@selvajs/supabase-provider 0.11.0

package/dist/permissions/__tests__/conformance.test.js

@@ -0,0 +1,27 @@
+import { describe, beforeEach, it } from 'vitest';
+import { runPlatformPermissionStoreConformance } from '@selvajs/platform/testing';
+import { SupabasePlatformPermissionStore } from '../SupabasePlatformPermissionStore.js';
+import { readEnv, resetAllData, seedPlainUser } from '../../data/__tests__/test-helpers.js';
+const envCtx = readEnv();
+if (!envCtx) {
+    describe.skip('SupabasePlatformPermissionStore (skipped: no live stack)', () => {
+        it('populate packages/providers/supabase/.env.test with Supabase creds to run these tests', () => { });
+    });
+}
+else {
+    describe('SupabasePlatformPermissionStore', () => {
+        beforeEach(async () => {
+            await resetAllData(envCtx);
+        });
+        runPlatformPermissionStoreConformance({
+            name: 'SupabasePlatformPermissionStore',
+            createStore: async () => {
+                return {
+                    store: new SupabasePlatformPermissionStore(envCtx.bundle),
+                    seedUser: async () => (await seedPlainUser(envCtx, '')).userId
+                };
+            }
+        });
+    });
+}
+//# sourceMappingURL=conformance.test.js.map

package/dist/permissions/__tests__/conformance.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"conformance.test.js","sourceRoot":"","sources":["../../../src/permissions/__tests__/conformance.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAE,qCAAqC,EAAE,MAAM,2BAA2B,CAAC;AAClF,OAAO,EAAE,+BAA+B,EAAE,MAAM,uCAAuC,CAAC;AACxF,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AAE5F,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC;AAEzB,IAAI,CAAC,MAAM,EAAE,CAAC;IACb,QAAQ,CAAC,IAAI,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAC9E,EAAE,CAAC,uFAAuF,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACvG,CAAC,CAAC,CAAC;AACJ,CAAC;KAAM,CAAC;IACP,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;QAChD,UAAU,CAAC,KAAK,IAAI,EAAE;YACrB,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;QAEH,qCAAqC,CAAC;YACrC,IAAI,EAAE,iCAAiC;YACvC,WAAW,EAAE,KAAK,IAAI,EAAE;gBACvB,OAAO;oBACN,KAAK,EAAE,IAAI,+BAA+B,CAAC,MAAM,CAAC,MAAM,CAAC;oBACzD,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM;iBAC9D,CAAC;YACH,CAAC;SACD,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACJ,CAAC"}

package/dist/permissions/index.d.ts

@@ -0,0 +1,2 @@
+export { SupabasePlatformPermissionStore } from './SupabasePlatformPermissionStore.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/permissions/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/permissions/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,sCAAsC,CAAC"}

package/dist/permissions/index.js

@@ -0,0 +1,2 @@
+export { SupabasePlatformPermissionStore } from './SupabasePlatformPermissionStore.js';
+//# sourceMappingURL=index.js.map

package/dist/permissions/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/permissions/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,sCAAsC,CAAC"}

package/dist/storage/SupabaseStorageProvider.d.ts

@@ -0,0 +1,67 @@
+import type { IStorageProvider } from '@selvajs/platform/storage';
+/**
+ * Storage backend for Selva on Supabase Storage.
+ *
+ * Uses two buckets:
+ *   - {publicBucket} (public): cover images, archive thumbnails, anything
+ *     CDN-safe. `getPublicUrl` returns the direct CDN URL.
+ *   - {privateBucket} (private): .gh / .ghx source files. `getPublicUrl`
+ *     returns the authenticated proxy URL (`${privateUrlPrefix}/{path}`) —
+ *     the consuming app must have a route at that prefix that authenticates
+ *     the request and streams the bytes via `get()`.
+ *
+ * Path routing: any path whose basename matches `definition.{ext}` is
+ * considered private. Covers (`cover.webp`) and archives (`archive/{ref}`)
+ * stay public. `definitionPaths` from @selvajs/platform produces exactly these
+ * names, so the routing is implicit — no caller has to think about buckets.
+ */
+export interface SupabaseStorageProviderConfig {
+    /** Supabase project URL (e.g. http://127.0.0.1:54321 for local stack). */
+    supabaseUrl: string;
+    /**
+     * Service-role key. Required because the provider runs server-side and
+     * must bypass RLS for server-internal actions (admin uploads, janitor
+     * cleanup). The provider is never used directly from the browser.
+     */
+    serviceRoleKey: string;
+    /** Bucket for CDN-readable objects. Default: "selva-public". */
+    publicBucket?: string;
+    /** Bucket for authenticated-only objects. Default: "selva-private". */
+    privateBucket?: string;
+    /**
+     * URL prefix the app exposes for authenticated file downloads. Used by
+     * `getPublicUrl` for private-bucket paths. Default: "/api/files".
+     * The matching SvelteKit route is expected to call `get()` and stream
+     * bytes back after an auth check.
+     */
+    privateUrlPrefix?: string;
+}
+export declare class SupabaseStorageProvider implements IStorageProvider {
+    private readonly client;
+    private readonly publicBucket;
+    private readonly privateBucket;
+    private readonly publicBaseUrl;
+    private readonly privateUrlPrefix;
+    static fromEnv(env: Record<string, string | undefined>): SupabaseStorageProvider;
+    constructor(config: SupabaseStorageProviderConfig);
+    /**
+     * Route a storage path to a bucket. Any `.gh`/`.ghx` source file is
+     * private — confidentiality is determined by extension, not location, so
+     * a path-scheme rename (e.g. `definition.gh` → `versions/v1.gh`) can't
+     * silently move source files into the public bucket. Everything else
+     * (covers, archives, thumbnails) is public.
+     */
+    private bucketFor;
+    get(storagePath: string): Promise<Uint8Array | null>;
+    put(storagePath: string, data: Uint8Array, contentType?: string): Promise<void>;
+    delete(storagePath: string): Promise<void>;
+    deletePrefix(prefix: string): Promise<void>;
+    private deletePrefixInBucket;
+    /**
+     * Recursively list every key under a prefix. `storage-js`'s `list` API
+     * only returns the immediate children of a "folder", so we DFS.
+     */
+    private listAllKeys;
+    getPublicUrl(storagePath: string): string;
+}
+//# sourceMappingURL=SupabaseStorageProvider.d.ts.map

package/dist/storage/SupabaseStorageProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SupabaseStorageProvider.d.ts","sourceRoot":"","sources":["../../src/storage/SupabaseStorageProvider.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAElE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,6BAA6B;IAC7C,0EAA0E;IAC1E,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,cAAc,EAAE,MAAM,CAAC;IACvB,gEAAgE;IAChE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uEAAuE;IACvE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,qBAAa,uBAAwB,YAAW,gBAAgB;IAC/D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiB;IACxC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAE1C,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,uBAAuB;gBAcpE,MAAM,EAAE,6BAA6B;IAWjD;;;;;;OAMG;IACH,OAAO,CAAC,SAAS;IAIX,GAAG,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAcpD,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAc/E,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAO1C,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YASnC,oBAAoB;IAYlC;;;OAGG;YACW,WAAW;IAuBzB,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM;CAOzC"}

package/dist/storage/SupabaseStorageProvider.js

@@ -0,0 +1,136 @@
+import { createClient } from '@supabase/supabase-js';
+import { transcodeImageIfNeeded } from '@selvajs/platform/storage';
+export class SupabaseStorageProvider {
+    client;
+    publicBucket;
+    privateBucket;
+    publicBaseUrl;
+    privateUrlPrefix;
+    static fromEnv(env) {
+        const supabaseUrl = env.SUPABASE_URL;
+        const serviceRoleKey = env.SUPABASE_SERVICE_ROLE_KEY;
+        if (!supabaseUrl)
+            throw new Error('Missing required env var: SUPABASE_URL');
+        if (!serviceRoleKey)
+            throw new Error('Missing required env var: SUPABASE_SERVICE_ROLE_KEY');
+        return new SupabaseStorageProvider({
+            supabaseUrl,
+            serviceRoleKey,
+            publicBucket: env.SUPABASE_PUBLIC_BUCKET,
+            privateBucket: env.SUPABASE_PRIVATE_BUCKET,
+            privateUrlPrefix: env.SUPABASE_PRIVATE_URL_PREFIX
+        });
+    }
+    constructor(config) {
+        this.client = createClient(config.supabaseUrl, config.serviceRoleKey, {
+            auth: { persistSession: false, autoRefreshToken: false }
+        });
+        this.publicBucket = config.publicBucket ?? 'selva-public';
+        this.privateBucket = config.privateBucket ?? 'selva-private';
+        // Direct CDN URL format: {supabaseUrl}/storage/v1/object/public/{bucket}/{path}
+        this.publicBaseUrl = `${config.supabaseUrl.replace(/\/$/, '')}/storage/v1/object/public/${this.publicBucket}`;
+        this.privateUrlPrefix = (config.privateUrlPrefix ?? '/api/files').replace(/\/$/, '');
+    }
+    /**
+     * Route a storage path to a bucket. Any `.gh`/`.ghx` source file is
+     * private — confidentiality is determined by extension, not location, so
+     * a path-scheme rename (e.g. `definition.gh` → `versions/v1.gh`) can't
+     * silently move source files into the public bucket. Everything else
+     * (covers, archives, thumbnails) is public.
+     */
+    bucketFor(storagePath) {
+        return /\.(gh|ghx)$/i.test(storagePath) ? this.privateBucket : this.publicBucket;
+    }
+    async get(storagePath) {
+        const bucket = this.bucketFor(storagePath);
+        const { data, error } = await this.client.storage.from(bucket).download(storagePath);
+        if (error) {
+            // storage-js surfaces 404 as an error with message "Object not found".
+            // Normalize any "not found" to null — we don't have a stable status code.
+            const msg = error.message ?? '';
+            if (/not found/i.test(msg) || /no such key/i.test(msg))
+                return null;
+            throw error;
+        }
+        const buffer = await data.arrayBuffer();
+        return new Uint8Array(buffer);
+    }
+    async put(storagePath, data, contentType) {
+        // Normalize images through the shared helper so this provider produces
+        // the same bytes / extensions as LocalStorageProvider for the same input.
+        const transcoded = await transcodeImageIfNeeded(data, contentType, storagePath);
+        const bucket = this.bucketFor(transcoded.path);
+        const { error } = await this.client.storage
+            .from(bucket)
+            .upload(transcoded.path, transcoded.data, {
+            contentType: transcoded.contentType,
+            upsert: true
+        });
+        if (error)
+            throw error;
+    }
+    async delete(storagePath) {
+        const bucket = this.bucketFor(storagePath);
+        const { error } = await this.client.storage.from(bucket).remove([storagePath]);
+        // remove() does not error for missing paths — it just returns an empty array.
+        if (error)
+            throw error;
+    }
+    async deletePrefix(prefix) {
+        // Hit both buckets: a definition's GUID prefix may have files in each.
+        // Scoped by the trailing slash in the prefix, so siblings aren't touched.
+        await Promise.all([
+            this.deletePrefixInBucket(this.publicBucket, prefix),
+            this.deletePrefixInBucket(this.privateBucket, prefix)
+        ]);
+    }
+    async deletePrefixInBucket(bucket, prefix) {
+        const normalized = prefix.replace(/\/+$/, '');
+        const keys = await this.listAllKeys(bucket, normalized);
+        if (keys.length === 0)
+            return;
+        // `remove` accepts up to 1000 paths; batch just in case.
+        for (let i = 0; i < keys.length; i += 1000) {
+            const slice = keys.slice(i, i + 1000);
+            const { error } = await this.client.storage.from(bucket).remove(slice);
+            if (error)
+                throw error;
+        }
+    }
+    /**
+     * Recursively list every key under a prefix. `storage-js`'s `list` API
+     * only returns the immediate children of a "folder", so we DFS.
+     */
+    async listAllKeys(bucket, prefix) {
+        const out = [];
+        const stack = [prefix];
+        while (stack.length > 0) {
+            const dir = stack.pop();
+            const { data, error } = await this.client.storage.from(bucket).list(dir, {
+                limit: 1000,
+                sortBy: { column: 'name', order: 'asc' }
+            });
+            if (error)
+                throw error;
+            for (const entry of data ?? []) {
+                const full = dir ? `${dir}/${entry.name}` : entry.name;
+                // Folder entries have `id === null` in storage-js.
+                if (entry.id === null) {
+                    stack.push(full);
+                }
+                else {
+                    out.push(full);
+                }
+            }
+        }
+        return out;
+    }
+    getPublicUrl(storagePath) {
+        if (this.bucketFor(storagePath) === this.publicBucket) {
+            return `${this.publicBaseUrl}/${storagePath}`;
+        }
+        // Private files: the app's authenticated proxy route. See `privateUrlPrefix`.
+        return `${this.privateUrlPrefix}/${storagePath}`;
+    }
+}
+//# sourceMappingURL=SupabaseStorageProvider.js.map

package/dist/storage/SupabaseStorageProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SupabaseStorageProvider.js","sourceRoot":"","sources":["../../src/storage/SupabaseStorageProvider.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAyCnE,MAAM,OAAO,uBAAuB;IAClB,MAAM,CAAiB;IACvB,YAAY,CAAS;IACrB,aAAa,CAAS;IACtB,aAAa,CAAS;IACtB,gBAAgB,CAAS;IAE1C,MAAM,CAAC,OAAO,CAAC,GAAuC;QACrD,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC;QACrC,MAAM,cAAc,GAAG,GAAG,CAAC,yBAAyB,CAAC;QACrD,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5E,IAAI,CAAC,cAAc;YAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QAC5F,OAAO,IAAI,uBAAuB,CAAC;YAClC,WAAW;YACX,cAAc;YACd,YAAY,EAAE,GAAG,CAAC,sBAAsB;YACxC,aAAa,EAAE,GAAG,CAAC,uBAAuB;YAC1C,gBAAgB,EAAE,GAAG,CAAC,2BAA2B;SACjD,CAAC,CAAC;IACJ,CAAC;IAED,YAAY,MAAqC;QAChD,IAAI,CAAC,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,cAAc,EAAE;YACrE,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE;SACxD,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,cAAc,CAAC;QAC1D,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,IAAI,eAAe,CAAC;QAC7D,gFAAgF;QAChF,IAAI,CAAC,aAAa,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,6BAA6B,IAAI,CAAC,YAAY,EAAE,CAAC;QAC9G,IAAI,CAAC,gBAAgB,GAAG,CAAC,MAAM,CAAC,gBAAgB,IAAI,YAAY,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtF,CAAC;IAED;;;;;;OAMG;IACK,SAAS,CAAC,WAAmB;QACpC,OAAO,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;IAClF,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,WAAmB;QAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACrF,IAAI,KAAK,EAAE,CAAC;YACX,uEAAuE;YACvE,0EAA0E;YAC1E,MAAM,GAAG,GAAI,KAA8B,CAAC,OAAO,IAAI,EAAE,CAAC;YAC1D,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpE,MAAM,KAAK,CAAC;QACb,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QACxC,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,WAAmB,EAAE,IAAgB,EAAE,WAAoB;QACpE,uEAAuE;QACvE,0EAA0E;QAC1E,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,IAAI,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;QAChF,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC/C,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO;aACzC,IAAI,CAAC,MAAM,CAAC;aACZ,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE;YACzC,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,MAAM,EAAE,IAAI;SACZ,CAAC,CAAC;QACJ,IAAI,KAAK;YAAE,MAAM,KAAK,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,WAAmB;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;QAC/E,8EAA8E;QAC9E,IAAI,KAAK;YAAE,MAAM,KAAK,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAc;QAChC,uEAAuE;QACvE,0EAA0E;QAC1E,MAAM,OAAO,CAAC,GAAG,CAAC;YACjB,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC;YACpD,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC;SACrD,CAAC,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAAC,MAAc,EAAE,MAAc;QAChE,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACxD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC9B,yDAAyD;QACzD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;YAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;YACtC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,IAAI,KAAK;gBAAE,MAAM,KAAK,CAAC;QACxB,CAAC;IACF,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,WAAW,CAAC,MAAc,EAAE,MAAc;QACvD,MAAM,GAAG,GAAa,EAAE,CAAC;QACzB,MAAM,KAAK,GAAa,CAAC,MAAM,CAAC,CAAC;QACjC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAG,CAAC;YACzB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE;gBACxE,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE;aACxC,CAAC,CAAC;YACH,IAAI,KAAK;gBAAE,MAAM,KAAK,CAAC;YACvB,KAAK,MAAM,KAAK,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;gBAChC,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;gBACvD,mDAAmD;gBACnD,IAAI,KAAK,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;oBACvB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAClB,CAAC;qBAAM,CAAC;oBACP,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAChB,CAAC;YACF,CAAC;QACF,CAAC;QACD,OAAO,GAAG,CAAC;IACZ,CAAC;IAED,YAAY,CAAC,WAAmB;QAC/B,IAAI,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;YACvD,OAAO,GAAG,IAAI,CAAC,aAAa,IAAI,WAAW,EAAE,CAAC;QAC/C,CAAC;QACD,8EAA8E;QAC9E,OAAO,GAAG,IAAI,CAAC,gBAAgB,IAAI,WAAW,EAAE,CAAC;IAClD,CAAC;CACD"}

package/dist/storage/__tests__/conformance.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=conformance.test.d.ts.map

package/dist/storage/__tests__/conformance.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"conformance.test.d.ts","sourceRoot":"","sources":["../../../src/storage/__tests__/conformance.test.ts"],"names":[],"mappings":""}

package/dist/storage/__tests__/conformance.test.js

@@ -0,0 +1,149 @@
+import { describe, beforeEach, it, expect } from 'vitest';
+import { createClient } from '@supabase/supabase-js';
+import { runStorageProviderConformance } from '@selvajs/platform/testing';
+import { definitionPaths } from '@selvajs/platform';
+import { SupabaseStorageProvider } from '../SupabaseStorageProvider.js';
+const SUPABASE_URL = process.env.SUPABASE_URL;
+const SERVICE_ROLE_KEY = process.env.SUPABASE_SERVICE_ROLE_KEY;
+const PUBLIC_BUCKET = process.env.SUPABASE_PUBLIC_BUCKET ?? 'selva-public';
+const PRIVATE_BUCKET = process.env.SUPABASE_PRIVATE_BUCKET ?? 'selva-private';
+// The conformance suite hits a live Supabase stack. If creds aren't present
+// (e.g. in CI without Docker, or a clean clone pre-`supabase start`), skip
+// the suite with a single explanatory test so the run surfaces the reason.
+// `createClient` transitively loads `@supabase/realtime-js`, which on Node < 22
+// throws at construction without native WebSocket — treat that as "no stack"
+// rather than crashing the suite during collection.
+function tryBuildAdminClient() {
+    if (!SUPABASE_URL || !SERVICE_ROLE_KEY)
+        return null;
+    try {
+        return createClient(SUPABASE_URL, SERVICE_ROLE_KEY, {
+            auth: { persistSession: false, autoRefreshToken: false }
+        });
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        if (msg.includes('WebSocket'))
+            return null;
+        throw err;
+    }
+}
+const _adminClient = tryBuildAdminClient();
+if (_adminClient === null) {
+    describe.skip('SupabaseStorageProvider (skipped: no live stack)', () => {
+        it('populate packages/providers/supabase/.env.test with SUPABASE_URL and SUPABASE_SERVICE_ROLE_KEY (from `npx supabase start`) to run these tests', () => { });
+    });
+}
+else {
+    // Re-bind in this branch so closures below see the non-null narrowed type.
+    const adminClient = _adminClient;
+    /**
+     * Delete every object under a prefix in a bucket. The conformance suite
+     * assumes fresh state per test; Supabase Storage is shared across runs,
+     * so we reset both buckets before each test.
+     */
+    async function emptyBucket(bucket) {
+        const keys = [];
+        const stack = [''];
+        while (stack.length > 0) {
+            const dir = stack.pop();
+            const { data, error } = await adminClient.storage.from(bucket).list(dir, {
+                limit: 1000,
+                sortBy: { column: 'name', order: 'asc' }
+            });
+            if (error)
+                throw error;
+            for (const entry of data ?? []) {
+                const full = dir ? `${dir}/${entry.name}` : entry.name;
+                if (entry.id === null)
+                    stack.push(full);
+                else
+                    keys.push(full);
+            }
+        }
+        if (keys.length === 0)
+            return;
+        for (let i = 0; i < keys.length; i += 1000) {
+            const { error } = await adminClient.storage.from(bucket).remove(keys.slice(i, i + 1000));
+            if (error)
+                throw error;
+        }
+    }
+    describe('SupabaseStorageProvider', () => {
+        beforeEach(async () => {
+            await Promise.all([emptyBucket(PUBLIC_BUCKET), emptyBucket(PRIVATE_BUCKET)]);
+        });
+        runStorageProviderConformance({
+            name: 'SupabaseStorageProvider',
+            createStorage: () => new SupabaseStorageProvider({
+                supabaseUrl: SUPABASE_URL,
+                serviceRoleKey: SERVICE_ROLE_KEY,
+                publicBucket: PUBLIC_BUCKET,
+                privateBucket: PRIVATE_BUCKET
+            })
+        });
+        // ============================================================================
+        // Bucket routing — Supabase-specific (the conformance suite is provider-
+        // agnostic and can't see which bucket a file lands in). Without these tests
+        // a regex regression in `bucketFor` could silently move .gh source files
+        // into the public/CDN bucket.
+        // ============================================================================
+        describe('bucket routing', () => {
+            const storage = new SupabaseStorageProvider({
+                supabaseUrl: SUPABASE_URL,
+                serviceRoleKey: SERVICE_ROLE_KEY,
+                publicBucket: PUBLIC_BUCKET,
+                privateBucket: PRIVATE_BUCKET
+            });
+            async function existsInBucket(bucket, path) {
+                const { data, error } = await adminClient.storage.from(bucket).download(path);
+                if (error)
+                    return false;
+                return Boolean(data);
+            }
+            it('versioned .gh files land in the private bucket', async () => {
+                const guid = 'aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa';
+                const path = definitionPaths.version(guid, 1, 'gh');
+                await storage.put(path, new TextEncoder().encode('GH_BYTES'));
+                expect(await existsInBucket(PRIVATE_BUCKET, path)).toBe(true);
+                expect(await existsInBucket(PUBLIC_BUCKET, path)).toBe(false);
+            });
+            it('versioned .ghx files land in the private bucket', async () => {
+                const guid = 'bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb';
+                const path = definitionPaths.version(guid, 3, 'ghx');
+                await storage.put(path, new TextEncoder().encode('GHX_BYTES'));
+                expect(await existsInBucket(PRIVATE_BUCKET, path)).toBe(true);
+                expect(await existsInBucket(PUBLIC_BUCKET, path)).toBe(false);
+            });
+            it('cover images land in the public bucket', async () => {
+                const guid = 'cccccccc-cccc-cccc-cccc-cccccccccccc';
+                const path = definitionPaths.image(guid);
+                // Real 1×1 transparent PNG. The provider runs every image through
+                // transcodeImageIfNeeded → sharp, so a hand-crafted byte stub
+                // would fail the decode. Routing (the test's actual concern) is
+                // independent of which format the input arrives in.
+                const tinyPng = Uint8Array.from([
+                    137, 80, 78, 71, 13, 10, 26, 10, 0, 0, 0, 13, 73, 72, 68, 82, 0, 0, 0, 1, 0, 0, 0, 1, 8,
+                    6, 0, 0, 0, 31, 21, 196, 137, 0, 0, 0, 9, 112, 72, 89, 115, 0, 0, 3, 232, 0, 0, 3, 232, 1,
+                    181, 123, 82, 107, 0, 0, 0, 13, 73, 68, 65, 84, 120, 156, 99, 96, 96, 96, 96, 0, 0, 0, 5,
+                    0, 1, 165, 246, 69, 64, 0, 0, 0, 0, 73, 69, 78, 68, 174, 66, 96, 130
+                ]);
+                await storage.put(path, tinyPng, 'image/png');
+                expect(await existsInBucket(PUBLIC_BUCKET, path)).toBe(true);
+                expect(await existsInBucket(PRIVATE_BUCKET, path)).toBe(false);
+            });
+            it('getPublicUrl returns the proxy prefix for private files', () => {
+                const path = definitionPaths.version('guid-1', 1, 'gh');
+                const url = storage.getPublicUrl(path);
+                expect(url.startsWith('/api/files/')).toBe(true);
+                expect(url).not.toContain('/storage/v1/object/public/');
+            });
+            it('getPublicUrl returns the CDN URL for public files', () => {
+                const path = definitionPaths.image('guid-1');
+                const url = storage.getPublicUrl(path);
+                expect(url).toContain(`/storage/v1/object/public/${PUBLIC_BUCKET}/`);
+            });
+        });
+    });
+}
+//# sourceMappingURL=conformance.test.js.map

package/dist/storage/__tests__/conformance.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"conformance.test.js","sourceRoot":"","sources":["../../../src/storage/__tests__/conformance.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,6BAA6B,EAAE,MAAM,2BAA2B,CAAC;AAC1E,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAExE,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;AAC9C,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;AAC/D,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,cAAc,CAAC;AAC3E,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,eAAe,CAAC;AAE9E,4EAA4E;AAC5E,2EAA2E;AAC3E,2EAA2E;AAC3E,gFAAgF;AAChF,6EAA6E;AAC7E,oDAAoD;AACpD,SAAS,mBAAmB;IAC3B,IAAI,CAAC,YAAY,IAAI,CAAC,gBAAgB;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,CAAC;QACJ,OAAO,YAAY,CAAC,YAAY,EAAE,gBAAgB,EAAE;YACnD,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE;SACxD,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3C,MAAM,GAAG,CAAC;IACX,CAAC;AACF,CAAC;AACD,MAAM,YAAY,GAAG,mBAAmB,EAAE,CAAC;AAE3C,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;IAC3B,QAAQ,CAAC,IAAI,CAAC,kDAAkD,EAAE,GAAG,EAAE;QACtE,EAAE,CAAC,+IAA+I,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC/J,CAAC,CAAC,CAAC;AACJ,CAAC;KAAM,CAAC;IACP,2EAA2E;IAC3E,MAAM,WAAW,GAAG,YAAY,CAAC;IAEjC;;;;OAIG;IACH,KAAK,UAAU,WAAW,CAAC,MAAc;QACxC,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAa,CAAC,EAAE,CAAC,CAAC;QAC7B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAG,CAAC;YACzB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE;gBACxE,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE;aACxC,CAAC,CAAC;YACH,IAAI,KAAK;gBAAE,MAAM,KAAK,CAAC;YACvB,KAAK,MAAM,KAAK,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;gBAChC,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;gBACvD,IAAI,KAAK,CAAC,EAAE,KAAK,IAAI;oBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;;oBACnC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtB,CAAC;QACF,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;YAC5C,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;YACzF,IAAI,KAAK;gBAAE,MAAM,KAAK,CAAC;QACxB,CAAC;IACF,CAAC;IAED,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACxC,UAAU,CAAC,KAAK,IAAI,EAAE;YACrB,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,aAAa,CAAC,EAAE,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;QAC9E,CAAC,CAAC,CAAC;QAEH,6BAA6B,CAAC;YAC7B,IAAI,EAAE,yBAAyB;YAC/B,aAAa,EAAE,GAAG,EAAE,CACnB,IAAI,uBAAuB,CAAC;gBAC3B,WAAW,EAAE,YAAa;gBAC1B,cAAc,EAAE,gBAAiB;gBACjC,YAAY,EAAE,aAAa;gBAC3B,aAAa,EAAE,cAAc;aAC7B,CAAC;SACH,CAAC,CAAC;QAEH,+EAA+E;QAC/E,yEAAyE;QACzE,4EAA4E;QAC5E,yEAAyE;QACzE,8BAA8B;QAC9B,+EAA+E;QAC/E,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;YAC/B,MAAM,OAAO,GAAG,IAAI,uBAAuB,CAAC;gBAC3C,WAAW,EAAE,YAAa;gBAC1B,cAAc,EAAE,gBAAiB;gBACjC,YAAY,EAAE,aAAa;gBAC3B,aAAa,EAAE,cAAc;aAC7B,CAAC,CAAC;YAEH,KAAK,UAAU,cAAc,CAAC,MAAc,EAAE,IAAY;gBACzD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAC9E,IAAI,KAAK;oBAAE,OAAO,KAAK,CAAC;gBACxB,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;YACtB,CAAC;YAED,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;gBAC/D,MAAM,IAAI,GAAG,sCAAsC,CAAC;gBACpD,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;gBACpD,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;gBAC9D,MAAM,CAAC,MAAM,cAAc,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC9D,MAAM,CAAC,MAAM,cAAc,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC/D,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;gBAChE,MAAM,IAAI,GAAG,sCAAsC,CAAC;gBACpD,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;gBACrD,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC/D,MAAM,CAAC,MAAM,cAAc,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC9D,MAAM,CAAC,MAAM,cAAc,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC/D,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;gBACvD,MAAM,IAAI,GAAG,sCAAsC,CAAC;gBACpD,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACzC,kEAAkE;gBAClE,8DAA8D;gBAC9D,gEAAgE;gBAChE,oDAAoD;gBACpD,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC;oBAC/B,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;oBACvF,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC;oBACzF,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;oBACxF,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG;iBACpE,CAAC,CAAC;gBACH,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;gBAC9C,MAAM,CAAC,MAAM,cAAc,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC7D,MAAM,CAAC,MAAM,cAAc,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAChE,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;gBAClE,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;gBACxD,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;gBACvC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACjD,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,4BAA4B,CAAC,CAAC;YACzD,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;gBAC5D,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAC7C,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;gBACvC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,6BAA6B,aAAa,GAAG,CAAC,CAAC;YACtE,CAAC,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACJ,CAAC"}

package/dist/storage/index.d.ts

@@ -0,0 +1,3 @@
+export { SupabaseStorageProvider } from './SupabaseStorageProvider.js';
+export type { SupabaseStorageProviderConfig } from './SupabaseStorageProvider.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/storage/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/storage/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,YAAY,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC"}

package/dist/storage/index.js

@@ -0,0 +1,2 @@
+export { SupabaseStorageProvider } from './SupabaseStorageProvider.js';
+//# sourceMappingURL=index.js.map

package/dist/storage/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/storage/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC"}

package/dist/userProfile/SupabaseUserProfileProvider.d.ts

@@ -0,0 +1,16 @@
+import type { IUserProfileStore, RecentRun, RequestContext, UserManagementResult, UserProfile } from '@selvajs/platform';
+import type { ClientBundle } from '../data/client.js';
+export declare class SupabaseUserProfileProvider implements IUserProfileStore {
+    private readonly clients;
+    constructor(clients: ClientBundle);
+    private client;
+    getProfile(ctx: RequestContext, userId: string): Promise<UserProfile | null>;
+    getProfiles(_ctx: RequestContext, userIds: readonly string[]): Promise<UserProfile[]>;
+    updateProfile(ctx: RequestContext, userId: string, patch: {
+        displayName?: string;
+    }): Promise<UserManagementResult>;
+    starDefinition(ctx: RequestContext, userId: string, definitionId: string): Promise<UserManagementResult>;
+    unstarDefinition(ctx: RequestContext, userId: string, definitionId: string): Promise<UserManagementResult>;
+    recordRun(ctx: RequestContext, userId: string, run: RecentRun): Promise<UserManagementResult>;
+}
+//# sourceMappingURL=SupabaseUserProfileProvider.d.ts.map

package/dist/userProfile/SupabaseUserProfileProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SupabaseUserProfileProvider.d.ts","sourceRoot":"","sources":["../../src/userProfile/SupabaseUserProfileProvider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACX,iBAAiB,EACjB,SAAS,EACT,cAAc,EACd,oBAAoB,EACpB,WAAW,EACX,MAAM,mBAAmB,CAAC;AAE3B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAetD,qBAAa,2BAA4B,YAAW,iBAAiB;IACxD,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,YAAY;IAElD,OAAO,CAAC,MAAM;IAIR,UAAU,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAW5E,WAAW,CAAC,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAYrF,aAAa,CAClB,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAC7B,OAAO,CAAC,oBAAoB,CAAC;IAe1B,cAAc,CACnB,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,GAClB,OAAO,CAAC,oBAAoB,CAAC;IAmB1B,gBAAgB,CACrB,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,GAClB,OAAO,CAAC,oBAAoB,CAAC;IAgB1B,SAAS,CACd,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,SAAS,GACZ,OAAO,CAAC,oBAAoB,CAAC;CAiBhC"}

package/dist/userProfile/SupabaseUserProfileProvider.js

@@ -0,0 +1,148 @@
+import { ProviderError, hasPermission } from '@selvajs/platform';
+/**
+ * User profile backed by `public.user_profiles` (one row per `auth.users.id`).
+ * The row is auto-seeded by the `handle_new_auth_user` trigger on signup, so
+ * the store never inserts — only reads/updates.
+ *
+ * Uses the service-role client throughout (RLS on `user_profiles` is
+ * coarse-grained — server-side flows like the hooks.server.ts profile load
+ * need access regardless of the caller's identity). The `assertCanAccess`
+ * check enforces "you can only see/modify your own profile" at the app layer
+ * to match the `IUserProfileStore` contract.
+ */
+const MAX_RECENT_RUNS = 20;
+export class SupabaseUserProfileProvider {
+    clients;
+    constructor(clients) {
+        this.clients = clients;
+    }
+    client() {
+        return this.clients.serviceClient;
+    }
+    async getProfile(ctx, userId) {
+        assertCanAccess(ctx, userId);
+        const { data, error } = await this.client()
+            .from('user_profiles')
+            .select('user_id, display_name, starred_definitions, recent_runs')
+            .eq('user_id', userId)
+            .maybeSingle();
+        if (error)
+            throw mapError(error);
+        return data ? rowToProfile(data) : null;
+    }
+    async getProfiles(_ctx, userIds) {
+        // Batch read serves display-name lookups across the UI; scoping to one
+        // user defeats the purpose. No assertCanAccess.
+        if (userIds.length === 0)
+            return [];
+        const { data, error } = await this.client()
+            .from('user_profiles')
+            .select('user_id, display_name, starred_definitions, recent_runs')
+            .in('user_id', [...userIds]);
+        if (error)
+            throw mapError(error);
+        return (data ?? []).map(rowToProfile);
+    }
+    async updateProfile(ctx, userId, patch) {
+        assertCanAccess(ctx, userId);
+        const row = {};
+        if (patch.displayName !== undefined)
+            row.display_name = patch.displayName;
+        if (Object.keys(row).length === 0)
+            return 'ok';
+        const { data, error } = await this.client()
+            .from('user_profiles')
+            .update(row)
+            .eq('user_id', userId)
+            .select('user_id');
+        if (error)
+            throw mapError(error);
+        return data && data.length > 0 ? 'ok' : 'not_found';
+    }
+    async starDefinition(ctx, userId, definitionId) {
+        assertCanAccess(ctx, userId);
+        // Read-modify-write is fine for the local scale here; if concurrent
+        // starring ever becomes a hotspot, a SECURITY DEFINER RPC using
+        // `array_append` + `array_distinct` closes the race.
+        const existing = await this.getProfile(ctx, userId);
+        if (!existing)
+            return 'not_found';
+        if (existing.starredDefinitions.includes(definitionId))
+            return 'ok';
+        const next = [...existing.starredDefinitions, definitionId];
+        const { data, error } = await this.client()
+            .from('user_profiles')
+            .update({ starred_definitions: next })
+            .eq('user_id', userId)
+            .select('user_id');
+        if (error)
+            throw mapError(error);
+        return data && data.length > 0 ? 'ok' : 'not_found';
+    }
+    async unstarDefinition(ctx, userId, definitionId) {
+        assertCanAccess(ctx, userId);
+        const existing = await this.getProfile(ctx, userId);
+        if (!existing)
+            return 'not_found';
+        if (!existing.starredDefinitions.includes(definitionId))
+            return 'ok';
+        const next = existing.starredDefinitions.filter((id) => id !== definitionId);
+        const { data, error } = await this.client()
+            .from('user_profiles')
+            .update({ starred_definitions: next })
+            .eq('user_id', userId)
+            .select('user_id');
+        if (error)
+            throw mapError(error);
+        return data && data.length > 0 ? 'ok' : 'not_found';
+    }
+    async recordRun(ctx, userId, run) {
+        assertCanAccess(ctx, userId);
+        const existing = await this.getProfile(ctx, userId);
+        if (!existing)
+            return 'not_found';
+        // Prepend newest, de-dupe by definitionId, cap at MAX_RECENT_RUNS.
+        const filtered = existing.recentRuns.filter((r) => r.definitionId !== run.definitionId);
+        const next = [run, ...filtered].slice(0, MAX_RECENT_RUNS);
+        const { data, error } = await this.client()
+            .from('user_profiles')
+            .update({ recent_runs: next })
+            .eq('user_id', userId)
+            .select('user_id');
+        if (error)
+            throw mapError(error);
+        return data && data.length > 0 ? 'ok' : 'not_found';
+    }
+}
+function assertCanAccess(ctx, userId) {
+    if (ctx.system)
+        return;
+    if (ctx.userId === userId)
+        return;
+    if (hasPermission(ctx, 'instance_admin'))
+        return;
+    throw new ProviderError('Forbidden: cannot access another user’s profile', 403);
+}
+function rowToProfile(row) {
+    return {
+        userId: row.user_id,
+        displayName: row.display_name ?? undefined,
+        starredDefinitions: row.starred_definitions ?? [],
+        recentRuns: row.recent_runs ?? []
+    };
+}
+function mapError(e) {
+    const pg = e;
+    if (pg?.code === '23505')
+        return new ProviderError(pg.message ?? 'Duplicate record', 409);
+    if (pg?.code === '23503')
+        return new ProviderError(pg.message ?? 'Foreign key violation', 409);
+    if (e instanceof Error)
+        return e;
+    if (e && typeof e === 'object') {
+        const obj = e;
+        return new Error(obj.code ? `[${obj.code}] ${obj.message ?? ''}` : (obj.message ?? String(e)));
+    }
+    return new Error(String(e));
+}
+//# sourceMappingURL=SupabaseUserProfileProvider.js.map

package/dist/userProfile/SupabaseUserProfileProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SupabaseUserProfileProvider.js","sourceRoot":"","sources":["../../src/userProfile/SupabaseUserProfileProvider.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGjE;;;;;;;;;;GAUG;AACH,MAAM,eAAe,GAAG,EAAE,CAAC;AAE3B,MAAM,OAAO,2BAA2B;IACV;IAA7B,YAA6B,OAAqB;QAArB,YAAO,GAAP,OAAO,CAAc;IAAG,CAAC;IAE9C,MAAM;QACb,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,GAAmB,EAAE,MAAc;QACnD,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE;aACzC,IAAI,CAAC,eAAe,CAAC;aACrB,MAAM,CAAC,yDAAyD,CAAC;aACjE,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC;aACrB,WAAW,EAAE,CAAC;QAChB,IAAI,KAAK;YAAE,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,IAAoB,EAAE,OAA0B;QACjE,uEAAuE;QACvE,gDAAgD;QAChD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACpC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE;aACzC,IAAI,CAAC,eAAe,CAAC;aACrB,MAAM,CAAC,yDAAyD,CAAC;aACjE,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;QAC9B,IAAI,KAAK;YAAE,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;QACjC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,aAAa,CAClB,GAAmB,EACnB,MAAc,EACd,KAA+B;QAE/B,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS;YAAE,GAAG,CAAC,YAAY,GAAG,KAAK,CAAC,WAAW,CAAC;QAC1E,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAE/C,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE;aACzC,IAAI,CAAC,eAAe,CAAC;aACrB,MAAM,CAAC,GAAG,CAAC;aACX,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC;aACrB,MAAM,CAAC,SAAS,CAAC,CAAC;QACpB,IAAI,KAAK;YAAE,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;QACjC,OAAO,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,cAAc,CACnB,GAAmB,EACnB,MAAc,EACd,YAAoB;QAEpB,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC7B,oEAAoE;QACpE,gEAAgE;QAChE,qDAAqD;QACrD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACpD,IAAI,CAAC,QAAQ;YAAE,OAAO,WAAW,CAAC;QAClC,IAAI,QAAQ,CAAC,kBAAkB,CAAC,QAAQ,CAAC,YAAY,CAAC;YAAE,OAAO,IAAI,CAAC;QAEpE,MAAM,IAAI,GAAG,CAAC,GAAG,QAAQ,CAAC,kBAAkB,EAAE,YAAY,CAAC,CAAC;QAC5D,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE;aACzC,IAAI,CAAC,eAAe,CAAC;aACrB,MAAM,CAAC,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC;aACrC,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC;aACrB,MAAM,CAAC,SAAS,CAAC,CAAC;QACpB,IAAI,KAAK;YAAE,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;QACjC,OAAO,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,gBAAgB,CACrB,GAAmB,EACnB,MAAc,EACd,YAAoB;QAEpB,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACpD,IAAI,CAAC,QAAQ;YAAE,OAAO,WAAW,CAAC;QAClC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,QAAQ,CAAC,YAAY,CAAC;YAAE,OAAO,IAAI,CAAC;QAErE,MAAM,IAAI,GAAG,QAAQ,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,YAAY,CAAC,CAAC;QAC7E,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE;aACzC,IAAI,CAAC,eAAe,CAAC;aACrB,MAAM,CAAC,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC;aACrC,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC;aACrB,MAAM,CAAC,SAAS,CAAC,CAAC;QACpB,IAAI,KAAK;YAAE,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;QACjC,OAAO,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,SAAS,CACd,GAAmB,EACnB,MAAc,EACd,GAAc;QAEd,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACpD,IAAI,CAAC,QAAQ;YAAE,OAAO,WAAW,CAAC;QAElC,mEAAmE;QACnE,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,GAAG,CAAC,YAAY,CAAC,CAAC;QACxF,MAAM,IAAI,GAAG,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;QAE1D,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE;aACzC,IAAI,CAAC,eAAe,CAAC;aACrB,MAAM,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;aAC7B,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC;aACrB,MAAM,CAAC,SAAS,CAAC,CAAC;QACpB,IAAI,KAAK;YAAE,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;QACjC,OAAO,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC;IACrD,CAAC;CACD;AAED,SAAS,eAAe,CAAC,GAAmB,EAAE,MAAc;IAC3D,IAAI,GAAG,CAAC,MAAM;QAAE,OAAO;IACvB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO;IAClC,IAAI,aAAa,CAAC,GAAG,EAAE,gBAAgB,CAAC;QAAE,OAAO;IACjD,MAAM,IAAI,aAAa,CAAC,iDAAiD,EAAE,GAAG,CAAC,CAAC;AACjF,CAAC;AASD,SAAS,YAAY,CAAC,GAAe;IACpC,OAAO;QACN,MAAM,EAAE,GAAG,CAAC,OAAO;QACnB,WAAW,EAAE,GAAG,CAAC,YAAY,IAAI,SAAS;QAC1C,kBAAkB,EAAE,GAAG,CAAC,mBAAmB,IAAI,EAAE;QACjD,UAAU,EAAE,GAAG,CAAC,WAAW,IAAI,EAAE;KACjC,CAAC;AACH,CAAC;AAOD,SAAS,QAAQ,CAAC,CAAU;IAC3B,MAAM,EAAE,GAAG,CAAmB,CAAC;IAC/B,IAAI,EAAE,EAAE,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,aAAa,CAAC,EAAE,CAAC,OAAO,IAAI,kBAAkB,EAAE,GAAG,CAAC,CAAC;IAC1F,IAAI,EAAE,EAAE,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,aAAa,CAAC,EAAE,CAAC,OAAO,IAAI,uBAAuB,EAAE,GAAG,CAAC,CAAC;IAC/F,IAAI,CAAC,YAAY,KAAK;QAAE,OAAO,CAAC,CAAC;IACjC,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,CAAwC,CAAC;QACrD,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7B,CAAC"}

package/dist/userProfile/__tests__/conformance.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=conformance.test.d.ts.map