@hot-updater/supabase 0.31.4 → 0.32.0

package/dist/edge.cjs

@@ -1,4 +1,4 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_supabaseEdgeFunctionStorage = require("./supabaseEdgeFunctionStorage-BZC0Z0XP.cjs");
+const require_supabaseEdgeFunctionStorage = require("./supabaseEdgeFunctionStorage-D933mGy9.cjs");
 exports.supabaseEdgeFunctionDatabase = require_supabaseEdgeFunctionStorage.supabaseEdgeFunctionDatabase;
 exports.supabaseEdgeFunctionStorage = require_supabaseEdgeFunctionStorage.supabaseEdgeFunctionStorage;

package/dist/edge.d.cts

@@ -1,2 +1,2 @@
-import { i as supabaseEdgeFunctionDatabase, n as supabaseEdgeFunctionStorage } from "./supabaseEdgeFunctionStorage-hkokSgXP.cjs";
+import { i as supabaseEdgeFunctionDatabase, n as supabaseEdgeFunctionStorage } from "./supabaseEdgeFunctionStorage-CU396KO3.cjs";
 export { supabaseEdgeFunctionDatabase, supabaseEdgeFunctionStorage };

package/dist/edge.d.mts

@@ -1,2 +1,2 @@
-import { i as supabaseEdgeFunctionDatabase, n as supabaseEdgeFunctionStorage } from "./supabaseEdgeFunctionStorage-CXmcRBZ2.mjs";
+import { i as supabaseEdgeFunctionDatabase, n as supabaseEdgeFunctionStorage } from "./supabaseEdgeFunctionStorage-BRxGvt-r.mjs";
 export { supabaseEdgeFunctionDatabase, supabaseEdgeFunctionStorage };

package/dist/edge.mjs

@@ -1,2 +1,2 @@
-import { n as supabaseEdgeFunctionDatabase, t as supabaseEdgeFunctionStorage } from "./supabaseEdgeFunctionStorage-BKU_mLzA.mjs";
+import { n as supabaseEdgeFunctionDatabase, t as supabaseEdgeFunctionStorage } from "./supabaseEdgeFunctionStorage-B4KN0khj.mjs";
 export { supabaseEdgeFunctionDatabase, supabaseEdgeFunctionStorage };

package/dist/iac/index.cjs

@@ -6,7 +6,7 @@ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
+var __commonJSMin = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
 var __copyProps = (to, from, except, desc) => {
 	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
 		key = keys[i];
@@ -23,21 +23,21 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 }) : target, mod));
 //#endregion
 let fs_promises = require("fs/promises");
-fs_promises = __toESM(fs_promises, 1);
+fs_promises = __toESM(fs_promises);
 let node_module = require("node:module");
 let path = require("path");
-path = __toESM(path, 1);
+path = __toESM(path);
 let _hot_updater_cli_tools = require("@hot-updater/cli-tools");
 let node_url = require("node:url");
 let node_child_process = require("node:child_process");
 let node_string_decoder = require("node:string_decoder");
 let node_util = require("node:util");
 let node_process = require("node:process");
-node_process = __toESM(node_process, 1);
+node_process = __toESM(node_process);
 let node_tty = require("node:tty");
-node_tty = __toESM(node_tty, 1);
+node_tty = __toESM(node_tty);
 let node_path = require("node:path");
-node_path = __toESM(node_path, 1);
+node_path = __toESM(node_path);
 let node_timers_promises = require("node:timers/promises");
 let node_os = require("node:os");
 let node_events = require("node:events");
@@ -6233,8 +6233,8 @@ createExeca(mapScriptAsync, {}, deepScriptOptions, setScriptSync);
 const { sendMessage, getOneMessage, getEachMessage, getCancelSignal } = getIpcExport();
 //#endregion
 //#region iac/supabaseApi.ts
-const supabaseApi = (supabaseUrl, supabaseAnonKey) => {
-	const supabase = (0, _supabase_supabase_js.createClient)(supabaseUrl, supabaseAnonKey);
+const supabaseApi = (supabaseUrl, supabaseServiceRoleKey) => {
+	const supabase = (0, _supabase_supabase_js.createClient)(supabaseUrl, supabaseServiceRoleKey);
 	return {
 		listBuckets: async () => {
 			const { data, error } = await supabase.storage.listBuckets();
@@ -6268,7 +6268,7 @@ const getConfigScaffold = (build) => {
 		}],
 		configString: `supabaseStorage({
     supabaseUrl: process.env.HOT_UPDATER_SUPABASE_URL!,
-    supabaseAnonKey: process.env.HOT_UPDATER_SUPABASE_ANON_KEY!,
+    supabaseServiceRoleKey: process.env.HOT_UPDATER_SUPABASE_SERVICE_ROLE_KEY!,
     bucketName: process.env.HOT_UPDATER_SUPABASE_BUCKET_NAME!,
   })`
 	}).setDatabase({
@@ -6278,10 +6278,27 @@ const getConfigScaffold = (build) => {
 		}],
 		configString: `supabaseDatabase({
     supabaseUrl: process.env.HOT_UPDATER_SUPABASE_URL!,
-    supabaseAnonKey: process.env.HOT_UPDATER_SUPABASE_ANON_KEY!,
+    supabaseServiceRoleKey: process.env.HOT_UPDATER_SUPABASE_SERVICE_ROLE_KEY!,
   })`
 	}));
 };
+const getLegacySupabaseConfigReference = (configText) => {
+	if (configText.includes("HOT_UPDATER_SUPABASE_ANON_KEY")) return "HOT_UPDATER_SUPABASE_ANON_KEY";
+	if (/\bsupabaseAnonKey\s*:/.test(configText)) return "supabaseAnonKey";
+	return null;
+};
+const assertSkippedConfigDoesNotUseLegacySupabaseKey = async (configWriteResult) => {
+	if (configWriteResult.status !== "skipped") return;
+	const configText = await fs_promises.default.readFile(configWriteResult.path, "utf-8").catch((error) => {
+		if (error.code === "ENOENT") return null;
+		throw error;
+	});
+	const legacyReference = configText === null ? null : getLegacySupabaseConfigReference(configText);
+	if (!legacyReference) return;
+	_hot_updater_cli_tools.p.log.error(`Existing '${configWriteResult.path}' still references '${legacyReference}'.`);
+	_hot_updater_cli_tools.p.log.message("Update it to use 'supabaseServiceRoleKey' with 'HOT_UPDATER_SUPABASE_SERVICE_ROLE_KEY', then run init again.");
+	process.exit(1);
+};
 const SOURCE_TEMPLATE = `// add this to your App.tsx
 import { HotUpdater } from "@hot-updater/react-native";
 
@@ -6642,9 +6659,9 @@ const runInit = async ({ build }) => {
 		process.exit(1);
 	}
 	spinner.stop();
-	const serviceRoleKey = apiKeys.find((key) => key.name === "service_role");
-	if (!serviceRoleKey) throw new Error("Service role key not found, is your project paused?");
-	const bucket = await selectBucket(supabaseApi(`https://${project.id}.supabase.co`, serviceRoleKey.api_key));
+	const serviceRoleApiKey = apiKeys.find((key) => key.name === "service_role");
+	if (!serviceRoleApiKey) throw new Error("Service role key not found, is your project paused?");
+	const bucket = await selectBucket(supabaseApi(`https://${project.id}.supabase.co`, serviceRoleApiKey.api_key));
 	const { tmpDir, removeTmpDir } = await (0, _hot_updater_cli_tools.copyDirToTmp)(path.default.dirname(path.default.resolve(require$1.resolve("@hot-updater/supabase/scaffold"))), "supabase");
 	const migrationPath = await path.default.join(tmpDir, "supabase", "migrations");
 	const migrationFiles = await fs_promises.default.readdir(migrationPath);
@@ -6663,8 +6680,9 @@ const runInit = async ({ build }) => {
 	await deployEdgeFunction(tmpDir, project.id);
 	await removeTmpDir();
 	const configWriteResult = await (0, _hot_updater_cli_tools.writeHotUpdaterConfig)(getConfigScaffold(build));
+	await assertSkippedConfigDoesNotUseLegacySupabaseKey(configWriteResult);
 	await (0, _hot_updater_cli_tools.makeEnv)({
-		HOT_UPDATER_SUPABASE_ANON_KEY: serviceRoleKey.api_key,
+		HOT_UPDATER_SUPABASE_SERVICE_ROLE_KEY: serviceRoleApiKey.api_key,
 		HOT_UPDATER_SUPABASE_BUCKET_NAME: bucket.name,
 		HOT_UPDATER_SUPABASE_URL: `https://${project.id}.supabase.co`
 	});
@@ -6677,6 +6695,7 @@ const runInit = async ({ build }) => {
 	_hot_updater_cli_tools.p.log.success("Done! 🎉");
 };
 //#endregion
+exports.getLegacySupabaseConfigReference = getLegacySupabaseConfigReference;
 exports.resolveEdgeFunctionDenoConfig = resolveEdgeFunctionDenoConfig;
 exports.runInit = runInit;
 exports.selectBucket = selectBucket;

package/dist/iac/index.d.cts

@@ -16,6 +16,7 @@ interface SupabaseApi {
 }
 //#endregion
 //#region iac/index.d.ts
+declare const getLegacySupabaseConfigReference: (configText: string) => "HOT_UPDATER_SUPABASE_ANON_KEY" | "supabaseAnonKey" | null;
 declare const resolveEdgeFunctionDenoConfig: (targetDir: string) => Promise<{
   imports: Record<string, string>;
 }>;
@@ -34,4 +35,4 @@ declare const runInit: ({
   build: BuildType;
 }) => Promise<void>;
 //#endregion
-export { resolveEdgeFunctionDenoConfig, runInit, selectBucket, selectProject };
+export { getLegacySupabaseConfigReference, resolveEdgeFunctionDenoConfig, runInit, selectBucket, selectProject };

package/dist/iac/index.d.mts

@@ -16,6 +16,7 @@ interface SupabaseApi {
 }
 //#endregion
 //#region iac/index.d.ts
+declare const getLegacySupabaseConfigReference: (configText: string) => "HOT_UPDATER_SUPABASE_ANON_KEY" | "supabaseAnonKey" | null;
 declare const resolveEdgeFunctionDenoConfig: (targetDir: string) => Promise<{
   imports: Record<string, string>;
 }>;
@@ -34,4 +35,4 @@ declare const runInit: ({
   build: BuildType;
 }) => Promise<void>;
 //#endregion
-export { resolveEdgeFunctionDenoConfig, runInit, selectBucket, selectProject };
+export { getLegacySupabaseConfigReference, resolveEdgeFunctionDenoConfig, runInit, selectBucket, selectProject };

package/dist/iac/index.mjs

@@ -25,7 +25,7 @@ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
+var __commonJSMin = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
 var __copyProps = (to, from, except, desc) => {
 	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
 		key = keys[i];
@@ -6228,8 +6228,8 @@ createExeca(mapScriptAsync, {}, deepScriptOptions, setScriptSync);
 const { sendMessage, getOneMessage, getEachMessage, getCancelSignal } = getIpcExport();
 //#endregion
 //#region iac/supabaseApi.ts
-const supabaseApi = (supabaseUrl, supabaseAnonKey) => {
-	const supabase = createClient(supabaseUrl, supabaseAnonKey);
+const supabaseApi = (supabaseUrl, supabaseServiceRoleKey) => {
+	const supabase = createClient(supabaseUrl, supabaseServiceRoleKey);
 	return {
 		listBuckets: async () => {
 			const { data, error } = await supabase.storage.listBuckets();
@@ -6263,7 +6263,7 @@ const getConfigScaffold = (build) => {
 		}],
 		configString: `supabaseStorage({
     supabaseUrl: process.env.HOT_UPDATER_SUPABASE_URL!,
-    supabaseAnonKey: process.env.HOT_UPDATER_SUPABASE_ANON_KEY!,
+    supabaseServiceRoleKey: process.env.HOT_UPDATER_SUPABASE_SERVICE_ROLE_KEY!,
     bucketName: process.env.HOT_UPDATER_SUPABASE_BUCKET_NAME!,
   })`
 	}).setDatabase({
@@ -6273,10 +6273,27 @@ const getConfigScaffold = (build) => {
 		}],
 		configString: `supabaseDatabase({
     supabaseUrl: process.env.HOT_UPDATER_SUPABASE_URL!,
-    supabaseAnonKey: process.env.HOT_UPDATER_SUPABASE_ANON_KEY!,
+    supabaseServiceRoleKey: process.env.HOT_UPDATER_SUPABASE_SERVICE_ROLE_KEY!,
   })`
 	}));
 };
+const getLegacySupabaseConfigReference = (configText) => {
+	if (configText.includes("HOT_UPDATER_SUPABASE_ANON_KEY")) return "HOT_UPDATER_SUPABASE_ANON_KEY";
+	if (/\bsupabaseAnonKey\s*:/.test(configText)) return "supabaseAnonKey";
+	return null;
+};
+const assertSkippedConfigDoesNotUseLegacySupabaseKey = async (configWriteResult) => {
+	if (configWriteResult.status !== "skipped") return;
+	const configText = await fs.readFile(configWriteResult.path, "utf-8").catch((error) => {
+		if (error.code === "ENOENT") return null;
+		throw error;
+	});
+	const legacyReference = configText === null ? null : getLegacySupabaseConfigReference(configText);
+	if (!legacyReference) return;
+	p.log.error(`Existing '${configWriteResult.path}' still references '${legacyReference}'.`);
+	p.log.message("Update it to use 'supabaseServiceRoleKey' with 'HOT_UPDATER_SUPABASE_SERVICE_ROLE_KEY', then run init again.");
+	process.exit(1);
+};
 const SOURCE_TEMPLATE = `// add this to your App.tsx
 import { HotUpdater } from "@hot-updater/react-native";
 
@@ -6637,9 +6654,9 @@ const runInit = async ({ build }) => {
 		process.exit(1);
 	}
 	spinner.stop();
-	const serviceRoleKey = apiKeys.find((key) => key.name === "service_role");
-	if (!serviceRoleKey) throw new Error("Service role key not found, is your project paused?");
-	const bucket = await selectBucket(supabaseApi(`https://${project.id}.supabase.co`, serviceRoleKey.api_key));
+	const serviceRoleApiKey = apiKeys.find((key) => key.name === "service_role");
+	if (!serviceRoleApiKey) throw new Error("Service role key not found, is your project paused?");
+	const bucket = await selectBucket(supabaseApi(`https://${project.id}.supabase.co`, serviceRoleApiKey.api_key));
 	const { tmpDir, removeTmpDir } = await copyDirToTmp(path.dirname(path.resolve(require$1.resolve("@hot-updater/supabase/scaffold"))), "supabase");
 	const migrationPath = await path.join(tmpDir, "supabase", "migrations");
 	const migrationFiles = await fs.readdir(migrationPath);
@@ -6658,8 +6675,9 @@ const runInit = async ({ build }) => {
 	await deployEdgeFunction(tmpDir, project.id);
 	await removeTmpDir();
 	const configWriteResult = await writeHotUpdaterConfig(getConfigScaffold(build));
+	await assertSkippedConfigDoesNotUseLegacySupabaseKey(configWriteResult);
 	await makeEnv({
-		HOT_UPDATER_SUPABASE_ANON_KEY: serviceRoleKey.api_key,
+		HOT_UPDATER_SUPABASE_SERVICE_ROLE_KEY: serviceRoleApiKey.api_key,
 		HOT_UPDATER_SUPABASE_BUCKET_NAME: bucket.name,
 		HOT_UPDATER_SUPABASE_URL: `https://${project.id}.supabase.co`
 	});
@@ -6672,4 +6690,4 @@ const runInit = async ({ build }) => {
 	p.log.success("Done! 🎉");
 };
 //#endregion
-export { resolveEdgeFunctionDenoConfig, runInit, selectBucket, selectProject };
+export { getLegacySupabaseConfigReference, resolveEdgeFunctionDenoConfig, runInit, selectBucket, selectProject };

package/dist/index.cjs

@@ -21,19 +21,44 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 	enumerable: true
 }) : target, mod));
 //#endregion
-const require_supabaseEdgeFunctionStorage = require("./supabaseEdgeFunctionStorage-BZC0Z0XP.cjs");
+const require_supabaseEdgeFunctionStorage = require("./supabaseEdgeFunctionStorage-D933mGy9.cjs");
 let _hot_updater_plugin_core = require("@hot-updater/plugin-core");
 let _supabase_supabase_js = require("@supabase/supabase-js");
 let fs_promises = require("fs/promises");
-fs_promises = __toESM(fs_promises, 1);
+fs_promises = __toESM(fs_promises);
 let path = require("path");
-path = __toESM(path, 1);
+path = __toESM(path);
 //#region src/supabaseStorage.ts
+function getErrorMessage(error) {
+	if (error instanceof Error) return error.message;
+	if (error && typeof error === "object" && "message" in error && typeof error.message === "string") return error.message;
+	return String(error);
+}
+async function createSignedUrlOrThrow({ bucket, key, expiresIn }) {
+	let data = null;
+	let error = null;
+	try {
+		const response = await bucket.createSignedUrl(key, expiresIn);
+		data = response.data;
+		error = response.error;
+	} catch (thrownError) {
+		error = thrownError;
+	}
+	if (!error && data?.signedUrl) return data.signedUrl;
+	throw new Error(`Failed to generate download URL for "${key}": ${getErrorMessage(error ?? /* @__PURE__ */ new Error("missing signed URL"))}`);
+}
+async function verifyObjectCanBeSignedForRuntime({ bucket, key }) {
+	await createSignedUrlOrThrow({
+		bucket,
+		key,
+		expiresIn: 3600
+	});
+}
 const supabaseStorage = (0, _hot_updater_plugin_core.createUniversalStoragePlugin)({
 	name: "supabaseStorage",
 	supportedProtocol: "supabase-storage",
 	factory: (config) => {
-		const bucket = (0, _supabase_supabase_js.createClient)(config.supabaseUrl, config.supabaseAnonKey).storage.from(config.bucketName);
+		const bucket = (0, _supabase_supabase_js.createClient)(config.supabaseUrl, require_supabaseEdgeFunctionStorage.resolveSupabaseServiceRoleKey(config)).storage.from(config.bucketName);
 		const getStorageKey = (0, _hot_updater_plugin_core.createStorageKeyBuilder)(config.basePath);
 		return {
 			node: {
@@ -56,8 +81,24 @@ const supabaseStorage = (0, _hot_updater_plugin_core.createUniversalStoragePlugi
 						headers: {}
 					});
 					if (upload.error) throw upload.error;
+					await verifyObjectCanBeSignedForRuntime({
+						bucket,
+						key: Key
+					});
 					return { storageUri: `supabase-storage://${upload.data.fullPath}` };
 				},
+				async exists(storageUri) {
+					const { key, bucket: bucketName } = (0, _hot_updater_plugin_core.parseStorageUri)(storageUri, "supabase-storage");
+					if (bucketName !== config.bucketName) throw new Error(`Bucket name mismatch: expected "${config.bucketName}", but found "${bucketName}".`);
+					const { data, error } = await bucket.exists(key);
+					if (data === false) return false;
+					if (error) throw error;
+					await verifyObjectCanBeSignedForRuntime({
+						bucket,
+						key
+					});
+					return data;
+				},
 				async downloadFile(storageUri, filePath) {
 					const { key, bucket: bucketName } = (0, _hot_updater_plugin_core.parseStorageUri)(storageUri, "supabase-storage");
 					if (bucketName !== config.bucketName) throw new Error(`Bucket name mismatch: expected "${config.bucketName}", but found "${bucketName}".`);
@@ -86,10 +127,11 @@ const supabaseStorage = (0, _hot_updater_plugin_core.createUniversalStoragePlugi
 					let key = `${u.host}${u.pathname}`.replace(/^\//, "");
 					if (!key) throw new Error("Invalid Supabase storage URI: missing key");
 					if (key.startsWith(`${config.bucketName}/`)) key = key.substring(`${config.bucketName}/`.length);
-					const { data, error } = await bucket.createSignedUrl(key, 3600);
-					if (error) throw new Error(`Failed to generate download URL: ${error.message}`);
-					if (!data?.signedUrl) throw new Error("Failed to generate download URL");
-					return { fileUrl: data.signedUrl };
+					return { fileUrl: await createSignedUrlOrThrow({
+						bucket,
+						key,
+						expiresIn: 3600
+					}) };
 				}
 			}
 		};

package/dist/index.d.cts

@@ -1,22 +1,29 @@
-import { i as supabaseEdgeFunctionDatabase, n as supabaseEdgeFunctionStorage, r as SupabaseEdgeFunctionDatabaseConfig, t as SupabaseEdgeFunctionStorageConfig } from "./supabaseEdgeFunctionStorage-hkokSgXP.cjs";
+import { i as supabaseEdgeFunctionDatabase, n as supabaseEdgeFunctionStorage, r as SupabaseEdgeFunctionDatabaseConfig, t as SupabaseEdgeFunctionStorageConfig } from "./supabaseEdgeFunctionStorage-CU396KO3.cjs";
+import * as _$_hot_updater_plugin_core0 from "@hot-updater/plugin-core";
 
-//#region src/supabaseDatabase.d.ts
-interface SupabaseDatabaseConfig {
+//#region src/supabaseConfig.d.ts
+type SupabaseServiceRoleConfig = {
+  supabaseUrl: string;
+  supabaseServiceRoleKey: string;
+  supabaseAnonKey?: string;
+} | {
   supabaseUrl: string;
   supabaseAnonKey: string;
-}
-declare const supabaseDatabase: (config: SupabaseDatabaseConfig, hooks?: import("@hot-updater/plugin-core").DatabasePluginHooks) => () => import("@hot-updater/plugin-core").DatabasePlugin<unknown>;
+  supabaseServiceRoleKey?: string;
+};
+//#endregion
+//#region src/supabaseDatabase.d.ts
+type SupabaseDatabaseConfig = SupabaseServiceRoleConfig;
+declare const supabaseDatabase: (config: SupabaseServiceRoleConfig, hooks?: _$_hot_updater_plugin_core0.DatabasePluginHooks) => () => _$_hot_updater_plugin_core0.DatabasePlugin<unknown>;
 //#endregion
 //#region src/supabaseStorage.d.ts
-interface SupabaseStorageConfig {
-  supabaseUrl: string;
-  supabaseAnonKey: string;
+type SupabaseStorageConfig = SupabaseServiceRoleConfig & {
   bucketName: string;
   /**
    * Base path where bundles will be stored in the bucket
    */
   basePath?: string;
-}
-declare const supabaseStorage: (config: SupabaseStorageConfig, hooks?: import("@hot-updater/plugin-core").StoragePluginHooks) => () => import("@hot-updater/plugin-core").UniversalStoragePlugin<unknown>;
+};
+declare const supabaseStorage: (config: SupabaseStorageConfig, hooks?: _$_hot_updater_plugin_core0.StoragePluginHooks) => () => _$_hot_updater_plugin_core0.UniversalStoragePlugin<unknown>;
 //#endregion
 export { SupabaseDatabaseConfig, SupabaseEdgeFunctionDatabaseConfig, SupabaseEdgeFunctionStorageConfig, SupabaseStorageConfig, supabaseDatabase, supabaseEdgeFunctionDatabase, supabaseEdgeFunctionStorage, supabaseStorage };

package/dist/index.d.mts

@@ -1,22 +1,29 @@
-import { i as supabaseEdgeFunctionDatabase, n as supabaseEdgeFunctionStorage, r as SupabaseEdgeFunctionDatabaseConfig, t as SupabaseEdgeFunctionStorageConfig } from "./supabaseEdgeFunctionStorage-CXmcRBZ2.mjs";
+import { i as supabaseEdgeFunctionDatabase, n as supabaseEdgeFunctionStorage, r as SupabaseEdgeFunctionDatabaseConfig, t as SupabaseEdgeFunctionStorageConfig } from "./supabaseEdgeFunctionStorage-BRxGvt-r.mjs";
+import * as _$_hot_updater_plugin_core0 from "@hot-updater/plugin-core";
 
-//#region src/supabaseDatabase.d.ts
-interface SupabaseDatabaseConfig {
+//#region src/supabaseConfig.d.ts
+type SupabaseServiceRoleConfig = {
+  supabaseUrl: string;
+  supabaseServiceRoleKey: string;
+  supabaseAnonKey?: string;
+} | {
   supabaseUrl: string;
   supabaseAnonKey: string;
-}
-declare const supabaseDatabase: (config: SupabaseDatabaseConfig, hooks?: import("@hot-updater/plugin-core").DatabasePluginHooks) => () => import("@hot-updater/plugin-core").DatabasePlugin<unknown>;
+  supabaseServiceRoleKey?: string;
+};
+//#endregion
+//#region src/supabaseDatabase.d.ts
+type SupabaseDatabaseConfig = SupabaseServiceRoleConfig;
+declare const supabaseDatabase: (config: SupabaseServiceRoleConfig, hooks?: _$_hot_updater_plugin_core0.DatabasePluginHooks) => () => _$_hot_updater_plugin_core0.DatabasePlugin<unknown>;
 //#endregion
 //#region src/supabaseStorage.d.ts
-interface SupabaseStorageConfig {
-  supabaseUrl: string;
-  supabaseAnonKey: string;
+type SupabaseStorageConfig = SupabaseServiceRoleConfig & {
   bucketName: string;
   /**
    * Base path where bundles will be stored in the bucket
    */
   basePath?: string;
-}
-declare const supabaseStorage: (config: SupabaseStorageConfig, hooks?: import("@hot-updater/plugin-core").StoragePluginHooks) => () => import("@hot-updater/plugin-core").UniversalStoragePlugin<unknown>;
+};
+declare const supabaseStorage: (config: SupabaseStorageConfig, hooks?: _$_hot_updater_plugin_core0.StoragePluginHooks) => () => _$_hot_updater_plugin_core0.UniversalStoragePlugin<unknown>;
 //#endregion
 export { SupabaseDatabaseConfig, SupabaseEdgeFunctionDatabaseConfig, SupabaseEdgeFunctionStorageConfig, SupabaseStorageConfig, supabaseDatabase, supabaseEdgeFunctionDatabase, supabaseEdgeFunctionStorage, supabaseStorage };

package/dist/index.mjs

@@ -1,14 +1,39 @@
-import { n as supabaseEdgeFunctionDatabase, r as supabaseDatabase, t as supabaseEdgeFunctionStorage } from "./supabaseEdgeFunctionStorage-BKU_mLzA.mjs";
+import { i as resolveSupabaseServiceRoleKey, n as supabaseEdgeFunctionDatabase, r as supabaseDatabase, t as supabaseEdgeFunctionStorage } from "./supabaseEdgeFunctionStorage-B4KN0khj.mjs";
 import { createStorageKeyBuilder, createUniversalStoragePlugin, getContentType, parseStorageUri } from "@hot-updater/plugin-core";
 import { createClient } from "@supabase/supabase-js";
 import fs from "fs/promises";
 import path from "path";
 //#region src/supabaseStorage.ts
+function getErrorMessage(error) {
+	if (error instanceof Error) return error.message;
+	if (error && typeof error === "object" && "message" in error && typeof error.message === "string") return error.message;
+	return String(error);
+}
+async function createSignedUrlOrThrow({ bucket, key, expiresIn }) {
+	let data = null;
+	let error = null;
+	try {
+		const response = await bucket.createSignedUrl(key, expiresIn);
+		data = response.data;
+		error = response.error;
+	} catch (thrownError) {
+		error = thrownError;
+	}
+	if (!error && data?.signedUrl) return data.signedUrl;
+	throw new Error(`Failed to generate download URL for "${key}": ${getErrorMessage(error ?? /* @__PURE__ */ new Error("missing signed URL"))}`);
+}
+async function verifyObjectCanBeSignedForRuntime({ bucket, key }) {
+	await createSignedUrlOrThrow({
+		bucket,
+		key,
+		expiresIn: 3600
+	});
+}
 const supabaseStorage = createUniversalStoragePlugin({
 	name: "supabaseStorage",
 	supportedProtocol: "supabase-storage",
 	factory: (config) => {
-		const bucket = createClient(config.supabaseUrl, config.supabaseAnonKey).storage.from(config.bucketName);
+		const bucket = createClient(config.supabaseUrl, resolveSupabaseServiceRoleKey(config)).storage.from(config.bucketName);
 		const getStorageKey = createStorageKeyBuilder(config.basePath);
 		return {
 			node: {
@@ -31,8 +56,24 @@ const supabaseStorage = createUniversalStoragePlugin({
 						headers: {}
 					});
 					if (upload.error) throw upload.error;
+					await verifyObjectCanBeSignedForRuntime({
+						bucket,
+						key: Key
+					});
 					return { storageUri: `supabase-storage://${upload.data.fullPath}` };
 				},
+				async exists(storageUri) {
+					const { key, bucket: bucketName } = parseStorageUri(storageUri, "supabase-storage");
+					if (bucketName !== config.bucketName) throw new Error(`Bucket name mismatch: expected "${config.bucketName}", but found "${bucketName}".`);
+					const { data, error } = await bucket.exists(key);
+					if (data === false) return false;
+					if (error) throw error;
+					await verifyObjectCanBeSignedForRuntime({
+						bucket,
+						key
+					});
+					return data;
+				},
 				async downloadFile(storageUri, filePath) {
 					const { key, bucket: bucketName } = parseStorageUri(storageUri, "supabase-storage");
 					if (bucketName !== config.bucketName) throw new Error(`Bucket name mismatch: expected "${config.bucketName}", but found "${bucketName}".`);
@@ -61,10 +102,11 @@ const supabaseStorage = createUniversalStoragePlugin({
 					let key = `${u.host}${u.pathname}`.replace(/^\//, "");
 					if (!key) throw new Error("Invalid Supabase storage URI: missing key");
 					if (key.startsWith(`${config.bucketName}/`)) key = key.substring(`${config.bucketName}/`.length);
-					const { data, error } = await bucket.createSignedUrl(key, 3600);
-					if (error) throw new Error(`Failed to generate download URL: ${error.message}`);
-					if (!data?.signedUrl) throw new Error("Failed to generate download URL");
-					return { fileUrl: data.signedUrl };
+					return { fileUrl: await createSignedUrlOrThrow({
+						bucket,
+						key,
+						expiresIn: 3600
+					}) };
 				}
 			}
 		};

package/dist/{supabaseEdgeFunctionStorage-BKU_mLzA.mjs → supabaseEdgeFunctionStorage-B4KN0khj.mjs}

@@ -1,6 +1,13 @@
 import { DEFAULT_ROLLOUT_COHORT_COUNT, getAssetBaseStorageUri, getBundlePatches, getManifestFileHash, getManifestStorageUri, stripBundleArtifactMetadata } from "@hot-updater/core";
 import { calculatePagination, createDatabasePlugin, createDatabasePluginGetUpdateInfo, createRuntimeStoragePlugin } from "@hot-updater/plugin-core";
 import { createClient } from "@supabase/supabase-js";
+//#region src/supabaseConfig.ts
+const resolveSupabaseServiceRoleKey = (config) => {
+	const key = config.supabaseServiceRoleKey ?? config.supabaseAnonKey;
+	if (!key) throw new Error("Supabase service role key is required. Set supabaseServiceRoleKey.");
+	return key;
+};
+//#endregion
 //#region src/supabaseDatabase.ts
 const normalizeMetadata = (value) => {
 	if (!value) return {};
@@ -99,7 +106,7 @@ const bundleToPatchRows = (bundle) => getBundlePatches(bundle).map((patch, index
 const supabaseDatabase = createDatabasePlugin({
 	name: "supabaseDatabase",
 	factory: (config) => {
-		const supabase = createClient(config.supabaseUrl, config.supabaseAnonKey);
+		const supabase = createClient(config.supabaseUrl, resolveSupabaseServiceRoleKey(config));
 		const fetchPatchMap = async (bundleIds) => {
 			const patchMap = /* @__PURE__ */ new Map();
 			if (bundleIds.length === 0) return patchMap;
@@ -228,11 +235,16 @@ const supabaseDatabase = createDatabasePlugin({
 const supabaseEdgeFunctionDatabase = (config, hooks) => {
 	return supabaseDatabase({
 		supabaseUrl: config.supabaseUrl,
-		supabaseAnonKey: config.supabaseServiceRoleKey
+		supabaseServiceRoleKey: config.supabaseServiceRoleKey
 	}, hooks);
 };
 //#endregion
 //#region src/supabaseEdgeFunctionStorage.ts
+function getErrorMessage(error) {
+	if (error instanceof Error) return error.message;
+	if (error && typeof error === "object" && "message" in error && typeof error.message === "string") return error.message;
+	return String(error);
+}
 const parseSupabaseStorageUri = (storageUri) => {
 	const storageUrl = new URL(storageUri);
 	if (storageUrl.protocol !== "supabase-storage:") throw new Error("Invalid Supabase storage URI protocol");
@@ -262,13 +274,22 @@ const supabaseEdgeFunctionStorage = createRuntimeStoragePlugin({
 			},
 			async getDownloadUrl(storageUri) {
 				const { bucketName, key } = parseSupabaseStorageUri(storageUri);
-				const { data, error } = await supabase.storage.from(bucketName).createSignedUrl(key, config.signedUrlExpiresIn ?? 3600);
-				if (error) throw new Error(`Failed to generate download URL: ${error.message}`);
-				if (!data?.signedUrl) throw new Error("Failed to generate download URL");
-				return { fileUrl: data.signedUrl };
+				const bucket = supabase.storage.from(bucketName);
+				const expiresIn = config.signedUrlExpiresIn ?? 3600;
+				let data = null;
+				let error = null;
+				try {
+					const response = await bucket.createSignedUrl(key, expiresIn);
+					data = response.data;
+					error = response.error;
+				} catch (thrownError) {
+					error = thrownError;
+				}
+				if (!error && data?.signedUrl) return { fileUrl: data.signedUrl };
+				throw new Error(`Failed to generate download URL for "${bucketName}/${key}": ${getErrorMessage(error ?? /* @__PURE__ */ new Error("missing signed URL"))}`);
 			}
 		};
 	}
 });
 //#endregion
-export { supabaseEdgeFunctionDatabase as n, supabaseDatabase as r, supabaseEdgeFunctionStorage as t };
+export { resolveSupabaseServiceRoleKey as i, supabaseEdgeFunctionDatabase as n, supabaseDatabase as r, supabaseEdgeFunctionStorage as t };

package/dist/{supabaseEdgeFunctionStorage-CXmcRBZ2.d.mts → supabaseEdgeFunctionStorage-BRxGvt-r.d.mts}

@@ -1,3 +1,4 @@
+import * as _$_hot_updater_plugin_core0 from "@hot-updater/plugin-core";
 import { DatabasePluginHooks } from "@hot-updater/plugin-core";
 
 //#region src/supabaseEdgeFunctionDatabase.d.ts
@@ -5,7 +6,7 @@ interface SupabaseEdgeFunctionDatabaseConfig {
   supabaseUrl: string;
   supabaseServiceRoleKey: string;
 }
-declare const supabaseEdgeFunctionDatabase: (config: SupabaseEdgeFunctionDatabaseConfig, hooks?: DatabasePluginHooks) => () => import("@hot-updater/plugin-core").DatabasePlugin<unknown>;
+declare const supabaseEdgeFunctionDatabase: (config: SupabaseEdgeFunctionDatabaseConfig, hooks?: DatabasePluginHooks) => () => _$_hot_updater_plugin_core0.DatabasePlugin<unknown>;
 //#endregion
 //#region src/supabaseEdgeFunctionStorage.d.ts
 interface SupabaseEdgeFunctionStorageConfig {
@@ -13,6 +14,6 @@ interface SupabaseEdgeFunctionStorageConfig {
   supabaseServiceRoleKey: string;
   signedUrlExpiresIn?: number;
 }
-declare const supabaseEdgeFunctionStorage: (config: SupabaseEdgeFunctionStorageConfig, hooks?: import("@hot-updater/plugin-core").StoragePluginHooks) => () => import("@hot-updater/plugin-core").RuntimeStoragePlugin<unknown>;
+declare const supabaseEdgeFunctionStorage: (config: SupabaseEdgeFunctionStorageConfig, hooks?: _$_hot_updater_plugin_core0.StoragePluginHooks) => () => _$_hot_updater_plugin_core0.RuntimeStoragePlugin<unknown>;
 //#endregion
 export { supabaseEdgeFunctionDatabase as i, supabaseEdgeFunctionStorage as n, SupabaseEdgeFunctionDatabaseConfig as r, SupabaseEdgeFunctionStorageConfig as t };

package/dist/{supabaseEdgeFunctionStorage-hkokSgXP.d.cts → supabaseEdgeFunctionStorage-CU396KO3.d.cts}

@@ -1,3 +1,4 @@
+import * as _$_hot_updater_plugin_core0 from "@hot-updater/plugin-core";
 import { DatabasePluginHooks } from "@hot-updater/plugin-core";
 
 //#region src/supabaseEdgeFunctionDatabase.d.ts
@@ -5,7 +6,7 @@ interface SupabaseEdgeFunctionDatabaseConfig {
   supabaseUrl: string;
   supabaseServiceRoleKey: string;
 }
-declare const supabaseEdgeFunctionDatabase: (config: SupabaseEdgeFunctionDatabaseConfig, hooks?: DatabasePluginHooks) => () => import("@hot-updater/plugin-core").DatabasePlugin<unknown>;
+declare const supabaseEdgeFunctionDatabase: (config: SupabaseEdgeFunctionDatabaseConfig, hooks?: DatabasePluginHooks) => () => _$_hot_updater_plugin_core0.DatabasePlugin<unknown>;
 //#endregion
 //#region src/supabaseEdgeFunctionStorage.d.ts
 interface SupabaseEdgeFunctionStorageConfig {
@@ -13,6 +14,6 @@ interface SupabaseEdgeFunctionStorageConfig {
   supabaseServiceRoleKey: string;
   signedUrlExpiresIn?: number;
 }
-declare const supabaseEdgeFunctionStorage: (config: SupabaseEdgeFunctionStorageConfig, hooks?: import("@hot-updater/plugin-core").StoragePluginHooks) => () => import("@hot-updater/plugin-core").RuntimeStoragePlugin<unknown>;
+declare const supabaseEdgeFunctionStorage: (config: SupabaseEdgeFunctionStorageConfig, hooks?: _$_hot_updater_plugin_core0.StoragePluginHooks) => () => _$_hot_updater_plugin_core0.RuntimeStoragePlugin<unknown>;
 //#endregion
 export { supabaseEdgeFunctionDatabase as i, supabaseEdgeFunctionStorage as n, SupabaseEdgeFunctionDatabaseConfig as r, SupabaseEdgeFunctionStorageConfig as t };

package/dist/{supabaseEdgeFunctionStorage-BZC0Z0XP.cjs → supabaseEdgeFunctionStorage-D933mGy9.cjs}

@@ -2,6 +2,13 @@ require("./index.cjs");
 let _hot_updater_core = require("@hot-updater/core");
 let _hot_updater_plugin_core = require("@hot-updater/plugin-core");
 let _supabase_supabase_js = require("@supabase/supabase-js");
+//#region src/supabaseConfig.ts
+const resolveSupabaseServiceRoleKey = (config) => {
+	const key = config.supabaseServiceRoleKey ?? config.supabaseAnonKey;
+	if (!key) throw new Error("Supabase service role key is required. Set supabaseServiceRoleKey.");
+	return key;
+};
+//#endregion
 //#region src/supabaseDatabase.ts
 const normalizeMetadata = (value) => {
 	if (!value) return {};
@@ -100,7 +107,7 @@ const bundleToPatchRows = (bundle) => (0, _hot_updater_core.getBundlePatches)(bu
 const supabaseDatabase = (0, _hot_updater_plugin_core.createDatabasePlugin)({
 	name: "supabaseDatabase",
 	factory: (config) => {
-		const supabase = (0, _supabase_supabase_js.createClient)(config.supabaseUrl, config.supabaseAnonKey);
+		const supabase = (0, _supabase_supabase_js.createClient)(config.supabaseUrl, resolveSupabaseServiceRoleKey(config));
 		const fetchPatchMap = async (bundleIds) => {
 			const patchMap = /* @__PURE__ */ new Map();
 			if (bundleIds.length === 0) return patchMap;
@@ -229,11 +236,16 @@ const supabaseDatabase = (0, _hot_updater_plugin_core.createDatabasePlugin)({
 const supabaseEdgeFunctionDatabase = (config, hooks) => {
 	return supabaseDatabase({
 		supabaseUrl: config.supabaseUrl,
-		supabaseAnonKey: config.supabaseServiceRoleKey
+		supabaseServiceRoleKey: config.supabaseServiceRoleKey
 	}, hooks);
 };
 //#endregion
 //#region src/supabaseEdgeFunctionStorage.ts
+function getErrorMessage(error) {
+	if (error instanceof Error) return error.message;
+	if (error && typeof error === "object" && "message" in error && typeof error.message === "string") return error.message;
+	return String(error);
+}
 const parseSupabaseStorageUri = (storageUri) => {
 	const storageUrl = new URL(storageUri);
 	if (storageUrl.protocol !== "supabase-storage:") throw new Error("Invalid Supabase storage URI protocol");
@@ -263,15 +275,30 @@ const supabaseEdgeFunctionStorage = (0, _hot_updater_plugin_core.createRuntimeSt
 			},
 			async getDownloadUrl(storageUri) {
 				const { bucketName, key } = parseSupabaseStorageUri(storageUri);
-				const { data, error } = await supabase.storage.from(bucketName).createSignedUrl(key, config.signedUrlExpiresIn ?? 3600);
-				if (error) throw new Error(`Failed to generate download URL: ${error.message}`);
-				if (!data?.signedUrl) throw new Error("Failed to generate download URL");
-				return { fileUrl: data.signedUrl };
+				const bucket = supabase.storage.from(bucketName);
+				const expiresIn = config.signedUrlExpiresIn ?? 3600;
+				let data = null;
+				let error = null;
+				try {
+					const response = await bucket.createSignedUrl(key, expiresIn);
+					data = response.data;
+					error = response.error;
+				} catch (thrownError) {
+					error = thrownError;
+				}
+				if (!error && data?.signedUrl) return { fileUrl: data.signedUrl };
+				throw new Error(`Failed to generate download URL for "${bucketName}/${key}": ${getErrorMessage(error ?? /* @__PURE__ */ new Error("missing signed URL"))}`);
 			}
 		};
 	}
 });
 //#endregion
+Object.defineProperty(exports, "resolveSupabaseServiceRoleKey", {
+	enumerable: true,
+	get: function() {
+		return resolveSupabaseServiceRoleKey;
+	}
+});
 Object.defineProperty(exports, "supabaseDatabase", {
 	enumerable: true,
 	get: function() {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@hot-updater/supabase",
   "type": "module",
-  "version": "0.31.4",
+  "version": "0.32.0",
   "description": "React Native OTA solution for self-hosted",
   "main": "dist/index.cjs",
   "module": "dist/index.mjs",
@@ -47,10 +47,10 @@
     "@supabase/supabase-js": "2.76.1",
     "hono": "4.12.9",
     "uuidv7": "^1.0.2",
-    "@hot-updater/core": "0.31.4",
-    "@hot-updater/plugin-core": "0.31.4",
-    "@hot-updater/server": "0.31.4",
-    "@hot-updater/cli-tools": "0.31.4"
+    "@hot-updater/core": "0.32.0",
+    "@hot-updater/plugin-core": "0.32.0",
+    "@hot-updater/cli-tools": "0.32.0",
+    "@hot-updater/server": "0.32.0"
   },
   "devDependencies": {
     "@electric-sql/pglite": "0.2.17",
@@ -60,10 +60,10 @@
     "execa": "9.5.2",
     "@types/node": "^20",
     "mime": "^4.0.4",
-    "@hot-updater/js": "0.31.4",
-    "@hot-updater/mock": "0.31.4",
-    "@hot-updater/test-utils": "0.31.4",
-    "@hot-updater/postgres": "0.31.4"
+    "@hot-updater/js": "0.32.0",
+    "@hot-updater/mock": "0.32.0",
+    "@hot-updater/test-utils": "0.32.0",
+    "@hot-updater/postgres": "0.32.0"
   },
   "scripts": {
     "build": "tsdown",

package/supabase/edge-functions/index.ts

@@ -32,7 +32,6 @@ const hotUpdater = createHotUpdater({
   basePath: hotUpdaterBasePath,
   routes: {
     updateCheck: true,
-    version: true,
     bundles: false,
   },
 });

package/supabase/migrations/20260520014100_hot-updater_rls.sql

@@ -0,0 +1,48 @@
+-- HotUpdater.supabase_rls
+
+ALTER TABLE public.bundles ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.bundle_patches ENABLE ROW LEVEL SECURITY;
+
+ALTER FUNCTION public.get_target_app_version_list(public.platforms, uuid)
+  SET search_path = public, pg_catalog;
+ALTER FUNCTION public.get_channels()
+  SET search_path = public, pg_catalog;
+ALTER FUNCTION public.positive_mod(integer, integer)
+  SET search_path = public, pg_catalog;
+ALTER FUNCTION public.hash_rollout_value(text)
+  SET search_path = public, pg_catalog;
+ALTER FUNCTION public.normalize_cohort_value(text)
+  SET search_path = public, pg_catalog;
+ALTER FUNCTION public.gcd_int(integer, integer)
+  SET search_path = public, pg_catalog;
+ALTER FUNCTION public.get_rollout_multiplier(uuid)
+  SET search_path = public, pg_catalog;
+ALTER FUNCTION public.get_rollout_offset(uuid)
+  SET search_path = public, pg_catalog;
+ALTER FUNCTION public.get_modular_inverse(integer, integer)
+  SET search_path = public, pg_catalog;
+ALTER FUNCTION public.is_numeric_cohort(text)
+  SET search_path = public, pg_catalog;
+ALTER FUNCTION public.get_numeric_cohort_rollout_position(uuid, text)
+  SET search_path = public, pg_catalog;
+ALTER FUNCTION public.is_cohort_eligible(uuid, text, integer, text[])
+  SET search_path = public, pg_catalog;
+ALTER FUNCTION public.get_update_info_by_fingerprint_hash(
+  public.platforms,
+  uuid,
+  uuid,
+  text,
+  text,
+  text
+)
+  SET search_path = public, pg_catalog;
+ALTER FUNCTION public.get_update_info_by_app_version(
+  public.platforms,
+  text,
+  uuid,
+  uuid,
+  text,
+  text[],
+  text
+)
+  SET search_path = public, pg_catalog;

package/supabase/migrations.spec.ts

@@ -0,0 +1,67 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+
+import { describe, expect, it } from "vitest";
+
+const rlsMigrationPath = path.resolve(
+  "plugins/supabase/supabase/migrations/20260520014100_hot-updater_rls.sql",
+);
+const migrationsDir = path.dirname(rlsMigrationPath);
+
+describe("Supabase RLS migration", () => {
+  it("runs after Supabase function redefinition migrations", async () => {
+    const migrations = (await fs.readdir(migrationsDir))
+      .filter((file) => file.endsWith(".sql"))
+      .sort();
+
+    expect(migrations.at(-1)).toBe(path.basename(rlsMigrationPath));
+  });
+
+  it("enables RLS on Hot Updater tables", async () => {
+    const sql = await fs.readFile(rlsMigrationPath, "utf8");
+
+    expect(sql).toContain(
+      "ALTER TABLE public.bundles ENABLE ROW LEVEL SECURITY;",
+    );
+    expect(sql).toContain(
+      "ALTER TABLE public.bundle_patches ENABLE ROW LEVEL SECURITY;",
+    );
+    expect(sql).not.toContain("REVOKE ALL ON TABLE");
+    expect(sql).not.toContain("GRANT SELECT, INSERT, UPDATE, DELETE");
+  });
+
+  it("pins search_path for public Hot Updater functions", async () => {
+    const sql = await fs.readFile(rlsMigrationPath, "utf8");
+    const hotUpdaterFunctions = [
+      "get_target_app_version_list",
+      "get_channels",
+      "positive_mod",
+      "hash_rollout_value",
+      "normalize_cohort_value",
+      "gcd_int",
+      "get_rollout_multiplier",
+      "get_rollout_offset",
+      "get_modular_inverse",
+      "is_numeric_cohort",
+      "get_numeric_cohort_rollout_position",
+      "is_cohort_eligible",
+      "get_update_info_by_fingerprint_hash",
+      "get_update_info_by_app_version",
+    ];
+
+    for (const functionName of hotUpdaterFunctions) {
+      expect(sql).toContain(`ALTER FUNCTION public.${functionName}`);
+    }
+
+    expect(sql.match(/SET search_path = public, pg_catalog;/g)).toHaveLength(
+      hotUpdaterFunctions.length,
+    );
+  });
+
+  it("does not change function execution grants", async () => {
+    const sql = await fs.readFile(rlsMigrationPath, "utf8");
+
+    expect(sql).not.toContain("REVOKE EXECUTE");
+    expect(sql).not.toContain("GRANT EXECUTE");
+  });
+});