@hot-updater/supabase 1.2.0-rc.1 → 1.2.0-rc.11

package/dist/edge.cjs

@@ -1,4 +1,4 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_supabaseStorage = require("./supabaseStorage-MqoRcaii.cjs");
+const require_supabaseStorage = require("./supabaseStorage-DUa49vGh.cjs");
 exports.supabaseDatabase = require_supabaseStorage.supabaseDatabase;
 exports.supabaseStorage = require_supabaseStorage.supabaseStorage;

package/dist/edge.d.cts

@@ -1,2 +1,2 @@
-import { i as supabaseDatabase, n as supabaseStorage, r as SupabaseDatabaseConfig, t as SupabaseStorageConfig } from "./supabaseStorage-BryXQ72m.cjs";
+import { i as supabaseDatabase, n as supabaseStorage, r as SupabaseDatabaseConfig, t as SupabaseStorageConfig } from "./supabaseStorage-C9W-69OP.cjs";
 export { type SupabaseDatabaseConfig, type SupabaseStorageConfig, supabaseDatabase, supabaseStorage };

package/dist/edge.d.mts

@@ -1,2 +1,2 @@
-import { i as supabaseDatabase, n as supabaseStorage, r as SupabaseDatabaseConfig, t as SupabaseStorageConfig } from "./supabaseStorage-BryXQ72m.mjs";
+import { i as supabaseDatabase, n as supabaseStorage, r as SupabaseDatabaseConfig, t as SupabaseStorageConfig } from "./supabaseStorage-C9W-69OP.mjs";
 export { type SupabaseDatabaseConfig, type SupabaseStorageConfig, supabaseDatabase, supabaseStorage };

package/dist/edge.mjs

@@ -1,2 +1,2 @@
-import { n as supabaseDatabase, t as supabaseStorage } from "./supabaseStorage-D4jcGa-l.mjs";
+import { n as supabaseDatabase, t as supabaseStorage } from "./supabaseStorage-B6IM8UX2.mjs";
 export { supabaseDatabase, supabaseStorage };

package/dist/index.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_supabaseStorage = require("./supabaseStorage-MqoRcaii.cjs");
+const require_supabaseStorage = require("./supabaseStorage-DUa49vGh.cjs");
 let _hot_updater_plugin_core = require("@hot-updater/plugin-core");
 //#region src/supabaseSchema.ts
 /** Every table the apply RPC may name: models, index tables, settings, and the write guard. */

package/dist/index.d.cts

@@ -1,4 +1,4 @@
-import { n as supabaseStorage, r as SupabaseDatabaseConfig, t as SupabaseStorageConfig } from "./supabaseStorage-BryXQ72m.cjs";
+import { n as supabaseStorage, r as SupabaseDatabaseConfig, t as SupabaseStorageConfig } from "./supabaseStorage-C9W-69OP.cjs";
 import { ToolingDatabase } from "@hot-updater/plugin-core";
 //#region src/supabaseMigration.d.ts
 /**

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-import { n as supabaseStorage, r as SupabaseDatabaseConfig, t as SupabaseStorageConfig } from "./supabaseStorage-BryXQ72m.mjs";
+import { n as supabaseStorage, r as SupabaseDatabaseConfig, t as SupabaseStorageConfig } from "./supabaseStorage-C9W-69OP.mjs";
 import { ToolingDatabase } from "@hot-updater/plugin-core";
 //#region src/supabaseMigration.d.ts
 /**

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { i as SUPABASE_TABLE_PREFIX, n as supabaseDatabase$1, r as SUPABASE_APPLY_FUNCTION, t as supabaseStorage } from "./supabaseStorage-D4jcGa-l.mjs";
+import { i as SUPABASE_TABLE_PREFIX, n as supabaseDatabase$1, r as SUPABASE_APPLY_FUNCTION, t as supabaseStorage } from "./supabaseStorage-B6IM8UX2.mjs";
 import { SETTINGS_TABLE, WRITE_GUARD_TABLE, coreSettings, coreTarget, createTableStatements, generateEngineSql, isMultiIndex } from "@hot-updater/plugin-core";
 //#region src/supabaseSchema.ts
 /** Every table the apply RPC may name: models, index tables, settings, and the write guard. */

package/dist/init/index.cjs

@@ -6333,9 +6333,11 @@ createExeca(mapScriptAsync, {}, deepScriptOptions, setScriptSync);
 const { sendMessage, getOneMessage, getEachMessage, getCancelSignal } = getIpcExport();
 //#endregion
 //#region src/supabaseConfig.ts
-const resolveSupabaseServiceRoleKey = (config) => {
-	if (!config.supabaseServiceRoleKey) throw new Error("Supabase service role key is required. Set supabaseServiceRoleKey.");
-	return config.supabaseServiceRoleKey;
+const resolveSupabaseServiceRoleKey = async (config) => {
+	const { supabaseServiceRoleKey } = config;
+	const key = typeof supabaseServiceRoleKey === "function" ? await supabaseServiceRoleKey() : supabaseServiceRoleKey;
+	if (!key) throw new Error("Supabase service role key is required. Set supabaseServiceRoleKey.");
+	return key;
 };
 //#endregion
 //#region src/supabaseInfrastructureNames.ts
@@ -6375,9 +6377,16 @@ const withCode = (error) => Object.assign(new Error(error.message, { cause: erro
 */
 const supabaseExecutor = (client) => {
 	let created;
-	const clientOf = () => typeof client === "function" ? created ??= client() : client;
+	const clientOf = async () => {
+		if (typeof client !== "function") return client;
+		created ??= Promise.resolve().then(client).catch((error) => {
+			created = void 0;
+			throw error;
+		});
+		return created;
+	};
 	const apply = async (statements) => {
-		const { data, error } = await clientOf().rpc(SUPABASE_APPLY_FUNCTION, { p_statements: statements.map(toApplyStatement) });
+		const { data, error } = await (await clientOf()).rpc(SUPABASE_APPLY_FUNCTION, { p_statements: statements.map(toApplyStatement) });
 		if (error) throw withCode(error);
 		return data;
 	};
@@ -6400,7 +6409,7 @@ const supabaseExecutor = (client) => {
 */
 const supabaseDatabase = (config) => {
 	const { migrations: _migrations, ...adapter } = (0, _hot_updater_plugin_core.createSqlAdapter)({
-		executor: supabaseExecutor(() => (0, _supabase_supabase_js.createClient)(config.supabaseUrl, resolveSupabaseServiceRoleKey(config))),
+		executor: supabaseExecutor(async () => (0, _supabase_supabase_js.createClient)(config.supabaseUrl, await resolveSupabaseServiceRoleKey(config))),
 		tablePrefix: SUPABASE_TABLE_PREFIX
 	});
 	return (0, _hot_updater_plugin_core.createEngineDatabase)({
@@ -6410,27 +6419,39 @@ const supabaseDatabase = (config) => {
 };
 //#endregion
 //#region iac/configTemplate.ts
-const getConfigScaffold = (build) => {
-	return (0, _hot_updater_cli_tools.createHotUpdaterConfigScaffoldFromBuilder)(new _hot_updater_cli_tools.ConfigBuilder().setBuildType(build).setStorage({
+/**
+* The config init writes. With the `resources` init set up, it names them,
+* and reads the service role key with `secret()`, from the environment and
+* `.env.hotupdater`, then the config's `secrets` adapter. Without them, as
+* the agent scaffold writes it before the agent creates the project, it
+* reads the URL and bucket from the environment, where the agent records
+* them, and the key with `secret()` alike.
+*/
+const getConfigScaffold = (build, resources) => {
+	const supabaseUrl = resources === void 0 ? "process.env.HOT_UPDATER_SUPABASE_URL!" : JSON.stringify(resources.supabaseUrl);
+	const serviceRoleKey = "secret(\"HOT_UPDATER_SUPABASE_SERVICE_ROLE_KEY\")";
+	const storageConfig = {
 		imports: [{
 			pkg: "@hot-updater/supabase",
 			named: ["supabaseStorage"]
 		}],
 		configString: `supabaseStorage({
-    supabaseUrl: process.env.HOT_UPDATER_SUPABASE_URL!,
-    supabaseServiceRoleKey: process.env.HOT_UPDATER_SUPABASE_SERVICE_ROLE_KEY!,
-    bucketName: process.env.HOT_UPDATER_SUPABASE_BUCKET_NAME!,
+    supabaseUrl: ${supabaseUrl},
+    supabaseServiceRoleKey: ${serviceRoleKey},
+    bucketName: ${resources === void 0 ? "process.env.HOT_UPDATER_SUPABASE_BUCKET_NAME!" : JSON.stringify(resources.bucketName)},
   })`
-	}).setDatabase({
+	};
+	const databaseConfig = {
 		imports: [{
 			pkg: "@hot-updater/supabase",
 			named: ["supabaseDatabase"]
 		}],
 		configString: `supabaseDatabase({
-    supabaseUrl: process.env.HOT_UPDATER_SUPABASE_URL!,
-    supabaseServiceRoleKey: process.env.HOT_UPDATER_SUPABASE_SERVICE_ROLE_KEY!,
+    supabaseUrl: ${supabaseUrl},
+    supabaseServiceRoleKey: ${serviceRoleKey},
   })`
-	}).setPlugins({
+	};
+	const builder = new _hot_updater_cli_tools.ConfigBuilder().setBuildType(build).setStorage(storageConfig).setDatabase(databaseConfig).setPlugins({
 		imports: [{
 			pkg: "hot-updater/plugins",
 			named: [
@@ -6440,7 +6461,12 @@ const getConfigScaffold = (build) => {
 			]
 		}],
 		configString: "[apiKeys(), insights(), remoteConfig()]"
-	}));
+	});
+	builder.addImport({
+		pkg: "hot-updater",
+		named: ["secret"]
+	});
+	return (0, _hot_updater_cli_tools.createHotUpdaterConfigScaffoldFromBuilder)(builder);
 };
 //#endregion
 //#region iac/init/index.ts
@@ -6546,7 +6572,8 @@ const initProvider = {
 				type: "password"
 			}
 		}
-	}
+	},
+	secrets: ["HOT_UPDATER_SUPABASE_SERVICE_ROLE_KEY"]
 };
 //#endregion
 //#region iac/supabaseApi.ts
@@ -7515,9 +7542,9 @@ const withSupabaseCliMetadataCleanup = async (cwd, operation) => {
 		});
 	}
 };
-const runInitWithoutCliMetadata = async ({ build, envFile }) => {
+const runInitWithoutCliMetadata = async ({ build, envFile, secretsEnv }) => {
 	const nonInteractive = envFile !== void 0;
-	const initEnvSources = await (0, _hot_updater_cli_tools.readHotUpdaterInitEnv)(process.cwd(), envFile);
+	const initEnvSources = await (0, _hot_updater_cli_tools.readHotUpdaterInitEnv)(process.cwd(), envFile, secretsEnv);
 	const { inputEnv, managedEnv } = initEnvSources;
 	const initInputEnv = (0, _hot_updater_cli_tools.getHotUpdaterInitInputEnv)(initEnvSources, nonInteractive);
 	const savedInputs = resolveSupabaseInitInputs(initInputEnv, {
@@ -7596,6 +7623,7 @@ const runInitWithoutCliMetadata = async ({ build, envFile }) => {
 	const { tmpDir, removeTmpDir } = await (0, _hot_updater_cli_tools.copyDirToTmp)(scaffoldLibPath, "supabase");
 	let credential;
 	let clientPlugins = [];
+	let resources;
 	try {
 		await stageEdgeFunction({
 			bucketName: bucketSelection.name,
@@ -7637,6 +7665,10 @@ const runInitWithoutCliMetadata = async ({ build, envFile }) => {
 			[initProvider.inputs.bucketName.envKey]: bucket.name,
 			HOT_UPDATER_SUPABASE_URL: `https://${project.id}.supabase.co`
 		});
+		resources = {
+			supabaseUrl: `https://${project.id}.supabase.co`,
+			bucketName: bucket.name
+		};
 		await linkSupabase(tmpDir, {
 			accessToken,
 			projectId: project.id,
@@ -7674,7 +7706,7 @@ const runInitWithoutCliMetadata = async ({ build, envFile }) => {
 		await removeTmpDir();
 	}
 	_hot_updater_cli_tools.p.log.success("Generated '.env.hotupdater' file with Supabase settings.");
-	await (0, _hot_updater_cli_tools.writeHotUpdaterFiles)(getConfigScaffold(build), {
+	await (0, _hot_updater_cli_tools.writeHotUpdaterFiles)(getConfigScaffold(build, resources), {
 		cwd: process.cwd(),
 		settings: "Supabase"
 	});

package/dist/init/index.d.cts

@@ -99,6 +99,7 @@ declare const initProvider: {
       };
     };
   };
+  readonly secrets: readonly ["HOT_UPDATER_SUPABASE_SERVICE_ROLE_KEY"];
 };
 //#endregion
 //#region iac/supabaseManagementApi.d.ts

package/dist/init/index.d.mts

@@ -99,6 +99,7 @@ declare const initProvider: {
       };
     };
   };
+  readonly secrets: readonly ["HOT_UPDATER_SUPABASE_SERVICE_ROLE_KEY"];
 };
 //#endregion
 //#region iac/supabaseManagementApi.d.ts

package/dist/init/index.mjs

@@ -6328,9 +6328,11 @@ createExeca(mapScriptAsync, {}, deepScriptOptions, setScriptSync);
 const { sendMessage, getOneMessage, getEachMessage, getCancelSignal } = getIpcExport();
 //#endregion
 //#region src/supabaseConfig.ts
-const resolveSupabaseServiceRoleKey = (config) => {
-	if (!config.supabaseServiceRoleKey) throw new Error("Supabase service role key is required. Set supabaseServiceRoleKey.");
-	return config.supabaseServiceRoleKey;
+const resolveSupabaseServiceRoleKey = async (config) => {
+	const { supabaseServiceRoleKey } = config;
+	const key = typeof supabaseServiceRoleKey === "function" ? await supabaseServiceRoleKey() : supabaseServiceRoleKey;
+	if (!key) throw new Error("Supabase service role key is required. Set supabaseServiceRoleKey.");
+	return key;
 };
 //#endregion
 //#region src/supabaseInfrastructureNames.ts
@@ -6370,9 +6372,16 @@ const withCode = (error) => Object.assign(new Error(error.message, { cause: erro
 */
 const supabaseExecutor = (client) => {
 	let created;
-	const clientOf = () => typeof client === "function" ? created ??= client() : client;
+	const clientOf = async () => {
+		if (typeof client !== "function") return client;
+		created ??= Promise.resolve().then(client).catch((error) => {
+			created = void 0;
+			throw error;
+		});
+		return created;
+	};
 	const apply = async (statements) => {
-		const { data, error } = await clientOf().rpc(SUPABASE_APPLY_FUNCTION, { p_statements: statements.map(toApplyStatement) });
+		const { data, error } = await (await clientOf()).rpc(SUPABASE_APPLY_FUNCTION, { p_statements: statements.map(toApplyStatement) });
 		if (error) throw withCode(error);
 		return data;
 	};
@@ -6395,7 +6404,7 @@ const supabaseExecutor = (client) => {
 */
 const supabaseDatabase = (config) => {
 	const { migrations: _migrations, ...adapter } = createSqlAdapter({
-		executor: supabaseExecutor(() => createClient(config.supabaseUrl, resolveSupabaseServiceRoleKey(config))),
+		executor: supabaseExecutor(async () => createClient(config.supabaseUrl, await resolveSupabaseServiceRoleKey(config))),
 		tablePrefix: SUPABASE_TABLE_PREFIX
 	});
 	return createEngineDatabase({
@@ -6405,27 +6414,39 @@ const supabaseDatabase = (config) => {
 };
 //#endregion
 //#region iac/configTemplate.ts
-const getConfigScaffold = (build) => {
-	return createHotUpdaterConfigScaffoldFromBuilder(new ConfigBuilder().setBuildType(build).setStorage({
+/**
+* The config init writes. With the `resources` init set up, it names them,
+* and reads the service role key with `secret()`, from the environment and
+* `.env.hotupdater`, then the config's `secrets` adapter. Without them, as
+* the agent scaffold writes it before the agent creates the project, it
+* reads the URL and bucket from the environment, where the agent records
+* them, and the key with `secret()` alike.
+*/
+const getConfigScaffold = (build, resources) => {
+	const supabaseUrl = resources === void 0 ? "process.env.HOT_UPDATER_SUPABASE_URL!" : JSON.stringify(resources.supabaseUrl);
+	const serviceRoleKey = "secret(\"HOT_UPDATER_SUPABASE_SERVICE_ROLE_KEY\")";
+	const storageConfig = {
 		imports: [{
 			pkg: "@hot-updater/supabase",
 			named: ["supabaseStorage"]
 		}],
 		configString: `supabaseStorage({
-    supabaseUrl: process.env.HOT_UPDATER_SUPABASE_URL!,
-    supabaseServiceRoleKey: process.env.HOT_UPDATER_SUPABASE_SERVICE_ROLE_KEY!,
-    bucketName: process.env.HOT_UPDATER_SUPABASE_BUCKET_NAME!,
+    supabaseUrl: ${supabaseUrl},
+    supabaseServiceRoleKey: ${serviceRoleKey},
+    bucketName: ${resources === void 0 ? "process.env.HOT_UPDATER_SUPABASE_BUCKET_NAME!" : JSON.stringify(resources.bucketName)},
   })`
-	}).setDatabase({
+	};
+	const databaseConfig = {
 		imports: [{
 			pkg: "@hot-updater/supabase",
 			named: ["supabaseDatabase"]
 		}],
 		configString: `supabaseDatabase({
-    supabaseUrl: process.env.HOT_UPDATER_SUPABASE_URL!,
-    supabaseServiceRoleKey: process.env.HOT_UPDATER_SUPABASE_SERVICE_ROLE_KEY!,
+    supabaseUrl: ${supabaseUrl},
+    supabaseServiceRoleKey: ${serviceRoleKey},
   })`
-	}).setPlugins({
+	};
+	const builder = new ConfigBuilder().setBuildType(build).setStorage(storageConfig).setDatabase(databaseConfig).setPlugins({
 		imports: [{
 			pkg: "hot-updater/plugins",
 			named: [
@@ -6435,7 +6456,12 @@ const getConfigScaffold = (build) => {
 			]
 		}],
 		configString: "[apiKeys(), insights(), remoteConfig()]"
-	}));
+	});
+	builder.addImport({
+		pkg: "hot-updater",
+		named: ["secret"]
+	});
+	return createHotUpdaterConfigScaffoldFromBuilder(builder);
 };
 //#endregion
 //#region iac/init/index.ts
@@ -6541,7 +6567,8 @@ const initProvider = {
 				type: "password"
 			}
 		}
-	}
+	},
+	secrets: ["HOT_UPDATER_SUPABASE_SERVICE_ROLE_KEY"]
 };
 //#endregion
 //#region iac/supabaseApi.ts
@@ -7510,9 +7537,9 @@ const withSupabaseCliMetadataCleanup = async (cwd, operation) => {
 		});
 	}
 };
-const runInitWithoutCliMetadata = async ({ build, envFile }) => {
+const runInitWithoutCliMetadata = async ({ build, envFile, secretsEnv }) => {
 	const nonInteractive = envFile !== void 0;
-	const initEnvSources = await readHotUpdaterInitEnv(process.cwd(), envFile);
+	const initEnvSources = await readHotUpdaterInitEnv(process.cwd(), envFile, secretsEnv);
 	const { inputEnv, managedEnv } = initEnvSources;
 	const initInputEnv = getHotUpdaterInitInputEnv(initEnvSources, nonInteractive);
 	const savedInputs = resolveSupabaseInitInputs(initInputEnv, {
@@ -7591,6 +7618,7 @@ const runInitWithoutCliMetadata = async ({ build, envFile }) => {
 	const { tmpDir, removeTmpDir } = await copyDirToTmp(scaffoldLibPath, "supabase");
 	let credential;
 	let clientPlugins = [];
+	let resources;
 	try {
 		await stageEdgeFunction({
 			bucketName: bucketSelection.name,
@@ -7632,6 +7660,10 @@ const runInitWithoutCliMetadata = async ({ build, envFile }) => {
 			[initProvider.inputs.bucketName.envKey]: bucket.name,
 			HOT_UPDATER_SUPABASE_URL: `https://${project.id}.supabase.co`
 		});
+		resources = {
+			supabaseUrl: `https://${project.id}.supabase.co`,
+			bucketName: bucket.name
+		};
 		await linkSupabase(tmpDir, {
 			accessToken,
 			projectId: project.id,
@@ -7669,7 +7701,7 @@ const runInitWithoutCliMetadata = async ({ build, envFile }) => {
 		await removeTmpDir();
 	}
 	p.log.success("Generated '.env.hotupdater' file with Supabase settings.");
-	await writeHotUpdaterFiles(getConfigScaffold(build), {
+	await writeHotUpdaterFiles(getConfigScaffold(build, resources), {
 		cwd: process.cwd(),
 		settings: "Supabase"
 	});

package/dist/{supabaseStorage-D4jcGa-l.mjs → supabaseStorage-B6IM8UX2.mjs}

@@ -1,9 +1,11 @@
 import { SETTINGS_TABLE, createEngineDatabase, createSqlAdapter, createStorageAdapter, createStorageKeyBuilder, createStorageUri, parseStorageUri } from "@hot-updater/plugin-core";
 import { createClient } from "@supabase/supabase-js";
 //#region src/supabaseConfig.ts
-const resolveSupabaseServiceRoleKey = (config) => {
-	if (!config.supabaseServiceRoleKey) throw new Error("Supabase service role key is required. Set supabaseServiceRoleKey.");
-	return config.supabaseServiceRoleKey;
+const resolveSupabaseServiceRoleKey = async (config) => {
+	const { supabaseServiceRoleKey } = config;
+	const key = typeof supabaseServiceRoleKey === "function" ? await supabaseServiceRoleKey() : supabaseServiceRoleKey;
+	if (!key) throw new Error("Supabase service role key is required. Set supabaseServiceRoleKey.");
+	return key;
 };
 //#endregion
 //#region src/supabaseInfrastructureNames.ts
@@ -42,9 +44,16 @@ const withCode = (error) => Object.assign(new Error(error.message, { cause: erro
 */
 const supabaseExecutor = (client) => {
 	let created;
-	const clientOf = () => typeof client === "function" ? created ??= client() : client;
+	const clientOf = async () => {
+		if (typeof client !== "function") return client;
+		created ??= Promise.resolve().then(client).catch((error) => {
+			created = void 0;
+			throw error;
+		});
+		return created;
+	};
 	const apply = async (statements) => {
-		const { data, error } = await clientOf().rpc(SUPABASE_APPLY_FUNCTION, { p_statements: statements.map(toApplyStatement) });
+		const { data, error } = await (await clientOf()).rpc(SUPABASE_APPLY_FUNCTION, { p_statements: statements.map(toApplyStatement) });
 		if (error) throw withCode(error);
 		return data;
 	};
@@ -67,7 +76,7 @@ const supabaseExecutor = (client) => {
 */
 const supabaseDatabase = (config) => {
 	const { migrations: _migrations, ...adapter } = createSqlAdapter({
-		executor: supabaseExecutor(() => createClient(config.supabaseUrl, resolveSupabaseServiceRoleKey(config))),
+		executor: supabaseExecutor(async () => createClient(config.supabaseUrl, await resolveSupabaseServiceRoleKey(config))),
 		tablePrefix: SUPABASE_TABLE_PREFIX
 	});
 	return createEngineDatabase({
@@ -157,7 +166,15 @@ const isMissingObjectError = async (error) => {
 };
 /** A character Storage rejects in an object name, `?`, or `!`. */
 const ESCAPED_CHARACTER = /[^A-Za-z0-9_/.*'() &$=@;:+,-]/gu;
+const ESCAPE_SEQUENCE = /!([0-9A-F]{2})/gu;
 const utf8 = new TextEncoder();
+const utf8Decoder = new TextDecoder("utf-8", { fatal: true });
+/** Objects Storage lists a page at a time. */
+const LIST_PAGE_SIZE = 1e3;
+/** Names Storage removes in one request. */
+const DELETE_BATCH_SIZE = 1e3;
+/** The object the Supabase dashboard keeps in a folder it creates. */
+const EMPTY_FOLDER_PLACEHOLDER = ".emptyFolderPlaceholder";
 /**
 * The object name Storage keeps a key under. Storage accepts names of ASCII
 * letters, digits and `_/!.*'() &$=@;:+,?-` only, and supabase-js puts a name
@@ -168,12 +185,44 @@ const utf8 = new TextEncoder();
 * Deploy's keys, such as `<bundleId>/manifest.json`, are stored as they are.
 */
 const toObjectName = (key) => key.replace(ESCAPED_CHARACTER, (character) => Array.from(utf8.encode(character), (byte) => `!${byte.toString(16).toUpperCase().padStart(2, "0")}`).join(""));
+/** The key `toObjectName` stored under `name`, or null for a name it never makes. */
+const fromObjectName = (name) => {
+	const bytes = [];
+	const parts = [];
+	const flush = () => {
+		if (bytes.length === 0) return true;
+		try {
+			parts.push(utf8Decoder.decode(new Uint8Array(bytes)));
+		} catch {
+			return false;
+		}
+		bytes.length = 0;
+		return true;
+	};
+	let index = 0;
+	for (const match of name.matchAll(ESCAPE_SEQUENCE)) {
+		if (match.index !== index) {
+			if (!flush()) return null;
+			parts.push(name.slice(index, match.index));
+		}
+		bytes.push(Number.parseInt(match[1], 16));
+		index = match.index + match[0].length;
+	}
+	if (!flush()) return null;
+	parts.push(name.slice(index));
+	const key = parts.join("");
+	return toObjectName(key) === name ? key : null;
+};
 const supabaseStorage = (config) => {
 	let client;
-	const bucket = () => (client ??= createClient(config.supabaseUrl, resolveSupabaseServiceRoleKey(config))).storage.from(config.bucketName);
+	const bucket = async () => (await (client ??= resolveSupabaseServiceRoleKey(config).then((key) => createClient(config.supabaseUrl, key), (error) => {
+		client = void 0;
+		throw error;
+	}))).storage.from(config.bucketName);
 	const getStorageKey = createStorageKeyBuilder(config.basePath);
+	const basePrefix = getStorageKey() ? `${getStorageKey()}/` : "";
 	const resolveSignedUrl = createSupabaseSignedUrlBatcher({
-		createSignedUrls: (_bucketName, keys, expiresIn) => bucket().createSignedUrls(keys, expiresIn),
+		createSignedUrls: async (_bucketName, keys, expiresIn) => (await bucket()).createSignedUrls(keys, expiresIn),
 		expiresIn: config.signedUrlExpiresIn ?? 3600,
 		formatObjectPath: (_bucketName, key) => key
 	});
@@ -187,7 +236,7 @@ const supabaseStorage = (config) => {
 		protocol: "supabase-storage",
 		async put({ key, body, contentLength, contentType }) {
 			const storageKey = getStorageKey(key);
-			const { error } = await bucket().upload(toObjectName(storageKey), body, {
+			const { error } = await (await bucket()).upload(toObjectName(storageKey), body, {
 				contentType,
 				cacheControl: "max-age=31536000",
 				upsert: true,
@@ -203,7 +252,7 @@ const supabaseStorage = (config) => {
 		},
 		async get({ storageUri }) {
 			const { key } = parseAndValidate(storageUri);
-			const { data, error } = await bucket().download(toObjectName(key));
+			const { data, error } = await (await bucket()).download(toObjectName(key));
 			if (error) {
 				if (await isMissingObjectError(error)) return { response: null };
 				throw new Error(`Failed to download storage object: ${error.message}`);
@@ -216,7 +265,7 @@ const supabaseStorage = (config) => {
 		},
 		async exists({ storageUri }) {
 			const { key } = parseAndValidate(storageUri);
-			const { data, error } = await bucket().exists(toObjectName(key));
+			const { data, error } = await (await bucket()).exists(toObjectName(key));
 			if (error) {
 				if (isMissingExistsError(error)) return { exists: false };
 				throw error;
@@ -225,9 +274,54 @@ const supabaseStorage = (config) => {
 		},
 		async delete({ storageUri }) {
 			const { key } = parseAndValidate(storageUri);
-			const { error } = await bucket().remove([toObjectName(key)]);
+			const { error } = await (await bucket()).remove([toObjectName(key)]);
 			if (error && !isNotFoundError(error)) throw new Error(`Failed to delete storage object: ${error.message}`);
 			return { deleted: true };
+		},
+		async listObjects(prefix) {
+			const objects = [];
+			const folder = toObjectName(getStorageKey(prefix ?? ""));
+			let cursor;
+			do {
+				const { data, error } = await (await bucket()).listV2({
+					prefix: folder ? `${folder}/` : "",
+					limit: LIST_PAGE_SIZE,
+					...cursor === void 0 ? {} : { cursor }
+				});
+				if (error) throw new Error(`Failed to list storage objects: ${error.message}`);
+				for (const entry of data.objects) {
+					const name = entry.key ?? entry.name;
+					if (name.split("/").at(-1) === EMPTY_FOLDER_PLACEHOLDER) continue;
+					const key = fromObjectName(name);
+					if (key === null || !key.startsWith(basePrefix)) continue;
+					let storageUri;
+					try {
+						storageUri = createStorageUri({
+							protocol: "supabase-storage",
+							bucket: config.bucketName,
+							key
+						});
+					} catch {
+						continue;
+					}
+					const updatedAt = entry.updated_at ?? entry.created_at;
+					objects.push({
+						key: key.slice(basePrefix.length),
+						...updatedAt ? { lastModifiedAt: new Date(updatedAt) } : {},
+						size: Number(entry.metadata?.size ?? 0),
+						storageUri
+					});
+				}
+				cursor = data.hasNext ? data.nextCursor : void 0;
+			} while (cursor !== void 0);
+			return objects;
+		},
+		async deleteObjects(relativeKeys) {
+			const names = relativeKeys.map((key) => toObjectName(getStorageKey(key)));
+			for (let offset = 0; offset < names.length; offset += DELETE_BATCH_SIZE) {
+				const { error } = await (await bucket()).remove(names.slice(offset, offset + DELETE_BATCH_SIZE));
+				if (error && !isNotFoundError(error)) throw new Error(`Failed to delete storage objects: ${error.message}`);
+			}
 		}
 	});
 };

package/dist/{supabaseStorage-BryXQ72m.d.cts → supabaseStorage-C9W-69OP.d.cts}

@@ -1,8 +1,13 @@
-import { EngineDatabase, StorageAdapterWith } from "@hot-updater/plugin-core";
+import { EngineDatabase, Lazy, StorageAdapterWith } from "@hot-updater/plugin-core";
 //#region src/supabaseConfig.d.ts
 type SupabaseServiceRoleConfig = {
   supabaseUrl: string;
-  supabaseServiceRoleKey: string;
+  /**
+   * The project's service role key, or a function that returns it, such as
+   * `secret("<name>")` in `hot-updater.config.ts`: called on the first
+   * request, so a config loads without the key.
+   */
+  supabaseServiceRoleKey: Lazy<string>;
 };
 //#endregion
 //#region src/supabaseDatabase.d.ts
@@ -23,6 +28,6 @@ type SupabaseStorageConfig = SupabaseServiceRoleConfig & {
   /** Signed download URL lifetime in seconds. @default 3600 */
   signedUrlExpiresIn?: number;
 };
-declare const supabaseStorage: (config: SupabaseStorageConfig) => StorageAdapterWith<"put" | "get" | "getDownloadUrl" | "exists" | "delete">;
+declare const supabaseStorage: (config: SupabaseStorageConfig) => StorageAdapterWith<"put" | "get" | "getDownloadUrl" | "exists" | "delete" | "listObjects" | "deleteObjects">;
 //#endregion
 export { supabaseDatabase as i, supabaseStorage as n, SupabaseDatabaseConfig as r, SupabaseStorageConfig as t };

package/dist/{supabaseStorage-BryXQ72m.d.mts → supabaseStorage-C9W-69OP.d.mts}

@@ -1,8 +1,13 @@
-import { EngineDatabase, StorageAdapterWith } from "@hot-updater/plugin-core";
+import { EngineDatabase, Lazy, StorageAdapterWith } from "@hot-updater/plugin-core";
 //#region src/supabaseConfig.d.ts
 type SupabaseServiceRoleConfig = {
   supabaseUrl: string;
-  supabaseServiceRoleKey: string;
+  /**
+   * The project's service role key, or a function that returns it, such as
+   * `secret("<name>")` in `hot-updater.config.ts`: called on the first
+   * request, so a config loads without the key.
+   */
+  supabaseServiceRoleKey: Lazy<string>;
 };
 //#endregion
 //#region src/supabaseDatabase.d.ts
@@ -23,6 +28,6 @@ type SupabaseStorageConfig = SupabaseServiceRoleConfig & {
   /** Signed download URL lifetime in seconds. @default 3600 */
   signedUrlExpiresIn?: number;
 };
-declare const supabaseStorage: (config: SupabaseStorageConfig) => StorageAdapterWith<"put" | "get" | "getDownloadUrl" | "exists" | "delete">;
+declare const supabaseStorage: (config: SupabaseStorageConfig) => StorageAdapterWith<"put" | "get" | "getDownloadUrl" | "exists" | "delete" | "listObjects" | "deleteObjects">;
 //#endregion
 export { supabaseDatabase as i, supabaseStorage as n, SupabaseDatabaseConfig as r, SupabaseStorageConfig as t };

package/dist/{supabaseStorage-MqoRcaii.cjs → supabaseStorage-DUa49vGh.cjs}

@@ -1,9 +1,11 @@
 let _hot_updater_plugin_core = require("@hot-updater/plugin-core");
 let _supabase_supabase_js = require("@supabase/supabase-js");
 //#region src/supabaseConfig.ts
-const resolveSupabaseServiceRoleKey = (config) => {
-	if (!config.supabaseServiceRoleKey) throw new Error("Supabase service role key is required. Set supabaseServiceRoleKey.");
-	return config.supabaseServiceRoleKey;
+const resolveSupabaseServiceRoleKey = async (config) => {
+	const { supabaseServiceRoleKey } = config;
+	const key = typeof supabaseServiceRoleKey === "function" ? await supabaseServiceRoleKey() : supabaseServiceRoleKey;
+	if (!key) throw new Error("Supabase service role key is required. Set supabaseServiceRoleKey.");
+	return key;
 };
 //#endregion
 //#region src/supabaseInfrastructureNames.ts
@@ -42,9 +44,16 @@ const withCode = (error) => Object.assign(new Error(error.message, { cause: erro
 */
 const supabaseExecutor = (client) => {
 	let created;
-	const clientOf = () => typeof client === "function" ? created ??= client() : client;
+	const clientOf = async () => {
+		if (typeof client !== "function") return client;
+		created ??= Promise.resolve().then(client).catch((error) => {
+			created = void 0;
+			throw error;
+		});
+		return created;
+	};
 	const apply = async (statements) => {
-		const { data, error } = await clientOf().rpc(SUPABASE_APPLY_FUNCTION, { p_statements: statements.map(toApplyStatement) });
+		const { data, error } = await (await clientOf()).rpc(SUPABASE_APPLY_FUNCTION, { p_statements: statements.map(toApplyStatement) });
 		if (error) throw withCode(error);
 		return data;
 	};
@@ -67,7 +76,7 @@ const supabaseExecutor = (client) => {
 */
 const supabaseDatabase = (config) => {
 	const { migrations: _migrations, ...adapter } = (0, _hot_updater_plugin_core.createSqlAdapter)({
-		executor: supabaseExecutor(() => (0, _supabase_supabase_js.createClient)(config.supabaseUrl, resolveSupabaseServiceRoleKey(config))),
+		executor: supabaseExecutor(async () => (0, _supabase_supabase_js.createClient)(config.supabaseUrl, await resolveSupabaseServiceRoleKey(config))),
 		tablePrefix: SUPABASE_TABLE_PREFIX
 	});
 	return (0, _hot_updater_plugin_core.createEngineDatabase)({
@@ -157,7 +166,15 @@ const isMissingObjectError = async (error) => {
 };
 /** A character Storage rejects in an object name, `?`, or `!`. */
 const ESCAPED_CHARACTER = /[^A-Za-z0-9_/.*'() &$=@;:+,-]/gu;
+const ESCAPE_SEQUENCE = /!([0-9A-F]{2})/gu;
 const utf8 = new TextEncoder();
+const utf8Decoder = new TextDecoder("utf-8", { fatal: true });
+/** Objects Storage lists a page at a time. */
+const LIST_PAGE_SIZE = 1e3;
+/** Names Storage removes in one request. */
+const DELETE_BATCH_SIZE = 1e3;
+/** The object the Supabase dashboard keeps in a folder it creates. */
+const EMPTY_FOLDER_PLACEHOLDER = ".emptyFolderPlaceholder";
 /**
 * The object name Storage keeps a key under. Storage accepts names of ASCII
 * letters, digits and `_/!.*'() &$=@;:+,?-` only, and supabase-js puts a name
@@ -168,12 +185,44 @@ const utf8 = new TextEncoder();
 * Deploy's keys, such as `<bundleId>/manifest.json`, are stored as they are.
 */
 const toObjectName = (key) => key.replace(ESCAPED_CHARACTER, (character) => Array.from(utf8.encode(character), (byte) => `!${byte.toString(16).toUpperCase().padStart(2, "0")}`).join(""));
+/** The key `toObjectName` stored under `name`, or null for a name it never makes. */
+const fromObjectName = (name) => {
+	const bytes = [];
+	const parts = [];
+	const flush = () => {
+		if (bytes.length === 0) return true;
+		try {
+			parts.push(utf8Decoder.decode(new Uint8Array(bytes)));
+		} catch {
+			return false;
+		}
+		bytes.length = 0;
+		return true;
+	};
+	let index = 0;
+	for (const match of name.matchAll(ESCAPE_SEQUENCE)) {
+		if (match.index !== index) {
+			if (!flush()) return null;
+			parts.push(name.slice(index, match.index));
+		}
+		bytes.push(Number.parseInt(match[1], 16));
+		index = match.index + match[0].length;
+	}
+	if (!flush()) return null;
+	parts.push(name.slice(index));
+	const key = parts.join("");
+	return toObjectName(key) === name ? key : null;
+};
 const supabaseStorage = (config) => {
 	let client;
-	const bucket = () => (client ??= (0, _supabase_supabase_js.createClient)(config.supabaseUrl, resolveSupabaseServiceRoleKey(config))).storage.from(config.bucketName);
+	const bucket = async () => (await (client ??= resolveSupabaseServiceRoleKey(config).then((key) => (0, _supabase_supabase_js.createClient)(config.supabaseUrl, key), (error) => {
+		client = void 0;
+		throw error;
+	}))).storage.from(config.bucketName);
 	const getStorageKey = (0, _hot_updater_plugin_core.createStorageKeyBuilder)(config.basePath);
+	const basePrefix = getStorageKey() ? `${getStorageKey()}/` : "";
 	const resolveSignedUrl = createSupabaseSignedUrlBatcher({
-		createSignedUrls: (_bucketName, keys, expiresIn) => bucket().createSignedUrls(keys, expiresIn),
+		createSignedUrls: async (_bucketName, keys, expiresIn) => (await bucket()).createSignedUrls(keys, expiresIn),
 		expiresIn: config.signedUrlExpiresIn ?? 3600,
 		formatObjectPath: (_bucketName, key) => key
 	});
@@ -187,7 +236,7 @@ const supabaseStorage = (config) => {
 		protocol: "supabase-storage",
 		async put({ key, body, contentLength, contentType }) {
 			const storageKey = getStorageKey(key);
-			const { error } = await bucket().upload(toObjectName(storageKey), body, {
+			const { error } = await (await bucket()).upload(toObjectName(storageKey), body, {
 				contentType,
 				cacheControl: "max-age=31536000",
 				upsert: true,
@@ -203,7 +252,7 @@ const supabaseStorage = (config) => {
 		},
 		async get({ storageUri }) {
 			const { key } = parseAndValidate(storageUri);
-			const { data, error } = await bucket().download(toObjectName(key));
+			const { data, error } = await (await bucket()).download(toObjectName(key));
 			if (error) {
 				if (await isMissingObjectError(error)) return { response: null };
 				throw new Error(`Failed to download storage object: ${error.message}`);
@@ -216,7 +265,7 @@ const supabaseStorage = (config) => {
 		},
 		async exists({ storageUri }) {
 			const { key } = parseAndValidate(storageUri);
-			const { data, error } = await bucket().exists(toObjectName(key));
+			const { data, error } = await (await bucket()).exists(toObjectName(key));
 			if (error) {
 				if (isMissingExistsError(error)) return { exists: false };
 				throw error;
@@ -225,9 +274,54 @@ const supabaseStorage = (config) => {
 		},
 		async delete({ storageUri }) {
 			const { key } = parseAndValidate(storageUri);
-			const { error } = await bucket().remove([toObjectName(key)]);
+			const { error } = await (await bucket()).remove([toObjectName(key)]);
 			if (error && !isNotFoundError(error)) throw new Error(`Failed to delete storage object: ${error.message}`);
 			return { deleted: true };
+		},
+		async listObjects(prefix) {
+			const objects = [];
+			const folder = toObjectName(getStorageKey(prefix ?? ""));
+			let cursor;
+			do {
+				const { data, error } = await (await bucket()).listV2({
+					prefix: folder ? `${folder}/` : "",
+					limit: LIST_PAGE_SIZE,
+					...cursor === void 0 ? {} : { cursor }
+				});
+				if (error) throw new Error(`Failed to list storage objects: ${error.message}`);
+				for (const entry of data.objects) {
+					const name = entry.key ?? entry.name;
+					if (name.split("/").at(-1) === EMPTY_FOLDER_PLACEHOLDER) continue;
+					const key = fromObjectName(name);
+					if (key === null || !key.startsWith(basePrefix)) continue;
+					let storageUri;
+					try {
+						storageUri = (0, _hot_updater_plugin_core.createStorageUri)({
+							protocol: "supabase-storage",
+							bucket: config.bucketName,
+							key
+						});
+					} catch {
+						continue;
+					}
+					const updatedAt = entry.updated_at ?? entry.created_at;
+					objects.push({
+						key: key.slice(basePrefix.length),
+						...updatedAt ? { lastModifiedAt: new Date(updatedAt) } : {},
+						size: Number(entry.metadata?.size ?? 0),
+						storageUri
+					});
+				}
+				cursor = data.hasNext ? data.nextCursor : void 0;
+			} while (cursor !== void 0);
+			return objects;
+		},
+		async deleteObjects(relativeKeys) {
+			const names = relativeKeys.map((key) => toObjectName(getStorageKey(key)));
+			for (let offset = 0; offset < names.length; offset += DELETE_BATCH_SIZE) {
+				const { error } = await (await bucket()).remove(names.slice(offset, offset + DELETE_BATCH_SIZE));
+				if (error && !isNotFoundError(error)) throw new Error(`Failed to delete storage objects: ${error.message}`);
+			}
 		}
 	});
 };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@hot-updater/supabase",
   "type": "module",
-  "version": "1.2.0-rc.1",
+  "version": "1.2.0-rc.11",
   "description": "React Native OTA solution for self-hosted",
   "main": "dist/index.cjs",
   "module": "dist/index.mjs",
@@ -51,10 +51,10 @@
     "@supabase/supabase-js": "2.76.1",
     "hono": "4.12.34",
     "uuidv7": "^1.0.2",
-    "@hot-updater/protocol": "1.2.0-rc.1",
-    "@hot-updater/plugin-core": "1.2.0-rc.1",
-    "@hot-updater/cli-tools": "1.2.0-rc.1",
-    "@hot-updater/server": "1.2.0-rc.1"
+    "@hot-updater/protocol": "1.2.0-rc.11",
+    "@hot-updater/plugin-core": "1.2.0-rc.11",
+    "@hot-updater/cli-tools": "1.2.0-rc.11",
+    "@hot-updater/server": "1.2.0-rc.11"
   },
   "devDependencies": {
     "@electric-sql/pglite": "0.4.1",
@@ -64,9 +64,9 @@
     "execa": "9.5.2",
     "@types/node": "^20",
     "mime": "^4.0.4",
-    "@hot-updater/test-utils": "1.2.0-rc.1",
-    "@hot-updater/postgres": "1.2.0-rc.1",
-    "@hot-updater/mock": "1.2.0-rc.1"
+    "@hot-updater/mock": "1.2.0-rc.11",
+    "@hot-updater/test-utils": "1.2.0-rc.11",
+    "@hot-updater/postgres": "1.2.0-rc.11"
   },
   "scripts": {
     "build": "tsdown",