@protobase/server 0.30.0 → 0.30.1

package/dist/admin-options.d.ts

@@ -15,7 +15,7 @@ export type AdminOptions = {
   basePath?: string;
   /**
    * The app's publishable and secret keys, with which supabase-js calls the PostgREST-compatible `/rest/v1` and the
-   * Realtime-compatible `/realtime/v1` (see `ApiKeysOptions`); default `PROTOBASE_PUBLISHABLE_KEY` and
+   * Realtime-compatible `/realtime/v1` and the Storage-compatible `/storage/v1` (see `ApiKeysOptions`); default `PROTOBASE_PUBLISHABLE_KEY` and
    * `PROTOBASE_SECRET_KEY`. Without either, or with `false`, the app serves neither.
    */
   apiKeys?: ApiKeysOptions | false;

package/dist/api-keys/caller-settings.js

@@ -0,0 +1,27 @@
+//#region src/api-keys/caller-settings.ts
+/**
+* The transaction settings a request admitted by key (`/rest/v1`, `/storage/v1`) runs with, as Supabase's PostgREST
+* sets them: `role`, which is `SET LOCAL ROLE`, to `anon` or `authenticated`, and the caller's claims in `request.jwt.claims` and its user in
+* `request.jwt.claim.sub`, which `auth.uid()`, `auth.role()` and `auth.jwt()` read. The `role` claim names the
+* database role, as on Supabase, whatever the token's own says. The app's role, of the secret key, sets no role: the
+* connection's own owns the tables. A signed-in user is the actor change capture records, when `actorSetting` is set.
+*/
+const callerSettings = (caller, actorSetting) => {
+	const role = caller.role === "app" ? "service_role" : caller.role;
+	const sub = caller.role === "authenticated" ? caller.claims.sub : void 0;
+	const actor = sub === void 0 ? void 0 : {
+		id: sub,
+		roles: []
+	};
+	return {
+		...caller.role !== "app" && { role: caller.role },
+		"request.jwt.claims": JSON.stringify({
+			...caller.claims,
+			role
+		}),
+		...sub !== void 0 && { "request.jwt.claim.sub": sub },
+		...actor && actorSetting && { [actorSetting]: JSON.stringify(actor) }
+	};
+};
+//#endregion
+export { callerSettings };

package/dist/create-admin.d.ts

@@ -72,7 +72,7 @@ export type CreateAdminInput = {
   formsDifficulty?: Difficulty;
   /** @internal The users comments name, mention and mail, which tests fake; from `auth` otherwise. */
   commentUsers?: CommentUsers;
-  /** @internal Verifies a user's token on `/rest/v1` and `/realtime/v1` and gives its claims, which tests fake; those `/auth/v1` signs otherwise. */
+  /** @internal Verifies a user's token on `/rest/v1`, `/realtime/v1` and `/storage/v1` and gives its claims, which tests fake; those `/auth/v1` signs otherwise. */
   verifyToken?: (token: string) => Promise<JWTPayload>;
   /**
    * The host's WebSocket upgrade, such as `@hono/node-server`'s, with which an app with keys and live resources serves

package/dist/create-admin.js

@@ -17,6 +17,7 @@ import { apiKeyCaller } from "./api-keys/resolve-caller.js";
 import { jwtVerifier } from "./auth/jwt.js";
 import { realtimeApp } from "./realtime/realtime-app.js";
 import { restRoutes } from "./rest/rest-routes.js";
+import { storageRoutes } from "./storage/storage-routes.js";
 import { readAppName } from "./app-name.js";
 import { goTruePath } from "./gotrue/keys.js";
 import { authBasePath } from "./better-auth/auth-base-path.js";
@@ -139,11 +140,13 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 		pages: pageModels.map((entry) => entry.name)
 	});
 	const apiKeys = apiKeySettings(options.apiKeys, globalThis.process?.env ?? {});
+	const servesKeys = Boolean(apiKeys.publishable || apiKeys.secret);
 	const files = createFilesRuntime({
 		...filesOptions && { options: filesOptions },
 		env: globalThis.process?.env ?? {},
 		models: registry.entries.map((entry) => entry.model),
-		systemPath
+		systemPath,
+		storage: servesKeys
 	});
 	const table = webhooksOptions && webhookTable(webhooksOptions, auth);
 	const withAi = withAiFields || hasAiActions(viewModels);
@@ -286,7 +289,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 		report
 	});
 	if (appModels.some((model) => model.live)) app.route(systemPath || "/", guarded((live) => void live.route("/", liveRoutes(feed, (session) => visibleNotices(deps, session))), withAnonymous(authenticate, options.roles)));
-	if (apiKeys.publishable || apiKeys.secret) {
+	if (servesKeys) {
 		const verify = verifyToken ?? (auth ? jwtVerifier(goTrueTokens({ auth })) : () => Promise.reject(unauthorized("This app signs no user tokens")));
 		const caller = apiKeyCaller({
 			keys: apiKeys,
@@ -304,6 +307,21 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 			caller,
 			report
 		}));
+		if (files?.storage) {
+			const storage = {
+				db,
+				statementTimeoutMs: deps.statementTimeoutMs,
+				...deps.actorSetting && { actorSetting: deps.actorSetting },
+				store: files.providers[files.storage.provider].store,
+				signer: files.signer,
+				maxBytes: files.storage.maxBytes,
+				caller
+			};
+			app.route("/storage/v1", storageRoutes({
+				deps: storage,
+				report
+			}));
+		}
 	}
 	app.route(basePath, api);
 	app.route(`${deps.systemPath}/meta`, metaApp);

package/dist/files/download.js

@@ -7,6 +7,7 @@ import { fetchRecord } from "../records.js";
 import { readTransaction } from "../transactions.js";
 //#region src/files/download.ts
 const gone = () => notFound("There is no such file");
+/** One `bytes=start-end` range, inclusive; `undefined` for none, `false` for one that cannot be served. */
 const rangeOf = (header, size) => {
 	if (!header) return void 0;
 	const match = /^bytes=(\d*)-(\d*)$/.exec(header.trim());
@@ -106,4 +107,4 @@ const serveFile = async (deps, request, provider, path) => {
 	});
 };
 //#endregion
-export { serveFile };
+export { rangeOf, serveFile };

package/dist/files/options.d.ts

@@ -22,5 +22,14 @@ export type FilesOptions = {
    * public files from: `['images.example.com']`. Images from any other host load with `referrerPolicy="no-referrer"`.
    */
   trustedHosts?: string[];
+  /**
+   * Where `supabase.storage` keeps the bytes of its objects, which the app serves at `/storage/v1` when it has an API key
+   * (see `apiKeys`): `provider` names one of the providers, default `private`, and `maxFileSize` caps every upload, as
+   * `50 MB` (the default) or a number of bytes; a bucket's own limit can only be lower. `false` serves no `/storage/v1`.
+   */
+  storage?: {
+    provider?: string;
+    maxFileSize?: number | string;
+  } | false;
 };
 //#endregion

package/dist/files/runtime.js

@@ -3,19 +3,25 @@ import { storageCleanupSchedule } from "./cleanup-schedule.js";
 import { resolveProviders, retentionOf } from "./providers.js";
 import { createSigner } from "./signer.js";
 import { trustedImageHosts } from "./trusted-hosts.js";
+import { parseSize } from "@protobase/schema/internal";
 //#region src/files/runtime.ts
 /** How long an upload ticket stays usable, so a form left open still saves. */
 const ticketSeconds = 86400;
 const imageFields = (models) => models.flatMap((model) => Object.values(model.fields).flatMap(({ name, file }) => file && (file.variants || file.original || file.placeholder !== void 0) ? [`${model.name}.${name}`] : []));
 /**
-* The runtime, when a resource has a file field or the config names providers. It fails at startup when a field's
+* The runtime, when a resource has a file field, the config names providers or the app serves `/storage/v1`. It fails at startup when a field's
 * provider is not configured, nothing signs uploads, or a field makes image variants or placeholders without sharp.
 */
-const createFilesRuntime = ({ options = {}, env, models, systemPath }) => {
-	const used = [...new Set(models.flatMap((model) => Object.values(model.fields).flatMap((field) => field.file ? [field.file.provider] : [])))];
+const createFilesRuntime = ({ options = {}, env, models, systemPath, storage: servesStorage = false }) => {
+	const storage = servesStorage && options.storage !== false ? {
+		provider: options.storage?.provider ?? "private",
+		maxBytes: parseSize(options.storage?.maxFileSize ?? "50 MB")
+	} : void 0;
+	const fieldProviders = models.flatMap((model) => Object.values(model.fields).flatMap((field) => field.file ? [field.file.provider] : []));
+	const used = [.../* @__PURE__ */ new Set([...fieldProviders, ...storage ? [storage.provider] : []])];
 	if (used.length === 0 && !options.providers) return void 0;
 	const secret = options.secret ?? env.PROTOBASE_FILES_SECRET ?? env.BETTER_AUTH_SECRET;
-	if (!secret) throw new Error("File fields need a secret to sign uploads: set BETTER_AUTH_SECRET, PROTOBASE_FILES_SECRET or files.secret");
+	if (!secret) throw new Error("File fields and /storage/v1 need a secret to sign uploads: set BETTER_AUTH_SECRET, PROTOBASE_FILES_SECRET or files.secret");
 	const images = imageFields(models);
 	if (images.length > 0 && !options.sharp) throw new Error(`${images.join(", ")} make image variants or placeholders, which need sharp: add it to the project (bun add sharp), then import sharp from 'sharp' in the config and pass files: { sharp }`);
 	const providers = resolveProviders(options, env, used);
@@ -28,7 +34,8 @@ const createFilesRuntime = ({ options = {}, env, models, systemPath }) => {
 		path: `${systemPath}/files`,
 		columns: fileColumns(models),
 		trustedHosts: trustedImageHosts(providers, options.trustedHosts),
-		...options.sharp && { sharp: options.sharp }
+		...options.sharp && { sharp: options.sharp },
+		...storage && { storage }
 	};
 };
 /** Runs the scheduled deletes that are due (see `runCleanup`). */

package/dist/storage/bucket-routes.js

@@ -0,0 +1,78 @@
+import { isDatabaseError } from "../error-handler.js";
+import { deleteBucket, findBucket, insertBucket, listBuckets, updateBucket } from "./bucket-sql.js";
+import { bucketNotEmpty, bucketNotFound, invalidRequest } from "./storage-error.js";
+import { checkedBucketId, objectKey } from "./object-key.js";
+import { deleteBucketObjects } from "./object-sql.js";
+import { asCaller } from "./storage-db.js";
+import { jsonBody } from "./storage-context.js";
+import { ownerOf } from "./write-object.js";
+import { Hono } from "hono";
+import { parseSize } from "@protobase/schema/internal";
+//#region src/storage/bucket-routes.ts
+const bucketJson = (bucket) => ({
+	...bucket,
+	type: "STANDARD"
+});
+const sizeLimit = (value) => {
+	if (value === null) return null;
+	if (typeof value === "number" && Number.isSafeInteger(value) && value > 0) return value;
+	if (typeof value === "string" && /^\s*\d+(\.\d+)?\s*(b|kb|mb|gb)?\s*$/i.test(value)) return parseSize(value);
+	throw invalidRequest("file_size_limit must be a number of bytes or a size such as 1MB");
+};
+const bucketWrite = (body) => {
+	const types = body.allowed_mime_types;
+	if (types !== void 0 && types !== null && !(Array.isArray(types) && types.every((type) => typeof type === "string"))) throw invalidRequest("allowed_mime_types must be a list of media types");
+	if (body.public !== void 0 && typeof body.public !== "boolean") throw invalidRequest("public must be true or false");
+	return {
+		...body.public !== void 0 && { public: body.public },
+		...body.file_size_limit !== void 0 && { file_size_limit: sizeLimit(body.file_size_limit) },
+		...types !== void 0 && { allowed_mime_types: types }
+	};
+};
+/** `supabase.storage`'s bucket calls, each as the caller, so the restored `storage.buckets` policies decide. */
+const bucketRoutes = (deps) => {
+	const app = new Hono();
+	app.get("/bucket", async (c) => c.json((await asCaller(deps, await deps.caller(c.req.raw), true, listBuckets)).map(bucketJson)));
+	app.get("/bucket/:id", async (c) => {
+		const id = checkedBucketId(c.req.param("id"));
+		const bucket = await asCaller(deps, await deps.caller(c.req.raw), true, (trx) => findBucket(trx, id));
+		if (!bucket) throw bucketNotFound();
+		return c.json(bucketJson(bucket));
+	});
+	app.post("/bucket", async (c) => {
+		const body = await jsonBody(c);
+		const name = checkedBucketId(typeof body.name === "string" ? body.name : "");
+		const id = typeof body.id === "string" ? checkedBucketId(body.id) : name;
+		const caller = await deps.caller(c.req.raw);
+		await asCaller(deps, caller, false, (trx) => insertBucket(trx, {
+			id,
+			name,
+			owner: ownerOf(caller),
+			...bucketWrite(body)
+		}));
+		return c.json({ name: id });
+	});
+	app.put("/bucket/:id", async (c) => {
+		const id = checkedBucketId(c.req.param("id"));
+		const write = bucketWrite(await jsonBody(c));
+		if (!await asCaller(deps, await deps.caller(c.req.raw), false, (trx) => updateBucket(trx, id, write))) throw bucketNotFound();
+		return c.json({ message: "Successfully updated" });
+	});
+	app.post("/bucket/:id/empty", async (c) => {
+		const id = checkedBucketId(c.req.param("id"));
+		const deleted = await asCaller(deps, await deps.caller(c.req.raw), false, (trx) => deleteBucketObjects(trx, id));
+		for (const row of deleted) await deps.store.delete(await objectKey(row.bucket_id, row.name, row.version));
+		return c.json({ message: "Successfully emptied" });
+	});
+	app.delete("/bucket/:id", async (c) => {
+		const id = checkedBucketId(c.req.param("id"));
+		if (!await asCaller(deps, await deps.caller(c.req.raw), false, (trx) => deleteBucket(trx, id)).catch((error) => {
+			if (isDatabaseError(error) && error.code === "23503") throw bucketNotEmpty();
+			throw error;
+		})) throw bucketNotFound();
+		return c.json({ message: "Successfully deleted" });
+	});
+	return app;
+};
+//#endregion
+export { bucketRoutes };

package/dist/storage/bucket-sql.js

@@ -0,0 +1,29 @@
+import { sql } from "kysely";
+//#region src/storage/bucket-sql.ts
+const columns = sql`id, name, owner, owner_id, public, file_size_limit::float8 as file_size_limit, allowed_mime_types, created_at, updated_at`;
+/** The bucket `id`, as the transaction's role may see it. */
+const findBucket = async (trx, id) => {
+	const { rows } = await sql`select ${columns} from storage.buckets where id = ${id}`.execute(trx);
+	return rows[0];
+};
+/** Every bucket the transaction's role may see, by name. */
+const listBuckets = async (trx) => (await sql`select ${columns} from storage.buckets order by name collate "C"`.execute(trx)).rows;
+/** Adds a bucket; RLS refuses it with 42501, a taken id or name with 23505. */
+const insertBucket = async (trx, bucket) => {
+	await sql`
+    insert into storage.buckets (id, name, owner_id, public, file_size_limit, allowed_mime_types)
+    values (${bucket.id}, ${bucket.name}, ${bucket.owner}, ${bucket.public ?? false}, ${bucket.file_size_limit ?? null}, ${bucket.allowed_mime_types ?? null})`.execute(trx);
+};
+/** Changes the bucket `id`; whether the transaction's role could. */
+const updateBucket = async (trx, id, write) => {
+	const sets = Object.entries(write).filter(([, value]) => value !== void 0).map(([column, value]) => sql`${sql.ref(column)} = ${value}`);
+	if (sets.length === 0) return await findBucket(trx, id) !== void 0;
+	return (await sql`update storage.buckets set ${sql.join(sets)} where id = ${id}`.execute(trx)).numAffectedRows === 1n;
+};
+/** Deletes the bucket `id`; whether the transaction's role could. A bucket that still has objects fails with 23503. */
+const deleteBucket = async (trx, id) => {
+	await sql`select set_config('storage.allow_delete_query', 'true', true)`.execute(trx);
+	return (await sql`delete from storage.buckets where id = ${id}`.execute(trx)).numAffectedRows === 1n;
+};
+//#endregion
+export { deleteBucket, findBucket, insertBucket, listBuckets, updateBucket };

package/dist/storage/list-sql.js

@@ -0,0 +1,29 @@
+import { sql } from "kysely";
+//#region src/storage/list-sql.ts
+const likeEscaped = (text) => text.replace(/[\\%_]/g, (char) => `\\${char}`);
+/**
+* One level of `bucket` below the folder `prefix` (`''` for the top, else ending in `/`), as the transaction's role may
+* see it: the objects directly in it and the folders that hold objects deeper down, whose names start with `search`
+* (case-insensitive). Folders sort with the objects by name; by any other column they come first, as in Supabase.
+*/
+const listFolder = async (trx, bucket, query) => {
+	const start = [...query.prefix].length + 1;
+	const order = sql.raw(query.order === "desc" ? "desc" : "asc");
+	const { rows } = await sql`
+    with level as (
+      select split_part(substr(name, ${start}), '/', 1) as entry, strpos(substr(name, ${start}), '/') > 0 as folder, id, updated_at, created_at, last_accessed_at, metadata
+      from storage.objects
+      where bucket_id = ${bucket} and name like ${`${likeEscaped(query.prefix)}%`} and substr(name, ${start}) ilike ${`${likeEscaped(query.search)}%`}
+    ), entries as (
+      select distinct on (entry) entry as name, folder, case when folder then null else id end as id,
+        case when folder then null else updated_at end as updated_at, case when folder then null else created_at end as created_at,
+        case when folder then null else last_accessed_at end as last_accessed_at, case when folder then null else metadata end as metadata
+      from level order by entry, folder desc
+    )
+    select name, id, updated_at, created_at, last_accessed_at, metadata from entries
+    order by ${query.column === "name" ? sql`name collate "C" ${order}` : sql`folder desc, ${sql.ref(query.column)} ${order} nulls last, name collate "C"`}
+    limit ${query.limit} offset ${query.offset}`.execute(trx);
+	return rows;
+};
+//#endregion
+export { listFolder };

package/dist/storage/move-copy.js

@@ -0,0 +1,63 @@
+import { accessDenied, alreadyExists, objectNotFound } from "./storage-error.js";
+import { objectKey } from "./object-key.js";
+import { findObject, renameObject } from "./object-sql.js";
+import { asApp, asCaller, becomeCaller } from "./storage-db.js";
+import { ownerOf, writeObject } from "./write-object.js";
+//#region src/storage/move-copy.ts
+/** The object as the caller may see it, else 404 `NoSuchKey`. */
+const visibleObject = async (deps, caller, at) => {
+	const row = await asCaller(deps, caller, true, (trx) => findObject(trx, at.bucket, at.name));
+	if (!row) throw objectNotFound();
+	return row;
+};
+const copyBytes = async (store, row, key) => {
+	const body = await store.read(await objectKey(row.bucket_id, row.name, row.version));
+	if (!body) throw objectNotFound();
+	return store.put(key, body);
+};
+/**
+* Copies an object the caller may see to `to`, with its type, cache control and metadata, as a new object the caller
+* must be allowed to write there (see `writeObject`); `upsert` lets it replace one.
+*/
+const copyObject = async (deps, caller, from, to, upsert) => {
+	const source = await visibleObject(deps, caller, from);
+	return writeObject(deps, {
+		...to,
+		caller,
+		owner: ownerOf(caller),
+		upsert
+	}, {
+		type: source.metadata?.mimetype ?? "application/octet-stream",
+		cacheControl: source.metadata?.cacheControl ?? "max-age=3600",
+		userMetadata: source.user_metadata,
+		store: (key) => copyBytes(deps.store, source, key)
+	});
+};
+/**
+* Moves an object the caller may see to `to`: its bytes are copied under a new version, then its row is renamed as the
+* caller, so the update policies decide on the old and the new name. When that fails, the copy is deleted; once it
+* commits, the old bytes are.
+*/
+const moveObject = async (deps, caller, from, to) => {
+	const source = await visibleObject(deps, caller, from);
+	const version = crypto.randomUUID();
+	const key = await objectKey(to.bucket, to.name, version);
+	await copyBytes(deps.store, source, key);
+	await asApp(deps, async (trx) => {
+		if (!await findObject(trx, from.bucket, from.name, true)) throw objectNotFound();
+		if (await findObject(trx, to.bucket, to.name, true)) throw alreadyExists();
+		await becomeCaller(trx, deps, caller);
+		if (!await renameObject(trx, from, {
+			...to,
+			version,
+			owner: ownerOf(caller)
+		})) throw accessDenied();
+	}).catch(async (error) => {
+		await deps.store.delete(key);
+		throw error;
+	});
+	await deps.store.delete(await objectKey(source.bucket_id, source.name, source.version));
+	return source.id;
+};
+//#endregion
+export { copyObject, moveObject, visibleObject };

package/dist/storage/multipart.js

@@ -0,0 +1,47 @@
+//#region src/storage/multipart.ts
+const encoder = new TextEncoder();
+const decoder = new TextDecoder();
+const indexOf = (haystack, needle, from) => {
+	for (let at = haystack.indexOf(needle[0], from); at !== -1 && at + needle.length <= haystack.length; at = haystack.indexOf(needle[0], at + 1)) {
+		let index = 1;
+		while (index < needle.length && haystack[at + index] === needle[index]) index += 1;
+		if (index === needle.length) return at;
+	}
+	return -1;
+};
+/** The boundary of a `multipart/form-data` Content-Type, else `undefined`. */
+const boundaryOf = (contentType) => /;\s*boundary=(?:"([^"]+)"|([^;\s]+))/i.exec(contentType)?.slice(1).find(Boolean);
+const headerValue = (headers, name) => new RegExp(`^${name}:\\s*(.*)$`, "im").exec(headers)?.[1]?.trim();
+const parameter = (disposition, name) => new RegExp(`;\\s*${name}="([^"]*)"`, "i").exec(disposition)?.[1];
+/**
+* The parts of a whole `multipart/form-data` body, every one kept, also a file part with an empty field name, as
+* storage-js sends a `Blob`: Bun's `formData()` drops it. Undefined when the body does not parse.
+*/
+const multipartParts = (bytes, boundary) => {
+	const delimiter = encoder.encode(`--${boundary}`);
+	const next = encoder.encode(`\r\n--${boundary}`);
+	const parts = [];
+	let at = indexOf(bytes, delimiter, 0);
+	if (at === -1) return void 0;
+	at += delimiter.length;
+	while (decoder.decode(bytes.subarray(at, at + 2)) !== "--") {
+		if (decoder.decode(bytes.subarray(at, at + 2)) !== "\r\n") return void 0;
+		const headersEnd = indexOf(bytes, encoder.encode("\r\n\r\n"), at + 2);
+		const end = headersEnd === -1 ? -1 : indexOf(bytes, next, headersEnd + 4);
+		if (end === -1) return void 0;
+		const headers = decoder.decode(bytes.subarray(at + 2, headersEnd));
+		const disposition = headerValue(headers, "content-disposition") ?? "";
+		const filename = parameter(disposition, "filename");
+		const type = headerValue(headers, "content-type");
+		parts.push({
+			name: parameter(disposition, "name") ?? "",
+			...filename !== void 0 && { filename },
+			...type && { type },
+			body: bytes.subarray(headersEnd + 4, end)
+		});
+		at = end + next.length;
+	}
+	return parts;
+};
+//#endregion
+export { boundaryOf, multipartParts };

package/dist/storage/object-body.js

@@ -0,0 +1,75 @@
+import { invalidRequest, tooLarge } from "./storage-error.js";
+import { boundaryOf, multipartParts } from "./multipart.js";
+//#region src/storage/object-body.ts
+const defaultType = "text/plain;charset=UTF-8";
+const defaultCacheControl = "max-age=3600";
+const parsedMetadata = (text) => {
+	if (text === null) return null;
+	try {
+		const value = JSON.parse(text);
+		if (typeof value === "object" && value !== null && !Array.isArray(value)) return value;
+	} catch (error) {
+		if (!(error instanceof SyntaxError)) throw error;
+	}
+	throw invalidRequest("The metadata is not a JSON object");
+};
+const fromBase64 = (text) => {
+	try {
+		return new TextDecoder().decode(Uint8Array.from(atob(text), (char) => char.charCodeAt(0)));
+	} catch (error) {
+		if (error instanceof DOMException && error.name === "InvalidCharacterError") throw invalidRequest("The x-metadata header is not base64");
+		throw error;
+	}
+};
+/** `body`, failing with 413 `EntityTooLarge` once it passes `maxBytes`. */
+const limitedBody = (body, maxBytes) => {
+	let size = 0;
+	return body.pipeThrough(new TransformStream({ transform: (chunk, controller) => {
+		size += chunk.length;
+		if (size > maxBytes) throw tooLarge();
+		controller.enqueue(chunk);
+	} }));
+};
+/**
+* The object of an upload request: a raw body with its Content-Type, `Cache-Control` and the base64 JSON of
+* `x-metadata`, or the file part of a `multipart/form-data` body with its type and the `cacheControl` and `metadata`
+* fields, as storage-js sends a `Blob` or `File` (see `multipartParts`). A multipart body is read whole, after its length is checked; a raw
+* body streams. Past `maxBytes` it is 413 `EntityTooLarge`.
+*/
+const incomingObject = async (request, maxBytes) => {
+	const header = request.headers.get("content-length");
+	const length = header === null ? void 0 : Number(header);
+	const contentType = request.headers.get("content-type") ?? defaultType;
+	if (!contentType.toLowerCase().startsWith("multipart/form-data")) {
+		if (length !== void 0 && length > maxBytes) throw tooLarge();
+		const metadata = request.headers.get("x-metadata");
+		return {
+			body: limitedBody(request.body ?? new Blob([]).stream(), maxBytes),
+			type: contentType,
+			...length !== void 0 && { length },
+			cacheControl: request.headers.get("cache-control") ?? defaultCacheControl,
+			userMetadata: parsedMetadata(metadata === null ? null : fromBase64(metadata))
+		};
+	}
+	if (length !== void 0 && length > maxBytes + 65536) throw tooLarge();
+	const boundary = boundaryOf(contentType);
+	const parts = boundary === void 0 ? void 0 : multipartParts(new Uint8Array(await request.arrayBuffer()), boundary);
+	if (!parts) throw invalidRequest("The multipart body does not parse");
+	const file = parts.find((part) => part.filename !== void 0);
+	if (!file) throw invalidRequest("The multipart body has no file");
+	if (file.body.length > maxBytes) throw tooLarge();
+	const field = (name) => {
+		const part = parts.find((one) => one.name === name && one.filename === void 0);
+		return part ? new TextDecoder().decode(part.body) : null;
+	};
+	const cacheControl = field("cacheControl");
+	return {
+		body: new Blob([file.body]).stream(),
+		type: file.type ?? defaultType,
+		length: file.body.length,
+		cacheControl: cacheControl === null ? defaultCacheControl : `max-age=${cacheControl}`,
+		userMetadata: parsedMetadata(field("metadata"))
+	};
+};
+//#endregion
+export { incomingObject, limitedBody };

package/dist/storage/object-key.js

@@ -0,0 +1,32 @@
+import { invalidBucketName, invalidKey } from "./storage-error.js";
+//#region src/storage/object-key.ts
+const bucketPattern = /^[\w!\-.*'() &$@=;:+,?]{1,100}$/;
+const maxNameBytes = 1024;
+const controlCharacters = /[\u0000-\u001f\u007f]/;
+/** A bucket id as Supabase Storage accepts it, else 400 `InvalidBucketName`. */
+const checkedBucketId = (id) => {
+	if (!bucketPattern.test(id)) throw invalidBucketName();
+	return id;
+};
+/**
+* An object name as Supabase Storage accepts it: not empty, at most 1024 bytes, no control characters, no empty folder
+* and no `.` or `..` folder. Else 400 `InvalidKey`.
+*/
+const checkedName = (name) => {
+	const parts = name.split("/");
+	if (!(name !== "" && new TextEncoder().encode(name).length <= maxNameBytes && !controlCharacters.test(name) && parts.every((part) => part !== "" && part !== "." && part !== ".."))) throw invalidKey(name);
+	return name;
+};
+const hex = (bytes) => [...new Uint8Array(bytes)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+/**
+* Where an object's bytes are kept in the storage provider: `storage/<sha-256 of bucket and name>/<version>`. Names may
+* hold any character, which no provider takes in a path; the hash takes every one, and the version keeps an upload apart
+* from the one it replaces until the database says which is current. A row without a version, as an import may leave
+* it, is at `unversioned`.
+*/
+const objectKey = async (bucket, name, version) => {
+	const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(JSON.stringify([bucket, name])));
+	return `storage/${hex(digest)}/${version ?? "unversioned"}`;
+};
+//#endregion
+export { checkedBucketId, checkedName, objectKey };

package/dist/storage/object-routes.js

@@ -0,0 +1,130 @@
+import { invalidRequest, objectNotFound } from "./storage-error.js";
+import { checkedBucketId, checkedName, objectKey } from "./object-key.js";
+import { deleteObjects, findPublicObject } from "./object-sql.js";
+import { asApp, asCaller } from "./storage-db.js";
+import { addressOf, jsonBody, stringField } from "./storage-context.js";
+import { ownerOf } from "./write-object.js";
+import { listFolder } from "./list-sql.js";
+import { serveObject } from "./serve-object.js";
+import { copyObject, moveObject, visibleObject } from "./move-copy.js";
+import { uploadObject } from "./upload-object.js";
+import { Hono } from "hono";
+//#region src/storage/object-routes.ts
+const sortColumns = /* @__PURE__ */ new Set([
+	"name",
+	"updated_at",
+	"created_at",
+	"last_accessed_at"
+]);
+const listQuery = (body) => {
+	const prefix = typeof body.prefix === "string" ? body.prefix : "";
+	const sortBy = typeof body.sortBy === "object" && body.sortBy !== null ? body.sortBy : {};
+	const column = typeof sortBy.column === "string" && sortColumns.has(sortBy.column) ? sortBy.column : "name";
+	const count = (value, fallback) => Number.isSafeInteger(value) && value >= 0 ? value : fallback;
+	return {
+		prefix: prefix === "" || prefix.endsWith("/") ? prefix : `${prefix}/`,
+		search: typeof body.search === "string" ? body.search : "",
+		limit: Math.min(count(body.limit, 100), 1e3),
+		offset: count(body.offset, 0),
+		column,
+		order: sortBy.order === "desc" ? "desc" : "asc"
+	};
+};
+/** The routes of objects that the caller's role reaches: upload, download, delete, info, list, move and copy, and public objects. */
+const objectRoutes = (deps) => {
+	const app = new Hono();
+	app.get("/object/public/:bucket/:name{.+}", async (c) => {
+		const { bucket, name } = addressOf(c);
+		const row = await asApp(deps, (trx) => findPublicObject(trx, bucket, name));
+		if (!row) throw objectNotFound();
+		return serveObject(deps.store, row, c.req.raw);
+	});
+	app.post("/object/list/:bucket", async (c) => {
+		const bucket = checkedBucketId(c.req.param("bucket"));
+		const query = listQuery(await jsonBody(c));
+		const caller = await deps.caller(c.req.raw);
+		return c.json(await asCaller(deps, caller, true, (trx) => listFolder(trx, bucket, query)));
+	});
+	app.post("/object/move", async (c) => {
+		const body = await jsonBody(c);
+		const caller = await deps.caller(c.req.raw);
+		const from = {
+			bucket: checkedBucketId(stringField(body, "bucketId")),
+			name: checkedName(stringField(body, "sourceKey"))
+		};
+		const to = {
+			bucket: checkedBucketId(typeof body.destinationBucket === "string" ? body.destinationBucket : from.bucket),
+			name: checkedName(stringField(body, "destinationKey"))
+		};
+		const id = await moveObject(deps, caller, from, to);
+		return c.json({
+			message: "Successfully moved",
+			Id: id,
+			Key: to.name
+		});
+	});
+	app.post("/object/copy", async (c) => {
+		const body = await jsonBody(c);
+		const caller = await deps.caller(c.req.raw);
+		const from = {
+			bucket: checkedBucketId(stringField(body, "bucketId")),
+			name: checkedName(stringField(body, "sourceKey"))
+		};
+		const to = {
+			bucket: checkedBucketId(typeof body.destinationBucket === "string" ? body.destinationBucket : from.bucket),
+			name: checkedName(stringField(body, "destinationKey"))
+		};
+		const { id } = await copyObject(deps, caller, from, to, c.req.header("x-upsert") === "true");
+		return c.json({
+			Id: id,
+			Key: `${to.bucket}/${to.name}`
+		});
+	});
+	app.get("/object/info/:bucket/:name{.+}", async (c) => {
+		const row = await visibleObject(deps, await deps.caller(c.req.raw), addressOf(c));
+		return c.json({
+			id: row.id,
+			name: row.name,
+			version: row.version,
+			bucket_id: row.bucket_id,
+			size: row.metadata?.size ?? null,
+			content_type: row.metadata?.mimetype ?? null,
+			cache_control: row.metadata?.cacheControl ?? null,
+			etag: row.metadata?.eTag ?? null,
+			metadata: row.user_metadata,
+			last_modified: row.updated_at,
+			created_at: row.created_at
+		});
+	});
+	for (const path of ["/object/authenticated/:bucket/:name{.+}", "/object/:bucket/:name{.+}"]) app.get(path, async (c) => serveObject(deps.store, await visibleObject(deps, await deps.caller(c.req.raw), addressOf(c)), c.req.raw));
+	app.on(["POST", "PUT"], "/object/:bucket/:name{.+}", async (c) => {
+		const caller = await deps.caller(c.req.raw);
+		const upsert = c.req.method === "PUT" || c.req.header("x-upsert") === "true";
+		return c.json(await uploadObject(deps, c.req.raw, {
+			...addressOf(c),
+			caller,
+			owner: ownerOf(caller),
+			upsert
+		}));
+	});
+	app.delete("/object/:bucket", async (c) => {
+		const bucket = checkedBucketId(c.req.param("bucket"));
+		const prefixes = (await jsonBody(c)).prefixes;
+		if (!Array.isArray(prefixes) || !prefixes.every((name) => typeof name === "string")) throw invalidRequest("body must have required property 'prefixes'");
+		const caller = await deps.caller(c.req.raw);
+		const deleted = await asCaller(deps, caller, false, (trx) => deleteObjects(trx, bucket, prefixes));
+		for (const row of deleted) await deps.store.delete(await objectKey(row.bucket_id, row.name, row.version));
+		return c.json(deleted);
+	});
+	app.delete("/object/:bucket/:name{.+}", async (c) => {
+		const { bucket, name } = addressOf(c);
+		const caller = await deps.caller(c.req.raw);
+		const [deleted] = await asCaller(deps, caller, false, (trx) => deleteObjects(trx, bucket, [name]));
+		if (!deleted) throw objectNotFound();
+		await deps.store.delete(await objectKey(deleted.bucket_id, deleted.name, deleted.version));
+		return c.json({ message: "Successfully deleted" });
+	});
+	return app;
+};
+//#endregion
+export { objectRoutes };

package/dist/storage/object-sql.js

@@ -0,0 +1,56 @@
+import { sql } from "kysely";
+//#region src/storage/object-sql.ts
+const columns = sql`id, bucket_id, name, owner, owner_id, version, metadata, user_metadata, created_at, updated_at, last_accessed_at`;
+const ownerUuid = (owner) => owner !== null && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(owner) ? owner : null;
+/** The object `name` of `bucket`, as the transaction's role may see it; locked for the transaction when `lock`. */
+const findObject = async (trx, bucket, name, lock = false) => {
+	const { rows } = await sql`select ${columns} from storage.objects where bucket_id = ${bucket} and name = ${name} ${lock ? sql`for update` : sql``}`.execute(trx);
+	return rows[0];
+};
+/** The object `name` of a public bucket, for anyone. */
+const findPublicObject = async (trx, bucket, name) => {
+	const { rows } = await sql`
+    select ${columns} from storage.objects
+    where bucket_id = ${bucket} and name = ${name} and exists (select from storage.buckets where id = ${bucket} and public)`.execute(trx);
+	return rows[0];
+};
+/** Which of `names` in `bucket` the transaction's role may see. */
+const visibleNames = async (trx, bucket, names) => (await sql`select name from storage.objects where bucket_id = ${bucket} and name = any(${names}::text[])`.execute(trx)).rows.map((row) => row.name);
+/** Adds the object; RLS refuses it with 42501, an existing name with 23505. No `returning`, which would need a select policy too. */
+const insertObject = async (trx, bucket, name, write) => {
+	const id = crypto.randomUUID();
+	await sql`
+    insert into storage.objects (id, bucket_id, name, owner, owner_id, version, metadata, user_metadata)
+    values (${id}, ${bucket}, ${name}, ${ownerUuid(write.owner)}, ${write.owner}, ${write.version}, ${JSON.stringify(write.metadata)}, ${write.user_metadata === null ? null : JSON.stringify(write.user_metadata)})`.execute(trx);
+	return id;
+};
+/** Replaces the object with `id`; whether the transaction's role could. */
+const updateObject = async (trx, id, write) => {
+	return (await sql`
+    update storage.objects set owner = ${ownerUuid(write.owner)}, owner_id = ${write.owner}, version = ${write.version},
+      metadata = ${JSON.stringify(write.metadata)}, user_metadata = ${write.user_metadata === null ? null : JSON.stringify(write.user_metadata)}
+    where id = ${id}`.execute(trx)).numAffectedRows === 1n;
+};
+/** Gives the object `name` a new bucket, name and version, as a move does; whether the transaction's role could. */
+const renameObject = async (trx, from, to) => {
+	return (await sql`
+    update storage.objects set bucket_id = ${to.bucket}, name = ${to.name}, version = ${to.version}, owner = ${ownerUuid(to.owner)}, owner_id = ${to.owner}
+    where bucket_id = ${from.bucket} and name = ${from.name}`.execute(trx)).numAffectedRows === 1n;
+};
+/**
+* Deletes the objects of `bucket` named in `names` that the transaction's role may delete, and gives them back. The
+* restored schema refuses a delete unless `storage.allow_delete_query` is set, as Supabase Storage sets it.
+*/
+const deleteObjects = async (trx, bucket, names) => {
+	await sql`select set_config('storage.allow_delete_query', 'true', true)`.execute(trx);
+	const { rows } = await sql`delete from storage.objects where bucket_id = ${bucket} and name = any(${names}::text[]) returning ${columns}`.execute(trx);
+	return rows;
+};
+/** Every object of `bucket` the transaction's role may delete, deleted and given back, as emptying a bucket does. */
+const deleteBucketObjects = async (trx, bucket) => {
+	await sql`select set_config('storage.allow_delete_query', 'true', true)`.execute(trx);
+	const { rows } = await sql`delete from storage.objects where bucket_id = ${bucket} returning ${columns}`.execute(trx);
+	return rows;
+};
+//#endregion
+export { deleteBucketObjects, deleteObjects, findObject, findPublicObject, insertObject, renameObject, updateObject, visibleNames };

package/dist/storage/serve-object.js

@@ -0,0 +1,51 @@
+import { HttpProblem } from "../problem.js";
+import "../files/media-types.js";
+import { objectNotFound } from "./storage-error.js";
+import { objectKey } from "./object-key.js";
+import { rangeOf } from "../files/download.js";
+//#region src/storage/serve-object.ts
+const disposition = (download, name) => {
+	if (download === null) return {};
+	const fileName = download || name.slice(name.lastIndexOf("/") + 1);
+	return { "content-disposition": `attachment; filename="${fileName.replace(/[^\x20-\x7e]|["\\]/g, "_")}"; filename*=UTF-8''${encodeURIComponent(fileName)}` };
+};
+/**
+* The bytes of an object, or the one range asked for, with the type, cache control and ETag it was uploaded with. The
+* type is the uploader's, as on Supabase, so nothing on the app's own origin may run: `nosniff` and a sandboxing CSP.
+*/
+const serveObject = async (store, row, request) => {
+	const key = await objectKey(row.bucket_id, row.name, row.version);
+	const object = await store.head(key);
+	if (!object) throw objectNotFound();
+	const headers = {
+		"content-type": row.metadata?.mimetype ?? "application/octet-stream",
+		"cache-control": row.metadata?.cacheControl ?? "no-cache",
+		...row.metadata?.eTag && { etag: row.metadata.eTag },
+		"last-modified": row.updated_at.toUTCString(),
+		"accept-ranges": "bytes",
+		"x-content-type-options": "nosniff",
+		"content-security-policy": "sandbox; default-src 'none'",
+		...disposition(new URL(request.url).searchParams.get("download"), row.name)
+	};
+	const range = rangeOf(request.headers.get("range"), object.size);
+	if (range === false) throw new HttpProblem(416, "range-not-satisfiable", "Range Not Satisfiable", "The requested range is outside the object", {}, { "content-range": `bytes */${object.size}` });
+	const body = await store.read(key, range);
+	if (!body) throw objectNotFound();
+	if (!range) return new Response(body, {
+		status: 200,
+		headers: {
+			...headers,
+			"content-length": String(object.size)
+		}
+	});
+	return new Response(body, {
+		status: 206,
+		headers: {
+			...headers,
+			"content-length": String(range.end - range.start + 1),
+			"content-range": `bytes ${range.start}-${range.end}/${object.size}`
+		}
+	});
+};
+//#endregion
+export { serveObject };

package/dist/storage/signed-routes.js

@@ -0,0 +1,121 @@
+import { invalidRequest, objectNotFound } from "./storage-error.js";
+import { checkedBucketId } from "./object-key.js";
+import { findObject, visibleNames } from "./object-sql.js";
+import { asApp, asCaller } from "./storage-db.js";
+import { addressOf, jsonBody } from "./storage-context.js";
+import { ownerOf, probeWrite } from "./write-object.js";
+import { serveObject } from "./serve-object.js";
+import { visibleObject } from "./move-copy.js";
+import { uploadObject } from "./upload-object.js";
+import { readGrant, signGrant } from "./storage-token.js";
+import { Hono } from "hono";
+//#region src/storage/signed-routes.ts
+const uploadSeconds = 7200;
+const expiresIn = (body) => {
+	const seconds = body.expiresIn;
+	if (typeof seconds !== "number" || !Number.isSafeInteger(seconds) || seconds < 1) throw invalidRequest("expiresIn must be a whole number of seconds, at least 1");
+	return Math.floor(Date.now() / 1e3) + seconds;
+};
+const queryToken = (request) => new URL(request.url).searchParams.get("token") ?? "";
+/**
+* Signed URLs: the caller signs a download of an object it may read, or an upload it may write, and anyone with the
+* URL then reads or writes that one object until it expires, without a key.
+*/
+const signedRoutes = (deps) => {
+	const app = new Hono();
+	app.post("/object/sign/:bucket/:name{.+}", async (c) => {
+		const { bucket, name } = addressOf(c);
+		const expires = expiresIn(await jsonBody(c));
+		await visibleObject(deps, await deps.caller(c.req.raw), {
+			bucket,
+			name
+		});
+		const token = await signGrant(deps.signer, "storage-download", {
+			bucket,
+			name,
+			expires
+		});
+		return c.json({ signedURL: `/object/sign/${bucket}/${name}?token=${token}` });
+	});
+	app.post("/object/sign/:bucket", async (c) => {
+		const bucket = checkedBucketId(c.req.param("bucket"));
+		const body = await jsonBody(c);
+		const expires = expiresIn(body);
+		if (!Array.isArray(body.paths) || !body.paths.every((path) => typeof path === "string")) throw invalidRequest("body must have required property 'paths'");
+		const paths = body.paths;
+		const caller = await deps.caller(c.req.raw);
+		const visible = new Set(await asCaller(deps, caller, true, (trx) => visibleNames(trx, bucket, paths)));
+		const signed = paths.map(async (path) => {
+			if (!visible.has(path)) return {
+				error: "Either the object does not exist or you do not have access to it",
+				path,
+				signedURL: null
+			};
+			const token = await signGrant(deps.signer, "storage-download", {
+				bucket,
+				name: path,
+				expires
+			});
+			return {
+				error: null,
+				path,
+				signedURL: `/object/sign/${bucket}/${path}?token=${token}`
+			};
+		});
+		return c.json(await Promise.all(signed));
+	});
+	app.get("/object/sign/:bucket/:name{.+}", async (c) => {
+		const { bucket, name } = addressOf(c);
+		await readGrant(deps.signer, "storage-download", queryToken(c.req.raw), {
+			bucket,
+			name
+		});
+		const row = await asApp(deps, (trx) => findObject(trx, bucket, name));
+		if (!row) throw objectNotFound();
+		return serveObject(deps.store, row, c.req.raw);
+	});
+	app.post("/object/upload/sign/:bucket/:name{.+}", async (c) => {
+		const { bucket, name } = addressOf(c);
+		const caller = await deps.caller(c.req.raw);
+		const upsert = c.req.header("x-upsert") === "true";
+		await probeWrite(deps, {
+			bucket,
+			name,
+			caller,
+			owner: ownerOf(caller),
+			upsert
+		}, c.req.header("content-type") ?? "application/octet-stream");
+		const token = await signGrant(deps.signer, "storage-upload", {
+			bucket,
+			name,
+			owner: ownerOf(caller),
+			upsert,
+			expires: Math.floor(Date.now() / 1e3) + uploadSeconds
+		});
+		return c.json({
+			url: `/object/upload/sign/${bucket}/${name}?token=${token}`,
+			token
+		});
+	});
+	app.put("/object/upload/sign/:bucket/:name{.+}", async (c) => {
+		const { bucket, name } = addressOf(c);
+		const grant = await readGrant(deps.signer, "storage-upload", queryToken(c.req.raw), {
+			bucket,
+			name
+		});
+		const { Key } = await uploadObject(deps, c.req.raw, {
+			bucket,
+			name,
+			caller: {
+				role: "app",
+				claims: { role: "service_role" }
+			},
+			owner: grant.owner,
+			upsert: grant.upsert
+		});
+		return c.json({ Key });
+	});
+	return app;
+};
+//#endregion
+export { signedRoutes };

package/dist/storage/storage-context.js

@@ -0,0 +1,25 @@
+import { invalidRequest } from "./storage-error.js";
+import { checkedBucketId, checkedName } from "./object-key.js";
+//#region src/storage/storage-context.ts
+/** The object a route's `:bucket` and `:name{.+}` address, both checked. */
+const addressOf = (c) => ({
+	bucket: checkedBucketId(c.req.param("bucket")),
+	name: checkedName(c.req.param("name"))
+});
+/** The JSON object of a request's body, else 400. */
+const jsonBody = async (c) => {
+	const body = await c.req.json().catch((error) => {
+		if (error instanceof SyntaxError) return void 0;
+		throw error;
+	});
+	if (typeof body !== "object" || body === null || Array.isArray(body)) throw invalidRequest("The body is not a JSON object");
+	return body;
+};
+/** A string field of a body, else 400 naming it. */
+const stringField = (body, name) => {
+	const value = body[name];
+	if (typeof value !== "string") throw invalidRequest(`body must have required property '${name}'`);
+	return value;
+};
+//#endregion
+export { addressOf, jsonBody, stringField };

package/dist/storage/storage-db.js

@@ -0,0 +1,23 @@
+import { readTransaction, writeTransaction } from "../transactions.js";
+import { callerSettings } from "../api-keys/caller-settings.js";
+import { sql } from "kysely";
+//#region src/storage/storage-db.ts
+/**
+* Makes the rest of the transaction run as `caller`: its role and claims, as `/rest/v1` sets them (see
+* `callerSettings`), so the restored `storage.objects` and `storage.buckets` policies decide what it reads and writes.
+* What runs before it runs as the app's own role, which owns the tables.
+*/
+const becomeCaller = async (trx, deps, caller) => {
+	const settings = Object.entries(callerSettings(caller, deps.actorSetting));
+	await sql`select ${sql.join(settings.map(([name, value]) => sql`set_config(${name}, ${value}, true)`))}`.execute(trx);
+};
+/** Runs `work` in one transaction as `caller`, read-only when `readOnly`. */
+const asCaller = (deps, caller, readOnly, work) => {
+	const settings = callerSettings(caller, deps.actorSetting);
+	if (readOnly) return readTransaction(deps.db, deps.statementTimeoutMs, work, settings);
+	return writeTransaction(deps.db, deps.statementTimeoutMs, work, settings);
+};
+/** Runs `work` in one transaction as the app's own role, for what no caller decides: public objects, signed URLs. */
+const asApp = (deps, work) => writeTransaction(deps.db, deps.statementTimeoutMs, work);
+//#endregion
+export { asApp, asCaller, becomeCaller };

package/dist/storage/storage-error.js

@@ -0,0 +1,63 @@
+import { HttpProblem } from "../problem.js";
+import { isDatabaseError } from "../error-handler.js";
+//#region src/storage/storage-error.ts
+/**
+* An error as Supabase Storage sends it, which storage-js hands to the app as `error`: the HTTP status is 400 for any
+* refusal and 500 for a failure, and `statusCode` in the body says what it was (`404`, `403`, `409`, …).
+*/
+var StorageError = class extends Error {
+	statusCode;
+	code;
+	error;
+	constructor(statusCode, code, error, message) {
+		super(message);
+		this.statusCode = statusCode;
+		this.code = code;
+		this.error = error;
+	}
+	get status() {
+		return this.statusCode === 500 ? 500 : 400;
+	}
+	get body() {
+		return {
+			statusCode: String(this.statusCode),
+			code: this.code,
+			error: this.error,
+			message: this.message
+		};
+	}
+};
+const objectNotFound = () => new StorageError(404, "NoSuchKey", "not_found", "Object not found");
+const bucketNotFound = () => new StorageError(404, "NoSuchBucket", "Bucket not found", "Bucket not found");
+const accessDenied = (message = "new row violates row-level security policy") => new StorageError(403, "AccessDenied", "Unauthorized", message);
+const alreadyExists = () => new StorageError(409, "Duplicate", "Duplicate", "The resource already exists");
+const invalidRequest = (message) => new StorageError(400, "InvalidRequest", "InvalidRequest", message);
+const invalidKey = (key) => new StorageError(400, "InvalidKey", "InvalidKey", `Invalid key: ${key}`);
+const invalidBucketName = () => new StorageError(400, "InvalidBucketName", "Invalid Input", "Bucket name invalid");
+const invalidSignature = () => new StorageError(400, "InvalidSignature", "InvalidSignature", "Invalid signature");
+const expiredSignature = () => new StorageError(400, "ExpiredToken", "ExpiredToken", "The provided token has expired.");
+const tooLarge = () => new StorageError(413, "EntityTooLarge", "Payload too large", "The object exceeded the maximum allowed size");
+const mimeTypeRefused = (type) => new StorageError(415, "InvalidMimeType", "invalid_mime_type", `mime type ${type} is not supported`);
+const bucketNotEmpty = () => new StorageError(409, "ResourceNotEmpty", "ResourceNotEmpty", "The bucket you tried to delete is not empty");
+const databaseError = (code, message) => {
+	if (code === "42501") return accessDenied(message.includes("row-level security") ? void 0 : message);
+	if (code === "23505") return alreadyExists();
+	if (code === "23503") return new StorageError(404, "InvalidRequest", "InvalidRequest", "The related resource does not exist");
+	if (code === "42P01" || code === "3F000") return new StorageError(500, "DatabaseError", "DatabaseError", "This app has no storage schema: restore one with protobase import supabase");
+};
+/**
+* The Storage error an error stands for: its own, a refusal of the database's (RLS, a duplicate key, a missing bucket),
+* or a problem such as a full provider's 507 and the caller's 401. Other errors give `undefined`.
+*/
+const storageErrorOf = (error) => {
+	if (error instanceof StorageError) return error;
+	if (error instanceof HttpProblem) return new StorageError(error.status, error.slug, error.title, error.detail);
+	if (!isDatabaseError(error)) return void 0;
+	return databaseError(error.code, error.message);
+};
+const errorResponse = (error) => new Response(JSON.stringify(error.body), {
+	status: error.status,
+	headers: { "content-type": "application/json; charset=utf-8" }
+});
+//#endregion
+export { StorageError, accessDenied, alreadyExists, bucketNotEmpty, bucketNotFound, errorResponse, expiredSignature, invalidBucketName, invalidKey, invalidRequest, invalidSignature, mimeTypeRefused, objectNotFound, storageErrorOf, tooLarge };

package/dist/storage/storage-routes.js

@@ -0,0 +1,28 @@
+import { StorageError, errorResponse, storageErrorOf } from "./storage-error.js";
+import { bucketRoutes } from "./bucket-routes.js";
+import { objectRoutes } from "./object-routes.js";
+import { signedRoutes } from "./signed-routes.js";
+import { Hono } from "hono";
+//#region src/storage/storage-routes.ts
+/**
+* The Storage-compatible API `supabase.storage` calls, mounted at `/storage/v1`, over the app's storage provider. Every
+* read and write of `storage.objects` and `storage.buckets` runs as the request's caller (`anon`, `authenticated` or
+* the app's own role), so the policies restored with them decide; public buckets and signed URLs need no key. Errors
+* come back as Supabase Storage's `{ statusCode, error, message }`; an unexpected one as a 500 that names nothing of it.
+*/
+const storageRoutes = ({ deps, report }) => {
+	const app = new Hono();
+	app.onError((error, c) => {
+		const known = storageErrorOf(error);
+		if (known) return errorResponse(known);
+		report?.(error, c.req.raw);
+		return errorResponse(new StorageError(500, "InternalError", "Internal", "Internal Server Error"));
+	});
+	app.route("/", signedRoutes(deps));
+	app.route("/", objectRoutes(deps));
+	app.route("/", bucketRoutes(deps));
+	app.notFound(() => errorResponse(new StorageError(404, "NotFound", "not_found", "Route not found")));
+	return app;
+};
+//#endregion
+export { storageRoutes };

package/dist/storage/storage-token.js

@@ -0,0 +1,28 @@
+import { expiredSignature, invalidSignature } from "./storage-error.js";
+//#region src/storage/storage-token.ts
+const encode = (value) => btoa(String.fromCharCode(...new TextEncoder().encode(JSON.stringify(value)))).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+const decode = (text) => {
+	if (!/^[\w-]+$/.test(text)) return void 0;
+	try {
+		return JSON.parse(new TextDecoder().decode(Uint8Array.from(atob(text.replaceAll("-", "+").replaceAll("_", "/")), (char) => char.charCodeAt(0))));
+	} catch (error) {
+		if (error instanceof SyntaxError || error instanceof DOMException && error.name === "InvalidCharacterError") return void 0;
+		throw error;
+	}
+};
+/** The `token` of a signed URL: the grant and the signature over it, both URL-safe, joined by `.`. */
+const signGrant = async (signer, purpose, grant) => `${encode(grant)}.${await signer.sign(purpose, [grant])}`;
+/**
+* The grant of a token signed for `purpose`, when it is for the object at `bucket` and `name` and has not expired at
+* `now`; else 400 `InvalidSignature` or `ExpiredToken`, as Supabase Storage answers.
+*/
+const readGrant = async (signer, purpose, token, object, now = Date.now()) => {
+	const [payload = "", signature = ""] = token.split(".");
+	const grant = decode(payload);
+	if (typeof grant !== "object" || grant === null || !await signer.verify(purpose, [grant], signature)) throw invalidSignature();
+	if (grant.bucket !== object.bucket || grant.name !== object.name) throw invalidSignature();
+	if (grant.expires * 1e3 < now) throw expiredSignature();
+	return grant;
+};
+//#endregion
+export { readGrant, signGrant };

package/dist/storage/upload-object.js

@@ -0,0 +1,37 @@
+import { accepts } from "../files/media-types.js";
+import { findBucket } from "./bucket-sql.js";
+import { bucketNotFound, mimeTypeRefused } from "./storage-error.js";
+import { asApp } from "./storage-db.js";
+import { writeObject } from "./write-object.js";
+import { incomingObject } from "./object-body.js";
+//#region src/storage/upload-object.ts
+/** The bucket an upload goes to, read as the app, as Supabase Storage reads it: its size limit and allowed types. */
+const uploadBucket = async (deps, id) => {
+	const bucket = await asApp(deps, (trx) => findBucket(trx, id));
+	if (!bucket) throw bucketNotFound();
+	return bucket;
+};
+/**
+* Stores the object a request uploads at `target` (see `writeObject`), within the bucket's size limit and the app's,
+* and of a type the bucket allows. Answers what storage-js reads back: the row's id and `<bucket>/<name>`.
+*/
+const uploadObject = async (deps, request, target) => {
+	const bucket = await uploadBucket(deps, target.bucket);
+	const maxBytes = Math.min(bucket.file_size_limit ?? Infinity, deps.maxBytes);
+	const incoming = await incomingObject(request, maxBytes);
+	const type = incoming.type.split(";", 1)[0].trim().toLowerCase();
+	if (bucket.allowed_mime_types?.length && !accepts(bucket.allowed_mime_types, type)) {
+		await incoming.body.cancel();
+		throw mimeTypeRefused(type);
+	}
+	const { id } = await writeObject(deps, target, {
+		...incoming,
+		store: (key) => deps.store.put(key, incoming.body)
+	});
+	return {
+		Id: id,
+		Key: `${target.bucket}/${target.name}`
+	};
+};
+//#endregion
+export { uploadBucket, uploadObject };

package/dist/storage/write-object.js

@@ -0,0 +1,85 @@
+import { accessDenied, alreadyExists } from "./storage-error.js";
+import { objectKey } from "./object-key.js";
+import { findObject, insertObject, updateObject } from "./object-sql.js";
+import { asApp, becomeCaller } from "./storage-db.js";
+//#region src/storage/write-object.ts
+/** The owner Supabase records for a write: the signed-in user, or nobody for the keys alone. */
+const ownerOf = (caller) => caller.role === "authenticated" && typeof caller.claims.sub === "string" ? caller.claims.sub : null;
+const writeRow = async (trx, deps, target, write) => {
+	const existing = await findObject(trx, target.bucket, target.name, true);
+	if (existing && !target.upsert) throw alreadyExists();
+	await becomeCaller(trx, deps, target.caller);
+	if (!existing) return {
+		id: await insertObject(trx, target.bucket, target.name, write),
+		replaced: void 0
+	};
+	if (!await updateObject(trx, existing.id, write)) throw accessDenied();
+	return {
+		id: existing.id,
+		replaced: existing
+	};
+};
+var ProbeDone = class extends Error {};
+/**
+* Whether the caller may write the object, decided by the restored policies on a row written and rolled back, before
+* any byte is stored: a refused upload costs no storage. Throws the refusal.
+*/
+const probeWrite = async (deps, target, type) => {
+	const metadata = {
+		eTag: "",
+		size: 0,
+		mimetype: type,
+		cacheControl: "",
+		lastModified: (/* @__PURE__ */ new Date()).toISOString(),
+		contentLength: 0,
+		httpStatusCode: 200
+	};
+	await asApp(deps, async (trx) => {
+		await writeRow(trx, deps, target, {
+			owner: target.owner,
+			version: crypto.randomUUID(),
+			metadata,
+			user_metadata: null
+		});
+		throw new ProbeDone();
+	}).catch((error) => {
+		if (!(error instanceof ProbeDone)) throw error;
+	});
+};
+/**
+* Writes an object: checks the caller may (`probeWrite`), stores the bytes under a new version, then writes the row
+* as the caller in one transaction, so the policies decide again on the real row. When that fails, the new bytes are
+* deleted; once it commits, the bytes of the object it replaced are.
+*/
+const writeObject = async (deps, target, bytes) => {
+	await probeWrite(deps, target, bytes.type);
+	const version = crypto.randomUUID();
+	const key = await objectKey(target.bucket, target.name, version);
+	const { size } = await bytes.store(key);
+	const metadata = {
+		eTag: `"${version}"`,
+		size,
+		mimetype: bytes.type,
+		cacheControl: bytes.cacheControl,
+		lastModified: (/* @__PURE__ */ new Date()).toUTCString(),
+		contentLength: size,
+		httpStatusCode: 200
+	};
+	const write = {
+		owner: target.owner,
+		version,
+		metadata,
+		user_metadata: bytes.userMetadata
+	};
+	const written = await asApp(deps, (trx) => writeRow(trx, deps, target, write)).catch(async (error) => {
+		await deps.store.delete(key);
+		throw error;
+	});
+	if (written.replaced) await deps.store.delete(await objectKey(target.bucket, target.name, written.replaced.version));
+	return {
+		id: written.id,
+		metadata
+	};
+};
+//#endregion
+export { ownerOf, probeWrite, writeObject };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.30.0",
+  "version": "0.30.1",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -32,9 +32,9 @@
   "dependencies": {
     "@better-auth/passkey": "^1.7.7",
     "@better-auth/sso": "^1.7.7",
-    "@protobase/layout": "0.30.0",
-    "@protobase/query": "0.30.0",
-    "@protobase/schema": "0.30.0",
+    "@protobase/layout": "0.30.1",
+    "@protobase/query": "0.30.1",
+    "@protobase/schema": "0.30.1",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",