@e-sig/supabase 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Opendelphi contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,40 @@
+# @e-sig/supabase
+
+Supabase reference adapters for [`@e-sig/core`](https://github.com/vmvtech/esig-suite/tree/main/packages/esig-core) —
+self-contained PDF e-signature persistence on Supabase Postgres + Storage.
+
+```bash
+npm i @e-sig/core @e-sig/supabase @supabase/supabase-js
+```
+
+Apply `migrations/0001_esig_self_contained.sql` (in the suite root) first.
+
+```ts
+import { createClient } from "@supabase/supabase-js";
+import {
+  SupabaseCertStore,
+  SupabaseAuditLogStore,
+  SupabasePdfStorageStore,
+} from "@e-sig/supabase";
+
+const service = createClient(url, serviceRoleKey); // service-role: bypasses RLS for cert/audit/storage writes
+
+const certStore = new SupabaseCertStore(service);          // table "org_signing_certs", tenant col "tenant_id"
+const auditStore = new SupabaseAuditLogStore(service);     // table "esig_audit_log"
+const storage = new SupabasePdfStorageStore(service);      // bucket "signed-documents"
+```
+
+All three constructors take options to map onto an existing schema, e.g. the
+Opendelphi schema keys on `org_id`:
+
+```ts
+new SupabaseCertStore(service, { table: "org_signing_certs", tenantColumn: "org_id" });
+new SupabaseAuditLogStore(service, { tenantColumn: "org_id" });
+new SupabasePdfStorageStore(service, { bucket: "signed-documents" });
+```
+
+Pass these to `signDocument()` from `@e-sig/core`. The stores handle the
+Postgres `\x`-hex bytea round-trip for the encrypted key and return the storage
+**path** (private buckets have no public URL — serve via an RLS-gated download route).
+
+Peer deps: `@e-sig/core`, `@supabase/supabase-js`. License: MIT.

package/dist/audit-store.d.ts

@@ -0,0 +1,16 @@
+import type { SupabaseClient } from "@supabase/supabase-js";
+import type { AuditLogStore, AuditLogEntry, AuditLogRow } from "@e-sig/core";
+export interface SupabaseAuditLogStoreOptions {
+    /** Table name. Default `esig_audit_log`. */
+    table?: string;
+    /** Tenant key column. Default `tenant_id`. */
+    tenantColumn?: string;
+}
+export declare class SupabaseAuditLogStore implements AuditLogStore {
+    private sb;
+    private table;
+    private tenantColumn;
+    constructor(sb: SupabaseClient, opts?: SupabaseAuditLogStoreOptions);
+    insert(entry: AuditLogEntry): Promise<AuditLogRow>;
+}
+//# sourceMappingURL=audit-store.d.ts.map

package/dist/audit-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-store.d.ts","sourceRoot":"","sources":["../src/audit-store.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE7E,MAAM,WAAW,4BAA4B;IAC3C,4CAA4C;IAC5C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8CAA8C;IAC9C,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,qBAAa,qBAAsB,YAAW,aAAa;IAG7C,OAAO,CAAC,EAAE;IAFtB,OAAO,CAAC,KAAK,CAAS;IACtB,OAAO,CAAC,YAAY,CAAS;gBACT,EAAE,EAAE,cAAc,EAAE,IAAI,GAAE,4BAAiC;IAKzE,MAAM,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC;CAsBzD"}

package/dist/audit-store.js

@@ -0,0 +1,38 @@
+// @e-sig/supabase — SupabaseAuditLogStore
+//
+// Append-only AuditLogStore backed by a Postgres table (default `esig_audit_log`)
+// via supabase-js. Tenant key column defaults to `tenant_id` (Opendelphi: `org_id`).
+export class SupabaseAuditLogStore {
+    sb;
+    table;
+    tenantColumn;
+    constructor(sb, opts = {}) {
+        this.sb = sb;
+        this.table = opts.table ?? "esig_audit_log";
+        this.tenantColumn = opts.tenantColumn ?? "tenant_id";
+    }
+    async insert(entry) {
+        const { data, error } = await this.sb
+            .from(this.table)
+            .insert({
+            [this.tenantColumn]: entry.tenantId,
+            actor_user_id: entry.actorUserId ?? null,
+            action: entry.action,
+            target_table: entry.targetTable ?? null,
+            target_id: entry.targetId ?? null,
+            cert_id: entry.certId ?? null,
+            cert_fingerprint: entry.certFingerprint ?? null,
+            ip: entry.ip ?? null,
+            user_agent: entry.userAgent ?? null,
+            session_id: entry.sessionId ?? null,
+            signed_pdf_url: entry.signedPdfUrl ?? null,
+            metadata: entry.metadata ?? {},
+        })
+            .select("id, created_at")
+            .single();
+        if (error || !data)
+            throw new Error(`SupabaseAuditLogStore.insert: ${error?.message}`);
+        return { id: data.id, createdAt: new Date(data.created_at) };
+    }
+}
+//# sourceMappingURL=audit-store.js.map

package/dist/audit-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-store.js","sourceRoot":"","sources":["../src/audit-store.ts"],"names":[],"mappings":"AAAA,0CAA0C;AAC1C,EAAE;AACF,kFAAkF;AAClF,qFAAqF;AAYrF,MAAM,OAAO,qBAAqB;IAGZ;IAFZ,KAAK,CAAS;IACd,YAAY,CAAS;IAC7B,YAAoB,EAAkB,EAAE,OAAqC,EAAE;QAA3D,OAAE,GAAF,EAAE,CAAgB;QACpC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,gBAAgB,CAAC;QAC5C,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,WAAW,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAoB;QAC/B,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;aAClC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;aAChB,MAAM,CAAC;YACN,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,QAAQ;YACnC,aAAa,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;YACxC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,YAAY,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;YACvC,SAAS,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;YACjC,OAAO,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI;YAC7B,gBAAgB,EAAE,KAAK,CAAC,eAAe,IAAI,IAAI;YAC/C,EAAE,EAAE,KAAK,CAAC,EAAE,IAAI,IAAI;YACpB,UAAU,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;YACnC,UAAU,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;YACnC,cAAc,EAAE,KAAK,CAAC,YAAY,IAAI,IAAI;YAC1C,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,EAAE;SAC/B,CAAC;aACD,MAAM,CAAC,gBAAgB,CAAC;aACxB,MAAM,EAAE,CAAC;QACZ,IAAI,KAAK,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QACvF,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,EAAY,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,UAAoB,CAAC,EAAE,CAAC;IACnF,CAAC;CACF"}

package/dist/cert-store.d.ts

@@ -0,0 +1,24 @@
+import type { SupabaseClient } from "@supabase/supabase-js";
+import type { CertStore, StoredCert, GeneratedCert } from "@e-sig/core";
+export interface SupabaseCertStoreOptions {
+    /** Table name. Default `org_signing_certs`. */
+    table?: string;
+    /** Tenant key column. Default `tenant_id`. */
+    tenantColumn?: string;
+}
+export declare class SupabaseCertStore implements CertStore {
+    private sb;
+    private table;
+    private tenantColumn;
+    constructor(sb: SupabaseClient, opts?: SupabaseCertStoreOptions);
+    findActive(tenantId: string): Promise<StoredCert | null>;
+    insert(input: {
+        tenantId: string;
+        generated: GeneratedCert;
+        keyPemEncrypted: Uint8Array;
+        rotatedFromId?: string | null;
+    }): Promise<StoredCert>;
+    deactivate(id: string): Promise<void>;
+    findExpiring(withinDays: number): Promise<StoredCert[]>;
+}
+//# sourceMappingURL=cert-store.d.ts.map

package/dist/cert-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cert-store.d.ts","sourceRoot":"","sources":["../src/cert-store.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAgBxE,MAAM,WAAW,wBAAwB;IACvC,+CAA+C;IAC/C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8CAA8C;IAC9C,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AA2CD,qBAAa,iBAAkB,YAAW,SAAS;IAGrC,OAAO,CAAC,EAAE;IAFtB,OAAO,CAAC,KAAK,CAAS;IACtB,OAAO,CAAC,YAAY,CAAS;gBACT,EAAE,EAAE,cAAc,EAAE,IAAI,GAAE,wBAA6B;IAKrE,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAWxD,MAAM,CAAC,KAAK,EAAE;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,aAAa,CAAC;QACzB,eAAe,EAAE,UAAU,CAAC;QAC5B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC/B,GAAG,OAAO,CAAC,UAAU,CAAC;IAwBjB,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKrC,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;CAU9D"}

package/dist/cert-store.js

@@ -0,0 +1,112 @@
+// @e-sig/supabase — SupabaseCertStore
+//
+// CertStore backed by a Postgres table (default `org_signing_certs`) via
+// supabase-js. Matches the schema in migrations/0001_esig_self_contained.sql.
+// The tenant key column is `tenant_id` in the bundled migration; pass
+// `tenantColumn` if yours differs (Opendelphi uses `org_id`).
+function toStoredCert(r, tenantColumn) {
+    // Postgres bytea comes back from PostgREST as a `\x<hex>` string. Decode to
+    // bytes. Legacy rows may be JSON-Buffer-wrapped (`{"type":"Buffer",...}`) by
+    // older supabase-js; detect + unwrap so they're at least diagnosable (they'll
+    // still fail GCM decryption — rotate to recover).
+    let keyBytes;
+    const raw = r.key_pem_encrypted;
+    if (raw instanceof Uint8Array) {
+        keyBytes = raw;
+    }
+    else if (typeof raw === "string" && raw.startsWith("\\x")) {
+        keyBytes = Buffer.from(raw.slice(2), "hex");
+        if (keyBytes.length > 0 && keyBytes[0] === 0x7b /* '{' */) {
+            try {
+                const parsed = JSON.parse(Buffer.from(keyBytes).toString("utf8"));
+                if (parsed && parsed.type === "Buffer" && Array.isArray(parsed.data)) {
+                    keyBytes = Buffer.from(parsed.data);
+                }
+            }
+            catch {
+                /* not JSON — keep original bytes */
+            }
+        }
+    }
+    else if (typeof raw === "string") {
+        keyBytes = Buffer.from(raw, "base64");
+    }
+    else {
+        keyBytes = new Uint8Array();
+    }
+    const tenantId = r[tenantColumn] ?? r.tenant_id ?? r.org_id ?? "";
+    return {
+        id: r.id,
+        tenantId,
+        certPem: r.cert_pem,
+        keyPemEncrypted: keyBytes,
+        certFingerprint: r.cert_fingerprint,
+        notBefore: new Date(r.not_before),
+        notAfter: new Date(r.not_after),
+        active: r.active,
+        rotatedFromId: r.rotated_from,
+        createdAt: new Date(r.created_at),
+    };
+}
+export class SupabaseCertStore {
+    sb;
+    table;
+    tenantColumn;
+    constructor(sb, opts = {}) {
+        this.sb = sb;
+        this.table = opts.table ?? "org_signing_certs";
+        this.tenantColumn = opts.tenantColumn ?? "tenant_id";
+    }
+    async findActive(tenantId) {
+        const { data, error } = await this.sb
+            .from(this.table)
+            .select("*")
+            .eq(this.tenantColumn, tenantId)
+            .eq("active", true)
+            .maybeSingle();
+        if (error)
+            throw new Error(`SupabaseCertStore.findActive: ${error.message}`);
+        return data ? toStoredCert(data, this.tenantColumn) : null;
+    }
+    async insert(input) {
+        // bytea wire encoding: supabase-js JSON-stringifies a Uint8Array, mangling
+        // the round-trip. Pre-encode as the Postgres bytea-in hex form `\x<hex>`.
+        const bytes = Buffer.isBuffer(input.keyPemEncrypted)
+            ? input.keyPemEncrypted
+            : Buffer.from(input.keyPemEncrypted);
+        const hexEncoded = "\\x" + bytes.toString("hex");
+        const { data, error } = await this.sb
+            .from(this.table)
+            .insert({
+            [this.tenantColumn]: input.tenantId,
+            cert_pem: input.generated.certPem,
+            key_pem_encrypted: hexEncoded,
+            cert_fingerprint: input.generated.fingerprint,
+            not_before: input.generated.notBefore.toISOString(),
+            not_after: input.generated.notAfter.toISOString(),
+            rotated_from: input.rotatedFromId ?? null,
+        })
+            .select()
+            .single();
+        if (error || !data)
+            throw new Error(`SupabaseCertStore.insert: ${error?.message}`);
+        return toStoredCert(data, this.tenantColumn);
+    }
+    async deactivate(id) {
+        const { error } = await this.sb.from(this.table).update({ active: false }).eq("id", id);
+        if (error)
+            throw new Error(`SupabaseCertStore.deactivate: ${error.message}`);
+    }
+    async findExpiring(withinDays) {
+        const horizon = new Date(Date.now() + withinDays * 86400_000).toISOString();
+        const { data, error } = await this.sb
+            .from(this.table)
+            .select("*")
+            .eq("active", true)
+            .lte("not_after", horizon);
+        if (error)
+            throw new Error(`SupabaseCertStore.findExpiring: ${error.message}`);
+        return (data ?? []).map((r) => toStoredCert(r, this.tenantColumn));
+    }
+}
+//# sourceMappingURL=cert-store.js.map

package/dist/cert-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cert-store.js","sourceRoot":"","sources":["../src/cert-store.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,EAAE;AACF,yEAAyE;AACzE,8EAA8E;AAC9E,sEAAsE;AACtE,8DAA8D;AA0B9D,SAAS,YAAY,CAAC,CAAa,EAAE,YAAoB;IACvD,4EAA4E;IAC5E,6EAA6E;IAC7E,8EAA8E;IAC9E,kDAAkD;IAClD,IAAI,QAAoB,CAAC;IACzB,MAAM,GAAG,GAAG,CAAC,CAAC,iBAAiB,CAAC;IAChC,IAAI,GAAG,YAAY,UAAU,EAAE,CAAC;QAC9B,QAAQ,GAAG,GAAG,CAAC;IACjB,CAAC;SAAM,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC5C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;YAC1D,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;gBAClE,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBACrE,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACtC,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,oCAAoC;YACtC,CAAC;QACH,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACnC,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACxC,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG,IAAI,UAAU,EAAE,CAAC;IAC9B,CAAC;IACD,MAAM,QAAQ,GAAI,CAAC,CAAC,YAAgC,CAAY,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;IAClG,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,QAAQ;QACR,OAAO,EAAE,CAAC,CAAC,QAAQ;QACnB,eAAe,EAAE,QAAQ;QACzB,eAAe,EAAE,CAAC,CAAC,gBAAgB;QACnC,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;QACjC,QAAQ,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/B,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,aAAa,EAAE,CAAC,CAAC,YAAY;QAC7B,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;KAClC,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,iBAAiB;IAGR;IAFZ,KAAK,CAAS;IACd,YAAY,CAAS;IAC7B,YAAoB,EAAkB,EAAE,OAAiC,EAAE;QAAvD,OAAE,GAAF,EAAE,CAAgB;QACpC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,mBAAmB,CAAC;QAC/C,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,WAAW,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,QAAgB;QAC/B,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;aAClC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;aAChB,MAAM,CAAC,GAAG,CAAC;aACX,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC;aAC/B,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC;aAClB,WAAW,EAAE,CAAC;QACjB,IAAI,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7E,OAAO,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,IAAkB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAKZ;QACC,2EAA2E;QAC3E,0EAA0E;QAC1E,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,eAAe,CAAC;YAClD,CAAC,CAAC,KAAK,CAAC,eAAe;YACvB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QACvC,MAAM,UAAU,GAAG,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;aAClC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;aAChB,MAAM,CAAC;YACN,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,QAAQ;YACnC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC,OAAO;YACjC,iBAAiB,EAAE,UAAU;YAC7B,gBAAgB,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW;YAC7C,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,WAAW,EAAE;YACnD,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE;YACjD,YAAY,EAAE,KAAK,CAAC,aAAa,IAAI,IAAI;SAC1C,CAAC;aACD,MAAM,EAAE;aACR,MAAM,EAAE,CAAC;QACZ,IAAI,KAAK,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QACnF,OAAO,YAAY,CAAC,IAAkB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EAAU;QACzB,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACxF,IAAI,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,UAAkB;QACnC,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;QAC5E,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;aAClC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;aAChB,MAAM,CAAC,GAAG,CAAC;aACX,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC;aAClB,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAC7B,IAAI,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/E,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAe,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IACnF,CAAC;CACF"}

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+export { SupabaseCertStore, type SupabaseCertStoreOptions, } from "./cert-store.js";
+export { SupabaseAuditLogStore, type SupabaseAuditLogStoreOptions, } from "./audit-store.js";
+export { SupabasePdfStorageStore, type SupabasePdfStorageStoreOptions, } from "./storage.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAOA,OAAO,EACL,iBAAiB,EACjB,KAAK,wBAAwB,GAC9B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,qBAAqB,EACrB,KAAK,4BAA4B,GAClC,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,uBAAuB,EACvB,KAAK,8BAA8B,GACpC,MAAM,cAAc,CAAC"}

package/dist/index.js

@@ -0,0 +1,10 @@
+// @e-sig/supabase
+//
+// Supabase reference implementations of the @e-sig/core persistence
+// interfaces (CertStore, AuditLogStore, PdfStorageStore). Pair with the bundled
+// migration (migrations/0001_esig_self_contained.sql). Table/bucket/tenant-column
+// names are configurable so you can map onto your existing schema.
+export { SupabaseCertStore, } from "./cert-store.js";
+export { SupabaseAuditLogStore, } from "./audit-store.js";
+export { SupabasePdfStorageStore, } from "./storage.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,kBAAkB;AAClB,EAAE;AACF,oEAAoE;AACpE,gFAAgF;AAChF,kFAAkF;AAClF,mEAAmE;AAEnE,OAAO,EACL,iBAAiB,GAElB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,qBAAqB,GAEtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,uBAAuB,GAExB,MAAM,cAAc,CAAC"}

package/dist/storage.d.ts

@@ -0,0 +1,22 @@
+import type { SupabaseClient } from "@supabase/supabase-js";
+import type { PdfStorageStore } from "@e-sig/core";
+export interface SupabasePdfStorageStoreOptions {
+    /** Bucket name. Default `signed-documents`. */
+    bucket?: string;
+    /** Allow overwriting an existing object at the path. Default false. */
+    upsert?: boolean;
+}
+export declare class SupabasePdfStorageStore implements PdfStorageStore {
+    private sb;
+    private bucket;
+    private upsert;
+    constructor(sb: SupabaseClient, opts?: SupabasePdfStorageStoreOptions);
+    upload(input: {
+        path: string;
+        bytes: Uint8Array;
+        contentType: string;
+    }): Promise<{
+        url: string;
+    }>;
+}
+//# sourceMappingURL=storage.d.ts.map

package/dist/storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../src/storage.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD,MAAM,WAAW,8BAA8B;IAC7C,+CAA+C;IAC/C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,qBAAa,uBAAwB,YAAW,eAAe;IAGjD,OAAO,CAAC,EAAE;IAFtB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,MAAM,CAAU;gBACJ,EAAE,EAAE,cAAc,EAAE,IAAI,GAAE,8BAAmC;IAK3E,MAAM,CAAC,KAAK,EAAE;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,UAAU,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;KACrB,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;CAU7B"}

package/dist/storage.js

@@ -0,0 +1,29 @@
+// @e-sig/supabase — SupabasePdfStorageStore
+//
+// PdfStorageStore backed by a private Supabase Storage bucket (default
+// `signed-documents`). Returns the storage PATH as the `url` — private buckets
+// have no public URL, so serve signed PDFs through an auth-gated download route
+// (RLS on the bucket restricts reads to the owning tenant). Uploads use the
+// service-role client (bucket write policy is service-role-only).
+export class SupabasePdfStorageStore {
+    sb;
+    bucket;
+    upsert;
+    constructor(sb, opts = {}) {
+        this.sb = sb;
+        this.bucket = opts.bucket ?? "signed-documents";
+        this.upsert = opts.upsert ?? false;
+    }
+    async upload(input) {
+        const body = Buffer.isBuffer(input.bytes) ? input.bytes : Buffer.from(input.bytes);
+        const { error } = await this.sb.storage.from(this.bucket).upload(input.path, body, {
+            contentType: input.contentType,
+            upsert: this.upsert,
+        });
+        if (error)
+            throw new Error(`SupabasePdfStorageStore.upload(${input.path}): ${error.message}`);
+        // Private bucket → return the path key; the app serves it via a download route.
+        return { url: input.path };
+    }
+}
+//# sourceMappingURL=storage.js.map

package/dist/storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.js","sourceRoot":"","sources":["../src/storage.ts"],"names":[],"mappings":"AAAA,4CAA4C;AAC5C,EAAE;AACF,uEAAuE;AACvE,+EAA+E;AAC/E,gFAAgF;AAChF,4EAA4E;AAC5E,kEAAkE;AAYlE,MAAM,OAAO,uBAAuB;IAGd;IAFZ,MAAM,CAAS;IACf,MAAM,CAAU;IACxB,YAAoB,EAAkB,EAAE,OAAuC,EAAE;QAA7D,OAAE,GAAF,EAAE,CAAgB;QACpC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,kBAAkB,CAAC;QAChD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAIZ;QACC,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACnF,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE;YACjF,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;QACH,IAAI,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,KAAK,CAAC,IAAI,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9F,gFAAgF;QAChF,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,CAAC;CACF"}

package/package.json

@@ -0,0 +1,60 @@
+{
+  "name": "@e-sig/supabase",
+  "version": "0.1.0",
+  "description": "Supabase adapters (CertStore / AuditLogStore / PdfStorageStore) for @e-sig/core — self-contained PDF e-signature persistence on Supabase Postgres + Storage.",
+  "license": "MIT",
+  "type": "module",
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist/",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "clean": "rm -rf dist",
+    "prepublishOnly": "npm run clean && npm run build"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "keywords": [
+    "supabase",
+    "pdf",
+    "esignature",
+    "pkcs7",
+    "self-contained",
+    "esign",
+    "certstore",
+    "audit-log"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/vmvtech/esig-suite.git",
+    "directory": "packages/esig-supabase"
+  },
+  "homepage": "https://github.com/vmvtech/esig-suite/tree/main/packages/esig-supabase#readme",
+  "peerDependencies": {
+    "@supabase/supabase-js": ">=2",
+    "@e-sig/core": "^0.4.0"
+  },
+  "devDependencies": {
+    "@supabase/supabase-js": "^2.98.0",
+    "@types/node": "^22.0.0",
+    "@e-sig/core": "^0.4.0",
+    "typescript": "^5.4.0"
+  },
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org",
+    "access": "public"
+  }
+}