Download

Serve the URL's blob as a streamed download or a bounded validated raster preview. The signed ws claim names the workspace whose store holds the bytes; the read binds it, and the stream's key resolves inside the binding so the body serves after it releases. A download streams out in bounded chunks — the bytes never buffer whole, so a large or concurrent fetch can't spike memory — under the real media type its filename names, always as an attachment; only a signed preview claim renders inline, after the bytes prove to be the raster type and size it declares. nosniff holds the browser to the declared type. Served bytes are briefly publicly cacheable: the signed URL is itself the whole grant, so a cache answering a repeat of the exact URL answers only what the signature grants, for a window inside the grant's remaining validity — refusals and redirects stay no-store.