@effect-kit/storage 0.0.0-stage → 0.1.0

package/dist/supabase/signing.js

@@ -0,0 +1,93 @@
+import { ObjectKey } from "../core/object.js";
+import { storageError } from "../core/errors.js";
+import { StorageSigning } from "../core/capabilities.js";
+import { signingRequest } from "../internal/signing-request.js";
+import { objectPath, validateKey, validateRef } from "../providers/supabase/mapping.js";
+import { json, request } from "../providers/supabase/transport.js";
+import { SupabaseStorage } from "../supabase.js";
+import { Clock, Context, DateTime, Effect, Layer, Redacted, Schema } from "effect";
+import { Base64Url } from "effect/encoding";
+
+// src/providers/supabase/signing.ts
+var SupabaseUploadGrants = class extends Context.Service()("@effect-kit/storage/supabase/SupabaseUploadGrants") {};
+const grantUrl = Effect.fnUntraced(function* (base, path, prefix) {
+	const url = URL.parse(base + path);
+	const origin = new URL(base).origin;
+	if (!url || url.origin !== origin || url.pathname !== new URL(`${base}/${prefix}`).pathname || url.username || url.password || url.hash || !url.searchParams.get("token")) return yield* storageError("sign", "supabase", { _tag: "ProviderFailure" });
+	return url;
+});
+const tokenExpiry = Effect.fnUntraced(function* (url) {
+	const token = url.searchParams.get("token") ?? "";
+	const payload = yield* Effect.fromResult(Base64Url.decodeString(token.split(".")[1] ?? "")).pipe(Effect.mapError(() => storageError("sign", "supabase", { _tag: "ProviderFailure" })));
+	const claims = yield* Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Struct({ exp: Schema.Natural.check(Schema.isLessThanOrEqualTo(864e10)) })))(payload).pipe(Effect.mapError(() => storageError("sign", "supabase", { _tag: "ProviderFailure" })));
+	if (claims.exp * 1e3 <= (yield* Clock.currentTimeMillis)) return yield* storageError("sign", "supabase", { _tag: "Expired" });
+	return DateTime.makeUnsafe(claims.exp * 1e3);
+});
+const SupabaseSigning = { layer() {
+	return Layer.effectContext(Effect.gen(function* () {
+		const storage = yield* SupabaseStorage;
+		const sign = Effect.fnUntraced(function* (input) {
+			yield* signingRequest(input, "supabase");
+			yield* validateRef(storage, input.ref, "sign");
+			if (/[?#%\\]/u.test(input.ref.key)) return yield* storageError("sign", "supabase", {
+				_tag: "Unsupported",
+				capability: "reserved-signing-key"
+			}, "not-started");
+			if (input.method !== "GET") return yield* storageError("sign", "supabase", {
+				_tag: "Unsupported",
+				capability: "native-signing-method"
+			}, "not-started");
+			return yield* Effect.scoped(Effect.gen(function* () {
+				const response = yield* request(storage, "sign", "POST", `/object/sign/${objectPath(storage, input.ref.key)}`, { json: { expiresIn: input.expiresInSeconds } });
+				const body = yield* json(response, Schema.Struct({ signedURL: Schema.String }), "sign");
+				const url = yield* grantUrl(storage.config.baseUrl, body.signedURL, `object/sign/${objectPath(storage, input.ref.key)}`);
+				return {
+					method: "GET",
+					url: Redacted.make(url.href),
+					headers: Redacted.make({}),
+					ref: input.ref,
+					expiresAt: yield* tokenExpiry(url),
+					constraints: []
+				};
+			}));
+		});
+		const create = Effect.fnUntraced(function* (input) {
+			yield* Schema.decodeUnknownEffect(Schema.Struct({
+				key: ObjectKey,
+				upsert: Schema.optional(Schema.Boolean)
+			}))(input).pipe(Effect.mapError(() => storageError("grant", "supabase", {
+				_tag: "InvalidInput",
+				field: "request"
+			}, "not-started")));
+			yield* validateKey(input.key, "grant");
+			if (/[?#%\\]/u.test(input.key)) return yield* storageError("grant", "supabase", {
+				_tag: "Unsupported",
+				capability: "reserved-signing-key"
+			}, "not-started");
+			return yield* Effect.scoped(Effect.gen(function* () {
+				const response = yield* request(storage, "grant", "POST", `/object/upload/sign/${objectPath(storage, input.key)}`, {
+					json: {},
+					headers: { "x-upsert": String(input.upsert ?? false) }
+				});
+				const body = yield* json(response, Schema.Struct({ url: Schema.String }), "grant");
+				const url = yield* grantUrl(storage.config.baseUrl, body.url, `object/upload/sign/${objectPath(storage, input.key)}`);
+				return {
+					method: "PUT",
+					url: Redacted.make(url.href),
+					token: Redacted.make(url.searchParams.get("token") ?? ""),
+					headers: Redacted.make({}),
+					expiresAt: yield* tokenExpiry(url),
+					constraints: [{
+						kind: "upsert",
+						value: String(input.upsert ?? false),
+						enforcement: "provider"
+					}]
+				};
+			}));
+		});
+		return Context.make(StorageSigning, { sign }).pipe(Context.add(SupabaseUploadGrants, { create }));
+	}));
+} };
+
+export { SupabaseSigning, SupabaseUploadGrants };
+//# sourceMappingURL=signing.js.map

package/dist/supabase/signing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signing.js","names":[],"sources":["../../src/providers/supabase/signing.ts"],"sourcesContent":["import { Clock, Context, DateTime, Effect, Layer, Redacted, Schema } from \"effect\";\nimport { Base64Url } from \"effect/encoding\";\n\nimport { StorageSigning } from \"../../core/capabilities.js\";\nimport type { GrantConstraint } from \"../../core/capabilities.js\";\nimport { storageError } from \"../../core/errors.js\";\nimport { ObjectKey } from \"../../core/object.js\";\nimport { signingRequest } from \"../../internal/signing-request.js\";\nimport { SupabaseStorage } from \"./index.js\";\nimport { objectPath, validateKey, validateRef } from \"./mapping.js\";\nimport { json, request } from \"./transport.js\";\n\nexport class SupabaseUploadGrants extends Context.Service<\n  SupabaseUploadGrants,\n  {\n    readonly create: (input: { readonly key: string; readonly upsert?: boolean }) => Effect.Effect<\n      {\n        readonly method: \"PUT\";\n        readonly url: Redacted.Redacted<string>;\n        readonly token: Redacted.Redacted<string>;\n        readonly headers: Redacted.Redacted<Readonly<Record<string, string>>>;\n        readonly expiresAt: DateTime.Utc;\n        readonly constraints: ReadonlyArray<GrantConstraint>;\n      },\n      ReturnType<typeof storageError>\n    >;\n  }\n>()(\"@effect-kit/storage/supabase/SupabaseUploadGrants\") {}\n\nconst grantUrl = Effect.fnUntraced(function* (base: string, path: string, prefix: string) {\n  const url = URL.parse(base + path);\n  const origin = new URL(base).origin;\n  if (\n    !url ||\n    url.origin !== origin ||\n    url.pathname !== new URL(`${base}/${prefix}`).pathname ||\n    url.username ||\n    url.password ||\n    url.hash ||\n    !url.searchParams.get(\"token\")\n  )\n    return yield* storageError(\"sign\", \"supabase\", { _tag: \"ProviderFailure\" });\n  return url;\n});\nconst tokenExpiry = Effect.fnUntraced(function* (url: URL) {\n  const token = url.searchParams.get(\"token\") ?? \"\";\n  const payload = yield* Effect.fromResult(Base64Url.decodeString(token.split(\".\")[1] ?? \"\")).pipe(\n    Effect.mapError(() => storageError(\"sign\", \"supabase\", { _tag: \"ProviderFailure\" })),\n  );\n  const claims = yield* Schema.decodeUnknownEffect(\n    Schema.fromJsonString(\n      Schema.Struct({ exp: Schema.Natural.check(Schema.isLessThanOrEqualTo(8640000000000)) }),\n    ),\n  )(payload).pipe(\n    Effect.mapError(() => storageError(\"sign\", \"supabase\", { _tag: \"ProviderFailure\" })),\n  );\n  if (claims.exp * 1000 <= (yield* Clock.currentTimeMillis))\n    return yield* storageError(\"sign\", \"supabase\", { _tag: \"Expired\" });\n  return DateTime.makeUnsafe(claims.exp * 1000);\n});\nexport const SupabaseSigning = {\n  layer() {\n    return Layer.effectContext(\n      Effect.gen(function* () {\n        const storage = yield* SupabaseStorage;\n        const sign: StorageSigning[\"Service\"][\"sign\"] = Effect.fnUntraced(function* (input) {\n          yield* signingRequest(input, \"supabase\");\n          yield* validateRef(storage, input.ref, \"sign\");\n          if (/[?#%\\\\]/u.test(input.ref.key))\n            return yield* storageError(\n              \"sign\",\n              \"supabase\",\n              { _tag: \"Unsupported\", capability: \"reserved-signing-key\" },\n              \"not-started\",\n            );\n          if (input.method !== \"GET\")\n            return yield* storageError(\n              \"sign\",\n              \"supabase\",\n              { _tag: \"Unsupported\", capability: \"native-signing-method\" },\n              \"not-started\",\n            );\n          return yield* Effect.scoped(\n            Effect.gen(function* () {\n              const response = yield* request(\n                storage,\n                \"sign\",\n                \"POST\",\n                `/object/sign/${objectPath(storage, input.ref.key)}`,\n                { json: { expiresIn: input.expiresInSeconds } },\n              );\n              const body = yield* json(\n                response,\n                Schema.Struct({ signedURL: Schema.String }),\n                \"sign\",\n              );\n              const url = yield* grantUrl(\n                storage.config.baseUrl,\n                body.signedURL,\n                `object/sign/${objectPath(storage, input.ref.key)}`,\n              );\n              return {\n                method: \"GET\" as const,\n                url: Redacted.make(url.href),\n                headers: Redacted.make({}),\n                ref: input.ref,\n                expiresAt: yield* tokenExpiry(url),\n                constraints: [],\n              };\n            }),\n          );\n        });\n        const create: SupabaseUploadGrants[\"Service\"][\"create\"] = Effect.fnUntraced(\n          function* (input) {\n            yield* Schema.decodeUnknownEffect(\n              Schema.Struct({ key: ObjectKey, upsert: Schema.optional(Schema.Boolean) }),\n            )(input).pipe(\n              Effect.mapError(() =>\n                storageError(\n                  \"grant\",\n                  \"supabase\",\n                  { _tag: \"InvalidInput\", field: \"request\" },\n                  \"not-started\",\n                ),\n              ),\n            );\n            yield* validateKey(input.key, \"grant\");\n            if (/[?#%\\\\]/u.test(input.key))\n              return yield* storageError(\n                \"grant\",\n                \"supabase\",\n                { _tag: \"Unsupported\", capability: \"reserved-signing-key\" },\n                \"not-started\",\n              );\n            return yield* Effect.scoped(\n              Effect.gen(function* () {\n                const response = yield* request(\n                  storage,\n                  \"grant\",\n                  \"POST\",\n                  `/object/upload/sign/${objectPath(storage, input.key)}`,\n                  { json: {}, headers: { \"x-upsert\": String(input.upsert ?? false) } },\n                );\n                const body = yield* json(response, Schema.Struct({ url: Schema.String }), \"grant\");\n                const url = yield* grantUrl(\n                  storage.config.baseUrl,\n                  body.url,\n                  `object/upload/sign/${objectPath(storage, input.key)}`,\n                );\n                return {\n                  method: \"PUT\" as const,\n                  url: Redacted.make(url.href),\n                  token: Redacted.make(url.searchParams.get(\"token\") ?? \"\"),\n                  headers: Redacted.make({}),\n                  expiresAt: yield* tokenExpiry(url),\n                  constraints: [\n                    {\n                      kind: \"upsert\",\n                      value: String(input.upsert ?? false),\n                      enforcement: \"provider\" as const,\n                    },\n                  ],\n                };\n              }),\n            );\n          },\n        );\n        return Context.make(StorageSigning, { sign }).pipe(\n          Context.add(SupabaseUploadGrants, { create }),\n        );\n      }),\n    );\n  },\n};\n"],"mappings":";;;;;;;;;;;AAYA,IAAa,uBAAb,cAA0C,QAAQ,QAehD,CAAC,CAAC,mDAAmD,CAAC,CAAC,CAAC;AAE1D,MAAM,WAAW,OAAO,WAAW,WAAW,MAAc,MAAc,QAAgB;CACxF,MAAM,MAAM,IAAI,MAAM,OAAO,IAAI;CACjC,MAAM,SAAS,IAAI,IAAI,IAAI,CAAC,CAAC;CAC7B,IACE,CAAC,OACD,IAAI,WAAW,UACf,IAAI,aAAa,IAAI,IAAI,GAAG,KAAK,GAAG,QAAQ,CAAC,CAAC,YAC9C,IAAI,YACJ,IAAI,YACJ,IAAI,QACJ,CAAC,IAAI,aAAa,IAAI,OAAO,GAE7B,OAAO,OAAO,aAAa,QAAQ,YAAY,EAAE,MAAM,kBAAkB,CAAC;CAC5E,OAAO;AACT,CAAC;AACD,MAAM,cAAc,OAAO,WAAW,WAAW,KAAU;CACzD,MAAM,QAAQ,IAAI,aAAa,IAAI,OAAO,KAAK;CAC/C,MAAM,UAAU,OAAO,OAAO,WAAW,UAAU,aAAa,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,KAC1F,OAAO,eAAe,aAAa,QAAQ,YAAY,EAAE,MAAM,kBAAkB,CAAC,CAAC,CACrF;CACA,MAAM,SAAS,OAAO,OAAO,oBAC3B,OAAO,eACL,OAAO,OAAO,EAAE,KAAK,OAAO,QAAQ,MAAM,OAAO,oBAAoB,MAAa,CAAC,EAAE,CAAC,CACxF,CACF,CAAC,CAAC,OAAO,CAAC,CAAC,KACT,OAAO,eAAe,aAAa,QAAQ,YAAY,EAAE,MAAM,kBAAkB,CAAC,CAAC,CACrF;CACA,IAAI,OAAO,MAAM,QAAS,OAAO,MAAM,oBACrC,OAAO,OAAO,aAAa,QAAQ,YAAY,EAAE,MAAM,UAAU,CAAC;CACpE,OAAO,SAAS,WAAW,OAAO,MAAM,GAAI;AAC9C,CAAC;AACD,MAAa,kBAAkB,EAC7B,QAAQ;CACN,OAAO,MAAM,cACX,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO;EACvB,MAAM,OAA0C,OAAO,WAAW,WAAW,OAAO;GAClF,OAAO,eAAe,OAAO,UAAU;GACvC,OAAO,YAAY,SAAS,MAAM,KAAK,MAAM;GAC7C,IAAI,WAAW,KAAK,MAAM,IAAI,GAAG,GAC/B,OAAO,OAAO,aACZ,QACA,YACA;IAAE,MAAM;IAAe,YAAY;GAAuB,GAC1D,aACF;GACF,IAAI,MAAM,WAAW,OACnB,OAAO,OAAO,aACZ,QACA,YACA;IAAE,MAAM;IAAe,YAAY;GAAwB,GAC3D,aACF;GACF,OAAO,OAAO,OAAO,OACnB,OAAO,IAAI,aAAa;IACtB,MAAM,WAAW,OAAO,QACtB,SACA,QACA,QACA,gBAAgB,WAAW,SAAS,MAAM,IAAI,GAAG,KACjD,EAAE,MAAM,EAAE,WAAW,MAAM,iBAAiB,EAAE,CAChD;IACA,MAAM,OAAO,OAAO,KAClB,UACA,OAAO,OAAO,EAAE,WAAW,OAAO,OAAO,CAAC,GAC1C,MACF;IACA,MAAM,MAAM,OAAO,SACjB,QAAQ,OAAO,SACf,KAAK,WACL,eAAe,WAAW,SAAS,MAAM,IAAI,GAAG,GAClD;IACA,OAAO;KACL,QAAQ;KACR,KAAK,SAAS,KAAK,IAAI,IAAI;KAC3B,SAAS,SAAS,KAAK,CAAC,CAAC;KACzB,KAAK,MAAM;KACX,WAAW,OAAO,YAAY,GAAG;KACjC,aAAa,CAAC;IAChB;GACF,CAAC,CACH;EACF,CAAC;EACD,MAAM,SAAoD,OAAO,WAC/D,WAAW,OAAO;GAChB,OAAO,OAAO,oBACZ,OAAO,OAAO;IAAE,KAAK;IAAW,QAAQ,OAAO,SAAS,OAAO,OAAO;GAAE,CAAC,CAC3E,CAAC,CAAC,KAAK,CAAC,CAAC,KACP,OAAO,eACL,aACE,SACA,YACA;IAAE,MAAM;IAAgB,OAAO;GAAU,GACzC,aACF,CACF,CACF;GACA,OAAO,YAAY,MAAM,KAAK,OAAO;GACrC,IAAI,WAAW,KAAK,MAAM,GAAG,GAC3B,OAAO,OAAO,aACZ,SACA,YACA;IAAE,MAAM;IAAe,YAAY;GAAuB,GAC1D,aACF;GACF,OAAO,OAAO,OAAO,OACnB,OAAO,IAAI,aAAa;IACtB,MAAM,WAAW,OAAO,QACtB,SACA,SACA,QACA,uBAAuB,WAAW,SAAS,MAAM,GAAG,KACpD;KAAE,MAAM,CAAC;KAAG,SAAS,EAAE,YAAY,OAAO,MAAM,UAAU,KAAK,EAAE;IAAE,CACrE;IACA,MAAM,OAAO,OAAO,KAAK,UAAU,OAAO,OAAO,EAAE,KAAK,OAAO,OAAO,CAAC,GAAG,OAAO;IACjF,MAAM,MAAM,OAAO,SACjB,QAAQ,OAAO,SACf,KAAK,KACL,sBAAsB,WAAW,SAAS,MAAM,GAAG,GACrD;IACA,OAAO;KACL,QAAQ;KACR,KAAK,SAAS,KAAK,IAAI,IAAI;KAC3B,OAAO,SAAS,KAAK,IAAI,aAAa,IAAI,OAAO,KAAK,EAAE;KACxD,SAAS,SAAS,KAAK,CAAC,CAAC;KACzB,WAAW,OAAO,YAAY,GAAG;KACjC,aAAa,CACX;MACE,MAAM;MACN,OAAO,OAAO,MAAM,UAAU,KAAK;MACnC,aAAa;KACf,CACF;IACF;GACF,CAAC,CACH;EACF,CACF;EACA,OAAO,QAAQ,KAAK,gBAAgB,EAAE,KAAK,CAAC,CAAC,CAAC,KAC5C,QAAQ,IAAI,sBAAsB,EAAE,OAAO,CAAC,CAC9C;CACF,CAAC,CACH;AACF,EACF"}

package/dist/supabase/tus-uploads.d.ts

@@ -0,0 +1,13 @@
+import { UploadActor, UploadError, failUpload } from "../uploads/schema.js";
+import { StorageError } from "../core/errors.js";
+import "../index.js";
+import { UploadGrantDriver } from "../uploads/driver.js";
+import { SupabaseStorage } from "../supabase.js";
+import { Effect, Layer, Redacted } from "effect";
+export declare const SupabaseTusUploadGrants: {
+  layer<R>(options: {
+    readonly userToken: (actor: UploadActor) => Effect.Effect<Redacted.Redacted<string>, ReturnType<typeof failUpload>, R>;
+    readonly publicApiKey: Redacted.Redacted<string>;
+  }): Layer.Layer<UploadGrantDriver, StorageError | UploadError, SupabaseStorage | Exclude<R, import("effect/Scope").Scope>>;
+};
+//# sourceMappingURL=tus-uploads.d.ts.map

package/dist/supabase/tus-uploads.js

@@ -0,0 +1,109 @@
+import { failUpload } from "../uploads/schema.js";
+import { UploadGrantDriver } from "../uploads/driver.js";
+import { operationMetadata } from "../uploads/verification.js";
+import { negotiateTus, tusUploads } from "../providers/supabase/tus.js";
+import { SupabaseStorage } from "../supabase.js";
+import { Clock, Effect, Layer, Redacted, Schema } from "effect";
+import { Base64Url } from "effect/encoding";
+
+// src/providers/supabase/tus-uploads.ts
+const decode = (value) => Schema.decodeUnknownEffect(Schema.Struct({
+	url: Schema.String,
+	total: Schema.Natural,
+	expiresAt: Schema.Number
+}))(value).pipe(Effect.mapError(() => failUpload("Conflict")));
+const SupabaseTusUploadGrants = { layer(options) {
+	return Layer.effect(UploadGrantDriver, Effect.gen(function* () {
+		const storage = yield* SupabaseStorage;
+		const context = yield* Effect.context();
+		if (!storage.offsets) return yield* failUpload("Unsupported");
+		const extensions = yield* negotiateTus(storage);
+		const credentials = Effect.fnUntraced(function* (actor) {
+			const token = yield* Effect.provide(options.userToken(actor), context);
+			const payload = yield* Effect.fromResult(Base64Url.decodeString(Redacted.value(token).split(".")[1] ?? "")).pipe(Effect.mapError(() => failUpload("Unauthorized")));
+			const claims = yield* Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Struct({
+				sub: Schema.String,
+				role: Schema.Literal("authenticated"),
+				exp: Schema.Natural
+			})))(payload).pipe(Effect.mapError(() => failUpload("Unauthorized")));
+			if (claims.sub !== actor.subject || claims.exp * 1e3 <= (yield* Clock.currentTimeMillis)) return yield* failUpload("Unauthorized");
+			return {
+				token,
+				native: tusUploads({
+					...storage,
+					config: {
+						...storage.config,
+						auth: {
+							mode: "user",
+							token,
+							apiKey: options.publicApiKey
+						}
+					}
+				}, extensions),
+				expiresAt: claims.exp * 1e3
+			};
+		});
+		return UploadGrantDriver.of({
+			maximumGrantLifetimeMillis: 864e5,
+			begin: Effect.fnUntraced(function* (record) {
+				if (!["auto", "resumable"].includes(record.input.strategy ?? "auto")) return yield* failUpload("Unsupported");
+				const upload = yield* (yield* credentials(record.actor)).native.create({
+					key: record.stagingKey,
+					contentLength: record.input.file.size,
+					contentType: record.input.file.contentType,
+					customMetadata: operationMetadata(record),
+					condition: { _tag: "CreateOnly" }
+				});
+				return {
+					...yield* Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Struct({
+						url: Schema.String,
+						total: Schema.Natural
+					})))(Redacted.value(upload.handle)).pipe(Effect.mapError(() => failUpload("Unavailable"))),
+					expiresAt: (yield* Clock.currentTimeMillis) + 864e5
+				};
+			}),
+			grant: Effect.fnUntraced(function* (record, expiresAt) {
+				const user = yield* credentials(record.actor);
+				const remote = yield* decode(record.remote ? Redacted.value(record.remote) : void 0);
+				const state = yield* user.native.query({
+					protocol: "supabase-tus-v1",
+					ref: {
+						storeId: storage.storeId,
+						key: record.stagingKey
+					},
+					handle: Redacted.make(JSON.stringify(remote))
+				});
+				if (state._tag === "Expired") return yield* failUpload("Expired");
+				if (state._tag === "Unknown") return yield* failUpload("Unavailable");
+				return {
+					_tag: "Resumable",
+					protocol: "tus",
+					url: remote.url,
+					headers: {
+						authorization: `Bearer ${Redacted.value(user.token)}`,
+						apikey: Redacted.value(options.publicApiKey)
+					},
+					offset: state._tag === "Completed" ? record.input.file.size : state.committedOffset,
+					chunkBytes: 6 * 1024 ** 2,
+					expiresAt: Math.min(expiresAt, user.expiresAt, remote.expiresAt)
+				};
+			}),
+			abort: Effect.fnUntraced(function* (record) {
+				if (record.remote === void 0) return;
+				const user = yield* credentials(record.actor);
+				const remote = yield* decode(record.remote ? Redacted.value(record.remote) : void 0);
+				yield* user.native.cancel({
+					protocol: "supabase-tus-v1",
+					ref: {
+						storeId: storage.storeId,
+						key: record.stagingKey
+					},
+					handle: Redacted.make(JSON.stringify(remote))
+				});
+			})
+		});
+	}));
+} };
+
+export { SupabaseTusUploadGrants };
+//# sourceMappingURL=tus-uploads.js.map

package/dist/supabase/tus-uploads.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tus-uploads.js","names":[],"sources":["../../src/providers/supabase/tus-uploads.ts"],"sourcesContent":["import { Clock, Effect, Layer, Redacted, Schema } from \"effect\";\nimport { Base64Url } from \"effect/encoding\";\n\nimport { UploadGrantDriver } from \"../../uploads/driver.js\";\nimport { failUpload } from \"../../uploads/schema.js\";\nimport type { UploadActor } from \"../../uploads/schema.js\";\nimport { operationMetadata } from \"../../uploads/verification.js\";\nimport { SupabaseStorage } from \"./index.js\";\nimport { negotiateTus, tusUploads } from \"./tus.js\";\n\nconst decode = (value: unknown) =>\n  Schema.decodeUnknownEffect(\n    Schema.Struct({ url: Schema.String, total: Schema.Natural, expiresAt: Schema.Number }),\n  )(value).pipe(Effect.mapError(() => failUpload(\"Conflict\")));\n\nexport const SupabaseTusUploadGrants = {\n  layer<R>(options: {\n    readonly userToken: (\n      actor: UploadActor,\n    ) => Effect.Effect<Redacted.Redacted<string>, ReturnType<typeof failUpload>, R>;\n    readonly publicApiKey: Redacted.Redacted<string>;\n  }) {\n    return Layer.effect(\n      UploadGrantDriver,\n      Effect.gen(function* () {\n        const storage = yield* SupabaseStorage;\n        const context = yield* Effect.context<R>();\n        if (!storage.offsets) return yield* failUpload(\"Unsupported\");\n        const extensions = yield* negotiateTus(storage);\n        const credentials = Effect.fnUntraced(function* (actor: UploadActor) {\n          const token = yield* Effect.provide(options.userToken(actor), context);\n          const payload = yield* Effect.fromResult(\n            Base64Url.decodeString(Redacted.value(token).split(\".\")[1] ?? \"\"),\n          ).pipe(Effect.mapError(() => failUpload(\"Unauthorized\")));\n          const claims = yield* Schema.decodeUnknownEffect(\n            Schema.fromJsonString(\n              Schema.Struct({\n                sub: Schema.String,\n                role: Schema.Literal(\"authenticated\"),\n                exp: Schema.Natural,\n              }),\n            ),\n          )(payload).pipe(Effect.mapError(() => failUpload(\"Unauthorized\")));\n          if (claims.sub !== actor.subject || claims.exp * 1000 <= (yield* Clock.currentTimeMillis))\n            return yield* failUpload(\"Unauthorized\");\n          const native = tusUploads(\n            {\n              ...storage,\n              config: {\n                ...storage.config,\n                auth: { mode: \"user\" as const, token, apiKey: options.publicApiKey },\n              },\n            },\n            extensions,\n          );\n          return { token, native, expiresAt: claims.exp * 1000 };\n        });\n        return UploadGrantDriver.of({\n          maximumGrantLifetimeMillis: 86400000,\n          begin: Effect.fnUntraced(function* (record) {\n            if (![\"auto\", \"resumable\"].includes(record.input.strategy ?? \"auto\"))\n              return yield* failUpload(\"Unsupported\");\n            const user = yield* credentials(record.actor);\n            const upload = yield* user.native.create({\n              key: record.stagingKey,\n              contentLength: record.input.file.size,\n              contentType: record.input.file.contentType,\n              customMetadata: operationMetadata(record),\n              condition: { _tag: \"CreateOnly\" },\n            });\n            const handle = yield* Schema.decodeUnknownEffect(\n              Schema.fromJsonString(Schema.Struct({ url: Schema.String, total: Schema.Natural })),\n            )(Redacted.value(upload.handle)).pipe(Effect.mapError(() => failUpload(\"Unavailable\")));\n            return { ...handle, expiresAt: (yield* Clock.currentTimeMillis) + 1 * 86400000 };\n          }),\n          grant: Effect.fnUntraced(function* (record, expiresAt) {\n            const user = yield* credentials(record.actor);\n            const remote = yield* decode(record.remote ? Redacted.value(record.remote) : undefined);\n            const state = yield* user.native.query({\n              protocol: \"supabase-tus-v1\",\n              ref: { storeId: storage.storeId, key: record.stagingKey },\n              handle: Redacted.make(JSON.stringify(remote)),\n            });\n            if (state._tag === \"Expired\") return yield* failUpload(\"Expired\");\n            if (state._tag === \"Unknown\") return yield* failUpload(\"Unavailable\");\n            return {\n              _tag: \"Resumable\",\n              protocol: \"tus\",\n              url: remote.url,\n              headers: {\n                authorization: `Bearer ${Redacted.value(user.token)}`,\n                apikey: Redacted.value(options.publicApiKey),\n              },\n              offset: state._tag === \"Completed\" ? record.input.file.size : state.committedOffset,\n              chunkBytes: 6 * 1024 ** 2,\n              expiresAt: Math.min(expiresAt, user.expiresAt, remote.expiresAt),\n            };\n          }),\n          abort: Effect.fnUntraced(function* (record) {\n            if (record.remote === undefined) return;\n            const user = yield* credentials(record.actor);\n            const remote = yield* decode(record.remote ? Redacted.value(record.remote) : undefined);\n            yield* user.native.cancel({\n              protocol: \"supabase-tus-v1\",\n              ref: { storeId: storage.storeId, key: record.stagingKey },\n              handle: Redacted.make(JSON.stringify(remote)),\n            });\n          }),\n        });\n      }),\n    );\n  },\n};\n"],"mappings":";;;;;;;;;AAUA,MAAM,UAAU,UACd,OAAO,oBACL,OAAO,OAAO;CAAE,KAAK,OAAO;CAAQ,OAAO,OAAO;CAAS,WAAW,OAAO;AAAO,CAAC,CACvF,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,OAAO,eAAe,WAAW,UAAU,CAAC,CAAC;AAE7D,MAAa,0BAA0B,EACrC,MAAS,SAKN;CACD,OAAO,MAAM,OACX,mBACA,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO;EACvB,MAAM,UAAU,OAAO,OAAO,QAAW;EACzC,IAAI,CAAC,QAAQ,SAAS,OAAO,OAAO,WAAW,aAAa;EAC5D,MAAM,aAAa,OAAO,aAAa,OAAO;EAC9C,MAAM,cAAc,OAAO,WAAW,WAAW,OAAoB;GACnE,MAAM,QAAQ,OAAO,OAAO,QAAQ,QAAQ,UAAU,KAAK,GAAG,OAAO;GACrE,MAAM,UAAU,OAAO,OAAO,WAC5B,UAAU,aAAa,SAAS,MAAM,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAClE,CAAC,CAAC,KAAK,OAAO,eAAe,WAAW,cAAc,CAAC,CAAC;GACxD,MAAM,SAAS,OAAO,OAAO,oBAC3B,OAAO,eACL,OAAO,OAAO;IACZ,KAAK,OAAO;IACZ,MAAM,OAAO,QAAQ,eAAe;IACpC,KAAK,OAAO;GACd,CAAC,CACH,CACF,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,OAAO,eAAe,WAAW,cAAc,CAAC,CAAC;GACjE,IAAI,OAAO,QAAQ,MAAM,WAAW,OAAO,MAAM,QAAS,OAAO,MAAM,oBACrE,OAAO,OAAO,WAAW,cAAc;GAWzC,OAAO;IAAE;IAAO,QAVD,WACb;KACE,GAAG;KACH,QAAQ;MACN,GAAG,QAAQ;MACX,MAAM;OAAE,MAAM;OAAiB;OAAO,QAAQ,QAAQ;MAAa;KACrE;IACF,GACA,UAEmB;IAAG,WAAW,OAAO,MAAM;GAAK;EACvD,CAAC;EACD,OAAO,kBAAkB,GAAG;GAC1B,4BAA4B;GAC5B,OAAO,OAAO,WAAW,WAAW,QAAQ;IAC1C,IAAI,CAAC,CAAC,QAAQ,WAAW,CAAC,CAAC,SAAS,OAAO,MAAM,YAAY,MAAM,GACjE,OAAO,OAAO,WAAW,aAAa;IAExC,MAAM,SAAS,QAAO,OADF,YAAY,OAAO,KAAK,EAClB,CAAC,OAAO,OAAO;KACvC,KAAK,OAAO;KACZ,eAAe,OAAO,MAAM,KAAK;KACjC,aAAa,OAAO,MAAM,KAAK;KAC/B,gBAAgB,kBAAkB,MAAM;KACxC,WAAW,EAAE,MAAM,aAAa;IAClC,CAAC;IAID,OAAO;KAAE,GAAG,OAHU,OAAO,oBAC3B,OAAO,eAAe,OAAO,OAAO;MAAE,KAAK,OAAO;MAAQ,OAAO,OAAO;KAAQ,CAAC,CAAC,CACpF,CAAC,CAAC,SAAS,MAAM,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK,OAAO,eAAe,WAAW,aAAa,CAAC,CAAC;KAClE,YAAY,OAAO,MAAM,qBAAqB;IAAa;GACjF,CAAC;GACD,OAAO,OAAO,WAAW,WAAW,QAAQ,WAAW;IACrD,MAAM,OAAO,OAAO,YAAY,OAAO,KAAK;IAC5C,MAAM,SAAS,OAAO,OAAO,OAAO,SAAS,SAAS,MAAM,OAAO,MAAM,IAAI,MAAS;IACtF,MAAM,QAAQ,OAAO,KAAK,OAAO,MAAM;KACrC,UAAU;KACV,KAAK;MAAE,SAAS,QAAQ;MAAS,KAAK,OAAO;KAAW;KACxD,QAAQ,SAAS,KAAK,KAAK,UAAU,MAAM,CAAC;IAC9C,CAAC;IACD,IAAI,MAAM,SAAS,WAAW,OAAO,OAAO,WAAW,SAAS;IAChE,IAAI,MAAM,SAAS,WAAW,OAAO,OAAO,WAAW,aAAa;IACpE,OAAO;KACL,MAAM;KACN,UAAU;KACV,KAAK,OAAO;KACZ,SAAS;MACP,eAAe,UAAU,SAAS,MAAM,KAAK,KAAK;MAClD,QAAQ,SAAS,MAAM,QAAQ,YAAY;KAC7C;KACA,QAAQ,MAAM,SAAS,cAAc,OAAO,MAAM,KAAK,OAAO,MAAM;KACpE,YAAY,IAAI,QAAQ;KACxB,WAAW,KAAK,IAAI,WAAW,KAAK,WAAW,OAAO,SAAS;IACjE;GACF,CAAC;GACD,OAAO,OAAO,WAAW,WAAW,QAAQ;IAC1C,IAAI,OAAO,WAAW,QAAW;IACjC,MAAM,OAAO,OAAO,YAAY,OAAO,KAAK;IAC5C,MAAM,SAAS,OAAO,OAAO,OAAO,SAAS,SAAS,MAAM,OAAO,MAAM,IAAI,MAAS;IACtF,OAAO,KAAK,OAAO,OAAO;KACxB,UAAU;KACV,KAAK;MAAE,SAAS,QAAQ;MAAS,KAAK,OAAO;KAAW;KACxD,QAAQ,SAAS,KAAK,KAAK,UAAU,MAAM,CAAC;IAC9C,CAAC;GACH,CAAC;EACH,CAAC;CACH,CAAC,CACH;AACF,EACF"}

package/dist/supabase/uploads.d.ts

@@ -0,0 +1,5 @@
+import { UploadGrantDriver } from "../uploads/driver.js";
+import { SupabaseUploadGrants } from "./signing.js";
+import { Layer } from "effect";
+export declare const SupabaseAuthorizedUploads: Layer.Layer<UploadGrantDriver, never, SupabaseUploadGrants>;
+//# sourceMappingURL=uploads.d.ts.map

package/dist/supabase/uploads.js

@@ -0,0 +1,32 @@
+import { failUpload } from "../uploads/schema.js";
+import { UploadGrantDriver } from "../uploads/driver.js";
+import { SupabaseUploadGrants } from "./signing.js";
+import { Clock, DateTime, Effect, Layer, Redacted } from "effect";
+
+// src/providers/supabase/uploads.ts
+const SupabaseAuthorizedUploads = Layer.effect(UploadGrantDriver, Effect.gen(function* () {
+	const grants = yield* SupabaseUploadGrants;
+	return UploadGrantDriver.of({
+		maximumGrantLifetimeMillis: 726e4,
+		begin: (record) => ["auto", "single"].includes(record.input.strategy ?? "auto") ? Effect.succeed(null) : Effect.fail(failUpload("Unsupported")),
+		grant: Effect.fnUntraced(function* (record, expiresAt) {
+			const grant = yield* grants.create({
+				key: record.stagingKey,
+				upsert: false
+			});
+			if (DateTime.toEpochMillis(grant.expiresAt) > expiresAt || DateTime.toEpochMillis(grant.expiresAt) <= (yield* Clock.currentTimeMillis)) return yield* failUpload("Unsupported");
+			return {
+				_tag: "SignedRequest",
+				constraints: grant.constraints,
+				method: "PUT",
+				url: Redacted.value(grant.url),
+				headers: Redacted.value(grant.headers),
+				expiresAt: DateTime.toEpochMillis(grant.expiresAt)
+			};
+		}),
+		abort: () => Effect.void
+	});
+}));
+
+export { SupabaseAuthorizedUploads };
+//# sourceMappingURL=uploads.js.map

package/dist/supabase/uploads.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"uploads.js","names":[],"sources":["../../src/providers/supabase/uploads.ts"],"sourcesContent":["import { Clock, DateTime, Effect, Layer, Redacted } from \"effect\";\n\nimport { UploadGrantDriver } from \"../../uploads/driver.js\";\nimport { failUpload } from \"../../uploads/schema.js\";\nimport { SupabaseUploadGrants } from \"./signing.js\";\nexport const SupabaseAuthorizedUploads = Layer.effect(\n  UploadGrantDriver,\n  Effect.gen(function* () {\n    const grants = yield* SupabaseUploadGrants;\n    return UploadGrantDriver.of({\n      maximumGrantLifetimeMillis: 7260000,\n      begin: (record) =>\n        [\"auto\", \"single\"].includes(record.input.strategy ?? \"auto\")\n          ? Effect.succeed(null)\n          : Effect.fail(failUpload(\"Unsupported\")),\n      grant: Effect.fnUntraced(function* (record, expiresAt) {\n        const grant = yield* grants.create({ key: record.stagingKey, upsert: false });\n        // Native Supabase upload tokens have a fixed lifetime. The workflow must retain that full cleanup horizon.\n        if (\n          DateTime.toEpochMillis(grant.expiresAt) > expiresAt ||\n          DateTime.toEpochMillis(grant.expiresAt) <= (yield* Clock.currentTimeMillis)\n        )\n          return yield* failUpload(\"Unsupported\");\n        return {\n          _tag: \"SignedRequest\",\n          constraints: grant.constraints,\n          method: \"PUT\",\n          url: Redacted.value(grant.url),\n          headers: Redacted.value(grant.headers),\n          expiresAt: DateTime.toEpochMillis(grant.expiresAt),\n        };\n      }),\n      abort: () => Effect.void,\n    });\n  }),\n);\n"],"mappings":";;;;;;AAKA,MAAa,4BAA4B,MAAM,OAC7C,mBACA,OAAO,IAAI,aAAa;CACtB,MAAM,SAAS,OAAO;CACtB,OAAO,kBAAkB,GAAG;EAC1B,4BAA4B;EAC5B,QAAQ,WACN,CAAC,QAAQ,QAAQ,CAAC,CAAC,SAAS,OAAO,MAAM,YAAY,MAAM,IACvD,OAAO,QAAQ,IAAI,IACnB,OAAO,KAAK,WAAW,aAAa,CAAC;EAC3C,OAAO,OAAO,WAAW,WAAW,QAAQ,WAAW;GACrD,MAAM,QAAQ,OAAO,OAAO,OAAO;IAAE,KAAK,OAAO;IAAY,QAAQ;GAAM,CAAC;GAE5E,IACE,SAAS,cAAc,MAAM,SAAS,IAAI,aAC1C,SAAS,cAAc,MAAM,SAAS,MAAM,OAAO,MAAM,oBAEzD,OAAO,OAAO,WAAW,aAAa;GACxC,OAAO;IACL,MAAM;IACN,aAAa,MAAM;IACnB,QAAQ;IACR,KAAK,SAAS,MAAM,MAAM,GAAG;IAC7B,SAAS,SAAS,MAAM,MAAM,OAAO;IACrC,WAAW,SAAS,cAAc,MAAM,SAAS;GACnD;EACF,CAAC;EACD,aAAa,OAAO;CACtB,CAAC;AACH,CAAC,CACH"}

package/dist/supabase.d.ts

@@ -0,0 +1,100 @@
+import { ObjectMetadata } from "./core/object.js";
+import { StorageError } from "./core/errors.js";
+import { DeleteRequest, GetRequest, GetResult, HeadRequest, ListPage, ListRequest, PutRequest } from "./core/requests.js";
+import { StorageCapabilities, StoragePublicUrls } from "./core/capabilities.js";
+import { Storage } from "./core/storage.js";
+import { OffsetUploads } from "./core/contracts/resumable.js";
+import "./index.js";
+import { TransferDriver } from "./transfers/dependencies.js";
+import { SupabaseConfig } from "./providers/supabase/config.js";
+import { Context, Effect, Layer } from "effect";
+import { HttpClient } from "effect/http";
+declare const make: (input: SupabaseConfig) => Effect.Effect<{
+  provider: string;
+  storeId: string;
+  capabilities: StorageCapabilities;
+  put: <E = never, R = never>(request: PutRequest<E, R>) => Effect.Effect<ObjectMetadata, StorageError | E, R>;
+  get: (request: GetRequest) => Effect.Effect<GetResult, StorageError, import("effect/Scope").Scope>;
+  head: (request: HeadRequest) => Effect.Effect<ObjectMetadata, StorageError>;
+  delete: (request: DeleteRequest) => Effect.Effect<void, StorageError>;
+  listPage: (request?: ListRequest) => Effect.Effect<ListPage, StorageError>;
+  config: {
+    bucket: string;
+    storeId: string;
+    auth: {
+      readonly mode: "user" | "service";
+      readonly token: import("effect/Redacted").Redacted<string> | Effect.Effect<import("effect/Redacted").Redacted<string>, StorageError>;
+      readonly apiKey?: import("effect/Redacted").Redacted<string>;
+    };
+    resumable?: boolean;
+    url: string;
+    baseUrl: string;
+    maxObjectBytes: number;
+    maxUnknownLengthBytes: number;
+    requestTimeoutMillis: number;
+  };
+  http: HttpClient.HttpClient;
+  offsets?: OffsetUploads;
+}, StorageError, HttpClient.HttpClient>;
+export type SupabaseStorageService = Effect.Success<ReturnType<typeof make>>;
+declare const SupabaseStorage_base: Context.ServiceClass<SupabaseStorage, "@effect-kit/storage/supabase/SupabaseStorage", {
+  provider: string;
+  storeId: string;
+  capabilities: StorageCapabilities;
+  put: <E = never, R = never>(request: PutRequest<E, R>) => Effect.Effect<ObjectMetadata, StorageError | E, R>;
+  get: (request: GetRequest) => Effect.Effect<GetResult, StorageError, import("effect/Scope").Scope>;
+  head: (request: HeadRequest) => Effect.Effect<ObjectMetadata, StorageError>;
+  delete: (request: DeleteRequest) => Effect.Effect<void, StorageError>;
+  listPage: (request?: ListRequest) => Effect.Effect<ListPage, StorageError>;
+  config: {
+    bucket: string;
+    storeId: string;
+    auth: {
+      readonly mode: "user" | "service";
+      readonly token: import("effect/Redacted").Redacted<string> | Effect.Effect<import("effect/Redacted").Redacted<string>, StorageError>;
+      readonly apiKey?: import("effect/Redacted").Redacted<string>;
+    };
+    resumable?: boolean;
+    url: string;
+    baseUrl: string;
+    maxObjectBytes: number;
+    maxUnknownLengthBytes: number;
+    requestTimeoutMillis: number;
+  };
+  http: HttpClient.HttpClient;
+  offsets?: OffsetUploads;
+}>;
+export declare class SupabaseStorage extends SupabaseStorage_base {
+  static readonly make: (input: SupabaseConfig) => Effect.Effect<{
+    provider: string;
+    storeId: string;
+    capabilities: StorageCapabilities;
+    put: <E = never, R = never>(request: PutRequest<E, R>) => Effect.Effect<ObjectMetadata, StorageError | E, R>;
+    get: (request: GetRequest) => Effect.Effect<GetResult, StorageError, import("effect/Scope").Scope>;
+    head: (request: HeadRequest) => Effect.Effect<ObjectMetadata, StorageError>;
+    delete: (request: DeleteRequest) => Effect.Effect<void, StorageError>;
+    listPage: (request?: ListRequest) => Effect.Effect<ListPage, StorageError>;
+    config: {
+      bucket: string;
+      storeId: string;
+      auth: {
+        readonly mode: "user" | "service";
+        readonly token: import("effect/Redacted").Redacted<string> | Effect.Effect<import("effect/Redacted").Redacted<string>, StorageError>;
+        readonly apiKey?: import("effect/Redacted").Redacted<string>;
+      };
+      resumable?: boolean;
+      url: string;
+      baseUrl: string;
+      maxObjectBytes: number;
+      maxUnknownLengthBytes: number;
+      requestTimeoutMillis: number;
+    };
+    http: HttpClient.HttpClient;
+    offsets?: OffsetUploads;
+  }, StorageError, HttpClient.HttpClient>;
+  static layerHttp(config: SupabaseConfig): Layer.Layer<Storage | SupabaseStorage | TransferDriver, StorageError, HttpClient.HttpClient>;
+  static layer(config: SupabaseConfig): Layer.Layer<Storage | SupabaseStorage | TransferDriver, StorageError, never>;
+  static publicUrls(): Layer.Layer<StoragePublicUrls, StorageError, SupabaseStorage>;
+}
+export type { SupabaseConfig };
+//# sourceMappingURL=supabase.d.ts.map

package/dist/supabase.js

@@ -0,0 +1,50 @@
+import { Storage } from "./core/storage.js";
+import { TransferDriver } from "./transfers/dependencies.js";
+import { StoragePublicUrls } from "./core/capabilities.js";
+import { makePublicUrls } from "./internal/public-urls.js";
+import { resolveConfig } from "./providers/supabase/config.js";
+import { nativeHeaders, validateKey } from "./providers/supabase/mapping.js";
+import { primitives } from "./providers/supabase/primitives.js";
+import { negotiateTus, tusUploads } from "./providers/supabase/tus.js";
+import { Context, Effect, Layer } from "effect";
+import { FetchHttpClient, HttpClient } from "effect/http";
+
+// src/providers/supabase/index.ts
+const make = Effect.fnUntraced(function* (input) {
+	const connection = {
+		config: yield* resolveConfig(input),
+		http: yield* HttpClient.HttpClient
+	};
+	const extensions = input.resumable ? yield* negotiateTus(connection) : [];
+	return {
+		...primitives(connection),
+		...connection,
+		...input.resumable ? { offsets: tusUploads(connection, extensions) } : {}
+	};
+});
+var SupabaseStorage = class SupabaseStorage extends Context.Service()("@effect-kit/storage/supabase/SupabaseStorage") {
+	static make = make;
+	static layerHttp(config) {
+		return Layer.effectContext(Effect.map(make(config), (storage) => {
+			const endpoint = {
+				storage,
+				offsets: storage.offsets,
+				maximumObjectBytes: storage.config.maxObjectBytes,
+				maximumSingleUploadBytes: storage.config.maxObjectBytes,
+				transportOverheadBytes: 1024 ** 2,
+				validateUpload: ({ key, headers }) => validateKey(key, "upload").pipe(Effect.andThen(nativeHeaders(headers, "upload")), Effect.asVoid),
+				reconcile: ({ key, operationId, size }) => storage.head({ key }).pipe(Effect.map((found) => found.size === size && found.customMetadata?.["effect-storage-operation"] === operationId ? found : void 0), Effect.catchReason("StorageError", "NotFound", () => Effect.undefined))
+			};
+			return Context.make(Storage, storage).pipe(Context.add(SupabaseStorage, storage), Context.add(TransferDriver, endpoint));
+		}));
+	}
+	static layer(config) {
+		return SupabaseStorage.layerHttp(config).pipe(Layer.provide(FetchHttpClient.layer));
+	}
+	static publicUrls() {
+		return Layer.effect(StoragePublicUrls, Effect.flatMap(SupabaseStorage, (storage) => makePublicUrls(storage, `${storage.config.baseUrl}/object/public/${encodeURIComponent(storage.config.bucket)}/`)));
+	}
+};
+
+export { SupabaseStorage };
+//# sourceMappingURL=supabase.js.map

package/dist/supabase.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"supabase.js","names":[],"sources":["../src/providers/supabase/index.ts"],"sourcesContent":["import { Context, Effect, Layer } from \"effect\";\nimport { FetchHttpClient, HttpClient } from \"effect/http\";\n\nimport { StoragePublicUrls } from \"../../core/capabilities.js\";\nimport { Storage } from \"../../core/storage.js\";\nimport { makePublicUrls } from \"../../internal/public-urls.js\";\nimport { TransferDriver } from \"../../transfers/dependencies.js\";\nimport type { TransferEndpoint } from \"../../transfers/models.js\";\nimport { resolveConfig } from \"./config.js\";\nimport type { SupabaseConfig } from \"./config.js\";\nimport { validateKey, nativeHeaders } from \"./mapping.js\";\nimport { primitives } from \"./primitives.js\";\nimport { negotiateTus, tusUploads } from \"./tus.js\";\n\nexport type { SupabaseConfig } from \"./config.js\";\nconst make = Effect.fnUntraced(function* (input: SupabaseConfig) {\n  const connection = { config: yield* resolveConfig(input), http: yield* HttpClient.HttpClient };\n  const extensions = input.resumable ? yield* negotiateTus(connection) : [];\n  return {\n    ...primitives(connection),\n    ...connection,\n    ...(input.resumable ? { offsets: tusUploads(connection, extensions) } : {}),\n  };\n});\nexport type SupabaseStorageService = Effect.Success<ReturnType<typeof make>>;\nexport class SupabaseStorage extends Context.Service<SupabaseStorage, SupabaseStorageService>()(\n  \"@effect-kit/storage/supabase/SupabaseStorage\",\n) {\n  static readonly make = make;\n  static layerHttp(config: SupabaseConfig) {\n    return Layer.effectContext(\n      Effect.map(make(config), (storage) => {\n        const endpoint: TransferEndpoint = {\n          storage,\n          offsets: storage.offsets,\n          maximumObjectBytes: storage.config.maxObjectBytes,\n          maximumSingleUploadBytes: storage.config.maxObjectBytes,\n          transportOverheadBytes: 1024 ** 2,\n          validateUpload: ({ key, headers }) =>\n            validateKey(key, \"upload\").pipe(\n              Effect.andThen(nativeHeaders(headers, \"upload\")),\n              Effect.asVoid,\n            ),\n          reconcile: ({ key, operationId, size }) =>\n            storage.head({ key }).pipe(\n              Effect.map((found) =>\n                found.size === size &&\n                found.customMetadata?.[\"effect-storage-operation\"] === operationId\n                  ? found\n                  : undefined,\n              ),\n              Effect.catchReason(\"StorageError\", \"NotFound\", () => Effect.undefined),\n            ),\n        };\n        return Context.make(Storage, storage).pipe(\n          Context.add(SupabaseStorage, storage),\n          Context.add(TransferDriver, endpoint),\n        );\n      }),\n    );\n  }\n  static layer(config: SupabaseConfig) {\n    return SupabaseStorage.layerHttp(config).pipe(Layer.provide(FetchHttpClient.layer));\n  }\n  static publicUrls() {\n    return Layer.effect(\n      StoragePublicUrls,\n      Effect.flatMap(SupabaseStorage, (storage) =>\n        makePublicUrls(\n          storage,\n          `${storage.config.baseUrl}/object/public/${encodeURIComponent(storage.config.bucket)}/`,\n        ),\n      ),\n    );\n  }\n}\n"],"mappings":";;;;;;;;;;;;AAeA,MAAM,OAAO,OAAO,WAAW,WAAW,OAAuB;CAC/D,MAAM,aAAa;EAAE,QAAQ,OAAO,cAAc,KAAK;EAAG,MAAM,OAAO,WAAW;CAAW;CAC7F,MAAM,aAAa,MAAM,YAAY,OAAO,aAAa,UAAU,IAAI,CAAC;CACxE,OAAO;EACL,GAAG,WAAW,UAAU;EACxB,GAAG;EACH,GAAI,MAAM,YAAY,EAAE,SAAS,WAAW,YAAY,UAAU,EAAE,IAAI,CAAC;CAC3E;AACF,CAAC;AAED,IAAa,kBAAb,MAAa,wBAAwB,QAAQ,QAAiD,CAAC,CAC7F,8CACF,CAAC,CAAC;CACA,OAAgB,OAAO;CACvB,OAAO,UAAU,QAAwB;EACvC,OAAO,MAAM,cACX,OAAO,IAAI,KAAK,MAAM,IAAI,YAAY;GACpC,MAAM,WAA6B;IACjC;IACA,SAAS,QAAQ;IACjB,oBAAoB,QAAQ,OAAO;IACnC,0BAA0B,QAAQ,OAAO;IACzC,wBAAwB,QAAQ;IAChC,iBAAiB,EAAE,KAAK,cACtB,YAAY,KAAK,QAAQ,CAAC,CAAC,KACzB,OAAO,QAAQ,cAAc,SAAS,QAAQ,CAAC,GAC/C,OAAO,MACT;IACF,YAAY,EAAE,KAAK,aAAa,WAC9B,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,KACpB,OAAO,KAAK,UACV,MAAM,SAAS,QACf,MAAM,iBAAiB,gCAAgC,cACnD,QACA,MACN,GACA,OAAO,YAAY,gBAAgB,kBAAkB,OAAO,SAAS,CACvE;GACJ;GACA,OAAO,QAAQ,KAAK,SAAS,OAAO,CAAC,CAAC,KACpC,QAAQ,IAAI,iBAAiB,OAAO,GACpC,QAAQ,IAAI,gBAAgB,QAAQ,CACtC;EACF,CAAC,CACH;CACF;CACA,OAAO,MAAM,QAAwB;EACnC,OAAO,gBAAgB,UAAU,MAAM,CAAC,CAAC,KAAK,MAAM,QAAQ,gBAAgB,KAAK,CAAC;CACpF;CACA,OAAO,aAAa;EAClB,OAAO,MAAM,OACX,mBACA,OAAO,QAAQ,kBAAkB,YAC/B,eACE,SACA,GAAG,QAAQ,OAAO,QAAQ,iBAAiB,mBAAmB,QAAQ,OAAO,MAAM,EAAE,EACvF,CACF,CACF;CACF;AACF"}

package/dist/testing/body-failure.js

@@ -0,0 +1,18 @@
+import { Effect, Stream } from "effect";
+
+// src/testing/body-failure.ts
+/** Emits at most afterBytes before failing, including when the boundary splits a chunk. */
+function failBody(source, afterBytes, failure) {
+	return Stream.unwrap(Effect.sync(() => {
+		let remaining = afterBytes;
+		return Stream.flatMap(source, (chunk) => {
+			if (remaining <= 0) return Stream.fail(failure);
+			const allowed = Math.min(remaining, chunk.length);
+			remaining -= allowed;
+			return allowed < chunk.length || remaining === 0 ? Stream.concat(Stream.succeed(chunk.slice(0, allowed)), Stream.fail(failure)) : Stream.succeed(chunk);
+		});
+	}));
+}
+
+export { failBody };
+//# sourceMappingURL=body-failure.js.map

package/dist/testing/body-failure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"body-failure.js","names":[],"sources":["../../src/testing/body-failure.ts"],"sourcesContent":["import { Effect, Stream } from \"effect\";\n\nimport type { StorageError } from \"../core/errors.js\";\n\n/** Emits at most afterBytes before failing, including when the boundary splits a chunk. */\nexport function failBody<E, R>(\n  source: Stream.Stream<Uint8Array, E, R>,\n  afterBytes: number,\n  failure: StorageError,\n): Stream.Stream<Uint8Array, E | StorageError, R> {\n  return Stream.unwrap(\n    Effect.sync(() => {\n      let remaining = afterBytes;\n      return Stream.flatMap(source, (chunk) => {\n        if (remaining <= 0) return Stream.fail(failure);\n        const allowed = Math.min(remaining, chunk.length);\n        remaining -= allowed;\n        return allowed < chunk.length || remaining === 0\n          ? Stream.concat(Stream.succeed(chunk.slice(0, allowed)), Stream.fail(failure))\n          : Stream.succeed(chunk);\n      });\n    }),\n  );\n}\n"],"mappings":";;;;AAKA,SAAgB,SACd,QACA,YACA,SACgD;CAChD,OAAO,OAAO,OACZ,OAAO,WAAW;EAChB,IAAI,YAAY;EAChB,OAAO,OAAO,QAAQ,SAAS,UAAU;GACvC,IAAI,aAAa,GAAG,OAAO,OAAO,KAAK,OAAO;GAC9C,MAAM,UAAU,KAAK,IAAI,WAAW,MAAM,MAAM;GAChD,aAAa;GACb,OAAO,UAAU,MAAM,UAAU,cAAc,IAC3C,OAAO,OAAO,OAAO,QAAQ,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,OAAO,KAAK,OAAO,CAAC,IAC3E,OAAO,QAAQ,KAAK;EAC1B,CAAC;CACH,CAAC,CACH;AACF"}

package/dist/testing/conformance/assertions.d.ts

@@ -0,0 +1,10 @@
+import "../../core/errors.js";
+import "../../core/storage.js";
+import { Effect, Schema } from "effect";
+declare const ConformanceFailure_base: Schema.Class<ConformanceFailure, Schema.TaggedStruct<"ConformanceFailure", {
+  readonly testName: Schema.String;
+  readonly detail: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+export declare class ConformanceFailure extends ConformanceFailure_base {}
+export {};
+//# sourceMappingURL=assertions.d.ts.map

package/dist/testing/conformance/assertions.js

@@ -0,0 +1,21 @@
+import { Storage } from "../../core/storage.js";
+import { Effect, Result, Schema } from "effect";
+
+// src/testing/conformance/assertions.ts
+var ConformanceFailure = class extends Schema.TaggedError()("ConformanceFailure", {
+	testName: Schema.String,
+	detail: Schema.String
+}) {};
+const check = (condition, detail) => condition ? Effect.void : Effect.fail(new ConformanceFailure({
+	testName: "assertion",
+	detail
+}));
+const read = (storage, key) => Storage.getBytes({
+	key,
+	maxBytes: 1024
+}).pipe(Effect.provideService(Storage, storage));
+const expectReason = (effect, reason) => Effect.flatMap(Effect.result(effect), (result) => check(Result.isFailure(result) && result.failure.reason._tag === reason, `Expected storage reason ${reason}`));
+const bytesEqual = (actual, expected) => actual.length === expected.length && actual.every((byte, index) => byte === expected[index]);
+
+export { ConformanceFailure, bytesEqual, check, expectReason, read };
+//# sourceMappingURL=assertions.js.map

package/dist/testing/conformance/assertions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assertions.js","names":[],"sources":["../../../src/testing/conformance/assertions.ts"],"sourcesContent":["import { Effect, Result, Schema } from \"effect\";\n\nimport type { StorageError, StorageReason } from \"../../core/errors.js\";\nimport { Storage } from \"../../core/storage.js\";\nimport type { StorageService } from \"../../core/storage.js\";\n\nexport class ConformanceFailure extends Schema.TaggedError<ConformanceFailure>()(\n  \"ConformanceFailure\",\n  {\n    testName: Schema.String,\n    detail: Schema.String,\n  },\n) {}\n\nexport const check = (condition: boolean, detail: string) =>\n  condition ? Effect.void : Effect.fail(new ConformanceFailure({ testName: \"assertion\", detail }));\n\nexport const read = (storage: StorageService, key: string) =>\n  Storage.getBytes({ key, maxBytes: 1024 }).pipe(Effect.provideService(Storage, storage));\n\nexport const expectReason = <A, R>(\n  effect: Effect.Effect<A, StorageError, R>,\n  reason: StorageReason[\"_tag\"],\n) =>\n  Effect.flatMap(Effect.result(effect), (result) =>\n    check(\n      Result.isFailure(result) && result.failure.reason._tag === reason,\n      `Expected storage reason ${reason}`,\n    ),\n  );\n\nexport const bytesEqual = (actual: Uint8Array, expected: Uint8Array) =>\n  actual.length === expected.length && actual.every((byte, index) => byte === expected[index]);\n"],"mappings":";;;;AAMA,IAAa,qBAAb,cAAwC,OAAO,YAAgC,CAAC,CAC9E,sBACA;CACE,UAAU,OAAO;CACjB,QAAQ,OAAO;AACjB,CACF,CAAC,CAAC,CAAC;AAEH,MAAa,SAAS,WAAoB,WACxC,YAAY,OAAO,OAAO,OAAO,KAAK,IAAI,mBAAmB;CAAE,UAAU;CAAa;AAAO,CAAC,CAAC;AAEjG,MAAa,QAAQ,SAAyB,QAC5C,QAAQ,SAAS;CAAE;CAAK,UAAU;AAAK,CAAC,CAAC,CAAC,KAAK,OAAO,eAAe,SAAS,OAAO,CAAC;AAExF,MAAa,gBACX,QACA,WAEA,OAAO,QAAQ,OAAO,OAAO,MAAM,IAAI,WACrC,MACE,OAAO,UAAU,MAAM,KAAK,OAAO,QAAQ,OAAO,SAAS,QAC3D,2BAA2B,QAC7B,CACF;AAEF,MAAa,cAAc,QAAoB,aAC7C,OAAO,WAAW,SAAS,UAAU,OAAO,OAAO,MAAM,UAAU,SAAS,SAAS,MAAM"}