@motherbase/client 1.5.0 → 1.5.1

package/dist/sso.d.ts

@@ -0,0 +1,147 @@
+import type { HttpClient } from './http.js';
+import type { MotherbaseResponse } from './types.js';
+/**
+ * `client.auth.sso`: identity providers registered at runtime, typically by an
+ * organization's admins for their own members (Better Auth's SSO plugin).
+ * Signing in through one is `client.auth.signInWithSSO()`.
+ *
+ * supabase-js has no runtime equivalent: Supabase registers SSO providers from
+ * its CLI or management API, per project. Here a provider is tenant data, so the
+ * app's own admin screens manage it, and an `organizationId` scopes it to that
+ * organization's members.
+ *
+ * Needs Auth · SSO on in the project settings; otherwise every call is a 404.
+ * The callback URL to configure at the identity provider is
+ * `<project url>/api/auth/sso/callback/<providerId>`, also returned as
+ * `redirectURI` by `register`.
+ */
+export interface OidcMapping {
+    id: string;
+    email: string;
+    emailVerified?: string;
+    name: string;
+    image?: string;
+    extraFields?: Record<string, string>;
+}
+export interface SamlMapping {
+    id: string;
+    email: string;
+    emailVerified?: string;
+    name: string;
+    firstName?: string;
+    lastName?: string;
+    extraFields?: Record<string, string>;
+}
+export interface OidcProviderConfig {
+    clientId: string;
+    clientSecret: string;
+    /** The issuer's `.well-known/openid-configuration`. Fills in every endpoint below. */
+    discoveryEndpoint?: string;
+    authorizationEndpoint?: string;
+    tokenEndpoint?: string;
+    userInfoEndpoint?: string;
+    jwksEndpoint?: string;
+    tokenEndpointAuthentication?: 'client_secret_post' | 'client_secret_basic';
+    /** Skip discovery at registration; then the endpoints above are required. */
+    skipDiscovery?: boolean;
+    /** Defaults to `['openid', 'email', 'profile', 'offline_access']`. */
+    scopes?: string[];
+    /** Defaults to true. */
+    pkce?: boolean;
+    mapping?: OidcMapping;
+}
+export interface SamlProviderConfig {
+    entryPoint: string;
+    /** The IdP's signing certificate, PEM. */
+    cert: string;
+    callbackUrl: string;
+    audience?: string;
+    /** IdP metadata XML in `metadata`, or its parts. */
+    idpMetadata?: {
+        metadata?: string;
+        entityID?: string;
+        cert?: string;
+    };
+    spMetadata: {
+        metadata?: string;
+        entityID?: string;
+        binding?: string;
+    };
+    wantAssertionsSigned?: boolean;
+    authnRequestsSigned?: boolean;
+    signatureAlgorithm?: string;
+    digestAlgorithm?: string;
+    identifierFormat?: string;
+    mapping?: SamlMapping;
+}
+export interface RegisterSsoProviderParams {
+    /** Stable id of your choosing; it appears in the callback URL. */
+    providerId: string;
+    issuer: string;
+    /** Email domain routed to this provider. Several, comma-separated, for one IdP serving many domains. */
+    domain: string;
+    /** Scope the provider to one organization, whose members it signs in and provisions. */
+    organizationId?: string;
+    /** Overwrite the user's profile from the IdP on every sign-in. Defaults to false. */
+    overrideUserInfo?: boolean;
+    /** Exactly one of `oidcConfig` and `samlConfig`. */
+    oidcConfig?: OidcProviderConfig;
+    samlConfig?: SamlProviderConfig;
+}
+/**
+ * A provider as listed: secrets withheld, the client id masked to its last four
+ * characters.
+ */
+export interface SsoProvider {
+    providerId: string;
+    type: 'oidc' | 'saml';
+    issuer: string;
+    domain: string;
+    organizationId: string | null;
+    domainVerified: boolean;
+    oidcConfig?: Omit<OidcProviderConfig, 'clientId' | 'clientSecret' | 'skipDiscovery' | 'mapping'> & {
+        clientIdLastFour?: string;
+    };
+    samlConfig?: Pick<SamlProviderConfig, 'entryPoint' | 'callbackUrl' | 'audience' | 'wantAssertionsSigned' | 'authnRequestsSigned' | 'identifierFormat' | 'signatureAlgorithm' | 'digestAlgorithm'> & {
+        certificate?: unknown;
+    };
+    /** Where the IdP fetches this project's SAML service provider metadata. */
+    spMetadataUrl: string;
+}
+export declare class SsoClient {
+    private readonly http;
+    constructor(http: HttpClient);
+    /**
+     * Register an identity provider. For an organization's provider, the caller
+     * must be that organization's owner or admin.
+     */
+    register(params: RegisterSsoProviderParams): Promise<MotherbaseResponse<{
+        providerId: string;
+        issuer: string;
+        domain: string;
+        organizationId?: string | null;
+        redirectURI: string;
+    }>>;
+    /** Providers the signed-in user may manage: their own, and their admin organizations'. */
+    listProviders(): Promise<MotherbaseResponse<{
+        providers: SsoProvider[];
+    }>>;
+    getProvider(params: {
+        providerId: string;
+    }): Promise<MotherbaseResponse<SsoProvider>>;
+    /** Change a provider. Config objects are merged into the stored ones, so send only what changes. */
+    updateProvider(params: {
+        providerId: string;
+        issuer?: string;
+        domain?: string;
+    } & {
+        oidcConfig?: Partial<OidcProviderConfig>;
+        samlConfig?: Partial<SamlProviderConfig>;
+    }): Promise<MotherbaseResponse<SsoProvider>>;
+    deleteProvider(params: {
+        providerId: string;
+    }): Promise<MotherbaseResponse<{
+        success: boolean;
+    }>>;
+}
+//# sourceMappingURL=sso.d.ts.map

package/dist/sso.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso.d.ts","sourceRoot":"","sources":["../src/sso.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD;;;;;;;;;;;;;;GAcG;AAEH,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,sFAAsF;IACtF,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,2BAA2B,CAAC,EAAE,oBAAoB,GAAG,qBAAqB,CAAC;IAC3E,6EAA6E;IAC7E,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,sEAAsE;IACtE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,wBAAwB;IACxB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,WAAW,CAAC;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oDAAoD;IACpD,WAAW,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACtE,UAAU,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACvE,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,OAAO,CAAC,EAAE,WAAW,CAAC;CACvB;AAED,MAAM,WAAW,yBAAyB;IACxC,kEAAkE;IAClE,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,wGAAwG;IACxG,MAAM,EAAE,MAAM,CAAC;IACf,wFAAwF;IACxF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,qFAAqF;IACrF,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,oDAAoD;IACpD,UAAU,CAAC,EAAE,kBAAkB,CAAC;IAChC,UAAU,CAAC,EAAE,kBAAkB,CAAC;CACjC;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,cAAc,EAAE,OAAO,CAAC;IACxB,UAAU,CAAC,EAAE,IAAI,CAAC,kBAAkB,EAAE,UAAU,GAAG,cAAc,GAAG,eAAe,GAAG,SAAS,CAAC,GAAG;QACjG,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;IACF,UAAU,CAAC,EAAE,IAAI,CACf,kBAAkB,EAChB,YAAY,GACZ,aAAa,GACb,UAAU,GACV,sBAAsB,GACtB,qBAAqB,GACrB,kBAAkB,GAClB,oBAAoB,GACpB,iBAAiB,CACpB,GAAG;QAAE,WAAW,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC9B,2EAA2E;IAC3E,aAAa,EAAE,MAAM,CAAC;CACvB;AAUD,qBAAa,SAAS;IACR,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,UAAU;IAE7C;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAClD,kBAAkB,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAChI;IAID,0FAA0F;IAC1F,aAAa,IAAI,OAAO,CAAC,kBAAkB,CAAC;QAAE,SAAS,EAAE,WAAW,EAAE,CAAA;KAAE,CAAC,CAAC;IAI1E,WAAW,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC;IAIrF,oGAAoG;IACpG,cAAc,CACZ,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG;QACjE,UAAU,CAAC,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC;QACzC,UAAU,CAAC,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC;KAC1C,GACA,OAAO,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC;IAI3C,cAAc,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAGlG"}

package/dist/sso.js

@@ -0,0 +1,35 @@
+import { pluginGet, pluginPost } from './plugin-endpoint.js';
+const R = {
+    register: '/api/auth/sso/register',
+    list: '/api/auth/sso/providers',
+    get: '/api/auth/sso/get-provider',
+    update: '/api/auth/sso/update-provider',
+    delete: '/api/auth/sso/delete-provider',
+};
+export class SsoClient {
+    constructor(http) {
+        this.http = http;
+    }
+    /**
+     * Register an identity provider. For an organization's provider, the caller
+     * must be that organization's owner or admin.
+     */
+    register(params) {
+        return pluginPost(this.http, R.register, params);
+    }
+    /** Providers the signed-in user may manage: their own, and their admin organizations'. */
+    listProviders() {
+        return pluginGet(this.http, R.list);
+    }
+    getProvider(params) {
+        return pluginGet(this.http, R.get, params);
+    }
+    /** Change a provider. Config objects are merged into the stored ones, so send only what changes. */
+    updateProvider(params) {
+        return pluginPost(this.http, R.update, params);
+    }
+    deleteProvider(params) {
+        return pluginPost(this.http, R.delete, params);
+    }
+}
+//# sourceMappingURL=sso.js.map

package/dist/sso.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso.js","sourceRoot":"","sources":["../src/sso.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAuH7D,MAAM,CAAC,GAAG;IACR,QAAQ,EAAE,wBAAwB;IAClC,IAAI,EAAE,yBAAyB;IAC/B,GAAG,EAAE,4BAA4B;IACjC,MAAM,EAAE,+BAA+B;IACvC,MAAM,EAAE,+BAA+B;CAC/B,CAAC;AAEX,MAAM,OAAO,SAAS;IACpB,YAA6B,IAAgB;QAAhB,SAAI,GAAJ,IAAI,CAAY;IAAG,CAAC;IAEjD;;;OAGG;IACH,QAAQ,CAAC,MAAiC;QAGxC,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACnD,CAAC;IAED,0FAA0F;IAC1F,aAAa;QACX,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IAED,WAAW,CAAC,MAA8B;QACxC,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC;IAED,oGAAoG;IACpG,cAAc,CACZ,MAGC;QAED,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC;IAED,cAAc,CAAC,MAA8B;QAC3C,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC;CACF"}

package/dist/storage.d.ts

@@ -0,0 +1,268 @@
+import type { HttpClient } from './http.js';
+import type { FileObject, FileVisibility, MotherbaseResponse, StorageRemoveResponse, UploadInput } from './types.js';
+export interface UploadOptions {
+    /** Object visibility. Defaults to the backend's default (private). */
+    visibility?: FileVisibility;
+    /** Content type stored with the object. Overrides what the file itself declares. */
+    contentType?: string;
+    upsert?: boolean;
+}
+export interface UploadResult {
+    /** The object key, exactly as passed to `upload`. */
+    path: string;
+    /** The server-issued file id. Still accepted anywhere a path is. */
+    id: string;
+    /** `bucket/key`. */
+    fullPath: string;
+}
+/** A bucket, in the supabase-js shape. `id` is the slug. */
+export interface BucketInfo {
+    id: string;
+    name: string;
+    owner: string;
+    public: boolean;
+    /** Largest object the bucket accepts, in bytes. `null` defers to the project limit. */
+    file_size_limit: number | null;
+    /** MIME allowlist (`image/*` wildcards allowed). `null` accepts any type. */
+    allowed_mime_types: string[] | null;
+    created_at: string | null;
+    updated_at: string | null;
+}
+/** supabase-js `createBucket` / `updateBucket` options. */
+export interface BucketOptions {
+    public?: boolean;
+    name?: string;
+    /** Bytes, or a string with a unit: `'20MB'`, `'1GB'`. `null` removes the limit. */
+    fileSizeLimit?: number | string | null;
+    /** `['image/*', 'application/pdf']`. `null` or `[]` accepts any type. */
+    allowedMimeTypes?: string[] | null;
+}
+/** One object's metadata, in the supabase-js `info()` shape. */
+export interface ObjectInfo {
+    name: string;
+    id: string;
+    version: string | null;
+    bucket_id: string;
+    created_at: string | null;
+    updated_at: string | null;
+    last_accessed_at: string | null;
+    size: number;
+    content_type: string | null;
+    cache_control: string | null;
+    metadata: Record<string, unknown>;
+}
+/**
+ * supabase-js image transform options. Served by `/storage/v1/render/image`,
+ * resized with the same limits Supabase applies (1 to 2500 px, quality 20 to
+ * 100). Without `format` the server answers WebP to clients that accept it.
+ */
+export interface TransformOptions {
+    width?: number;
+    height?: number;
+    resize?: 'cover' | 'contain' | 'fill';
+    quality?: number;
+    format?: 'origin' | 'webp' | 'avif';
+}
+export interface ListOptions {
+    limit?: number;
+    offset?: number;
+    search?: string;
+    sortBy?: {
+        column?: 'name' | 'created_at' | 'updated_at';
+        order?: 'asc' | 'desc';
+    };
+}
+export declare class StorageBucket {
+    private readonly http;
+    private readonly baseUrl;
+    private readonly bucket;
+    /** Used only by `uploadToSignedUrl`, which PUTs straight to object storage. */
+    private readonly fetchImpl;
+    constructor(http: HttpClient, baseUrl: string, bucket: string, 
+    /** Used only by `uploadToSignedUrl`, which PUTs straight to object storage. */
+    fetchImpl: typeof fetch);
+    /**
+     * Route for one object. A bare uuid is treated as a file id (the pre-path
+     * addressing form, which existing callers have stored); anything else is a
+     * key inside this bucket.
+     */
+    private objectPath;
+    upload(path: string, file: UploadInput, options?: UploadOptions): Promise<MotherbaseResponse<UploadResult>>;
+    /**
+     * Upload several objects, a few at a time, reporting progress per file.
+     *
+     * Uploading a folder is the common case and `Promise.all` is the common
+     * mistake: a hundred parallel multipart posts saturate the connection, and
+     * the server rate limiter answers 429 to the tail of them. Four at a time
+     * finishes sooner in practice and fails less.
+     *
+     * One failing file does not cancel the rest. The result reports every entry
+     * in the order it was given, each with its own error or `null`, so the caller
+     * can retry exactly what failed.
+     *
+     * ponytail: progress is per file, not per byte. Byte-level progress needs
+     * XMLHttpRequest, which does not exist outside a browser; if a progress bar
+     * has to move within one large file, that is the upgrade path.
+     */
+    uploadMany(files: Array<{
+        path: string;
+        file: UploadInput;
+        options?: UploadOptions;
+    }>, options?: {
+        /** Uploads in flight at once. Default 4. */
+        concurrency?: number;
+        /** Called after each file settles, with how many have settled so far. */
+        onProgress?: (progress: {
+            completed: number;
+            total: number;
+            path: string;
+            error: string | null;
+        }) => void;
+    }): Promise<MotherbaseResponse<Array<{
+        path: string;
+        data: UploadResult | null;
+        error: string | null;
+    }>>>;
+    /** The object's bytes. With `transform`, a resized image from the render endpoint instead. */
+    download(path: string, options?: {
+        transform?: TransformOptions;
+    }): Promise<MotherbaseResponse<Blob>>;
+    remove(paths: string[]): Promise<MotherbaseResponse<StorageRemoveResponse[]>>;
+    /** Objects under a prefix, in the Supabase response shape. */
+    list(prefix?: string, options?: ListOptions): Promise<MotherbaseResponse<FileObject[]>>;
+    /**
+     * Synchronous public URL (Supabase parity). Serves through the public bucket
+     * endpoint, or through the render endpoint when `transform` is given.
+     */
+    getPublicUrl(path: string, options?: {
+        transform?: TransformOptions;
+    }): {
+        data: {
+            publicUrl: string;
+        };
+    };
+    /**
+     * A download URL for the object, valid for `expiresIn` seconds (default 3600,
+     * maximum 7 days: the AWS SigV4 ceiling; anything outside that is a `400`).
+     *
+     * `expiresAt` reports when the URL actually stops working, and is `null` when
+     * nothing expires: a public object's URL is permanent, and a private object on
+     * the `local` storage driver resolves to the authenticated streaming endpoint,
+     * which is bound to the session rather than to a clock and so cannot be handed
+     * to a third party at all. Check it rather than assuming `expiresIn` applied,
+     * that assumption is exactly what this used to get wrong, silently.
+     */
+    createSignedUrl(path: string, expiresIn?: number, options?: {
+        transform?: TransformOptions;
+    }): Promise<MotherbaseResponse<{
+        signedUrl: string;
+        expiresAt: string | null;
+    }>>;
+    /**
+     * Sign several objects in one call.
+     *
+     * There is no batch endpoint behind this: it signs each key and reports per
+     * entry, exactly as supabase-js does, so one missing object yields one entry
+     * with an `error` rather than failing the whole batch.
+     */
+    createSignedUrls(paths: string[], expiresIn?: number): Promise<MotherbaseResponse<Array<{
+        path: string;
+        signedUrl: string | null;
+        error: string | null;
+    }>>>;
+    /**
+     * Replace the object at `path`. In supabase-js `update` is `upload` with
+     * upsert forced on, and the same is true here.
+     */
+    update(path: string, file: UploadInput, options?: UploadOptions): Promise<MotherbaseResponse<UploadResult>>;
+    /** Copy an object to another key in this bucket. */
+    copy(from: string, to: string, options?: {
+        upsert?: boolean;
+    }): Promise<MotherbaseResponse<{
+        path: string;
+    }>>;
+    /** Move an object to another key in this bucket (copy, then delete the source). */
+    move(from: string, to: string, options?: {
+        upsert?: boolean;
+    }): Promise<MotherbaseResponse<{
+        path: string;
+    }>>;
+    private transfer;
+    /** One object's metadata, without downloading it. */
+    info(path: string): Promise<MotherbaseResponse<ObjectInfo>>;
+    /**
+     * Whether an object exists and this caller can read it.
+     *
+     * A 404 is the answer `false`, not a failure. Anything else (a 403, a network
+     * error) is reported as an error rather than as "no": treating an
+     * authorization failure as absence is how a UI ends up offering to create
+     * something that is already there.
+     */
+    exists(path: string): Promise<MotherbaseResponse<boolean>>;
+    /**
+     * Mint a URL the browser can PUT the bytes to directly, skipping this server.
+     *
+     * Unlike supabase-js this needs the file's `size` and content type up front:
+     * the upload is reserved against the bucket quota and the signature is bound
+     * to that exact length, which is what stops a signed URL from becoming an
+     * unbounded write. Pair it with `uploadToSignedUrl`.
+     *
+     * Requires the S3 driver; the local driver has no presigned uploads.
+     */
+    createSignedUploadUrl(path: string, options: {
+        size: number;
+        contentType?: string;
+        visibility?: FileVisibility;
+    }): Promise<MotherbaseResponse<{
+        signedUrl: string;
+        token: string;
+        path: string;
+    }>>;
+    /**
+     * Upload to a URL from `createSignedUploadUrl`: PUT the bytes to storage,
+     * then tell the server the object landed. The finalise step is what makes the
+     * row readable, so a PUT that succeeds and a finalise that fails leaves the
+     * reservation to expire rather than a half-visible object.
+     */
+    uploadToSignedUrl(path: string, token: string, file: UploadInput, options?: {
+        contentType?: string;
+    }): Promise<MotherbaseResponse<UploadResult>>;
+}
+/** Supabase-compatible storage client: `client.storage.from(bucket)`. */
+export declare class StorageClient {
+    private readonly http;
+    private readonly baseUrl;
+    private readonly fetchImpl;
+    constructor(http: HttpClient, baseUrl: string, fetchImpl: typeof fetch);
+    from(bucket: string): StorageBucket;
+    /**
+     * Bucket administration, supabase-js shaped.
+     *
+     * Every method here needs a SECRET project API key, which is the same rule
+     * Supabase applies (bucket administration is a service-role operation). With
+     * a publishable key they resolve with a 401 error, so keep them in server
+     * code and setup scripts, never in a browser bundle.
+     */
+    listBuckets(): Promise<MotherbaseResponse<BucketInfo[]>>;
+    getBucket(id: string): Promise<MotherbaseResponse<BucketInfo>>;
+    createBucket(id: string, options?: BucketOptions): Promise<MotherbaseResponse<BucketInfo>>;
+    updateBucket(id: string, options: BucketOptions): Promise<MotherbaseResponse<BucketInfo>>;
+    /** Delete every object in the bucket, keeping the bucket itself. */
+    emptyBucket(id: string): Promise<MotherbaseResponse<{
+        emptied: boolean;
+        removed: number;
+    }>>;
+    /**
+     * Delete the bucket. A bucket that still holds objects is a `409` unless
+     * `force` is set, which queues a background deletion of its contents: an
+     * accidental `deleteBucket` must not be able to destroy a project's files in
+     * one unqualified call.
+     */
+    deleteBucket(id: string, options?: {
+        force?: boolean;
+    }): Promise<MotherbaseResponse<{
+        deleted: boolean;
+    }>>;
+    private bucketCall;
+}
+//# sourceMappingURL=storage.d.ts.map

package/dist/storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../src/storage.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EACV,UAAU,EACV,cAAc,EACd,kBAAkB,EAClB,qBAAqB,EAErB,WAAW,EACZ,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,aAAa;IAC5B,sEAAsE;IACtE,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,oFAAoF;IACpF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,EAAE,EAAE,MAAM,CAAC;IACX,oBAAoB;IACpB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,4DAA4D;AAC5D,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,uFAAuF;IACvF,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,6EAA6E;IAC7E,kBAAkB,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACpC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,2DAA2D;AAC3D,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mFAAmF;IACnF,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACvC,yEAAyE;IACzE,gBAAgB,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;CACpC;AAeD,gEAAgE;AAChE,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;IACtC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,QAAQ,GAAG,MAAM,GAAG,MAAM,CAAC;CACrC;AAeD,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,GAAG,YAAY,GAAG,YAAY,CAAC;QAAC,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,CAAA;KAAE,CAAC;CACpF;AAuBD,qBAAa,aAAa;IAEtB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,+EAA+E;IAC/E,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAJT,IAAI,EAAE,UAAU,EAChB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM;IAC/B,+EAA+E;IAC9D,SAAS,EAAE,OAAO,KAAK;IAG1C;;;;OAIG;IACH,OAAO,CAAC,UAAU;IAWZ,MAAM,CACV,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,WAAW,EACjB,OAAO,GAAE,aAAkB,GAC1B,OAAO,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;IA2B5C;;;;;;;;;;;;;;;OAeG;IACG,UAAU,CACd,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,WAAW,CAAC;QAAC,OAAO,CAAC,EAAE,aAAa,CAAA;KAAE,CAAC,EAC1E,OAAO,GAAE;QACP,4CAA4C;QAC5C,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,yEAAyE;QACzE,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE;YAAE,SAAS,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;SAAE,KAAK,IAAI,CAAC;KACtG,GACL,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,YAAY,GAAG,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC,CAAC;IA6BxG,8FAA8F;IACxF,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,SAAS,CAAC,EAAE,gBAAgB,CAAA;KAAO,GAAG,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAYzG,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC,qBAAqB,EAAE,CAAC,CAAC;IAqBnF,8DAA8D;IACxD,IAAI,CAAC,MAAM,SAAK,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,kBAAkB,CAAC,UAAU,EAAE,CAAC,CAAC;IAoB7F;;;OAGG;IACH,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,SAAS,CAAC,EAAE,gBAAgB,CAAA;KAAO,GAAG;QAAE,IAAI,EAAE;YAAE,SAAS,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE;IAQ3G;;;;;;;;;;OAUG;IACG,eAAe,CACnB,IAAI,EAAE,MAAM,EACZ,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,GAAE;QAAE,SAAS,CAAC,EAAE,gBAAgB,CAAA;KAAO,GAC7C,OAAO,CAAC,kBAAkB,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAmB/E;;;;;;OAMG;IACG,gBAAgB,CACpB,KAAK,EAAE,MAAM,EAAE,EACf,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC,CAAC;IAUvG;;;OAGG;IACG,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,GAAE,aAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;IAIrH,oDAAoD;IAC9C,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAIvH,mFAAmF;IAC7E,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;YAIzG,QAAQ;IAiBtB,qDAAqD;IAC/C,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;IASjE;;;;;;;OAOG;IACG,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAOhE;;;;;;;;;OASG;IACG,qBAAqB,CACzB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,cAAc,CAAA;KAAE,GAC3E,OAAO,CAAC,kBAAkB,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAwBlF;;;;;OAKG;IACG,iBAAiB,CACrB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,WAAW,EACjB,OAAO,GAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAO,GACrC,OAAO,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;CA+B7C;AAED,yEAAyE;AACzE,qBAAa,aAAa;IAEtB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAFT,IAAI,EAAE,UAAU,EAChB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,OAAO,KAAK;IAG1C,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa;IAInC;;;;;;;OAOG;IACG,WAAW,IAAI,OAAO,CAAC,kBAAkB,CAAC,UAAU,EAAE,CAAC,CAAC;IASxD,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAI9D,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,GAAE,aAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAI9F,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAI/F,oEAAoE;IAC9D,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAYjG;;;;;OAKG;IACG,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;YAatG,UAAU;CAQzB"}