
+ * Pure set-union over pre-resolved roles: roles match when their grantedTo
+ * groups intersect the principal's memberships, and their concrete id sets
+ * union into the principal's grant index.
+ */
+export declare function resolveAuthorizationContext(input: {
+    readonly principal: Principal;
+    readonly sessionId?: string;
+    readonly groupIds: readonly string[];
+    readonly roles: readonly ResolvedRole[];
+}): AuthorizationContext;
+//# sourceMappingURL=resolve.d.ts.map

package/dist/authorization/resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/authorization/resolve.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAC9C,OAAO,KAAK,EAAE,cAAc,EAAa,MAAM,aAAa,CAAA;AAC5D,OAAO,EAIL,KAAK,aAAa,EAEnB,MAAM,eAAe,CAAA;AACtB,OAAO,KAAK,EAAE,oBAAoB,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAE7E;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,aAAa,GAAG,UAAU,CAe3F;AA4BD;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE;IACjD,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,QAAQ,CAAC,KAAK,EAAE,SAAS,YAAY,EAAE,CAAA;CACxC,GAAG,oBAAoB,CAyBvB"}

package/dist/authorization/run-visibility.d.ts

@@ -0,0 +1,15 @@
+import type { ProjectionDefinition, ProjectionTarget } from "../projections";
+import type { ActionRunRecord } from "../storage/action-runs";
+import type { PipelineRunRecord } from "../storage/pipeline-runs";
+import type { WorkflowInterventionRecord } from "../storage/workflow-interventions";
+import type { WorkflowRunRecord } from "../storage/workflow-runs";
+import type { AuthorizationContext } from "./types";
+export declare function canViewActionRun(authorization: AuthorizationContext | null | undefined, run: Pick<ActionRunRecord, "actionId" | "subject">): boolean;
+export declare function canViewWorkflowRun(authorization: AuthorizationContext | null | undefined, run: Pick<WorkflowRunRecord, "workflowId">): boolean;
+export declare function canViewWorkflowIntervention(authorization: AuthorizationContext | null | undefined, intervention: Pick<WorkflowInterventionRecord, "workflowId">): boolean;
+export declare function canViewPipelineRun(authorization: AuthorizationContext | null | undefined, run: Pick<PipelineRunRecord, "pipelineId">): boolean;
+/** A projection run is viewable when its target object type(s) are viewable. */
+export declare function canViewProjectionRun(authorization: AuthorizationContext | null | undefined, target: ProjectionTarget): boolean;
+/** Whether a principal may see a projection definition (and its run history). */
+export declare function canViewProjection(authorization: AuthorizationContext | null | undefined, projection: ProjectionDefinition): boolean;
+//# sourceMappingURL=run-visibility.d.ts.map

package/dist/authorization/run-visibility.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-visibility.d.ts","sourceRoot":"","sources":["../../src/authorization/run-visibility.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAE5E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAC7D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AACjE,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,mCAAmC,CAAA;AACnF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAEjE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAA;AAEnD,wBAAgB,gBAAgB,CAC9B,aAAa,EAAE,oBAAoB,GAAG,IAAI,GAAG,SAAS,EACtD,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,UAAU,GAAG,SAAS,CAAC,GACjD,OAAO,CAeT;AAED,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,oBAAoB,GAAG,IAAI,GAAG,SAAS,EACtD,GAAG,EAAE,IAAI,CAAC,iBAAiB,EAAE,YAAY,CAAC,GACzC,OAAO,CAIT;AAED,wBAAgB,2BAA2B,CACzC,aAAa,EAAE,oBAAoB,GAAG,IAAI,GAAG,SAAS,EACtD,YAAY,EAAE,IAAI,CAAC,0BAA0B,EAAE,YAAY,CAAC,GAC3D,OAAO,CAKT;AAED,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,oBAAoB,GAAG,IAAI,GAAG,SAAS,EACtD,GAAG,EAAE,IAAI,CAAC,iBAAiB,EAAE,YAAY,CAAC,GACzC,OAAO,CAIT;AAED,gFAAgF;AAChF,wBAAgB,oBAAoB,CAClC,aAAa,EAAE,oBAAoB,GAAG,IAAI,GAAG,SAAS,EACtD,MAAM,EAAE,gBAAgB,GACvB,OAAO,CAQT;AAED,iFAAiF;AACjF,wBAAgB,iBAAiB,CAC/B,aAAa,EAAE,oBAAoB,GAAG,IAAI,GAAG,SAAS,EACtD,UAAU,EAAE,oBAAoB,GAC/B,OAAO,CAET"}

package/dist/authorization/types.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Authorization context types.
+ *
+ * The context is plain, immutable data resolved once per request
+ * (`principal -> groups -> roles -> grants`). Grants resolve eagerly into set
+ * lookups so enforcement on the hot path is synchronous and allocation-free.
+ * Group and role ids are retained so decisions stay explainable.
+ */
+import type { Principal } from "../auth/types";
+import { type GrantKind } from "./grant-kinds";
+/**
+ * Grants resolved to concrete id sets, keyed by grant kind (`view:object`,
+ * `run:sync`, …). Broad grants and object subtypes are already expanded, so
+ * enforcement is a single `grants[kind].has(id)` lookup. Keyed by `GrantKind`
+ * so a new grant family adds one key, not a new bucket every consumer must
+ * learn.
+ */
+export type GrantIndex = Readonly<Record<GrantKind, ReadonlySet<string>>>;
+/**
+ * A grant index that grants nothing, as the base for a hand-built context — typically in tests.
+ *
+ * This is the read-only face of `emptyGrantSets()`, the mutable builder resolution fills in and which
+ * stays internal. A factory rather than a shared constant, because the sets are only `ReadonlySet` to
+ * the type system: one frozen instance would be aliased into every context that spreads it.
+ *
+ * Writing the literal by hand is what this avoids. `GrantIndex` is deliberately a total `Record` so
+ * that `grants[kind].has(id)` cannot be misspelled into a silent `undefined` — with an optional index
+ * every enforcement site would read `?.has(id) ?? false`, where a typo denies instead of failing to
+ * compile. The cost of totality is that a literal breaks whenever a grant family is added.
+ */
+export declare function emptyGrantIndex(): GrantIndex;
+/** A role with its grants pre-expanded to concrete id sets at startup. */
+export interface ResolvedRole {
+    readonly id: string;
+    readonly grantedToGroupIds: readonly string[];
+    readonly grants: GrantIndex;
+}
+export interface AuthorizationContext {
+    readonly principal: Principal;
+    readonly sessionId?: string;
+    readonly groupIds: readonly string[];
+    /** Roles whose grantedTo groups intersect the principal's memberships. */
+    readonly roleIds: readonly string[];
+    readonly grants: GrantIndex;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/authorization/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/authorization/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAC9C,OAAO,EAAkB,KAAK,SAAS,EAAE,MAAM,eAAe,CAAA;AAE9D;;;;;;GAMG;AACH,MAAM,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;AAEzE;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,IAAI,UAAU,CAE5C;AAED,0EAA0E;AAC1E,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAA;IAC7C,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;CAC5B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;CAC5B"}

package/dist/blob-storage/browser.d.ts

@@ -0,0 +1,14 @@
+import type { FileRef } from "./types";
+export { DEFAULT_SIMPLE_FILE_UPLOAD_BYTES } from "./constants";
+export { blobDigestHex, blobIdFromDigest } from "./derive";
+export type { BlobDigest, BlobInfo, FileRef } from "./types";
+export { isBlobDigest, isFileRef } from "./validation";
+/**
+ * Best-effort display name for a file reference: the trailing path segment of
+ * `fileName`, else of `logicalPath`, else a synthetic `<blobId>.bin`.
+ *
+ * `fileName`/`logicalPath` are untrusted caller metadata; callers that render or
+ * set headers with the result must still sanitize it.
+ */
+export declare function fileNameFor(fileRef: FileRef): string;
+//# sourceMappingURL=browser.d.ts.map

package/dist/blob-storage/browser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser.d.ts","sourceRoot":"","sources":["../../src/blob-storage/browser.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AAEtC,OAAO,EAAE,gCAAgC,EAAE,MAAM,aAAa,CAAA;AAC9D,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAC1D,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AAC5D,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AAEtD;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAQpD"}

package/dist/blob-storage/browser.js

@@ -0,0 +1,22 @@
+// @bun
+import {
+  DEFAULT_SIMPLE_FILE_UPLOAD_BYTES,
+  fileNameFor
+} from "../chunk-51fjndv0.js";
+import {
+  blobDigestHex,
+  blobIdFromDigest,
+  isBlobDigest,
+  isFileRef
+} from "../chunk-4pycxcj3.js";
+import"../chunk-y64skrwp.js";
+export {
+  isFileRef,
+  isBlobDigest,
+  fileNameFor,
+  blobIdFromDigest,
+  blobDigestHex,
+  DEFAULT_SIMPLE_FILE_UPLOAD_BYTES
+};
+
+//# debugId=EDD9C93F8E50586764756E2164756E21

package/dist/blob-storage/browser.js.map

@@ -0,0 +1,9 @@
+{
+  "version": 3,
+  "sources": [],
+  "sourcesContent": [
+  ],
+  "mappings": "",
+  "debugId": "EDD9C93F8E50586764756E2164756E21",
+  "names": []
+}

package/dist/blob-storage/constants.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Maximum size, in bytes, of a single-request ("server"-strategy) file upload.
+ *
+ * This is a single source of truth for two sides that must agree: it is both the
+ * server's simple-upload ceiling AND the client's threshold for switching to a
+ * staged (direct-put) upload. Keeping one constant prevents the two limits from
+ * drifting apart.
+ */
+export declare const DEFAULT_SIMPLE_FILE_UPLOAD_BYTES: number;
+//# sourceMappingURL=constants.d.ts.map

package/dist/blob-storage/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/blob-storage/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,eAAO,MAAM,gCAAgC,QAAmB,CAAA"}

package/dist/blob-storage/derive.d.ts

@@ -0,0 +1,4 @@
+import type { BlobDigest } from "./types";
+export declare function blobDigestHex(digest: BlobDigest): string;
+export declare function blobIdFromDigest(digest: BlobDigest): string;
+//# sourceMappingURL=derive.d.ts.map

package/dist/blob-storage/derive.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"derive.d.ts","sourceRoot":"","sources":["../../src/blob-storage/derive.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAMzC,wBAAgB,aAAa,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAExD;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAE3D"}

package/dist/blob-storage/errors.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Error for blob storage invariants and provider-level failures.
+ */
+export declare class BlobStorageError extends Error {
+    readonly name = "BlobStorageError";
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/blob-storage/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/blob-storage/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,IAAI,sBAAqB;CACnC"}

package/dist/blob-storage/in-memory.d.ts

@@ -0,0 +1,10 @@
+import type { BlobByteRange, BlobInfo, BlobStorage, FileRef, PutBlobInput, RangeReadableBlobStorage } from "./types";
+export declare class InMemoryBlobStorage implements BlobStorage, RangeReadableBlobStorage {
+    private readonly blobsById;
+    put(input: PutBlobInput): Promise<FileRef>;
+    open(blobId: string): Promise<ReadableStream<Uint8Array>>;
+    openRange(blobId: string, range: BlobByteRange): Promise<ReadableStream<Uint8Array>>;
+    stat(blobId: string): Promise<BlobInfo | null>;
+    private requireStoredBlob;
+}
+//# sourceMappingURL=in-memory.d.ts.map

package/dist/blob-storage/in-memory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"in-memory.d.ts","sourceRoot":"","sources":["../../src/blob-storage/in-memory.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,aAAa,EACb,QAAQ,EACR,WAAW,EACX,OAAO,EACP,YAAY,EACZ,wBAAwB,EACzB,MAAM,SAAS,CAAA;AAchB,qBAAa,mBAAoB,YAAW,WAAW,EAAE,wBAAwB;IAC/E,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAgC;IAEpD,GAAG,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC;IAuB1C,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;IAKzD,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;IAMpF,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAKpD,OAAO,CAAC,iBAAiB;CAQ1B"}

package/dist/blob-storage/index.d.ts

@@ -0,0 +1,8 @@
+export type { BlobDigest, BlobInfo, FileRef } from "./browser";
+export { blobDigestHex, blobIdFromDigest, DEFAULT_SIMPLE_FILE_UPLOAD_BYTES, fileNameFor, isBlobDigest, isFileRef, } from "./browser";
+export { BlobStorageError } from "./errors";
+export { InMemoryBlobStorage } from "./in-memory";
+export type { AbortBlobUploadInput, BlobBody, BlobByteRange, BlobStorage, BlobUploadPart, BlobUploadSession, CompleteBlobUploadInput, CreateBlobUploadInput, DirectPutBlobUploadSession, DirectUploadBlobStorage, MultipartBlobUploadSession, PutBlobInput, RangeReadableBlobStorage, SignBlobUploadPartInput, SignedBlobUploadPart, } from "./types";
+export { assertExpectedBlobSize, assertValidExpectedBlobSize, computeBlobDigest, createFileRef, readBlobBody, streamBlobBody, } from "./utils";
+export { supportsDirectUpload, supportsRangeRead } from "./validation";
+//# sourceMappingURL=index.d.ts.map

package/dist/blob-storage/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/blob-storage/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAC9D,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,gCAAgC,EAChC,WAAW,EACX,YAAY,EACZ,SAAS,GACV,MAAM,WAAW,CAAA;AAClB,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AACjD,YAAY,EACV,oBAAoB,EACpB,QAAQ,EACR,aAAa,EACb,WAAW,EACX,cAAc,EACd,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,EACrB,0BAA0B,EAC1B,uBAAuB,EACvB,0BAA0B,EAC1B,YAAY,EACZ,wBAAwB,EACxB,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,SAAS,CAAA;AAChB,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,iBAAiB,EACjB,aAAa,EACb,YAAY,EACZ,cAAc,GACf,MAAM,SAAS,CAAA;AAChB,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA"}

package/dist/blob-storage/index.js

@@ -0,0 +1,44 @@
+// @bun
+import {
+  BlobStorageError,
+  InMemoryBlobStorage,
+  assertExpectedBlobSize,
+  assertValidExpectedBlobSize,
+  computeBlobDigest,
+  createFileRef,
+  readBlobBody,
+  streamBlobBody
+} from "../chunk-vj723r3p.js";
+import {
+  DEFAULT_SIMPLE_FILE_UPLOAD_BYTES,
+  fileNameFor
+} from "../chunk-51fjndv0.js";
+import {
+  blobDigestHex,
+  blobIdFromDigest,
+  isBlobDigest,
+  isFileRef,
+  supportsDirectUpload,
+  supportsRangeRead
+} from "../chunk-4pycxcj3.js";
+import"../chunk-y64skrwp.js";
+export {
+  supportsRangeRead,
+  supportsDirectUpload,
+  streamBlobBody,
+  readBlobBody,
+  isFileRef,
+  isBlobDigest,
+  fileNameFor,
+  createFileRef,
+  computeBlobDigest,
+  blobIdFromDigest,
+  blobDigestHex,
+  assertValidExpectedBlobSize,
+  assertExpectedBlobSize,
+  InMemoryBlobStorage,
+  DEFAULT_SIMPLE_FILE_UPLOAD_BYTES,
+  BlobStorageError
+};
+
+//# debugId=95E5106263C5E09264756E2164756E21

package/dist/blob-storage/index.js.map

@@ -0,0 +1,9 @@
+{
+  "version": 3,
+  "sources": [],
+  "sourcesContent": [
+  ],
+  "mappings": "",
+  "debugId": "95E5106263C5E09264756E2164756E21",
+  "names": []
+}

package/dist/blob-storage/types.d.ts

@@ -0,0 +1,126 @@
+export type BlobDigest = `sha256:${string}`;
+/**
+ * Dataset-safe reference to immutable blob bytes stored outside lake rows.
+ *
+ * `blobId`, `digest`, and `sizeBytes` are the blob's content-addressed identity:
+ * `blobId` is always `blob_<sha256 hex>` derived from `digest`. `fileName`,
+ * `mediaType`, and `logicalPath` are caller-supplied per-reference metadata (not
+ * part of blob identity) and are untrusted — consumers must sanitize them before
+ * using them for paths, headers, or rendering.
+ */
+export interface FileRef {
+    readonly blobId: string;
+    readonly digest: BlobDigest;
+    readonly sizeBytes: number;
+    readonly fileName?: string;
+    readonly mediaType?: string;
+    readonly logicalPath?: string;
+}
+export type BlobBody = ArrayBuffer | Uint8Array | Blob | ReadableStream<Uint8Array>;
+export interface PutBlobInput {
+    readonly body: BlobBody;
+    /** Reject the write when the consumed byte count differs from this value. */
+    readonly expectedSizeBytes?: number;
+    /** Cancels body consumption and provider-side staging work. */
+    readonly signal?: AbortSignal;
+    readonly fileName?: string;
+    readonly mediaType?: string;
+    readonly logicalPath?: string;
+}
+export interface BlobInfo {
+    readonly blobId: string;
+    readonly digest: BlobDigest;
+    readonly sizeBytes: number;
+}
+/**
+ * Durable content-addressed binary storage. Implementations should return the
+ * same blob id and digest for identical bytes.
+ */
+export interface BlobStorage {
+    put(input: PutBlobInput): Promise<FileRef>;
+    open(blobId: string): Promise<ReadableStream<Uint8Array>>;
+    stat(blobId: string): Promise<BlobInfo | null>;
+    /** Release external resources. Optional: a provider that owns none omits it. */
+    close?(): void | Promise<void>;
+}
+/**
+ * Inclusive byte range `[start, endInclusive]` (both offsets are part of the
+ * requested slice), matching HTTP `Range: bytes=start-end` semantics. Callers
+ * validate the bounds against the blob size before requesting a range.
+ */
+export interface BlobByteRange {
+    readonly start: number;
+    readonly endInclusive: number;
+}
+export interface RangeReadableBlobStorage {
+    openRange(blobId: string, range: BlobByteRange): Promise<ReadableStream<Uint8Array>>;
+}
+export interface CreateBlobUploadInput {
+    readonly uploadId: string;
+    readonly fileName?: string;
+    readonly mediaType?: string;
+    readonly logicalPath?: string;
+    readonly sizeBytes?: number;
+    readonly expectedDigest?: BlobDigest;
+    readonly expiresAt: Date;
+}
+export interface DirectPutBlobUploadSession {
+    readonly strategy: "direct-put";
+    readonly uploadId: string;
+    readonly method: "PUT";
+    readonly url: string;
+    readonly headers: Readonly<Record<string, string>>;
+    readonly expiresAt: Date;
+    readonly stagingKey: string;
+    readonly providerUploadId?: string;
+}
+export interface MultipartBlobUploadSession {
+    readonly strategy: "multipart";
+    readonly uploadId: string;
+    readonly partSizeBytes: number;
+    readonly expiresAt: Date;
+    readonly stagingKey: string;
+    readonly providerUploadId: string;
+}
+export type BlobUploadSession = DirectPutBlobUploadSession | MultipartBlobUploadSession;
+export interface SignBlobUploadPartInput {
+    readonly uploadId: string;
+    readonly stagingKey: string;
+    readonly providerUploadId?: string;
+    readonly partNumber: number;
+    readonly expiresAt: Date;
+}
+export interface SignedBlobUploadPart {
+    readonly partNumber: number;
+    readonly method: "PUT";
+    readonly url: string;
+    readonly headers: Readonly<Record<string, string>>;
+    readonly expiresAt: Date;
+}
+export interface BlobUploadPart {
+    readonly partNumber: number;
+    readonly etag: string;
+}
+export interface CompleteBlobUploadInput {
+    readonly uploadId: string;
+    readonly stagingKey: string;
+    readonly providerUploadId?: string;
+    readonly fileName?: string;
+    readonly mediaType?: string;
+    readonly logicalPath?: string;
+    readonly expectedSizeBytes?: number;
+    readonly expectedDigest?: BlobDigest;
+    readonly parts?: readonly BlobUploadPart[];
+}
+export interface AbortBlobUploadInput {
+    readonly uploadId: string;
+    readonly stagingKey: string;
+    readonly providerUploadId?: string;
+}
+export interface DirectUploadBlobStorage {
+    createUpload(input: CreateBlobUploadInput): Promise<BlobUploadSession>;
+    signUploadPart(input: SignBlobUploadPartInput): Promise<SignedBlobUploadPart>;
+    completeUpload(input: CompleteBlobUploadInput): Promise<FileRef>;
+    abortUpload(input: AbortBlobUploadInput): Promise<void>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/blob-storage/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/blob-storage/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,UAAU,GAAG,UAAU,MAAM,EAAE,CAAA;AAE3C;;;;;;;;GAQG;AACH,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAC9B;AAED,MAAM,MAAM,QAAQ,GAAG,WAAW,GAAG,UAAU,GAAG,IAAI,GAAG,cAAc,CAAC,UAAU,CAAC,CAAA;AAEnF,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;IACvB,6EAA6E;IAC7E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC,+DAA+D;IAC/D,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAC9B;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,GAAG,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC1C,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAA;IACzD,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAA;IAE9C,gFAAgF;IAChF,KAAK,CAAC,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC/B;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAC9B;AAED,MAAM,WAAW,wBAAwB;IACvC,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAA;CACrF;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,cAAc,CAAC,EAAE,UAAU,CAAA;IACpC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;CACzB;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAA;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAA;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAClD,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CACnC;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAA;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;CAClC;AAED,MAAM,MAAM,iBAAiB,GAAG,0BAA0B,GAAG,0BAA0B,CAAA;AAEvF,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;CACzB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAA;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAClD,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC,QAAQ,CAAC,cAAc,CAAC,EAAE,UAAU,CAAA;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,cAAc,EAAE,CAAA;CAC3C;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CACnC;AAED,MAAM,WAAW,uBAAuB;IACtC,YAAY,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAA;IACtE,cAAc,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAA;IAC7E,cAAc,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAChE,WAAW,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACxD"}

package/dist/blob-storage/utils.d.ts

@@ -0,0 +1,9 @@
+import type { BlobBody, BlobDigest, BlobInfo, FileRef, PutBlobInput } from "./types";
+/** Normalize every supported blob body to the streaming representation used by providers. */
+export declare function streamBlobBody(input: BlobBody): ReadableStream<Uint8Array>;
+export declare function readBlobBody(input: PutBlobInput["body"], signal?: AbortSignal): Promise<Uint8Array>;
+export declare function assertExpectedBlobSize(expectedSizeBytes: number | undefined, actualSizeBytes: number, provider?: string): void;
+export declare function assertValidExpectedBlobSize(expectedSizeBytes: number | undefined, provider?: string): void;
+export declare function computeBlobDigest(bytes: Uint8Array): BlobDigest;
+export declare function createFileRef(input: PutBlobInput, info: BlobInfo): FileRef;
+//# sourceMappingURL=utils.d.ts.map

package/dist/blob-storage/utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/blob-storage/utils.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAEpF,6FAA6F;AAC7F,wBAAgB,cAAc,CAAC,KAAK,EAAE,QAAQ,GAAG,cAAc,CAAC,UAAU,CAAC,CAgB1E;AAED,wBAAsB,YAAY,CAChC,KAAK,EAAE,YAAY,CAAC,MAAM,CAAC,EAC3B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,UAAU,CAAC,CAmDrB;AAED,wBAAgB,sBAAsB,CACpC,iBAAiB,EAAE,MAAM,GAAG,SAAS,EACrC,eAAe,EAAE,MAAM,EACvB,QAAQ,SAAgB,GACvB,IAAI,CAWN;AAED,wBAAgB,2BAA2B,CACzC,iBAAiB,EAAE,MAAM,GAAG,SAAS,EACrC,QAAQ,SAAgB,GACvB,IAAI,CAUN;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,UAAU,GAAG,UAAU,CAG/D;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,CAS1E"}

package/dist/blob-storage/validation.d.ts

@@ -0,0 +1,6 @@
+import type { BlobDigest, BlobStorage, DirectUploadBlobStorage, FileRef, RangeReadableBlobStorage } from "./types";
+export declare function isBlobDigest(value: unknown): value is BlobDigest;
+export declare function isFileRef(value: unknown): value is FileRef;
+export declare function supportsDirectUpload(storage: BlobStorage): storage is BlobStorage & DirectUploadBlobStorage;
+export declare function supportsRangeRead(storage: BlobStorage): storage is BlobStorage & RangeReadableBlobStorage;
+//# sourceMappingURL=validation.d.ts.map

package/dist/blob-storage/validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../src/blob-storage/validation.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,UAAU,EACV,WAAW,EACX,uBAAuB,EACvB,OAAO,EACP,wBAAwB,EACzB,MAAM,SAAS,CAAA;AAWhB,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,UAAU,CAEhE;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,OAAO,CAgB1D;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,WAAW,GACnB,OAAO,IAAI,WAAW,GAAG,uBAAuB,CAQlD;AAED,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,WAAW,GACnB,OAAO,IAAI,WAAW,GAAG,wBAAwB,CAGnD"}