@managemint-solutions/sdk 0.49.0 → 0.51.0

package/dist/index.d.ts

@@ -17,7 +17,7 @@ export type { CreateFeatureRequestRow, CreatedFeatureRequest } from './feature-r
 export { CreateFeatureRequestDto } from './feature-requests';
 export { CreateConfigDto, UpdateConfigDto } from './configs';
 export { CreateSupportRequestDto } from './support';
-export { AddStatusDto, GetStatusesDto, StatusIdDto, UpdateStatusDto } from './statuses';
+export { AddStatusDto, GetStatusesDto, ReorderStatusesDto, StatusIdDto, UpdateStatusDto } from './statuses';
 export { AddLabelDto, GetLabelsDto, LabelIdDto, UpdateLabelDto } from './labels';
 export { AddAdditionalDetailsDto, AdditionalDetailsIdDto, GetAdditionalDetailsDto, IsAdditionalDetailsValueByType, UpdateAdditionalDetailsDto, } from './additional-details';
 export { AddNoteDto, GetNotesDto, NoteIdDto } from './notes';
@@ -33,7 +33,7 @@ export { UpdatePermissionsDto } from './permissions';
 export type { UserEmploymentRow, UserRow } from './users';
 export { AddUserDto, GetUsersQueryDto, UpdateMyProfileDto, UpdateUserDto, UserIdDto, } from './users';
 export type { ClaimOutcome, WebhookEventRow, WebhookEventsTable } from './webhook-events';
-export { GetSupportingFilesDto, SupportingFileIdDto } from './supporting-files';
+export { GetSupportingFilesDto, SupportingFileIdDto, SupportingFileNamesDto } from './supporting-files';
 export { ClientIdDto, CreateClientDto, GetClientsDto, UpdateClientDto } from './clients';
 export { ConvertLeadDto, CreateLeadDto, GetLeadsDto, LeadIdDto, UpdateLeadDto } from './leads';
 export { CreateProjectDto, GetProjectsDto, ProjectIdDto, UpdateProjectDto } from './projects';

package/dist/index.js

@@ -7,9 +7,9 @@
 // their classes are not exported: a consumer never constructs one, and every export is a contract
 // to keep. The row and input types they produce and accept are exported for annotations.
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AddUserDto = exports.UpdatePermissionsDto = exports.PermissionsResource = exports.UpdateOrganizationDto = exports.CreateOrganizationDto = exports.NotificationIdDto = exports.GetNotificationsDto = exports.NoteIdDto = exports.GetNotesDto = exports.AddNoteDto = exports.UpdateAdditionalDetailsDto = exports.IsAdditionalDetailsValueByType = exports.GetAdditionalDetailsDto = exports.AdditionalDetailsIdDto = exports.AddAdditionalDetailsDto = exports.UpdateLabelDto = exports.LabelIdDto = exports.GetLabelsDto = exports.AddLabelDto = exports.UpdateStatusDto = exports.StatusIdDto = exports.GetStatusesDto = exports.AddStatusDto = exports.CreateSupportRequestDto = exports.UpdateConfigDto = exports.CreateConfigDto = exports.CreateFeatureRequestDto = exports.InvoiceIdDto = exports.GetInvoicesQueryDto = exports.ReinstateSubscriptionDto = exports.PurchaseModuleDto = exports.PaymentIdDto = exports.InitialPaymentDto = exports.GetPaymentsQueryDto = exports.CancelSubscriptionDto = exports.GetAuditTrailDto = exports.IsNullable = exports.EmptyToNull = exports.SupabaseClientError = exports.createSupabaseServiceClient = exports.SupabaseServiceClient = exports.SignInDto = exports.SendPasswordResetEmailDto = exports.ResetPasswordDto = exports.ExchangeTokenHashDto = exports.ExchangeRefreshTokenDto = exports.createSupabaseAuthClient = exports.SupabaseAuthClient = exports.createSupabaseClient = exports.SupabaseClient = void 0;
-exports.shiftDays = exports.proRataDays = exports.isWithinPeriod = exports.initialUntil = exports.cyclePeriodFor = exports.countWorkingDays = exports.completedMonths = exports.addMonths = exports.GetPublicHolidaysDto = exports.UpdateLeaveTypeDto = exports.UpdateLeaveRequestDto = exports.UpdateLeaveEntitlementDto = exports.ReviewLeaveRequestDto = exports.LeaveTypeIdDto = exports.LeaveRequestIdDto = exports.LeaveEntitlementIdDto = exports.GetLeaveTypesDto = exports.GetLeaveRequestsDto = exports.GetLeaveEntitlementsDto = exports.GetLeaveCalendarDto = exports.CreateLeaveTypeDto = exports.CreateLeaveRequestDto = exports.CreateLeaveEntitlementDto = exports.CreateLeaveAdjustmentDto = exports.BulkCreateLeaveEntitlementsDto = exports.UpdateTaskDto = exports.TaskLinkIdDto = exports.TaskIdDto = exports.GetTasksDto = exports.CreateTaskDto = exports.AddTaskLinkDto = exports.UpdateProjectDto = exports.ProjectIdDto = exports.GetProjectsDto = exports.CreateProjectDto = exports.UpdateLeadDto = exports.LeadIdDto = exports.GetLeadsDto = exports.CreateLeadDto = exports.ConvertLeadDto = exports.UpdateClientDto = exports.GetClientsDto = exports.CreateClientDto = exports.ClientIdDto = exports.SupportingFileIdDto = exports.GetSupportingFilesDto = exports.UserIdDto = exports.UpdateUserDto = exports.UpdateMyProfileDto = exports.GetUsersQueryDto = void 0;
-exports.monthlyTotalMinor = exports.weekStartOf = exports.minutesBetween = exports.UpdateTimesheetEntryDto = exports.TimesheetIdDto = exports.TimesheetEntryIdDto = exports.ReviewTimesheetDto = exports.GetTimesheetsDto = exports.GetTimesheetReportDto = exports.CreateTimesheetEntryDto = exports.todayInJohannesburg = void 0;
+exports.UpdatePermissionsDto = exports.PermissionsResource = exports.UpdateOrganizationDto = exports.CreateOrganizationDto = exports.NotificationIdDto = exports.GetNotificationsDto = exports.NoteIdDto = exports.GetNotesDto = exports.AddNoteDto = exports.UpdateAdditionalDetailsDto = exports.IsAdditionalDetailsValueByType = exports.GetAdditionalDetailsDto = exports.AdditionalDetailsIdDto = exports.AddAdditionalDetailsDto = exports.UpdateLabelDto = exports.LabelIdDto = exports.GetLabelsDto = exports.AddLabelDto = exports.UpdateStatusDto = exports.StatusIdDto = exports.ReorderStatusesDto = exports.GetStatusesDto = exports.AddStatusDto = exports.CreateSupportRequestDto = exports.UpdateConfigDto = exports.CreateConfigDto = exports.CreateFeatureRequestDto = exports.InvoiceIdDto = exports.GetInvoicesQueryDto = exports.ReinstateSubscriptionDto = exports.PurchaseModuleDto = exports.PaymentIdDto = exports.InitialPaymentDto = exports.GetPaymentsQueryDto = exports.CancelSubscriptionDto = exports.GetAuditTrailDto = exports.IsNullable = exports.EmptyToNull = exports.SupabaseClientError = exports.createSupabaseServiceClient = exports.SupabaseServiceClient = exports.SignInDto = exports.SendPasswordResetEmailDto = exports.ResetPasswordDto = exports.ExchangeTokenHashDto = exports.ExchangeRefreshTokenDto = exports.createSupabaseAuthClient = exports.SupabaseAuthClient = exports.createSupabaseClient = exports.SupabaseClient = void 0;
+exports.isWithinPeriod = exports.initialUntil = exports.cyclePeriodFor = exports.countWorkingDays = exports.completedMonths = exports.addMonths = exports.GetPublicHolidaysDto = exports.UpdateLeaveTypeDto = exports.UpdateLeaveRequestDto = exports.UpdateLeaveEntitlementDto = exports.ReviewLeaveRequestDto = exports.LeaveTypeIdDto = exports.LeaveRequestIdDto = exports.LeaveEntitlementIdDto = exports.GetLeaveTypesDto = exports.GetLeaveRequestsDto = exports.GetLeaveEntitlementsDto = exports.GetLeaveCalendarDto = exports.CreateLeaveTypeDto = exports.CreateLeaveRequestDto = exports.CreateLeaveEntitlementDto = exports.CreateLeaveAdjustmentDto = exports.BulkCreateLeaveEntitlementsDto = exports.UpdateTaskDto = exports.TaskLinkIdDto = exports.TaskIdDto = exports.GetTasksDto = exports.CreateTaskDto = exports.AddTaskLinkDto = exports.UpdateProjectDto = exports.ProjectIdDto = exports.GetProjectsDto = exports.CreateProjectDto = exports.UpdateLeadDto = exports.LeadIdDto = exports.GetLeadsDto = exports.CreateLeadDto = exports.ConvertLeadDto = exports.UpdateClientDto = exports.GetClientsDto = exports.CreateClientDto = exports.ClientIdDto = exports.SupportingFileNamesDto = exports.SupportingFileIdDto = exports.GetSupportingFilesDto = exports.UserIdDto = exports.UpdateUserDto = exports.UpdateMyProfileDto = exports.GetUsersQueryDto = exports.AddUserDto = void 0;
+exports.monthlyTotalMinor = exports.weekStartOf = exports.minutesBetween = exports.UpdateTimesheetEntryDto = exports.TimesheetIdDto = exports.TimesheetEntryIdDto = exports.ReviewTimesheetDto = exports.GetTimesheetsDto = exports.GetTimesheetReportDto = exports.CreateTimesheetEntryDto = exports.todayInJohannesburg = exports.shiftDays = exports.proRataDays = void 0;
 var client_1 = require("./client");
 Object.defineProperty(exports, "SupabaseClient", { enumerable: true, get: function () { return client_1.SupabaseClient; } });
 Object.defineProperty(exports, "createSupabaseClient", { enumerable: true, get: function () { return client_1.createSupabaseClient; } });
@@ -52,6 +52,7 @@ Object.defineProperty(exports, "CreateSupportRequestDto", { enumerable: true, ge
 var statuses_1 = require("./statuses");
 Object.defineProperty(exports, "AddStatusDto", { enumerable: true, get: function () { return statuses_1.AddStatusDto; } });
 Object.defineProperty(exports, "GetStatusesDto", { enumerable: true, get: function () { return statuses_1.GetStatusesDto; } });
+Object.defineProperty(exports, "ReorderStatusesDto", { enumerable: true, get: function () { return statuses_1.ReorderStatusesDto; } });
 Object.defineProperty(exports, "StatusIdDto", { enumerable: true, get: function () { return statuses_1.StatusIdDto; } });
 Object.defineProperty(exports, "UpdateStatusDto", { enumerable: true, get: function () { return statuses_1.UpdateStatusDto; } });
 var labels_1 = require("./labels");
@@ -90,6 +91,7 @@ Object.defineProperty(exports, "UserIdDto", { enumerable: true, get: function ()
 var supporting_files_1 = require("./supporting-files");
 Object.defineProperty(exports, "GetSupportingFilesDto", { enumerable: true, get: function () { return supporting_files_1.GetSupportingFilesDto; } });
 Object.defineProperty(exports, "SupportingFileIdDto", { enumerable: true, get: function () { return supporting_files_1.SupportingFileIdDto; } });
+Object.defineProperty(exports, "SupportingFileNamesDto", { enumerable: true, get: function () { return supporting_files_1.SupportingFileNamesDto; } });
 var clients_1 = require("./clients");
 Object.defineProperty(exports, "ClientIdDto", { enumerable: true, get: function () { return clients_1.ClientIdDto; } });
 Object.defineProperty(exports, "CreateClientDto", { enumerable: true, get: function () { return clients_1.CreateClientDto; } });

package/dist/statuses/dto.d.ts

@@ -1,4 +1,4 @@
-import type { AddStatusDto as AddStatusDtoType, GetStatusesDto as GetStatusesDtoType, StatusIdDto as StatusIdDtoType, UpdateStatusDto as UpdateStatusDtoType } from '@managemint-solutions/entities/status/dto';
+import type { AddStatusDto as AddStatusDtoType, GetStatusesDto as GetStatusesDtoType, ReorderStatusesDto as ReorderStatusesDtoType, StatusIdDto as StatusIdDtoType, UpdateStatusDto as UpdateStatusDtoType } from '@managemint-solutions/entities/status/dto';
 import { StatusEntityTypes } from '@managemint-solutions/entities/status/enum';
 export declare class StatusIdDto implements StatusIdDtoType {
     readonly statusId: string;
@@ -12,6 +12,9 @@ export declare class AddStatusDto implements AddStatusDtoType {
     readonly entity: StatusEntityTypes;
     readonly is_complete?: boolean;
 }
+export declare class ReorderStatusesDto implements ReorderStatusesDtoType {
+    readonly status_ids: string[];
+}
 export declare class UpdateStatusDto implements UpdateStatusDtoType {
     readonly label: string;
     readonly colour: string;

package/dist/statuses/dto.js

@@ -9,7 +9,7 @@ var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.UpdateStatusDto = exports.AddStatusDto = exports.GetStatusesDto = exports.StatusIdDto = void 0;
+exports.UpdateStatusDto = exports.ReorderStatusesDto = exports.AddStatusDto = exports.GetStatusesDto = exports.StatusIdDto = void 0;
 const class_validator_1 = require("class-validator");
 const enum_1 = require("@managemint-solutions/entities/status/enum");
 // class-validator versions of the shared DTO types from @managemint-solutions/entities.
@@ -62,6 +62,18 @@ __decorate([
     (0, class_validator_1.IsBoolean)({ message: 'is_complete must be true or false' }),
     __metadata("design:type", Boolean)
 ], AddStatusDto.prototype, "is_complete", void 0);
+class ReorderStatusesDto {
+    // The whole catalogue of the entity type in its new order; the resource checks it is complete
+    // and has no repeats, which the decorators cannot (they do not know the organization).
+    status_ids;
+}
+exports.ReorderStatusesDto = ReorderStatusesDto;
+__decorate([
+    (0, class_validator_1.IsArray)({ message: 'status_ids must be an array' }),
+    (0, class_validator_1.ArrayMinSize)(1, { message: 'status_ids cannot be empty' }),
+    (0, class_validator_1.IsUUID)('7', { each: true, message: 'Invalid status ID format' }),
+    __metadata("design:type", Array)
+], ReorderStatusesDto.prototype, "status_ids", void 0);
 class UpdateStatusDto {
     label;
     // Colour must be a valid hex code (e.g., #FFFFFF)

package/dist/statuses/index.d.ts

@@ -1,5 +1,5 @@
 import type { StatusEntity } from '@managemint-solutions/entities/status';
-import type { AddStatusDto, UpdateStatusDto } from '@managemint-solutions/entities/status/dto';
+import type { AddStatusDto, ReorderStatusesDto, UpdateStatusDto } from '@managemint-solutions/entities/status/dto';
 import type { StatusEntityTypes } from '@managemint-solutions/entities/status/enum';
 import type { AuthContext } from '../auth';
 import { type AuditResource } from '../audit';
@@ -10,8 +10,17 @@ export declare class StatusesResource {
     private readonly auth;
     private readonly table;
     constructor(supabase: TypedSupabaseClient, auth: AuthContext, audit: AuditResource);
+    /** The catalogue in its order: `position` first, then insertion order for the seeded ties. */
     list(entity: StatusEntityTypes): Promise<StatusEntity[]>;
+    /** A new status goes last: one past the highest position its entity type has. */
     create(input: AddStatusDto): Promise<StatusEntity>;
+    /**
+     * Rewrites the whole catalogue's positions from the order given. The ids must be exactly the
+     * entity type's statuses, each once - a partial list would leave positions undefined, so it is
+     * refused with a 400 before anything is written. Only the rows that move are written (and
+     * audited); the answer is the catalogue in its new order.
+     */
+    reorder(entity: StatusEntityTypes, input: ReorderStatusesDto): Promise<StatusEntity[]>;
     update(statusId: string, input: UpdateStatusDto): Promise<StatusEntity>;
     /** The Won status cannot be deleted. Every other status can. */
     remove(statusId: string): Promise<void>;

package/dist/statuses/index.js

@@ -23,7 +23,7 @@ const refuseWon = (message) => new errors_1.SupabaseClientError({ status: 400, e
 // The public contract is the shared StatusEntity from @managemint-solutions/entities; the
 // `as StatusEntity` casts declare the shape the select string below produces (the columns are
 // defined in the api's supabase/migrations).
-const STATUS_SELECT = 'mms_id, label, colour, is_complete, is_fail, is_triage, is_won';
+const STATUS_SELECT = 'mms_id, label, colour, is_complete, is_fail, is_triage, is_won, position';
 // The audited write returns the whole row; the wire shape is the STATUS_SELECT columns.
 const toStatus = (row) => ({
     mms_id: row.mms_id,
@@ -33,6 +33,7 @@ const toStatus = (row) => ({
     is_fail: row.is_fail,
     is_triage: row.is_triage,
     is_won: row.is_won,
+    position: row.position,
 });
 class StatusesResource {
     supabase;
@@ -46,27 +47,75 @@ class StatusesResource {
             entityType: enum_1.AuditTrailEntityType.STATUS,
         });
     }
+    /** The catalogue in its order: `position` first, then insertion order for the seeded ties. */
     async list(entity) {
         const { data, error } = await this.supabase
             .from('statuses')
             .select(STATUS_SELECT)
             .eq('organization_id', this.auth.organization_id)
-            .eq('entity_type', entity);
+            .eq('entity_type', entity)
+            .order('position')
+            .order('created_at')
+            .order('mms_id');
         if (error)
             throw (0, errors_1.mapPostgrestError)(error);
         return data;
     }
+    /** A new status goes last: one past the highest position its entity type has. */
     async create(input) {
+        const { data, error } = await this.supabase
+            .from('statuses')
+            .select('position')
+            .eq('organization_id', this.auth.organization_id)
+            .eq('entity_type', input.entity)
+            .order('position', { ascending: false })
+            .limit(1)
+            .maybeSingle();
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+        const last = data?.position;
         const row = await this.table.insert({
             label: input.label,
             colour: input.colour,
             entity_type: input.entity,
             is_complete: input.is_complete ?? false,
+            position: last === undefined ? 0 : last + 1,
             organization_id: this.auth.organization_id,
             created_by: this.auth.mms_id,
         });
         return toStatus(row);
     }
+    /**
+     * Rewrites the whole catalogue's positions from the order given. The ids must be exactly the
+     * entity type's statuses, each once - a partial list would leave positions undefined, so it is
+     * refused with a 400 before anything is written. Only the rows that move are written (and
+     * audited); the answer is the catalogue in its new order.
+     */
+    async reorder(entity, input) {
+        const current = await this.list(entity);
+        const currentIds = new Set(current.map((status) => status.mms_id));
+        const given = new Set(input.status_ids);
+        if (given.size !== input.status_ids.length ||
+            given.size !== currentIds.size ||
+            input.status_ids.some((id) => !currentIds.has(id))) {
+            throw new errors_1.SupabaseClientError({
+                status: 400,
+                error: 'Database Error',
+                message: `status_ids must list every ${entity} status exactly once`,
+            });
+        }
+        const positionOf = new Map(current.map((status) => [status.mms_id, status.position]));
+        for (const [position, id] of input.status_ids.entries()) {
+            if (positionOf.get(id) === position)
+                continue;
+            await this.table.update(id, {
+                position,
+                updated_at: new Date().toISOString(),
+                last_updated_by: this.auth.mms_id,
+            });
+        }
+        return this.list(entity);
+    }
     async update(statusId, input) {
         if (await this.isWon(statusId)) {
             throw refuseWon('The Won status is fixed and cannot be changed');

package/dist/supporting-files/dto.d.ts

@@ -1,5 +1,7 @@
-import type { GetSupportingFilesDto as GetSupportingFilesDtoType, SupportingFileIdDto as SupportingFileIdDtoType } from '@managemint-solutions/entities/supporting-files/dto';
+import type { GetSupportingFilesDto as GetSupportingFilesDtoType, SupportingFileIdDto as SupportingFileIdDtoType, SupportingFileNamesDto as SupportingFileNamesDtoType } from '@managemint-solutions/entities/supporting-files/dto';
 import { SupportingFilesEntityTypes } from '@managemint-solutions/entities/supporting-files/enum';
+/** Files accepted in one upload. */
+export declare const MAX_FILES_PER_UPLOAD = 10;
 export declare class SupportingFileIdDto implements SupportingFileIdDtoType {
     readonly supportingFileId: string;
 }
@@ -7,3 +9,6 @@ export declare class GetSupportingFilesDto implements GetSupportingFilesDtoType
     readonly entity: SupportingFilesEntityTypes;
     readonly entityId: string;
 }
+export declare class SupportingFileNamesDto implements SupportingFileNamesDtoType {
+    readonly names: string[];
+}

package/dist/supporting-files/dto.js

@@ -9,12 +9,13 @@ var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.GetSupportingFilesDto = exports.SupportingFileIdDto = void 0;
+exports.SupportingFileNamesDto = exports.GetSupportingFilesDto = exports.SupportingFileIdDto = exports.MAX_FILES_PER_UPLOAD = void 0;
 const class_validator_1 = require("class-validator");
 const enum_1 = require("@managemint-solutions/entities/supporting-files/enum");
 // class-validator versions of the shared DTO types from @managemint-solutions/entities.
-// Each class `implements` its entities type so the wire contract cannot drift. There is no class
-// for the upload payload - it arrives as multipart and is not validated by class-validator.
+// Each class `implements` its entities type so the wire contract cannot drift.
+/** Files accepted in one upload. */
+exports.MAX_FILES_PER_UPLOAD = 10;
 class SupportingFileIdDto {
     supportingFileId;
 }
@@ -36,3 +37,17 @@ __decorate([
     (0, class_validator_1.IsUUID)('7', { message: 'Invalid entity ID format' }),
     __metadata("design:type", String)
 ], GetSupportingFilesDto.prototype, "entityId", void 0);
+class SupportingFileNamesDto {
+    // The names are the client's file names; the resource validates each one (characters,
+    // length, extension) when it builds the object key, which the decorators cannot.
+    names;
+}
+exports.SupportingFileNamesDto = SupportingFileNamesDto;
+__decorate([
+    (0, class_validator_1.IsArray)({ message: 'names must be an array' }),
+    (0, class_validator_1.ArrayMinSize)(1, { message: 'At least one file is required' }),
+    (0, class_validator_1.ArrayMaxSize)(exports.MAX_FILES_PER_UPLOAD, { message: `At most ${exports.MAX_FILES_PER_UPLOAD} files per upload` }),
+    (0, class_validator_1.IsString)({ each: true, message: 'Each file name must be a string' }),
+    (0, class_validator_1.IsNotEmpty)({ each: true, message: 'A file name cannot be empty' }),
+    __metadata("design:type", Array)
+], SupportingFileNamesDto.prototype, "names", void 0);

package/dist/supporting-files/index.d.ts

@@ -1,5 +1,4 @@
-import type { SupportingFileEntity, SupportingFilePresignedUrl } from '@managemint-solutions/entities/supporting-files';
-import type { UploadSupportingFilesDto } from '@managemint-solutions/entities/supporting-files/dto';
+import type { SupportingFileEntity, SupportingFilePresignedUrl, SupportingFileUploadTarget } from '@managemint-solutions/entities/supporting-files';
 import { SupportingFilesEntityTypes } from '@managemint-solutions/entities/supporting-files/enum';
 import type { AuthContext } from '../auth';
 import { type AuditResource } from '../audit';
@@ -13,6 +12,24 @@ export declare class SupportingFilesResource {
     constructor(supabase: TypedSupabaseClient, auth: AuthContext, audit: AuditResource);
     getPresignedUrl(supportingFileId: string): Promise<SupportingFilePresignedUrl>;
     list(entity: SupportingFilesEntityTypes, entityId: string): Promise<SupportingFileEntity[]>;
-    upload(entity: SupportingFilesEntityTypes, entityId: string, input: UploadSupportingFilesDto): Promise<SupportingFileEntity[]>;
+    /**
+     * Where the caller puts each file: one signed upload URL per name, in request order, valid
+     * for two hours, into the organization's prefix. Storage checks the bucket's INSERT policy
+     * here, as the caller. An existing object of the same name is replaced - the latest version
+     * of a document wins.
+     */
+    createUploadUrls(entity: SupportingFilesEntityTypes, entityId: string, names: string[]): Promise<SupportingFileUploadTarget[]>;
+    /**
+     * Records the files the caller has put in the bucket. A name whose object is not there is
+     * refused, so no row ever points at nothing; a name already recorded keeps its row (its
+     * object was refreshed in place). Returns the record's whole list.
+     */
+    record(entity: SupportingFilesEntityTypes, entityId: string, names: string[]): Promise<SupportingFileEntity[]>;
     remove(supportingFileId: string): Promise<void>;
+    /**
+     * Each client name validated once, and the object key built from that same split - so what
+     * `createUploadUrls` mints, `record` checks and `getPresignedUrl` and `remove` rebuild later
+     * are one key. A converted lead takes no new files.
+     */
+    private prepare;
 }

package/dist/supporting-files/index.js

@@ -27,8 +27,14 @@ __exportStar(require("./paths"), exports);
 const BUCKET = 'supporting-files';
 /** How long a presigned download URL stays valid. */
 const SIGNED_URL_TTL_SECONDS = 300;
-/** Uploads run concurrently in batches of this size. */
-const UPLOAD_BATCH_SIZE = 5;
+/** Storage calls per file (minting an upload URL, checking an object) run concurrently in batches of this size. */
+const BATCH_SIZE = 5;
+/**
+ * The only extensions a supporting file may carry - what the portal offers. The bytes never
+ * pass through the api, so this check on the name is the type gate; the bucket's
+ * `file_size_limit` is the size gate.
+ */
+const ALLOWED_EXTENSIONS = new Set(Object.values(enum_1.SupportingFilesExtensions));
 /** The `name`/`extension` pair rendered back into the file name it was split from. */
 const fileNameOf = (file) => file.extension ? `${file.name}.${file.extension}` : file.name;
 // The public contract is the shared SupportingFileEntity from @managemint-solutions/entities; the
@@ -38,6 +44,10 @@ const fileNameOf = (file) => file.extension ? `${file.name}.${file.extension}` :
 // Object keys are `organizationId/entityType/entityId/file` - the organization leads so a storage
 // policy can scope by tenant. A data migration renames the pre-existing objects, which have no
 // organization segment, into that prefix.
+//
+// An upload is two calls: `createUploadUrls` hands the caller a signed upload URL per file, the
+// caller puts each file's bytes straight into the bucket, and `record` writes the rows for what
+// landed. The bytes never pass through here - a Vercel function body is capped at 4.5 MB.
 class SupportingFilesResource {
     supabase;
     auth;
@@ -78,9 +88,48 @@ class SupportingFilesResource {
             throw (0, errors_1.mapPostgrestError)(error);
         return data;
     }
-    async upload(entity, entityId, input) {
-        if (entity === enum_1.SupportingFilesEntityTypes.LEAD) {
-            await (0, won_1.refuseWonLead)(this.supabase, this.auth.organization_id, entityId);
+    /**
+     * Where the caller puts each file: one signed upload URL per name, in request order, valid
+     * for two hours, into the organization's prefix. Storage checks the bucket's INSERT policy
+     * here, as the caller. An existing object of the same name is replaced - the latest version
+     * of a document wins.
+     */
+    async createUploadUrls(entity, entityId, names) {
+        const files = await this.prepare(entity, entityId, names);
+        const targets = [];
+        for (let index = 0; index < files.length; index += BATCH_SIZE) {
+            targets.push(...(await Promise.all(files.slice(index, index + BATCH_SIZE).map(async ({ name, extension, path }) => {
+                const { data, error } = await this.supabase.storage
+                    .from(BUCKET)
+                    .createSignedUploadUrl(path, { upsert: true });
+                if (error) {
+                    throw (0, errors_1.mapStorageError)(error, `Failed to prepare upload: ${fileNameOf({ name, extension })}`);
+                }
+                return { name, extension, url: data.signedUrl };
+            }))));
+        }
+        return targets;
+    }
+    /**
+     * Records the files the caller has put in the bucket. A name whose object is not there is
+     * refused, so no row ever points at nothing; a name already recorded keeps its row (its
+     * object was refreshed in place). Returns the record's whole list.
+     */
+    async record(entity, entityId, names) {
+        const files = await this.prepare(entity, entityId, names);
+        for (let index = 0; index < files.length; index += BATCH_SIZE) {
+            await Promise.all(files.slice(index, index + BATCH_SIZE).map(async ({ name, extension, path }) => {
+                // A missing object comes back as `data: false` (storage-js keeps the 404 in `error`);
+                // any other failure is thrown by storage-js itself.
+                const { data: present } = await this.supabase.storage.from(BUCKET).exists(path);
+                if (!present) {
+                    throw new errors_1.SupabaseClientError({
+                        status: 400,
+                        error: 'Storage Error',
+                        message: `File was not uploaded: ${fileNameOf({ name, extension })}`,
+                    });
+                }
+            }));
         }
         const { data: existing, error: existingError } = await this.supabase
             .from('supporting_files')
@@ -91,26 +140,7 @@ class SupportingFilesResource {
         if (existingError)
             throw (0, errors_1.mapPostgrestError)(existingError);
         const existingFileNames = existing.map(fileNameOf);
-        // Each client name is validated once here, and the object key, the duplicate check and the
-        // row are all built from that same split - so what is stored is what presign and remove
-        // rebuild later.
-        const uploads = input.files.map((file) => ({
-            file,
-            ...(0, paths_1.splitFileName)((0, paths_1.sanitizeFileName)(file.name)),
-        }));
-        // Every file is written to the bucket, duplicates included - an upsert refreshes the object.
-        for (let index = 0; index < uploads.length; index += UPLOAD_BATCH_SIZE) {
-            await Promise.all(uploads.slice(index, index + UPLOAD_BATCH_SIZE).map(async ({ file, name, extension }) => {
-                const { error } = await this.supabase.storage
-                    .from(BUCKET)
-                    .upload((0, paths_1.storagePath)(this.auth.organization_id, entity, entityId, name, extension), file, { cacheControl: '3600', upsert: true });
-                if (error) {
-                    throw (0, errors_1.mapStorageError)(error, `Failed to upload file: ${fileNameOf({ name, extension })}`);
-                }
-            }));
-        }
-        // Only files without an existing row get one - the rest were refreshed in place above.
-        const newFiles = uploads.filter((file) => !existingFileNames.includes(fileNameOf(file)));
+        const newFiles = files.filter((file) => !existingFileNames.includes(fileNameOf(file)));
         if (newFiles.length > 0) {
             await this.table.insertMany(newFiles.map(({ name, extension }) => ({
                 name,
@@ -140,5 +170,30 @@ class SupportingFilesResource {
             throw (0, errors_1.mapStorageError)(storageError, `Failed to delete file: ${fileName}`);
         }
     }
+    /**
+     * Each client name validated once, and the object key built from that same split - so what
+     * `createUploadUrls` mints, `record` checks and `getPresignedUrl` and `remove` rebuild later
+     * are one key. A converted lead takes no new files.
+     */
+    async prepare(entity, entityId, names) {
+        if (entity === enum_1.SupportingFilesEntityTypes.LEAD) {
+            await (0, won_1.refuseWonLead)(this.supabase, this.auth.organization_id, entityId);
+        }
+        return names.map((fileName) => {
+            const { name, extension } = (0, paths_1.splitFileName)((0, paths_1.sanitizeFileName)(fileName));
+            if (!ALLOWED_EXTENSIONS.has(extension.toLowerCase())) {
+                throw new errors_1.SupabaseClientError({
+                    status: 400,
+                    error: 'Storage Error',
+                    message: `Unsupported file type: ${fileNameOf({ name, extension })}`,
+                });
+            }
+            return {
+                name,
+                extension: extension,
+                path: (0, paths_1.storagePath)(this.auth.organization_id, entity, entityId, name, extension),
+            };
+        });
+    }
 }
 exports.SupportingFilesResource = SupportingFilesResource;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@managemint-solutions/sdk",
-  "version": "0.49.0",
+  "version": "0.51.0",
   "description": "Typed Supabase data-access SDK for ManageMint Solutions",
   "license": "UNLICENSED",
   "author": "Scott Bebington <scottbebington@gmail.com>",
@@ -51,7 +51,7 @@
     "testEnvironment": "node"
   },
   "dependencies": {
-    "@managemint-solutions/entities": "^1.32.0"
+    "@managemint-solutions/entities": "^1.34.0"
   },
   "peerDependencies": {
     "@nestjs/common": "^11.0.0",