better-supabase 0.12.0 → 0.14.0

package/dist/index-NRMMhhEi.d.ts

@@ -0,0 +1,104 @@
+import { StandardSchemaV1 } from "@standard-schema/spec";
+import { SupabaseEnv } from "@supabase/server";
+//#region src/env/index.d.ts
+/**
+ * Validated Supabase settings. Only `publicEnv()` of it is safe to ship to a
+ * browser.
+ */
+interface BetterSupabaseEnv {
+  readonly url: string;
+  readonly publishableKey: string;
+  readonly secretKey?: string;
+  /**
+   * Named secret keys from `SUPABASE_SECRET_KEYS`, including `default` when
+   * `secretKey` is set.
+   */
+  readonly secretKeys?: Readonly<Record<string, string>>;
+  /** `SUPABASE_JWKS_URL`, or `<url>/auth/v1/.well-known/jwks.json`. */
+  readonly jwksUrl: URL;
+  /** `SUPABASE_JWKS`: inline keys, used instead of fetching `jwksUrl`. */
+  readonly jwks?: InlineJwks;
+  /**
+   * Postgres connection string: `SUPABASE_DB_URL`, `DATABASE_URL`, then the
+   * Vercel integration's `POSTGRES_URL` (pooled) and
+   * `POSTGRES_URL_NON_POOLING`.
+   */
+  readonly dbUrl?: string;
+  /** Project ref for hosted projects (`<ref>.supabase.co`). */
+  readonly projectRef?: string;
+  /**
+   * `SUPABASE_READ_URL`: a read replica or the `<ref>-all` load balancer, for
+   * reads.
+   */
+  readonly readUrl?: string;
+  /**
+   * `SUPABASE_JWT_SECRET`: the shared HS256 secret Supabase Lite signs user
+   * tokens with (`auth.jwt_secret`). Server-only; read with `backend: "lite"`.
+   */
+  readonly jwtSecret?: string;
+}
+/** A JSON Web Key Set, as `@supabase/server` verifies with it. */
+type InlineJwks = Exclude<SupabaseEnv["jwks"], URL | null>;
+interface PublicEnv {
+  readonly url: string;
+  readonly publishableKey: string;
+}
+type EnvSource = Readonly<Record<string, string | undefined>>;
+interface EnvIssue {
+  /** The variable names that were checked, first one preferred. */
+  readonly variables: readonly string[];
+  readonly message: string;
+}
+interface EnvOptions {
+  /** Settings that must be present. `url` and `publishableKey` always are. */
+  readonly require?: readonly ("secretKey" | "dbUrl")[];
+}
+type EnvResult = {
+  readonly ok: true;
+  readonly env: BetterSupabaseEnv;
+  readonly issues?: undefined;
+} | {
+  readonly ok: false;
+  readonly env?: undefined;
+  readonly issues: readonly EnvIssue[];
+};
+declare const ENV_VARIABLES: {
+  readonly url: readonly string[];
+  readonly publishableKey: readonly string[];
+  readonly secretKey: readonly string[];
+  readonly dbUrl: readonly string[];
+  readonly jwksUrl: readonly string[];
+  readonly jwks: readonly string[];
+  readonly readUrl: readonly string[];
+  readonly jwtSecret: readonly string[];
+};
+declare class EnvValidationError extends Error {
+  override readonly name = "EnvValidationError";
+  readonly issues: readonly EnvIssue[];
+  constructor(issues: readonly EnvIssue[]);
+}
+/**
+ * Reads and validates Supabase settings. Accepts the `SUPABASE_`,
+ * `NEXT_PUBLIC_`, `VITE_`, `PUBLIC_`, `EXPO_PUBLIC_` and `NUXT_PUBLIC_`
+ * spellings. Issues name variables, never values.
+ */
+declare function parseEnv(source: EnvSource, options?: EnvOptions): EnvResult;
+/**
+ * Like `parseEnv`, but throws `EnvValidationError`. Reads `process.env` by
+ * default.
+ */
+declare function loadEnv(source?: EnvSource, options?: EnvOptions): BetterSupabaseEnv;
+/**
+ * The env validator as a Standard Schema, for t3-env, framework config or any
+ * validator slot.
+ */
+declare function envSchema(options?: EnvOptions): StandardSchemaV1<EnvSource, BetterSupabaseEnv>;
+/** The parts that are safe in client bundles. */
+declare function publicEnv(env: BetterSupabaseEnv): PublicEnv;
+/**
+ * Converts to `@supabase/server`'s `SupabaseEnv` (the `env` option of
+ * `withSupabase`).
+ */
+declare function toServerEnv(env: BetterSupabaseEnv): SupabaseEnv;
+//#endregion
+export { EnvResult as a, InlineJwks as c, loadEnv as d, parseEnv as f, EnvOptions as i, PublicEnv as l, toServerEnv as m, ENV_VARIABLES as n, EnvSource as o, publicEnv as p, EnvIssue as r, EnvValidationError as s, BetterSupabaseEnv as t, envSchema as u };

package/dist/index-U0o7kU0s.d.ts

@@ -0,0 +1,69 @@
+import { a as Identified, c as InboxListActions, d as InboxWidgetActions, i as ConversationSnapshot, l as InboxListSnapshot, m as InboxWidgetSnapshot, t as ConversationActions, u as InboxSource } from "./client-7_4Y21ue.js";
+//#region src/blocks/inbox/react/index.d.ts
+interface UseInboxOptions<T> {
+  /** The organization; the hook joins `inbox:org:<id>`. `null` waits. */
+  readonly organizationId: string | null;
+  readonly load: InboxSource<T>;
+  /**
+   * `blockConfig.inbox.options.topic` from `blocks.generated.ts`. Defaults to
+   * `inbox`.
+   */
+  readonly topic?: string;
+  /** Runs for each broadcast, e.g. to show a toast for `message`. */
+  readonly onMessage?: (event: string, payload: unknown) => void;
+}
+interface InboxListState<T> extends InboxListSnapshot<T>, InboxListActions {}
+/**
+ * The staff view of an organization's conversations, kept current: loads, then
+ * loads again after each ping on `inbox:org:<id>` and on rejoin.
+ */
+declare function useInbox<T>(options: UseInboxOptions<T>): InboxListState<T>;
+interface UseConversationOptions<T extends Identified> {
+  /** `null` waits, e.g. before the widget opens a conversation. */
+  readonly conversationId: string | null;
+  /** The messages, oldest first: on mount and after a rejoin. */
+  readonly load: InboxSource<T>;
+  /** One message after a ping; `null` when the caller cannot read it. */
+  readonly get: (messageId: string) => Promise<T | null>;
+  /** The messaging topic prefix. Defaults to `messages`. */
+  readonly topic?: string;
+  /** Runs for the other pings, such as `conversation` and `read`. */
+  readonly onEvent?: (event: string, payload: unknown) => void;
+  /** How long a typing ping counts. Defaults to 5000 ms. */
+  readonly typingMs?: number;
+}
+interface ConversationState<T extends Identified> extends ConversationSnapshot<T>, ConversationActions {}
+/**
+ * One conversation's messages, kept current over `messages:<id>`: each ping
+ * fetches the one message it names. Typing pings go between staff and the
+ * contact.
+ */
+declare function useConversation<T extends Identified>(options: UseConversationOptions<T>): ConversationState<T>;
+interface UseInboxWidgetOptions<T extends Identified> {
+  /**
+   * Opens the visitor's conversation, e.g. a server action that calls
+   * `inbox.conversations.open(inboxId, { message })` with the visitor's
+   * transport. Returns its id.
+   */
+  readonly open: (message: string) => Promise<string>;
+  /** Sends into the open conversation. */
+  readonly send: (conversationId: string, message: string) => Promise<void>;
+  readonly load: (conversationId: string) => Promise<readonly T[]>;
+  /** One message after a ping; `null` when the visitor cannot read it. */
+  readonly get: (messageId: string) => Promise<T | null>;
+  /**
+   * Remembers the conversation across reloads in the client's storage port
+   * (`localStorage` on the web). Defaults to `better-supabase:inbox-widget`.
+   */
+  readonly storageKey?: string | null;
+  readonly topic?: string;
+}
+interface InboxWidgetState<T extends Identified> extends InboxWidgetSnapshot<T>, InboxWidgetActions {}
+/**
+ * The visitor side of an in-app inbox: the first message opens the
+ * conversation, later ones go into it, and the messages and typing pings stay
+ * current. Visitors without an account sign in anonymously first.
+ */
+declare function useInboxWidget<T extends Identified>(options: UseInboxWidgetOptions<T>): InboxWidgetState<T>;
+//#endregion
+export { UseInboxOptions as a, useInbox as c, UseConversationOptions as i, useInboxWidget as l, InboxListState as n, UseInboxWidgetOptions as o, InboxWidgetState as r, useConversation as s, ConversationState as t };

package/dist/index-WEafENqH.d.ts

@@ -0,0 +1,149 @@
+import { t as AsyncResult } from "./result-C6jDfedy.js";
+import { M as AnyFunctions, N as AnyModels } from "./executor-CPyrQdjh.js";
+import { l as PublicEnv } from "./index-NRMMhhEi.js";
+import { h as SessionEncoding } from "./resolve-CzUKTIMq.js";
+import { t as BetterSupabase } from "./define-Dw7pRO4h.js";
+import { i as KeyboardPort, l as StoragePort, n as DeepLinkPort, r as FilePickerPort, s as PushTokenPort, t as ClientPorts } from "./ports-DsJicwI2.js";
+import { i as BindClientOptions, r as BetterClient } from "./bind-Dz8y3T5T.js";
+import { n as FunctionContract } from "./function-contract-vPqwt1j4.js";
+import { FunctionInvokeOptions, SupabaseClient, SupabaseClientOptions } from "@supabase/supabase-js";
+//#region src/client/functions.d.ts
+/**
+ * `supabase.functions.invoke` options, without the body: `invoke` sends the
+ * input.
+ */
+type InvokeOptions = Omit<FunctionInvokeOptions, "body">;
+/** Edge Function contracts by function name. */
+type FunctionContracts = Readonly<Record<string, FunctionContract>>;
+/** Anything with supabase-js's `functions` client, e.g. a `SupabaseClient`. */
+interface FunctionsHost {
+  readonly functions: {
+    invoke(name: string, options?: FunctionInvokeOptions): Promise<{
+      data: unknown;
+      error: unknown;
+      response?: Response;
+    }>;
+  };
+}
+interface TypedFunctions<Contracts extends FunctionContracts> {
+  /**
+   * Calls the function with `input` as the JSON body. Problem Details from the
+   * function come back as their `DbError`; a network or relay failure is a
+   * `network` error.
+   */
+  invoke<N extends keyof Contracts & string>(name: N, ...[input, options]: undefined extends Contracts[N]["input"] ? [input?: Contracts[N]["input"], options?: InvokeOptions] : [input: Contracts[N]["input"], options?: InvokeOptions]): AsyncResult<Contracts[N]["output"]>;
+}
+/**
+ * Typed Edge Function calls over supabase-js's `functions` client. The
+ * contracts come from the functions' own code, imported as types:
+ *
+ * ```ts
+ * import type { SendInvite } from "../supabase/functions/send-invite/index.ts";
+ *
+ * const fns = functions<{ "send-invite": SendInvite }>(supabase);
+ * const invite = await fns.invoke("send-invite", { email }).orThrow();
+ * ```
+ */
+declare function functions<Contracts extends FunctionContracts>(host: FunctionsHost): TypedFunctions<Contracts>;
+//#endregion
+//#region src/client/web-ports.d.ts
+/** The part of a `ServiceWorkerRegistration` the push token port uses. */
+interface PushRegistrationLike {
+  readonly pushManager: {
+    getSubscription(): Promise<unknown>;
+    subscribe(options: {
+      readonly userVisibleOnly: boolean;
+      readonly applicationServerKey: Uint8Array<ArrayBuffer>;
+    }): Promise<unknown>;
+  };
+}
+/**
+ * The storage port over `localStorage` (or `sessionStorage`). Reads resolve
+ * with `null` and writes do nothing where storage is missing or blocked.
+ */
+declare function webStorage(kind?: "local" | "session"): StoragePort;
+/** The keyboard port over `keydown` on `window`; `mod` matches Cmd and Ctrl. */
+declare function webKeyboard(): KeyboardPort;
+/** The file picker port over a hidden `<input type="file">`. */
+declare function webFilePicker(): FilePickerPort;
+/** The deep link port over `location`, `popstate` and `hashchange`. */
+declare function webDeepLinks(): DeepLinkPort;
+interface WebPushTokenOptions {
+  /** The VAPID public key, base64url-encoded. */
+  readonly vapidPublicKey: string;
+  /**
+   * The service worker that receives the pushes. Default
+   * `navigator.serviceWorker.ready`.
+   */
+  readonly registration?: () => Promise<PushRegistrationLike>;
+}
+/**
+ * The push token port over the Push API: the token is the JSON of the browser's
+ * push subscription, which a Web Push sender needs.
+ */
+declare function webPushToken(options: WebPushTokenOptions): PushTokenPort;
+/**
+ * The web ports `createClient` uses: storage, the keyboard, the file picker and
+ * deep links.
+ */
+declare function webPorts(): ClientPorts;
+//#endregion
+//#region src/client/index.d.ts
+interface ClientOptions {
+  /** URL and publishable key. Not needed when `client` is given. */
+  readonly env?: PublicEnv;
+  /**
+   * Bring your own supabase-js client (custom storage). React Native apps use
+   * `better-supabase/client/native`, which doesn't load `@supabase/ssr`.
+   */
+  readonly client?: SupabaseClient;
+  /**
+   * `cookies` (default) shares the session with the server through
+   * `@supabase/ssr`; `local` keeps it in localStorage for SPAs without a
+   * server.
+   */
+  readonly storage?: "cookies" | "local";
+  readonly cookies?: {
+    /**
+     * `tokens-only` keeps the user object out of the cookie (it lives in
+     * `auth.userStorage`, localStorage by default), so cookies stay small. Use
+     * the same value as the server's `encode`. Defaults to `user-and-tokens`.
+     */
+    readonly encode?: SessionEncoding;
+  };
+  readonly auth?: {
+    /** Where auth-js keeps the user object with `cookies.encode: 'tokens-only'`. */
+    readonly userStorage?: UserStorage;
+  };
+  /**
+   * `staleTime` for every query option in `bs.queries`. Above zero, a remount
+   * or a window focus reuses cached rows instead of refetching.
+   */
+  readonly staleTime?: number;
+  /**
+   * Platform services for the block hooks, over the web defaults (`webPorts()`
+   * and an upload port over Supabase Storage).
+   */
+  readonly ports?: ClientPorts;
+  /**
+   * `blockConfig` from `blocks.generated.ts`: the block hooks call the schema,
+   * function names and topics `gen` wrote.
+   */
+  readonly blocks?: BindClientOptions["blocks"];
+  /** The tenant the block hooks act in; default the session's tenant claim. */
+  readonly tenant?: BindClientOptions["tenant"];
+}
+type UserStorage = NonNullable<NonNullable<SupabaseClientOptions<"public">["auth"]>["userStorage"]>;
+/**
+ * The browser side: a supabase-js client, repositories that follow the session,
+ * TanStack Query options and an auth store for UI state.
+ *
+ * ```ts
+ * export const bs = createClient(betterSupabase, {
+ *   env: { url, publishableKey },
+ * });
+ * ```
+ */
+declare function createClient$1<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown, P = unknown>(betterSupabase: BetterSupabase<M, D, F, E, C, P>, options?: ClientOptions): BetterClient<M, F, E, C, P>;
+//#endregion
+export { webDeepLinks as a, webPorts as c, FunctionContracts as d, FunctionsHost as f, functions as h, WebPushTokenOptions as i, webPushToken as l, TypedFunctions as m, createClient$1 as n, webFilePicker as o, InvokeOptions as p, PushRegistrationLike as r, webKeyboard as s, ClientOptions as t, webStorage as u };

package/dist/index-X2fkPUwb.d.ts

@@ -0,0 +1,51 @@
+//#region src/create/oauth/index.d.ts
+/**
+ * OAuth helpers for any provider: PKCE, sealed cookies and a session shape, on
+ * WebCrypto only. `better-supabase/create/supabase` builds the Supabase flow on
+ * them; another provider, such as a deploy target, can reuse them.
+ */
+/**
+ * The HKDF info `seal` and `unseal` use when none is given; cookies sealed with
+ * it keep opening.
+ */
+declare const DEFAULT_SEAL_INFO = "better-supabase create session";
+/** An access token, an optional refresh token and when the access token expires. */
+interface OAuthSession {
+  readonly accessToken: string;
+  readonly refreshToken?: string | undefined;
+  /** Epoch milliseconds. */
+  readonly expiresAt: number;
+}
+declare function isOAuthSession(value: unknown): value is OAuthSession;
+/** What a flow cookie holds between the redirect and the callback. */
+interface OAuthFlow {
+  readonly state: string;
+  readonly verifier: string;
+  readonly returnTo: string;
+}
+declare function isFlow(value: unknown): value is OAuthFlow;
+declare class OAuthError extends Error {
+  override readonly name = "OAuthError";
+}
+/** Whether the access token expires within a minute. */
+declare function needsRefresh(session: OAuthSession, now: number): boolean;
+/** `length` random bytes as base64url. */
+declare function randomToken(length?: number): string;
+/** A PKCE verifier and its S256 challenge (RFC 7636). */
+declare function pkcePair(): Promise<{
+  verifier: string;
+  challenge: string;
+}>;
+/**
+ * Encrypts `value` as JSON with AES-GCM: base64url of the IV, then the
+ * ciphertext. The key comes from `secret` through HKDF with `info`; give each
+ * cookie its own `info` so one can't be swapped for another.
+ */
+declare function seal(value: object, secret: string, info?: string): Promise<string>;
+/**
+ * The value `seal` wrote with the same `secret` and `info`, or `undefined` when
+ * it is missing, tampered with or another shape.
+ */
+declare function unseal<TValue>(sealed: string | undefined, secret: string, guard: (value: unknown) => value is TValue, info?: string): Promise<TValue | undefined>;
+//#endregion
+export { isFlow as a, pkcePair as c, unseal as d, OAuthSession as i, randomToken as l, OAuthError as n, isOAuthSession as o, OAuthFlow as r, needsRefresh as s, DEFAULT_SEAL_INFO as t, seal as u };

package/dist/index-Yep7auV-.d.ts

@@ -0,0 +1,287 @@
+import { b as DbError, f as Result, t as AsyncResult } from "./result-C6jDfedy.js";
+import { X as StoragePath, a as BucketConnectOptions, g as StorageAdminClient, i as BucketConfig, j as StorageClient, n as Bucket, r as BucketClient, s as BucketPolicy, x as TransformOptions } from "./bucket-TkB7_xv8.js";
+import { SupabaseClient } from "@supabase/supabase-js";
+//#region src/storage/errors.d.ts
+/** Maps a Storage error (`StorageApiError`, fetch failures) to a `DbError`. */
+declare function fromStorageError(raw: unknown, table?: string): DbError;
+//#endregion
+//#region src/storage/image-url.d.ts
+interface StorageImageOptions {
+  /** Project URL, e.g. `import.meta.env.PUBLIC_SUPABASE_URL`. */
+  readonly url: string;
+  /** Resize mode for the transform. Defaults to Storage's own (`cover`). */
+  readonly resize?: "cover" | "contain" | "fill";
+}
+/** The size and quality to render an image at. */
+interface StorageImageSize {
+  readonly width: number;
+  readonly height?: number | undefined;
+  readonly quality?: number | undefined;
+}
+/**
+ * Turns public Storage object URLs into Supabase image transformation URLs
+ * (`/render/image/public`) at a given size. Any other URL (local files, other
+ * hosts, signed URLs) comes back as `undefined`: a signed URL's token covers
+ * the transform it was signed with, so sign it with `renderUrl()`.
+ *
+ * A crop keeps its shape: when `size` has no `height` but `src` already carries
+ * a `width` and `height` (a render URL from a variant), the height scales with
+ * the new width. Both sides stop at Storage's 2500 limit by the same factor.
+ *
+ * ```ts
+ * const imageUrl = storageImageUrl({ url: SUPABASE_URL });
+ * imageUrl(avatar, { width: 96 }) ?? avatar;
+ * ```
+ */
+declare function storageImageUrl(options: StorageImageOptions): (src: string, size: StorageImageSize) => string | undefined;
+/**
+ * Builds a `srcset` of public Storage images at `densities` times the size
+ * (`1x` and `2x` by default) for a plain `<img>`. Returns `undefined` for the
+ * URLs `storageImageUrl` leaves alone.
+ *
+ * ```tsx
+ * const srcSet = storageImageSrcSet({ url: SUPABASE_URL });
+ * <img
+ *   src={avatar}
+ *   srcSet={srcSet(avatar, { width: 96, height: 96 })}
+ *   width={96}
+ *   height={96}
+ * />;
+ * ```
+ */
+declare function storageImageSrcSet(options: StorageImageOptions): (src: string, size: StorageImageSize, densities?: readonly number[]) => string | undefined;
+//#endregion
+//#region src/storage/registry.d.ts
+/** Any bucket definition from `defineBucket` or a preset. */
+type AnyBucket = Bucket<string>;
+type BucketMap = Readonly<Record<string, AnyBucket>>;
+/** The bucket ids of a registry's buckets. */
+type BucketIdOf<B extends BucketMap> = B[keyof B]["id"];
+/** The bucket of a registry whose id is `I`. */
+type BucketWithId<B extends BucketMap, I extends string> = Extract<B[keyof B], {
+  readonly id: I;
+}>;
+/** A stored object as rows keep it: the bucket id and the object path. */
+interface StoredRef {
+  /** The bucket id, e.g. a `bucket_id` column. */
+  readonly bucket: string;
+  readonly path: string;
+}
+/**
+ * A stored reference whose bucket is registered and whose path matches one of
+ * its templates.
+ */
+interface ResolvedRef<B extends BucketMap> {
+  readonly bucket: B[keyof B];
+  readonly path: StoragePath<BucketIdOf<B>>;
+}
+/** A resolved reference with a client of its bucket. */
+interface ConnectedRef<B extends BucketMap> extends ResolvedRef<B> {
+  readonly storage: BucketClient<string, BucketIdOf<B>>;
+}
+interface Buckets<B extends BucketMap> {
+  /** The bucket definitions, by the names given. */
+  readonly buckets: B;
+  /** Every registered bucket id, in the order given. */
+  readonly ids: readonly BucketIdOf<B>[];
+  /** Whether `id` names a registered bucket. */
+  has(id: string): id is BucketIdOf<B>;
+  /** The bucket with this id, or `invalid_input` for an id no bucket has. */
+  byId<I extends BucketIdOf<B>>(id: I): Result<BucketWithId<B, I>>;
+  byId(id: string): Result<B[keyof B]>;
+  /**
+   * Checks a stored `{ bucket, path }`: the bucket must be registered and the
+   * path must match one of its templates. Either failure is `invalid_input`.
+   */
+  resolve(ref: StoredRef): Result<ResolvedRef<B>>;
+  /**
+   * `resolve`, then `connect` the bucket and check the path with the connected
+   * client, so a bucket with `tenant` also refuses another tenant's path
+   * (`forbidden`). No request is made.
+   */
+  connectStored(client: StorageClient, ref: StoredRef, options?: BucketConnectOptions): Result<ConnectedRef<B>>;
+}
+/**
+ * A registry of bucket definitions by id, for rows that store a bucket id next
+ * to an object path (files, attachments, sources). An id no bucket has, and a
+ * path outside the bucket's templates, are errors, never a fallback bucket.
+ *
+ * ```ts
+ * export const buckets = defineBuckets({ files, attachments, logos });
+ *
+ * const ref = buckets.connectStored(
+ *   supabase,
+ *   { bucket: row.bucketId, path: row.path },
+ *   { context: db.$context },
+ * );
+ * if (ref.ok) await ref.data.storage.signedUrl(ref.data.path);
+ * ```
+ */
+declare function defineBuckets<const B extends BucketMap>(buckets: B): Buckets<B>;
+//#endregion
+//#region src/storage/presets.d.ts
+/** The image types browsers display everywhere. */
+declare const IMAGE_TYPES: readonly string[];
+interface ImageBucketOptions<P extends string, Id extends string, V extends string = never> {
+  readonly id?: Id;
+  /** The path template; keep the preset's placeholders the policy relies on. */
+  readonly path?: P | readonly [P, ...P[]];
+  /** Defaults to `true`: images load from their public URL without signing. */
+  readonly public?: boolean;
+  readonly fileSizeLimit?: string | number;
+  readonly allowedMimeTypes?: readonly string[];
+  /** Replaces the preset's policy. */
+  readonly policy?: BucketPolicy;
+  /** Replaces the preset's variants. */
+  readonly variants?: Readonly<Record<V, TransformOptions>>;
+}
+type AvatarBucketOptions<P extends string, Id extends string, V extends string = never> = ImageBucketOptions<P, Id, V>;
+interface OrganizationLogoBucketOptions<P extends string, Id extends string, V extends string = never> extends ImageBucketOptions<P, Id, V> {
+  /**
+   * The permission that may upload, replace and delete a logo, checked through
+   * the access contract. Defaults to `organization.update`, the `organizations`
+   * module's update permission.
+   */
+  readonly permission?: string;
+  /**
+   * The tenant segment connected clients are held to. `false` lets one client
+   * upload for any organization the policy allows. Defaults to `{ param:
+   * 'organizationId' }`.
+   */
+  readonly tenant?: BucketConfig["tenant"] | false;
+}
+declare const AVATAR_PATH = "{userId}/avatar-{version}.{ext}";
+declare const LOGO_PATH = "{organizationId}/logo-{version}.{ext}";
+/** The variant names of the image presets. */
+type ImageVariant = "sm" | "md" | "lg";
+/**
+ * A bucket for profile pictures: `{userId}/avatar-{version}.{ext}`, public, 2
+ * MiB of images, written only by their owner (the `owner` policy). Variants
+ * `sm`, `md` and `lg` are 48, 96 and 256 pixel square crops.
+ */
+declare function avatarBucket<const P extends string = typeof AVATAR_PATH, const Id extends string = "avatars", const V extends string = ImageVariant>(options?: AvatarBucketOptions<P, Id, V>): Bucket<P, Id, V>;
+/**
+ * A bucket for organization logos: `{organizationId}/logo-{version}.{ext}`,
+ * public, 2 MiB of images, written by members with the update permission
+ * through the access contract (`tenant_ids_with`), so it follows the app's
+ * roles. Variants `sm`, `md` and `lg` fit the whole logo in a 64, 128 or 256
+ * pixel square.
+ */
+declare function organizationLogoBucket<const P extends string = typeof LOGO_PATH, const Id extends string = "organization-logos", const V extends string = ImageVariant>(options?: OrganizationLogoBucketOptions<P, Id, V>): Bucket<P, Id, V>;
+//#endregion
+//#region src/storage/analytics-bucket.d.ts
+/**
+ * The Iceberg REST catalog of an analytics bucket, from
+ * `storage.analytics.from(id)`.
+ */
+type AnalyticsCatalog = ReturnType<SupabaseClient["storage"]["analytics"]["from"]>;
+interface AnalyticsBucketClient {
+  /** Creates the bucket when it is missing. Needs the secret key. */
+  apply(): AsyncResult<{
+    readonly created: boolean;
+  }>;
+  /**
+   * The bucket's Iceberg catalog: namespaces and tables, each call returning `{
+   * data, error }`.
+   */
+  catalog(): AnalyticsCatalog;
+}
+interface AnalyticsBucket<Id extends string> {
+  readonly id: Id;
+  connect(client: StorageAdminClient): AnalyticsBucketClient;
+}
+/**
+ * A Storage analytics bucket: Apache Iceberg tables that query engines read
+ * through the Iceberg REST catalog.
+ *
+ * ```ts
+ * export const events = defineAnalyticsBucket({ id: "events" });
+ * await events.connect(admin).apply().orThrow();
+ * ```
+ */
+declare function defineAnalyticsBucket<const Id extends string>(config: {
+  readonly id: Id;
+}): AnalyticsBucket<Id>;
+//#endregion
+//#region src/storage/vector-bucket.d.ts
+type VectorDistance = "cosine" | "euclidean" | "dotproduct";
+interface VectorIndexConfig {
+  /** Number of values in every vector, e.g. 1536 for `text-embedding-3-small`. */
+  readonly dimension: number;
+  /** Defaults to `cosine`. */
+  readonly distanceMetric?: VectorDistance;
+  /** Metadata keys stored with each vector but not usable in `filter`. */
+  readonly nonFilterableMetadataKeys?: readonly string[];
+}
+interface VectorBucketConfig<Id extends string, I extends Readonly<Record<string, VectorIndexConfig>>> {
+  readonly id: Id;
+  readonly indexes: I;
+}
+type VectorMetadata = Readonly<Record<string, unknown>>;
+interface VectorRecord<M extends VectorMetadata = VectorMetadata> {
+  readonly key: string;
+  readonly vector: readonly number[];
+  readonly metadata?: M;
+}
+interface VectorHit<M extends VectorMetadata = VectorMetadata> {
+  readonly key: string;
+  /** Set by `query()`: smaller is closer for every metric. */
+  readonly distance?: number;
+  readonly metadata?: M;
+  readonly vector?: readonly number[];
+}
+interface VectorQueryOptions {
+  /** Number of matches, defaults to 10. */
+  readonly topK?: number;
+  /**
+   * A metadata filter, e.g. `{ organizationId: "o1" }` or `{ year: { $gte: 2024
+   * } }`.
+   */
+  readonly filter?: VectorMetadata;
+  /** Return each match's metadata. Defaults to `true`. */
+  readonly metadata?: boolean;
+}
+interface VectorIndexClient<M extends VectorMetadata = VectorMetadata> {
+  readonly name: string;
+  readonly dimension: number;
+  /** Inserts or replaces vectors by key, in batches of 500. */
+  put(records: readonly VectorRecord<M>[]): AsyncResult<number>;
+  /** The nearest vectors, closest first. */
+  query(vector: readonly number[], options?: VectorQueryOptions): AsyncResult<readonly VectorHit<M>[]>;
+  /** Vectors by key; missing keys are left out. */
+  get(keys: readonly string[], options?: {
+    readonly vector?: boolean;
+  }): AsyncResult<readonly VectorHit<M>[]>;
+  remove(keys: readonly string[]): AsyncResult<readonly string[]>;
+}
+interface VectorBucketClient<I extends string> {
+  /**
+   * Creates the bucket and any missing index. An index with another dimension
+   * or metric is a `conflict`.
+   */
+  apply(): AsyncResult<{
+    readonly created: readonly string[];
+  }>;
+  index<M extends VectorMetadata = VectorMetadata>(name: I): VectorIndexClient<M>;
+}
+interface VectorBucket<Id extends string, I extends Readonly<Record<string, VectorIndexConfig>>> {
+  readonly id: Id;
+  readonly indexes: I;
+  connect(client: StorageAdminClient): VectorBucketClient<keyof I & string>;
+}
+/**
+ * A Storage vector bucket with typed indexes. Storage keeps the vectors outside
+ * Postgres; use the `vector-search` module for pgvector in a table.
+ *
+ * ```ts
+ * export const embeddings = defineVectorBucket({
+ *   id: "embeddings",
+ *   indexes: { documents: { dimension: 1536 } },
+ * });
+ * const docs = embeddings.connect(admin).index("documents");
+ * await docs.put([{ key: doc.id, vector, metadata: { organizationId } }]);
+ * ```
+ */
+declare function defineVectorBucket<const Id extends string, const I extends Readonly<Record<string, VectorIndexConfig>>>(config: VectorBucketConfig<Id, I>): VectorBucket<Id, I>;
+//#endregion
+export { StoredRef as A, AnyBucket as C, Buckets as D, BucketWithId as E, storageImageUrl as F, fromStorageError as I, StorageImageOptions as M, StorageImageSize as N, ConnectedRef as O, storageImageSrcSet as P, organizationLogoBucket as S, BucketMap as T, IMAGE_TYPES as _, VectorHit as a, OrganizationLogoBucketOptions as b, VectorMetadata as c, defineVectorBucket as d, AnalyticsBucket as f, AvatarBucketOptions as g, defineAnalyticsBucket as h, VectorDistance as i, defineBuckets as j, ResolvedRef as k, VectorQueryOptions as l, AnalyticsCatalog as m, VectorBucketClient as n, VectorIndexClient as o, AnalyticsBucketClient as p, VectorBucketConfig as r, VectorIndexConfig as s, VectorBucket as t, VectorRecord as u, ImageBucketOptions as v, BucketIdOf as w, avatarBucket as x, ImageVariant as y };