@agentpond/supabase 0.6.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Marcus Schiesser
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/environment-context.d.ts

@@ -0,0 +1,18 @@
+import { type AgentPondEnvironmentContext, type AgentPondProviderProject } from "@agentpond/core";
+import { type SupabaseProcessRunner } from "./supabase-project.js";
+export type SupabaseEnvironmentContextOptions = {
+    cwd?: string;
+    envName?: string;
+};
+export declare function supabaseEnvironmentContextFromCwdIfAvailable(options?: SupabaseEnvironmentContextOptions, dependencies?: {
+    run?: SupabaseProcessRunner;
+}): AgentPondEnvironmentContext | undefined;
+export declare const supabaseProvider: {
+    readonly kind: "supabase";
+    readonly displayName: "Supabase";
+    readonly instrumentationPrompt: "Use $agentpond-instrumentation to inspect this Supabase project and add\nOpenInference tracing to its trusted AI application.\n\nUse the dedicated private agentpond Storage bucket and export spans directly\nwith createSupabaseSpanExporter() from @agentpond/supabase.\n\nBuild the application, exercise one real AI request, then use $agentpond to:\n\n  npx agentpond sync\n  npx agentpond traces list --limit 10";
+    readonly openProject: (options?: {
+        cwd?: string;
+        allowUnlinked?: boolean;
+    } | undefined) => AgentPondProviderProject | undefined;
+};

package/dist/environment-context.js

@@ -0,0 +1,78 @@
+import { agentPondWorkspaceRoot, resolveAgentPondEnvironment, } from "@agentpond/core";
+import { SUPABASE_INSTRUMENTATION_PROMPT, selectSupabaseEnvironment, supabaseCliProjectConfigFromCwdIfAvailable, supabaseLinkedProjectRef, supabaseProjectDirectory, validateSupabaseProjectRef, } from "./supabase-project.js";
+import { SupabaseStorageObjectStore } from "./supabase-storage.js";
+export function supabaseEnvironmentContextFromCwdIfAvailable(options = {}, dependencies = {}) {
+    const root = supabaseProjectDirectory(options.cwd);
+    if (!root)
+        return undefined;
+    const projectRef = options.envName
+        ? validateSupabaseProjectRef(options.envName)
+        : supabaseLinkedProjectRef(root);
+    if (!projectRef) {
+        throw new Error("Run supabase link --project-ref <project-ref> before using AgentPond with this Supabase project");
+    }
+    return supabaseEnvironmentContext({ projectRef, root }, dependencies);
+}
+function supabaseEnvironmentContext(project, dependencies = {}) {
+    const environment = resolveAgentPondEnvironment({
+        cwd: project.root,
+        name: project.projectRef,
+    });
+    const config = {
+        projectId: project.projectRef,
+        dbPath: environment.dbPath,
+        prefix: "",
+        auth: {
+            projectId: project.projectRef,
+            publicKey: "pk-agentpond",
+            secretKey: "sk-agentpond",
+        },
+        environment,
+    };
+    return {
+        kind: "supabase",
+        rootDir: project.root,
+        config,
+        usesAgentPondDevServer: false,
+        async resolveStorage() {
+            return {
+                store: await SupabaseStorageObjectStore.fromCliProject(project, dependencies),
+                projectId: project.projectRef,
+                prefix: "",
+            };
+        },
+    };
+}
+export const supabaseProvider = {
+    kind: "supabase",
+    displayName: "Supabase",
+    instrumentationPrompt: SUPABASE_INSTRUMENTATION_PROMPT,
+    openProject(options = {}) {
+        const candidateRoot = supabaseProjectDirectory(options.cwd);
+        if (!candidateRoot && !options.allowUnlinked)
+            return undefined;
+        const root = candidateRoot ?? agentPondWorkspaceRoot(options.cwd);
+        return supabaseProviderProject(root);
+    },
+};
+function supabaseProviderProject(root) {
+    return {
+        get projectLabel() {
+            return (supabaseCliProjectConfigFromCwdIfAvailable(root)?.projectRef ??
+                "unlinked");
+        },
+        rootDir: root,
+        selectEnvironment(name) {
+            return selectSupabaseEnvironment(name, { cwd: root });
+        },
+        resolveEnvironment(envName) {
+            const projectRef = envName
+                ? validateSupabaseProjectRef(envName)
+                : supabaseLinkedProjectRef(root);
+            if (!projectRef) {
+                throw new Error("Run supabase link --project-ref <project-ref> before using AgentPond with this Supabase project");
+            }
+            return supabaseEnvironmentContext({ projectRef, root });
+        },
+    };
+}

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+export * from "./environment-context.js";
+export * from "./span-exporter.js";
+export * from "./supabase-project.js";
+export * from "./supabase-storage.js";

package/dist/index.js

@@ -0,0 +1,4 @@
+export * from "./environment-context.js";
+export * from "./span-exporter.js";
+export * from "./supabase-project.js";
+export * from "./supabase-storage.js";

package/dist/span-exporter.d.ts

@@ -0,0 +1,13 @@
+import { AgentPondSpanExporter } from "@agentpond/otel";
+import type { SupabaseClient } from "@supabase/supabase-js";
+import { type SupabaseEnvironment } from "./supabase-storage.js";
+export type SupabaseSpanExporterOptions = {
+    bucket?: string;
+    client?: SupabaseClient;
+    env?: SupabaseEnvironment;
+    prefix?: string;
+    projectId?: string;
+    secretKey?: string;
+    url?: string;
+};
+export declare function createSupabaseSpanExporter(options?: SupabaseSpanExporterOptions): AgentPondSpanExporter;

package/dist/span-exporter.js

@@ -0,0 +1,37 @@
+import { AgentPondSpanExporter } from "@agentpond/otel";
+import { supabaseProjectRefFromUrl, validateSupabaseProjectRef, } from "./supabase-project.js";
+import { defaultSupabaseStorageBucket, defaultSupabaseStoragePrefix, SupabaseStorageObjectStore, supabaseRuntimeEnvironment, supabaseStorageConfigFromEnv, } from "./supabase-storage.js";
+export function createSupabaseSpanExporter(options = {}) {
+    if (options.client) {
+        const projectId = options.projectId
+            ? validateSupabaseProjectRef(options.projectId)
+            : supabaseProjectRefFromUrl(supabaseClientUrl(options.client));
+        const store = SupabaseStorageObjectStore.fromClient(options.client, {
+            bucket: options.bucket ?? defaultSupabaseStorageBucket,
+            prefix: options.prefix ?? defaultSupabaseStoragePrefix,
+        });
+        return new AgentPondSpanExporter({ store, projectId });
+    }
+    const env = options.env ??
+        (options.url && options.secretKey ? {} : supabaseRuntimeEnvironment());
+    const storageConfig = supabaseStorageConfigFromEnv({
+        ...env,
+        ...(options.url ? { SUPABASE_URL: options.url } : {}),
+        ...(options.secretKey ? { SUPABASE_SECRET_KEY: options.secretKey } : {}),
+    }, {
+        bucket: options.bucket ?? defaultSupabaseStorageBucket,
+        prefix: options.prefix ?? defaultSupabaseStoragePrefix,
+    });
+    const projectId = options.projectId
+        ? validateSupabaseProjectRef(options.projectId)
+        : supabaseProjectRefFromUrl(storageConfig.url);
+    const store = SupabaseStorageObjectStore.fromConfig(storageConfig);
+    return new AgentPondSpanExporter({ store, projectId });
+}
+function supabaseClientUrl(client) {
+    const url = client.supabaseUrl;
+    if (typeof url !== "string") {
+        throw new Error("createSupabaseSpanExporter() requires an explicit projectId when the Supabase client URL is unavailable");
+    }
+    return url;
+}

package/dist/supabase-project.d.ts

@@ -0,0 +1,34 @@
+export declare const SUPABASE_PROJECT_REF_PATTERN: RegExp;
+export type SupabaseCliProjectConfig = {
+    projectRef: string;
+    root: string;
+};
+export type SupabaseProcessRequest = {
+    args: readonly string[];
+    cwd: string;
+    stdio: "capture" | "inherit";
+};
+export type SupabaseProcessResult = {
+    exitCode: number;
+    stderr: string;
+    stdout: string;
+};
+export type SupabaseProcessRunner = (request: SupabaseProcessRequest) => Promise<SupabaseProcessResult>;
+export declare const SUPABASE_INSTRUMENTATION_PROMPT = "Use $agentpond-instrumentation to inspect this Supabase project and add\nOpenInference tracing to its trusted AI application.\n\nUse the dedicated private agentpond Storage bucket and export spans directly\nwith createSupabaseSpanExporter() from @agentpond/supabase.\n\nBuild the application, exercise one real AI request, then use $agentpond to:\n\n  npx agentpond sync\n  npx agentpond traces list --limit 10";
+export declare function isSupabaseProjectDirectory(cwd?: string): boolean;
+export declare function supabaseProjectDirectory(cwd?: string): string | undefined;
+export declare function supabaseCliProjectConfigFromCwd(cwd?: string): SupabaseCliProjectConfig;
+export declare function supabaseCliProjectConfigFromCwdIfAvailable(cwd?: string): SupabaseCliProjectConfig | undefined;
+export declare function supabaseLinkedProjectRef(root: string): string | undefined;
+export declare function validateSupabaseProjectRef(projectRef: string): string;
+export declare function supabaseHostedUrl(projectRef: string): string;
+export declare function supabaseProjectRefFromUrl(urlValue: string): string;
+export declare function selectSupabaseEnvironment(name: string, options?: {
+    cwd?: string;
+}, dependencies?: {
+    run?: SupabaseProcessRunner;
+}): Promise<string>;
+export declare function supabaseSecretKeyForProject(project: SupabaseCliProjectConfig, dependencies?: {
+    run?: SupabaseProcessRunner;
+}): Promise<string>;
+export declare function runSupabaseProcess(request: SupabaseProcessRequest): Promise<SupabaseProcessResult>;

package/dist/supabase-project.js

@@ -0,0 +1,192 @@
+import { spawn } from "node:child_process";
+import { once } from "node:events";
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { text } from "node:stream/consumers";
+import { findAncestorDirectory, nonEmpty } from "@agentpond/core";
+import { validateSupabaseSecretKey } from "./supabase-storage.js";
+export const SUPABASE_PROJECT_REF_PATTERN = /^[a-z]{20}$/;
+export const SUPABASE_INSTRUMENTATION_PROMPT = `Use $agentpond-instrumentation to inspect this Supabase project and add
+OpenInference tracing to its trusted AI application.
+
+Use the dedicated private agentpond Storage bucket and export spans directly
+with createSupabaseSpanExporter() from @agentpond/supabase.
+
+Build the application, exercise one real AI request, then use $agentpond to:
+
+  npx agentpond sync
+  npx agentpond traces list --limit 10`;
+export function isSupabaseProjectDirectory(cwd = process.cwd()) {
+    return supabaseProjectDirectory(cwd) !== undefined;
+}
+export function supabaseProjectDirectory(cwd = process.cwd()) {
+    return findAncestorDirectory(cwd, (directory) => existsSync(join(directory, "supabase", "config.toml")));
+}
+export function supabaseCliProjectConfigFromCwd(cwd = process.cwd()) {
+    const root = supabaseProjectDirectory(cwd);
+    if (!root) {
+        throw new Error("Run AgentPond inside an initialized Supabase project with supabase/config.toml");
+    }
+    const projectRef = supabaseLinkedProjectRef(root);
+    if (!projectRef) {
+        throw new Error("Run supabase link --project-ref <project-ref> before using AgentPond with this Supabase project");
+    }
+    return { projectRef, root };
+}
+export function supabaseCliProjectConfigFromCwdIfAvailable(cwd = process.cwd()) {
+    const root = supabaseProjectDirectory(cwd);
+    if (!root)
+        return undefined;
+    const projectRef = supabaseLinkedProjectRef(root);
+    return projectRef ? { projectRef, root } : undefined;
+}
+export function supabaseLinkedProjectRef(root) {
+    const path = join(root, "supabase", ".temp", "project-ref");
+    if (!existsSync(path))
+        return undefined;
+    let projectRef;
+    try {
+        projectRef = readFileSync(path, "utf8").trim();
+    }
+    catch {
+        throw new Error(`Could not read Supabase project link state at ${path}`);
+    }
+    if (!projectRef)
+        return undefined;
+    return validateSupabaseProjectRef(projectRef);
+}
+export function validateSupabaseProjectRef(projectRef) {
+    if (!SUPABASE_PROJECT_REF_PATTERN.test(projectRef)) {
+        throw new Error("Supabase project ref must contain exactly 20 lowercase letters");
+    }
+    return projectRef;
+}
+export function supabaseHostedUrl(projectRef) {
+    return `https://${validateSupabaseProjectRef(projectRef)}.supabase.co`;
+}
+export function supabaseProjectRefFromUrl(urlValue) {
+    let url;
+    try {
+        url = new URL(urlValue);
+    }
+    catch {
+        throw new Error("Could not derive a Supabase project ref from SUPABASE_URL");
+    }
+    const match = /^([a-z]{20})\.supabase\.co$/.exec(url.hostname);
+    if (url.protocol !== "https:" || url.port || !match) {
+        throw new Error("Could not derive a hosted Supabase project ref from SUPABASE_URL; provide projectId explicitly");
+    }
+    return validateSupabaseProjectRef(match[1]);
+}
+export async function selectSupabaseEnvironment(name, options = {}, dependencies = {}) {
+    const projectRef = validateSupabaseProjectRef(name);
+    const root = supabaseProjectDirectory(options.cwd);
+    if (!root) {
+        throw new Error("Run AgentPond inside an initialized Supabase project with supabase/config.toml");
+    }
+    const result = await (dependencies.run ?? runSupabaseProcess)({
+        args: ["link", "--project-ref", projectRef],
+        cwd: root,
+        stdio: "inherit",
+    });
+    if (result.exitCode !== 0) {
+        throw new Error(`Could not link Supabase project "${projectRef}". Run supabase login and try again.`);
+    }
+    return projectRef;
+}
+export async function supabaseSecretKeyForProject(project, dependencies = {}) {
+    const result = await (dependencies.run ?? runSupabaseProcess)({
+        args: [
+            "projects",
+            "api-keys",
+            "--project-ref",
+            project.projectRef,
+            "--output",
+            "json",
+            "--reveal",
+        ],
+        cwd: project.root,
+        stdio: "capture",
+    });
+    if (result.exitCode !== 0) {
+        throw new Error(`Could not load Supabase API keys for project "${project.projectRef}". Run supabase login and verify project access.`);
+    }
+    let value;
+    try {
+        value = JSON.parse(result.stdout);
+    }
+    catch {
+        throw new Error(`Supabase CLI returned invalid API-key metadata for project "${project.projectRef}"`);
+    }
+    const entries = supabaseApiKeyEntries(value);
+    const modern = entries.find((entry) => entry.name === "default" && entry.type === "secret");
+    const legacy = entries.find((entry) => entry.name === "service_role");
+    const key = nonEmpty(modern?.api_key) ?? nonEmpty(legacy?.api_key);
+    if (!key) {
+        throw new Error(`No default secret or legacy service-role key is available for Supabase project "${project.projectRef}"`);
+    }
+    try {
+        return validateSupabaseSecretKey(key);
+    }
+    catch {
+        throw new Error(`Supabase CLI did not reveal a usable secret or service-role key for project "${project.projectRef}"`);
+    }
+}
+export async function runSupabaseProcess(request) {
+    const child = spawn("supabase", request.args, {
+        cwd: request.cwd,
+        stdio: request.stdio === "inherit"
+            ? "inherit"
+            : ["inherit", "pipe", "pipe"],
+    });
+    try {
+        if (request.stdio === "inherit") {
+            const [code, signal] = (await once(child, "exit"));
+            if (code !== null)
+                return { exitCode: code, stderr: "", stdout: "" };
+            throw new Error(`Supabase CLI stopped by signal ${signal ?? "unknown"}`);
+        }
+        if (!child.stdout || !child.stderr) {
+            throw new Error("Could not capture Supabase CLI output");
+        }
+        const [[code, signal], stdout, stderr] = await Promise.all([
+            once(child, "exit"),
+            text(child.stdout),
+            text(child.stderr),
+        ]);
+        if (code !== null)
+            return { exitCode: code, stderr, stdout };
+        throw new Error(`Supabase CLI stopped by signal ${signal ?? "unknown"}`);
+    }
+    catch (error) {
+        if (error.code === "ENOENT") {
+            throw new Error("Supabase CLI is required. Install it, run supabase login, and try again.");
+        }
+        throw error;
+    }
+}
+function supabaseApiKeyEntries(value) {
+    const values = Array.isArray(value)
+        ? value
+        : value &&
+            typeof value === "object" &&
+            Array.isArray(value.apiKeys)
+            ? value.apiKeys
+            : [];
+    return values.flatMap((entry) => {
+        if (!entry || typeof entry !== "object")
+            return [];
+        const candidate = entry;
+        if (typeof candidate.name !== "string" ||
+            typeof candidate.api_key !== "string") {
+            return [];
+        }
+        return [
+            {
+                name: candidate.name,
+                api_key: candidate.api_key,
+                ...(typeof candidate.type === "string" ? { type: candidate.type } : {}),
+            },
+        ];
+    });
+}

package/dist/supabase-storage.d.ts

@@ -0,0 +1,48 @@
+import { type IngestionSink, type ObjectStore, type ObjectStoreIngestionSinkOptions } from "@agentpond/core";
+import { type SupabaseClient } from "@supabase/supabase-js";
+import type { SupabaseCliProjectConfig, SupabaseProcessRunner } from "./supabase-project.js";
+export declare const defaultSupabaseStorageBucket = "agentpond";
+export declare const defaultSupabaseStoragePrefix = "";
+export type SupabaseEnvironment = Record<string, string | undefined>;
+export type SupabaseStorageObjectStoreConfig = {
+    url: string;
+    secretKey: string;
+    bucket?: string;
+    prefix?: string;
+};
+export type SupabaseStorageRuntimeOptions = {
+    bucket?: string;
+    env?: SupabaseEnvironment;
+    prefix?: string;
+};
+export type SupabaseStorageClientOptions = {
+    bucket?: string;
+    prefix?: string;
+};
+export type SupabaseStorageConfig = {
+    bucket: string;
+    prefix: string;
+};
+export declare function supabaseStorageConfigFromEnv(env: SupabaseEnvironment, options?: Pick<SupabaseStorageObjectStoreConfig, "bucket" | "prefix">): SupabaseStorageObjectStoreConfig;
+export declare function supabaseSecretKeyFromEnv(env: SupabaseEnvironment): string;
+export declare function validateSupabaseSecretKey(secretKey: string): string;
+export declare class SupabaseStorageObjectStore implements ObjectStore {
+    readonly config: SupabaseStorageConfig;
+    private readonly storage;
+    private bucketValidation?;
+    static fromConfig(options: SupabaseStorageObjectStoreConfig): SupabaseStorageObjectStore;
+    static fromRuntimeEnv(options?: SupabaseStorageRuntimeOptions): SupabaseStorageObjectStore;
+    static fromClient(client: SupabaseClient, options?: SupabaseStorageClientOptions): SupabaseStorageObjectStore;
+    static fromCliProject(project: SupabaseCliProjectConfig, dependencies?: {
+        run?: SupabaseProcessRunner;
+    }): Promise<SupabaseStorageObjectStore>;
+    private constructor();
+    toSink(options?: ObjectStoreIngestionSinkOptions): IngestionSink;
+    putJson(key: string, value: unknown): Promise<void>;
+    getJson<T>(key: string): Promise<T>;
+    listKeys(prefix: string): Promise<string[]>;
+    private ensurePrivateBucket;
+    private validatePrivateBucket;
+    private listDirectory;
+}
+export declare function supabaseRuntimeEnvironment(): SupabaseEnvironment;

package/dist/supabase-storage.js

@@ -0,0 +1,276 @@
+import { nonEmpty, normalizePrefix, sinkFromStore, } from "@agentpond/core";
+import { createClient } from "@supabase/supabase-js";
+import { supabaseHostedUrl, supabaseSecretKeyForProject, } from "./supabase-project.js";
+export const defaultSupabaseStorageBucket = "agentpond";
+export const defaultSupabaseStoragePrefix = "";
+export function supabaseStorageConfigFromEnv(env, options = {}) {
+    const url = nonEmpty(env.SUPABASE_URL);
+    if (!url) {
+        throw new Error("Supabase storage requires SUPABASE_URL or an explicit url");
+    }
+    const secretKey = supabaseSecretKeyFromEnv(env);
+    return {
+        url: validatedSupabaseUrl(url),
+        secretKey,
+        bucket: options.bucket ?? defaultSupabaseStorageBucket,
+        prefix: options.prefix ?? defaultSupabaseStoragePrefix,
+    };
+}
+export function supabaseSecretKeyFromEnv(env) {
+    const direct = nonEmpty(env.SUPABASE_SECRET_KEY);
+    if (direct)
+        return validateSupabaseSecretKey(direct);
+    const dictionary = nonEmpty(env.SUPABASE_SECRET_KEYS);
+    if (dictionary) {
+        let parsed;
+        try {
+            parsed = JSON.parse(dictionary);
+        }
+        catch {
+            throw new Error("SUPABASE_SECRET_KEYS must contain a JSON object");
+        }
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+            throw new Error("SUPABASE_SECRET_KEYS must contain a JSON object");
+        }
+        const value = parsed.default;
+        if (value !== undefined && (typeof value !== "string" || !value)) {
+            throw new Error("SUPABASE_SECRET_KEYS.default must be a non-empty string");
+        }
+        if (typeof value === "string" && value) {
+            return validateSupabaseSecretKey(value);
+        }
+    }
+    const legacy = nonEmpty(env.SUPABASE_SERVICE_ROLE_KEY);
+    if (legacy)
+        return validateSupabaseSecretKey(legacy);
+    throw new Error("Supabase storage requires SUPABASE_SECRET_KEY, SUPABASE_SECRET_KEYS.default, or SUPABASE_SERVICE_ROLE_KEY");
+}
+export function validateSupabaseSecretKey(secretKey) {
+    if (secretKey.includes("*") ||
+        secretKey.includes("·") ||
+        secretKey.includes("•") ||
+        secretKey.startsWith("sb_publishable_") ||
+        secretKey.startsWith("anon")) {
+        throw invalidSupabaseCredentialError();
+    }
+    if (secretKey.startsWith("sb_secret_") && secretKey.length > 10) {
+        return secretKey;
+    }
+    if (legacyJwtRole(secretKey) === "service_role")
+        return secretKey;
+    throw invalidSupabaseCredentialError();
+}
+export class SupabaseStorageObjectStore {
+    config;
+    storage;
+    bucketValidation;
+    static fromConfig(options) {
+        const url = validatedSupabaseUrl(options.url);
+        const secretKey = validateSupabaseSecretKey(options.secretKey);
+        const client = createClient(url, secretKey, {
+            auth: {
+                autoRefreshToken: false,
+                detectSessionInUrl: false,
+                persistSession: false,
+            },
+        });
+        return SupabaseStorageObjectStore.fromClient(client, options);
+    }
+    static fromRuntimeEnv(options = {}) {
+        return SupabaseStorageObjectStore.fromConfig(supabaseStorageConfigFromEnv(options.env ?? supabaseRuntimeEnvironment(), options));
+    }
+    static fromClient(client, options = {}) {
+        const key = client.supabaseKey;
+        if (typeof key !== "string") {
+            throw new Error("SupabaseStorageObjectStore.fromClient() requires a client initialized with a Supabase secret or service-role key");
+        }
+        validateSupabaseSecretKey(key);
+        return new SupabaseStorageObjectStore({
+            bucket: options.bucket ?? defaultSupabaseStorageBucket,
+            prefix: options.prefix ?? defaultSupabaseStoragePrefix,
+        }, client.storage);
+    }
+    static async fromCliProject(project, dependencies = {}) {
+        const secretKey = await supabaseSecretKeyForProject(project, dependencies);
+        return SupabaseStorageObjectStore.fromConfig({
+            url: supabaseHostedUrl(project.projectRef),
+            secretKey,
+        });
+    }
+    constructor(config, storage) {
+        this.config = config;
+        this.storage = storage;
+    }
+    toSink(options = {}) {
+        return sinkFromStore(this, {
+            prefix: normalizePrefix(options.prefix ?? this.config.prefix),
+        });
+    }
+    async putJson(key, value) {
+        await this.ensurePrivateBucket();
+        const { error } = await this.storage
+            .from(this.config.bucket)
+            .upload(key, JSON.stringify(value), {
+            cacheControl: "0",
+            contentType: "application/json",
+            upsert: true,
+        });
+        if (error) {
+            throw new Error(`Could not upload Supabase Storage object ${key}: ${storageErrorDetail(error)}`);
+        }
+    }
+    async getJson(key) {
+        await this.ensurePrivateBucket();
+        const { data, error } = await this.storage
+            .from(this.config.bucket)
+            .download(key);
+        if (error || !data) {
+            throw new Error(`Could not download Supabase Storage object ${key}: ${storageErrorDetail(error)}`);
+        }
+        const body = await data.text();
+        if (!body)
+            throw new Error(`Supabase Storage object is empty: ${key}`);
+        try {
+            return JSON.parse(body);
+        }
+        catch {
+            throw new Error(`Supabase Storage object is not valid JSON: ${key}`);
+        }
+    }
+    async listKeys(prefix) {
+        await this.ensurePrivateBucket();
+        const initialDirectory = listingDirectoryForPrefix(prefix);
+        const keys = new Set();
+        await this.listDirectory(initialDirectory, prefix, keys, new Set());
+        return [...keys].sort();
+    }
+    async ensurePrivateBucket() {
+        this.bucketValidation ??= this.validatePrivateBucket();
+        await this.bucketValidation;
+    }
+    async validatePrivateBucket() {
+        const { data, error } = await this.storage.getBucket(this.config.bucket);
+        if (error || !data) {
+            if (isMissingStorageResource(error)) {
+                throw new Error(`Supabase Storage bucket "${this.config.bucket}" does not exist`);
+            }
+            throw new Error(`Could not inspect Supabase Storage bucket "${this.config.bucket}": ${storageErrorDetail(error)}`);
+        }
+        if (data.public) {
+            throw new Error(`Supabase Storage bucket "${this.config.bucket}" must be private`);
+        }
+    }
+    async listDirectory(directory, prefix, keys, visited) {
+        if (visited.has(directory))
+            return;
+        visited.add(directory);
+        const entries = [];
+        const limit = 100;
+        let offset = 0;
+        while (true) {
+            const { data, error } = await this.storage
+                .from(this.config.bucket)
+                .list(directory, {
+                limit,
+                offset,
+                sortBy: { column: "name", order: "asc" },
+            });
+            if (error || !data) {
+                throw new Error(`Could not list Supabase Storage path ${directory || "/"}: ${storageErrorDetail(error)}`);
+            }
+            entries.push(...data);
+            if (data.length < limit)
+                break;
+            offset += data.length;
+        }
+        for (const entry of entries.sort((left, right) => left.name.localeCompare(right.name))) {
+            const key = directory ? `${directory}/${entry.name}` : entry.name;
+            if (isStorageDirectory(entry)) {
+                if (key.startsWith(prefix) || prefix.startsWith(`${key}/`)) {
+                    await this.listDirectory(key, prefix, keys, visited);
+                }
+                continue;
+            }
+            if (key.startsWith(prefix))
+                keys.add(key);
+        }
+    }
+}
+export function supabaseRuntimeEnvironment() {
+    const names = [
+        "SUPABASE_URL",
+        "SUPABASE_SECRET_KEY",
+        "SUPABASE_SECRET_KEYS",
+        "SUPABASE_SERVICE_ROLE_KEY",
+    ];
+    const env = {};
+    if (typeof process !== "undefined") {
+        for (const name of names)
+            env[name] = process.env[name];
+    }
+    const deno = globalThis.Deno;
+    if (deno?.env) {
+        for (const name of names)
+            env[name] ??= deno.env.get(name);
+    }
+    return env;
+}
+function validatedSupabaseUrl(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new Error("Supabase url must be a valid absolute URL");
+    }
+    if (url.protocol !== "https:" && url.protocol !== "http:") {
+        throw new Error("Supabase url must use http or https");
+    }
+    return url.toString().replace(/\/$/, "");
+}
+function legacyJwtRole(value) {
+    const payload = value.split(".")[1];
+    if (!payload)
+        return undefined;
+    try {
+        const normalized = payload.replace(/-/g, "+").replace(/_/g, "/");
+        const padded = normalized.padEnd(normalized.length + ((4 - (normalized.length % 4)) % 4), "=");
+        const parsed = JSON.parse(atob(padded));
+        return typeof parsed.role === "string" ? parsed.role : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function invalidSupabaseCredentialError() {
+    return new Error("Supabase storage requires a secret key or legacy service-role key; publishable and anonymous keys are not allowed");
+}
+function listingDirectoryForPrefix(prefix) {
+    let start = 0;
+    while (prefix[start] === "/")
+        start += 1;
+    let end = prefix.length;
+    while (end > start && prefix[end - 1] === "/")
+        end -= 1;
+    const trimmed = prefix.slice(start, end);
+    if (!trimmed)
+        return "";
+    if (prefix.endsWith("/"))
+        return trimmed;
+    const separator = trimmed.lastIndexOf("/");
+    return separator === -1 ? "" : trimmed.slice(0, separator);
+}
+function isStorageDirectory(entry) {
+    return entry.id == null && entry.metadata == null;
+}
+function isMissingStorageResource(error) {
+    if (!error)
+        return true;
+    const status = error.statusCode ?? error.status;
+    return (status === 404 ||
+        status === "404" ||
+        /not found|does not exist/i.test(error.message ?? ""));
+}
+function storageErrorDetail(error) {
+    return error?.message?.trim() || "unknown storage error";
+}

package/package.json

@@ -0,0 +1,34 @@
+{
+  "name": "@agentpond/supabase",
+  "version": "0.6.0",
+  "description": "Supabase Storage adapter and direct OpenTelemetry exporter for AgentPond",
+  "license": "MIT",
+  "type": "module",
+  "files": [
+    "dist"
+  ],
+  "types": "./dist/index.d.ts",
+  "repository": {
+    "type": "git",
+    "url": "git+ssh://git@github.com/marcusschiesser/agentpond.git",
+    "directory": "packages/supabase"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "dependencies": {
+    "@supabase/supabase-js": "^2.110.6",
+    "@agentpond/core": "0.5.1",
+    "@agentpond/otel": "0.1.3"
+  },
+  "devDependencies": {
+    "@opentelemetry/sdk-trace-base": "^2.9.0"
+  },
+  "scripts": {
+    "test": "NODE_ENV=test node --test --import tsx tests/*.test.ts",
+    "test:deno": "deno run tests/deno-smoke.ts"
+  }
+}