@hot-updater/supabase 1.1.4 → 1.2.0-rc.0

package/dist/edge.cjs

@@ -1,4 +1,4 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_supabaseStorage = require("./supabaseStorage-DAl3pyb7.cjs");
+const require_supabaseStorage = require("./supabaseStorage-MqoRcaii.cjs");
 exports.supabaseDatabase = require_supabaseStorage.supabaseDatabase;
 exports.supabaseStorage = require_supabaseStorage.supabaseStorage;

package/dist/edge.mjs

@@ -1,2 +1,2 @@
-import { n as supabaseDatabase, t as supabaseStorage } from "./supabaseStorage-C8xQ3nyM.mjs";
+import { n as supabaseDatabase, t as supabaseStorage } from "./supabaseStorage-D4jcGa-l.mjs";
 export { supabaseDatabase, supabaseStorage };

package/dist/index.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_supabaseStorage = require("./supabaseStorage-DAl3pyb7.cjs");
+const require_supabaseStorage = require("./supabaseStorage-MqoRcaii.cjs");
 let _hot_updater_plugin_core = require("@hot-updater/plugin-core");
 //#region src/supabaseSchema.ts
 /** Every table the apply RPC may name: models, index tables, settings, and the write guard. */
@@ -118,10 +118,20 @@ const supabaseSchemaStatements = ({ schema, settings: expected } = _hot_updater_
 		...settings
 	];
 };
-const supabaseSchemaSql = (target) => `-- HotUpdater.schema\n\n${supabaseSchemaStatements(target).map((statement) => `${statement};`).join("\n\n")}\n`;
+const HEADER = "-- HotUpdater.schema\n\n";
+const toSql = (statements) => `${HEADER}${statements.map((statement) => `${statement};`).join("\n\n")}\n`;
+const supabaseSchemaSql = (target) => toSql(supabaseSchemaStatements(target));
 //#endregion
 //#region src/supabaseMigration.ts
 /**
+* The resource this database reaches, without credentials, under the key
+* `hot-updater doctor` reads to tell the database `hot-updater init` saved
+* from another (a convention CLAUDE.md documents).
+*/
+const DATABASE_TARGET = Symbol.for("@hot-updater/database-target");
+/** `target` under {@link DATABASE_TARGET}, to spread into the database. */
+const marked = (target) => ({ [DATABASE_TARGET]: target });
+/**
 * Hot Updater's database on Supabase, with the migration `hot-updater db
 * generate` writes to `supabase/migrations`: core's tables, the server's
 * plugin tables, the apply RPC that may name them, and their settings rows.
@@ -129,6 +139,7 @@ const supabaseSchemaSql = (target) => `-- HotUpdater.schema\n\n${supabaseSchemaS
 */
 const supabaseDatabase = (config) => ({
 	...require_supabaseStorage.supabaseDatabase(config),
+	...marked(`supabase/${new URL(config.supabaseUrl).hostname}`),
 	generateSchema: ((version, _name, target = _hot_updater_plugin_core.coreTarget) => {
 		if (version !== "latest" && version !== _hot_updater_plugin_core.coreSettings["schema.core"]) throw new Error(`Invalid version ${version}`);
 		const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/\D/g, "").slice(0, 14);

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { i as SUPABASE_TABLE_PREFIX, n as supabaseDatabase$1, r as SUPABASE_APPLY_FUNCTION, t as supabaseStorage } from "./supabaseStorage-C8xQ3nyM.mjs";
+import { i as SUPABASE_TABLE_PREFIX, n as supabaseDatabase$1, r as SUPABASE_APPLY_FUNCTION, t as supabaseStorage } from "./supabaseStorage-D4jcGa-l.mjs";
 import { SETTINGS_TABLE, WRITE_GUARD_TABLE, coreSettings, coreTarget, createTableStatements, generateEngineSql, isMultiIndex } from "@hot-updater/plugin-core";
 //#region src/supabaseSchema.ts
 /** Every table the apply RPC may name: models, index tables, settings, and the write guard. */
@@ -117,10 +117,20 @@ const supabaseSchemaStatements = ({ schema, settings: expected } = coreTarget) =
 		...settings
 	];
 };
-const supabaseSchemaSql = (target) => `-- HotUpdater.schema\n\n${supabaseSchemaStatements(target).map((statement) => `${statement};`).join("\n\n")}\n`;
+const HEADER = "-- HotUpdater.schema\n\n";
+const toSql = (statements) => `${HEADER}${statements.map((statement) => `${statement};`).join("\n\n")}\n`;
+const supabaseSchemaSql = (target) => toSql(supabaseSchemaStatements(target));
 //#endregion
 //#region src/supabaseMigration.ts
 /**
+* The resource this database reaches, without credentials, under the key
+* `hot-updater doctor` reads to tell the database `hot-updater init` saved
+* from another (a convention CLAUDE.md documents).
+*/
+const DATABASE_TARGET = Symbol.for("@hot-updater/database-target");
+/** `target` under {@link DATABASE_TARGET}, to spread into the database. */
+const marked = (target) => ({ [DATABASE_TARGET]: target });
+/**
 * Hot Updater's database on Supabase, with the migration `hot-updater db
 * generate` writes to `supabase/migrations`: core's tables, the server's
 * plugin tables, the apply RPC that may name them, and their settings rows.
@@ -128,6 +138,7 @@ const supabaseSchemaSql = (target) => `-- HotUpdater.schema\n\n${supabaseSchemaS
 */
 const supabaseDatabase = (config) => ({
 	...supabaseDatabase$1(config),
+	...marked(`supabase/${new URL(config.supabaseUrl).hostname}`),
 	generateSchema: ((version, _name, target = coreTarget) => {
 		if (version !== "latest" && version !== coreSettings["schema.core"]) throw new Error(`Invalid version ${version}`);
 		const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/\D/g, "").slice(0, 14);

package/dist/init/index.cjs

@@ -6370,11 +6370,14 @@ const toApplyStatement = ({ sql, params }) => {
 const withCode = (error) => Object.assign(new Error(error.message, { cause: error }), { code: error.code === "PGRST202" || error.code === "PGRST205" ? "42P01" : error.code });
 /**
 * The SQL core's executor over Supabase: every statement goes through the
-* apply RPC, and a write is one RPC call, so one transaction.
+* apply RPC, and a write is one RPC call, so one transaction. `client` may
+* be what creates the client, called on the first statement.
 */
 const supabaseExecutor = (client) => {
+	let created;
+	const clientOf = () => typeof client === "function" ? created ??= client() : client;
 	const apply = async (statements) => {
-		const { data, error } = await client.rpc(SUPABASE_APPLY_FUNCTION, { p_statements: statements.map(toApplyStatement) });
+		const { data, error } = await clientOf().rpc(SUPABASE_APPLY_FUNCTION, { p_statements: statements.map(toApplyStatement) });
 		if (error) throw withCode(error);
 		return data;
 	};
@@ -6397,7 +6400,7 @@ const supabaseExecutor = (client) => {
 */
 const supabaseDatabase = (config) => {
 	const { migrations: _migrations, ...adapter } = (0, _hot_updater_plugin_core.createSqlAdapter)({
-		executor: supabaseExecutor((0, _supabase_supabase_js.createClient)(config.supabaseUrl, resolveSupabaseServiceRoleKey(config))),
+		executor: supabaseExecutor(() => (0, _supabase_supabase_js.createClient)(config.supabaseUrl, resolveSupabaseServiceRoleKey(config))),
 		tablePrefix: SUPABASE_TABLE_PREFIX
 	});
 	return (0, _hot_updater_plugin_core.createEngineDatabase)({
@@ -6683,12 +6686,18 @@ const isSupabaseDatabaseAuthError = (err) => {
 	const stderr = err.stderr;
 	return typeof stderr === "string" && SUPABASE_DATABASE_AUTH_ERROR_PATTERNS.some((pattern) => pattern.test(stderr));
 };
-const handleSupabaseDatabaseCommandError = (err, { dbPassword, stderrInherited = false }) => {
+/** What a failed database command reports: a bad password, or the CLI's output. */
+const supabaseDatabaseCommandErrorMessage = (err, { dbPassword, stderrInherited = false }) => {
 	if (err instanceof ExecaError) {
-		if (dbPassword && isSupabaseDatabaseAuthError(err)) _hot_updater_cli_tools.p.log.error(SUPABASE_DATABASE_CONNECTION_ERROR);
-		else if (!stderrInherited && err.stderr) _hot_updater_cli_tools.p.log.error(err.stderr);
-		else _hot_updater_cli_tools.p.log.error(err.message);
-	} else console.error(err);
+		if (dbPassword && isSupabaseDatabaseAuthError(err)) return SUPABASE_DATABASE_CONNECTION_ERROR;
+		if (!stderrInherited && err.stderr) return err.stderr;
+		return err.message;
+	}
+	return err instanceof Error ? err.message : String(err);
+};
+const handleSupabaseDatabaseCommandError = (err, options) => {
+	if (err instanceof ExecaError) _hot_updater_cli_tools.p.log.error(supabaseDatabaseCommandErrorMessage(err, options));
+	else console.error(err);
 	process.exit(1);
 };
 const confirmSupabaseDatabaseMigrations = async ({ nonInteractive }) => {
@@ -6698,71 +6707,80 @@ const confirmSupabaseDatabaseMigrations = async ({ nonInteractive }) => {
 		initialValue: true
 	}) === true;
 };
-const linkSupabase = async (workdir, { accessToken, projectId, dbPassword }) => {
+const runSupabaseLink = async (workdir, { accessToken, projectId, dbPassword }) => {
+	await fs_promises.default.writeFile(path.default.join(workdir, "supabase", "config.toml"), (0, _hot_updater_cli_tools.transformTemplate)(SUPABASE_CONFIG_TEMPLATE, { projectId }));
+	await execa("npx", [
+		"supabase",
+		"link",
+		"--project-ref",
+		projectId,
+		"--workdir",
+		workdir
+	], {
+		cwd: workdir,
+		env: getSupabaseCommandEnv(accessToken, dbPassword),
+		input: "",
+		stdio: [
+			"pipe",
+			"pipe",
+			"pipe"
+		]
+	});
+};
+const linkSupabase = async (workdir, options) => {
 	const spinner = _hot_updater_cli_tools.p.spinner();
 	try {
-		await fs_promises.default.writeFile(path.default.join(workdir, "supabase", "config.toml"), (0, _hot_updater_cli_tools.transformTemplate)(SUPABASE_CONFIG_TEMPLATE, { projectId }));
 		spinner.start("Linking Supabase...");
-		await execa("npx", [
-			"supabase",
-			"link",
-			"--project-ref",
-			projectId,
-			"--workdir",
-			workdir
-		], {
-			cwd: workdir,
-			env: getSupabaseCommandEnv(accessToken, dbPassword),
-			input: "",
-			stdio: [
-				"pipe",
-				"pipe",
-				"pipe"
-			]
-		});
+		await runSupabaseLink(workdir, options);
 		spinner.stop("Supabase linked ✔");
 	} catch (err) {
 		spinner.stop();
-		handleSupabaseDatabaseCommandError(err instanceof Error ? err : new Error(String(err)), { dbPassword });
+		handleSupabaseDatabaseCommandError(err instanceof Error ? err : new Error(String(err)), { dbPassword: options.dbPassword });
 	}
 };
-const pushDB = async (workdir, { accessToken, dbPassword }) => {
-	try {
-		await execa("npx", [
-			"supabase",
-			"migration",
-			"fetch",
-			"--linked",
-			"--yes",
-			"--workdir",
-			workdir
-		], {
-			cwd: workdir,
-			env: getSupabaseCommandEnv(accessToken, dbPassword)
-		}).catch((error) => {
-			if (error instanceof ExecaError && [error.stderr, error.stdout].some((output) => typeof output === "string" && /relation \\?"supabase_migrations\.schema_migrations\\?" does not exist/.test(output))) return;
-			throw error;
-		});
-		const dbPush = await execa("npx", [
-			"supabase",
-			"db",
-			"push",
-			"--include-all",
-			"--yes",
-			"--workdir",
-			workdir
-		], {
-			cwd: workdir,
-			env: getSupabaseCommandEnv(accessToken, dbPassword),
+/** Pushes the workdir's migrations the linked project has not run, after its own history. */
+const runSupabasePush = async (workdir, { accessToken, dbPassword, quiet = false }) => {
+	await execa("npx", [
+		"supabase",
+		"migration",
+		"fetch",
+		"--linked",
+		"--yes",
+		"--workdir",
+		workdir
+	], {
+		cwd: workdir,
+		env: getSupabaseCommandEnv(accessToken, dbPassword)
+	}).catch((error) => {
+		if (error instanceof ExecaError && [error.stderr, error.stdout].some((output) => typeof output === "string" && /relation \\?"supabase_migrations\.schema_migrations\\?" does not exist/.test(output))) return;
+		throw error;
+	});
+	return execa("npx", [
+		"supabase",
+		"db",
+		"push",
+		"--include-all",
+		"--yes",
+		"--workdir",
+		workdir
+	], {
+		cwd: workdir,
+		env: getSupabaseCommandEnv(accessToken, dbPassword),
+		...quiet ? { input: "" } : {
 			stderr: ["pipe", "inherit"],
 			stdin: "inherit",
 			stdout: "inherit"
-		});
+		}
+	});
+};
+const pushDB = async (workdir, options) => {
+	try {
+		const dbPush = await runSupabasePush(workdir, options);
 		_hot_updater_cli_tools.p.log.success("DB pushed ✔");
 		return dbPush.stdout;
 	} catch (err) {
 		handleSupabaseDatabaseCommandError(err instanceof Error ? err : new Error(String(err)), {
-			dbPassword,
+			dbPassword: options.dbPassword,
 			stderrInherited: true
 		});
 	}

package/dist/init/index.mjs

@@ -6365,11 +6365,14 @@ const toApplyStatement = ({ sql, params }) => {
 const withCode = (error) => Object.assign(new Error(error.message, { cause: error }), { code: error.code === "PGRST202" || error.code === "PGRST205" ? "42P01" : error.code });
 /**
 * The SQL core's executor over Supabase: every statement goes through the
-* apply RPC, and a write is one RPC call, so one transaction.
+* apply RPC, and a write is one RPC call, so one transaction. `client` may
+* be what creates the client, called on the first statement.
 */
 const supabaseExecutor = (client) => {
+	let created;
+	const clientOf = () => typeof client === "function" ? created ??= client() : client;
 	const apply = async (statements) => {
-		const { data, error } = await client.rpc(SUPABASE_APPLY_FUNCTION, { p_statements: statements.map(toApplyStatement) });
+		const { data, error } = await clientOf().rpc(SUPABASE_APPLY_FUNCTION, { p_statements: statements.map(toApplyStatement) });
 		if (error) throw withCode(error);
 		return data;
 	};
@@ -6392,7 +6395,7 @@ const supabaseExecutor = (client) => {
 */
 const supabaseDatabase = (config) => {
 	const { migrations: _migrations, ...adapter } = createSqlAdapter({
-		executor: supabaseExecutor(createClient(config.supabaseUrl, resolveSupabaseServiceRoleKey(config))),
+		executor: supabaseExecutor(() => createClient(config.supabaseUrl, resolveSupabaseServiceRoleKey(config))),
 		tablePrefix: SUPABASE_TABLE_PREFIX
 	});
 	return createEngineDatabase({
@@ -6678,12 +6681,18 @@ const isSupabaseDatabaseAuthError = (err) => {
 	const stderr = err.stderr;
 	return typeof stderr === "string" && SUPABASE_DATABASE_AUTH_ERROR_PATTERNS.some((pattern) => pattern.test(stderr));
 };
-const handleSupabaseDatabaseCommandError = (err, { dbPassword, stderrInherited = false }) => {
+/** What a failed database command reports: a bad password, or the CLI's output. */
+const supabaseDatabaseCommandErrorMessage = (err, { dbPassword, stderrInherited = false }) => {
 	if (err instanceof ExecaError) {
-		if (dbPassword && isSupabaseDatabaseAuthError(err)) p.log.error(SUPABASE_DATABASE_CONNECTION_ERROR);
-		else if (!stderrInherited && err.stderr) p.log.error(err.stderr);
-		else p.log.error(err.message);
-	} else console.error(err);
+		if (dbPassword && isSupabaseDatabaseAuthError(err)) return SUPABASE_DATABASE_CONNECTION_ERROR;
+		if (!stderrInherited && err.stderr) return err.stderr;
+		return err.message;
+	}
+	return err instanceof Error ? err.message : String(err);
+};
+const handleSupabaseDatabaseCommandError = (err, options) => {
+	if (err instanceof ExecaError) p.log.error(supabaseDatabaseCommandErrorMessage(err, options));
+	else console.error(err);
 	process.exit(1);
 };
 const confirmSupabaseDatabaseMigrations = async ({ nonInteractive }) => {
@@ -6693,71 +6702,80 @@ const confirmSupabaseDatabaseMigrations = async ({ nonInteractive }) => {
 		initialValue: true
 	}) === true;
 };
-const linkSupabase = async (workdir, { accessToken, projectId, dbPassword }) => {
+const runSupabaseLink = async (workdir, { accessToken, projectId, dbPassword }) => {
+	await fs.writeFile(path.join(workdir, "supabase", "config.toml"), transformTemplate(SUPABASE_CONFIG_TEMPLATE, { projectId }));
+	await execa("npx", [
+		"supabase",
+		"link",
+		"--project-ref",
+		projectId,
+		"--workdir",
+		workdir
+	], {
+		cwd: workdir,
+		env: getSupabaseCommandEnv(accessToken, dbPassword),
+		input: "",
+		stdio: [
+			"pipe",
+			"pipe",
+			"pipe"
+		]
+	});
+};
+const linkSupabase = async (workdir, options) => {
 	const spinner = p.spinner();
 	try {
-		await fs.writeFile(path.join(workdir, "supabase", "config.toml"), transformTemplate(SUPABASE_CONFIG_TEMPLATE, { projectId }));
 		spinner.start("Linking Supabase...");
-		await execa("npx", [
-			"supabase",
-			"link",
-			"--project-ref",
-			projectId,
-			"--workdir",
-			workdir
-		], {
-			cwd: workdir,
-			env: getSupabaseCommandEnv(accessToken, dbPassword),
-			input: "",
-			stdio: [
-				"pipe",
-				"pipe",
-				"pipe"
-			]
-		});
+		await runSupabaseLink(workdir, options);
 		spinner.stop("Supabase linked ✔");
 	} catch (err) {
 		spinner.stop();
-		handleSupabaseDatabaseCommandError(err instanceof Error ? err : new Error(String(err)), { dbPassword });
+		handleSupabaseDatabaseCommandError(err instanceof Error ? err : new Error(String(err)), { dbPassword: options.dbPassword });
 	}
 };
-const pushDB = async (workdir, { accessToken, dbPassword }) => {
-	try {
-		await execa("npx", [
-			"supabase",
-			"migration",
-			"fetch",
-			"--linked",
-			"--yes",
-			"--workdir",
-			workdir
-		], {
-			cwd: workdir,
-			env: getSupabaseCommandEnv(accessToken, dbPassword)
-		}).catch((error) => {
-			if (error instanceof ExecaError && [error.stderr, error.stdout].some((output) => typeof output === "string" && /relation \\?"supabase_migrations\.schema_migrations\\?" does not exist/.test(output))) return;
-			throw error;
-		});
-		const dbPush = await execa("npx", [
-			"supabase",
-			"db",
-			"push",
-			"--include-all",
-			"--yes",
-			"--workdir",
-			workdir
-		], {
-			cwd: workdir,
-			env: getSupabaseCommandEnv(accessToken, dbPassword),
+/** Pushes the workdir's migrations the linked project has not run, after its own history. */
+const runSupabasePush = async (workdir, { accessToken, dbPassword, quiet = false }) => {
+	await execa("npx", [
+		"supabase",
+		"migration",
+		"fetch",
+		"--linked",
+		"--yes",
+		"--workdir",
+		workdir
+	], {
+		cwd: workdir,
+		env: getSupabaseCommandEnv(accessToken, dbPassword)
+	}).catch((error) => {
+		if (error instanceof ExecaError && [error.stderr, error.stdout].some((output) => typeof output === "string" && /relation \\?"supabase_migrations\.schema_migrations\\?" does not exist/.test(output))) return;
+		throw error;
+	});
+	return execa("npx", [
+		"supabase",
+		"db",
+		"push",
+		"--include-all",
+		"--yes",
+		"--workdir",
+		workdir
+	], {
+		cwd: workdir,
+		env: getSupabaseCommandEnv(accessToken, dbPassword),
+		...quiet ? { input: "" } : {
 			stderr: ["pipe", "inherit"],
 			stdin: "inherit",
 			stdout: "inherit"
-		});
+		}
+	});
+};
+const pushDB = async (workdir, options) => {
+	try {
+		const dbPush = await runSupabasePush(workdir, options);
 		p.log.success("DB pushed ✔");
 		return dbPush.stdout;
 	} catch (err) {
 		handleSupabaseDatabaseCommandError(err instanceof Error ? err : new Error(String(err)), {
-			dbPassword,
+			dbPassword: options.dbPassword,
 			stderrInherited: true
 		});
 	}

package/dist/{supabaseStorage-C8xQ3nyM.mjs → supabaseStorage-D4jcGa-l.mjs}

@@ -37,11 +37,14 @@ const toApplyStatement = ({ sql, params }) => {
 const withCode = (error) => Object.assign(new Error(error.message, { cause: error }), { code: error.code === "PGRST202" || error.code === "PGRST205" ? "42P01" : error.code });
 /**
 * The SQL core's executor over Supabase: every statement goes through the
-* apply RPC, and a write is one RPC call, so one transaction.
+* apply RPC, and a write is one RPC call, so one transaction. `client` may
+* be what creates the client, called on the first statement.
 */
 const supabaseExecutor = (client) => {
+	let created;
+	const clientOf = () => typeof client === "function" ? created ??= client() : client;
 	const apply = async (statements) => {
-		const { data, error } = await client.rpc(SUPABASE_APPLY_FUNCTION, { p_statements: statements.map(toApplyStatement) });
+		const { data, error } = await clientOf().rpc(SUPABASE_APPLY_FUNCTION, { p_statements: statements.map(toApplyStatement) });
 		if (error) throw withCode(error);
 		return data;
 	};
@@ -64,7 +67,7 @@ const supabaseExecutor = (client) => {
 */
 const supabaseDatabase = (config) => {
 	const { migrations: _migrations, ...adapter } = createSqlAdapter({
-		executor: supabaseExecutor(createClient(config.supabaseUrl, resolveSupabaseServiceRoleKey(config))),
+		executor: supabaseExecutor(() => createClient(config.supabaseUrl, resolveSupabaseServiceRoleKey(config))),
 		tablePrefix: SUPABASE_TABLE_PREFIX
 	});
 	return createEngineDatabase({
@@ -166,10 +169,11 @@ const utf8 = new TextEncoder();
 */
 const toObjectName = (key) => key.replace(ESCAPED_CHARACTER, (character) => Array.from(utf8.encode(character), (byte) => `!${byte.toString(16).toUpperCase().padStart(2, "0")}`).join(""));
 const supabaseStorage = (config) => {
-	const bucket = createClient(config.supabaseUrl, resolveSupabaseServiceRoleKey(config)).storage.from(config.bucketName);
+	let client;
+	const bucket = () => (client ??= createClient(config.supabaseUrl, resolveSupabaseServiceRoleKey(config))).storage.from(config.bucketName);
 	const getStorageKey = createStorageKeyBuilder(config.basePath);
 	const resolveSignedUrl = createSupabaseSignedUrlBatcher({
-		createSignedUrls: (_bucketName, keys, expiresIn) => bucket.createSignedUrls(keys, expiresIn),
+		createSignedUrls: (_bucketName, keys, expiresIn) => bucket().createSignedUrls(keys, expiresIn),
 		expiresIn: config.signedUrlExpiresIn ?? 3600,
 		formatObjectPath: (_bucketName, key) => key
 	});
@@ -183,7 +187,7 @@ const supabaseStorage = (config) => {
 		protocol: "supabase-storage",
 		async put({ key, body, contentLength, contentType }) {
 			const storageKey = getStorageKey(key);
-			const { error } = await bucket.upload(toObjectName(storageKey), body, {
+			const { error } = await bucket().upload(toObjectName(storageKey), body, {
 				contentType,
 				cacheControl: "max-age=31536000",
 				upsert: true,
@@ -199,7 +203,7 @@ const supabaseStorage = (config) => {
 		},
 		async get({ storageUri }) {
 			const { key } = parseAndValidate(storageUri);
-			const { data, error } = await bucket.download(toObjectName(key));
+			const { data, error } = await bucket().download(toObjectName(key));
 			if (error) {
 				if (await isMissingObjectError(error)) return { response: null };
 				throw new Error(`Failed to download storage object: ${error.message}`);
@@ -212,7 +216,7 @@ const supabaseStorage = (config) => {
 		},
 		async exists({ storageUri }) {
 			const { key } = parseAndValidate(storageUri);
-			const { data, error } = await bucket.exists(toObjectName(key));
+			const { data, error } = await bucket().exists(toObjectName(key));
 			if (error) {
 				if (isMissingExistsError(error)) return { exists: false };
 				throw error;
@@ -221,7 +225,7 @@ const supabaseStorage = (config) => {
 		},
 		async delete({ storageUri }) {
 			const { key } = parseAndValidate(storageUri);
-			const { error } = await bucket.remove([toObjectName(key)]);
+			const { error } = await bucket().remove([toObjectName(key)]);
 			if (error && !isNotFoundError(error)) throw new Error(`Failed to delete storage object: ${error.message}`);
 			return { deleted: true };
 		}

package/dist/{supabaseStorage-DAl3pyb7.cjs → supabaseStorage-MqoRcaii.cjs}

@@ -37,11 +37,14 @@ const toApplyStatement = ({ sql, params }) => {
 const withCode = (error) => Object.assign(new Error(error.message, { cause: error }), { code: error.code === "PGRST202" || error.code === "PGRST205" ? "42P01" : error.code });
 /**
 * The SQL core's executor over Supabase: every statement goes through the
-* apply RPC, and a write is one RPC call, so one transaction.
+* apply RPC, and a write is one RPC call, so one transaction. `client` may
+* be what creates the client, called on the first statement.
 */
 const supabaseExecutor = (client) => {
+	let created;
+	const clientOf = () => typeof client === "function" ? created ??= client() : client;
 	const apply = async (statements) => {
-		const { data, error } = await client.rpc(SUPABASE_APPLY_FUNCTION, { p_statements: statements.map(toApplyStatement) });
+		const { data, error } = await clientOf().rpc(SUPABASE_APPLY_FUNCTION, { p_statements: statements.map(toApplyStatement) });
 		if (error) throw withCode(error);
 		return data;
 	};
@@ -64,7 +67,7 @@ const supabaseExecutor = (client) => {
 */
 const supabaseDatabase = (config) => {
 	const { migrations: _migrations, ...adapter } = (0, _hot_updater_plugin_core.createSqlAdapter)({
-		executor: supabaseExecutor((0, _supabase_supabase_js.createClient)(config.supabaseUrl, resolveSupabaseServiceRoleKey(config))),
+		executor: supabaseExecutor(() => (0, _supabase_supabase_js.createClient)(config.supabaseUrl, resolveSupabaseServiceRoleKey(config))),
 		tablePrefix: SUPABASE_TABLE_PREFIX
 	});
 	return (0, _hot_updater_plugin_core.createEngineDatabase)({
@@ -166,10 +169,11 @@ const utf8 = new TextEncoder();
 */
 const toObjectName = (key) => key.replace(ESCAPED_CHARACTER, (character) => Array.from(utf8.encode(character), (byte) => `!${byte.toString(16).toUpperCase().padStart(2, "0")}`).join(""));
 const supabaseStorage = (config) => {
-	const bucket = (0, _supabase_supabase_js.createClient)(config.supabaseUrl, resolveSupabaseServiceRoleKey(config)).storage.from(config.bucketName);
+	let client;
+	const bucket = () => (client ??= (0, _supabase_supabase_js.createClient)(config.supabaseUrl, resolveSupabaseServiceRoleKey(config))).storage.from(config.bucketName);
 	const getStorageKey = (0, _hot_updater_plugin_core.createStorageKeyBuilder)(config.basePath);
 	const resolveSignedUrl = createSupabaseSignedUrlBatcher({
-		createSignedUrls: (_bucketName, keys, expiresIn) => bucket.createSignedUrls(keys, expiresIn),
+		createSignedUrls: (_bucketName, keys, expiresIn) => bucket().createSignedUrls(keys, expiresIn),
 		expiresIn: config.signedUrlExpiresIn ?? 3600,
 		formatObjectPath: (_bucketName, key) => key
 	});
@@ -183,7 +187,7 @@ const supabaseStorage = (config) => {
 		protocol: "supabase-storage",
 		async put({ key, body, contentLength, contentType }) {
 			const storageKey = getStorageKey(key);
-			const { error } = await bucket.upload(toObjectName(storageKey), body, {
+			const { error } = await bucket().upload(toObjectName(storageKey), body, {
 				contentType,
 				cacheControl: "max-age=31536000",
 				upsert: true,
@@ -199,7 +203,7 @@ const supabaseStorage = (config) => {
 		},
 		async get({ storageUri }) {
 			const { key } = parseAndValidate(storageUri);
-			const { data, error } = await bucket.download(toObjectName(key));
+			const { data, error } = await bucket().download(toObjectName(key));
 			if (error) {
 				if (await isMissingObjectError(error)) return { response: null };
 				throw new Error(`Failed to download storage object: ${error.message}`);
@@ -212,7 +216,7 @@ const supabaseStorage = (config) => {
 		},
 		async exists({ storageUri }) {
 			const { key } = parseAndValidate(storageUri);
-			const { data, error } = await bucket.exists(toObjectName(key));
+			const { data, error } = await bucket().exists(toObjectName(key));
 			if (error) {
 				if (isMissingExistsError(error)) return { exists: false };
 				throw error;
@@ -221,7 +225,7 @@ const supabaseStorage = (config) => {
 		},
 		async delete({ storageUri }) {
 			const { key } = parseAndValidate(storageUri);
-			const { error } = await bucket.remove([toObjectName(key)]);
+			const { error } = await bucket().remove([toObjectName(key)]);
 			if (error && !isNotFoundError(error)) throw new Error(`Failed to delete storage object: ${error.message}`);
 			return { deleted: true };
 		}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@hot-updater/supabase",
   "type": "module",
-  "version": "1.1.4",
+  "version": "1.2.0-rc.0",
   "description": "React Native OTA solution for self-hosted",
   "main": "dist/index.cjs",
   "module": "dist/index.mjs",
@@ -51,10 +51,10 @@
     "@supabase/supabase-js": "2.76.1",
     "hono": "4.12.34",
     "uuidv7": "^1.0.2",
-    "@hot-updater/protocol": "1.1.4",
-    "@hot-updater/cli-tools": "1.1.4",
-    "@hot-updater/plugin-core": "1.1.4",
-    "@hot-updater/server": "1.1.4"
+    "@hot-updater/protocol": "1.2.0-rc.0",
+    "@hot-updater/plugin-core": "1.2.0-rc.0",
+    "@hot-updater/cli-tools": "1.2.0-rc.0",
+    "@hot-updater/server": "1.2.0-rc.0"
   },
   "devDependencies": {
     "@electric-sql/pglite": "0.4.1",
@@ -64,9 +64,9 @@
     "execa": "9.5.2",
     "@types/node": "^20",
     "mime": "^4.0.4",
-    "@hot-updater/test-utils": "1.1.4",
-    "@hot-updater/mock": "1.1.4",
-    "@hot-updater/postgres": "1.1.4"
+    "@hot-updater/mock": "1.2.0-rc.0",
+    "@hot-updater/test-utils": "1.2.0-rc.0",
+    "@hot-updater/postgres": "1.2.0-rc.0"
   },
   "scripts": {
     "build": "tsdown",

package/supabase/migrations/0002_hot-updater_1.2.0.sql

@@ -0,0 +1,73 @@
+-- HotUpdater.schema
+
+CREATE TABLE IF NOT EXISTS "hot_updater_v1_native_builds" ("id" varchar(36) COLLATE "C" NOT NULL, "scope_key" varchar(2048) COLLATE "C" NOT NULL, "platform" varchar(16) COLLATE "C" NOT NULL, "channel_id" varchar(1408) COLLATE "C" NOT NULL, "fingerprint_hash" varchar(255) COLLATE "C", "app_version" text COLLATE "C", "min_bundle_id" varchar(36) COLLATE "C" NOT NULL, "artifact_kind" varchar(16) COLLATE "C" NOT NULL, "artifact_storage_uri" text COLLATE "C" NOT NULL, "byte_size" bigint NOT NULL, "git_commit_hash" varchar(255) COLLATE "C", "created_at_ms" bigint NOT NULL, "build_key" varchar(69) COLLATE "C", "build_number" varchar(64) COLLATE "C", "submitted_to" varchar(16) COLLATE "C", "submitted_at_ms" bigint, "submitted_version" varchar(255) COLLATE "C", "_v" bigint NOT NULL DEFAULT 0, PRIMARY KEY ("id"));
+
+CREATE INDEX IF NOT EXISTS "hot_updater_v1_native_builds_byScope" ON "hot_updater_v1_native_builds" ("scope_key", "id");
+
+CREATE INDEX IF NOT EXISTS "hot_updater_v1_native_builds_byBuildKey" ON "hot_updater_v1_native_builds" ("scope_key", "build_key", "id");
+
+CREATE INDEX IF NOT EXISTS "hot_updater_v1_native_builds_byChannel" ON "hot_updater_v1_native_builds" ("channel_id", "id");
+
+CREATE UNIQUE INDEX IF NOT EXISTS "hot_updater_v1_native_builds_min_bundle_id" ON "hot_updater_v1_native_builds" ("min_bundle_id");
+
+ALTER TABLE "hot_updater_v1_native_builds" ENABLE ROW LEVEL SECURITY;
+
+CREATE OR REPLACE FUNCTION public.hot_updater_v1_apply(p_statements jsonb)
+RETURNS jsonb
+LANGUAGE plpgsql
+SECURITY INVOKER
+SET search_path = public, pg_temp
+AS $apply$
+DECLARE
+  item jsonb;
+  statement text;
+  shape text;
+  target text;
+  found record;
+  rows jsonb;
+  changed bigint;
+  results jsonb := '[]'::jsonb;
+BEGIN
+  FOR item IN SELECT value FROM jsonb_array_elements(p_statements) LOOP
+    statement := item->>'sql';
+    FOR target IN SELECT (regexp_matches(statement, '(?:FROM|INTO|UPDATE|JOIN) "([^"]+)"', 'g'))[1] LOOP
+      IF NOT target = ANY (ARRAY['hot_updater_v1_bundles', 'hot_updater_v1_bundle_patches', 'hot_updater_v1_releases', 'hot_updater_v1_release_catalogs', 'hot_updater_v1_channels', 'hot_updater_v1_bundle_totals', 'hot_updater_v1_native_builds', 'hot_updater_v1_bundle_events', 'hot_updater_v1_bundle_events__byBundle', 'hot_updater_v1_bundle_event_heads', 'hot_updater_v1_insights_overview', 'hot_updater_v1_insights_sketches', 'hot_updater_v1_insights_overview_daily', 'hot_updater_v1_insights_sketches_daily', 'hot_updater_v1_insights_overview_lifetime', 'hot_updater_v1_insights_sketches_lifetime', 'hot_updater_v1_insights_distribution', 'hot_updater_v1_insights_builtin_distribution', 'hot_updater_v1_insights_latest_by_bundle', 'hot_updater_v1_insights_outcomes', 'hot_updater_v1_insights_failures', 'hot_updater_v1_api_keys', 'hot_updater_v1_remote_config_active', 'hot_updater_v1_remote_config_versions', 'hot_updater_v1_private_hot_updater_settings', 'hot_updater_v1__hu_write']) THEN
+        RAISE EXCEPTION 'hot_updater_v1_apply: % is not a Hot Updater table', target USING ERRCODE = '42501';
+      END IF;
+    END LOOP;
+    shape := regexp_replace(regexp_replace(statement, '^INSERT INTO "[^"]+" \(', 'INSERT INTO ('), '"[^"]*"', '"', 'g');
+    IF shape !~ '^(SELECT|INSERT INTO|UPDATE|DELETE FROM) '
+      OR shape ~ '"[[:space:]]*\('
+      OR shape ~ '[;''\\]|--|/\*'
+      OR regexp_replace(shape, '\m(SELECT|FROM|WHERE|AND|OR|NOT|EXISTS|INSERT|INTO|VALUES|UPDATE|SET|DELETE|ORDER|BY|ASC|DESC|LIMIT|IS|NULL|ON|CONFLICT|DO|JOIN|FOR|bigint|double|precision|boolean|jsonb|i|b)\M', '', 'gi') !~ '^[[:space:]"(),.*=<>+0-9$:-]*$' THEN
+      RAISE EXCEPTION 'hot_updater_v1_apply: statement not allowed' USING ERRCODE = '42501';
+    END IF;
+    IF statement ~ '^SELECT ' THEN
+      rows := '[]'::jsonb;
+      FOR found IN EXECUTE statement USING item->'params' LOOP
+        rows := rows || jsonb_build_array(to_jsonb(found));
+      END LOOP;
+      results := results || jsonb_build_array(jsonb_build_object('rows', rows, 'changes', 0));
+    ELSE
+      EXECUTE statement USING item->'params';
+      GET DIAGNOSTICS changed = ROW_COUNT;
+      results := results || jsonb_build_array(jsonb_build_object('rows', '[]'::jsonb, 'changes', changed));
+    END IF;
+  END LOOP;
+  RETURN results;
+END;
+$apply$;
+
+REVOKE EXECUTE ON FUNCTION public.hot_updater_v1_apply(jsonb) FROM PUBLIC, anon, authenticated;
+
+GRANT EXECUTE ON FUNCTION public.hot_updater_v1_apply(jsonb) TO service_role;
+
+INSERT INTO "hot_updater_v1_private_hot_updater_settings" ("key", "value", "_v") VALUES ('schema.engine', '1', 0) ON CONFLICT ("key") DO UPDATE SET "value" = excluded."value";
+
+INSERT INTO "hot_updater_v1_private_hot_updater_settings" ("key", "value", "_v") VALUES ('schema.core', '1.2.0', 0) ON CONFLICT ("key") DO UPDATE SET "value" = excluded."value";
+
+INSERT INTO "hot_updater_v1_private_hot_updater_settings" ("key", "value", "_v") VALUES ('schema.insights', '1.0.0', 0) ON CONFLICT ("key") DO UPDATE SET "value" = excluded."value";
+
+INSERT INTO "hot_updater_v1_private_hot_updater_settings" ("key", "value", "_v") VALUES ('schema.apiKeys', '1.0.0', 0) ON CONFLICT ("key") DO UPDATE SET "value" = excluded."value";
+
+INSERT INTO "hot_updater_v1_private_hot_updater_settings" ("key", "value", "_v") VALUES ('schema.remoteConfig', '1.0.0', 0) ON CONFLICT ("key") DO UPDATE SET "value" = excluded."value";