@vercel/blob 0.27.0 → 0.27.1

package/dist/client.cjs

@@ -7,66 +7,56 @@
 
 
 
-var _chunkXTBGGUVNcjs = require('./chunk-XTBGGUVN.cjs');
+var _chunkA3XDFQYYcjs = require('./chunk-A3XDFQYY.cjs');
 
 // src/client.ts
 var _crypto = require('crypto'); var crypto = _interopRequireWildcard(_crypto);
 var _undici = require('undici');
 function createPutExtraChecks(methodName) {
   return function extraChecks(options) {
-    if (typeof window === "undefined") {
-      throw new (0, _chunkXTBGGUVNcjs.BlobError)(
-        `${methodName} must be called from a client environment`
-      );
-    }
     if (!options.token.startsWith("vercel_blob_client_")) {
-      throw new (0, _chunkXTBGGUVNcjs.BlobError)(`${methodName} must be called with a client token`);
+      throw new (0, _chunkA3XDFQYYcjs.BlobError)(`${methodName} must be called with a client token`);
     }
     if (
       // @ts-expect-error -- Runtime check for DX.
       options.addRandomSuffix !== void 0 || // @ts-expect-error -- Runtime check for DX.
       options.cacheControlMaxAge !== void 0
     ) {
-      throw new (0, _chunkXTBGGUVNcjs.BlobError)(
+      throw new (0, _chunkA3XDFQYYcjs.BlobError)(
         `${methodName} doesn't allow addRandomSuffix and cacheControlMaxAge. Configure these options at the server side when generating client tokens.`
       );
     }
   };
 }
-var put = _chunkXTBGGUVNcjs.createPutMethod.call(void 0, {
+var put = _chunkA3XDFQYYcjs.createPutMethod.call(void 0, {
   allowedOptions: ["contentType"],
   extraChecks: createPutExtraChecks("client/`put`")
 });
-var createMultipartUpload = _chunkXTBGGUVNcjs.createCreateMultipartUploadMethod.call(void 0, {
+var createMultipartUpload = _chunkA3XDFQYYcjs.createCreateMultipartUploadMethod.call(void 0, {
   allowedOptions: ["contentType"],
   extraChecks: createPutExtraChecks("client/`createMultipartUpload`")
 });
-var createMultipartUploader = _chunkXTBGGUVNcjs.createCreateMultipartUploaderMethod.call(void 0, 
+var createMultipartUploader = _chunkA3XDFQYYcjs.createCreateMultipartUploaderMethod.call(void 0, 
   {
     allowedOptions: ["contentType"],
     extraChecks: createPutExtraChecks("client/`createMultipartUpload`")
   }
 );
-var uploadPart = _chunkXTBGGUVNcjs.createUploadPartMethod.call(void 0, {
+var uploadPart = _chunkA3XDFQYYcjs.createUploadPartMethod.call(void 0, {
   allowedOptions: ["contentType"],
   extraChecks: createPutExtraChecks("client/`multipartUpload`")
 });
-var completeMultipartUpload = _chunkXTBGGUVNcjs.createCompleteMultipartUploadMethod.call(void 0, 
+var completeMultipartUpload = _chunkA3XDFQYYcjs.createCompleteMultipartUploadMethod.call(void 0, 
   {
     allowedOptions: ["contentType"],
     extraChecks: createPutExtraChecks("client/`completeMultipartUpload`")
   }
 );
-var upload = _chunkXTBGGUVNcjs.createPutMethod.call(void 0, {
+var upload = _chunkA3XDFQYYcjs.createPutMethod.call(void 0, {
   allowedOptions: ["contentType"],
   extraChecks(options) {
-    if (typeof window === "undefined") {
-      throw new (0, _chunkXTBGGUVNcjs.BlobError)(
-        "client/`upload` must be called from a client environment"
-      );
-    }
     if (options.handleUploadUrl === void 0) {
-      throw new (0, _chunkXTBGGUVNcjs.BlobError)(
+      throw new (0, _chunkA3XDFQYYcjs.BlobError)(
         "client/`upload` requires the 'handleUploadUrl' parameter"
       );
     }
@@ -75,7 +65,7 @@ var upload = _chunkXTBGGUVNcjs.createPutMethod.call(void 0, {
       options.addRandomSuffix !== void 0 || // @ts-expect-error -- Runtime check for DX.
       options.cacheControlMaxAge !== void 0
     ) {
-      throw new (0, _chunkXTBGGUVNcjs.BlobError)(
+      throw new (0, _chunkA3XDFQYYcjs.BlobError)(
         "client/`upload` doesn't allow addRandomSuffix and cacheControlMaxAge. Configure these options at the server side when generating client tokens."
       );
     }
@@ -158,7 +148,7 @@ async function handleUpload({
   onUploadCompleted
 }) {
   var _a, _b, _c, _d;
-  const resolvedToken = _chunkXTBGGUVNcjs.getTokenFromOptionsOrEnv.call(void 0, { token });
+  const resolvedToken = _chunkA3XDFQYYcjs.getTokenFromOptionsOrEnv.call(void 0, { token });
   const type = body.type;
   switch (type) {
     case "blob.generate-client-token": {
@@ -190,7 +180,7 @@ async function handleUpload({
       const signatureHeader = "x-vercel-signature";
       const signature = "credentials" in request ? (_c = request.headers.get(signatureHeader)) != null ? _c : "" : (_d = request.headers[signatureHeader]) != null ? _d : "";
       if (!signature) {
-        throw new (0, _chunkXTBGGUVNcjs.BlobError)("Missing callback signature");
+        throw new (0, _chunkA3XDFQYYcjs.BlobError)("Missing callback signature");
       }
       const isVerified = await verifyCallbackSignature({
         token: resolvedToken,
@@ -198,13 +188,13 @@ async function handleUpload({
         body: JSON.stringify(body)
       });
       if (!isVerified) {
-        throw new (0, _chunkXTBGGUVNcjs.BlobError)("Invalid callback signature");
+        throw new (0, _chunkA3XDFQYYcjs.BlobError)("Invalid callback signature");
       }
       await onUploadCompleted(body.payload);
       return { type, response: "ok" };
     }
     default:
-      throw new (0, _chunkXTBGGUVNcjs.BlobError)("Invalid event type");
+      throw new (0, _chunkA3XDFQYYcjs.BlobError)("Invalid event type");
   }
 }
 async function retrieveClientToken(options) {
@@ -228,17 +218,17 @@ async function retrieveClientToken(options) {
     signal: options.abortSignal
   });
   if (!res.ok) {
-    throw new (0, _chunkXTBGGUVNcjs.BlobError)("Failed to  retrieve the client token");
+    throw new (0, _chunkA3XDFQYYcjs.BlobError)("Failed to  retrieve the client token");
   }
   try {
     const { clientToken } = await res.json();
     return clientToken;
   } catch (e) {
-    throw new (0, _chunkXTBGGUVNcjs.BlobError)("Failed to retrieve the client token");
+    throw new (0, _chunkA3XDFQYYcjs.BlobError)("Failed to retrieve the client token");
   }
 }
 function toAbsoluteUrl(url) {
-  return new URL(url, window.location.href).href;
+  return new URL(url, location.href).href;
 }
 function isAbsoluteUrl(url) {
   try {
@@ -253,16 +243,16 @@ async function generateClientTokenFromReadWriteToken({
 }) {
   var _a;
   if (typeof window !== "undefined") {
-    throw new (0, _chunkXTBGGUVNcjs.BlobError)(
+    throw new (0, _chunkA3XDFQYYcjs.BlobError)(
       '"generateClientTokenFromReadWriteToken" must be called from a server environment'
     );
   }
   const timestamp = /* @__PURE__ */ new Date();
   timestamp.setSeconds(timestamp.getSeconds() + 30);
-  const readWriteToken = _chunkXTBGGUVNcjs.getTokenFromOptionsOrEnv.call(void 0, { token });
+  const readWriteToken = _chunkA3XDFQYYcjs.getTokenFromOptionsOrEnv.call(void 0, { token });
   const [, , , storeId = null] = readWriteToken.split("_");
   if (!storeId) {
-    throw new (0, _chunkXTBGGUVNcjs.BlobError)(
+    throw new (0, _chunkA3XDFQYYcjs.BlobError)(
       token ? "Invalid `token` parameter" : "Invalid `BLOB_READ_WRITE_TOKEN`"
     );
   }
@@ -274,7 +264,7 @@ async function generateClientTokenFromReadWriteToken({
   ).toString("base64");
   const securedKey = await signPayload(payload, readWriteToken);
   if (!securedKey) {
-    throw new (0, _chunkXTBGGUVNcjs.BlobError)("Unable to sign client token");
+    throw new (0, _chunkA3XDFQYYcjs.BlobError)("Unable to sign client token");
   }
   return `vercel_blob_client_${storeId}_${Buffer.from(
     `${securedKey}.${payload}`
@@ -291,5 +281,5 @@ async function generateClientTokenFromReadWriteToken({
 
 
 
-exports.completeMultipartUpload = completeMultipartUpload; exports.createFolder = _chunkXTBGGUVNcjs.createFolder; exports.createMultipartUpload = createMultipartUpload; exports.createMultipartUploader = createMultipartUploader; exports.generateClientTokenFromReadWriteToken = generateClientTokenFromReadWriteToken; exports.getPayloadFromClientToken = getPayloadFromClientToken; exports.handleUpload = handleUpload; exports.put = put; exports.upload = upload; exports.uploadPart = uploadPart;
+exports.completeMultipartUpload = completeMultipartUpload; exports.createFolder = _chunkA3XDFQYYcjs.createFolder; exports.createMultipartUpload = createMultipartUpload; exports.createMultipartUploader = createMultipartUploader; exports.generateClientTokenFromReadWriteToken = generateClientTokenFromReadWriteToken; exports.getPayloadFromClientToken = getPayloadFromClientToken; exports.handleUpload = handleUpload; exports.put = put; exports.upload = upload; exports.uploadPart = uploadPart;
 //# sourceMappingURL=client.cjs.map

package/dist/client.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["/home/runner/work/storage/storage/packages/blob/dist/client.cjs","../src/client.ts"],"names":[],"mappings":"AAAA;AACE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACF,wDAA6B;AAC7B;AACA;ACVA,+EAAwB;AAKxB,gCAAsB;AA+CtB,SAAS,oBAAA,CAEP,UAAA,EAAoB;AACpB,EAAA,OAAO,SAAS,WAAA,CAAY,OAAA,EAAmB;AAC7C,IAAA,GAAA,CAAI,OAAO,OAAA,IAAW,WAAA,EAAa;AACjC,MAAA,MAAM,IAAI,gCAAA;AAAA,QACR,CAAA,EAAA;AACF,MAAA;AACF,IAAA;AAEK,IAAA;AACH,MAAA;AACF,IAAA;AAEA,IAAA;AAAA;AAEE,MAAA;AAEA,MAAA;AACA,IAAA;AACA,MAAA;AACE,QAAA;AACF,MAAA;AACF,IAAA;AACF,EAAA;AACF;AAOa;AACX,EAAA;AACA,EAAA;AACD;AAUY;AAET,EAAA;AACA,EAAA;AACD;AAEU;AAET,EAAA;AACE,IAAA;AACA,IAAA;AACF,EAAA;AACF;AAOW;AAET,EAAA;AACA,EAAA;AACD;AAOU;AAET,EAAA;AACE,IAAA;AACA,IAAA;AACF,EAAA;AACF;AA4BW;AACX,EAAA;AACA,EAAA;AACM,IAAA;AACF,MAAA;AACE,QAAA;AACF,MAAA;AACF,IAAA;AAGI,IAAA;AACF,MAAA;AACE,QAAA;AACF,MAAA;AACF,IAAA;AAEA,IAAA;AAAA;AAEE,MAAA;AAEA,MAAA;AACA,IAAA;AACA,MAAA;AACE,QAAA;AACF,MAAA;AACF,IAAA;AACF,EAAA;AACM,EAAA;AA7LR,IAAA;AA8LI,IAAA;AACE,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACD,IAAA;AACH,EAAA;AACD;AAED;AACS,EAAA;AACL,IAAA;AACI,IAAA;AACF,IAAA;AACF,IAAA;AACC,IAAA;AACH,EAAA;AACF;AAEA;AAKO,EAAA;AACH,IAAA;AACF,EAAA;AAEM,EAAA;AACJ,IAAA;AACA,IAAA;AACI,IAAA;AACN,EAAA;AACO,EAAA;AACT;AAEA;AACE,EAAA;AACA,EAAA;AACA,EAAA;AAKmB;AAEb,EAAA;AAGD,EAAA;AAEH,IAAA;AAIA,IAAA;AACA,IAAA;AAEA,IAAA;AAIF,EAAA;AAEM,EAAA;AACJ,IAAA;AACA,IAAA;AACA,IAAA;AACI,IAAA;AACN,EAAA;AACO,EAAA;AACT;AAES;AACH,EAAA;AACF,IAAA;AACF,EAAA;AACM,EAAA;AAEN,EAAA;AACO,IAAA;AACP,EAAA;AAEO,EAAA;AACT;AASgB;AAGP,EAAA;AACD,EAAA;AAGA,EAAA;AACC,EAAA;AACT;AAEM;AACJ,EAAA;AACA,EAAA;AACF;AA4CA;AACE,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AAIA;AA9VF,EAAA;AA+VQ,EAAA;AAEA,EAAA;AACN,EAAA;AACO,IAAA;AACH,MAAA;AACA,MAAA;AACE,QAAA;AACA,QAAA;AACA,QAAA;AACF,MAAA;AACA,MAAA;AAGA,MAAA;AACA,MAAA;AACA,MAAA;AAIA,MAAA;AACE,QAAA;AACA,QAAA;AAAyD,UAAA;AACpD,UAAA;AACI,UAAA;AACP,UAAA;AACmB,YAAA;AACjB,YAAA;AACA,UAAA;AACF,UAAA;AAED,QAAA;AACH,MAAA;AACF,IAAA;AACK,IAAA;AACH,MAAA;AACA,MAAA;AAMA,MAAA;AACE,QAAA;AACF,MAAA;AAEA,MAAA;AACE,QAAA;AACA,QAAA;AACA,QAAA;AACD,MAAA;AAED,MAAA;AACE,QAAA;AACF,MAAA;AACA,MAAA;AACA,MAAA;AACF,IAAA;AACA,IAAA;AACE,MAAA;AACJ,EAAA;AACF;AAEA;AAOQ,EAAA;AACA,EAAA;AAIA,EAAA;AACJ,IAAA;AACA,IAAA;AACE,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACF,IAAA;AACF,EAAA;AAEM,EAAA;AACJ,IAAA;AACA,IAAA;AACA,IAAA;AACE,MAAA;AACF,IAAA;AACA,IAAA;AACD,EAAA;AAEI,EAAA;AACH,IAAA;AACF,EAAA;AAEI,EAAA;AACF,IAAA;AACA,IAAA;AACF,EAAA;AACE,IAAA;AACF,EAAA;AACF;AAES;AACA,EAAA;AACT;AAES;AACH,EAAA;AACF,IAAA;AACF,EAAA;AACE,IAAA;AACF,EAAA;AACF;AAEA;AACE,EAAA;AACG,EAAA;AAC2C;AAxdhD,EAAA;AAydM,EAAA;AACF,IAAA;AACE,MAAA;AACF,IAAA;AACF,EAAA;AAEM,EAAA;AACN,EAAA;AACM,EAAA;AAEC,EAAA;AAEF,EAAA;AACH,IAAA;AACE,MAAA;AACF,IAAA;AACF,EAAA;AAEM,EAAA;AACC,IAAA;AACA,MAAA;AACH,MAAA;AACD,IAAA;AACD,EAAA;AAEI,EAAA;AAED,EAAA;AACH,IAAA;AACF,EAAA;AACO,EAAA;AACF,IAAA;AACH,EAAA;AACJ;ADhOS;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA","file":"/home/runner/work/storage/storage/packages/blob/dist/client.cjs","sourcesContent":[null,"// eslint-disable-next-line unicorn/prefer-node-protocol -- node:crypto does not resolve correctly in browser and edge runtime\nimport * as crypto from 'crypto';\nimport type { IncomingMessage } from 'node:http';\n// When bundled via a bundler supporting the `browser` field, then\n// the `undici` module will be replaced with https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API\n// for browser contexts. See ./undici-browser.js and ./package.json\nimport { fetch } from 'undici';\nimport type { BlobCommandOptions, WithUploadProgress } from './helpers';\nimport { BlobError, getTokenFromOptionsOrEnv } from './helpers';\nimport { createPutMethod } from './put';\nimport type { PutBlobResult } from './put-helpers';\nimport type { CommonCompleteMultipartUploadOptions } from './multipart/complete';\nimport { createCompleteMultipartUploadMethod } from './multipart/complete';\nimport { createCreateMultipartUploadMethod } from './multipart/create';\nimport { createUploadPartMethod } from './multipart/upload';\nimport type { CommonMultipartUploadOptions } from './multipart/upload';\nimport { createCreateMultipartUploaderMethod } from './multipart/create-uploader';\n\n// interface for put, upload and multipartUpload.\n// This types omits all options that are encoded in the client token.\nexport interface ClientCommonCreateBlobOptions {\n  /**\n   * Whether the blob should be publicly accessible.\n   */\n  access: 'public';\n  /**\n   * Defines the content type of the blob. By default, this value is inferred from the pathname. Sent as the 'content-type' header when downloading a blob.\n   */\n  contentType?: string;\n  /**\n   * `AbortSignal` to cancel the running request. See https://developer.mozilla.org/en-US/docs/Web/API/AbortSignal\n   */\n  abortSignal?: AbortSignal;\n}\n\n// shared interface for put and multipartUpload\nexport interface ClientTokenOptions {\n  /**\n   * A client token that was generated by your server using the `generateClientToken` method.\n   */\n  token: string;\n}\n\n// shared interface for put and upload\ninterface ClientCommonPutOptions\n  extends ClientCommonCreateBlobOptions,\n    WithUploadProgress {\n  /**\n   * Whether to use multipart upload. Use this when uploading large files. It will split the file into multiple parts, upload them in parallel and retry failed parts.\n   */\n  multipart?: boolean;\n}\n\nfunction createPutExtraChecks<\n  TOptions extends ClientTokenOptions & ClientCommonCreateBlobOptions,\n>(methodName: string) {\n  return function extraChecks(options: TOptions) {\n    if (typeof window === 'undefined') {\n      throw new BlobError(\n        `${methodName} must be called from a client environment`,\n      );\n    }\n\n    if (!options.token.startsWith('vercel_blob_client_')) {\n      throw new BlobError(`${methodName} must be called with a client token`);\n    }\n\n    if (\n      // @ts-expect-error -- Runtime check for DX.\n      options.addRandomSuffix !== undefined ||\n      // @ts-expect-error -- Runtime check for DX.\n      options.cacheControlMaxAge !== undefined\n    ) {\n      throw new BlobError(\n        `${methodName} doesn't allow addRandomSuffix and cacheControlMaxAge. Configure these options at the server side when generating client tokens.`,\n      );\n    }\n  };\n}\n\n// client.put()\n\nexport type ClientPutCommandOptions = ClientCommonPutOptions &\n  ClientTokenOptions;\n\nexport const put = createPutMethod<ClientPutCommandOptions>({\n  allowedOptions: ['contentType'],\n  extraChecks: createPutExtraChecks('client/`put`'),\n});\n\n// vercelBlob. createMultipartUpload()\n// vercelBlob. uploadPart()\n// vercelBlob. completeMultipartUpload()\n// vercelBlob. createMultipartUploader()\n\nexport type ClientCreateMultipartUploadCommandOptions =\n  ClientCommonCreateBlobOptions & ClientTokenOptions;\n\nexport const createMultipartUpload =\n  createCreateMultipartUploadMethod<ClientCreateMultipartUploadCommandOptions>({\n    allowedOptions: ['contentType'],\n    extraChecks: createPutExtraChecks('client/`createMultipartUpload`'),\n  });\n\nexport const createMultipartUploader =\n  createCreateMultipartUploaderMethod<ClientCreateMultipartUploadCommandOptions>(\n    {\n      allowedOptions: ['contentType'],\n      extraChecks: createPutExtraChecks('client/`createMultipartUpload`'),\n    },\n  );\n\ntype ClientMultipartUploadCommandOptions = ClientCommonCreateBlobOptions &\n  ClientTokenOptions &\n  CommonMultipartUploadOptions &\n  WithUploadProgress;\n\nexport const uploadPart =\n  createUploadPartMethod<ClientMultipartUploadCommandOptions>({\n    allowedOptions: ['contentType'],\n    extraChecks: createPutExtraChecks('client/`multipartUpload`'),\n  });\n\ntype ClientCompleteMultipartUploadCommandOptions =\n  ClientCommonCreateBlobOptions &\n    ClientTokenOptions &\n    CommonCompleteMultipartUploadOptions;\n\nexport const completeMultipartUpload =\n  createCompleteMultipartUploadMethod<ClientCompleteMultipartUploadCommandOptions>(\n    {\n      allowedOptions: ['contentType'],\n      extraChecks: createPutExtraChecks('client/`completeMultipartUpload`'),\n    },\n  );\n\n// upload methods\n\nexport interface CommonUploadOptions {\n  /**\n   * A route that implements the `handleUpload` function for generating a client token.\n   */\n  handleUploadUrl: string;\n  /**\n   * Additional data which will be sent to your `handleUpload` route.\n   */\n  clientPayload?: string;\n}\n\n// client.upload()\n// This is a client-side wrapper that will fetch the client token for you and then upload the file\nexport type UploadOptions = ClientCommonPutOptions & CommonUploadOptions;\n/**\n * Uploads a blob into your store from the client.\n * Detailed documentation can be found here: https://vercel.com/docs/storage/vercel-blob/using-blob-sdk#client-uploads\n *\n * If you want to upload from your server instead, check out the documentation for the put operation: https://vercel.com/docs/storage/vercel-blob/using-blob-sdk#upload-a-blob\n *\n * @param pathname - The pathname to upload the blob to. This includes the filename.\n * @param body - The contents of your blob. This has to be a supported fetch body type https://developer.mozilla.org/en-US/docs/Web/API/fetch#body.\n * @param options - Additional options.\n */\nexport const upload = createPutMethod<UploadOptions>({\n  allowedOptions: ['contentType'],\n  extraChecks(options) {\n    if (typeof window === 'undefined') {\n      throw new BlobError(\n        'client/`upload` must be called from a client environment',\n      );\n    }\n\n    // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- Runtime check for DX.\n    if (options.handleUploadUrl === undefined) {\n      throw new BlobError(\n        \"client/`upload` requires the 'handleUploadUrl' parameter\",\n      );\n    }\n\n    if (\n      // @ts-expect-error -- Runtime check for DX.\n      options.addRandomSuffix !== undefined ||\n      // @ts-expect-error -- Runtime check for DX.\n      options.cacheControlMaxAge !== undefined\n    ) {\n      throw new BlobError(\n        \"client/`upload` doesn't allow addRandomSuffix and cacheControlMaxAge. Configure these options at the server side when generating client tokens.\",\n      );\n    }\n  },\n  async getToken(pathname, options) {\n    return retrieveClientToken({\n      handleUploadUrl: options.handleUploadUrl,\n      pathname,\n      clientPayload: options.clientPayload ?? null,\n      multipart: options.multipart ?? false,\n    });\n  },\n});\n\nasync function importKey(token: string): Promise<CryptoKey> {\n  return globalThis.crypto.subtle.importKey(\n    'raw',\n    new TextEncoder().encode(token),\n    { name: 'HMAC', hash: 'SHA-256' },\n    false,\n    ['sign', 'verify'],\n  );\n}\n\nasync function signPayload(\n  payload: string,\n  token: string,\n): Promise<string | undefined> {\n  // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- Node.js < 20: globalThis.crypto is undefined (in a real script.js, because the REPL has it linked to the crypto module). Node.js >= 20, Browsers and Cloudflare workers: globalThis.crypto is defined and is the Web Crypto API.\n  if (!globalThis.crypto) {\n    return crypto.createHmac('sha256', token).update(payload).digest('hex');\n  }\n\n  const signature = await globalThis.crypto.subtle.sign(\n    'HMAC',\n    await importKey(token),\n    new TextEncoder().encode(payload),\n  );\n  return Buffer.from(new Uint8Array(signature)).toString('hex');\n}\n\nasync function verifyCallbackSignature({\n  token,\n  signature,\n  body,\n}: {\n  token: string;\n  signature: string;\n  body: string;\n}): Promise<boolean> {\n  // callback signature is signed using the server token\n  const secret = token;\n  // Browsers, Edge runtime and Node >=20 implement the Web Crypto API\n  // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- Node.js < 20: globalThis.crypto is undefined (in a real script.js, because the REPL has it linked to the crypto module). Node.js >= 20, Browsers and Cloudflare workers: globalThis.crypto is defined and is the Web Crypto API.\n  if (!globalThis.crypto) {\n    // Node <20 falls back to the Node.js crypto module\n    const digest = crypto\n      .createHmac('sha256', secret)\n      .update(body)\n      .digest('hex');\n    const digestBuffer = Buffer.from(digest);\n    const signatureBuffer = Buffer.from(signature);\n\n    return (\n      digestBuffer.length === signatureBuffer.length &&\n      crypto.timingSafeEqual(digestBuffer, signatureBuffer)\n    );\n  }\n\n  const verified = await globalThis.crypto.subtle.verify(\n    'HMAC',\n    await importKey(token),\n    hexToArrayByte(signature),\n    new TextEncoder().encode(body),\n  );\n  return verified;\n}\n\nfunction hexToArrayByte(input: string): ArrayBuffer {\n  if (input.length % 2 !== 0) {\n    throw new RangeError('Expected string to be an even number of characters');\n  }\n  const view = new Uint8Array(input.length / 2);\n\n  for (let i = 0; i < input.length; i += 2) {\n    view[i / 2] = parseInt(input.substring(i, i + 2), 16);\n  }\n\n  return Buffer.from(view);\n}\n\nexport type DecodedClientTokenPayload = Omit<\n  GenerateClientTokenOptions,\n  'token'\n> & {\n  validUntil: number;\n};\n\nexport function getPayloadFromClientToken(\n  clientToken: string,\n): DecodedClientTokenPayload {\n  const [, , , , encodedToken] = clientToken.split('_');\n  const encodedPayload = Buffer.from(encodedToken ?? '', 'base64')\n    .toString()\n    .split('.')[1];\n  const decodedPayload = Buffer.from(encodedPayload ?? '', 'base64').toString();\n  return JSON.parse(decodedPayload) as DecodedClientTokenPayload;\n}\n\nconst EventTypes = {\n  generateClientToken: 'blob.generate-client-token',\n  uploadCompleted: 'blob.upload-completed',\n} as const;\n\ninterface GenerateClientTokenEvent {\n  type: (typeof EventTypes)['generateClientToken'];\n  payload: {\n    pathname: string;\n    callbackUrl: string;\n    multipart: boolean;\n    clientPayload: string | null;\n  };\n}\ninterface UploadCompletedEvent {\n  type: (typeof EventTypes)['uploadCompleted'];\n  payload: {\n    blob: PutBlobResult;\n    tokenPayload?: string | null;\n  };\n}\n\nexport type HandleUploadBody = GenerateClientTokenEvent | UploadCompletedEvent;\n\ntype RequestType = IncomingMessage | Request;\n\nexport interface HandleUploadOptions {\n  body: HandleUploadBody;\n  onBeforeGenerateToken: (\n    pathname: string,\n    clientPayload: string | null,\n    multipart: boolean,\n  ) => Promise<\n    Pick<\n      GenerateClientTokenOptions,\n      | 'allowedContentTypes'\n      | 'maximumSizeInBytes'\n      | 'validUntil'\n      | 'addRandomSuffix'\n      | 'cacheControlMaxAge'\n    > & { tokenPayload?: string | null }\n  >;\n  onUploadCompleted: (body: UploadCompletedEvent['payload']) => Promise<void>;\n  token?: string;\n  request: RequestType;\n}\n\nexport async function handleUpload({\n  token,\n  request,\n  body,\n  onBeforeGenerateToken,\n  onUploadCompleted,\n}: HandleUploadOptions): Promise<\n  | { type: GenerateClientTokenEvent['type']; clientToken: string }\n  | { type: UploadCompletedEvent['type']; response: 'ok' }\n> {\n  const resolvedToken = getTokenFromOptionsOrEnv({ token });\n\n  const type = body.type;\n  switch (type) {\n    case 'blob.generate-client-token': {\n      const { pathname, callbackUrl, clientPayload, multipart } = body.payload;\n      const payload = await onBeforeGenerateToken(\n        pathname,\n        clientPayload,\n        multipart,\n      );\n      const tokenPayload = payload.tokenPayload ?? clientPayload;\n\n      // one hour\n      const oneHourInSeconds = 60 * 60;\n      const now = new Date();\n      const validUntil =\n        payload.validUntil ??\n        now.setSeconds(now.getSeconds() + oneHourInSeconds);\n\n      return {\n        type,\n        clientToken: await generateClientTokenFromReadWriteToken({\n          ...payload,\n          token: resolvedToken,\n          pathname,\n          onUploadCompleted: {\n            callbackUrl,\n            tokenPayload,\n          },\n          validUntil,\n        }),\n      };\n    }\n    case 'blob.upload-completed': {\n      const signatureHeader = 'x-vercel-signature';\n      const signature = (\n        'credentials' in request\n          ? (request.headers.get(signatureHeader) ?? '')\n          : (request.headers[signatureHeader] ?? '')\n      ) as string;\n\n      if (!signature) {\n        throw new BlobError('Missing callback signature');\n      }\n\n      const isVerified = await verifyCallbackSignature({\n        token: resolvedToken,\n        signature,\n        body: JSON.stringify(body),\n      });\n\n      if (!isVerified) {\n        throw new BlobError('Invalid callback signature');\n      }\n      await onUploadCompleted(body.payload);\n      return { type, response: 'ok' };\n    }\n    default:\n      throw new BlobError('Invalid event type');\n  }\n}\n\nasync function retrieveClientToken(options: {\n  pathname: string;\n  handleUploadUrl: string;\n  clientPayload: string | null;\n  multipart: boolean;\n  abortSignal?: AbortSignal;\n}): Promise<string> {\n  const { handleUploadUrl, pathname } = options;\n  const url = isAbsoluteUrl(handleUploadUrl)\n    ? handleUploadUrl\n    : toAbsoluteUrl(handleUploadUrl);\n\n  const event: GenerateClientTokenEvent = {\n    type: EventTypes.generateClientToken,\n    payload: {\n      pathname,\n      callbackUrl: url,\n      clientPayload: options.clientPayload,\n      multipart: options.multipart,\n    },\n  };\n\n  const res = await fetch(url, {\n    method: 'POST',\n    body: JSON.stringify(event),\n    headers: {\n      'content-type': 'application/json',\n    },\n    signal: options.abortSignal,\n  });\n\n  if (!res.ok) {\n    throw new BlobError('Failed to  retrieve the client token');\n  }\n\n  try {\n    const { clientToken } = (await res.json()) as { clientToken: string };\n    return clientToken;\n  } catch (e) {\n    throw new BlobError('Failed to retrieve the client token');\n  }\n}\n\nfunction toAbsoluteUrl(url: string): string {\n  return new URL(url, window.location.href).href;\n}\n\nfunction isAbsoluteUrl(url: string): boolean {\n  try {\n    return Boolean(new URL(url));\n  } catch (e) {\n    return false;\n  }\n}\n\nexport async function generateClientTokenFromReadWriteToken({\n  token,\n  ...argsWithoutToken\n}: GenerateClientTokenOptions): Promise<string> {\n  if (typeof window !== 'undefined') {\n    throw new BlobError(\n      '\"generateClientTokenFromReadWriteToken\" must be called from a server environment',\n    );\n  }\n\n  const timestamp = new Date();\n  timestamp.setSeconds(timestamp.getSeconds() + 30);\n  const readWriteToken = getTokenFromOptionsOrEnv({ token });\n\n  const [, , , storeId = null] = readWriteToken.split('_');\n\n  if (!storeId) {\n    throw new BlobError(\n      token ? 'Invalid `token` parameter' : 'Invalid `BLOB_READ_WRITE_TOKEN`',\n    );\n  }\n\n  const payload = Buffer.from(\n    JSON.stringify({\n      ...argsWithoutToken,\n      validUntil: argsWithoutToken.validUntil ?? timestamp.getTime(),\n    }),\n  ).toString('base64');\n\n  const securedKey = await signPayload(payload, readWriteToken);\n\n  if (!securedKey) {\n    throw new BlobError('Unable to sign client token');\n  }\n  return `vercel_blob_client_${storeId}_${Buffer.from(\n    `${securedKey}.${payload}`,\n  ).toString('base64')}`;\n}\n\nexport interface GenerateClientTokenOptions extends BlobCommandOptions {\n  pathname: string;\n  onUploadCompleted?: {\n    callbackUrl: string;\n    tokenPayload?: string | null;\n  };\n  maximumSizeInBytes?: number;\n  allowedContentTypes?: string[];\n  validUntil?: number;\n  addRandomSuffix?: boolean;\n  cacheControlMaxAge?: number;\n}\n\nexport { createFolder } from './create-folder';\n"]}
+{"version":3,"sources":["/home/runner/work/storage/storage/packages/blob/dist/client.cjs","../src/client.ts"],"names":[],"mappings":"AAAA;AACE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACF,wDAA6B;AAC7B;AACA;ACVA,+EAAwB;AAKxB,gCAAsB;AA+CtB,SAAS,oBAAA,CAEP,UAAA,EAAoB;AACpB,EAAA,OAAO,SAAS,WAAA,CAAY,OAAA,EAAmB;AAC7C,IAAA,GAAA,CAAI,CAAC,OAAA,CAAQ,KAAA,CAAM,UAAA,CAAW,qBAAqB,CAAA,EAAG;AACpD,MAAA,MAAM,IAAI,gCAAA,CAAU,CAAA,EAAA;AACtB,IAAA;AAEA,IAAA;AAAA;AAEU,MAAA;AAEA,MAAA;AACR,IAAA;AACU,MAAA;AACK,QAAA;AACf,MAAA;AACF,IAAA;AACF,EAAA;AACF;AAO4D;AACzC,EAAA;AACJ,EAAA;AACd;AAUY;AAEQ,EAAA;AACJ,EAAA;AACd;AAEU;AAET,EAAA;AACmB,IAAA;AACJ,IAAA;AACf,EAAA;AACF;AAQA;AACmB,EAAA;AACJ,EAAA;AACd;AAOU;AAET,EAAA;AACmB,IAAA;AACJ,IAAA;AACf,EAAA;AACF;AA4BoB;AACH,EAAA;AACI,EAAA;AAEP,IAAA;AACA,MAAA;AACR,QAAA;AACF,MAAA;AACF,IAAA;AAEA,IAAA;AAAA;AAEU,MAAA;AAEA,MAAA;AACR,IAAA;AACU,MAAA;AACR,QAAA;AACF,MAAA;AACF,IAAA;AACF,EAAA;AACyB,EAAA;AAjL3B,IAAA;AAkLW,IAAA;AACY,MAAA;AACjB,MAAA;AACe,MAAA;AACJ,MAAA;AACZ,IAAA;AACH,EAAA;AACD;AAEwB;AACE,EAAA;AACvB,IAAA;AACkB,IAAA;AACI,IAAA;AACtB,IAAA;AACiB,IAAA;AACnB,EAAA;AACF;AAGE;AAIwB,EAAA;AACR,IAAA;AAChB,EAAA;AAEwB,EAAA;AACtB,IAAA;AACqB,IAAA;AACH,IAAA;AACpB,EAAA;AACuB,EAAA;AACzB;AAEe;AACb,EAAA;AACA,EAAA;AACA,EAAA;AAKmB;AAEJ,EAAA;AAGS,EAAA;AAGnB,IAAA;AAGkB,IAAA;AACf,IAAA;AAGS,IAAA;AAGjB,EAAA;AAEuB,EAAA;AACrB,IAAA;AACqB,IAAA;AACN,IAAA;AACG,IAAA;AACpB,EAAA;AACO,EAAA;AACT;AAEwB;AACG,EAAA;AACF,IAAA;AACvB,EAAA;AACiB,EAAA;AAEG,EAAA;AACK,IAAA;AACzB,EAAA;AAEuB,EAAA;AACzB;AASgB;AAGC,EAAA;AACQ,EAAA;AAGA,EAAA;AACL,EAAA;AACpB;AAEmB;AACI,EAAA;AACJ,EAAA;AACnB;AA4CsB;AACpB,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AAIA;AAlVF,EAAA;AAmVwB,EAAA;AAEJ,EAAA;AACJ,EAAA;AACP,IAAA;AACe,MAAA;AACF,MAAA;AACd,QAAA;AACA,QAAA;AACA,QAAA;AACF,MAAA;AACM,MAAA;AAGA,MAAA;AACM,MAAA;AAEV,MAAA;AAGK,MAAA;AACL,QAAA;AACmB,QAAA;AACd,UAAA;AACI,UAAA;AACP,UAAA;AACA,UAAA;AACE,YAAA;AACA,YAAA;AACF,UAAA;AACA,UAAA;AACD,QAAA;AACH,MAAA;AACF,IAAA;AACK,IAAA;AACG,MAAA;AAEJ,MAAA;AAKc,MAAA;AACJ,QAAA;AACZ,MAAA;AAEmB,MAAA;AACV,QAAA;AACP,QAAA;AACW,QAAA;AACZ,MAAA;AAEgB,MAAA;AACL,QAAA;AACZ,MAAA;AACM,MAAA;AACS,MAAA;AACjB,IAAA;AACA,IAAA;AACsB,MAAA;AACxB,EAAA;AACF;AAEe;AAOY,EAAA;AACb,EAAA;AAI4B,EAAA;AACrB,IAAA;AACR,IAAA;AACP,MAAA;AACa,MAAA;AACE,MAAA;AACI,MAAA;AACrB,IAAA;AACF,EAAA;AAEwB,EAAA;AACd,IAAA;AACa,IAAA;AACZ,IAAA;AACS,MAAA;AAClB,IAAA;AACgB,IAAA;AACjB,EAAA;AAEY,EAAA;AACS,IAAA;AACtB,EAAA;AAEI,EAAA;AACkB,IAAA;AACb,IAAA;AACG,EAAA;AACU,IAAA;AACtB,EAAA;AACF;AAEuB;AAED,EAAA;AACtB;AAEuB;AACjB,EAAA;AACqB,IAAA;AACb,EAAA;AACH,IAAA;AACT,EAAA;AACF;AAEsB;AACpB,EAAA;AACG,EAAA;AAC2C;AA7chD,EAAA;AA8cwB,EAAA;AACV,IAAA;AACR,MAAA;AACF,IAAA;AACF,EAAA;AAEkB,EAAA;AACG,EAAA;AACE,EAAA;AAEA,EAAA;AAET,EAAA;AACF,IAAA;AACA,MAAA;AACV,IAAA;AACF,EAAA;AAEuB,EAAA;AACN,IAAA;AACV,MAAA;AACS,MAAA;AACb,IAAA;AACgB,EAAA;AAEM,EAAA;AAER,EAAA;AACK,IAAA;AACtB,EAAA;AACO,EAAA;AACY,IAAA;AACC,EAAA;AACtB;AD/N2B;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA","file":"/home/runner/work/storage/storage/packages/blob/dist/client.cjs","sourcesContent":[null,"// eslint-disable-next-line unicorn/prefer-node-protocol -- node:crypto does not resolve correctly in browser and edge runtime\nimport * as crypto from 'crypto';\nimport type { IncomingMessage } from 'node:http';\n// When bundled via a bundler supporting the `browser` field, then\n// the `undici` module will be replaced with https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API\n// for browser contexts. See ./undici-browser.js and ./package.json\nimport { fetch } from 'undici';\nimport type { BlobCommandOptions, WithUploadProgress } from './helpers';\nimport { BlobError, getTokenFromOptionsOrEnv } from './helpers';\nimport { createPutMethod } from './put';\nimport type { PutBlobResult } from './put-helpers';\nimport type { CommonCompleteMultipartUploadOptions } from './multipart/complete';\nimport { createCompleteMultipartUploadMethod } from './multipart/complete';\nimport { createCreateMultipartUploadMethod } from './multipart/create';\nimport { createUploadPartMethod } from './multipart/upload';\nimport type { CommonMultipartUploadOptions } from './multipart/upload';\nimport { createCreateMultipartUploaderMethod } from './multipart/create-uploader';\n\n// interface for put, upload and multipartUpload.\n// This types omits all options that are encoded in the client token.\nexport interface ClientCommonCreateBlobOptions {\n  /**\n   * Whether the blob should be publicly accessible.\n   */\n  access: 'public';\n  /**\n   * Defines the content type of the blob. By default, this value is inferred from the pathname. Sent as the 'content-type' header when downloading a blob.\n   */\n  contentType?: string;\n  /**\n   * `AbortSignal` to cancel the running request. See https://developer.mozilla.org/en-US/docs/Web/API/AbortSignal\n   */\n  abortSignal?: AbortSignal;\n}\n\n// shared interface for put and multipartUpload\nexport interface ClientTokenOptions {\n  /**\n   * A client token that was generated by your server using the `generateClientToken` method.\n   */\n  token: string;\n}\n\n// shared interface for put and upload\ninterface ClientCommonPutOptions\n  extends ClientCommonCreateBlobOptions,\n    WithUploadProgress {\n  /**\n   * Whether to use multipart upload. Use this when uploading large files. It will split the file into multiple parts, upload them in parallel and retry failed parts.\n   */\n  multipart?: boolean;\n}\n\nfunction createPutExtraChecks<\n  TOptions extends ClientTokenOptions & ClientCommonCreateBlobOptions,\n>(methodName: string) {\n  return function extraChecks(options: TOptions) {\n    if (!options.token.startsWith('vercel_blob_client_')) {\n      throw new BlobError(`${methodName} must be called with a client token`);\n    }\n\n    if (\n      // @ts-expect-error -- Runtime check for DX.\n      options.addRandomSuffix !== undefined ||\n      // @ts-expect-error -- Runtime check for DX.\n      options.cacheControlMaxAge !== undefined\n    ) {\n      throw new BlobError(\n        `${methodName} doesn't allow addRandomSuffix and cacheControlMaxAge. Configure these options at the server side when generating client tokens.`,\n      );\n    }\n  };\n}\n\n// client.put()\n\nexport type ClientPutCommandOptions = ClientCommonPutOptions &\n  ClientTokenOptions;\n\nexport const put = createPutMethod<ClientPutCommandOptions>({\n  allowedOptions: ['contentType'],\n  extraChecks: createPutExtraChecks('client/`put`'),\n});\n\n// vercelBlob. createMultipartUpload()\n// vercelBlob. uploadPart()\n// vercelBlob. completeMultipartUpload()\n// vercelBlob. createMultipartUploader()\n\nexport type ClientCreateMultipartUploadCommandOptions =\n  ClientCommonCreateBlobOptions & ClientTokenOptions;\n\nexport const createMultipartUpload =\n  createCreateMultipartUploadMethod<ClientCreateMultipartUploadCommandOptions>({\n    allowedOptions: ['contentType'],\n    extraChecks: createPutExtraChecks('client/`createMultipartUpload`'),\n  });\n\nexport const createMultipartUploader =\n  createCreateMultipartUploaderMethod<ClientCreateMultipartUploadCommandOptions>(\n    {\n      allowedOptions: ['contentType'],\n      extraChecks: createPutExtraChecks('client/`createMultipartUpload`'),\n    },\n  );\n\ntype ClientMultipartUploadCommandOptions = ClientCommonCreateBlobOptions &\n  ClientTokenOptions &\n  CommonMultipartUploadOptions &\n  WithUploadProgress;\n\nexport const uploadPart =\n  createUploadPartMethod<ClientMultipartUploadCommandOptions>({\n    allowedOptions: ['contentType'],\n    extraChecks: createPutExtraChecks('client/`multipartUpload`'),\n  });\n\ntype ClientCompleteMultipartUploadCommandOptions =\n  ClientCommonCreateBlobOptions &\n    ClientTokenOptions &\n    CommonCompleteMultipartUploadOptions;\n\nexport const completeMultipartUpload =\n  createCompleteMultipartUploadMethod<ClientCompleteMultipartUploadCommandOptions>(\n    {\n      allowedOptions: ['contentType'],\n      extraChecks: createPutExtraChecks('client/`completeMultipartUpload`'),\n    },\n  );\n\n// upload methods\n\nexport interface CommonUploadOptions {\n  /**\n   * A route that implements the `handleUpload` function for generating a client token.\n   */\n  handleUploadUrl: string;\n  /**\n   * Additional data which will be sent to your `handleUpload` route.\n   */\n  clientPayload?: string;\n}\n\n// client.upload()\n// This is a client-side wrapper that will fetch the client token for you and then upload the file\nexport type UploadOptions = ClientCommonPutOptions & CommonUploadOptions;\n/**\n * Uploads a blob into your store from the client.\n * Detailed documentation can be found here: https://vercel.com/docs/storage/vercel-blob/using-blob-sdk#client-uploads\n *\n * If you want to upload from your server instead, check out the documentation for the put operation: https://vercel.com/docs/storage/vercel-blob/using-blob-sdk#upload-a-blob\n *\n * @param pathname - The pathname to upload the blob to. This includes the filename.\n * @param body - The contents of your blob. This has to be a supported fetch body type https://developer.mozilla.org/en-US/docs/Web/API/fetch#body.\n * @param options - Additional options.\n */\nexport const upload = createPutMethod<UploadOptions>({\n  allowedOptions: ['contentType'],\n  extraChecks(options) {\n    // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- Runtime check for DX.\n    if (options.handleUploadUrl === undefined) {\n      throw new BlobError(\n        \"client/`upload` requires the 'handleUploadUrl' parameter\",\n      );\n    }\n\n    if (\n      // @ts-expect-error -- Runtime check for DX.\n      options.addRandomSuffix !== undefined ||\n      // @ts-expect-error -- Runtime check for DX.\n      options.cacheControlMaxAge !== undefined\n    ) {\n      throw new BlobError(\n        \"client/`upload` doesn't allow addRandomSuffix and cacheControlMaxAge. Configure these options at the server side when generating client tokens.\",\n      );\n    }\n  },\n  async getToken(pathname, options) {\n    return retrieveClientToken({\n      handleUploadUrl: options.handleUploadUrl,\n      pathname,\n      clientPayload: options.clientPayload ?? null,\n      multipart: options.multipart ?? false,\n    });\n  },\n});\n\nasync function importKey(token: string): Promise<CryptoKey> {\n  return globalThis.crypto.subtle.importKey(\n    'raw',\n    new TextEncoder().encode(token),\n    { name: 'HMAC', hash: 'SHA-256' },\n    false,\n    ['sign', 'verify'],\n  );\n}\n\nasync function signPayload(\n  payload: string,\n  token: string,\n): Promise<string | undefined> {\n  // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- Node.js < 20: globalThis.crypto is undefined (in a real script.js, because the REPL has it linked to the crypto module). Node.js >= 20, Browsers and Cloudflare workers: globalThis.crypto is defined and is the Web Crypto API.\n  if (!globalThis.crypto) {\n    return crypto.createHmac('sha256', token).update(payload).digest('hex');\n  }\n\n  const signature = await globalThis.crypto.subtle.sign(\n    'HMAC',\n    await importKey(token),\n    new TextEncoder().encode(payload),\n  );\n  return Buffer.from(new Uint8Array(signature)).toString('hex');\n}\n\nasync function verifyCallbackSignature({\n  token,\n  signature,\n  body,\n}: {\n  token: string;\n  signature: string;\n  body: string;\n}): Promise<boolean> {\n  // callback signature is signed using the server token\n  const secret = token;\n  // Browsers, Edge runtime and Node >=20 implement the Web Crypto API\n  // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- Node.js < 20: globalThis.crypto is undefined (in a real script.js, because the REPL has it linked to the crypto module). Node.js >= 20, Browsers and Cloudflare workers: globalThis.crypto is defined and is the Web Crypto API.\n  if (!globalThis.crypto) {\n    // Node <20 falls back to the Node.js crypto module\n    const digest = crypto\n      .createHmac('sha256', secret)\n      .update(body)\n      .digest('hex');\n    const digestBuffer = Buffer.from(digest);\n    const signatureBuffer = Buffer.from(signature);\n\n    return (\n      digestBuffer.length === signatureBuffer.length &&\n      crypto.timingSafeEqual(digestBuffer, signatureBuffer)\n    );\n  }\n\n  const verified = await globalThis.crypto.subtle.verify(\n    'HMAC',\n    await importKey(token),\n    hexToArrayByte(signature),\n    new TextEncoder().encode(body),\n  );\n  return verified;\n}\n\nfunction hexToArrayByte(input: string): Buffer {\n  if (input.length % 2 !== 0) {\n    throw new RangeError('Expected string to be an even number of characters');\n  }\n  const view = new Uint8Array(input.length / 2);\n\n  for (let i = 0; i < input.length; i += 2) {\n    view[i / 2] = parseInt(input.substring(i, i + 2), 16);\n  }\n\n  return Buffer.from(view);\n}\n\nexport type DecodedClientTokenPayload = Omit<\n  GenerateClientTokenOptions,\n  'token'\n> & {\n  validUntil: number;\n};\n\nexport function getPayloadFromClientToken(\n  clientToken: string,\n): DecodedClientTokenPayload {\n  const [, , , , encodedToken] = clientToken.split('_');\n  const encodedPayload = Buffer.from(encodedToken ?? '', 'base64')\n    .toString()\n    .split('.')[1];\n  const decodedPayload = Buffer.from(encodedPayload ?? '', 'base64').toString();\n  return JSON.parse(decodedPayload) as DecodedClientTokenPayload;\n}\n\nconst EventTypes = {\n  generateClientToken: 'blob.generate-client-token',\n  uploadCompleted: 'blob.upload-completed',\n} as const;\n\ninterface GenerateClientTokenEvent {\n  type: (typeof EventTypes)['generateClientToken'];\n  payload: {\n    pathname: string;\n    callbackUrl: string;\n    multipart: boolean;\n    clientPayload: string | null;\n  };\n}\ninterface UploadCompletedEvent {\n  type: (typeof EventTypes)['uploadCompleted'];\n  payload: {\n    blob: PutBlobResult;\n    tokenPayload?: string | null;\n  };\n}\n\nexport type HandleUploadBody = GenerateClientTokenEvent | UploadCompletedEvent;\n\ntype RequestType = IncomingMessage | Request;\n\nexport interface HandleUploadOptions {\n  body: HandleUploadBody;\n  onBeforeGenerateToken: (\n    pathname: string,\n    clientPayload: string | null,\n    multipart: boolean,\n  ) => Promise<\n    Pick<\n      GenerateClientTokenOptions,\n      | 'allowedContentTypes'\n      | 'maximumSizeInBytes'\n      | 'validUntil'\n      | 'addRandomSuffix'\n      | 'cacheControlMaxAge'\n    > & { tokenPayload?: string | null }\n  >;\n  onUploadCompleted: (body: UploadCompletedEvent['payload']) => Promise<void>;\n  token?: string;\n  request: RequestType;\n}\n\nexport async function handleUpload({\n  token,\n  request,\n  body,\n  onBeforeGenerateToken,\n  onUploadCompleted,\n}: HandleUploadOptions): Promise<\n  | { type: GenerateClientTokenEvent['type']; clientToken: string }\n  | { type: UploadCompletedEvent['type']; response: 'ok' }\n> {\n  const resolvedToken = getTokenFromOptionsOrEnv({ token });\n\n  const type = body.type;\n  switch (type) {\n    case 'blob.generate-client-token': {\n      const { pathname, callbackUrl, clientPayload, multipart } = body.payload;\n      const payload = await onBeforeGenerateToken(\n        pathname,\n        clientPayload,\n        multipart,\n      );\n      const tokenPayload = payload.tokenPayload ?? clientPayload;\n\n      // one hour\n      const oneHourInSeconds = 60 * 60;\n      const now = new Date();\n      const validUntil =\n        payload.validUntil ??\n        now.setSeconds(now.getSeconds() + oneHourInSeconds);\n\n      return {\n        type,\n        clientToken: await generateClientTokenFromReadWriteToken({\n          ...payload,\n          token: resolvedToken,\n          pathname,\n          onUploadCompleted: {\n            callbackUrl,\n            tokenPayload,\n          },\n          validUntil,\n        }),\n      };\n    }\n    case 'blob.upload-completed': {\n      const signatureHeader = 'x-vercel-signature';\n      const signature = (\n        'credentials' in request\n          ? (request.headers.get(signatureHeader) ?? '')\n          : (request.headers[signatureHeader] ?? '')\n      ) as string;\n\n      if (!signature) {\n        throw new BlobError('Missing callback signature');\n      }\n\n      const isVerified = await verifyCallbackSignature({\n        token: resolvedToken,\n        signature,\n        body: JSON.stringify(body),\n      });\n\n      if (!isVerified) {\n        throw new BlobError('Invalid callback signature');\n      }\n      await onUploadCompleted(body.payload);\n      return { type, response: 'ok' };\n    }\n    default:\n      throw new BlobError('Invalid event type');\n  }\n}\n\nasync function retrieveClientToken(options: {\n  pathname: string;\n  handleUploadUrl: string;\n  clientPayload: string | null;\n  multipart: boolean;\n  abortSignal?: AbortSignal;\n}): Promise<string> {\n  const { handleUploadUrl, pathname } = options;\n  const url = isAbsoluteUrl(handleUploadUrl)\n    ? handleUploadUrl\n    : toAbsoluteUrl(handleUploadUrl);\n\n  const event: GenerateClientTokenEvent = {\n    type: EventTypes.generateClientToken,\n    payload: {\n      pathname,\n      callbackUrl: url,\n      clientPayload: options.clientPayload,\n      multipart: options.multipart,\n    },\n  };\n\n  const res = await fetch(url, {\n    method: 'POST',\n    body: JSON.stringify(event),\n    headers: {\n      'content-type': 'application/json',\n    },\n    signal: options.abortSignal,\n  });\n\n  if (!res.ok) {\n    throw new BlobError('Failed to  retrieve the client token');\n  }\n\n  try {\n    const { clientToken } = (await res.json()) as { clientToken: string };\n    return clientToken;\n  } catch (e) {\n    throw new BlobError('Failed to retrieve the client token');\n  }\n}\n\nfunction toAbsoluteUrl(url: string): string {\n  // location is available in web workers too: https://developer.mozilla.org/en-US/docs/Web/API/Window/location\n  return new URL(url, location.href).href;\n}\n\nfunction isAbsoluteUrl(url: string): boolean {\n  try {\n    return Boolean(new URL(url));\n  } catch (e) {\n    return false;\n  }\n}\n\nexport async function generateClientTokenFromReadWriteToken({\n  token,\n  ...argsWithoutToken\n}: GenerateClientTokenOptions): Promise<string> {\n  if (typeof window !== 'undefined') {\n    throw new BlobError(\n      '\"generateClientTokenFromReadWriteToken\" must be called from a server environment',\n    );\n  }\n\n  const timestamp = new Date();\n  timestamp.setSeconds(timestamp.getSeconds() + 30);\n  const readWriteToken = getTokenFromOptionsOrEnv({ token });\n\n  const [, , , storeId = null] = readWriteToken.split('_');\n\n  if (!storeId) {\n    throw new BlobError(\n      token ? 'Invalid `token` parameter' : 'Invalid `BLOB_READ_WRITE_TOKEN`',\n    );\n  }\n\n  const payload = Buffer.from(\n    JSON.stringify({\n      ...argsWithoutToken,\n      validUntil: argsWithoutToken.validUntil ?? timestamp.getTime(),\n    }),\n  ).toString('base64');\n\n  const securedKey = await signPayload(payload, readWriteToken);\n\n  if (!securedKey) {\n    throw new BlobError('Unable to sign client token');\n  }\n  return `vercel_blob_client_${storeId}_${Buffer.from(\n    `${securedKey}.${payload}`,\n  ).toString('base64')}`;\n}\n\nexport interface GenerateClientTokenOptions extends BlobCommandOptions {\n  pathname: string;\n  onUploadCompleted?: {\n    callbackUrl: string;\n    tokenPayload?: string | null;\n  };\n  maximumSizeInBytes?: number;\n  allowedContentTypes?: string[];\n  validUntil?: number;\n  addRandomSuffix?: boolean;\n  cacheControlMaxAge?: number;\n}\n\nexport { createFolder } from './create-folder';\n"]}

package/dist/client.js

@@ -7,18 +7,13 @@ import {
   createPutMethod,
   createUploadPartMethod,
   getTokenFromOptionsOrEnv
-} from "./chunk-KN6WT5GP.js";
+} from "./chunk-JGHUXF3X.js";
 
 // src/client.ts
 import * as crypto from "crypto";
 import { fetch } from "undici";
 function createPutExtraChecks(methodName) {
   return function extraChecks(options) {
-    if (typeof window === "undefined") {
-      throw new BlobError(
-        `${methodName} must be called from a client environment`
-      );
-    }
     if (!options.token.startsWith("vercel_blob_client_")) {
       throw new BlobError(`${methodName} must be called with a client token`);
     }
@@ -60,11 +55,6 @@ var completeMultipartUpload = createCompleteMultipartUploadMethod(
 var upload = createPutMethod({
   allowedOptions: ["contentType"],
   extraChecks(options) {
-    if (typeof window === "undefined") {
-      throw new BlobError(
-        "client/`upload` must be called from a client environment"
-      );
-    }
     if (options.handleUploadUrl === void 0) {
       throw new BlobError(
         "client/`upload` requires the 'handleUploadUrl' parameter"
@@ -238,7 +228,7 @@ async function retrieveClientToken(options) {
   }
 }
 function toAbsoluteUrl(url) {
-  return new URL(url, window.location.href).href;
+  return new URL(url, location.href).href;
 }
 function isAbsoluteUrl(url) {
   try {

package/dist/client.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/client.ts"],"sourcesContent":["// eslint-disable-next-line unicorn/prefer-node-protocol -- node:crypto does not resolve correctly in browser and edge runtime\nimport * as crypto from 'crypto';\nimport type { IncomingMessage } from 'node:http';\n// When bundled via a bundler supporting the `browser` field, then\n// the `undici` module will be replaced with https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API\n// for browser contexts. See ./undici-browser.js and ./package.json\nimport { fetch } from 'undici';\nimport type { BlobCommandOptions, WithUploadProgress } from './helpers';\nimport { BlobError, getTokenFromOptionsOrEnv } from './helpers';\nimport { createPutMethod } from './put';\nimport type { PutBlobResult } from './put-helpers';\nimport type { CommonCompleteMultipartUploadOptions } from './multipart/complete';\nimport { createCompleteMultipartUploadMethod } from './multipart/complete';\nimport { createCreateMultipartUploadMethod } from './multipart/create';\nimport { createUploadPartMethod } from './multipart/upload';\nimport type { CommonMultipartUploadOptions } from './multipart/upload';\nimport { createCreateMultipartUploaderMethod } from './multipart/create-uploader';\n\n// interface for put, upload and multipartUpload.\n// This types omits all options that are encoded in the client token.\nexport interface ClientCommonCreateBlobOptions {\n  /**\n   * Whether the blob should be publicly accessible.\n   */\n  access: 'public';\n  /**\n   * Defines the content type of the blob. By default, this value is inferred from the pathname. Sent as the 'content-type' header when downloading a blob.\n   */\n  contentType?: string;\n  /**\n   * `AbortSignal` to cancel the running request. See https://developer.mozilla.org/en-US/docs/Web/API/AbortSignal\n   */\n  abortSignal?: AbortSignal;\n}\n\n// shared interface for put and multipartUpload\nexport interface ClientTokenOptions {\n  /**\n   * A client token that was generated by your server using the `generateClientToken` method.\n   */\n  token: string;\n}\n\n// shared interface for put and upload\ninterface ClientCommonPutOptions\n  extends ClientCommonCreateBlobOptions,\n    WithUploadProgress {\n  /**\n   * Whether to use multipart upload. Use this when uploading large files. It will split the file into multiple parts, upload them in parallel and retry failed parts.\n   */\n  multipart?: boolean;\n}\n\nfunction createPutExtraChecks<\n  TOptions extends ClientTokenOptions & ClientCommonCreateBlobOptions,\n>(methodName: string) {\n  return function extraChecks(options: TOptions) {\n    if (typeof window === 'undefined') {\n      throw new BlobError(\n        `${methodName} must be called from a client environment`,\n      );\n    }\n\n    if (!options.token.startsWith('vercel_blob_client_')) {\n      throw new BlobError(`${methodName} must be called with a client token`);\n    }\n\n    if (\n      // @ts-expect-error -- Runtime check for DX.\n      options.addRandomSuffix !== undefined ||\n      // @ts-expect-error -- Runtime check for DX.\n      options.cacheControlMaxAge !== undefined\n    ) {\n      throw new BlobError(\n        `${methodName} doesn't allow addRandomSuffix and cacheControlMaxAge. Configure these options at the server side when generating client tokens.`,\n      );\n    }\n  };\n}\n\n// client.put()\n\nexport type ClientPutCommandOptions = ClientCommonPutOptions &\n  ClientTokenOptions;\n\nexport const put = createPutMethod<ClientPutCommandOptions>({\n  allowedOptions: ['contentType'],\n  extraChecks: createPutExtraChecks('client/`put`'),\n});\n\n// vercelBlob. createMultipartUpload()\n// vercelBlob. uploadPart()\n// vercelBlob. completeMultipartUpload()\n// vercelBlob. createMultipartUploader()\n\nexport type ClientCreateMultipartUploadCommandOptions =\n  ClientCommonCreateBlobOptions & ClientTokenOptions;\n\nexport const createMultipartUpload =\n  createCreateMultipartUploadMethod<ClientCreateMultipartUploadCommandOptions>({\n    allowedOptions: ['contentType'],\n    extraChecks: createPutExtraChecks('client/`createMultipartUpload`'),\n  });\n\nexport const createMultipartUploader =\n  createCreateMultipartUploaderMethod<ClientCreateMultipartUploadCommandOptions>(\n    {\n      allowedOptions: ['contentType'],\n      extraChecks: createPutExtraChecks('client/`createMultipartUpload`'),\n    },\n  );\n\ntype ClientMultipartUploadCommandOptions = ClientCommonCreateBlobOptions &\n  ClientTokenOptions &\n  CommonMultipartUploadOptions &\n  WithUploadProgress;\n\nexport const uploadPart =\n  createUploadPartMethod<ClientMultipartUploadCommandOptions>({\n    allowedOptions: ['contentType'],\n    extraChecks: createPutExtraChecks('client/`multipartUpload`'),\n  });\n\ntype ClientCompleteMultipartUploadCommandOptions =\n  ClientCommonCreateBlobOptions &\n    ClientTokenOptions &\n    CommonCompleteMultipartUploadOptions;\n\nexport const completeMultipartUpload =\n  createCompleteMultipartUploadMethod<ClientCompleteMultipartUploadCommandOptions>(\n    {\n      allowedOptions: ['contentType'],\n      extraChecks: createPutExtraChecks('client/`completeMultipartUpload`'),\n    },\n  );\n\n// upload methods\n\nexport interface CommonUploadOptions {\n  /**\n   * A route that implements the `handleUpload` function for generating a client token.\n   */\n  handleUploadUrl: string;\n  /**\n   * Additional data which will be sent to your `handleUpload` route.\n   */\n  clientPayload?: string;\n}\n\n// client.upload()\n// This is a client-side wrapper that will fetch the client token for you and then upload the file\nexport type UploadOptions = ClientCommonPutOptions & CommonUploadOptions;\n/**\n * Uploads a blob into your store from the client.\n * Detailed documentation can be found here: https://vercel.com/docs/storage/vercel-blob/using-blob-sdk#client-uploads\n *\n * If you want to upload from your server instead, check out the documentation for the put operation: https://vercel.com/docs/storage/vercel-blob/using-blob-sdk#upload-a-blob\n *\n * @param pathname - The pathname to upload the blob to. This includes the filename.\n * @param body - The contents of your blob. This has to be a supported fetch body type https://developer.mozilla.org/en-US/docs/Web/API/fetch#body.\n * @param options - Additional options.\n */\nexport const upload = createPutMethod<UploadOptions>({\n  allowedOptions: ['contentType'],\n  extraChecks(options) {\n    if (typeof window === 'undefined') {\n      throw new BlobError(\n        'client/`upload` must be called from a client environment',\n      );\n    }\n\n    // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- Runtime check for DX.\n    if (options.handleUploadUrl === undefined) {\n      throw new BlobError(\n        \"client/`upload` requires the 'handleUploadUrl' parameter\",\n      );\n    }\n\n    if (\n      // @ts-expect-error -- Runtime check for DX.\n      options.addRandomSuffix !== undefined ||\n      // @ts-expect-error -- Runtime check for DX.\n      options.cacheControlMaxAge !== undefined\n    ) {\n      throw new BlobError(\n        \"client/`upload` doesn't allow addRandomSuffix and cacheControlMaxAge. Configure these options at the server side when generating client tokens.\",\n      );\n    }\n  },\n  async getToken(pathname, options) {\n    return retrieveClientToken({\n      handleUploadUrl: options.handleUploadUrl,\n      pathname,\n      clientPayload: options.clientPayload ?? null,\n      multipart: options.multipart ?? false,\n    });\n  },\n});\n\nasync function importKey(token: string): Promise<CryptoKey> {\n  return globalThis.crypto.subtle.importKey(\n    'raw',\n    new TextEncoder().encode(token),\n    { name: 'HMAC', hash: 'SHA-256' },\n    false,\n    ['sign', 'verify'],\n  );\n}\n\nasync function signPayload(\n  payload: string,\n  token: string,\n): Promise<string | undefined> {\n  // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- Node.js < 20: globalThis.crypto is undefined (in a real script.js, because the REPL has it linked to the crypto module). Node.js >= 20, Browsers and Cloudflare workers: globalThis.crypto is defined and is the Web Crypto API.\n  if (!globalThis.crypto) {\n    return crypto.createHmac('sha256', token).update(payload).digest('hex');\n  }\n\n  const signature = await globalThis.crypto.subtle.sign(\n    'HMAC',\n    await importKey(token),\n    new TextEncoder().encode(payload),\n  );\n  return Buffer.from(new Uint8Array(signature)).toString('hex');\n}\n\nasync function verifyCallbackSignature({\n  token,\n  signature,\n  body,\n}: {\n  token: string;\n  signature: string;\n  body: string;\n}): Promise<boolean> {\n  // callback signature is signed using the server token\n  const secret = token;\n  // Browsers, Edge runtime and Node >=20 implement the Web Crypto API\n  // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- Node.js < 20: globalThis.crypto is undefined (in a real script.js, because the REPL has it linked to the crypto module). Node.js >= 20, Browsers and Cloudflare workers: globalThis.crypto is defined and is the Web Crypto API.\n  if (!globalThis.crypto) {\n    // Node <20 falls back to the Node.js crypto module\n    const digest = crypto\n      .createHmac('sha256', secret)\n      .update(body)\n      .digest('hex');\n    const digestBuffer = Buffer.from(digest);\n    const signatureBuffer = Buffer.from(signature);\n\n    return (\n      digestBuffer.length === signatureBuffer.length &&\n      crypto.timingSafeEqual(digestBuffer, signatureBuffer)\n    );\n  }\n\n  const verified = await globalThis.crypto.subtle.verify(\n    'HMAC',\n    await importKey(token),\n    hexToArrayByte(signature),\n    new TextEncoder().encode(body),\n  );\n  return verified;\n}\n\nfunction hexToArrayByte(input: string): ArrayBuffer {\n  if (input.length % 2 !== 0) {\n    throw new RangeError('Expected string to be an even number of characters');\n  }\n  const view = new Uint8Array(input.length / 2);\n\n  for (let i = 0; i < input.length; i += 2) {\n    view[i / 2] = parseInt(input.substring(i, i + 2), 16);\n  }\n\n  return Buffer.from(view);\n}\n\nexport type DecodedClientTokenPayload = Omit<\n  GenerateClientTokenOptions,\n  'token'\n> & {\n  validUntil: number;\n};\n\nexport function getPayloadFromClientToken(\n  clientToken: string,\n): DecodedClientTokenPayload {\n  const [, , , , encodedToken] = clientToken.split('_');\n  const encodedPayload = Buffer.from(encodedToken ?? '', 'base64')\n    .toString()\n    .split('.')[1];\n  const decodedPayload = Buffer.from(encodedPayload ?? '', 'base64').toString();\n  return JSON.parse(decodedPayload) as DecodedClientTokenPayload;\n}\n\nconst EventTypes = {\n  generateClientToken: 'blob.generate-client-token',\n  uploadCompleted: 'blob.upload-completed',\n} as const;\n\ninterface GenerateClientTokenEvent {\n  type: (typeof EventTypes)['generateClientToken'];\n  payload: {\n    pathname: string;\n    callbackUrl: string;\n    multipart: boolean;\n    clientPayload: string | null;\n  };\n}\ninterface UploadCompletedEvent {\n  type: (typeof EventTypes)['uploadCompleted'];\n  payload: {\n    blob: PutBlobResult;\n    tokenPayload?: string | null;\n  };\n}\n\nexport type HandleUploadBody = GenerateClientTokenEvent | UploadCompletedEvent;\n\ntype RequestType = IncomingMessage | Request;\n\nexport interface HandleUploadOptions {\n  body: HandleUploadBody;\n  onBeforeGenerateToken: (\n    pathname: string,\n    clientPayload: string | null,\n    multipart: boolean,\n  ) => Promise<\n    Pick<\n      GenerateClientTokenOptions,\n      | 'allowedContentTypes'\n      | 'maximumSizeInBytes'\n      | 'validUntil'\n      | 'addRandomSuffix'\n      | 'cacheControlMaxAge'\n    > & { tokenPayload?: string | null }\n  >;\n  onUploadCompleted: (body: UploadCompletedEvent['payload']) => Promise<void>;\n  token?: string;\n  request: RequestType;\n}\n\nexport async function handleUpload({\n  token,\n  request,\n  body,\n  onBeforeGenerateToken,\n  onUploadCompleted,\n}: HandleUploadOptions): Promise<\n  | { type: GenerateClientTokenEvent['type']; clientToken: string }\n  | { type: UploadCompletedEvent['type']; response: 'ok' }\n> {\n  const resolvedToken = getTokenFromOptionsOrEnv({ token });\n\n  const type = body.type;\n  switch (type) {\n    case 'blob.generate-client-token': {\n      const { pathname, callbackUrl, clientPayload, multipart } = body.payload;\n      const payload = await onBeforeGenerateToken(\n        pathname,\n        clientPayload,\n        multipart,\n      );\n      const tokenPayload = payload.tokenPayload ?? clientPayload;\n\n      // one hour\n      const oneHourInSeconds = 60 * 60;\n      const now = new Date();\n      const validUntil =\n        payload.validUntil ??\n        now.setSeconds(now.getSeconds() + oneHourInSeconds);\n\n      return {\n        type,\n        clientToken: await generateClientTokenFromReadWriteToken({\n          ...payload,\n          token: resolvedToken,\n          pathname,\n          onUploadCompleted: {\n            callbackUrl,\n            tokenPayload,\n          },\n          validUntil,\n        }),\n      };\n    }\n    case 'blob.upload-completed': {\n      const signatureHeader = 'x-vercel-signature';\n      const signature = (\n        'credentials' in request\n          ? (request.headers.get(signatureHeader) ?? '')\n          : (request.headers[signatureHeader] ?? '')\n      ) as string;\n\n      if (!signature) {\n        throw new BlobError('Missing callback signature');\n      }\n\n      const isVerified = await verifyCallbackSignature({\n        token: resolvedToken,\n        signature,\n        body: JSON.stringify(body),\n      });\n\n      if (!isVerified) {\n        throw new BlobError('Invalid callback signature');\n      }\n      await onUploadCompleted(body.payload);\n      return { type, response: 'ok' };\n    }\n    default:\n      throw new BlobError('Invalid event type');\n  }\n}\n\nasync function retrieveClientToken(options: {\n  pathname: string;\n  handleUploadUrl: string;\n  clientPayload: string | null;\n  multipart: boolean;\n  abortSignal?: AbortSignal;\n}): Promise<string> {\n  const { handleUploadUrl, pathname } = options;\n  const url = isAbsoluteUrl(handleUploadUrl)\n    ? handleUploadUrl\n    : toAbsoluteUrl(handleUploadUrl);\n\n  const event: GenerateClientTokenEvent = {\n    type: EventTypes.generateClientToken,\n    payload: {\n      pathname,\n      callbackUrl: url,\n      clientPayload: options.clientPayload,\n      multipart: options.multipart,\n    },\n  };\n\n  const res = await fetch(url, {\n    method: 'POST',\n    body: JSON.stringify(event),\n    headers: {\n      'content-type': 'application/json',\n    },\n    signal: options.abortSignal,\n  });\n\n  if (!res.ok) {\n    throw new BlobError('Failed to  retrieve the client token');\n  }\n\n  try {\n    const { clientToken } = (await res.json()) as { clientToken: string };\n    return clientToken;\n  } catch (e) {\n    throw new BlobError('Failed to retrieve the client token');\n  }\n}\n\nfunction toAbsoluteUrl(url: string): string {\n  return new URL(url, window.location.href).href;\n}\n\nfunction isAbsoluteUrl(url: string): boolean {\n  try {\n    return Boolean(new URL(url));\n  } catch (e) {\n    return false;\n  }\n}\n\nexport async function generateClientTokenFromReadWriteToken({\n  token,\n  ...argsWithoutToken\n}: GenerateClientTokenOptions): Promise<string> {\n  if (typeof window !== 'undefined') {\n    throw new BlobError(\n      '\"generateClientTokenFromReadWriteToken\" must be called from a server environment',\n    );\n  }\n\n  const timestamp = new Date();\n  timestamp.setSeconds(timestamp.getSeconds() + 30);\n  const readWriteToken = getTokenFromOptionsOrEnv({ token });\n\n  const [, , , storeId = null] = readWriteToken.split('_');\n\n  if (!storeId) {\n    throw new BlobError(\n      token ? 'Invalid `token` parameter' : 'Invalid `BLOB_READ_WRITE_TOKEN`',\n    );\n  }\n\n  const payload = Buffer.from(\n    JSON.stringify({\n      ...argsWithoutToken,\n      validUntil: argsWithoutToken.validUntil ?? timestamp.getTime(),\n    }),\n  ).toString('base64');\n\n  const securedKey = await signPayload(payload, readWriteToken);\n\n  if (!securedKey) {\n    throw new BlobError('Unable to sign client token');\n  }\n  return `vercel_blob_client_${storeId}_${Buffer.from(\n    `${securedKey}.${payload}`,\n  ).toString('base64')}`;\n}\n\nexport interface GenerateClientTokenOptions extends BlobCommandOptions {\n  pathname: string;\n  onUploadCompleted?: {\n    callbackUrl: string;\n    tokenPayload?: string | null;\n  };\n  maximumSizeInBytes?: number;\n  allowedContentTypes?: string[];\n  validUntil?: number;\n  addRandomSuffix?: boolean;\n  cacheControlMaxAge?: number;\n}\n\nexport { createFolder } from './create-folder';\n"],"mappings":";;;;;;;;;;;;AACA,YAAY,YAAY;AAKxB,SAAS,aAAa;AA+CtB,SAAS,qBAEP,YAAoB;AACpB,SAAO,SAAS,YAAY,SAAmB;AAC7C,QAAI,OAAO,WAAW,aAAa;AACjC,YAAM,IAAI;AAAA,QACR,GAAG,UAAU;AAAA,MACf;AAAA,IACF;AAEA,QAAI,CAAC,QAAQ,MAAM,WAAW,qBAAqB,GAAG;AACpD,YAAM,IAAI,UAAU,GAAG,UAAU,qCAAqC;AAAA,IACxE;AAEA;AAAA;AAAA,MAEE,QAAQ,oBAAoB;AAAA,MAE5B,QAAQ,uBAAuB;AAAA,MAC/B;AACA,YAAM,IAAI;AAAA,QACR,GAAG,UAAU;AAAA,MACf;AAAA,IACF;AAAA,EACF;AACF;AAOO,IAAM,MAAM,gBAAyC;AAAA,EAC1D,gBAAgB,CAAC,aAAa;AAAA,EAC9B,aAAa,qBAAqB,cAAc;AAClD,CAAC;AAUM,IAAM,wBACX,kCAA6E;AAAA,EAC3E,gBAAgB,CAAC,aAAa;AAAA,EAC9B,aAAa,qBAAqB,gCAAgC;AACpE,CAAC;AAEI,IAAM,0BACX;AAAA,EACE;AAAA,IACE,gBAAgB,CAAC,aAAa;AAAA,IAC9B,aAAa,qBAAqB,gCAAgC;AAAA,EACpE;AACF;AAOK,IAAM,aACX,uBAA4D;AAAA,EAC1D,gBAAgB,CAAC,aAAa;AAAA,EAC9B,aAAa,qBAAqB,0BAA0B;AAC9D,CAAC;AAOI,IAAM,0BACX;AAAA,EACE;AAAA,IACE,gBAAgB,CAAC,aAAa;AAAA,IAC9B,aAAa,qBAAqB,kCAAkC;AAAA,EACtE;AACF;AA4BK,IAAM,SAAS,gBAA+B;AAAA,EACnD,gBAAgB,CAAC,aAAa;AAAA,EAC9B,YAAY,SAAS;AACnB,QAAI,OAAO,WAAW,aAAa;AACjC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAGA,QAAI,QAAQ,oBAAoB,QAAW;AACzC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA;AAAA;AAAA,MAEE,QAAQ,oBAAoB;AAAA,MAE5B,QAAQ,uBAAuB;AAAA,MAC/B;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA,MAAM,SAAS,UAAU,SAAS;AA7LpC;AA8LI,WAAO,oBAAoB;AAAA,MACzB,iBAAiB,QAAQ;AAAA,MACzB;AAAA,MACA,gBAAe,aAAQ,kBAAR,YAAyB;AAAA,MACxC,YAAW,aAAQ,cAAR,YAAqB;AAAA,IAClC,CAAC;AAAA,EACH;AACF,CAAC;AAED,eAAe,UAAU,OAAmC;AAC1D,SAAO,WAAW,OAAO,OAAO;AAAA,IAC9B;AAAA,IACA,IAAI,YAAY,EAAE,OAAO,KAAK;AAAA,IAC9B,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,IAChC;AAAA,IACA,CAAC,QAAQ,QAAQ;AAAA,EACnB;AACF;AAEA,eAAe,YACb,SACA,OAC6B;AAE7B,MAAI,CAAC,WAAW,QAAQ;AACtB,WAAc,kBAAW,UAAU,KAAK,EAAE,OAAO,OAAO,EAAE,OAAO,KAAK;AAAA,EACxE;AAEA,QAAM,YAAY,MAAM,WAAW,OAAO,OAAO;AAAA,IAC/C;AAAA,IACA,MAAM,UAAU,KAAK;AAAA,IACrB,IAAI,YAAY,EAAE,OAAO,OAAO;AAAA,EAClC;AACA,SAAO,OAAO,KAAK,IAAI,WAAW,SAAS,CAAC,EAAE,SAAS,KAAK;AAC9D;AAEA,eAAe,wBAAwB;AAAA,EACrC;AAAA,EACA;AAAA,EACA;AACF,GAIqB;AAEnB,QAAM,SAAS;AAGf,MAAI,CAAC,WAAW,QAAQ;AAEtB,UAAM,SACH,kBAAW,UAAU,MAAM,EAC3B,OAAO,IAAI,EACX,OAAO,KAAK;AACf,UAAM,eAAe,OAAO,KAAK,MAAM;AACvC,UAAM,kBAAkB,OAAO,KAAK,SAAS;AAE7C,WACE,aAAa,WAAW,gBAAgB,UACjC,uBAAgB,cAAc,eAAe;AAAA,EAExD;AAEA,QAAM,WAAW,MAAM,WAAW,OAAO,OAAO;AAAA,IAC9C;AAAA,IACA,MAAM,UAAU,KAAK;AAAA,IACrB,eAAe,SAAS;AAAA,IACxB,IAAI,YAAY,EAAE,OAAO,IAAI;AAAA,EAC/B;AACA,SAAO;AACT;AAEA,SAAS,eAAe,OAA4B;AAClD,MAAI,MAAM,SAAS,MAAM,GAAG;AAC1B,UAAM,IAAI,WAAW,oDAAoD;AAAA,EAC3E;AACA,QAAM,OAAO,IAAI,WAAW,MAAM,SAAS,CAAC;AAE5C,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK,GAAG;AACxC,SAAK,IAAI,CAAC,IAAI,SAAS,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE;AAAA,EACtD;AAEA,SAAO,OAAO,KAAK,IAAI;AACzB;AASO,SAAS,0BACd,aAC2B;AAC3B,QAAM,CAAC,EAAE,EAAE,EAAE,EAAE,YAAY,IAAI,YAAY,MAAM,GAAG;AACpD,QAAM,iBAAiB,OAAO,KAAK,sCAAgB,IAAI,QAAQ,EAC5D,SAAS,EACT,MAAM,GAAG,EAAE,CAAC;AACf,QAAM,iBAAiB,OAAO,KAAK,0CAAkB,IAAI,QAAQ,EAAE,SAAS;AAC5E,SAAO,KAAK,MAAM,cAAc;AAClC;AAEA,IAAM,aAAa;AAAA,EACjB,qBAAqB;AAAA,EACrB,iBAAiB;AACnB;AA4CA,eAAsB,aAAa;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAGE;AA9VF;AA+VE,QAAM,gBAAgB,yBAAyB,EAAE,MAAM,CAAC;AAExD,QAAM,OAAO,KAAK;AAClB,UAAQ,MAAM;AAAA,IACZ,KAAK,8BAA8B;AACjC,YAAM,EAAE,UAAU,aAAa,eAAe,UAAU,IAAI,KAAK;AACjE,YAAM,UAAU,MAAM;AAAA,QACpB;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,YAAM,gBAAe,aAAQ,iBAAR,YAAwB;AAG7C,YAAM,mBAAmB,KAAK;AAC9B,YAAM,MAAM,oBAAI,KAAK;AACrB,YAAM,cACJ,aAAQ,eAAR,YACA,IAAI,WAAW,IAAI,WAAW,IAAI,gBAAgB;AAEpD,aAAO;AAAA,QACL;AAAA,QACA,aAAa,MAAM,sCAAsC;AAAA,UACvD,GAAG;AAAA,UACH,OAAO;AAAA,UACP;AAAA,UACA,mBAAmB;AAAA,YACjB;AAAA,YACA;AAAA,UACF;AAAA,UACA;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF;AAAA,IACA,KAAK,yBAAyB;AAC5B,YAAM,kBAAkB;AACxB,YAAM,YACJ,iBAAiB,WACZ,aAAQ,QAAQ,IAAI,eAAe,MAAnC,YAAwC,MACxC,aAAQ,QAAQ,eAAe,MAA/B,YAAoC;AAG3C,UAAI,CAAC,WAAW;AACd,cAAM,IAAI,UAAU,4BAA4B;AAAA,MAClD;AAEA,YAAM,aAAa,MAAM,wBAAwB;AAAA,QAC/C,OAAO;AAAA,QACP;AAAA,QACA,MAAM,KAAK,UAAU,IAAI;AAAA,MAC3B,CAAC;AAED,UAAI,CAAC,YAAY;AACf,cAAM,IAAI,UAAU,4BAA4B;AAAA,MAClD;AACA,YAAM,kBAAkB,KAAK,OAAO;AACpC,aAAO,EAAE,MAAM,UAAU,KAAK;AAAA,IAChC;AAAA,IACA;AACE,YAAM,IAAI,UAAU,oBAAoB;AAAA,EAC5C;AACF;AAEA,eAAe,oBAAoB,SAMf;AAClB,QAAM,EAAE,iBAAiB,SAAS,IAAI;AACtC,QAAM,MAAM,cAAc,eAAe,IACrC,kBACA,cAAc,eAAe;AAEjC,QAAM,QAAkC;AAAA,IACtC,MAAM,WAAW;AAAA,IACjB,SAAS;AAAA,MACP;AAAA,MACA,aAAa;AAAA,MACb,eAAe,QAAQ;AAAA,MACvB,WAAW,QAAQ;AAAA,IACrB;AAAA,EACF;AAEA,QAAM,MAAM,MAAM,MAAM,KAAK;AAAA,IAC3B,QAAQ;AAAA,IACR,MAAM,KAAK,UAAU,KAAK;AAAA,IAC1B,SAAS;AAAA,MACP,gBAAgB;AAAA,IAClB;AAAA,IACA,QAAQ,QAAQ;AAAA,EAClB,CAAC;AAED,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,IAAI,UAAU,sCAAsC;AAAA,EAC5D;AAEA,MAAI;AACF,UAAM,EAAE,YAAY,IAAK,MAAM,IAAI,KAAK;AACxC,WAAO;AAAA,EACT,SAAS,GAAG;AACV,UAAM,IAAI,UAAU,qCAAqC;AAAA,EAC3D;AACF;AAEA,SAAS,cAAc,KAAqB;AAC1C,SAAO,IAAI,IAAI,KAAK,OAAO,SAAS,IAAI,EAAE;AAC5C;AAEA,SAAS,cAAc,KAAsB;AAC3C,MAAI;AACF,WAAO,QAAQ,IAAI,IAAI,GAAG,CAAC;AAAA,EAC7B,SAAS,GAAG;AACV,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,sCAAsC;AAAA,EAC1D;AAAA,EACA,GAAG;AACL,GAAgD;AAxdhD;AAydE,MAAI,OAAO,WAAW,aAAa;AACjC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,YAAY,oBAAI,KAAK;AAC3B,YAAU,WAAW,UAAU,WAAW,IAAI,EAAE;AAChD,QAAM,iBAAiB,yBAAyB,EAAE,MAAM,CAAC;AAEzD,QAAM,CAAC,EAAE,EAAE,EAAE,UAAU,IAAI,IAAI,eAAe,MAAM,GAAG;AAEvD,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI;AAAA,MACR,QAAQ,8BAA8B;AAAA,IACxC;AAAA,EACF;AAEA,QAAM,UAAU,OAAO;AAAA,IACrB,KAAK,UAAU;AAAA,MACb,GAAG;AAAA,MACH,aAAY,sBAAiB,eAAjB,YAA+B,UAAU,QAAQ;AAAA,IAC/D,CAAC;AAAA,EACH,EAAE,SAAS,QAAQ;AAEnB,QAAM,aAAa,MAAM,YAAY,SAAS,cAAc;AAE5D,MAAI,CAAC,YAAY;AACf,UAAM,IAAI,UAAU,6BAA6B;AAAA,EACnD;AACA,SAAO,sBAAsB,OAAO,IAAI,OAAO;AAAA,IAC7C,GAAG,UAAU,IAAI,OAAO;AAAA,EAC1B,EAAE,SAAS,QAAQ,CAAC;AACtB;","names":[]}
+{"version":3,"sources":["../src/client.ts"],"sourcesContent":["// eslint-disable-next-line unicorn/prefer-node-protocol -- node:crypto does not resolve correctly in browser and edge runtime\nimport * as crypto from 'crypto';\nimport type { IncomingMessage } from 'node:http';\n// When bundled via a bundler supporting the `browser` field, then\n// the `undici` module will be replaced with https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API\n// for browser contexts. See ./undici-browser.js and ./package.json\nimport { fetch } from 'undici';\nimport type { BlobCommandOptions, WithUploadProgress } from './helpers';\nimport { BlobError, getTokenFromOptionsOrEnv } from './helpers';\nimport { createPutMethod } from './put';\nimport type { PutBlobResult } from './put-helpers';\nimport type { CommonCompleteMultipartUploadOptions } from './multipart/complete';\nimport { createCompleteMultipartUploadMethod } from './multipart/complete';\nimport { createCreateMultipartUploadMethod } from './multipart/create';\nimport { createUploadPartMethod } from './multipart/upload';\nimport type { CommonMultipartUploadOptions } from './multipart/upload';\nimport { createCreateMultipartUploaderMethod } from './multipart/create-uploader';\n\n// interface for put, upload and multipartUpload.\n// This types omits all options that are encoded in the client token.\nexport interface ClientCommonCreateBlobOptions {\n  /**\n   * Whether the blob should be publicly accessible.\n   */\n  access: 'public';\n  /**\n   * Defines the content type of the blob. By default, this value is inferred from the pathname. Sent as the 'content-type' header when downloading a blob.\n   */\n  contentType?: string;\n  /**\n   * `AbortSignal` to cancel the running request. See https://developer.mozilla.org/en-US/docs/Web/API/AbortSignal\n   */\n  abortSignal?: AbortSignal;\n}\n\n// shared interface for put and multipartUpload\nexport interface ClientTokenOptions {\n  /**\n   * A client token that was generated by your server using the `generateClientToken` method.\n   */\n  token: string;\n}\n\n// shared interface for put and upload\ninterface ClientCommonPutOptions\n  extends ClientCommonCreateBlobOptions,\n    WithUploadProgress {\n  /**\n   * Whether to use multipart upload. Use this when uploading large files. It will split the file into multiple parts, upload them in parallel and retry failed parts.\n   */\n  multipart?: boolean;\n}\n\nfunction createPutExtraChecks<\n  TOptions extends ClientTokenOptions & ClientCommonCreateBlobOptions,\n>(methodName: string) {\n  return function extraChecks(options: TOptions) {\n    if (!options.token.startsWith('vercel_blob_client_')) {\n      throw new BlobError(`${methodName} must be called with a client token`);\n    }\n\n    if (\n      // @ts-expect-error -- Runtime check for DX.\n      options.addRandomSuffix !== undefined ||\n      // @ts-expect-error -- Runtime check for DX.\n      options.cacheControlMaxAge !== undefined\n    ) {\n      throw new BlobError(\n        `${methodName} doesn't allow addRandomSuffix and cacheControlMaxAge. Configure these options at the server side when generating client tokens.`,\n      );\n    }\n  };\n}\n\n// client.put()\n\nexport type ClientPutCommandOptions = ClientCommonPutOptions &\n  ClientTokenOptions;\n\nexport const put = createPutMethod<ClientPutCommandOptions>({\n  allowedOptions: ['contentType'],\n  extraChecks: createPutExtraChecks('client/`put`'),\n});\n\n// vercelBlob. createMultipartUpload()\n// vercelBlob. uploadPart()\n// vercelBlob. completeMultipartUpload()\n// vercelBlob. createMultipartUploader()\n\nexport type ClientCreateMultipartUploadCommandOptions =\n  ClientCommonCreateBlobOptions & ClientTokenOptions;\n\nexport const createMultipartUpload =\n  createCreateMultipartUploadMethod<ClientCreateMultipartUploadCommandOptions>({\n    allowedOptions: ['contentType'],\n    extraChecks: createPutExtraChecks('client/`createMultipartUpload`'),\n  });\n\nexport const createMultipartUploader =\n  createCreateMultipartUploaderMethod<ClientCreateMultipartUploadCommandOptions>(\n    {\n      allowedOptions: ['contentType'],\n      extraChecks: createPutExtraChecks('client/`createMultipartUpload`'),\n    },\n  );\n\ntype ClientMultipartUploadCommandOptions = ClientCommonCreateBlobOptions &\n  ClientTokenOptions &\n  CommonMultipartUploadOptions &\n  WithUploadProgress;\n\nexport const uploadPart =\n  createUploadPartMethod<ClientMultipartUploadCommandOptions>({\n    allowedOptions: ['contentType'],\n    extraChecks: createPutExtraChecks('client/`multipartUpload`'),\n  });\n\ntype ClientCompleteMultipartUploadCommandOptions =\n  ClientCommonCreateBlobOptions &\n    ClientTokenOptions &\n    CommonCompleteMultipartUploadOptions;\n\nexport const completeMultipartUpload =\n  createCompleteMultipartUploadMethod<ClientCompleteMultipartUploadCommandOptions>(\n    {\n      allowedOptions: ['contentType'],\n      extraChecks: createPutExtraChecks('client/`completeMultipartUpload`'),\n    },\n  );\n\n// upload methods\n\nexport interface CommonUploadOptions {\n  /**\n   * A route that implements the `handleUpload` function for generating a client token.\n   */\n  handleUploadUrl: string;\n  /**\n   * Additional data which will be sent to your `handleUpload` route.\n   */\n  clientPayload?: string;\n}\n\n// client.upload()\n// This is a client-side wrapper that will fetch the client token for you and then upload the file\nexport type UploadOptions = ClientCommonPutOptions & CommonUploadOptions;\n/**\n * Uploads a blob into your store from the client.\n * Detailed documentation can be found here: https://vercel.com/docs/storage/vercel-blob/using-blob-sdk#client-uploads\n *\n * If you want to upload from your server instead, check out the documentation for the put operation: https://vercel.com/docs/storage/vercel-blob/using-blob-sdk#upload-a-blob\n *\n * @param pathname - The pathname to upload the blob to. This includes the filename.\n * @param body - The contents of your blob. This has to be a supported fetch body type https://developer.mozilla.org/en-US/docs/Web/API/fetch#body.\n * @param options - Additional options.\n */\nexport const upload = createPutMethod<UploadOptions>({\n  allowedOptions: ['contentType'],\n  extraChecks(options) {\n    // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- Runtime check for DX.\n    if (options.handleUploadUrl === undefined) {\n      throw new BlobError(\n        \"client/`upload` requires the 'handleUploadUrl' parameter\",\n      );\n    }\n\n    if (\n      // @ts-expect-error -- Runtime check for DX.\n      options.addRandomSuffix !== undefined ||\n      // @ts-expect-error -- Runtime check for DX.\n      options.cacheControlMaxAge !== undefined\n    ) {\n      throw new BlobError(\n        \"client/`upload` doesn't allow addRandomSuffix and cacheControlMaxAge. Configure these options at the server side when generating client tokens.\",\n      );\n    }\n  },\n  async getToken(pathname, options) {\n    return retrieveClientToken({\n      handleUploadUrl: options.handleUploadUrl,\n      pathname,\n      clientPayload: options.clientPayload ?? null,\n      multipart: options.multipart ?? false,\n    });\n  },\n});\n\nasync function importKey(token: string): Promise<CryptoKey> {\n  return globalThis.crypto.subtle.importKey(\n    'raw',\n    new TextEncoder().encode(token),\n    { name: 'HMAC', hash: 'SHA-256' },\n    false,\n    ['sign', 'verify'],\n  );\n}\n\nasync function signPayload(\n  payload: string,\n  token: string,\n): Promise<string | undefined> {\n  // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- Node.js < 20: globalThis.crypto is undefined (in a real script.js, because the REPL has it linked to the crypto module). Node.js >= 20, Browsers and Cloudflare workers: globalThis.crypto is defined and is the Web Crypto API.\n  if (!globalThis.crypto) {\n    return crypto.createHmac('sha256', token).update(payload).digest('hex');\n  }\n\n  const signature = await globalThis.crypto.subtle.sign(\n    'HMAC',\n    await importKey(token),\n    new TextEncoder().encode(payload),\n  );\n  return Buffer.from(new Uint8Array(signature)).toString('hex');\n}\n\nasync function verifyCallbackSignature({\n  token,\n  signature,\n  body,\n}: {\n  token: string;\n  signature: string;\n  body: string;\n}): Promise<boolean> {\n  // callback signature is signed using the server token\n  const secret = token;\n  // Browsers, Edge runtime and Node >=20 implement the Web Crypto API\n  // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- Node.js < 20: globalThis.crypto is undefined (in a real script.js, because the REPL has it linked to the crypto module). Node.js >= 20, Browsers and Cloudflare workers: globalThis.crypto is defined and is the Web Crypto API.\n  if (!globalThis.crypto) {\n    // Node <20 falls back to the Node.js crypto module\n    const digest = crypto\n      .createHmac('sha256', secret)\n      .update(body)\n      .digest('hex');\n    const digestBuffer = Buffer.from(digest);\n    const signatureBuffer = Buffer.from(signature);\n\n    return (\n      digestBuffer.length === signatureBuffer.length &&\n      crypto.timingSafeEqual(digestBuffer, signatureBuffer)\n    );\n  }\n\n  const verified = await globalThis.crypto.subtle.verify(\n    'HMAC',\n    await importKey(token),\n    hexToArrayByte(signature),\n    new TextEncoder().encode(body),\n  );\n  return verified;\n}\n\nfunction hexToArrayByte(input: string): Buffer {\n  if (input.length % 2 !== 0) {\n    throw new RangeError('Expected string to be an even number of characters');\n  }\n  const view = new Uint8Array(input.length / 2);\n\n  for (let i = 0; i < input.length; i += 2) {\n    view[i / 2] = parseInt(input.substring(i, i + 2), 16);\n  }\n\n  return Buffer.from(view);\n}\n\nexport type DecodedClientTokenPayload = Omit<\n  GenerateClientTokenOptions,\n  'token'\n> & {\n  validUntil: number;\n};\n\nexport function getPayloadFromClientToken(\n  clientToken: string,\n): DecodedClientTokenPayload {\n  const [, , , , encodedToken] = clientToken.split('_');\n  const encodedPayload = Buffer.from(encodedToken ?? '', 'base64')\n    .toString()\n    .split('.')[1];\n  const decodedPayload = Buffer.from(encodedPayload ?? '', 'base64').toString();\n  return JSON.parse(decodedPayload) as DecodedClientTokenPayload;\n}\n\nconst EventTypes = {\n  generateClientToken: 'blob.generate-client-token',\n  uploadCompleted: 'blob.upload-completed',\n} as const;\n\ninterface GenerateClientTokenEvent {\n  type: (typeof EventTypes)['generateClientToken'];\n  payload: {\n    pathname: string;\n    callbackUrl: string;\n    multipart: boolean;\n    clientPayload: string | null;\n  };\n}\ninterface UploadCompletedEvent {\n  type: (typeof EventTypes)['uploadCompleted'];\n  payload: {\n    blob: PutBlobResult;\n    tokenPayload?: string | null;\n  };\n}\n\nexport type HandleUploadBody = GenerateClientTokenEvent | UploadCompletedEvent;\n\ntype RequestType = IncomingMessage | Request;\n\nexport interface HandleUploadOptions {\n  body: HandleUploadBody;\n  onBeforeGenerateToken: (\n    pathname: string,\n    clientPayload: string | null,\n    multipart: boolean,\n  ) => Promise<\n    Pick<\n      GenerateClientTokenOptions,\n      | 'allowedContentTypes'\n      | 'maximumSizeInBytes'\n      | 'validUntil'\n      | 'addRandomSuffix'\n      | 'cacheControlMaxAge'\n    > & { tokenPayload?: string | null }\n  >;\n  onUploadCompleted: (body: UploadCompletedEvent['payload']) => Promise<void>;\n  token?: string;\n  request: RequestType;\n}\n\nexport async function handleUpload({\n  token,\n  request,\n  body,\n  onBeforeGenerateToken,\n  onUploadCompleted,\n}: HandleUploadOptions): Promise<\n  | { type: GenerateClientTokenEvent['type']; clientToken: string }\n  | { type: UploadCompletedEvent['type']; response: 'ok' }\n> {\n  const resolvedToken = getTokenFromOptionsOrEnv({ token });\n\n  const type = body.type;\n  switch (type) {\n    case 'blob.generate-client-token': {\n      const { pathname, callbackUrl, clientPayload, multipart } = body.payload;\n      const payload = await onBeforeGenerateToken(\n        pathname,\n        clientPayload,\n        multipart,\n      );\n      const tokenPayload = payload.tokenPayload ?? clientPayload;\n\n      // one hour\n      const oneHourInSeconds = 60 * 60;\n      const now = new Date();\n      const validUntil =\n        payload.validUntil ??\n        now.setSeconds(now.getSeconds() + oneHourInSeconds);\n\n      return {\n        type,\n        clientToken: await generateClientTokenFromReadWriteToken({\n          ...payload,\n          token: resolvedToken,\n          pathname,\n          onUploadCompleted: {\n            callbackUrl,\n            tokenPayload,\n          },\n          validUntil,\n        }),\n      };\n    }\n    case 'blob.upload-completed': {\n      const signatureHeader = 'x-vercel-signature';\n      const signature = (\n        'credentials' in request\n          ? (request.headers.get(signatureHeader) ?? '')\n          : (request.headers[signatureHeader] ?? '')\n      ) as string;\n\n      if (!signature) {\n        throw new BlobError('Missing callback signature');\n      }\n\n      const isVerified = await verifyCallbackSignature({\n        token: resolvedToken,\n        signature,\n        body: JSON.stringify(body),\n      });\n\n      if (!isVerified) {\n        throw new BlobError('Invalid callback signature');\n      }\n      await onUploadCompleted(body.payload);\n      return { type, response: 'ok' };\n    }\n    default:\n      throw new BlobError('Invalid event type');\n  }\n}\n\nasync function retrieveClientToken(options: {\n  pathname: string;\n  handleUploadUrl: string;\n  clientPayload: string | null;\n  multipart: boolean;\n  abortSignal?: AbortSignal;\n}): Promise<string> {\n  const { handleUploadUrl, pathname } = options;\n  const url = isAbsoluteUrl(handleUploadUrl)\n    ? handleUploadUrl\n    : toAbsoluteUrl(handleUploadUrl);\n\n  const event: GenerateClientTokenEvent = {\n    type: EventTypes.generateClientToken,\n    payload: {\n      pathname,\n      callbackUrl: url,\n      clientPayload: options.clientPayload,\n      multipart: options.multipart,\n    },\n  };\n\n  const res = await fetch(url, {\n    method: 'POST',\n    body: JSON.stringify(event),\n    headers: {\n      'content-type': 'application/json',\n    },\n    signal: options.abortSignal,\n  });\n\n  if (!res.ok) {\n    throw new BlobError('Failed to  retrieve the client token');\n  }\n\n  try {\n    const { clientToken } = (await res.json()) as { clientToken: string };\n    return clientToken;\n  } catch (e) {\n    throw new BlobError('Failed to retrieve the client token');\n  }\n}\n\nfunction toAbsoluteUrl(url: string): string {\n  // location is available in web workers too: https://developer.mozilla.org/en-US/docs/Web/API/Window/location\n  return new URL(url, location.href).href;\n}\n\nfunction isAbsoluteUrl(url: string): boolean {\n  try {\n    return Boolean(new URL(url));\n  } catch (e) {\n    return false;\n  }\n}\n\nexport async function generateClientTokenFromReadWriteToken({\n  token,\n  ...argsWithoutToken\n}: GenerateClientTokenOptions): Promise<string> {\n  if (typeof window !== 'undefined') {\n    throw new BlobError(\n      '\"generateClientTokenFromReadWriteToken\" must be called from a server environment',\n    );\n  }\n\n  const timestamp = new Date();\n  timestamp.setSeconds(timestamp.getSeconds() + 30);\n  const readWriteToken = getTokenFromOptionsOrEnv({ token });\n\n  const [, , , storeId = null] = readWriteToken.split('_');\n\n  if (!storeId) {\n    throw new BlobError(\n      token ? 'Invalid `token` parameter' : 'Invalid `BLOB_READ_WRITE_TOKEN`',\n    );\n  }\n\n  const payload = Buffer.from(\n    JSON.stringify({\n      ...argsWithoutToken,\n      validUntil: argsWithoutToken.validUntil ?? timestamp.getTime(),\n    }),\n  ).toString('base64');\n\n  const securedKey = await signPayload(payload, readWriteToken);\n\n  if (!securedKey) {\n    throw new BlobError('Unable to sign client token');\n  }\n  return `vercel_blob_client_${storeId}_${Buffer.from(\n    `${securedKey}.${payload}`,\n  ).toString('base64')}`;\n}\n\nexport interface GenerateClientTokenOptions extends BlobCommandOptions {\n  pathname: string;\n  onUploadCompleted?: {\n    callbackUrl: string;\n    tokenPayload?: string | null;\n  };\n  maximumSizeInBytes?: number;\n  allowedContentTypes?: string[];\n  validUntil?: number;\n  addRandomSuffix?: boolean;\n  cacheControlMaxAge?: number;\n}\n\nexport { createFolder } from './create-folder';\n"],"mappings":";;;;;;;;;;;;AACA,YAAY,YAAY;AAKxB,SAAS,aAAa;AA+CtB,SAAS,qBAEP,YAAoB;AACpB,SAAO,SAAS,YAAY,SAAmB;AAC7C,QAAI,CAAC,QAAQ,MAAM,WAAW,qBAAqB,GAAG;AACpD,YAAM,IAAI,UAAU,GAAG,UAAU,qCAAqC;AAAA,IACxE;AAEA;AAAA;AAAA,MAEE,QAAQ,oBAAoB;AAAA,MAE5B,QAAQ,uBAAuB;AAAA,MAC/B;AACA,YAAM,IAAI;AAAA,QACR,GAAG,UAAU;AAAA,MACf;AAAA,IACF;AAAA,EACF;AACF;AAOO,IAAM,MAAM,gBAAyC;AAAA,EAC1D,gBAAgB,CAAC,aAAa;AAAA,EAC9B,aAAa,qBAAqB,cAAc;AAClD,CAAC;AAUM,IAAM,wBACX,kCAA6E;AAAA,EAC3E,gBAAgB,CAAC,aAAa;AAAA,EAC9B,aAAa,qBAAqB,gCAAgC;AACpE,CAAC;AAEI,IAAM,0BACX;AAAA,EACE;AAAA,IACE,gBAAgB,CAAC,aAAa;AAAA,IAC9B,aAAa,qBAAqB,gCAAgC;AAAA,EACpE;AACF;AAOK,IAAM,aACX,uBAA4D;AAAA,EAC1D,gBAAgB,CAAC,aAAa;AAAA,EAC9B,aAAa,qBAAqB,0BAA0B;AAC9D,CAAC;AAOI,IAAM,0BACX;AAAA,EACE;AAAA,IACE,gBAAgB,CAAC,aAAa;AAAA,IAC9B,aAAa,qBAAqB,kCAAkC;AAAA,EACtE;AACF;AA4BK,IAAM,SAAS,gBAA+B;AAAA,EACnD,gBAAgB,CAAC,aAAa;AAAA,EAC9B,YAAY,SAAS;AAEnB,QAAI,QAAQ,oBAAoB,QAAW;AACzC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA;AAAA;AAAA,MAEE,QAAQ,oBAAoB;AAAA,MAE5B,QAAQ,uBAAuB;AAAA,MAC/B;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA,MAAM,SAAS,UAAU,SAAS;AAjLpC;AAkLI,WAAO,oBAAoB;AAAA,MACzB,iBAAiB,QAAQ;AAAA,MACzB;AAAA,MACA,gBAAe,aAAQ,kBAAR,YAAyB;AAAA,MACxC,YAAW,aAAQ,cAAR,YAAqB;AAAA,IAClC,CAAC;AAAA,EACH;AACF,CAAC;AAED,eAAe,UAAU,OAAmC;AAC1D,SAAO,WAAW,OAAO,OAAO;AAAA,IAC9B;AAAA,IACA,IAAI,YAAY,EAAE,OAAO,KAAK;AAAA,IAC9B,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,IAChC;AAAA,IACA,CAAC,QAAQ,QAAQ;AAAA,EACnB;AACF;AAEA,eAAe,YACb,SACA,OAC6B;AAE7B,MAAI,CAAC,WAAW,QAAQ;AACtB,WAAc,kBAAW,UAAU,KAAK,EAAE,OAAO,OAAO,EAAE,OAAO,KAAK;AAAA,EACxE;AAEA,QAAM,YAAY,MAAM,WAAW,OAAO,OAAO;AAAA,IAC/C;AAAA,IACA,MAAM,UAAU,KAAK;AAAA,IACrB,IAAI,YAAY,EAAE,OAAO,OAAO;AAAA,EAClC;AACA,SAAO,OAAO,KAAK,IAAI,WAAW,SAAS,CAAC,EAAE,SAAS,KAAK;AAC9D;AAEA,eAAe,wBAAwB;AAAA,EACrC;AAAA,EACA;AAAA,EACA;AACF,GAIqB;AAEnB,QAAM,SAAS;AAGf,MAAI,CAAC,WAAW,QAAQ;AAEtB,UAAM,SACH,kBAAW,UAAU,MAAM,EAC3B,OAAO,IAAI,EACX,OAAO,KAAK;AACf,UAAM,eAAe,OAAO,KAAK,MAAM;AACvC,UAAM,kBAAkB,OAAO,KAAK,SAAS;AAE7C,WACE,aAAa,WAAW,gBAAgB,UACjC,uBAAgB,cAAc,eAAe;AAAA,EAExD;AAEA,QAAM,WAAW,MAAM,WAAW,OAAO,OAAO;AAAA,IAC9C;AAAA,IACA,MAAM,UAAU,KAAK;AAAA,IACrB,eAAe,SAAS;AAAA,IACxB,IAAI,YAAY,EAAE,OAAO,IAAI;AAAA,EAC/B;AACA,SAAO;AACT;AAEA,SAAS,eAAe,OAAuB;AAC7C,MAAI,MAAM,SAAS,MAAM,GAAG;AAC1B,UAAM,IAAI,WAAW,oDAAoD;AAAA,EAC3E;AACA,QAAM,OAAO,IAAI,WAAW,MAAM,SAAS,CAAC;AAE5C,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK,GAAG;AACxC,SAAK,IAAI,CAAC,IAAI,SAAS,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE;AAAA,EACtD;AAEA,SAAO,OAAO,KAAK,IAAI;AACzB;AASO,SAAS,0BACd,aAC2B;AAC3B,QAAM,CAAC,EAAE,EAAE,EAAE,EAAE,YAAY,IAAI,YAAY,MAAM,GAAG;AACpD,QAAM,iBAAiB,OAAO,KAAK,sCAAgB,IAAI,QAAQ,EAC5D,SAAS,EACT,MAAM,GAAG,EAAE,CAAC;AACf,QAAM,iBAAiB,OAAO,KAAK,0CAAkB,IAAI,QAAQ,EAAE,SAAS;AAC5E,SAAO,KAAK,MAAM,cAAc;AAClC;AAEA,IAAM,aAAa;AAAA,EACjB,qBAAqB;AAAA,EACrB,iBAAiB;AACnB;AA4CA,eAAsB,aAAa;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAGE;AAlVF;AAmVE,QAAM,gBAAgB,yBAAyB,EAAE,MAAM,CAAC;AAExD,QAAM,OAAO,KAAK;AAClB,UAAQ,MAAM;AAAA,IACZ,KAAK,8BAA8B;AACjC,YAAM,EAAE,UAAU,aAAa,eAAe,UAAU,IAAI,KAAK;AACjE,YAAM,UAAU,MAAM;AAAA,QACpB;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,YAAM,gBAAe,aAAQ,iBAAR,YAAwB;AAG7C,YAAM,mBAAmB,KAAK;AAC9B,YAAM,MAAM,oBAAI,KAAK;AACrB,YAAM,cACJ,aAAQ,eAAR,YACA,IAAI,WAAW,IAAI,WAAW,IAAI,gBAAgB;AAEpD,aAAO;AAAA,QACL;AAAA,QACA,aAAa,MAAM,sCAAsC;AAAA,UACvD,GAAG;AAAA,UACH,OAAO;AAAA,UACP;AAAA,UACA,mBAAmB;AAAA,YACjB;AAAA,YACA;AAAA,UACF;AAAA,UACA;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF;AAAA,IACA,KAAK,yBAAyB;AAC5B,YAAM,kBAAkB;AACxB,YAAM,YACJ,iBAAiB,WACZ,aAAQ,QAAQ,IAAI,eAAe,MAAnC,YAAwC,MACxC,aAAQ,QAAQ,eAAe,MAA/B,YAAoC;AAG3C,UAAI,CAAC,WAAW;AACd,cAAM,IAAI,UAAU,4BAA4B;AAAA,MAClD;AAEA,YAAM,aAAa,MAAM,wBAAwB;AAAA,QAC/C,OAAO;AAAA,QACP;AAAA,QACA,MAAM,KAAK,UAAU,IAAI;AAAA,MAC3B,CAAC;AAED,UAAI,CAAC,YAAY;AACf,cAAM,IAAI,UAAU,4BAA4B;AAAA,MAClD;AACA,YAAM,kBAAkB,KAAK,OAAO;AACpC,aAAO,EAAE,MAAM,UAAU,KAAK;AAAA,IAChC;AAAA,IACA;AACE,YAAM,IAAI,UAAU,oBAAoB;AAAA,EAC5C;AACF;AAEA,eAAe,oBAAoB,SAMf;AAClB,QAAM,EAAE,iBAAiB,SAAS,IAAI;AACtC,QAAM,MAAM,cAAc,eAAe,IACrC,kBACA,cAAc,eAAe;AAEjC,QAAM,QAAkC;AAAA,IACtC,MAAM,WAAW;AAAA,IACjB,SAAS;AAAA,MACP;AAAA,MACA,aAAa;AAAA,MACb,eAAe,QAAQ;AAAA,MACvB,WAAW,QAAQ;AAAA,IACrB;AAAA,EACF;AAEA,QAAM,MAAM,MAAM,MAAM,KAAK;AAAA,IAC3B,QAAQ;AAAA,IACR,MAAM,KAAK,UAAU,KAAK;AAAA,IAC1B,SAAS;AAAA,MACP,gBAAgB;AAAA,IAClB;AAAA,IACA,QAAQ,QAAQ;AAAA,EAClB,CAAC;AAED,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,IAAI,UAAU,sCAAsC;AAAA,EAC5D;AAEA,MAAI;AACF,UAAM,EAAE,YAAY,IAAK,MAAM,IAAI,KAAK;AACxC,WAAO;AAAA,EACT,SAAS,GAAG;AACV,UAAM,IAAI,UAAU,qCAAqC;AAAA,EAC3D;AACF;AAEA,SAAS,cAAc,KAAqB;AAE1C,SAAO,IAAI,IAAI,KAAK,SAAS,IAAI,EAAE;AACrC;AAEA,SAAS,cAAc,KAAsB;AAC3C,MAAI;AACF,WAAO,QAAQ,IAAI,IAAI,GAAG,CAAC;AAAA,EAC7B,SAAS,GAAG;AACV,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,sCAAsC;AAAA,EAC1D;AAAA,EACA,GAAG;AACL,GAAgD;AA7chD;AA8cE,MAAI,OAAO,WAAW,aAAa;AACjC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,YAAY,oBAAI,KAAK;AAC3B,YAAU,WAAW,UAAU,WAAW,IAAI,EAAE;AAChD,QAAM,iBAAiB,yBAAyB,EAAE,MAAM,CAAC;AAEzD,QAAM,CAAC,EAAE,EAAE,EAAE,UAAU,IAAI,IAAI,eAAe,MAAM,GAAG;AAEvD,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI;AAAA,MACR,QAAQ,8BAA8B;AAAA,IACxC;AAAA,EACF;AAEA,QAAM,UAAU,OAAO;AAAA,IACrB,KAAK,UAAU;AAAA,MACb,GAAG;AAAA,MACH,aAAY,sBAAiB,eAAjB,YAA+B,UAAU,QAAQ;AAAA,IAC/D,CAAC;AAAA,EACH,EAAE,SAAS,QAAQ;AAEnB,QAAM,aAAa,MAAM,YAAY,SAAS,cAAc;AAE5D,MAAI,CAAC,YAAY;AACf,UAAM,IAAI,UAAU,6BAA6B;AAAA,EACnD;AACA,SAAO,sBAAsB,OAAO,IAAI,OAAO;AAAA,IAC7C,GAAG,UAAU,IAAI,OAAO;AAAA,EAC1B,EAAE,SAAS,QAAQ,CAAC;AACtB;","names":[]}

package/dist/index.cjs

@@ -22,11 +22,11 @@
 
 
 
-var _chunkXTBGGUVNcjs = require('./chunk-XTBGGUVN.cjs');
+var _chunkA3XDFQYYcjs = require('./chunk-A3XDFQYY.cjs');
 
 // src/del.ts
 async function del(url, options) {
-  await _chunkXTBGGUVNcjs.requestApi.call(void 0, 
+  await _chunkA3XDFQYYcjs.requestApi.call(void 0, 
     "/delete",
     {
       method: "POST",
@@ -41,7 +41,7 @@ async function del(url, options) {
 // src/head.ts
 async function head(url, options) {
   const searchParams = new URLSearchParams({ url });
-  const response = await _chunkXTBGGUVNcjs.requestApi.call(void 0, 
+  const response = await _chunkA3XDFQYYcjs.requestApi.call(void 0, 
     `?${searchParams.toString()}`,
     // HEAD can't have body as a response, so we use GET
     {
@@ -78,7 +78,7 @@ async function list(options) {
   if (options == null ? void 0 : options.mode) {
     searchParams.set("mode", options.mode);
   }
-  const response = await _chunkXTBGGUVNcjs.requestApi.call(void 0, 
+  const response = await _chunkA3XDFQYYcjs.requestApi.call(void 0, 
     `?${searchParams.toString()}`,
     {
       method: "GET",
@@ -113,19 +113,19 @@ function mapBlobResult(blobResult) {
 // src/copy.ts
 async function copy(fromUrl, toPathname, options) {
   if (!options) {
-    throw new (0, _chunkXTBGGUVNcjs.BlobError)("missing options, see usage");
+    throw new (0, _chunkA3XDFQYYcjs.BlobError)("missing options, see usage");
   }
   if (options.access !== "public") {
-    throw new (0, _chunkXTBGGUVNcjs.BlobError)('access must be "public"');
+    throw new (0, _chunkA3XDFQYYcjs.BlobError)('access must be "public"');
   }
-  if (toPathname.length > _chunkXTBGGUVNcjs.MAXIMUM_PATHNAME_LENGTH) {
-    throw new (0, _chunkXTBGGUVNcjs.BlobError)(
-      `pathname is too long, maximum length is ${_chunkXTBGGUVNcjs.MAXIMUM_PATHNAME_LENGTH}`
+  if (toPathname.length > _chunkA3XDFQYYcjs.MAXIMUM_PATHNAME_LENGTH) {
+    throw new (0, _chunkA3XDFQYYcjs.BlobError)(
+      `pathname is too long, maximum length is ${_chunkA3XDFQYYcjs.MAXIMUM_PATHNAME_LENGTH}`
     );
   }
-  for (const invalidCharacter of _chunkXTBGGUVNcjs.disallowedPathnameCharacters) {
+  for (const invalidCharacter of _chunkA3XDFQYYcjs.disallowedPathnameCharacters) {
     if (toPathname.includes(invalidCharacter)) {
-      throw new (0, _chunkXTBGGUVNcjs.BlobError)(
+      throw new (0, _chunkA3XDFQYYcjs.BlobError)(
         `pathname cannot contain "${invalidCharacter}", please encode it if needed`
       );
     }
@@ -140,7 +140,7 @@ async function copy(fromUrl, toPathname, options) {
   if (options.cacheControlMaxAge !== void 0) {
     headers["x-cache-control-max-age"] = options.cacheControlMaxAge.toString();
   }
-  const response = await _chunkXTBGGUVNcjs.requestApi.call(void 0, 
+  const response = await _chunkA3XDFQYYcjs.requestApi.call(void 0, 
     `/${toPathname}?fromUrl=${fromUrl}`,
     {
       method: "PUT",
@@ -159,19 +159,19 @@ async function copy(fromUrl, toPathname, options) {
 }
 
 // src/index.ts
-var put = _chunkXTBGGUVNcjs.createPutMethod.call(void 0, {
+var put = _chunkA3XDFQYYcjs.createPutMethod.call(void 0, {
   allowedOptions: ["cacheControlMaxAge", "addRandomSuffix", "contentType"]
 });
-var createMultipartUpload = _chunkXTBGGUVNcjs.createCreateMultipartUploadMethod.call(void 0, {
+var createMultipartUpload = _chunkA3XDFQYYcjs.createCreateMultipartUploadMethod.call(void 0, {
   allowedOptions: ["cacheControlMaxAge", "addRandomSuffix", "contentType"]
 });
-var createMultipartUploader = _chunkXTBGGUVNcjs.createCreateMultipartUploaderMethod.call(void 0, {
+var createMultipartUploader = _chunkA3XDFQYYcjs.createCreateMultipartUploaderMethod.call(void 0, {
   allowedOptions: ["cacheControlMaxAge", "addRandomSuffix", "contentType"]
 });
-var uploadPart = _chunkXTBGGUVNcjs.createUploadPartMethod.call(void 0, {
+var uploadPart = _chunkA3XDFQYYcjs.createUploadPartMethod.call(void 0, {
   allowedOptions: ["cacheControlMaxAge", "addRandomSuffix", "contentType"]
 });
-var completeMultipartUpload = _chunkXTBGGUVNcjs.createCompleteMultipartUploadMethod.call(void 0, {
+var completeMultipartUpload = _chunkA3XDFQYYcjs.createCompleteMultipartUploadMethod.call(void 0, {
   allowedOptions: ["cacheControlMaxAge", "addRandomSuffix", "contentType"]
 });
 
@@ -199,5 +199,5 @@ var completeMultipartUpload = _chunkXTBGGUVNcjs.createCompleteMultipartUploadMet
 
 
 
-exports.BlobAccessError = _chunkXTBGGUVNcjs.BlobAccessError; exports.BlobClientTokenExpiredError = _chunkXTBGGUVNcjs.BlobClientTokenExpiredError; exports.BlobContentTypeNotAllowedError = _chunkXTBGGUVNcjs.BlobContentTypeNotAllowedError; exports.BlobError = _chunkXTBGGUVNcjs.BlobError; exports.BlobFileTooLargeError = _chunkXTBGGUVNcjs.BlobFileTooLargeError; exports.BlobNotFoundError = _chunkXTBGGUVNcjs.BlobNotFoundError; exports.BlobPathnameMismatchError = _chunkXTBGGUVNcjs.BlobPathnameMismatchError; exports.BlobRequestAbortedError = _chunkXTBGGUVNcjs.BlobRequestAbortedError; exports.BlobServiceNotAvailable = _chunkXTBGGUVNcjs.BlobServiceNotAvailable; exports.BlobServiceRateLimited = _chunkXTBGGUVNcjs.BlobServiceRateLimited; exports.BlobStoreNotFoundError = _chunkXTBGGUVNcjs.BlobStoreNotFoundError; exports.BlobStoreSuspendedError = _chunkXTBGGUVNcjs.BlobStoreSuspendedError; exports.BlobUnknownError = _chunkXTBGGUVNcjs.BlobUnknownError; exports.completeMultipartUpload = completeMultipartUpload; exports.copy = copy; exports.createFolder = _chunkXTBGGUVNcjs.createFolder; exports.createMultipartUpload = createMultipartUpload; exports.createMultipartUploader = createMultipartUploader; exports.del = del; exports.getDownloadUrl = _chunkXTBGGUVNcjs.getDownloadUrl; exports.head = head; exports.list = list; exports.put = put; exports.uploadPart = uploadPart;
+exports.BlobAccessError = _chunkA3XDFQYYcjs.BlobAccessError; exports.BlobClientTokenExpiredError = _chunkA3XDFQYYcjs.BlobClientTokenExpiredError; exports.BlobContentTypeNotAllowedError = _chunkA3XDFQYYcjs.BlobContentTypeNotAllowedError; exports.BlobError = _chunkA3XDFQYYcjs.BlobError; exports.BlobFileTooLargeError = _chunkA3XDFQYYcjs.BlobFileTooLargeError; exports.BlobNotFoundError = _chunkA3XDFQYYcjs.BlobNotFoundError; exports.BlobPathnameMismatchError = _chunkA3XDFQYYcjs.BlobPathnameMismatchError; exports.BlobRequestAbortedError = _chunkA3XDFQYYcjs.BlobRequestAbortedError; exports.BlobServiceNotAvailable = _chunkA3XDFQYYcjs.BlobServiceNotAvailable; exports.BlobServiceRateLimited = _chunkA3XDFQYYcjs.BlobServiceRateLimited; exports.BlobStoreNotFoundError = _chunkA3XDFQYYcjs.BlobStoreNotFoundError; exports.BlobStoreSuspendedError = _chunkA3XDFQYYcjs.BlobStoreSuspendedError; exports.BlobUnknownError = _chunkA3XDFQYYcjs.BlobUnknownError; exports.completeMultipartUpload = completeMultipartUpload; exports.copy = copy; exports.createFolder = _chunkA3XDFQYYcjs.createFolder; exports.createMultipartUpload = createMultipartUpload; exports.createMultipartUploader = createMultipartUploader; exports.del = del; exports.getDownloadUrl = _chunkA3XDFQYYcjs.getDownloadUrl; exports.head = head; exports.list = list; exports.put = put; exports.uploadPart = uploadPart;
 //# sourceMappingURL=index.cjs.map

package/dist/index.js

@@ -22,7 +22,7 @@ import {
   disallowedPathnameCharacters,
   getDownloadUrl,
   requestApi
-} from "./chunk-KN6WT5GP.js";
+} from "./chunk-JGHUXF3X.js";
 
 // src/del.ts
 async function del(url, options) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vercel/blob",
-  "version": "0.27.0",
+  "version": "0.27.1",
   "description": "The Vercel Blob JavaScript API client",
   "homepage": "https://vercel.com/storage/blob",
   "repository": {
@@ -47,7 +47,6 @@
   },
   "dependencies": {
     "async-retry": "^1.3.3",
-    "bytes": "^3.1.2",
     "is-buffer": "^2.0.5",
     "is-node-process": "^1.2.0",
     "throttleit": "^2.1.0",
@@ -57,9 +56,8 @@
     "@edge-runtime/jest-environment": "2.3.10",
     "@edge-runtime/types": "2.2.9",
     "@types/async-retry": "1.4.9",
-    "@types/bytes": "3.1.4",
     "@types/jest": "29.5.14",
-    "@types/node": "22.9.4",
+    "@types/node": "22.10.7",
     "eslint": "8.56.0",
     "jest": "29.7.0",
     "jest-environment-jsdom": "29.7.0",