@selvajs/supabase-provider 0.17.0-beta.4 → 0.18.0

package/dist/data/migrationHead.js

@@ -1,14 +1,7 @@
 /**
- * The migration head this build of the provider expects the database to be at
- * — the timestamp prefix of the newest file in `supabase/migrations/`.
- *
- * Compared against `selva.migration_head()` (a SECURITY DEFINER function over
- * `supabase_migrations.schema_migrations`) in
- * `SupabaseDataProvider.verifySchemaVersion` to drive the boot-time app↔DB
- * schema handshake (audit O3).
- *
- * MUST be bumped whenever a migration is added — `migration-head.test.ts`
- * asserts this constant matches the migrations directory, so CI catches drift.
+ * Timestamp prefix of the newest file in `supabase/migrations/`. Bump this
+ * whenever a migration is added — `migration-head.test.ts` asserts it
+ * matches the migrations directory, so CI catches drift.
  */
-export const EXPECTED_MIGRATION_HEAD = '20260717120000';
+export const EXPECTED_MIGRATION_HEAD = '20260817120000';
 //# sourceMappingURL=migrationHead.js.map

package/dist/data/migrationHead.js.map

@@ -1 +1 @@
-{"version":3,"file":"migrationHead.js","sourceRoot":"","sources":["../../src/data/migrationHead.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,gBAAgB,CAAC"}
+{"version":3,"file":"migrationHead.js","sourceRoot":"","sources":["../../src/data/migrationHead.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,gBAAgB,CAAC"}

package/dist/data/pagination.d.ts

@@ -1,13 +1,8 @@
 /**
- * Pagination helpers shared across Supabase stores.
- *
- * The platform contract specifies cursor pagination (`ListOptions.cursor`).
- * Because Supabase/Postgres has no built-in opaque cursor format, we encode
- * an offset as the cursor — simple, correct for stable sorts, and good
- * enough for the volumes Selva deals with (admin/definition lists are
- * bounded; nothing is infinite scroll over millions of rows).
- *
- * Keyset pagination would be faster at scale if it ever matters.
+ * `ListOptions.cursor` is meant to be opaque; here it's just an offset
+ * encoded as a string. Simple and correct for stable sorts, fine at Selva's
+ * scale (bounded admin/definition lists, not infinite scroll over millions
+ * of rows). Keyset pagination would be faster if that ever changes.
  */
 import type { ListOptions } from '@selvajs/platform';
 export interface RangeSpec {
@@ -15,16 +10,10 @@ export interface RangeSpec {
     to: number;
     limit: number;
 }
-/** Decode an opaque cursor string. Returns 0 for missing/invalid cursors. */
+/** Returns 0 for a missing or invalid cursor. */
 export declare function decodeCursor(cursor: string | undefined): number;
 export declare function encodeCursor(offset: number): string;
-/** Clamp limit + compute the PostgREST `range(from, to)` bounds. */
 export declare function toRange(opts: Pick<ListOptions, 'limit' | 'cursor'> | undefined): RangeSpec;
-/**
- * Build the `nextCursor` from the count returned by PostgREST. Returns
- * undefined when there is no next page.
- */
 export declare function nextCursorFromRange(range: RangeSpec, returnedCount: number, totalCount: number | null | undefined): string | undefined;
-/** Map `ListOptions.orderBy` to a Postgres column name. */
 export declare function orderColumn(orderBy: ListOptions['orderBy'] | undefined): string;
 //# sourceMappingURL=pagination.d.ts.map

package/dist/data/pagination.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pagination.d.ts","sourceRoot":"","sources":["../../src/data/pagination.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,MAAM,WAAW,SAAS;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;CACd;AAED,6EAA6E;AAC7E,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAI/D;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,oEAAoE;AACpE,wBAAgB,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,OAAO,GAAG,QAAQ,CAAC,GAAG,SAAS,GAAG,SAAS,CAI1F;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAClC,KAAK,EAAE,SAAS,EAChB,aAAa,EAAE,MAAM,EACrB,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACnC,MAAM,GAAG,SAAS,CAOpB;AAED,2DAA2D;AAC3D,wBAAgB,WAAW,CAAC,OAAO,EAAE,WAAW,CAAC,SAAS,CAAC,GAAG,SAAS,GAAG,MAAM,CAU/E"}
+{"version":3,"file":"pagination.d.ts","sourceRoot":"","sources":["../../src/data/pagination.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,MAAM,WAAW,SAAS;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;CACd;AAED,iDAAiD;AACjD,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAI/D;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,wBAAgB,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,OAAO,GAAG,QAAQ,CAAC,GAAG,SAAS,GAAG,SAAS,CAI1F;AAED,wBAAgB,mBAAmB,CAClC,KAAK,EAAE,SAAS,EAChB,aAAa,EAAE,MAAM,EACrB,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACnC,MAAM,GAAG,SAAS,CAOpB;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,WAAW,CAAC,SAAS,CAAC,GAAG,SAAS,GAAG,MAAM,CAU/E"}

package/dist/data/pagination.js

@@ -1,16 +1,11 @@
 /**
- * Pagination helpers shared across Supabase stores.
- *
- * The platform contract specifies cursor pagination (`ListOptions.cursor`).
- * Because Supabase/Postgres has no built-in opaque cursor format, we encode
- * an offset as the cursor — simple, correct for stable sorts, and good
- * enough for the volumes Selva deals with (admin/definition lists are
- * bounded; nothing is infinite scroll over millions of rows).
- *
- * Keyset pagination would be faster at scale if it ever matters.
+ * `ListOptions.cursor` is meant to be opaque; here it's just an offset
+ * encoded as a string. Simple and correct for stable sorts, fine at Selva's
+ * scale (bounded admin/definition lists, not infinite scroll over millions
+ * of rows). Keyset pagination would be faster if that ever changes.
  */
 import { DEFAULT_PAGE_LIMIT, MAX_PAGE_LIMIT } from '@selvajs/platform';
-/** Decode an opaque cursor string. Returns 0 for missing/invalid cursors. */
+/** Returns 0 for a missing or invalid cursor. */
 export function decodeCursor(cursor) {
     if (!cursor)
         return 0;
@@ -20,16 +15,11 @@ export function decodeCursor(cursor) {
 export function encodeCursor(offset) {
     return String(offset);
 }
-/** Clamp limit + compute the PostgREST `range(from, to)` bounds. */
 export function toRange(opts) {
     const limit = Math.min(Math.max(opts?.limit ?? DEFAULT_PAGE_LIMIT, 1), MAX_PAGE_LIMIT);
     const from = decodeCursor(opts?.cursor);
     return { from, to: from + limit - 1, limit };
 }
-/**
- * Build the `nextCursor` from the count returned by PostgREST. Returns
- * undefined when there is no next page.
- */
 export function nextCursorFromRange(range, returnedCount, totalCount) {
     const consumed = range.from + returnedCount;
     if (totalCount != null) {
@@ -38,7 +28,6 @@ export function nextCursorFromRange(range, returnedCount, totalCount) {
     // Without total, we can only infer "there might be more" if we got a full page.
     return returnedCount >= range.limit ? encodeCursor(consumed) : undefined;
 }
-/** Map `ListOptions.orderBy` to a Postgres column name. */
 export function orderColumn(orderBy) {
     switch (orderBy) {
         case 'name':

package/dist/data/pagination.js.map

@@ -1 +1 @@
-{"version":3,"file":"pagination.js","sourceRoot":"","sources":["../../src/data/pagination.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AASvE,6EAA6E;AAC7E,MAAM,UAAU,YAAY,CAAC,MAA0B;IACtD,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC;IACtB,MAAM,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC/B,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAc;IAC1C,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;AACvB,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,OAAO,CAAC,IAAuD;IAC9E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,kBAAkB,EAAE,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;IACvF,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,GAAG,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAClC,KAAgB,EAChB,aAAqB,EACrB,UAAqC;IAErC,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5C,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;QACxB,OAAO,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,CAAC;IACD,gFAAgF;IAChF,OAAO,aAAa,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1E,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,WAAW,CAAC,OAA2C;IACtE,QAAQ,OAAO,EAAE,CAAC;QACjB,KAAK,MAAM;YACV,OAAO,MAAM,CAAC;QACf,KAAK,WAAW;YACf,OAAO,YAAY,CAAC;QACrB,KAAK,WAAW,CAAC;QACjB;YACC,OAAO,YAAY,CAAC;IACtB,CAAC;AACF,CAAC"}
+{"version":3,"file":"pagination.js","sourceRoot":"","sources":["../../src/data/pagination.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AASvE,iDAAiD;AACjD,MAAM,UAAU,YAAY,CAAC,MAA0B;IACtD,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC;IACtB,MAAM,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC/B,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAc;IAC1C,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,IAAuD;IAC9E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,kBAAkB,EAAE,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;IACvF,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,GAAG,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,mBAAmB,CAClC,KAAgB,EAChB,aAAqB,EACrB,UAAqC;IAErC,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5C,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;QACxB,OAAO,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,CAAC;IACD,gFAAgF;IAChF,OAAO,aAAa,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,OAA2C;IACtE,QAAQ,OAAO,EAAE,CAAC;QACjB,KAAK,MAAM;YACV,OAAO,MAAM,CAAC;QACf,KAAK,WAAW;YACf,OAAO,YAAY,CAAC;QACrB,KAAK,WAAW,CAAC;QACjB;YACC,OAAO,YAAY,CAAC;IACtB,CAAC;AACF,CAAC"}

package/dist/data/query.d.ts

@@ -1,20 +1,8 @@
-/**
- * Small query-builder helpers shared across Supabase stores.
- */
-/**
- * The slice of a PostgREST filter builder these helpers touch: an `.is()`
- * method that returns the same builder for chaining. Generic over the builder
- * type so the caller's concrete builder (and its row generic) flows through.
- */
+/** Minimal PostgREST filter-builder slice these helpers need, generic so the caller's row type flows through. */
 interface DeletableQuery {
     is(column: string, value: null): this;
 }
-/**
- * Apply the soft-delete filter `deleted_at IS NULL`. The `.is('deleted_at', null)`
- * idiom is repeated across every store that soft-deletes; this names it.
- *
- *   let q = notDeleted(client.from('projects').select(COLS));
- */
+/** `deleted_at IS NULL`, named once instead of repeated across every soft-deleting store. */
 export declare function notDeleted<Q extends DeletableQuery>(query: Q): Q;
 export {};
 //# sourceMappingURL=query.d.ts.map

package/dist/data/query.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"query.d.ts","sourceRoot":"","sources":["../../src/data/query.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;;;GAIG;AACH,UAAU,cAAc;IACvB,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,GAAG,IAAI,CAAC;CACtC;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,CAAC,SAAS,cAAc,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CAEhE"}
+{"version":3,"file":"query.d.ts","sourceRoot":"","sources":["../../src/data/query.ts"],"names":[],"mappings":"AAAA,iHAAiH;AACjH,UAAU,cAAc;IACvB,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,GAAG,IAAI,CAAC;CACtC;AAED,6FAA6F;AAC7F,wBAAgB,UAAU,CAAC,CAAC,SAAS,cAAc,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CAEhE"}

package/dist/data/query.js

@@ -1,12 +1,4 @@
-/**
- * Small query-builder helpers shared across Supabase stores.
- */
-/**
- * Apply the soft-delete filter `deleted_at IS NULL`. The `.is('deleted_at', null)`
- * idiom is repeated across every store that soft-deletes; this names it.
- *
- *   let q = notDeleted(client.from('projects').select(COLS));
- */
+/** `deleted_at IS NULL`, named once instead of repeated across every soft-deleting store. */
 export function notDeleted(query) {
     return query.is('deleted_at', null);
 }

package/dist/data/query.js.map

@@ -1 +1 @@
-{"version":3,"file":"query.js","sourceRoot":"","sources":["../../src/data/query.ts"],"names":[],"mappings":"AAAA;;GAEG;AAWH;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAA2B,KAAQ;IAC5D,OAAO,KAAK,CAAC,EAAE,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;AACrC,CAAC"}
+{"version":3,"file":"query.js","sourceRoot":"","sources":["../../src/data/query.ts"],"names":[],"mappings":"AAKA,6FAA6F;AAC7F,MAAM,UAAU,UAAU,CAA2B,KAAQ;IAC5D,OAAO,KAAK,CAAC,EAAE,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;AACrC,CAAC"}

package/dist/data/rowStamp.d.ts

@@ -1,35 +1,19 @@
 import type { RequestContext } from '@selvajs/platform';
 /**
- * Row-level (snake_case) audit-stamp helpers for Supabase stores.
+ * Translates platform's camelCase audit fields (`updatedAt`/`updatedBy`) to
+ * the snake_case columns every Supabase row uses.
  *
- * Platform's `auditUpdate` / `auditSoftDelete` emit camelCase *domain* fields
- * (`updatedAt` / `updatedBy`), but Postgres rows are snake_case, so every store
- * hand-translated them. These helpers own that translation once. Row-column
- * naming is a provider concern, so they live here rather than in platform.
+ * `updated_by` is written only when `ctx.userId` is set. On system contexts
+ * `auditUpdate`/`auditSoftDelete` fall back to `''`, and the column FKs
+ * `auth.users(id)` — writing `''` violates the FK — so it's omitted instead,
+ * leaving the existing value untouched.
  *
- * Two deliberate rules, matched to how the engine's stores already write rows:
- *  - `updated_by` is written ONLY when `ctx.userId` is set. On system contexts
- *    it's the empty string, and the column FKs `auth.users(id)` with
- *    `ON DELETE SET NULL` — writing `''` would violate the FK, so it's omitted
- *    and the existing value is left untouched.
- *  - Plain updates DON'T stamp `updated_at`: a per-table `updated_at` trigger
- *    already sets it. Only the soft-delete stamp writes `updated_at` explicitly,
- *    so it matches `deleted_at` (a single timestamp for the deletion event).
- */
-/**
- * Stamp for a plain UPDATE: `{ updated_by }` when the context carries a user,
- * `{}` otherwise (the DB trigger handles `updated_at`). Spread into the row:
- * `const row = { ...patch, ...stampUpdate(ctx) }`.
+ * Plain updates don't stamp `updated_at`: a per-table trigger already sets
+ * it. Only soft-delete sets `updated_at` explicitly, to match `deleted_at`.
  */
 export declare function stampUpdate(ctx: RequestContext): {
     updated_by?: string;
 };
-/**
- * Stamp for a soft-delete: `{ deleted_at, updated_at, updated_by? }`. `updated_at`
- * is set explicitly to equal `deleted_at`; `updated_by` follows the same
- * omit-when-empty rule as {@link stampUpdate}. `fallbackActor` defaults to
- * `ctx.userId` (matching the engine stores' `auditSoftDelete(ctx, ctx.userId)`).
- */
 export declare function stampSoftDelete(ctx: RequestContext, fallbackActor?: string | null | undefined): {
     deleted_at: string;
     updated_at: string;

package/dist/data/rowStamp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rowStamp.d.ts","sourceRoot":"","sources":["../../src/data/rowStamp.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGxD;;;;;;;;;;;;;;;;GAgBG;AAEH;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAExE;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC9B,GAAG,EAAE,cAAc,EACnB,aAAa,GAAE,MAAM,GAAG,IAAI,GAAG,SAAsB,GACnD;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAQjE"}
+{"version":3,"file":"rowStamp.d.ts","sourceRoot":"","sources":["../../src/data/rowStamp.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGxD;;;;;;;;;;;GAWG;AAEH,wBAAgB,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAExE;AAED,wBAAgB,eAAe,CAC9B,GAAG,EAAE,cAAc,EACnB,aAAa,GAAE,MAAM,GAAG,IAAI,GAAG,SAAsB,GACnD;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAQjE"}

package/dist/data/rowStamp.js

@@ -1,35 +1,19 @@
 import { auditSoftDelete } from '@selvajs/platform';
 /**
- * Row-level (snake_case) audit-stamp helpers for Supabase stores.
+ * Translates platform's camelCase audit fields (`updatedAt`/`updatedBy`) to
+ * the snake_case columns every Supabase row uses.
  *
- * Platform's `auditUpdate` / `auditSoftDelete` emit camelCase *domain* fields
- * (`updatedAt` / `updatedBy`), but Postgres rows are snake_case, so every store
- * hand-translated them. These helpers own that translation once. Row-column
- * naming is a provider concern, so they live here rather than in platform.
+ * `updated_by` is written only when `ctx.userId` is set. On system contexts
+ * `auditUpdate`/`auditSoftDelete` fall back to `''`, and the column FKs
+ * `auth.users(id)` — writing `''` violates the FK — so it's omitted instead,
+ * leaving the existing value untouched.
  *
- * Two deliberate rules, matched to how the engine's stores already write rows:
- *  - `updated_by` is written ONLY when `ctx.userId` is set. On system contexts
- *    it's the empty string, and the column FKs `auth.users(id)` with
- *    `ON DELETE SET NULL` — writing `''` would violate the FK, so it's omitted
- *    and the existing value is left untouched.
- *  - Plain updates DON'T stamp `updated_at`: a per-table `updated_at` trigger
- *    already sets it. Only the soft-delete stamp writes `updated_at` explicitly,
- *    so it matches `deleted_at` (a single timestamp for the deletion event).
- */
-/**
- * Stamp for a plain UPDATE: `{ updated_by }` when the context carries a user,
- * `{}` otherwise (the DB trigger handles `updated_at`). Spread into the row:
- * `const row = { ...patch, ...stampUpdate(ctx) }`.
+ * Plain updates don't stamp `updated_at`: a per-table trigger already sets
+ * it. Only soft-delete sets `updated_at` explicitly, to match `deleted_at`.
  */
 export function stampUpdate(ctx) {
     return ctx.userId ? { updated_by: ctx.userId } : {};
 }
-/**
- * Stamp for a soft-delete: `{ deleted_at, updated_at, updated_by? }`. `updated_at`
- * is set explicitly to equal `deleted_at`; `updated_by` follows the same
- * omit-when-empty rule as {@link stampUpdate}. `fallbackActor` defaults to
- * `ctx.userId` (matching the engine stores' `auditSoftDelete(ctx, ctx.userId)`).
- */
 export function stampSoftDelete(ctx, fallbackActor = ctx.userId) {
     const stamp = auditSoftDelete(ctx, fallbackActor);
     const row = {

package/dist/data/rowStamp.js.map

@@ -1 +1 @@
-{"version":3,"file":"rowStamp.js","sourceRoot":"","sources":["../../src/data/rowStamp.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEpD;;;;;;;;;;;;;;;;GAgBG;AAEH;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,GAAmB;IAC9C,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACrD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC9B,GAAmB,EACnB,gBAA2C,GAAG,CAAC,MAAM;IAErD,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IAClD,MAAM,GAAG,GAAoE;QAC5E,UAAU,EAAE,KAAK,CAAC,SAAS;QAC3B,UAAU,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC;IACF,IAAI,KAAK,CAAC,SAAS;QAAE,GAAG,CAAC,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC;IACtD,OAAO,GAAG,CAAC;AACZ,CAAC"}
+{"version":3,"file":"rowStamp.js","sourceRoot":"","sources":["../../src/data/rowStamp.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEpD;;;;;;;;;;;GAWG;AAEH,MAAM,UAAU,WAAW,CAAC,GAAmB;IAC9C,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,eAAe,CAC9B,GAAmB,EACnB,gBAA2C,GAAG,CAAC,MAAM;IAErD,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IAClD,MAAM,GAAG,GAAoE;QAC5E,UAAU,EAAE,KAAK,CAAC,SAAS;QAC3B,UAAU,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC;IACF,IAAI,KAAK,CAAC,SAAS;QAAE,GAAG,CAAC,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC;IACtD,OAAO,GAAG,CAAC;AACZ,CAAC"}

package/dist/permissions/SupabasePlatformPermissionStore.d.ts

@@ -1,17 +1,15 @@
 import type { IPlatformPermissionStore, PlatformPermission, RequestContext, UserManagementResult } from '@selvajs/platform';
 import type { ClientBundle } from '../data/client.js';
 /**
- * Supabase-backed platform-permission store. Reads and writes
- * `public.user_profiles.platform_permissions` (auto-seeded by the
- * `handle_new_auth_user` trigger). Service-role throughout — the store's own
- * `assertAdmin` / `assertCanRead` enforce the auth boundary at the app level
- * since RLS on `user_profiles` is coarse-grained for cross-user reads.
+ * Reads and writes `public.user_profiles.platform_permissions` (auto-seeded
+ * by the `handle_new_auth_user` trigger). Service-role throughout — RLS on
+ * `user_profiles` is too coarse for cross-user reads, so `assertAdmin` /
+ * `assertCanRead` enforce the auth boundary here instead.
  *
- * Disabled-user state is sourced from `auth.users.user_metadata.disabled` and
- * mirrored into `user_profiles.disabled` by the `sync_auth_user_disabled`
- * trigger, so the invariant counters exclude disabled admins in a single
- * indexed query (matches `Permissions.md §10` "enabled instance_admin"
- * semantics) instead of cross-referencing the auth admin API per candidate.
+ * `user_profiles.disabled` mirrors `auth.users.user_metadata.disabled` via
+ * the `sync_auth_user_disabled` trigger, so admin-count queries can exclude
+ * disabled admins with a single indexed query instead of cross-referencing
+ * the auth admin API per candidate.
  */
 export declare class SupabasePlatformPermissionStore implements IPlatformPermissionStore {
     private readonly clients;

package/dist/permissions/SupabasePlatformPermissionStore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SupabasePlatformPermissionStore.d.ts","sourceRoot":"","sources":["../../src/permissions/SupabasePlatformPermissionStore.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACX,wBAAwB,EACxB,kBAAkB,EAClB,cAAc,EACd,oBAAoB,EACpB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEtD;;;;;;;;;;;;GAYG;AACH,qBAAa,+BAAgC,YAAW,wBAAwB;IACnE,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,YAAY;IAElD,OAAO,CAAC,MAAM;IAIR,MAAM,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAW1E,WAAW,CAChB,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,SAAS,MAAM,EAAE,GACxB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAevC,GAAG,CACR,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,SAAS,kBAAkB,EAAE,GACxC,OAAO,CAAC,oBAAoB,CAAC;IA8B1B,gBAAgB,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC;IAUxD,4BAA4B,CAAC,IAAI,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAIlF,uBAAuB;CAUrC"}
+{"version":3,"file":"SupabasePlatformPermissionStore.d.ts","sourceRoot":"","sources":["../../src/permissions/SupabasePlatformPermissionStore.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACX,wBAAwB,EACxB,kBAAkB,EAClB,cAAc,EACd,oBAAoB,EACpB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEtD;;;;;;;;;;GAUG;AACH,qBAAa,+BAAgC,YAAW,wBAAwB;IACnE,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,YAAY;IAElD,OAAO,CAAC,MAAM;IAIR,MAAM,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAW1E,WAAW,CAChB,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,SAAS,MAAM,EAAE,GACxB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAevC,GAAG,CACR,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,SAAS,kBAAkB,EAAE,GACxC,OAAO,CAAC,oBAAoB,CAAC;IA0B1B,gBAAgB,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC;IAUxD,4BAA4B,CAAC,IAAI,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAIlF,uBAAuB;CAUrC"}

package/dist/permissions/SupabasePlatformPermissionStore.js

@@ -1,16 +1,14 @@
 import { ProviderError, hasPermission, ALL_PLATFORM_PERMISSIONS } from '@selvajs/platform';
 /**
- * Supabase-backed platform-permission store. Reads and writes
- * `public.user_profiles.platform_permissions` (auto-seeded by the
- * `handle_new_auth_user` trigger). Service-role throughout — the store's own
- * `assertAdmin` / `assertCanRead` enforce the auth boundary at the app level
- * since RLS on `user_profiles` is coarse-grained for cross-user reads.
+ * Reads and writes `public.user_profiles.platform_permissions` (auto-seeded
+ * by the `handle_new_auth_user` trigger). Service-role throughout — RLS on
+ * `user_profiles` is too coarse for cross-user reads, so `assertAdmin` /
+ * `assertCanRead` enforce the auth boundary here instead.
  *
- * Disabled-user state is sourced from `auth.users.user_metadata.disabled` and
- * mirrored into `user_profiles.disabled` by the `sync_auth_user_disabled`
- * trigger, so the invariant counters exclude disabled admins in a single
- * indexed query (matches `Permissions.md §10` "enabled instance_admin"
- * semantics) instead of cross-referencing the auth admin API per candidate.
+ * `user_profiles.disabled` mirrors `auth.users.user_metadata.disabled` via
+ * the `sync_auth_user_disabled` trigger, so admin-count queries can exclude
+ * disabled admins with a single indexed query instead of cross-referencing
+ * the auth admin API per candidate.
  */
 export class SupabasePlatformPermissionStore {
     clients;
@@ -49,9 +47,6 @@ export class SupabasePlatformPermissionStore {
     }
     async set(ctx, userId, permissions) {
         assertAdmin(ctx);
-        // 1. Confirm the target exists in the auth backend (the FK + trigger
-        //    means the user_profiles row should exist post-signup; if not,
-        //    treat as not_found rather than auto-creating).
         const { data: existing, error: fetchError } = await this.client()
             .from('user_profiles')
             .select('platform_permissions')
@@ -61,7 +56,7 @@ export class SupabasePlatformPermissionStore {
             throw mapError(fetchError);
         if (!existing)
             return 'not_found';
-        // 2. §2 invariant: refuse if dropping the last instance_admin.
+        // Refuse to drop the last enabled instance_admin.
         const wasAdmin = (existing.platform_permissions ?? []).includes('instance_admin');
         const willBeAdmin = permissions.includes('instance_admin');
         if (wasAdmin && !willBeAdmin) {
@@ -69,7 +64,6 @@ export class SupabasePlatformPermissionStore {
             if (others === 0)
                 return 'last_admin';
         }
-        // 3. Apply.
         const { error } = await this.client()
             .from('user_profiles')
             .update({ platform_permissions: [...permissions] })

package/dist/permissions/SupabasePlatformPermissionStore.js.map

@@ -1 +1 @@
-{"version":3,"file":"SupabasePlatformPermissionStore.js","sourceRoot":"","sources":["../../src/permissions/SupabasePlatformPermissionStore.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAG3F;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,+BAA+B;IACd;IAA7B,YAA6B,OAAqB;QAArB,YAAO,GAAP,OAAO,CAAc;IAAG,CAAC;IAE9C,MAAM;QACb,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAmB,EAAE,MAAc;QAC/C,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC3B,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE;aACzC,IAAI,CAAC,eAAe,CAAC;aACrB,MAAM,CAAC,sBAAsB,CAAC;aAC9B,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC;aACrB,WAAW,EAAE,CAAC;QAChB,IAAI,KAAK;YAAE,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;QACjC,OAAO,WAAW,CAAC,IAAI,EAAE,oBAAoB,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,WAAW,CAChB,GAAmB,EACnB,OAA0B;QAE1B,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,MAAM,GAAG,GAAG,IAAI,GAAG,EAAgC,CAAC;QACpD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC;QACrC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE;aACzC,IAAI,CAAC,eAAe,CAAC;aACrB,MAAM,CAAC,+BAA+B,CAAC;aACvC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;QAC9B,IAAI,KAAK;YAAE,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;QACjC,KAAK,MAAM,GAAG,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;YAC9B,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,OAAiB,EAAE,WAAW,CAAC,CAAC,GAAG,CAAC,oBAAoB,IAAI,EAAE,CAAa,CAAC,CAAC,CAAC;QAC3F,CAAC;QACD,OAAO,GAAG,CAAC;IACZ,CAAC;IAED,KAAK,CAAC,GAAG,CACR,GAAmB,EACnB,MAAc,EACd,WAA0C;QAE1C,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,qEAAqE;QACrE,mEAAmE;QACnE,oDAAoD;QACpD,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE;aAC/D,IAAI,CAAC,eAAe,CAAC;aACrB,MAAM,CAAC,sBAAsB,CAAC;aAC9B,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC;aACrB,WAAW,EAAE,CAAC;QAChB,IAAI,UAAU;YAAE,MAAM,QAAQ,CAAC,UAAU,CAAC,CAAC;QAC3C,IAAI,CAAC,QAAQ;YAAE,OAAO,WAAW,CAAC;QAElC,+DAA+D;QAC/D,MAAM,QAAQ,GAAG,CAAC,QAAQ,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QAClF,MAAM,WAAW,GAAG,WAAW,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QAC3D,IAAI,QAAQ,IAAI,CAAC,WAAW,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC;YAC1D,IAAI,MAAM,KAAK,CAAC;gBAAE,OAAO,YAAY,CAAC;QACvC,CAAC;QAED,YAAY;QACZ,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE;aACnC,IAAI,CAAC,eAAe,CAAC;aACrB,MAAM,CAAC,EAAE,oBAAoB,EAAE,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC;aAClD,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACxB,IAAI,KAAK;YAAE,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC;IACb,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,IAAoB;QAC1C,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE;aAC1C,IAAI,CAAC,eAAe,CAAC;aACrB,MAAM,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;aACjD,QAAQ,CAAC,sBAAsB,EAAE,CAAC,gBAAgB,CAAC,CAAC;aACpD,EAAE,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACxB,IAAI,KAAK;YAAE,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;QACjC,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,4BAA4B,CAAC,IAAoB,EAAE,aAAqB;QAC7E,OAAO,IAAI,CAAC,uBAAuB,CAAC,aAAa,CAAC,CAAC;IACpD,CAAC;IAEO,KAAK,CAAC,uBAAuB,CAAC,aAAqB;QAC1D,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE;aAC1C,IAAI,CAAC,eAAe,CAAC;aACrB,MAAM,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;aACjD,QAAQ,CAAC,sBAAsB,EAAE,CAAC,gBAAgB,CAAC,CAAC;aACpD,EAAE,CAAC,UAAU,EAAE,KAAK,CAAC;aACrB,GAAG,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;QAChC,IAAI,KAAK;YAAE,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;QACjC,OAAO,KAAK,IAAI,CAAC,CAAC;IACnB,CAAC;CACD;AAED,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAS,wBAAwB,CAAC,CAAC;AAEpE,SAAS,WAAW,CAAC,GAAsB;IAC1C,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAA2B,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,aAAa,CAAC,GAAmB,EAAE,MAAc;IACzD,IAAI,GAAG,CAAC,MAAM;QAAE,OAAO;IACvB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO;IAClC,IAAI,aAAa,CAAC,GAAG,EAAE,gBAAgB,CAAC;QAAE,OAAO;IACjD,MAAM,IAAI,aAAa,CAAC,mDAAmD,EAAE,GAAG,CAAC,CAAC;AACnF,CAAC;AAED,SAAS,WAAW,CAAC,GAAmB;IACvC,IAAI,GAAG,CAAC,MAAM;QAAE,OAAO;IACvB,IAAI,aAAa,CAAC,GAAG,EAAE,gBAAgB,CAAC;QAAE,OAAO;IACjD,MAAM,IAAI,aAAa,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAC;AACpE,CAAC;AAOD,SAAS,QAAQ,CAAC,CAAU;IAC3B,MAAM,EAAE,GAAG,CAAmB,CAAC;IAC/B,IAAI,EAAE,EAAE,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,aAAa,CAAC,EAAE,CAAC,OAAO,IAAI,kBAAkB,EAAE,GAAG,CAAC,CAAC;IAC1F,IAAI,EAAE,EAAE,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,aAAa,CAAC,EAAE,CAAC,OAAO,IAAI,uBAAuB,EAAE,GAAG,CAAC,CAAC;IAC/F,IAAI,CAAC,YAAY,KAAK;QAAE,OAAO,CAAC,CAAC;IACjC,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,CAAwC,CAAC;QACrD,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7B,CAAC"}
+{"version":3,"file":"SupabasePlatformPermissionStore.js","sourceRoot":"","sources":["../../src/permissions/SupabasePlatformPermissionStore.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAG3F;;;;;;;;;;GAUG;AACH,MAAM,OAAO,+BAA+B;IACd;IAA7B,YAA6B,OAAqB;QAArB,YAAO,GAAP,OAAO,CAAc;IAAG,CAAC;IAE9C,MAAM;QACb,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAmB,EAAE,MAAc;QAC/C,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC3B,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE;aACzC,IAAI,CAAC,eAAe,CAAC;aACrB,MAAM,CAAC,sBAAsB,CAAC;aAC9B,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC;aACrB,WAAW,EAAE,CAAC;QAChB,IAAI,KAAK;YAAE,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;QACjC,OAAO,WAAW,CAAC,IAAI,EAAE,oBAAoB,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,WAAW,CAChB,GAAmB,EACnB,OAA0B;QAE1B,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,MAAM,GAAG,GAAG,IAAI,GAAG,EAAgC,CAAC;QACpD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC;QACrC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE;aACzC,IAAI,CAAC,eAAe,CAAC;aACrB,MAAM,CAAC,+BAA+B,CAAC;aACvC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;QAC9B,IAAI,KAAK;YAAE,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;QACjC,KAAK,MAAM,GAAG,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;YAC9B,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,OAAiB,EAAE,WAAW,CAAC,CAAC,GAAG,CAAC,oBAAoB,IAAI,EAAE,CAAa,CAAC,CAAC,CAAC;QAC3F,CAAC;QACD,OAAO,GAAG,CAAC;IACZ,CAAC;IAED,KAAK,CAAC,GAAG,CACR,GAAmB,EACnB,MAAc,EACd,WAA0C;QAE1C,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE;aAC/D,IAAI,CAAC,eAAe,CAAC;aACrB,MAAM,CAAC,sBAAsB,CAAC;aAC9B,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC;aACrB,WAAW,EAAE,CAAC;QAChB,IAAI,UAAU;YAAE,MAAM,QAAQ,CAAC,UAAU,CAAC,CAAC;QAC3C,IAAI,CAAC,QAAQ;YAAE,OAAO,WAAW,CAAC;QAElC,kDAAkD;QAClD,MAAM,QAAQ,GAAG,CAAC,QAAQ,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QAClF,MAAM,WAAW,GAAG,WAAW,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QAC3D,IAAI,QAAQ,IAAI,CAAC,WAAW,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC;YAC1D,IAAI,MAAM,KAAK,CAAC;gBAAE,OAAO,YAAY,CAAC;QACvC,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE;aACnC,IAAI,CAAC,eAAe,CAAC;aACrB,MAAM,CAAC,EAAE,oBAAoB,EAAE,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC;aAClD,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACxB,IAAI,KAAK;YAAE,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC;IACb,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,IAAoB;QAC1C,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE;aAC1C,IAAI,CAAC,eAAe,CAAC;aACrB,MAAM,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;aACjD,QAAQ,CAAC,sBAAsB,EAAE,CAAC,gBAAgB,CAAC,CAAC;aACpD,EAAE,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACxB,IAAI,KAAK;YAAE,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;QACjC,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,4BAA4B,CAAC,IAAoB,EAAE,aAAqB;QAC7E,OAAO,IAAI,CAAC,uBAAuB,CAAC,aAAa,CAAC,CAAC;IACpD,CAAC;IAEO,KAAK,CAAC,uBAAuB,CAAC,aAAqB;QAC1D,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE;aAC1C,IAAI,CAAC,eAAe,CAAC;aACrB,MAAM,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;aACjD,QAAQ,CAAC,sBAAsB,EAAE,CAAC,gBAAgB,CAAC,CAAC;aACpD,EAAE,CAAC,UAAU,EAAE,KAAK,CAAC;aACrB,GAAG,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;QAChC,IAAI,KAAK;YAAE,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;QACjC,OAAO,KAAK,IAAI,CAAC,CAAC;IACnB,CAAC;CACD;AAED,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAS,wBAAwB,CAAC,CAAC;AAEpE,SAAS,WAAW,CAAC,GAAsB;IAC1C,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAA2B,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,aAAa,CAAC,GAAmB,EAAE,MAAc;IACzD,IAAI,GAAG,CAAC,MAAM;QAAE,OAAO;IACvB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO;IAClC,IAAI,aAAa,CAAC,GAAG,EAAE,gBAAgB,CAAC;QAAE,OAAO;IACjD,MAAM,IAAI,aAAa,CAAC,mDAAmD,EAAE,GAAG,CAAC,CAAC;AACnF,CAAC;AAED,SAAS,WAAW,CAAC,GAAmB;IACvC,IAAI,GAAG,CAAC,MAAM;QAAE,OAAO;IACvB,IAAI,aAAa,CAAC,GAAG,EAAE,gBAAgB,CAAC;QAAE,OAAO;IACjD,MAAM,IAAI,aAAa,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAC;AACpE,CAAC;AAOD,SAAS,QAAQ,CAAC,CAAU;IAC3B,MAAM,EAAE,GAAG,CAAmB,CAAC;IAC/B,IAAI,EAAE,EAAE,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,aAAa,CAAC,EAAE,CAAC,OAAO,IAAI,kBAAkB,EAAE,GAAG,CAAC,CAAC;IAC1F,IAAI,EAAE,EAAE,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,aAAa,CAAC,EAAE,CAAC,OAAO,IAAI,uBAAuB,EAAE,GAAG,CAAC,CAAC;IAC/F,IAAI,CAAC,YAAY,KAAK;QAAE,OAAO,CAAC,CAAC;IACjC,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,CAAwC,CAAC;QACrD,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7B,CAAC"}

package/dist/storage/SupabaseStorageProvider.d.ts

@@ -1,39 +1,25 @@
 import type { IStorageProvider } from '@selvajs/platform/storage';
 /**
- * Storage backend for Selva on Supabase Storage.
- *
- * Uses two buckets:
- *   - {publicBucket} (public): org branding, archive thumbnails, anything
- *     CDN-safe. `getPublicUrl` returns the direct CDN URL.
- *   - {privateBucket} (private): .gh / .ghx source files plus every asset
- *     class that isn't `public` (definition covers, org private files).
- *     `getPublicUrl` returns the authenticated proxy URL
- *     (`${privateUrlPrefix}/{path}`) — the consuming app must have a route at
- *     that prefix that authenticates the request and streams the bytes via
- *     `get()`.
- *
- * Routing is derived from the extension and `classifyAssetPath`, so callers
- * building paths via `definitionPaths` never have to think about buckets.
+ * Storage backend for Selva on Supabase Storage. Routes each path to one of
+ * two buckets: `publicBucket` (CDN-readable, `getPublicUrl` returns the
+ * direct CDN URL) or `privateBucket` (`getPublicUrl` returns
+ * `${privateUrlPrefix}/{path}` — the consuming app must route that prefix
+ * through an auth check and `get()`).
  */
 export interface SupabaseStorageProviderConfig {
     /** Supabase project URL (e.g. http://127.0.0.1:54321 for local stack). */
     supabaseUrl: string;
     /**
-     * Service-role key. Required because the provider runs server-side and
-     * must bypass RLS for server-internal actions (admin uploads, janitor
-     * cleanup). The provider is never used directly from the browser.
+     * Service-role key. The provider runs server-side and must bypass RLS
+     * for server-internal actions (admin uploads, janitor cleanup) — never
+     * used from the browser.
      */
     serviceRoleKey: string;
     /** Bucket for CDN-readable objects. Default: "selva-public". */
     publicBucket?: string;
     /** Bucket for authenticated-only objects. Default: "selva-private". */
     privateBucket?: string;
-    /**
-     * URL prefix the app exposes for authenticated file downloads. Used by
-     * `getPublicUrl` for private-bucket paths. Default: "/api/files".
-     * The matching SvelteKit route is expected to call `get()` and stream
-     * bytes back after an auth check.
-     */
+    /** URL prefix for authenticated file downloads, used by `getPublicUrl`. Default: "/api/files". */
     privateUrlPrefix?: string;
 }
 export declare class SupabaseStorageProvider implements IStorageProvider {
@@ -45,14 +31,10 @@ export declare class SupabaseStorageProvider implements IStorageProvider {
     static fromEnv(env: Record<string, string | undefined>): SupabaseStorageProvider;
     constructor(config: SupabaseStorageProviderConfig);
     /**
-     * Route a storage path to a bucket. A path is private when either:
-     *   - it's a `.gh`/`.ghx` source file — confidentiality by extension, so a
-     *     path-scheme rename can't silently move sources into the public bucket;
-     *   - it classifies as a non-`public` asset class (`classifyAssetPath`) —
-     *     e.g. `orgs/{id}/private/*` pricing sheets are members-only and must
-     *     never land in the CDN-readable bucket. Definition covers classify as
-     *     `project`-visible and are private for the same reason.
-     * Everything else (branding, archives, thumbnails) is public.
+     * `.gh`/`.ghx` source files are always private, regardless of what
+     * `classifyAssetPath` says — confidentiality by extension means a
+     * path-scheme rename can't silently move sources into the public bucket.
+     * Everything else routes by asset class.
      */
     private bucketFor;
     get(storagePath: string): Promise<Uint8Array | null>;
@@ -60,10 +42,7 @@ export declare class SupabaseStorageProvider implements IStorageProvider {
     delete(storagePath: string): Promise<void>;
     deletePrefix(prefix: string): Promise<void>;
     private deletePrefixInBucket;
-    /**
-     * Recursively list every key under a prefix. `storage-js`'s `list` API
-     * only returns the immediate children of a "folder", so we DFS.
-     */
+    /** storage-js's `list` only returns immediate children of a "folder", so DFS to get everything under `prefix`. */
     private listAllKeys;
     getPublicUrl(storagePath: string): string;
 }

package/dist/storage/SupabaseStorageProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SupabaseStorageProvider.d.ts","sourceRoot":"","sources":["../../src/storage/SupabaseStorageProvider.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAElE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,6BAA6B;IAC7C,0EAA0E;IAC1E,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,cAAc,EAAE,MAAM,CAAC;IACvB,gEAAgE;IAChE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uEAAuE;IACvE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,qBAAa,uBAAwB,YAAW,gBAAgB;IAC/D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiB;IACxC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAE1C,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,uBAAuB;gBAcpE,MAAM,EAAE,6BAA6B;IAWjD;;;;;;;;;OASG;IACH,OAAO,CAAC,SAAS;IAOX,GAAG,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAcpD,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAiB/E,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAO1C,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YASnC,oBAAoB;IAYlC;;;OAGG;YACW,WAAW;IAuBzB,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM;CAOzC"}
+{"version":3,"file":"SupabaseStorageProvider.d.ts","sourceRoot":"","sources":["../../src/storage/SupabaseStorageProvider.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAElE;;;;;;GAMG;AACH,MAAM,WAAW,6BAA6B;IAC7C,0EAA0E;IAC1E,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,cAAc,EAAE,MAAM,CAAC;IACvB,gEAAgE;IAChE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uEAAuE;IACvE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kGAAkG;IAClG,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,qBAAa,uBAAwB,YAAW,gBAAgB;IAC/D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiB;IACxC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAE1C,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,uBAAuB;gBAcpE,MAAM,EAAE,6BAA6B;IAUjD;;;;;OAKG;IACH,OAAO,CAAC,SAAS;IAOX,GAAG,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAapD,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAc/E,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAM1C,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAQnC,oBAAoB;IAYlC,kHAAkH;YACpG,WAAW;IAuBzB,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM;CAMzC"}

package/dist/storage/SupabaseStorageProvider.js

@@ -27,19 +27,14 @@ export class SupabaseStorageProvider {
         });
         this.publicBucket = config.publicBucket ?? 'selva-public';
         this.privateBucket = config.privateBucket ?? 'selva-private';
-        // Direct CDN URL format: {supabaseUrl}/storage/v1/object/public/{bucket}/{path}
         this.publicBaseUrl = `${config.supabaseUrl.replace(/\/$/, '')}/storage/v1/object/public/${this.publicBucket}`;
         this.privateUrlPrefix = (config.privateUrlPrefix ?? '/api/files').replace(/\/$/, '');
     }
     /**
-     * Route a storage path to a bucket. A path is private when either:
-     *   - it's a `.gh`/`.ghx` source file — confidentiality by extension, so a
-     *     path-scheme rename can't silently move sources into the public bucket;
-     *   - it classifies as a non-`public` asset class (`classifyAssetPath`) —
-     *     e.g. `orgs/{id}/private/*` pricing sheets are members-only and must
-     *     never land in the CDN-readable bucket. Definition covers classify as
-     *     `project`-visible and are private for the same reason.
-     * Everything else (branding, archives, thumbnails) is public.
+     * `.gh`/`.ghx` source files are always private, regardless of what
+     * `classifyAssetPath` says — confidentiality by extension means a
+     * path-scheme rename can't silently move sources into the public bucket.
+     * Everything else routes by asset class.
      */
     bucketFor(storagePath) {
         if (/\.(gh|ghx)$/i.test(storagePath))
@@ -53,8 +48,7 @@ export class SupabaseStorageProvider {
         const bucket = this.bucketFor(storagePath);
         const { data, error } = await this.client.storage.from(bucket).download(storagePath);
         if (error) {
-            // storage-js surfaces 404 as an error with message "Object not found".
-            // Normalize any "not found" to null — we don't have a stable status code.
+            // storage-js has no stable status code for 404 — match the message instead.
             const msg = error.message ?? '';
             if (/not found/i.test(msg) || /no such key/i.test(msg))
                 return null;
@@ -64,16 +58,13 @@ export class SupabaseStorageProvider {
         return new Uint8Array(buffer);
     }
     async put(storagePath, data, contentType) {
-        // Normalize images through the shared helper so this provider produces
-        // the same bytes / extensions as LocalStorageProvider for the same input.
         const transcoded = await transcodeImageIfNeeded(data, contentType, storagePath);
         const bucket = this.bucketFor(transcoded.path);
         const { error } = await this.client.storage
             .from(bucket)
             .upload(transcoded.path, transcoded.data, {
             contentType: transcoded.contentType,
-            // Objects are content-addressed (GUID/hash prefixes) and effectively
-            // immutable, so let CDN/browser cache them for a year.
+            // Objects are content-addressed and immutable — cache for a year.
             cacheControl: '31536000',
             upsert: true
         });
@@ -83,13 +74,11 @@ export class SupabaseStorageProvider {
     async delete(storagePath) {
         const bucket = this.bucketFor(storagePath);
         const { error } = await this.client.storage.from(bucket).remove([storagePath]);
-        // remove() does not error for missing paths — it just returns an empty array.
         if (error)
             throw error;
     }
     async deletePrefix(prefix) {
-        // Hit both buckets: a definition's GUID prefix may have files in each.
-        // Scoped by the trailing slash in the prefix, so siblings aren't touched.
+        // A definition's GUID prefix may have files in either bucket.
         await Promise.all([
             this.deletePrefixInBucket(this.publicBucket, prefix),
             this.deletePrefixInBucket(this.privateBucket, prefix)
@@ -100,7 +89,7 @@ export class SupabaseStorageProvider {
         const keys = await this.listAllKeys(bucket, normalized);
         if (keys.length === 0)
             return;
-        // `remove` accepts up to 1000 paths; batch just in case.
+        // remove() caps out at 1000 paths per call.
         for (let i = 0; i < keys.length; i += 1000) {
             const slice = keys.slice(i, i + 1000);
             const { error } = await this.client.storage.from(bucket).remove(slice);
@@ -108,10 +97,7 @@ export class SupabaseStorageProvider {
                 throw error;
         }
     }
-    /**
-     * Recursively list every key under a prefix. `storage-js`'s `list` API
-     * only returns the immediate children of a "folder", so we DFS.
-     */
+    /** storage-js's `list` only returns immediate children of a "folder", so DFS to get everything under `prefix`. */
     async listAllKeys(bucket, prefix) {
         const out = [];
         const stack = [prefix];
@@ -125,7 +111,7 @@ export class SupabaseStorageProvider {
                 throw error;
             for (const entry of data ?? []) {
                 const full = dir ? `${dir}/${entry.name}` : entry.name;
-                // Folder entries have `id === null` in storage-js.
+                // storage-js marks folder entries with id === null.
                 if (entry.id === null) {
                     stack.push(full);
                 }
@@ -140,7 +126,6 @@ export class SupabaseStorageProvider {
         if (this.bucketFor(storagePath) === this.publicBucket) {
             return `${this.publicBaseUrl}/${storagePath}`;
         }
-        // Private files: the app's authenticated proxy route. See `privateUrlPrefix`.
         return `${this.privateUrlPrefix}/${storagePath}`;
     }
 }

package/dist/storage/SupabaseStorageProvider.js.map

@@ -1 +1 @@
-{"version":3,"file":"SupabaseStorageProvider.js","sourceRoot":"","sources":["../../src/storage/SupabaseStorageProvider.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAyCtF,MAAM,OAAO,uBAAuB;IAClB,MAAM,CAAiB;IACvB,YAAY,CAAS;IACrB,aAAa,CAAS;IACtB,aAAa,CAAS;IACtB,gBAAgB,CAAS;IAE1C,MAAM,CAAC,OAAO,CAAC,GAAuC;QACrD,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC;QACrC,MAAM,cAAc,GAAG,GAAG,CAAC,yBAAyB,CAAC;QACrD,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5E,IAAI,CAAC,cAAc;YAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QAC5F,OAAO,IAAI,uBAAuB,CAAC;YAClC,WAAW;YACX,cAAc;YACd,YAAY,EAAE,GAAG,CAAC,sBAAsB;YACxC,aAAa,EAAE,GAAG,CAAC,uBAAuB;YAC1C,gBAAgB,EAAE,GAAG,CAAC,2BAA2B;SACjD,CAAC,CAAC;IACJ,CAAC;IAED,YAAY,MAAqC;QAChD,IAAI,CAAC,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,cAAc,EAAE;YACrE,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE;SACxD,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,cAAc,CAAC;QAC1D,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,IAAI,eAAe,CAAC;QAC7D,gFAAgF;QAChF,IAAI,CAAC,aAAa,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,6BAA6B,IAAI,CAAC,YAAY,EAAE,CAAC;QAC9G,IAAI,CAAC,gBAAgB,GAAG,CAAC,MAAM,CAAC,gBAAgB,IAAI,YAAY,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtF,CAAC;IAED;;;;;;;;;OASG;IACK,SAAS,CAAC,WAAmB;QACpC,IAAI,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC;YAAE,OAAO,IAAI,CAAC,aAAa,CAAC;QAChE,MAAM,GAAG,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAC3C,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,aAAa,CAAC;QACxE,OAAO,IAAI,CAAC,YAAY,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,WAAmB;QAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACrF,IAAI,KAAK,EAAE,CAAC;YACX,uEAAuE;YACvE,0EAA0E;YAC1E,MAAM,GAAG,GAAI,KAA8B,CAAC,OAAO,IAAI,EAAE,CAAC;YAC1D,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpE,MAAM,KAAK,CAAC;QACb,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QACxC,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,WAAmB,EAAE,IAAgB,EAAE,WAAoB;QACpE,uEAAuE;QACvE,0EAA0E;QAC1E,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,IAAI,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;QAChF,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC/C,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO;aACzC,IAAI,CAAC,MAAM,CAAC;aACZ,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE;YACzC,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,qEAAqE;YACrE,uDAAuD;YACvD,YAAY,EAAE,UAAU;YACxB,MAAM,EAAE,IAAI;SACZ,CAAC,CAAC;QACJ,IAAI,KAAK;YAAE,MAAM,KAAK,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,WAAmB;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;QAC/E,8EAA8E;QAC9E,IAAI,KAAK;YAAE,MAAM,KAAK,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAc;QAChC,uEAAuE;QACvE,0EAA0E;QAC1E,MAAM,OAAO,CAAC,GAAG,CAAC;YACjB,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC;YACpD,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC;SACrD,CAAC,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAAC,MAAc,EAAE,MAAc;QAChE,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACxD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC9B,yDAAyD;QACzD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;YAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;YACtC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,IAAI,KAAK;gBAAE,MAAM,KAAK,CAAC;QACxB,CAAC;IACF,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,WAAW,CAAC,MAAc,EAAE,MAAc;QACvD,MAAM,GAAG,GAAa,EAAE,CAAC;QACzB,MAAM,KAAK,GAAa,CAAC,MAAM,CAAC,CAAC;QACjC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAG,CAAC;YACzB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE;gBACxE,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE;aACxC,CAAC,CAAC;YACH,IAAI,KAAK;gBAAE,MAAM,KAAK,CAAC;YACvB,KAAK,MAAM,KAAK,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;gBAChC,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;gBACvD,mDAAmD;gBACnD,IAAI,KAAK,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;oBACvB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAClB,CAAC;qBAAM,CAAC;oBACP,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAChB,CAAC;YACF,CAAC;QACF,CAAC;QACD,OAAO,GAAG,CAAC;IACZ,CAAC;IAED,YAAY,CAAC,WAAmB;QAC/B,IAAI,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;YACvD,OAAO,GAAG,IAAI,CAAC,aAAa,IAAI,WAAW,EAAE,CAAC;QAC/C,CAAC;QACD,8EAA8E;QAC9E,OAAO,GAAG,IAAI,CAAC,gBAAgB,IAAI,WAAW,EAAE,CAAC;IAClD,CAAC;CACD"}
+{"version":3,"file":"SupabaseStorageProvider.js","sourceRoot":"","sources":["../../src/storage/SupabaseStorageProvider.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AA2BtF,MAAM,OAAO,uBAAuB;IAClB,MAAM,CAAiB;IACvB,YAAY,CAAS;IACrB,aAAa,CAAS;IACtB,aAAa,CAAS;IACtB,gBAAgB,CAAS;IAE1C,MAAM,CAAC,OAAO,CAAC,GAAuC;QACrD,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC;QACrC,MAAM,cAAc,GAAG,GAAG,CAAC,yBAAyB,CAAC;QACrD,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5E,IAAI,CAAC,cAAc;YAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QAC5F,OAAO,IAAI,uBAAuB,CAAC;YAClC,WAAW;YACX,cAAc;YACd,YAAY,EAAE,GAAG,CAAC,sBAAsB;YACxC,aAAa,EAAE,GAAG,CAAC,uBAAuB;YAC1C,gBAAgB,EAAE,GAAG,CAAC,2BAA2B;SACjD,CAAC,CAAC;IACJ,CAAC;IAED,YAAY,MAAqC;QAChD,IAAI,CAAC,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,cAAc,EAAE;YACrE,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE;SACxD,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,cAAc,CAAC;QAC1D,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,IAAI,eAAe,CAAC;QAC7D,IAAI,CAAC,aAAa,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,6BAA6B,IAAI,CAAC,YAAY,EAAE,CAAC;QAC9G,IAAI,CAAC,gBAAgB,GAAG,CAAC,MAAM,CAAC,gBAAgB,IAAI,YAAY,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtF,CAAC;IAED;;;;;OAKG;IACK,SAAS,CAAC,WAAmB;QACpC,IAAI,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC;YAAE,OAAO,IAAI,CAAC,aAAa,CAAC;QAChE,MAAM,GAAG,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAC3C,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,aAAa,CAAC;QACxE,OAAO,IAAI,CAAC,YAAY,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,WAAmB;QAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACrF,IAAI,KAAK,EAAE,CAAC;YACX,4EAA4E;YAC5E,MAAM,GAAG,GAAI,KAA8B,CAAC,OAAO,IAAI,EAAE,CAAC;YAC1D,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpE,MAAM,KAAK,CAAC;QACb,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QACxC,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,WAAmB,EAAE,IAAgB,EAAE,WAAoB;QACpE,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,IAAI,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;QAChF,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC/C,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO;aACzC,IAAI,CAAC,MAAM,CAAC;aACZ,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE;YACzC,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,kEAAkE;YAClE,YAAY,EAAE,UAAU;YACxB,MAAM,EAAE,IAAI;SACZ,CAAC,CAAC;QACJ,IAAI,KAAK;YAAE,MAAM,KAAK,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,WAAmB;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;QAC/E,IAAI,KAAK;YAAE,MAAM,KAAK,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAc;QAChC,8DAA8D;QAC9D,MAAM,OAAO,CAAC,GAAG,CAAC;YACjB,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC;YACpD,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC;SACrD,CAAC,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAAC,MAAc,EAAE,MAAc;QAChE,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACxD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC9B,4CAA4C;QAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;YAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;YACtC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,IAAI,KAAK;gBAAE,MAAM,KAAK,CAAC;QACxB,CAAC;IACF,CAAC;IAED,kHAAkH;IAC1G,KAAK,CAAC,WAAW,CAAC,MAAc,EAAE,MAAc;QACvD,MAAM,GAAG,GAAa,EAAE,CAAC;QACzB,MAAM,KAAK,GAAa,CAAC,MAAM,CAAC,CAAC;QACjC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAG,CAAC;YACzB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE;gBACxE,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE;aACxC,CAAC,CAAC;YACH,IAAI,KAAK;gBAAE,MAAM,KAAK,CAAC;YACvB,KAAK,MAAM,KAAK,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;gBAChC,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;gBACvD,oDAAoD;gBACpD,IAAI,KAAK,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;oBACvB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAClB,CAAC;qBAAM,CAAC;oBACP,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAChB,CAAC;YACF,CAAC;QACF,CAAC;QACD,OAAO,GAAG,CAAC;IACZ,CAAC;IAED,YAAY,CAAC,WAAmB;QAC/B,IAAI,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;YACvD,OAAO,GAAG,IAAI,CAAC,aAAa,IAAI,WAAW,EAAE,CAAC;QAC/C,CAAC;QACD,OAAO,GAAG,IAAI,CAAC,gBAAgB,IAAI,WAAW,EAAE,CAAC;IAClD,CAAC;CACD"}