@protobase/server 0.30.0 → 0.30.2

package/dist/storage/object-body.js

@@ -0,0 +1,75 @@
+import { invalidRequest, tooLarge } from "./storage-error.js";
+import { boundaryOf, multipartParts } from "./multipart.js";
+//#region src/storage/object-body.ts
+const defaultType = "text/plain;charset=UTF-8";
+const defaultCacheControl = "max-age=3600";
+const parsedMetadata = (text) => {
+	if (text === null) return null;
+	try {
+		const value = JSON.parse(text);
+		if (typeof value === "object" && value !== null && !Array.isArray(value)) return value;
+	} catch (error) {
+		if (!(error instanceof SyntaxError)) throw error;
+	}
+	throw invalidRequest("The metadata is not a JSON object");
+};
+const fromBase64 = (text) => {
+	try {
+		return new TextDecoder().decode(Uint8Array.from(atob(text), (char) => char.charCodeAt(0)));
+	} catch (error) {
+		if (error instanceof DOMException && error.name === "InvalidCharacterError") throw invalidRequest("The x-metadata header is not base64");
+		throw error;
+	}
+};
+/** `body`, failing with 413 `EntityTooLarge` once it passes `maxBytes`. */
+const limitedBody = (body, maxBytes) => {
+	let size = 0;
+	return body.pipeThrough(new TransformStream({ transform: (chunk, controller) => {
+		size += chunk.length;
+		if (size > maxBytes) throw tooLarge();
+		controller.enqueue(chunk);
+	} }));
+};
+/**
+* The object of an upload request: a raw body with its Content-Type, `Cache-Control` and the base64 JSON of
+* `x-metadata`, or the file part of a `multipart/form-data` body with its type and the `cacheControl` and `metadata`
+* fields, as storage-js sends a `Blob` or `File` (see `multipartParts`). A multipart body is read whole, after its length is checked; a raw
+* body streams. Past `maxBytes` it is 413 `EntityTooLarge`.
+*/
+const incomingObject = async (request, maxBytes) => {
+	const header = request.headers.get("content-length");
+	const length = header === null ? void 0 : Number(header);
+	const contentType = request.headers.get("content-type") ?? defaultType;
+	if (!contentType.toLowerCase().startsWith("multipart/form-data")) {
+		if (length !== void 0 && length > maxBytes) throw tooLarge();
+		const metadata = request.headers.get("x-metadata");
+		return {
+			body: limitedBody(request.body ?? new Blob([]).stream(), maxBytes),
+			type: contentType,
+			...length !== void 0 && { length },
+			cacheControl: request.headers.get("cache-control") ?? defaultCacheControl,
+			userMetadata: parsedMetadata(metadata === null ? null : fromBase64(metadata))
+		};
+	}
+	if (length !== void 0 && length > maxBytes + 65536) throw tooLarge();
+	const boundary = boundaryOf(contentType);
+	const parts = boundary === void 0 ? void 0 : multipartParts(new Uint8Array(await request.arrayBuffer()), boundary);
+	if (!parts) throw invalidRequest("The multipart body does not parse");
+	const file = parts.find((part) => part.filename !== void 0);
+	if (!file) throw invalidRequest("The multipart body has no file");
+	if (file.body.length > maxBytes) throw tooLarge();
+	const field = (name) => {
+		const part = parts.find((one) => one.name === name && one.filename === void 0);
+		return part ? new TextDecoder().decode(part.body) : null;
+	};
+	const cacheControl = field("cacheControl");
+	return {
+		body: new Blob([file.body]).stream(),
+		type: file.type ?? defaultType,
+		length: file.body.length,
+		cacheControl: cacheControl === null ? defaultCacheControl : `max-age=${cacheControl}`,
+		userMetadata: parsedMetadata(field("metadata"))
+	};
+};
+//#endregion
+export { incomingObject, limitedBody };

package/dist/storage/object-key.d.ts

@@ -0,0 +1,9 @@
+//#region src/storage/object-key.d.ts
+/**
+ * Where an object's bytes are kept in the storage provider: `storage/<sha-256 of bucket and name>/<version>`. Names may
+ * hold any character, which no provider takes in a path; the hash takes every one, and the version keeps an upload apart
+ * from the one it replaces until the database says which is current. A row without a version, as an import may leave
+ * it, is at `unversioned`.
+ */
+export declare const objectKey: (bucket: string, name: string, version: string | null) => Promise<string>;
+//#endregion

package/dist/storage/object-key.js

@@ -0,0 +1,32 @@
+import { invalidBucketName, invalidKey } from "./storage-error.js";
+//#region src/storage/object-key.ts
+const bucketPattern = /^[\w!\-.*'() &$@=;:+,?]{1,100}$/;
+const maxNameBytes = 1024;
+const controlCharacters = /[\u0000-\u001f\u007f]/;
+/** A bucket id as Supabase Storage accepts it, else 400 `InvalidBucketName`. */
+const checkedBucketId = (id) => {
+	if (!bucketPattern.test(id)) throw invalidBucketName();
+	return id;
+};
+/**
+* An object name as Supabase Storage accepts it: not empty, at most 1024 bytes, no control characters, no empty folder
+* and no `.` or `..` folder. Else 400 `InvalidKey`.
+*/
+const checkedName = (name) => {
+	const parts = name.split("/");
+	if (!(name !== "" && new TextEncoder().encode(name).length <= maxNameBytes && !controlCharacters.test(name) && parts.every((part) => part !== "" && part !== "." && part !== ".."))) throw invalidKey(name);
+	return name;
+};
+const hex = (bytes) => [...new Uint8Array(bytes)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+/**
+* Where an object's bytes are kept in the storage provider: `storage/<sha-256 of bucket and name>/<version>`. Names may
+* hold any character, which no provider takes in a path; the hash takes every one, and the version keeps an upload apart
+* from the one it replaces until the database says which is current. A row without a version, as an import may leave
+* it, is at `unversioned`.
+*/
+const objectKey = async (bucket, name, version) => {
+	const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(JSON.stringify([bucket, name])));
+	return `storage/${hex(digest)}/${version ?? "unversioned"}`;
+};
+//#endregion
+export { checkedBucketId, checkedName, objectKey };

package/dist/storage/object-routes.js

@@ -0,0 +1,130 @@
+import { invalidRequest, objectNotFound } from "./storage-error.js";
+import { checkedBucketId, checkedName, objectKey } from "./object-key.js";
+import { deleteObjects, findPublicObject } from "./object-sql.js";
+import { asApp, asCaller } from "./storage-db.js";
+import { addressOf, jsonBody, stringField } from "./storage-context.js";
+import { ownerOf } from "./write-object.js";
+import { listFolder } from "./list-sql.js";
+import { serveObject } from "./serve-object.js";
+import { copyObject, moveObject, visibleObject } from "./move-copy.js";
+import { uploadObject } from "./upload-object.js";
+import { Hono } from "hono";
+//#region src/storage/object-routes.ts
+const sortColumns = /* @__PURE__ */ new Set([
+	"name",
+	"updated_at",
+	"created_at",
+	"last_accessed_at"
+]);
+const listQuery = (body) => {
+	const prefix = typeof body.prefix === "string" ? body.prefix : "";
+	const sortBy = typeof body.sortBy === "object" && body.sortBy !== null ? body.sortBy : {};
+	const column = typeof sortBy.column === "string" && sortColumns.has(sortBy.column) ? sortBy.column : "name";
+	const count = (value, fallback) => Number.isSafeInteger(value) && value >= 0 ? value : fallback;
+	return {
+		prefix: prefix === "" || prefix.endsWith("/") ? prefix : `${prefix}/`,
+		search: typeof body.search === "string" ? body.search : "",
+		limit: Math.min(count(body.limit, 100), 1e3),
+		offset: count(body.offset, 0),
+		column,
+		order: sortBy.order === "desc" ? "desc" : "asc"
+	};
+};
+/** The routes of objects that the caller's role reaches: upload, download, delete, info, list, move and copy, and public objects. */
+const objectRoutes = (deps) => {
+	const app = new Hono();
+	app.get("/object/public/:bucket/:name{.+}", async (c) => {
+		const { bucket, name } = addressOf(c);
+		const row = await asApp(deps, (trx) => findPublicObject(trx, bucket, name));
+		if (!row) throw objectNotFound();
+		return serveObject(deps.store, row, c.req.raw);
+	});
+	app.post("/object/list/:bucket", async (c) => {
+		const bucket = checkedBucketId(c.req.param("bucket"));
+		const query = listQuery(await jsonBody(c));
+		const caller = await deps.caller(c.req.raw);
+		return c.json(await asCaller(deps, caller, true, (trx) => listFolder(trx, bucket, query)));
+	});
+	app.post("/object/move", async (c) => {
+		const body = await jsonBody(c);
+		const caller = await deps.caller(c.req.raw);
+		const from = {
+			bucket: checkedBucketId(stringField(body, "bucketId")),
+			name: checkedName(stringField(body, "sourceKey"))
+		};
+		const to = {
+			bucket: checkedBucketId(typeof body.destinationBucket === "string" ? body.destinationBucket : from.bucket),
+			name: checkedName(stringField(body, "destinationKey"))
+		};
+		const id = await moveObject(deps, caller, from, to);
+		return c.json({
+			message: "Successfully moved",
+			Id: id,
+			Key: to.name
+		});
+	});
+	app.post("/object/copy", async (c) => {
+		const body = await jsonBody(c);
+		const caller = await deps.caller(c.req.raw);
+		const from = {
+			bucket: checkedBucketId(stringField(body, "bucketId")),
+			name: checkedName(stringField(body, "sourceKey"))
+		};
+		const to = {
+			bucket: checkedBucketId(typeof body.destinationBucket === "string" ? body.destinationBucket : from.bucket),
+			name: checkedName(stringField(body, "destinationKey"))
+		};
+		const { id } = await copyObject(deps, caller, from, to, c.req.header("x-upsert") === "true");
+		return c.json({
+			Id: id,
+			Key: `${to.bucket}/${to.name}`
+		});
+	});
+	app.get("/object/info/:bucket/:name{.+}", async (c) => {
+		const row = await visibleObject(deps, await deps.caller(c.req.raw), addressOf(c));
+		return c.json({
+			id: row.id,
+			name: row.name,
+			version: row.version,
+			bucket_id: row.bucket_id,
+			size: row.metadata?.size ?? null,
+			content_type: row.metadata?.mimetype ?? null,
+			cache_control: row.metadata?.cacheControl ?? null,
+			etag: row.metadata?.eTag ?? null,
+			metadata: row.user_metadata,
+			last_modified: row.updated_at,
+			created_at: row.created_at
+		});
+	});
+	for (const path of ["/object/authenticated/:bucket/:name{.+}", "/object/:bucket/:name{.+}"]) app.get(path, async (c) => serveObject(deps.store, await visibleObject(deps, await deps.caller(c.req.raw), addressOf(c)), c.req.raw));
+	app.on(["POST", "PUT"], "/object/:bucket/:name{.+}", async (c) => {
+		const caller = await deps.caller(c.req.raw);
+		const upsert = c.req.method === "PUT" || c.req.header("x-upsert") === "true";
+		return c.json(await uploadObject(deps, c.req.raw, {
+			...addressOf(c),
+			caller,
+			owner: ownerOf(caller),
+			upsert
+		}));
+	});
+	app.delete("/object/:bucket", async (c) => {
+		const bucket = checkedBucketId(c.req.param("bucket"));
+		const prefixes = (await jsonBody(c)).prefixes;
+		if (!Array.isArray(prefixes) || !prefixes.every((name) => typeof name === "string")) throw invalidRequest("body must have required property 'prefixes'");
+		const caller = await deps.caller(c.req.raw);
+		const deleted = await asCaller(deps, caller, false, (trx) => deleteObjects(trx, bucket, prefixes));
+		for (const row of deleted) await deps.store.delete(await objectKey(row.bucket_id, row.name, row.version));
+		return c.json(deleted);
+	});
+	app.delete("/object/:bucket/:name{.+}", async (c) => {
+		const { bucket, name } = addressOf(c);
+		const caller = await deps.caller(c.req.raw);
+		const [deleted] = await asCaller(deps, caller, false, (trx) => deleteObjects(trx, bucket, [name]));
+		if (!deleted) throw objectNotFound();
+		await deps.store.delete(await objectKey(deleted.bucket_id, deleted.name, deleted.version));
+		return c.json({ message: "Successfully deleted" });
+	});
+	return app;
+};
+//#endregion
+export { objectRoutes };

package/dist/storage/object-sql.js

@@ -0,0 +1,56 @@
+import { sql } from "kysely";
+//#region src/storage/object-sql.ts
+const columns = sql`id, bucket_id, name, owner, owner_id, version, metadata, user_metadata, created_at, updated_at, last_accessed_at`;
+const ownerUuid = (owner) => owner !== null && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(owner) ? owner : null;
+/** The object `name` of `bucket`, as the transaction's role may see it; locked for the transaction when `lock`. */
+const findObject = async (trx, bucket, name, lock = false) => {
+	const { rows } = await sql`select ${columns} from storage.objects where bucket_id = ${bucket} and name = ${name} ${lock ? sql`for update` : sql``}`.execute(trx);
+	return rows[0];
+};
+/** The object `name` of a public bucket, for anyone. */
+const findPublicObject = async (trx, bucket, name) => {
+	const { rows } = await sql`
+    select ${columns} from storage.objects
+    where bucket_id = ${bucket} and name = ${name} and exists (select from storage.buckets where id = ${bucket} and public)`.execute(trx);
+	return rows[0];
+};
+/** Which of `names` in `bucket` the transaction's role may see. */
+const visibleNames = async (trx, bucket, names) => (await sql`select name from storage.objects where bucket_id = ${bucket} and name = any(${names}::text[])`.execute(trx)).rows.map((row) => row.name);
+/** Adds the object; RLS refuses it with 42501, an existing name with 23505. No `returning`, which would need a select policy too. */
+const insertObject = async (trx, bucket, name, write) => {
+	const id = crypto.randomUUID();
+	await sql`
+    insert into storage.objects (id, bucket_id, name, owner, owner_id, version, metadata, user_metadata)
+    values (${id}, ${bucket}, ${name}, ${ownerUuid(write.owner)}, ${write.owner}, ${write.version}, ${JSON.stringify(write.metadata)}, ${write.user_metadata === null ? null : JSON.stringify(write.user_metadata)})`.execute(trx);
+	return id;
+};
+/** Replaces the object with `id`; whether the transaction's role could. */
+const updateObject = async (trx, id, write) => {
+	return (await sql`
+    update storage.objects set owner = ${ownerUuid(write.owner)}, owner_id = ${write.owner}, version = ${write.version},
+      metadata = ${JSON.stringify(write.metadata)}, user_metadata = ${write.user_metadata === null ? null : JSON.stringify(write.user_metadata)}
+    where id = ${id}`.execute(trx)).numAffectedRows === 1n;
+};
+/** Gives the object `name` a new bucket, name and version, as a move does; whether the transaction's role could. */
+const renameObject = async (trx, from, to) => {
+	return (await sql`
+    update storage.objects set bucket_id = ${to.bucket}, name = ${to.name}, version = ${to.version}, owner = ${ownerUuid(to.owner)}, owner_id = ${to.owner}
+    where bucket_id = ${from.bucket} and name = ${from.name}`.execute(trx)).numAffectedRows === 1n;
+};
+/**
+* Deletes the objects of `bucket` named in `names` that the transaction's role may delete, and gives them back. The
+* restored schema refuses a delete unless `storage.allow_delete_query` is set, as Supabase Storage sets it.
+*/
+const deleteObjects = async (trx, bucket, names) => {
+	await sql`select set_config('storage.allow_delete_query', 'true', true)`.execute(trx);
+	const { rows } = await sql`delete from storage.objects where bucket_id = ${bucket} and name = any(${names}::text[]) returning ${columns}`.execute(trx);
+	return rows;
+};
+/** Every object of `bucket` the transaction's role may delete, deleted and given back, as emptying a bucket does. */
+const deleteBucketObjects = async (trx, bucket) => {
+	await sql`select set_config('storage.allow_delete_query', 'true', true)`.execute(trx);
+	const { rows } = await sql`delete from storage.objects where bucket_id = ${bucket} returning ${columns}`.execute(trx);
+	return rows;
+};
+//#endregion
+export { deleteBucketObjects, deleteObjects, findObject, findPublicObject, insertObject, renameObject, updateObject, visibleNames };

package/dist/storage/serve-object.js

@@ -0,0 +1,51 @@
+import { HttpProblem } from "../problem.js";
+import "../files/media-types.js";
+import { objectNotFound } from "./storage-error.js";
+import { objectKey } from "./object-key.js";
+import { rangeOf } from "../files/download.js";
+//#region src/storage/serve-object.ts
+const disposition = (download, name) => {
+	if (download === null) return {};
+	const fileName = download || name.slice(name.lastIndexOf("/") + 1);
+	return { "content-disposition": `attachment; filename="${fileName.replace(/[^\x20-\x7e]|["\\]/g, "_")}"; filename*=UTF-8''${encodeURIComponent(fileName)}` };
+};
+/**
+* The bytes of an object, or the one range asked for, with the type, cache control and ETag it was uploaded with. The
+* type is the uploader's, as on Supabase, so nothing on the app's own origin may run: `nosniff` and a sandboxing CSP.
+*/
+const serveObject = async (store, row, request) => {
+	const key = await objectKey(row.bucket_id, row.name, row.version);
+	const object = await store.head(key);
+	if (!object) throw objectNotFound();
+	const headers = {
+		"content-type": row.metadata?.mimetype ?? "application/octet-stream",
+		"cache-control": row.metadata?.cacheControl ?? "no-cache",
+		...row.metadata?.eTag && { etag: row.metadata.eTag },
+		"last-modified": row.updated_at.toUTCString(),
+		"accept-ranges": "bytes",
+		"x-content-type-options": "nosniff",
+		"content-security-policy": "sandbox; default-src 'none'",
+		...disposition(new URL(request.url).searchParams.get("download"), row.name)
+	};
+	const range = rangeOf(request.headers.get("range"), object.size);
+	if (range === false) throw new HttpProblem(416, "range-not-satisfiable", "Range Not Satisfiable", "The requested range is outside the object", {}, { "content-range": `bytes */${object.size}` });
+	const body = await store.read(key, range);
+	if (!body) throw objectNotFound();
+	if (!range) return new Response(body, {
+		status: 200,
+		headers: {
+			...headers,
+			"content-length": String(object.size)
+		}
+	});
+	return new Response(body, {
+		status: 206,
+		headers: {
+			...headers,
+			"content-length": String(range.end - range.start + 1),
+			"content-range": `bytes ${range.start}-${range.end}/${object.size}`
+		}
+	});
+};
+//#endregion
+export { serveObject };

package/dist/storage/signed-routes.js

@@ -0,0 +1,121 @@
+import { invalidRequest, objectNotFound } from "./storage-error.js";
+import { checkedBucketId } from "./object-key.js";
+import { findObject, visibleNames } from "./object-sql.js";
+import { asApp, asCaller } from "./storage-db.js";
+import { addressOf, jsonBody } from "./storage-context.js";
+import { ownerOf, probeWrite } from "./write-object.js";
+import { serveObject } from "./serve-object.js";
+import { visibleObject } from "./move-copy.js";
+import { uploadObject } from "./upload-object.js";
+import { readGrant, signGrant } from "./storage-token.js";
+import { Hono } from "hono";
+//#region src/storage/signed-routes.ts
+const uploadSeconds = 7200;
+const expiresIn = (body) => {
+	const seconds = body.expiresIn;
+	if (typeof seconds !== "number" || !Number.isSafeInteger(seconds) || seconds < 1) throw invalidRequest("expiresIn must be a whole number of seconds, at least 1");
+	return Math.floor(Date.now() / 1e3) + seconds;
+};
+const queryToken = (request) => new URL(request.url).searchParams.get("token") ?? "";
+/**
+* Signed URLs: the caller signs a download of an object it may read, or an upload it may write, and anyone with the
+* URL then reads or writes that one object until it expires, without a key.
+*/
+const signedRoutes = (deps) => {
+	const app = new Hono();
+	app.post("/object/sign/:bucket/:name{.+}", async (c) => {
+		const { bucket, name } = addressOf(c);
+		const expires = expiresIn(await jsonBody(c));
+		await visibleObject(deps, await deps.caller(c.req.raw), {
+			bucket,
+			name
+		});
+		const token = await signGrant(deps.signer, "storage-download", {
+			bucket,
+			name,
+			expires
+		});
+		return c.json({ signedURL: `/object/sign/${bucket}/${name}?token=${token}` });
+	});
+	app.post("/object/sign/:bucket", async (c) => {
+		const bucket = checkedBucketId(c.req.param("bucket"));
+		const body = await jsonBody(c);
+		const expires = expiresIn(body);
+		if (!Array.isArray(body.paths) || !body.paths.every((path) => typeof path === "string")) throw invalidRequest("body must have required property 'paths'");
+		const paths = body.paths;
+		const caller = await deps.caller(c.req.raw);
+		const visible = new Set(await asCaller(deps, caller, true, (trx) => visibleNames(trx, bucket, paths)));
+		const signed = paths.map(async (path) => {
+			if (!visible.has(path)) return {
+				error: "Either the object does not exist or you do not have access to it",
+				path,
+				signedURL: null
+			};
+			const token = await signGrant(deps.signer, "storage-download", {
+				bucket,
+				name: path,
+				expires
+			});
+			return {
+				error: null,
+				path,
+				signedURL: `/object/sign/${bucket}/${path}?token=${token}`
+			};
+		});
+		return c.json(await Promise.all(signed));
+	});
+	app.get("/object/sign/:bucket/:name{.+}", async (c) => {
+		const { bucket, name } = addressOf(c);
+		await readGrant(deps.signer, "storage-download", queryToken(c.req.raw), {
+			bucket,
+			name
+		});
+		const row = await asApp(deps, (trx) => findObject(trx, bucket, name));
+		if (!row) throw objectNotFound();
+		return serveObject(deps.store, row, c.req.raw);
+	});
+	app.post("/object/upload/sign/:bucket/:name{.+}", async (c) => {
+		const { bucket, name } = addressOf(c);
+		const caller = await deps.caller(c.req.raw);
+		const upsert = c.req.header("x-upsert") === "true";
+		await probeWrite(deps, {
+			bucket,
+			name,
+			caller,
+			owner: ownerOf(caller),
+			upsert
+		}, c.req.header("content-type") ?? "application/octet-stream");
+		const token = await signGrant(deps.signer, "storage-upload", {
+			bucket,
+			name,
+			owner: ownerOf(caller),
+			upsert,
+			expires: Math.floor(Date.now() / 1e3) + uploadSeconds
+		});
+		return c.json({
+			url: `/object/upload/sign/${bucket}/${name}?token=${token}`,
+			token
+		});
+	});
+	app.put("/object/upload/sign/:bucket/:name{.+}", async (c) => {
+		const { bucket, name } = addressOf(c);
+		const grant = await readGrant(deps.signer, "storage-upload", queryToken(c.req.raw), {
+			bucket,
+			name
+		});
+		const { Key } = await uploadObject(deps, c.req.raw, {
+			bucket,
+			name,
+			caller: {
+				role: "app",
+				claims: { role: "service_role" }
+			},
+			owner: grant.owner,
+			upsert: grant.upsert
+		});
+		return c.json({ Key });
+	});
+	return app;
+};
+//#endregion
+export { signedRoutes };

package/dist/storage/storage-context.js

@@ -0,0 +1,25 @@
+import { invalidRequest } from "./storage-error.js";
+import { checkedBucketId, checkedName } from "./object-key.js";
+//#region src/storage/storage-context.ts
+/** The object a route's `:bucket` and `:name{.+}` address, both checked. */
+const addressOf = (c) => ({
+	bucket: checkedBucketId(c.req.param("bucket")),
+	name: checkedName(c.req.param("name"))
+});
+/** The JSON object of a request's body, else 400. */
+const jsonBody = async (c) => {
+	const body = await c.req.json().catch((error) => {
+		if (error instanceof SyntaxError) return void 0;
+		throw error;
+	});
+	if (typeof body !== "object" || body === null || Array.isArray(body)) throw invalidRequest("The body is not a JSON object");
+	return body;
+};
+/** A string field of a body, else 400 naming it. */
+const stringField = (body, name) => {
+	const value = body[name];
+	if (typeof value !== "string") throw invalidRequest(`body must have required property '${name}'`);
+	return value;
+};
+//#endregion
+export { addressOf, jsonBody, stringField };

package/dist/storage/storage-db.js

@@ -0,0 +1,23 @@
+import { readTransaction, writeTransaction } from "../transactions.js";
+import { callerSettings } from "../api-keys/caller-settings.js";
+import { sql } from "kysely";
+//#region src/storage/storage-db.ts
+/**
+* Makes the rest of the transaction run as `caller`: its role and claims, as `/rest/v1` sets them (see
+* `callerSettings`), so the restored `storage.objects` and `storage.buckets` policies decide what it reads and writes.
+* What runs before it runs as the app's own role, which owns the tables.
+*/
+const becomeCaller = async (trx, deps, caller) => {
+	const settings = Object.entries(callerSettings(caller, deps.actorSetting));
+	await sql`select ${sql.join(settings.map(([name, value]) => sql`set_config(${name}, ${value}, true)`))}`.execute(trx);
+};
+/** Runs `work` in one transaction as `caller`, read-only when `readOnly`. */
+const asCaller = (deps, caller, readOnly, work) => {
+	const settings = callerSettings(caller, deps.actorSetting);
+	if (readOnly) return readTransaction(deps.db, deps.statementTimeoutMs, work, settings);
+	return writeTransaction(deps.db, deps.statementTimeoutMs, work, settings);
+};
+/** Runs `work` in one transaction as the app's own role, for what no caller decides: public objects, signed URLs. */
+const asApp = (deps, work) => writeTransaction(deps.db, deps.statementTimeoutMs, work);
+//#endregion
+export { asApp, asCaller, becomeCaller };

package/dist/storage/storage-error.js

@@ -0,0 +1,63 @@
+import { HttpProblem } from "../problem.js";
+import { isDatabaseError } from "../error-handler.js";
+//#region src/storage/storage-error.ts
+/**
+* An error as Supabase Storage sends it, which storage-js hands to the app as `error`: the HTTP status is 400 for any
+* refusal and 500 for a failure, and `statusCode` in the body says what it was (`404`, `403`, `409`, …).
+*/
+var StorageError = class extends Error {
+	statusCode;
+	code;
+	error;
+	constructor(statusCode, code, error, message) {
+		super(message);
+		this.statusCode = statusCode;
+		this.code = code;
+		this.error = error;
+	}
+	get status() {
+		return this.statusCode === 500 ? 500 : 400;
+	}
+	get body() {
+		return {
+			statusCode: String(this.statusCode),
+			code: this.code,
+			error: this.error,
+			message: this.message
+		};
+	}
+};
+const objectNotFound = () => new StorageError(404, "NoSuchKey", "not_found", "Object not found");
+const bucketNotFound = () => new StorageError(404, "NoSuchBucket", "Bucket not found", "Bucket not found");
+const accessDenied = (message = "new row violates row-level security policy") => new StorageError(403, "AccessDenied", "Unauthorized", message);
+const alreadyExists = () => new StorageError(409, "Duplicate", "Duplicate", "The resource already exists");
+const invalidRequest = (message) => new StorageError(400, "InvalidRequest", "InvalidRequest", message);
+const invalidKey = (key) => new StorageError(400, "InvalidKey", "InvalidKey", `Invalid key: ${key}`);
+const invalidBucketName = () => new StorageError(400, "InvalidBucketName", "Invalid Input", "Bucket name invalid");
+const invalidSignature = () => new StorageError(400, "InvalidSignature", "InvalidSignature", "Invalid signature");
+const expiredSignature = () => new StorageError(400, "ExpiredToken", "ExpiredToken", "The provided token has expired.");
+const tooLarge = () => new StorageError(413, "EntityTooLarge", "Payload too large", "The object exceeded the maximum allowed size");
+const mimeTypeRefused = (type) => new StorageError(415, "InvalidMimeType", "invalid_mime_type", `mime type ${type} is not supported`);
+const bucketNotEmpty = () => new StorageError(409, "ResourceNotEmpty", "ResourceNotEmpty", "The bucket you tried to delete is not empty");
+const databaseError = (code, message) => {
+	if (code === "42501") return accessDenied(message.includes("row-level security") ? void 0 : message);
+	if (code === "23505") return alreadyExists();
+	if (code === "23503") return new StorageError(404, "InvalidRequest", "InvalidRequest", "The related resource does not exist");
+	if (code === "42P01" || code === "3F000") return new StorageError(500, "DatabaseError", "DatabaseError", "This app has no storage schema: restore one with protobase import supabase");
+};
+/**
+* The Storage error an error stands for: its own, a refusal of the database's (RLS, a duplicate key, a missing bucket),
+* or a problem such as a full provider's 507 and the caller's 401. Other errors give `undefined`.
+*/
+const storageErrorOf = (error) => {
+	if (error instanceof StorageError) return error;
+	if (error instanceof HttpProblem) return new StorageError(error.status, error.slug, error.title, error.detail);
+	if (!isDatabaseError(error)) return void 0;
+	return databaseError(error.code, error.message);
+};
+const errorResponse = (error) => new Response(JSON.stringify(error.body), {
+	status: error.status,
+	headers: { "content-type": "application/json; charset=utf-8" }
+});
+//#endregion
+export { StorageError, accessDenied, alreadyExists, bucketNotEmpty, bucketNotFound, errorResponse, expiredSignature, invalidBucketName, invalidKey, invalidRequest, invalidSignature, mimeTypeRefused, objectNotFound, storageErrorOf, tooLarge };

package/dist/storage/storage-routes.js

@@ -0,0 +1,28 @@
+import { StorageError, errorResponse, storageErrorOf } from "./storage-error.js";
+import { bucketRoutes } from "./bucket-routes.js";
+import { objectRoutes } from "./object-routes.js";
+import { signedRoutes } from "./signed-routes.js";
+import { Hono } from "hono";
+//#region src/storage/storage-routes.ts
+/**
+* The Storage-compatible API `supabase.storage` calls, mounted at `/storage/v1`, over the app's storage provider. Every
+* read and write of `storage.objects` and `storage.buckets` runs as the request's caller (`anon`, `authenticated` or
+* the app's own role), so the policies restored with them decide; public buckets and signed URLs need no key. Errors
+* come back as Supabase Storage's `{ statusCode, error, message }`; an unexpected one as a 500 that names nothing of it.
+*/
+const storageRoutes = ({ deps, report }) => {
+	const app = new Hono();
+	app.onError((error, c) => {
+		const known = storageErrorOf(error);
+		if (known) return errorResponse(known);
+		report?.(error, c.req.raw);
+		return errorResponse(new StorageError(500, "InternalError", "Internal", "Internal Server Error"));
+	});
+	app.route("/", signedRoutes(deps));
+	app.route("/", objectRoutes(deps));
+	app.route("/", bucketRoutes(deps));
+	app.notFound(() => errorResponse(new StorageError(404, "NotFound", "not_found", "Route not found")));
+	return app;
+};
+//#endregion
+export { storageRoutes };

package/dist/storage/storage-token.js

@@ -0,0 +1,28 @@
+import { expiredSignature, invalidSignature } from "./storage-error.js";
+//#region src/storage/storage-token.ts
+const encode = (value) => btoa(String.fromCharCode(...new TextEncoder().encode(JSON.stringify(value)))).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+const decode = (text) => {
+	if (!/^[\w-]+$/.test(text)) return void 0;
+	try {
+		return JSON.parse(new TextDecoder().decode(Uint8Array.from(atob(text.replaceAll("-", "+").replaceAll("_", "/")), (char) => char.charCodeAt(0))));
+	} catch (error) {
+		if (error instanceof SyntaxError || error instanceof DOMException && error.name === "InvalidCharacterError") return void 0;
+		throw error;
+	}
+};
+/** The `token` of a signed URL: the grant and the signature over it, both URL-safe, joined by `.`. */
+const signGrant = async (signer, purpose, grant) => `${encode(grant)}.${await signer.sign(purpose, [grant])}`;
+/**
+* The grant of a token signed for `purpose`, when it is for the object at `bucket` and `name` and has not expired at
+* `now`; else 400 `InvalidSignature` or `ExpiredToken`, as Supabase Storage answers.
+*/
+const readGrant = async (signer, purpose, token, object, now = Date.now()) => {
+	const [payload = "", signature = ""] = token.split(".");
+	const grant = decode(payload);
+	if (typeof grant !== "object" || grant === null || !await signer.verify(purpose, [grant], signature)) throw invalidSignature();
+	if (grant.bucket !== object.bucket || grant.name !== object.name) throw invalidSignature();
+	if (grant.expires * 1e3 < now) throw expiredSignature();
+	return grant;
+};
+//#endregion
+export { readGrant, signGrant };