better-supabase 0.10.0 → 0.12.0

package/dist/{adapter-rmWaLNe3.js → adapter-CRNH2aX_.js}

@@ -1,19 +1,19 @@
-import { c as mapDbError, n as dbError, o as isDbError, r as dbErrorOf } from "./errors-8i6tSICm.js";
-import { t as temporal } from "./temporal-required-DqRzr7i0.js";
-import { a as ok, r as err, s as toDbError, t as AsyncResult } from "./result-COkvI9t5.js";
+import { c as mapDbError, n as dbError, o as isDbError, r as dbErrorOf } from "./errors-BV1SKTVs.js";
+import { t as temporal } from "./temporal-required-nfZ87U-0.js";
+import { a as ok, r as err, s as toDbError, t as AsyncResult } from "./result-DIeYscA3.js";
 import { n as isRecord } from "./guards-6F2bCtQR.js";
-import { a as postgrestExecutor, n as StatsRecorder } from "./stats-CUhqw6Ev.js";
-import { o as problemResponse } from "./problem-pIiL3WbE.js";
+import { a as postgrestExecutor, n as StatsRecorder } from "./stats-Di5VAsYU.js";
+import { o as problemResponse } from "./problem-JRCohp1j.js";
 import { loadEnv } from "./env/index.js";
-import { i as userContext, t as actClaim } from "./impersonation-CDeCzZP6.js";
+import { i as userContext, t as actClaim } from "./impersonation-DxU6yHJV.js";
 import { t as fromPgError } from "./pg-error-BV_X8Isq.js";
 import { i as forwardBlockEvents, t as DEFAULT_TYPE_PREFIX } from "./cloud-event-CTh9Sr5w.js";
 import { a as replicaState, i as primaryCookieWrite, o as routedExecutor, r as pinnedUntil, s as withPrimaryPin } from "./replicas-BvIL4_jL.js";
-import { t as authContext } from "./context-BDDgjoxz.js";
-import { a as narrowCap, i as delegatedClaims, r as contextClaims } from "./delegation-Dt8hMJWu.js";
-import { d as parseCookies, h as sessionCookieName, m as serializeCookie, n as prefetchJwks, r as resolveAuth, s as AUTH_CACHE_HEADERS, u as clearSessionAtScopes } from "./resolve-CAR9oaKW.js";
-import { t as credentialProviderOf } from "./provider-DKh2xFZb.js";
-import { a as respond, n as defaultPrefetchJwks, r as guard, t as defaultExpose } from "./respond-Dpx48ATq.js";
+import { t as authContext } from "./context-BiwgsycK.js";
+import { a as narrowCap, i as delegatedClaims, r as contextClaims } from "./delegation-B7uNnz6z.js";
+import { d as parseCookies, h as sessionCookieName, m as serializeCookie, n as prefetchJwks, r as resolveAuth, s as AUTH_CACHE_HEADERS, u as clearSessionAtScopes } from "./resolve-AtncaPTU.js";
+import { t as credentialProviderOf } from "./provider-C-Ti38J6.js";
+import { a as respond, n as defaultPrefetchJwks, r as guard, t as defaultExpose } from "./respond-Bhp3G__q.js";
 import { createClient } from "@supabase/supabase-js";
 import { defineMiddleware, getEnv, pipeline, seedContext } from "@supabase/middleware";
 import { PostgrestClient } from "@supabase/postgrest-js";
@@ -835,10 +835,19 @@ where bucket_id = $1 and name = $2 and user_metadata ->> 'supportSessionId' = $5
 const OWN_COPY = `update storage.objects
 set owner = $3::uuid, owner_id = $4, user_metadata = coalesce(user_metadata, '{}'::jsonb) || $5::jsonb
 where bucket_id = $1 and name = $2 and owner_id is null`;
+const OWN_SIGNED_UPLOAD = `${OWN_COPY}
+returning name`;
 const OWN_MOVE = `update storage.objects
 set owner = $3::uuid, owner_id = $4, user_metadata = coalesce(user_metadata, '{}'::jsonb) || $5::jsonb
 where bucket_id = $1 and name = $2 and owner_id is not distinct from $6`;
 const UUID = /^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}$/i;
+const OWNED = {
+	name: "StorageApiError",
+	message: "The object belongs to another user",
+	status: 403,
+	statusCode: "403",
+	code: "AccessDenied"
+};
 const HIDDEN_URL = "Either the object does not exist or you do not have access to it";
 const LIST_SORT_COLUMNS = /* @__PURE__ */ new Set([
 	"name",
@@ -1094,9 +1103,17 @@ function infoOf(row) {
 * decide as for the target's own request. Then the service client writes,
 * the admin connection makes the target the owner of the stored object,
 * and its `user_metadata` records the session id and the admin's id. A
-* refused dry run resolves to Storage's `403`. Signed uploads resolve to a
-* `403` `SUPPORT_STORAGE_WRITES` error, and every write in a read-only
-* session to a `403` `SUPPORT_READ_ONLY` error.
+* refused dry run resolves to Storage's `403`.
+*
+* `createSignedUploadUrl` runs the same dry run as `upload` before the
+* service client signs the URL. The object a browser uploads there has no
+* owner, so `claimSignedUpload(bucket, path)` finishes the upload: it checks again
+* that the target may insert at the path, then makes the target the owner
+* of an object without one and stamps the session on its `user_metadata`.
+* An object another user owns is refused with a `403`. `uploadToSignedUrl`
+* claims what it stores. Every write in a read-only session resolves to a
+* `403` `SUPPORT_READ_ONLY` error, and without `adminSql`, `session` or a
+* `sql` client with `transaction` to a `403` `SUPPORT_STORAGE_WRITES` error.
 */
 function supportStorage(options) {
 	const readOnly = options.readOnly ?? true;
@@ -1106,9 +1123,7 @@ function supportStorage(options) {
 		session
 	} : void 0;
 	const refusal = readOnly ? apiError(403, "The support session is read-only", "SUPPORT_READ_ONLY") : apiError(403, "Storage writes in a support session need adminSql, session and a sql client with transaction", "SUPPORT_STORAGE_WRITES");
-	const signedRefusal = readOnly ? refusal : apiError(403, "Signed uploads are not available in a support session", "SUPPORT_STORAGE_WRITES");
 	const refuse = () => Promise.resolve(failed(refusal));
-	const refuseSigned = () => Promise.resolve(failed(signedRefusal));
 	const rows = (query, values) => sql.queryRaw(query, values);
 	let versioned;
 	const upsertStatement = () => (versioned ??= rows(CURRENT_VERSION_INDEX, []).then(([row]) => row?.["versioned"] === true).catch((cause) => {
@@ -1132,277 +1147,373 @@ function supportStorage(options) {
 			throw cause;
 		}
 	};
-	return { from(bucket) {
-		const admin = () => options.admin.from(bucket);
-		const visible = async (path) => {
-			const [row] = await rows(VISIBLE_OBJECT, [bucket, path]);
-			return row?.["visible"] === true;
+	const rehearseStore = (bucket, active, name, statement, metadata) => rehearse(async (client) => {
+		await client.queryRaw(statement, [
+			bucket,
+			name,
+			ownerOf(active.targetUserId),
+			active.targetUserId,
+			JSON.stringify(metadata)
+		]);
+		return null;
+	});
+	const claimFor = async (bucket, { adminSql: ownerSql, session: active }, name) => {
+		const [claimed] = await ownerSql.queryRaw(OWN_SIGNED_UPLOAD, [
+			bucket,
+			name,
+			ownerOf(active.targetUserId),
+			active.targetUserId,
+			JSON.stringify(stampOf(active))
+		]);
+		if (claimed) return {
+			data: { path: name },
+			error: null
 		};
-		const checked = (path, read) => settled(async () => {
+		const [found] = await ownerSql.queryRaw(SOURCE_OBJECT, [bucket, name]);
+		if (!found) return failed(NOT_FOUND);
+		return found["owner_id"] === active.targetUserId ? {
+			data: { path: name },
+			error: null
+		} : failed(OWNED);
+	};
+	const claimSignedUpload = (bucket, path) => {
+		if (!writer) return refuse();
+		return settled(async () => {
 			const name = normalizePath(path);
-			if (!await visible(name)) return failed(NOT_FOUND);
-			return read(name);
-		});
-		const list = (path, listOptions = {}) => settled(async () => {
-			const problem = listProblem(listOptions);
-			if (problem) return failed(invalid(problem));
-			let prefix = path ?? "";
-			if (prefix.length > 0 && !prefix.endsWith("/")) prefix = `${prefix}/`;
-			const column = listOptions.sortBy?.column ?? "name";
-			const escape = column !== "name";
-			const safePrefix = escape ? escapeLike(prefix) : prefix;
-			const search = listOptions.search ?? "";
-			const safeSearch = escape ? escapeLike(search) : search;
-			return {
-				data: (await rows(SEARCH, [
-					safePrefix,
-					bucket,
-					listOptions.limit ?? 100,
-					(safePrefix + safeSearch).split("/").length,
-					listOptions.offset ?? 0,
-					safeSearch,
-					column,
-					listOptions.sortBy?.order ?? "asc"
-				])).map(listEntryOf),
-				error: null
-			};
-		});
-		const listV2 = (listOptions = {}) => settled(async () => {
-			const problem = listV2Problem(listOptions);
-			if (problem) return failed(invalid(problem));
-			const limit = Math.min(listOptions.limit ?? 1e3, 1e3);
-			const prefix = listOptions.prefix ?? "";
-			const cursor = listOptions.cursor ? decodeCursor(listOptions.cursor) : void 0;
-			if (listOptions.cursor && !cursor) return failed(apiError(400, "Invalid continuation token", "InvalidParameter"));
-			const sortOrder = filled(cursor?.sortOrder) ?? listOptions.sortBy?.order;
-			const sortColumn = filled(cursor?.sortColumn) ?? listOptions.sortBy?.column;
-			let found;
-			if (listOptions.with_delimiter) found = await rows(SEARCH_V2, [
-				prefix,
-				bucket,
-				limit + 1,
-				prefix ? prefix.split("/").length : 1,
-				cursor?.startAfter ?? "",
-				sortOrder ?? "asc",
-				sortColumn ?? "name",
-				filled(cursor?.sortColumnAfter) ?? null
-			]);
-			else {
-				const page = flatPage(bucket, listOptions.prefix, limit + 1, cursor, sortColumn, sortOrder);
-				found = await rows(page.text, page.values);
-			}
-			const entries = listOptions.with_delimiter ? delimited(found, prefix) : found;
-			const hasNext = entries.length > limit;
-			const count = hasNext ? limit : entries.length;
-			const folders = [];
-			const objects = [];
-			for (const entry of entries.slice(0, count)) if (entry["id"] === null || entry["id"] === void 0) folders.push(folderOf(entry));
-			else objects.push(objectOf(entry));
-			const last = entries[count - 1];
-			const after = last && sortColumn && sortColumn !== "name" ? iso(last[sortColumn]) : void 0;
-			const nextCursor = hasNext && last ? encodeCursor({
-				startAfter: String(last["name"]),
-				...sortOrder ? { sortOrder } : {},
-				...sortColumn ? { sortColumn } : {},
-				...typeof after === "string" ? { sortColumnAfter: new Date(after).toISOString() } : {}
-			}) : void 0;
-			return {
-				data: {
-					hasNext,
-					...nextCursor === void 0 ? {} : { nextCursor },
-					folders,
-					objects
-				},
-				error: null
-			};
-		});
-		const store = (method) => (path, body, fileOptions = {}) => {
-			if (!writer) return refuse();
-			const { adminSql: ownerSql, session: active } = writer;
-			return settled(async () => {
-				const name = normalizePath(path);
-				const owner = ownerOf(active.targetUserId);
-				const metadata = {
-					...fileOptions.metadata,
-					...stampOf(active)
-				};
-				const statement = method === "update" || fileOptions.upsert === true ? await upsertStatement() : INSERT_OBJECT;
-				const refused = await rehearse(async (client) => {
-					await client.queryRaw(statement, [
-						bucket,
-						name,
-						owner,
-						active.targetUserId,
-						JSON.stringify(metadata)
-					]);
-					return null;
-				});
-				if (refused) return failed(refused);
-				const reply = await admin()[method](name, body, {
-					...fileOptions,
-					metadata
-				});
-				if (reply.error) return reply;
+			const active = writer.session;
+			const refused = await rehearse(async (client) => {
 				try {
-					await ownerSql.queryRaw(OWN_UPLOAD, [
+					await client.queryRaw(INSERT_OBJECT, [
 						bucket,
 						name,
-						owner,
+						ownerOf(active.targetUserId),
 						active.targetUserId,
-						active.id
+						JSON.stringify(stampOf(active))
 					]);
 				} catch (cause) {
-					await admin().remove([name]);
-					return failed(sqlFailure(cause));
+					if (fromPgError(cause)?.code === "23505") return null;
+					throw cause;
 				}
-				return reply;
+				return NOT_FOUND;
 			});
-		};
-		const relocate = (method) => (from, to, destination = {}) => {
-			if (!writer) return refuse();
-			const { adminSql: ownerSql, session: active } = writer;
-			return settled(async () => {
-				const source = normalizePath(from);
-				const name = normalizePath(to);
-				const target = destination.destinationBucket ?? bucket;
-				const owner = ownerOf(active.targetUserId);
-				const stamp = JSON.stringify(stampOf(active));
-				let previousOwner = null;
-				const refused = await rehearse(async (client) => {
-					const [found] = await client.queryRaw(SOURCE_OBJECT, [bucket, source]);
-					if (!found) return NOT_FOUND;
-					previousOwner = text(found["owner_id"]) ?? null;
-					if (method === "copy") {
-						await client.queryRaw(INSERT_OBJECT, [
-							target,
-							name,
-							owner,
-							active.targetUserId,
-							stamp
-						]);
-						return null;
-					}
-					const [moved] = await client.queryRaw(MOVE_OBJECT, [
-						bucket,
-						source,
-						target,
-						name,
-						owner,
-						active.targetUserId
-					]);
-					return moved ? null : NOT_FOUND;
-				});
-				if (refused) return failed(refused);
-				const reply = await admin()[method](source, name, destination);
-				if (reply.error) return reply;
-				try {
-					await (method === "copy" ? ownerSql.queryRaw(OWN_COPY, [
-						target,
-						name,
-						owner,
-						active.targetUserId,
-						stamp
-					]) : ownerSql.queryRaw(OWN_MOVE, [
-						target,
-						name,
-						owner,
-						active.targetUserId,
-						stamp,
-						previousOwner
-					]));
-				} catch (cause) {
-					const written = options.admin.from(target);
-					await (method === "copy" ? written.remove([name]) : written.move(name, source, { destinationBucket: bucket }));
-					return failed(sqlFailure(cause));
-				}
-				return reply;
+			if (refused) return failed(refused);
+			return claimFor(bucket, writer, name);
+		});
+	};
+	return {
+		claimSignedUpload,
+		from(bucket) {
+			const admin = () => options.admin.from(bucket);
+			const visible = async (path) => {
+				const [row] = await rows(VISIBLE_OBJECT, [bucket, path]);
+				return row?.["visible"] === true;
+			};
+			const checked = (path, read) => settled(async () => {
+				const name = normalizePath(path);
+				if (!await visible(name)) return failed(NOT_FOUND);
+				return read(name);
 			});
-		};
-		const remove = (paths) => {
-			if (!writer) return refuse();
-			return settled(async () => {
-				const entries = paths.map((entry) => typeof entry === "string" ? normalizePath(entry) : {
-					...entry,
-					path: normalizePath(entry.path)
-				});
-				const names = entries.map((entry) => typeof entry === "string" ? entry : entry.path);
-				const removable = /* @__PURE__ */ new Set();
-				const refused = await rehearse(async (client) => {
-					await client.queryRaw(ALLOW_DELETE);
-					const deleted = await client.queryRaw(DELETE_OBJECTS, [bucket, [...new Set(names)]]);
-					for (const row of deleted) removable.add(String(row["name"]));
-					return null;
-				});
-				if (refused) return failed(refused);
-				const permitted = entries.filter((_, index) => removable.has(names[index] ?? ""));
-				if (permitted.length === 0) return {
-					data: [],
+			const list = (path, listOptions = {}) => settled(async () => {
+				const problem = listProblem(listOptions);
+				if (problem) return failed(invalid(problem));
+				let prefix = path ?? "";
+				if (prefix.length > 0 && !prefix.endsWith("/")) prefix = `${prefix}/`;
+				const column = listOptions.sortBy?.column ?? "name";
+				const escape = column !== "name";
+				const safePrefix = escape ? escapeLike(prefix) : prefix;
+				const search = listOptions.search ?? "";
+				const safeSearch = escape ? escapeLike(search) : search;
+				return {
+					data: (await rows(SEARCH, [
+						safePrefix,
+						bucket,
+						listOptions.limit ?? 100,
+						(safePrefix + safeSearch).split("/").length,
+						listOptions.offset ?? 0,
+						safeSearch,
+						column,
+						listOptions.sortBy?.order ?? "asc"
+					])).map(listEntryOf),
 					error: null
 				};
-				return admin().remove(permitted);
 			});
-		};
-		return {
-			exists: (path) => settled(async () => ({
-				data: await visible(normalizePath(path)),
-				error: null
-			})).then((reply) => reply.error === null ? reply : {
-				data: false,
-				error: reply.error
-			}),
-			info: (path, infoOptions) => settled(async () => {
-				const versionId = infoOptions?.versionId;
-				const name = normalizePath(path);
-				const [row] = await rows(versionId === void 0 ? OBJECT_INFO : `${OBJECT_INFO} and o.version = $3`, versionId === void 0 ? [bucket, name] : [
+			const listV2 = (listOptions = {}) => settled(async () => {
+				const problem = listV2Problem(listOptions);
+				if (problem) return failed(invalid(problem));
+				const limit = Math.min(listOptions.limit ?? 1e3, 1e3);
+				const prefix = listOptions.prefix ?? "";
+				const cursor = listOptions.cursor ? decodeCursor(listOptions.cursor) : void 0;
+				if (listOptions.cursor && !cursor) return failed(apiError(400, "Invalid continuation token", "InvalidParameter"));
+				const sortOrder = filled(cursor?.sortOrder) ?? listOptions.sortBy?.order;
+				const sortColumn = filled(cursor?.sortColumn) ?? listOptions.sortBy?.column;
+				let found;
+				if (listOptions.with_delimiter) found = await rows(SEARCH_V2, [
+					prefix,
 					bucket,
-					name,
-					versionId
+					limit + 1,
+					prefix ? prefix.split("/").length : 1,
+					cursor?.startAfter ?? "",
+					sortOrder ?? "asc",
+					sortColumn ?? "name",
+					filled(cursor?.sortColumnAfter) ?? null
 				]);
-				const object = row?.["object"];
-				return isRecord(object) ? {
-					data: infoOf(object),
-					error: null
-				} : failed(NOT_FOUND);
-			}),
-			download: (path, downloadOptions, parameters) => checked(path, (name) => admin().download(name, downloadOptions, parameters)),
-			createSignedUrl: (path, expiresIn, urlOptions) => checked(path, (name) => admin().createSignedUrl(name, expiresIn, urlOptions)),
-			createSignedUrls: (paths, expiresIn, urlOptions) => settled(async () => {
-				const names = paths.map(normalizePath);
-				const seen = new Set((await rows(VISIBLE_OBJECTS, [bucket, names])).map((row) => String(row["path"])));
-				const shown = [...new Set(names.filter((name) => seen.has(name)))];
-				const signed = /* @__PURE__ */ new Map();
-				if (shown.length > 0) {
-					const reply = await admin().createSignedUrls(shown, expiresIn, urlOptions);
-					if (reply.error) return failed(reply.error);
-					for (const entry of reply.data) if (entry.path !== null) signed.set(entry.path, entry);
+				else {
+					const page = flatPage(bucket, listOptions.prefix, limit + 1, cursor, sortColumn, sortOrder);
+					found = await rows(page.text, page.values);
 				}
+				const entries = listOptions.with_delimiter ? delimited(found, prefix) : found;
+				const hasNext = entries.length > limit;
+				const count = hasNext ? limit : entries.length;
+				const folders = [];
+				const objects = [];
+				for (const entry of entries.slice(0, count)) if (entry["id"] === null || entry["id"] === void 0) folders.push(folderOf(entry));
+				else objects.push(objectOf(entry));
+				const last = entries[count - 1];
+				const after = last && sortColumn && sortColumn !== "name" ? iso(last[sortColumn]) : void 0;
+				const nextCursor = hasNext && last ? encodeCursor({
+					startAfter: String(last["name"]),
+					...sortOrder ? { sortOrder } : {},
+					...sortColumn ? { sortColumn } : {},
+					...typeof after === "string" ? { sortColumnAfter: new Date(after).toISOString() } : {}
+				}) : void 0;
 				return {
-					data: names.map((name) => signed.get(name) ?? {
-						error: HIDDEN_URL,
-						path: name,
-						signedUrl: null
-					}),
+					data: {
+						hasNext,
+						...nextCursor === void 0 ? {} : { nextCursor },
+						folders,
+						objects
+					},
 					error: null
 				};
-			}),
-			getPublicUrl: (path, urlOptions) => admin().getPublicUrl(path, urlOptions),
-			list,
-			listV2,
-			upload: store("upload"),
-			update: store("update"),
-			createSignedUploadUrl: refuseSigned,
-			uploadToSignedUrl: refuseSigned,
-			remove,
-			copy: relocate("copy"),
-			move: relocate("move"),
-			purgeCache: (path, cacheOptions, parameters) => writer ? checked(path, (name) => admin().purgeCache(name, cacheOptions, parameters)) : refuse()
-		};
-	} };
+			});
+			const createSignedUploadUrl = (path, uploadOptions) => {
+				if (!writer) return refuse();
+				return settled(async () => {
+					const name = normalizePath(path);
+					const statement = uploadOptions?.upsert === true ? await upsertStatement() : INSERT_OBJECT;
+					const refused = await rehearseStore(bucket, writer.session, name, statement, stampOf(writer.session));
+					if (refused) return failed(refused);
+					return admin().createSignedUploadUrl(name, uploadOptions);
+				});
+			};
+			const uploadToSignedUrl = (path, token, body, fileOptions = {}) => {
+				if (!writer) return refuse();
+				return settled(async () => {
+					const name = normalizePath(path);
+					const metadata = {
+						...fileOptions.metadata,
+						...stampOf(writer.session)
+					};
+					const statement = fileOptions.upsert === true ? await upsertStatement() : INSERT_OBJECT;
+					const refused = await rehearseStore(bucket, writer.session, name, statement, metadata);
+					if (refused) return failed(refused);
+					const reply = await admin().uploadToSignedUrl(name, token, body, {
+						...fileOptions,
+						metadata
+					});
+					if (reply.error) return reply;
+					try {
+						const claimed = await claimFor(bucket, writer, name);
+						return claimed.error ? claimed : reply;
+					} catch (cause) {
+						await admin().remove([name]);
+						return failed(sqlFailure(cause));
+					}
+				});
+			};
+			const store = (method) => (path, body, fileOptions = {}) => {
+				if (!writer) return refuse();
+				const { adminSql: ownerSql, session: active } = writer;
+				return settled(async () => {
+					const name = normalizePath(path);
+					const owner = ownerOf(active.targetUserId);
+					const metadata = {
+						...fileOptions.metadata,
+						...stampOf(active)
+					};
+					const statement = method === "update" || fileOptions.upsert === true ? await upsertStatement() : INSERT_OBJECT;
+					const refused = await rehearseStore(bucket, active, name, statement, metadata);
+					if (refused) return failed(refused);
+					const reply = await admin()[method](name, body, {
+						...fileOptions,
+						metadata
+					});
+					if (reply.error) return reply;
+					try {
+						await ownerSql.queryRaw(OWN_UPLOAD, [
+							bucket,
+							name,
+							owner,
+							active.targetUserId,
+							active.id
+						]);
+					} catch (cause) {
+						await admin().remove([name]);
+						return failed(sqlFailure(cause));
+					}
+					return reply;
+				});
+			};
+			const relocate = (method) => (from, to, destination = {}) => {
+				if (!writer) return refuse();
+				const { adminSql: ownerSql, session: active } = writer;
+				return settled(async () => {
+					const source = normalizePath(from);
+					const name = normalizePath(to);
+					const target = destination.destinationBucket ?? bucket;
+					const owner = ownerOf(active.targetUserId);
+					const stamp = JSON.stringify(stampOf(active));
+					let previousOwner = null;
+					const refused = await rehearse(async (client) => {
+						const [found] = await client.queryRaw(SOURCE_OBJECT, [bucket, source]);
+						if (!found) return NOT_FOUND;
+						previousOwner = text(found["owner_id"]) ?? null;
+						if (method === "copy") {
+							await client.queryRaw(INSERT_OBJECT, [
+								target,
+								name,
+								owner,
+								active.targetUserId,
+								stamp
+							]);
+							return null;
+						}
+						const [moved] = await client.queryRaw(MOVE_OBJECT, [
+							bucket,
+							source,
+							target,
+							name,
+							owner,
+							active.targetUserId
+						]);
+						return moved ? null : NOT_FOUND;
+					});
+					if (refused) return failed(refused);
+					const reply = await admin()[method](source, name, destination);
+					if (reply.error) return reply;
+					try {
+						await (method === "copy" ? ownerSql.queryRaw(OWN_COPY, [
+							target,
+							name,
+							owner,
+							active.targetUserId,
+							stamp
+						]) : ownerSql.queryRaw(OWN_MOVE, [
+							target,
+							name,
+							owner,
+							active.targetUserId,
+							stamp,
+							previousOwner
+						]));
+					} catch (cause) {
+						const written = options.admin.from(target);
+						await (method === "copy" ? written.remove([name]) : written.move(name, source, { destinationBucket: bucket }));
+						return failed(sqlFailure(cause));
+					}
+					return reply;
+				});
+			};
+			const remove = (paths) => {
+				if (!writer) return refuse();
+				return settled(async () => {
+					const entries = paths.map((entry) => typeof entry === "string" ? normalizePath(entry) : {
+						...entry,
+						path: normalizePath(entry.path)
+					});
+					const names = entries.map((entry) => typeof entry === "string" ? entry : entry.path);
+					const removable = /* @__PURE__ */ new Set();
+					const refused = await rehearse(async (client) => {
+						await client.queryRaw(ALLOW_DELETE);
+						const deleted = await client.queryRaw(DELETE_OBJECTS, [bucket, [...new Set(names)]]);
+						for (const row of deleted) removable.add(String(row["name"]));
+						return null;
+					});
+					if (refused) return failed(refused);
+					const permitted = entries.filter((_, index) => removable.has(names[index] ?? ""));
+					if (permitted.length === 0) return {
+						data: [],
+						error: null
+					};
+					return admin().remove(permitted);
+				});
+			};
+			return {
+				exists: (path) => settled(async () => ({
+					data: await visible(normalizePath(path)),
+					error: null
+				})).then((reply) => reply.error === null ? reply : {
+					data: false,
+					error: reply.error
+				}),
+				info: (path, infoOptions) => settled(async () => {
+					const versionId = infoOptions?.versionId;
+					const name = normalizePath(path);
+					const [row] = await rows(versionId === void 0 ? OBJECT_INFO : `${OBJECT_INFO} and o.version = $3`, versionId === void 0 ? [bucket, name] : [
+						bucket,
+						name,
+						versionId
+					]);
+					const object = row?.["object"];
+					return isRecord(object) ? {
+						data: infoOf(object),
+						error: null
+					} : failed(NOT_FOUND);
+				}),
+				download: (path, downloadOptions, parameters) => checked(path, (name) => admin().download(name, downloadOptions, parameters)),
+				createSignedUrl: (path, expiresIn, urlOptions) => checked(path, (name) => admin().createSignedUrl(name, expiresIn, urlOptions)),
+				createSignedUrls: (paths, expiresIn, urlOptions) => settled(async () => {
+					const names = paths.map(normalizePath);
+					const seen = new Set((await rows(VISIBLE_OBJECTS, [bucket, names])).map((row) => String(row["path"])));
+					const shown = [...new Set(names.filter((name) => seen.has(name)))];
+					const signed = /* @__PURE__ */ new Map();
+					if (shown.length > 0) {
+						const reply = await admin().createSignedUrls(shown, expiresIn, urlOptions);
+						if (reply.error) return failed(reply.error);
+						for (const entry of reply.data) if (entry.path !== null) signed.set(entry.path, entry);
+					}
+					return {
+						data: names.map((name) => signed.get(name) ?? {
+							error: HIDDEN_URL,
+							path: name,
+							signedUrl: null
+						}),
+						error: null
+					};
+				}),
+				getPublicUrl: (path, urlOptions) => admin().getPublicUrl(path, urlOptions),
+				list,
+				listV2,
+				upload: store("upload"),
+				update: store("update"),
+				createSignedUploadUrl,
+				uploadToSignedUrl,
+				remove,
+				copy: relocate("copy"),
+				move: relocate("move"),
+				purgeCache: (path, cacheOptions, parameters) => writer ? checked(path, (name) => admin().purgeCache(name, cacheOptions, parameters)) : refuse()
+			};
+		}
+	};
 }
 //#endregion
 //#region src/server/server.ts
+/** The header `better_supabase.acting_member()` reads for a service caller. */
+const ACTOR_HEADER = "x-bs-actor";
 /** The environment as `getEnv` resolves it, one variable at a time. */
 const RUNTIME_ENV = new Proxy({}, { get: (_target, key) => typeof key === "string" ? getEnv(key) : void 0 });
+/**
+* `options.env` as given when it is loaded already, parsed when it is a
+* variable map (never merged with the runtime's), else the runtime's.
+*/
+function envOf(env) {
+	if (env === void 0) return loadEnv(RUNTIME_ENV);
+	return isLoadedEnv(env) ? env : loadEnv(env);
+}
+/** An `EnvSource` holds only strings, so a `URL` in `jwksUrl` means a loaded env. */
+function isLoadedEnv(env) {
+	return env.jwksUrl instanceof URL;
+}
 const needsPostgres = (method) => dbError("invalid_request", `${method} needs createServer(betterSupabase, { postgres: createPostgres() })`);
 /**
 * A framework adapter's server: `server` plus the adapter's own methods,
@@ -1424,7 +1535,7 @@ function extendServer(server, extra) {
 function createServer(betterSupabase, options = {}) {
 	const credentials = options.credentials === void 0 ? {} : { credentials: credentialProviderOf(options.credentials) };
 	let loaded;
-	const env = () => loaded ??= options.env ?? loadEnv(RUNTIME_ENV);
+	const env = () => loaded ??= envOf(options.env);
 	const lite = liteBackend(options, env);
 	if (lite === void 0 && (options.prefetchJwks ?? defaultPrefetchJwks()) && options.auth?.jwks === void 0) try {
 		prefetchJwks({
@@ -1448,10 +1559,17 @@ function createServer(betterSupabase, options = {}) {
 	const dbFor = (auth, context = {}) => {
 		let supabase;
 		const rest = restAt(env().url, auth);
+		const storage = { from: (bucket) => (supabase ??= supabaseFor(auth)).storage.from(bucket) };
 		const db = betterSupabase.connect(rest, {
 			...authContext(auth),
 			...context
-		}, auth.kind === "invalid" ? { executor: refusingExecutor(auth.error) } : tunedExecutor ? { executor: postgrestExecutor(rest, executorOptions) } : {});
+		}, auth.kind === "invalid" ? {
+			executor: refusingExecutor(auth.error),
+			storage
+		} : tunedExecutor ? {
+			executor: postgrestExecutor(rest, executorOptions),
+			storage
+		} : { storage });
 		return withLazyClient(db, () => supabase ??= supabaseFor(auth));
 	};
 	const sqlFor = (claims, context, stats, session, storage) => {
@@ -1651,6 +1769,7 @@ function createServer(betterSupabase, options = {}) {
 				const rest = (sharesClient ? void 0 : supabase) ?? restAt(env().url, auth, headers);
 				const connected = betterSupabase.connect(rest, context, {
 					stats: recorder,
+					storage: { from: (bucket) => client().storage.from(bucket) },
 					...auth.kind === "invalid" ? { executor: refusingExecutor(auth.error) } : url && replica ? { executor: routedExecutor(postgrestExecutor(rest, executorOptions), postgrestExecutor(restAt(url, auth, headers), executorOptions), replica) } : tunedExecutor ? { executor: postgrestExecutor(rest, executorOptions) } : {}
 				});
 				db = withLazyClient(connected, client);
@@ -1762,9 +1881,12 @@ function createServer(betterSupabase, options = {}) {
 			return resolving;
 		},
 		contextFromResolution: (resolution, request, contextOptions = {}) => fromResolution(resolution, request, contextOptions, contextOptions.tenant ?? syncTenant(request, resolution.auth)),
-		admin: (context = {}) => {
-			const client = serviceClient();
-			return betterSupabase.connect(client, {
+		admin: (context = {}, adminOptions = {}) => {
+			const client = adminOptions.as === void 0 ? serviceClient() : supabaseFor({
+				kind: "service",
+				keyName: "secret"
+			}, { [ACTOR_HEADER]: adminOptions.as });
+			const db = betterSupabase.connect(client, {
 				actor: {
 					id: "service",
 					kind: "service",
@@ -1773,6 +1895,7 @@ function createServer(betterSupabase, options = {}) {
 				claims: { role: "service_role" },
 				...context
 			}, tunedExecutor ? { executor: postgrestExecutor(client, executorOptions) } : {});
+			return Object.defineProperty(db, "$authAdmin", { get: () => client.auth.admin });
 		},
 		support,
 		deleteAccount: (userId, deleteOptions) => deleteAccount(betterSupabase, serviceClient, userId, {