@vercel/blob - npm Package Compare versions

Comparing version 0.8.3 to 0.9.0-canary.0

dist/index.d.ts

@@ -37,3 +37,3 @@ import { Readable } from 'node:stream';
 }
-declare function put(pathname: string, body: string | Readable | Blob | ArrayBuffer | FormData | ReadableStream, options: PutCommandOptions): Promise<BlobResult>;
+declare function put(pathname: string, body: string | Readable | Blob | ArrayBuffer | FormData | ReadableStream | File, options: PutCommandOptions): Promise<BlobResult>;
 type BlobDelResult<T extends string | string[]> = T extends string ? BlobResult | null : (BlobResult | null)[];
@@ -43,3 +43,15 @@ declare function del<T extends string | string[]>(url: T, options?: BlobCommandOptions): Promise<BlobDelResult<T>>;
 declare function list(options?: ListCommandOptions): Promise<ListBlobResult>;
+interface GenerateClientTokenOptions extends BlobCommandOptions {
+    pathname: string;
+    onUploadCompleted?: {
+        callbackUrl: string;
+        metadata?: string;
+    };
+}
+declare function generateClientTokenFromReadWriteToken({ token, ...args }: GenerateClientTokenOptions): Promise<string>;
+type DecodedClientTokenPayload = Omit<GenerateClientTokenOptions, 'token'> & {
+    validUntil: number;
+};
+declare function getPayloadFromClientToken(clientToken: string): DecodedClientTokenPayload;
 
-export { BlobAccessError, BlobCommandOptions, BlobError, BlobResult, BlobUnknownError, ListBlobResult, ListCommandOptions, PutCommandOptions, del, head, list, put };
+export { BlobAccessError, BlobCommandOptions, BlobError, BlobResult, BlobUnknownError, GenerateClientTokenOptions, ListBlobResult, ListCommandOptions, PutCommandOptions, del, generateClientTokenFromReadWriteToken, getPayloadFromClientToken, head, list, put };

dist/index.js

@@ -1,1 +0,1 @@
-import{fetch as u}from"undici";var i=class extends Error{constructor(s){super(`Vercel Blob: ${s}`)}},a=class extends Error{constructor(){super("Vercel Blob: Access denied, please provide a valid token for this resource")}},o=class extends Error{constructor(){super("Vercel Blob: Unknown error, please contact [e-mail]")}};async function p(e,s,t){if(!e)throw new i("pathname is required");if(!s)throw new i("body is required");if(!t||t.access!=="public")throw new i('access must be "public"');let r={authorization:`Bearer ${d(t)}`};t.contentType&&(r["x-content-type"]=t.contentType);let n=await u(`${c()}/${e}`,{method:"PUT",body:s,headers:r,duplex:"half"});if(n.status!==200)throw n.status===403?new a:new o;let b=await n.json();return l(b)}async function f(e,s){let t=await u(`${c()}/delete`,{method:"POST",headers:{authorization:`Bearer ${d(s)}`,"content-type":"application/json"},body:JSON.stringify({urls:Array.isArray(e)?e:[e]})});if(t.status!==200)throw t.status===403?new a:new o;let r=await t.json();return Array.isArray(e)?r.map(n=>n?l(n):null):r[0]?l(r[0]):null}async function B(e,s){let t=new URL(c());t.searchParams.set("url",e);let r=await u(t,{method:"GET",headers:{authorization:`Bearer ${d(s)}`}});if(r.status===404)return null;if(r.status!==200)throw r.status===403?new a:new o;let n=await r.json();return l(n)}async function R(e){let s=new URL(c());e!=null&&e.limit&&s.searchParams.set("limit",e.limit.toString()),e!=null&&e.prefix&&s.searchParams.set("prefix",e.prefix),e!=null&&e.cursor&&s.searchParams.set("cursor",e.cursor);let t=await u(s,{method:"GET",headers:{authorization:`Bearer ${d(e)}`}});if(t.status!==200)throw t.status===403?new a:new o;let r=await t.json();return{...r,blobs:r.blobs.map(l)}}function c(){return process.env.VERCEL_BLOB_API_URL||"https://blob.vercel-storage.com"}function d(e){if(e!=null&&e.token)return e.token;if(!process.env.BLOB_READ_WRITE_TOKEN)throw new Error("BLOB_READ_WRITE_TOKEN environment variable is not set. Please set it to your write token.");return process.env.BLOB_READ_WRITE_TOKEN}function l(e){return{...e,uploadedAt:new Date(e.uploadedAt)}}export{a as BlobAccessError,i as BlobError,o as BlobUnknownError,f as del,B as head,R as list,p as put};
+import*as b from"crypto";import{fetch as d}from"undici";var o=class extends Error{constructor(r){super(`Vercel Blob: ${r}`)}},a=class extends Error{constructor(){super("Vercel Blob: Access denied, please provide a valid token for this resource")}},i=class extends Error{constructor(){super("Vercel Blob: Unknown error, please contact [e-mail]")}};async function g(e,r,t){if(!e)throw new o("pathname is required");if(!r)throw new o("body is required");if(!t||t.access!=="public")throw new o('access must be "public"');let n={authorization:`Bearer ${c(t)}`};t.contentType&&(n["x-content-type"]=t.contentType);let s=await d(`${p()}/${e}`,{method:"PUT",body:r,headers:n,duplex:"half"});if(s.status!==200)throw s.status===403?new a:new i;let u=await s.json();return l(u)}async function B(e,r){let t=await d(`${p()}/delete`,{method:"POST",headers:{authorization:`Bearer ${c(r)}`,"content-type":"application/json"},body:JSON.stringify({urls:Array.isArray(e)?e:[e]})});if(t.status!==200)throw t.status===403?new a:new i;let n=await t.json();return Array.isArray(e)?n.map(s=>s?l(s):null):n[0]?l(n[0]):null}async function h(e,r){let t=new URL(p());t.searchParams.set("url",e);let n=await d(t,{method:"GET",headers:{authorization:`Bearer ${c(r)}`}});if(n.status===404)return null;if(n.status!==200)throw n.status===403?new a:new i;let s=await n.json();return l(s)}async function y(e){let r=new URL(p());e!=null&&e.limit&&r.searchParams.set("limit",e.limit.toString()),e!=null&&e.prefix&&r.searchParams.set("prefix",e.prefix),e!=null&&e.cursor&&r.searchParams.set("cursor",e.cursor);let t=await d(r,{method:"GET",headers:{authorization:`Bearer ${c(e)}`}});if(t.status!==200)throw t.status===403?new a:new i;let n=await t.json();return{...n,blobs:n.blobs.map(l)}}async function R({token:e,...r}){if(typeof window!="undefined")throw new Error('"generateClientTokenFromReadWriteToken" must be called from a server environment');let t=new Date;t.setSeconds(t.getSeconds()+30);let n=c({token:e}),[,,,s=null]=n.split("_");if(!s)throw new Error(e?'Invalid "token" parameter':"Invalid BLOB_READ_WRITE_TOKEN");let u=Buffer.from(JSON.stringify({...r,validUntil:t.getTime()})).toString("base64"),m=await f(u,n);if(!m)throw new Error("Unable to sign client token");return`vercel_blob_client_${s}_${Buffer.from(`${m}.${u}`).toString("base64")}`}async function f(e,r){if(!globalThis.crypto)return b.createHmac("sha256",r).update(e).digest("hex");let t=await globalThis.crypto.subtle.importKey("raw",new TextEncoder().encode(r),{name:"HMAC",hash:"SHA-256"},!1,["sign"]),n=await globalThis.crypto.subtle.sign("HMAC",t,new TextEncoder().encode(e));return[...new Uint8Array(n)].map(s=>s.toString(16).padStart(2,"0")).join("")}function T(e){let[,,,,r]=e.split("_"),t=Buffer.from(r!=null?r:"","base64").toString().split(".")[1],n=Buffer.from(t!=null?t:"","base64").toString();return JSON.parse(n)}function c(e){if(typeof window!="undefined"){if(!(e!=null&&e.token))throw new o('"token" is required');if(!e.token.startsWith("vercel_blob_client"))throw new o("client upload only supports client tokens")}if(e!=null&&e.token)return e.token;if(!process.env.BLOB_READ_WRITE_TOKEN)throw new Error("BLOB_READ_WRITE_TOKEN environment variable is not set. Please set it to your write token.");return process.env.BLOB_READ_WRITE_TOKEN}function p(){return process.env.VERCEL_BLOB_API_URL||process.env.NEXT_PUBLIC_VERCEL_BLOB_API_URL||"https://blob.vercel-storage.com"}function l(e){return{...e,uploadedAt:new Date(e.uploadedAt)}}export{a as BlobAccessError,o as BlobError,i as BlobUnknownError,B as del,R as generateClientTokenFromReadWriteToken,T as getPayloadFromClientToken,h as head,y as list,g as put};

package.json

 {
   "name": "@vercel/blob",
-  "version": "0.8.3",
+  "version": "0.9.0-canary.0",
   "description": "The Vercel Blob JavaScript API client",
@@ -14,18 +14,7 @@ "homepage": "https://vercel.com/storage/blob",
   "type": "module",
-  "exports": {
-    ".": {
-      "import": {
-        "node": "./dist/index.js",
-        "default": "./dist/index.js"
-      },
-      "require": {
-        "node": "./dist/index.cjs",
-        "default": "./dist/index.cjs"
-      }
-    }
-  },
   "main": "./dist/index.cjs",
   "module": "./dist/index.js",
   "browser": {
-    "undici": "./dist/undici-browser.js"
+    "undici": "./dist/undici-browser.js",
+    "crypto": "./dist/crypto-browser.js"
   },
@@ -59,3 +48,3 @@ "types": "./dist/index.d.ts",
   "scripts": {
-    "build": "tsup && cp src/undici-browser.js dist/undici-browser.js",
+    "build": "tsup && cp src/undici-browser.js dist/undici-browser.js && cp src/crypto-browser.js dist/crypto-browser.js",
     "dev": "cp src/undici-browser.js dist/undici-browser.js && tsup --watch --clean=false",
@@ -62,0 +51,0 @@ "lint": "eslint --max-warnings=0 .",

README.md

@@ -38,3 +38,3 @@ # 🍙 @vercel/blob
   pathname: string,
-  body: ReadableStream | String | ArrayBuffer | Blob // All fetch body types are supported: https://developer.mozilla.org/en-US/docs/Web/API/fetch#body
+  body: ReadableStream | String | ArrayBuffer | Blob | File // All fetch body types are supported: https://developer.mozilla.org/en-US/docs/Web/API/fetch#body
   options: {
@@ -46,2 +46,3 @@ access: 'public', // mandatory, as we will provide private blobs in the future
     // or using Vercel Blob outside of Vercel
+    // on the client `token` is mandatory and must be generated by "generateClientTokenFromReadWriteToken"
     token?: string,
@@ -133,2 +134,17 @@ }): Promise<{
 
+### generateClientTokenFromReadWriteToken(options)
+
+Generates a single-use token which can be used from within the client.
+
+```ts
+async function generateClientTokenFromReadWriteToken(options?: {
+  token?: string;
+  pathname?: string;
+  onUploadCompleted?: {
+    callbackUrl: string;
+    metadata?: string;
+  };
+}): string {}
+```
+
 ## Examples
@@ -135,0 +151,0 @@

New alerts

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

35599

increased by20.3%

Number of package files

9

increased by12.5%

Lines of code

110

increased by41.03%

Number of lines in readme file

329

increased by5.11%

Worsened metrics

Number of low supply chain risk alerts

12

increased by33.33%

No dependency changes