better-supabase 0.0.0 → 0.1.0

package/dist/mfa-CpogP66z.js

@@ -0,0 +1,521 @@
+import { n as dbError } from "./errors-Bl3rkOzo.js";
+import { DEFAULT_COOKIE_OPTIONS, createChunks, isChunkLike, parseCookieHeader, serializeCookieHeader, stringFromBase64URL, stringToBase64URL } from "@supabase/ssr";
+import { extractCredentials, verifyCredentials } from "@supabase/server/core";
+//#region src/auth/impersonation.ts
+/** The `act` claim for an impersonated session. */
+function actClaim(options) {
+	return {
+		sub: options.actor,
+		reason: options.reason
+	};
+}
+/** The impersonator in `claims.act`, or `undefined` for a normal session. */
+function impersonatorOf(claims) {
+	const act = claims["act"];
+	if (typeof act !== "object" || act === null) return void 0;
+	const { sub, reason } = act;
+	if (typeof sub !== "string" || sub === "") return void 0;
+	return typeof reason === "string" ? {
+		id: sub,
+		reason
+	} : { id: sub };
+}
+//#endregion
+//#region src/auth/refresh.ts
+/**
+* How long a finished refresh is reused for requests still carrying the old
+* refresh token (parallel page loads, prefetches). Matches the default
+* refresh-token reuse interval of Supabase Auth.
+*/
+const REUSE_MS = 1e4;
+const inflight = /* @__PURE__ */ new Map();
+const recent = /* @__PURE__ */ new Map();
+function shared(outcome) {
+	return outcome.ok ? {
+		...outcome,
+		shared: true
+	} : outcome;
+}
+function prune(now) {
+	for (const [token, entry] of recent) if (entry.until <= now) recent.delete(token);
+}
+async function request(refreshToken, options, now) {
+	const doFetch = options.fetch ?? fetch;
+	let response;
+	try {
+		response = await doFetch(`${options.url}/auth/v1/token?grant_type=refresh_token`, {
+			method: "POST",
+			headers: {
+				apikey: options.forwardedFor?.secretKey ?? options.publishableKey,
+				"content-type": "application/json",
+				...options.forwardedFor ? { "sb-forwarded-for": options.forwardedFor.ip } : {}
+			},
+			body: JSON.stringify({ refresh_token: refreshToken })
+		});
+	} catch (cause) {
+		return {
+			ok: false,
+			reason: "network",
+			message: cause instanceof Error ? cause.message : "fetch failed"
+		};
+	}
+	const body = await response.json().catch(() => null);
+	if (!response.ok || !body || typeof body["access_token"] !== "string" || typeof body["refresh_token"] !== "string") {
+		const message = typeof body?.["msg"] === "string" ? body["msg"] : typeof body?.["error_description"] === "string" ? body["error_description"] : `Refresh failed with ${String(response.status)}`;
+		return {
+			ok: false,
+			reason: response.status >= 500 || response.status === 429 ? "network" : "rejected",
+			status: response.status,
+			message
+		};
+	}
+	const expiresIn = typeof body["expires_in"] === "number" ? body["expires_in"] : void 0;
+	return {
+		ok: true,
+		session: {
+			...body,
+			access_token: body["access_token"],
+			refresh_token: body["refresh_token"],
+			...typeof body["expires_at"] !== "number" && expiresIn !== void 0 ? { expires_at: Math.floor(now / 1e3) + expiresIn } : {}
+		}
+	};
+}
+/**
+* Exchanges a refresh token for a new session. Concurrent calls with the same
+* token share one request, and a successful result is reused for a short
+* window so parallel requests carrying the old cookie converge on one session.
+*/
+function refreshSession(refreshToken, options) {
+	const now = (options.now ?? Date.now)();
+	prune(now);
+	const cached = recent.get(refreshToken);
+	if (cached) return Promise.resolve(shared(cached.outcome));
+	const pending = inflight.get(refreshToken);
+	if (pending) return pending.then(shared);
+	const promise = request(refreshToken, options, now).then((outcome) => {
+		inflight.delete(refreshToken);
+		if (outcome.ok) recent.set(refreshToken, {
+			outcome,
+			until: now + REUSE_MS
+		});
+		return outcome;
+	});
+	inflight.set(refreshToken, promise);
+	return promise;
+}
+//#endregion
+//#region src/auth/session.ts
+const BASE64_PREFIX = "base64-";
+/** Headers that keep responses carrying session cookies out of shared caches. */
+const AUTH_CACHE_HEADERS = {
+	"Cache-Control": "private, no-cache, no-store, must-revalidate, max-age=0",
+	Expires: "0",
+	Pragma: "no-cache"
+};
+/** `sb-<first label of the hostname>-auth-token`, the supabase-js default. */
+function sessionCookieName(url) {
+	return `sb-${new URL(url).hostname.split(".")[0] ?? ""}-auth-token`;
+}
+function parseCookies(header) {
+	return header ? parseCookieHeader(header) : [];
+}
+function serializeCookie(write) {
+	return serializeCookieHeader(write.name, write.value, write.options);
+}
+function combine(cookies, name) {
+	const byName = new Map(cookies.map((cookie) => [cookie.name, cookie.value]));
+	const whole = byName.get(name);
+	if (whole) return whole;
+	const parts = [];
+	for (let index = 0;; index++) {
+		const part = byName.get(`${name}.${index}`);
+		if (!part) break;
+		parts.push(part);
+	}
+	return parts.length > 0 ? parts.join("") : void 0;
+}
+function isStoredSession(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const session = value;
+	return typeof session["access_token"] === "string" && typeof session["refresh_token"] === "string";
+}
+/**
+* Reads the session written by `@supabase/ssr` (plain or `base64-`, whole or
+* chunked). Mismatched chunks from a partial write read as no session.
+*/
+function readSession(cookies, name) {
+	const raw = combine(cookies, name);
+	if (!raw) return null;
+	try {
+		const json = raw.startsWith(BASE64_PREFIX) ? stringFromBase64URL(raw.slice(7)) : raw;
+		const parsed = JSON.parse(json);
+		return isStoredSession(parsed) ? parsed : null;
+	} catch {
+		return null;
+	}
+}
+/**
+* Cookie writes that store `session` (or clear it with `null`) exactly like
+* `@supabase/ssr`, and expire chunks the new value no longer uses.
+*/
+function writeSession(existing, name, session, options = {}) {
+	const base = {
+		...DEFAULT_COOKIE_OPTIONS,
+		...options
+	};
+	const chunks = session ? createChunks(name, BASE64_PREFIX + stringToBase64URL(JSON.stringify(session))) : [];
+	const kept = new Set(chunks.map((chunk) => chunk.name));
+	return [...existing.filter((cookie) => isChunkLike(cookie.name, name) && !kept.has(cookie.name)).map((cookie) => ({
+		name: cookie.name,
+		value: "",
+		options: {
+			...base,
+			maxAge: 0
+		}
+	})), ...chunks.map((chunk) => ({
+		name: chunk.name,
+		value: chunk.value,
+		options: base
+	}))];
+}
+/** Applies cookie writes to a cookie list, as the next request would see it. */
+function applyCookieWrites(cookies, writes) {
+	const next = new Map(cookies.map((cookie) => [cookie.name, cookie.value]));
+	for (const write of writes) if (write.options.maxAge === 0) next.delete(write.name);
+	else next.set(write.name, write.value);
+	return [...next].map(([name, value]) => ({
+		name,
+		value
+	}));
+}
+//#endregion
+//#region src/auth/resolve.ts
+function decodePayload(token) {
+	const part = token.split(".")[1];
+	if (!part) return void 0;
+	try {
+		const json = atob(part.replace(/-/g, "+").replace(/_/g, "/"));
+		const parsed = JSON.parse(json);
+		return typeof parsed === "object" && parsed !== null ? parsed : void 0;
+	} catch {
+		return;
+	}
+}
+function expiryOf(session) {
+	if (typeof session.expires_at === "number") return session.expires_at;
+	const exp = decodePayload(session.access_token)?.["exp"];
+	return typeof exp === "number" ? exp : void 0;
+}
+function serverEnv(options) {
+	const { env } = options;
+	return {
+		url: env.url,
+		publishableKeys: { default: env.publishableKey },
+		secretKeys: env.secretKeys ?? (env.secretKey ? { default: env.secretKey } : {}),
+		jwks: options.jwks ?? env.jwksUrl
+	};
+}
+const MEMO_SIZE = 256;
+const memoByUrl = /* @__PURE__ */ new Map();
+let memoByJwks = /* @__PURE__ */ new WeakMap();
+/**
+* Tokens that already verified, until they expire. Every private-cache scope
+* and island resolves the same token again; this skips the signature check.
+*/
+function memoFor(options) {
+	const jwks = options.jwks;
+	if (jwks && typeof jwks === "object" && !(jwks instanceof URL)) {
+		let memo = memoByJwks.get(jwks);
+		if (!memo) memoByJwks.set(jwks, memo = /* @__PURE__ */ new Map());
+		return memo;
+	}
+	const key = JSON.stringify([
+		String(jwks ?? options.env.jwksUrl),
+		options.env.url,
+		options.audience ?? null,
+		options.issuer ?? null
+	]);
+	let memo = memoByUrl.get(key);
+	if (!memo) memoByUrl.set(key, memo = /* @__PURE__ */ new Map());
+	return memo;
+}
+function remembered(memo, token, now) {
+	const hit = memo.get(token);
+	if (!hit) return void 0;
+	memo.delete(token);
+	if (hit.expiresAt === null || hit.expiresAt <= now) return void 0;
+	memo.set(token, hit);
+	return hit;
+}
+function remember(memo, token, user) {
+	if (user.expiresAt === null) return;
+	memo.set(token, user);
+	if (memo.size > MEMO_SIZE) memo.delete(memo.keys().next().value);
+}
+async function verify(credentials, modes, options, source) {
+	const token = modes.length === 1 && modes[0] === "user" && credentials.token;
+	const memo = token ? memoFor(options) : void 0;
+	if (token && memo) {
+		const hit = remembered(memo, token, Math.floor((options.now ?? Date.now)() / 1e3));
+		if (hit) return checkClaims({
+			...hit,
+			source
+		}, options);
+	}
+	const state = await verifyOnce(credentials, modes, options, source);
+	if (token && memo && state.kind === "user") remember(memo, token, {
+		kind: "user",
+		token: state.token,
+		claims: state.claims,
+		user: state.user,
+		expiresAt: state.expiresAt
+	});
+	return checkClaims(state, options);
+}
+/** Validates a user's claims against `options.claims`, keeping every JWT claim. */
+async function checkClaims(state, options) {
+	if (state.kind !== "user" || !options.claims) return state;
+	let outcome = options.claims["~standard"].validate(state.claims);
+	if (outcome instanceof Promise) outcome = await outcome;
+	if (outcome.issues) {
+		const issues = outcome.issues.map((issue) => {
+			const path = issue.path?.map((segment) => typeof segment === "object" ? String(segment.key) : String(segment)).join(".");
+			return path ? `${path}: ${issue.message}` : issue.message;
+		}).join("; ");
+		return {
+			kind: "invalid",
+			reason: "claims",
+			error: dbError("unauthorized", `The token claims are invalid (${issues})`, { code: "CLAIMS_INVALID" })
+		};
+	}
+	const extra = outcome.value;
+	return typeof extra === "object" && extra !== null ? {
+		...state,
+		claims: {
+			...state.claims,
+			...extra
+		}
+	} : state;
+}
+async function verifyOnce(credentials, modes, options, source) {
+	const { data, error } = await verifyCredentials(credentials, {
+		auth: modes,
+		env: serverEnv(options),
+		...options.audience !== void 0 ? { audience: options.audience } : {},
+		...options.issuer !== void 0 ? { issuer: options.issuer } : {}
+	});
+	if (error) {
+		const kind = error.code === "JWKS_FETCH_FAILED" ? "network" : error.status >= 500 ? "unexpected" : "unauthorized";
+		return {
+			kind: "invalid",
+			reason: "token",
+			error: dbError(kind, error.message, { code: error.code })
+		};
+	}
+	if (data.authMode === "secret") return {
+		kind: "service",
+		keyName: data.keyName ?? "default"
+	};
+	if (data.authMode === "user" && data.token && data.jwtClaims && data.userClaims) return {
+		kind: "user",
+		token: data.token,
+		claims: data.jwtClaims,
+		user: data.userClaims,
+		source,
+		expiresAt: typeof data.jwtClaims.exp === "number" ? data.jwtClaims.exp : null
+	};
+	return {
+		kind: "anon",
+		reason: "none"
+	};
+}
+function resolution(auth, cookies, writes = []) {
+	const headers = writes.length > 0 ? AUTH_CACHE_HEADERS : {};
+	return {
+		auth,
+		cookies: writes,
+		headers,
+		requestCookies: writes.length > 0 ? applyCookieWrites(cookies, writes) : cookies,
+		apply(response) {
+			if (writes.length === 0) return response;
+			let target = response;
+			try {
+				for (const write of writes) target.headers.append("set-cookie", serializeCookie(write));
+			} catch {
+				target = new Response(response.body, response);
+				for (const write of writes) target.headers.append("set-cookie", serializeCookie(write));
+			}
+			for (const [name, value] of Object.entries(headers)) target.headers.set(name, value);
+			return target;
+		}
+	};
+}
+const IP = /^[0-9a-f:.]+$/i;
+/** The first `x-forwarded-for` hop, the client as your edge saw it. */
+function clientIp(request) {
+	const first = request.headers.get("x-forwarded-for")?.split(",")[0]?.trim();
+	return first && IP.test(first) ? first : void 0;
+}
+/**
+* Resolves who is calling: custom resolvers, then `Authorization: Bearer`
+* (APIs, MCP, mobile), then the `@supabase/ssr` session cookie (browsers).
+*
+* A valid token costs no network call: it is verified locally against the
+* cached JWKS. An expiring cookie session is refreshed only when `refresh` is
+* set, through a single-flight request, and only then are cookies written.
+*/
+async function resolveAuth(request, options) {
+	const cookies = parseCookies(request.headers.get("cookie"));
+	for (const resolver of options.resolvers ?? []) {
+		const state = await resolver.resolve(request);
+		if (!state) continue;
+		return resolution(state.kind === "invalid" ? {
+			kind: "invalid",
+			reason: state.reason ?? "token",
+			error: state.error
+		} : await checkClaims(state, options), cookies);
+	}
+	const credentials = extractCredentials(request);
+	if (credentials.token) return resolution(await verify({
+		token: credentials.token,
+		apikey: null
+	}, ["user"], options, "bearer"), cookies);
+	if (options.secret && credentials.apikey?.startsWith("sb_secret_")) return resolution(await verify({
+		token: null,
+		apikey: credentials.apikey
+	}, options.secret === true ? ["secret"] : options.secret.map((name) => `secret:${name}`), options, "bearer"), cookies);
+	const name = options.cookie?.name ?? sessionCookieName(options.env.url);
+	const session = readSession(cookies, name);
+	if (!session) {
+		const stale = cookies.some((cookie) => cookie.name === name || cookie.name.startsWith(`${name}.`));
+		const writes = stale && options.refresh ? writeSession(cookies, name, null, options.cookie?.options) : [];
+		return resolution({
+			kind: "anon",
+			reason: stale ? "signed_out" : "none"
+		}, cookies, writes);
+	}
+	const now = Math.floor((options.now ?? Date.now)() / 1e3);
+	const expiry = expiryOf(session);
+	if (expiry !== void 0 && expiry - (options.leeway ?? 60) > now) {
+		const state = await verify({
+			token: session.access_token,
+			apikey: null
+		}, ["user"], options, "cookie");
+		if (state.kind !== "invalid" || state.reason === "claims" || state.error.kind === "network") return resolution(state, cookies);
+		if (!options.refresh) return resolution({
+			kind: "anon",
+			reason: "signed_out"
+		}, cookies);
+	} else if (!options.refresh) return resolution({
+		kind: "anon",
+		reason: "expired"
+	}, cookies);
+	const secretKey = options.env.secretKey;
+	const ip = secretKey && options.clientIp !== false ? (options.clientIp ?? clientIp)(request) : void 0;
+	const started = performance.now();
+	const outcome = await refreshSession(session.refresh_token, {
+		url: options.env.url,
+		publishableKey: options.env.publishableKey,
+		...secretKey && ip ? { forwardedFor: {
+			ip,
+			secretKey
+		} } : {},
+		...options.fetch ? { fetch: options.fetch } : {},
+		...options.now ? { now: options.now } : {}
+	});
+	options.onRefresh?.({
+		ok: outcome.ok,
+		shared: outcome.ok && outcome.shared === true,
+		durationMs: performance.now() - started
+	});
+	if (!outcome.ok) {
+		if (outcome.reason === "network") return resolution({
+			kind: "anon",
+			reason: "refresh_failed"
+		}, cookies);
+		return resolution({
+			kind: "anon",
+			reason: "signed_out"
+		}, cookies, writeSession(cookies, name, null, options.cookie?.options));
+	}
+	const writes = writeSession(cookies, name, outcome.session, options.cookie?.options);
+	return resolution(await verify({
+		token: outcome.session.access_token,
+		apikey: null
+	}, ["user"], options, "cookie"), cookies, writes);
+}
+/** The repository context (`actor`, `claims`) for an auth state. */
+function authContext(auth) {
+	switch (auth.kind) {
+		case "user": {
+			const impersonator = impersonatorOf(auth.claims);
+			return {
+				actor: {
+					id: auth.user.id,
+					kind: "user",
+					...auth.user.role !== void 0 ? { role: auth.user.role } : {},
+					...auth.user.email !== void 0 ? { email: auth.user.email } : {},
+					...impersonator ? { impersonator: impersonator.id } : {}
+				},
+				claims: auth.claims
+			};
+		}
+		case "service": return {
+			actor: {
+				id: `service:${auth.keyName}`,
+				kind: "service",
+				role: "service_role"
+			},
+			claims: { role: "service_role" }
+		};
+		case "anon":
+		case "invalid": return {
+			actor: {
+				id: "anon",
+				kind: "anon",
+				role: "anon"
+			},
+			claims: { role: "anon" }
+		};
+		default: return auth;
+	}
+}
+//#endregion
+//#region src/auth/mfa.ts
+/** The session's assurance level from its claims; anything but `aal2` reads as `aal1`. */
+function aalOf(claims) {
+	return claims["aal"] === "aal2" ? "aal2" : "aal1";
+}
+/** The `amr` claim as typed entries, skipping malformed ones. */
+function amrOf(claims) {
+	const amr = claims["amr"];
+	if (!Array.isArray(amr)) return [];
+	return amr.flatMap((entry) => {
+		if (typeof entry !== "object" || entry === null) return [];
+		const { method, timestamp, provider } = entry;
+		if (typeof method !== "string" || typeof timestamp !== "number") return [];
+		return [typeof provider === "string" ? {
+			method,
+			timestamp,
+			provider
+		} : {
+			method,
+			timestamp
+		}];
+	});
+}
+/**
+* `undefined` when a user session meets `required`; otherwise a `forbidden`
+* error with `required` and code `INSUFFICIENT_AAL`, for the client to start
+* an MFA challenge. Non-user sessions pass: `allow` decides about them.
+*/
+function checkAal(auth, required) {
+	if (required === "aal1" || auth.kind !== "user" || !("claims" in auth)) return void 0;
+	if (aalOf(auth.claims) === "aal2") return void 0;
+	return dbError("forbidden", "Verify a second factor to continue", {
+		code: "INSUFFICIENT_AAL",
+		required
+	});
+}
+//#endregion
+export { clientIp as a, applyCookieWrites as c, serializeCookie as d, sessionCookieName as f, impersonatorOf as g, actClaim as h, authContext as i, parseCookies as l, refreshSession as m, amrOf as n, resolveAuth as o, writeSession as p, checkAal as r, AUTH_CACHE_HEADERS as s, aalOf as t, readSession as u };

package/dist/mfa-TVia554c.d.ts

@@ -0,0 +1,44 @@
+import { p as DbError } from "./result-CTkCZ6JA.js";
+//#region src/auth/impersonation.d.ts
+/** The admin acting as the user, from the RFC 8693 `act` claim. */
+interface Impersonator {
+  readonly id: string;
+  readonly reason?: string;
+}
+/** `actingAs(userId, claims, { actor, reason })`: who acts, and why (recorded by the audit module). */
+interface ImpersonationOptions {
+  readonly actor: string;
+  readonly reason: string;
+}
+/** The impersonator in `claims.act`, or `undefined` for a normal session. */
+declare function impersonatorOf(claims: Readonly<Record<string, unknown>>): Impersonator | undefined;
+//#endregion
+//#region src/auth/mfa.d.ts
+/** Authenticator assurance level: `aal2` once a second factor is verified in this session. */
+type Aal = "aal1" | "aal2";
+/** One way the user proved who they are in this session (the JWT `amr` claim). */
+interface AmrEntry {
+  /** `password`, `otp`, `oauth`, `totp`, `sso/saml`, `anonymous`, ... */
+  readonly method: string;
+  /** Seconds since epoch. */
+  readonly timestamp: number;
+  /** SSO provider id, for `sso/saml`. */
+  readonly provider?: string;
+}
+/** The session's assurance level from its claims; anything but `aal2` reads as `aal1`. */
+declare function aalOf(claims: Readonly<Record<string, unknown>>): Aal;
+/** The `amr` claim as typed entries, skipping malformed ones. */
+declare function amrOf(claims: Readonly<Record<string, unknown>>): readonly AmrEntry[];
+/**
+ * `undefined` when a user session meets `required`; otherwise a `forbidden`
+ * error with `required` and code `INSUFFICIENT_AAL`, for the client to start
+ * an MFA challenge. Non-user sessions pass: `allow` decides about them.
+ */
+declare function checkAal(auth: {
+  readonly kind: "user";
+  readonly claims: object;
+} | {
+  readonly kind: string;
+}, required: Aal): DbError | undefined;
+//#endregion
+export { checkAal as a, impersonatorOf as c, amrOf as i, AmrEntry as n, ImpersonationOptions as o, aalOf as r, Impersonator as s, Aal as t };

package/dist/next/image/index.d.ts

@@ -0,0 +1,34 @@
+//#region src/next/image/index.d.ts
+/** What `next/image` passes to a custom loader. */
+export interface ImageLoaderProps {
+  readonly src: string;
+  readonly width: number;
+  readonly quality?: number;
+}
+export type ImageLoader = (props: ImageLoaderProps) => string;
+export interface ImageLoaderOptions {
+  /** Project URL, e.g. `process.env.NEXT_PUBLIC_SUPABASE_URL`. */
+  readonly url: string;
+  /** Resize mode for the transform. Defaults to Storage's own (`cover`). */
+  readonly resize?: "cover" | "contain" | "fill";
+  /**
+   * For images that are not public Storage objects (local files, other
+   * hosts). Defaults to returning `src` unchanged.
+   */
+  readonly fallback?: ImageLoader;
+}
+/**
+ * A `next/image` loader that serves public Storage objects through
+ * Supabase image transformations (`/render/image/public`), so Next.js does
+ * not proxy or re-encode them:
+ *
+ * ```ts
+ * // src/image-loader.ts, set as `images.loaderFile` in next.config.ts
+ * export default createImageLoader({ url: process.env.NEXT_PUBLIC_SUPABASE_URL! });
+ * ```
+ *
+ * Signed URLs pass through unchanged: their token covers the transform they
+ * were signed with, so sign them with `renderUrl()` at the size you render.
+ */
+export declare function createImageLoader(options: ImageLoaderOptions): ImageLoader;
+//#endregion

package/dist/next/image/index.js

@@ -0,0 +1,40 @@
+//#region src/next/image/index.ts
+/** Storage's image transformation limits. */
+const MAX_WIDTH = 2500;
+const QUALITY = {
+	min: 20,
+	max: 100
+};
+const clamp = (value, min, max) => Math.min(max, Math.max(min, Math.round(value)));
+/**
+* A `next/image` loader that serves public Storage objects through
+* Supabase image transformations (`/render/image/public`), so Next.js does
+* not proxy or re-encode them:
+*
+* ```ts
+* // src/image-loader.ts, set as `images.loaderFile` in next.config.ts
+* export default createImageLoader({ url: process.env.NEXT_PUBLIC_SUPABASE_URL! });
+* ```
+*
+* Signed URLs pass through unchanged: their token covers the transform they
+* were signed with, so sign them with `renderUrl()` at the size you render.
+*/
+function createImageLoader(options) {
+	const storage = `${options.url.replace(/\/+$/, "")}/storage/v1`;
+	const publicPrefixes = [`${storage}/object/public/`, `${storage}/render/image/public/`];
+	const fallback = options.fallback ?? (({ src }) => src);
+	return (props) => {
+		const prefix = publicPrefixes.find((candidate) => props.src.startsWith(candidate));
+		if (prefix === void 0) return fallback(props);
+		const source = new URL(props.src);
+		const object = source.pathname.slice(new URL(prefix).pathname.length);
+		const target = new URL(`${storage}/render/image/public/${object}`);
+		for (const [key, value] of source.searchParams) target.searchParams.set(key, value);
+		target.searchParams.set("width", String(clamp(props.width, 1, MAX_WIDTH)));
+		if (props.quality !== void 0) target.searchParams.set("quality", String(clamp(props.quality, QUALITY.min, QUALITY.max)));
+		if (options.resize) target.searchParams.set("resize", options.resize);
+		return target.toString();
+	};
+}
+//#endregion
+export { createImageLoader };