better-supabase 0.7.1 → 0.9.0

package/dist/index-BlqrGvb3.d.ts

@@ -0,0 +1,227 @@
+import { P as SchemaMeta } from "./types-YfwpIE-d.js";
+import { h as MutationIntent } from "./executor-DoE-5iM8.js";
+import { c as MutationNotice, o as EventHub, st as SubjectEventData } from "./events-CTreRrgP.js";
+import { i as EventSink, n as CloudEventOptions, t as CloudEvent } from "./cloud-event-5rCEzIgK.js";
+//#region src/core/block-events-records.d.ts
+/** Events from the parties module: a company, a person, or a link between them. */
+interface PartyEventData {
+  readonly organizationId: string;
+  readonly companyId?: string;
+  readonly personId?: string;
+  readonly name?: string;
+  /** For `*.merged`: the record merged into this one, now archived. */
+  readonly mergedId?: string;
+  /** For `company.person_*`: the person's role at the company. */
+  readonly role?: string | null;
+}
+/**
+ * Events from the engagements module. `subjectType` and `subjectId` name
+ * the engagement's main record; `subjects` lists every record it is on.
+ */
+interface EngagementEventData extends SubjectEventData {
+  readonly organizationId: string;
+  readonly engagementId: string;
+  /** `call`, `email`, `meeting`, `note`, `task` or a configured type. */
+  readonly type: string;
+  readonly subjects: readonly {
+    readonly type: string;
+    readonly id: string;
+  }[];
+}
+/** `collection.created` and `collection.archived`: a list of one subject type. */
+interface CollectionEventData {
+  readonly organizationId: string;
+  readonly collectionId: string;
+  /** The type of the records the collection holds. */
+  readonly subjectType: string;
+  readonly name: string;
+  /** For `collection.created`: `user`, `team` or `tenant`. */
+  readonly scope?: string;
+}
+/** `collection.entry_added` and `collection.entry_removed`: a record in a list. */
+interface CollectionEntryEventData extends SubjectEventData {
+  readonly organizationId: string;
+  readonly collectionId: string;
+}
+/** Events from the deals module. Amounts are minor units as text. */
+interface DealEventData extends SubjectEventData {
+  readonly organizationId: string;
+  readonly dealId: string;
+  readonly name: string;
+  readonly amount?: string;
+  readonly currency?: string;
+  /** For `deal.closed`: `won` or `lost`. */
+  readonly outcome?: string;
+  /** For `deal.closed` as lost: why. */
+  readonly reason?: string | null;
+  /** For `deal.updated`: the fields the batch changed. */
+  readonly fields?: readonly string[];
+}
+/** Events from the work-items module. */
+interface WorkItemEventData extends SubjectEventData {
+  readonly organizationId: string;
+  readonly workItemId: string;
+  readonly title: string;
+  /** For `work_item.updated`: the fields the batch changed. */
+  readonly fields?: readonly string[];
+  /** For `work_item.assigned`: everyone assigned now. */
+  readonly assigneeIds?: readonly string[];
+  /** For `work_item.closed`: `completed` or `canceled`, and why. */
+  readonly state?: string;
+  readonly closeReason?: string;
+}
+/** Events from the quotes module. Amounts are minor units as text. */
+interface QuoteEventData extends SubjectEventData {
+  readonly organizationId: string;
+  readonly quoteId: string;
+  readonly identifier: string;
+  readonly total?: string;
+  readonly currency?: string;
+  /** For `quote.accepted`: who accepted, by name. */
+  readonly byName?: string;
+  /** For `quote.rejected` and `quote.changes_requested`. */
+  readonly note?: string | null;
+  /** For `quote.revised`: the new revision. */
+  readonly revisionId?: string;
+}
+/** Events from the invoices module. Amounts are minor units as text. */
+interface InvoiceEventData extends SubjectEventData {
+  readonly organizationId: string;
+  readonly invoiceId: string;
+  /** Null while the invoice is a draft. */
+  readonly identifier: string | null;
+  readonly total?: string;
+  readonly currency?: string;
+  readonly dueOn?: string;
+  readonly paymentId?: string;
+  readonly amount?: string;
+  readonly balance?: string;
+  readonly creditNoteId?: string;
+  readonly reason?: string | null;
+}
+/** Events from the sla module: a clock on a record warned, breached or was met. */
+interface SlaEventData extends SubjectEventData {
+  readonly organizationId: string;
+  readonly clockId: string;
+  /** `first_response`, `next_response` or `resolution`. */
+  readonly metric: string;
+  readonly dueAt: string;
+  /** For `sla.completed`: whether it was met after its due time. */
+  readonly late?: boolean;
+}
+/** Events from the hiring module about a job. */
+interface JobEventData {
+  readonly organizationId: string;
+  readonly jobId: string;
+  readonly title: string;
+}
+/** Events from the hiring module about an application. */
+interface ApplicationEventData extends SubjectEventData {
+  readonly organizationId: string;
+  readonly applicationId: string;
+  readonly jobId: string;
+  /** The candidate's record in config.subjects, a person by default. */
+  readonly candidateType: string;
+  readonly candidateId: string;
+  /** For `application.rejected`. */
+  readonly reason?: string | null;
+  /** For `scorecard.submitted`. */
+  readonly reviewerId?: string;
+  readonly recommendation?: string;
+  /** For `interview.scheduled`. */
+  readonly interviewId?: string;
+  readonly startsAt?: string;
+}
+/** Events from the employees module. */
+interface EmployeeEventData extends SubjectEventData {
+  readonly organizationId: string;
+  readonly employeeId: string;
+  readonly name: string;
+  /** For `employee.created`. */
+  readonly userId?: string | null;
+  readonly managerId?: string | null;
+  readonly status?: string;
+  /** For `employee.updated`: the fields the batch changed, or `contract`. */
+  readonly fields?: readonly string[];
+  /** For `employee.offboarded`: the last day and why. */
+  readonly endDate?: string;
+  readonly reason?: string | null;
+  /** For `employee.manager_changed`. */
+  readonly fromManagerId?: string | null;
+  readonly toManagerId?: string | null;
+}
+/**
+ * Events from the pipelines module. `pipeline.stage_changed` carries the
+ * record that moved as `subjectType` and `subjectId`; the configuration
+ * events (`pipeline.created`, `pipeline_stage.saved`) carry none.
+ */
+interface PipelineEventData {
+  readonly organizationId: string;
+  readonly pipelineId: string;
+  readonly subjectType?: string;
+  readonly subjectId?: string;
+  readonly key?: string;
+  readonly stageId?: string;
+  readonly fromStageId?: string | null;
+  readonly toStageId?: string;
+  /** The stage category, such as `won` or `started`. */
+  readonly category?: string;
+  /** `open`, `success` or `failure`. */
+  readonly outcome?: string;
+}
+/** `pipeline.stage_changed`: the record that moved and its stages. */
+type PipelineStageEventData = PipelineEventData & SubjectEventData;
+//#endregion
+//#region src/events/index.d.ts
+declare const ROW_EVENT_TYPES: { readonly [K in MutationIntent]: string; };
+interface RowEventData {
+  readonly table: string;
+  readonly row: Readonly<Record<string, unknown>>;
+  readonly actorId?: string;
+}
+/**
+ * One CloudEvent per mutated row: `dev.better-supabase.row.created` with the
+ * app-cased row and the actor in `data`, the primary key as `subject` and the
+ * tenant as `partitionkey`. Writes that return no rows (soft
+ * deletes, `returning: false`) send one event per known primary key, with the
+ * key as `row`.
+ */
+declare function toCloudEvents(notice: MutationNotice, options: CloudEventOptions & {
+  readonly meta?: SchemaMeta;
+}): CloudEvent<RowEventData>[];
+interface ForwardOptions extends CloudEventOptions {
+  /** Only forward these tables or kinds. */
+  readonly filter?: (notice: MutationNotice) => boolean;
+  /** Sink failures never fail the mutation. Defaults to the `Logger`. */
+  readonly onError?: (error: unknown, events: readonly CloudEvent[]) => void;
+}
+/**
+ * Sends a CloudEvent for every mutation to `sink`. Returns a function that
+ * stops forwarding. Sends in flight are tracked on `betterSupabase.events`
+ * (`settled()`), which the Next adapter hands to `after()` and the edge
+ * entry to `waitUntil`. Use an outbox (SQL modules) when events must not be lost.
+ */
+declare function forwardMutations(betterSupabase: {
+  readonly events: EventHub;
+  readonly meta: SchemaMeta;
+}, sink: EventSink, options: ForwardOptions): () => void;
+type HttpMode = "structured" | "binary" | "batch";
+/** The HTTP protocol binding: headers and body for one event (or a batch). */
+declare function toHttp(events: CloudEvent | readonly CloudEvent[], mode?: HttpMode): {
+  headers: Record<string, string>;
+  body: string;
+}[];
+declare function isCloudEvent(value: unknown): value is CloudEvent;
+/** Reads CloudEvents from a request in any of the three HTTP modes. */
+declare function fromHttp(request: Request): Promise<CloudEvent[]>;
+interface HttpSinkOptions {
+  readonly mode?: HttpMode;
+  readonly headers?: Readonly<Record<string, string>>;
+  readonly fetch?: typeof fetch;
+  /** Abort a request that takes longer than this. Defaults to 10 seconds. */
+  readonly timeoutMs?: number;
+}
+/** POSTs events to `url`. Non-2xx responses and timeouts reject. */
+declare function httpSink(url: string | URL, options?: HttpSinkOptions): EventSink;
+//#endregion
+export { QuoteEventData as C, PipelineStageEventData as S, WorkItemEventData as T, EngagementEventData as _, RowEventData as a, PartyEventData as b, httpSink as c, toHttp as d, ApplicationEventData as f, EmployeeEventData as g, DealEventData as h, ROW_EVENT_TYPES as i, isCloudEvent as l, CollectionEventData as m, HttpMode as n, forwardMutations as o, CollectionEntryEventData as p, HttpSinkOptions as r, fromHttp as s, ForwardOptions as t, toCloudEvents as u, InvoiceEventData as v, SlaEventData as w, PipelineEventData as x, JobEventData as y };

package/dist/index-Brhm22eL.d.ts

@@ -0,0 +1,138 @@
+import { n as RouteGuardOptions } from "./refusal-oD3ISM9h.js";
+import { t as Validated } from "./shared-DDSjEGDR.js";
+import { AnyEntry, Contributions } from "@supabase/middleware";
+import { IncomingMessage, ServerResponse } from "node:http";
+//#region src/node/http.d.ts
+interface WebRequestOptions {
+  /**
+   * Read the protocol and host from `x-forwarded-proto` and
+   * `x-forwarded-host`. Turn it on behind a proxy you control. Defaults to false.
+   */
+  readonly trustProxy?: boolean;
+  /** Stream the request body into the `Request`. Defaults to true. */
+  readonly body?: boolean;
+}
+/**
+ * A Node `IncomingMessage` as a Web `Request`. Express, Fastify and Koa
+ * pass theirs (`req`, `request.raw`, `ctx.req`). With `body: false` the
+ * stream stays unread, for middleware that runs before a body parser.
+ */
+declare function toWebRequest(req: IncomingMessage, options?: WebRequestOptions): Request;
+/** Writes a Web `Response` to a Node `ServerResponse`, streaming the body. */
+declare function sendWebResponse(res: ServerResponse, response: Response): Promise<void>;
+//#endregion
+//#region src/node/index.d.ts
+interface ToNodeOptions<Req = IncomingMessage> extends Omit<WebRequestOptions, "body"> {
+  /** The host's env object for `getEnv`; defaults to `process.env` through `getEnv`. */
+  readonly env?: (req: Req) => unknown;
+}
+/**
+ * A `node:http` request listener running the entries around `handler`.
+ * Response-phase entries see the handler's response, so refreshed cookies
+ * and `withDbStats` totals reach the client.
+ *
+ * ```ts
+ * createServer(toNodeHandler([withBetterSupabase(server)], (request, { db }) => db.notes.findMany()))
+ * ```
+ */
+declare function toNodeHandler<const Entries extends readonly AnyEntry[]>(entries: Entries & Validated<Entries>, handler: (request: Request, contributions: Contributions<Entries>) => unknown, options?: ToNodeOptions): (req: IncomingMessage, res: ServerResponse) => Promise<void>;
+/** The part of an Express response the middleware writes. */
+interface ExpressResponse extends ServerResponse {
+  /** Express's per-request locals; the contributions land here. */
+  locals: Record<string, unknown>;
+}
+/** Express (or Connect) middleware, typed structurally. */
+type ExpressMiddleware = (req: IncomingMessage, res: ExpressResponse, next: (error?: unknown) => void) => void;
+/** An Express error handler, typed structurally. */
+type ExpressErrorHandler = (error: unknown, req: IncomingMessage, res: ExpressResponse, next: (error?: unknown) => void) => void;
+/**
+ * Express middleware that puts every contribution on `res.locals`
+ * (`res.locals.db`, `res.locals.bs`). Mount it before the routes.
+ *
+ * ```ts
+ * app.use(toExpress([withBetterSupabase(server)]))
+ * app.get('/notes', async (req, res) => res.json(await res.locals.db.notes.findMany().orThrow()))
+ * ```
+ */
+declare function toExpress<const Entries extends readonly AnyEntry[]>(entries: Entries & Validated<Entries>, options?: ToNodeOptions): ExpressMiddleware;
+/**
+ * Express route middleware that refuses callers outside `options`:
+ * Problem Details, or a redirect to `signIn` or `mfa`. Runs after `toExpress`.
+ *
+ * ```ts
+ * app.get('/admin', guard({ roles: ['admin'] }), handler)
+ * ```
+ */
+declare function guard(options?: RouteGuardOptions): ExpressMiddleware;
+/**
+ * An Express error handler that answers thrown `DbException`s (from
+ * `.orThrow()`) with Problem Details and passes every other error on.
+ * Register it after the routes.
+ */
+declare function problemErrorHandler(options?: {
+  readonly expose?: boolean;
+}): ExpressErrorHandler;
+/** The part of a Fastify request the hook reads and writes. */
+interface FastifyRequestLike {
+  readonly raw: IncomingMessage;
+  /** The contributions land here: `request.locals.db`. */
+  locals?: Record<string, unknown>;
+}
+/** The part of a Fastify reply the hook writes. */
+interface FastifyReplyLike {
+  readonly raw: ServerResponse;
+  readonly sent: boolean;
+  code(status: number): FastifyReplyLike;
+  header(name: string, value: string | readonly string[]): FastifyReplyLike;
+  getHeader(name: string): number | string | string[] | undefined;
+  send(payload?: unknown): FastifyReplyLike;
+}
+/** A Fastify `onRequest` or `preHandler` hook, typed structurally. */
+type FastifyHook = (request: FastifyRequestLike, reply: FastifyReplyLike) => Promise<void>;
+/**
+ * A Fastify `onRequest` hook that puts every contribution on
+ * `request.locals`. Declare `locals` with `app.decorateRequest('locals', null)`.
+ *
+ * ```ts
+ * app.decorateRequest('locals', null)
+ * app.addHook('onRequest', toFastify([withBetterSupabase(server)]))
+ * app.get('/notes', (request) => request.locals.db.notes.findMany().orThrow())
+ * ```
+ */
+declare function toFastify<const Entries extends readonly AnyEntry[]>(entries: Entries & Validated<Entries>, options?: ToNodeOptions<FastifyRequestLike>): FastifyHook;
+/**
+ * A Fastify `preHandler` hook that refuses callers outside `options`. Runs
+ * after `toFastify`.
+ */
+declare function fastifyGuard(options?: RouteGuardOptions): FastifyHook;
+/** The part of a Koa context the middleware reads and writes. */
+interface KoaContextLike {
+  readonly req: IncomingMessage;
+  readonly res: ServerResponse;
+  /** Koa's per-request state; the contributions land here. */
+  state: Record<string, unknown>;
+  status: number;
+  body: unknown;
+  set(name: string, value: string | readonly string[]): void;
+  get response(): {
+    get(name: string): string | string[] | undefined;
+  };
+}
+/** Koa middleware, typed structurally. */
+type KoaMiddleware = (ctx: KoaContextLike, next: () => Promise<unknown>) => Promise<void>;
+/**
+ * Koa middleware that puts every contribution on `ctx.state`, then awaits
+ * the rest of the chain. Thrown `DbException`s become Problem Details.
+ *
+ * ```ts
+ * app.use(toKoa([withBetterSupabase(server)]))
+ * app.use(async (ctx) => { ctx.body = await ctx.state.db.notes.findMany().orThrow() })
+ * ```
+ */
+declare function toKoa<const Entries extends readonly AnyEntry[]>(entries: Entries & Validated<Entries>, options?: ToNodeOptions<KoaContextLike> & {
+  readonly expose?: boolean;
+}): KoaMiddleware;
+/** Koa middleware that refuses callers outside `options`. Runs after `toKoa`. */
+declare function koaGuard(options?: RouteGuardOptions): KoaMiddleware;
+//#endregion
+export { toNodeHandler as _, FastifyReplyLike as a, toWebRequest as b, KoaMiddleware as c, guard as d, koaGuard as f, toKoa as g, toFastify as h, FastifyHook as i, ToNodeOptions as l, toExpress as m, ExpressMiddleware as n, FastifyRequestLike as o, problemErrorHandler as p, ExpressResponse as r, KoaContextLike as s, ExpressErrorHandler as t, fastifyGuard as u, WebRequestOptions as v, sendWebResponse as y };

package/dist/index-Bvw9r94Q.d.ts

@@ -0,0 +1,245 @@
+import { b as DbError, f as Result, t as AsyncResult } from "./result-Cj3yWhjH.js";
+import { C as BucketClient, D as BucketPolicy, F as StorageAdminClient, Q as StoragePath, S as Bucket, T as BucketConnectOptions, r as StorageClient, w as BucketConfig } from "./storage-api-Cx-1iWBd.js";
+import { SupabaseClient } from "@supabase/supabase-js";
+//#region src/storage/errors.d.ts
+/** Maps a Storage error (`StorageApiError`, fetch failures) to a `DbError`. */
+declare function fromStorageError(raw: unknown, table?: string): DbError;
+//#endregion
+//#region src/storage/image-url.d.ts
+interface StorageImageOptions {
+  /** Project URL, e.g. `import.meta.env.PUBLIC_SUPABASE_URL`. */
+  readonly url: string;
+  /** Resize mode for the transform. Defaults to Storage's own (`cover`). */
+  readonly resize?: "cover" | "contain" | "fill";
+}
+/** The size and quality to render an image at. */
+interface StorageImageSize {
+  readonly width: number;
+  readonly height?: number | undefined;
+  readonly quality?: number | undefined;
+}
+/**
+ * Turns public Storage object URLs into Supabase image transformation URLs
+ * (`/render/image/public`) at a given size. Any other URL (local files,
+ * other hosts, signed URLs) comes back as `undefined`: a signed URL's token
+ * covers the transform it was signed with, so sign it with `renderUrl()`.
+ *
+ * ```ts
+ * const imageUrl = storageImageUrl({ url: SUPABASE_URL })
+ * imageUrl(avatar, { width: 96 }) ?? avatar
+ * ```
+ */
+declare function storageImageUrl(options: StorageImageOptions): (src: string, size: StorageImageSize) => string | undefined;
+//#endregion
+//#region src/storage/registry.d.ts
+/** Any bucket definition from `defineBucket` or a preset. */
+type AnyBucket = Bucket<string>;
+type BucketMap = Readonly<Record<string, AnyBucket>>;
+/** The bucket ids of a registry's buckets. */
+type BucketIdOf<B extends BucketMap> = B[keyof B]["id"];
+/** The bucket of a registry whose id is `I`. */
+type BucketWithId<B extends BucketMap, I extends string> = Extract<B[keyof B], {
+  readonly id: I;
+}>;
+/** A stored object as rows keep it: the bucket id and the object path. */
+interface StoredRef {
+  /** The bucket id, e.g. a `bucket_id` column. */
+  readonly bucket: string;
+  readonly path: string;
+}
+/** A stored reference whose bucket is registered and whose path matches one of its templates. */
+interface ResolvedRef<B extends BucketMap> {
+  readonly bucket: B[keyof B];
+  readonly path: StoragePath<BucketIdOf<B>>;
+}
+/** A resolved reference with a client of its bucket. */
+interface ConnectedRef<B extends BucketMap> extends ResolvedRef<B> {
+  readonly storage: BucketClient<string, BucketIdOf<B>>;
+}
+interface Buckets<B extends BucketMap> {
+  /** The bucket definitions, by the names given. */
+  readonly buckets: B;
+  /** Every registered bucket id, in the order given. */
+  readonly ids: readonly BucketIdOf<B>[];
+  /** Whether `id` names a registered bucket. */
+  has(id: string): id is BucketIdOf<B>;
+  /** The bucket with this id, or `invalid_input` for an id no bucket has. */
+  byId<I extends BucketIdOf<B>>(id: I): Result<BucketWithId<B, I>>;
+  byId(id: string): Result<B[keyof B]>;
+  /**
+   * Checks a stored `{ bucket, path }`: the bucket must be registered and the
+   * path must match one of its templates. Either failure is `invalid_input`.
+   */
+  resolve(ref: StoredRef): Result<ResolvedRef<B>>;
+  /**
+   * `resolve`, then `connect` the bucket and check the path with the
+   * connected client, so a bucket with `tenant` also refuses another
+   * tenant's path (`forbidden`). No request is made.
+   */
+  connectStored(client: StorageClient, ref: StoredRef, options?: BucketConnectOptions): Result<ConnectedRef<B>>;
+}
+/**
+ * A registry of bucket definitions by id, for rows that store a bucket id
+ * next to an object path (files, attachments, sources). An id no bucket
+ * has, and a path outside the bucket's templates, are errors, never a
+ * fallback bucket.
+ *
+ * ```ts
+ * export const buckets = defineBuckets({ files, attachments, logos });
+ *
+ * const ref = buckets.connectStored(supabase, {
+ *   bucket: row.bucketId,
+ *   path: row.path,
+ * }, { context: db.$context });
+ * if (ref.ok) await ref.data.storage.signedUrl(ref.data.path);
+ * ```
+ */
+declare function defineBuckets<const B extends BucketMap>(buckets: B): Buckets<B>;
+//#endregion
+//#region src/storage/presets.d.ts
+/** The image types browsers display everywhere. */
+declare const IMAGE_TYPES: readonly string[];
+interface ImageBucketOptions<P extends string, Id extends string> {
+  readonly id?: Id;
+  /** The path template; keep the preset's placeholders the policy relies on. */
+  readonly path?: P | readonly [P, ...P[]];
+  /** Defaults to `true`: images load from their public URL without signing. */
+  readonly public?: boolean;
+  readonly fileSizeLimit?: string | number;
+  readonly allowedMimeTypes?: readonly string[];
+  /** Replaces the preset's policy. */
+  readonly policy?: BucketPolicy;
+}
+type AvatarBucketOptions<P extends string, Id extends string> = ImageBucketOptions<P, Id>;
+interface OrganizationLogoBucketOptions<P extends string, Id extends string> extends ImageBucketOptions<P, Id> {
+  /**
+   * The permission that may upload, replace and delete a logo, checked
+   * through the access contract. Defaults to `organization.update`, the
+   * `organizations` module's update permission.
+   */
+  readonly permission?: string;
+  /**
+   * The tenant segment connected clients are held to. `false` lets one
+   * client upload for any organization the policy allows. Defaults to
+   * `{ param: 'organizationId' }`.
+   */
+  readonly tenant?: BucketConfig["tenant"] | false;
+}
+declare const AVATAR_PATH = "{userId}/avatar-{version}.{ext}";
+declare const LOGO_PATH = "{organizationId}/logo-{version}.{ext}";
+/**
+ * A bucket for profile pictures: `{userId}/avatar-{version}.{ext}`, public,
+ * 2 MiB of images, written only by their owner (the `owner` policy).
+ */
+declare function avatarBucket<const P extends string = typeof AVATAR_PATH, const Id extends string = "avatars">(options?: AvatarBucketOptions<P, Id>): Bucket<P, Id>;
+/**
+ * A bucket for organization logos: `{organizationId}/logo-{version}.{ext}`, public,
+ * 2 MiB of images, written by members with the update permission through
+ * the access contract (`tenant_ids_with`), so it follows the app's roles.
+ */
+declare function organizationLogoBucket<const P extends string = typeof LOGO_PATH, const Id extends string = "organization-logos">(options?: OrganizationLogoBucketOptions<P, Id>): Bucket<P, Id>;
+//#endregion
+//#region src/storage/analytics-bucket.d.ts
+/** The Iceberg REST catalog of an analytics bucket, from `storage.analytics.from(id)`. */
+type AnalyticsCatalog = ReturnType<SupabaseClient["storage"]["analytics"]["from"]>;
+interface AnalyticsBucketClient {
+  /** Creates the bucket when it is missing. Needs the secret key. */
+  apply(): AsyncResult<{
+    readonly created: boolean;
+  }>;
+  /** The bucket's Iceberg catalog: namespaces and tables, each call returning `{ data, error }`. */
+  catalog(): AnalyticsCatalog;
+}
+interface AnalyticsBucket<Id extends string> {
+  readonly id: Id;
+  connect(client: StorageAdminClient): AnalyticsBucketClient;
+}
+/**
+ * A Storage analytics bucket: Apache Iceberg tables that query engines read
+ * through the Iceberg REST catalog.
+ *
+ * ```ts
+ * export const events = defineAnalyticsBucket({ id: "events" });
+ * await events.connect(admin).apply().orThrow();
+ * ```
+ */
+declare function defineAnalyticsBucket<const Id extends string>(config: {
+  readonly id: Id;
+}): AnalyticsBucket<Id>;
+//#endregion
+//#region src/storage/vector-bucket.d.ts
+type VectorDistance = "cosine" | "euclidean" | "dotproduct";
+interface VectorIndexConfig {
+  /** Number of values in every vector, e.g. 1536 for `text-embedding-3-small`. */
+  readonly dimension: number;
+  /** Defaults to `cosine`. */
+  readonly distanceMetric?: VectorDistance;
+  /** Metadata keys stored with each vector but not usable in `filter`. */
+  readonly nonFilterableMetadataKeys?: readonly string[];
+}
+interface VectorBucketConfig<Id extends string, I extends Readonly<Record<string, VectorIndexConfig>>> {
+  readonly id: Id;
+  readonly indexes: I;
+}
+type VectorMetadata = Readonly<Record<string, unknown>>;
+interface VectorRecord<M extends VectorMetadata = VectorMetadata> {
+  readonly key: string;
+  readonly vector: readonly number[];
+  readonly metadata?: M;
+}
+interface VectorHit<M extends VectorMetadata = VectorMetadata> {
+  readonly key: string;
+  /** Set by `query()`: smaller is closer for every metric. */
+  readonly distance?: number;
+  readonly metadata?: M;
+  readonly vector?: readonly number[];
+}
+interface VectorQueryOptions {
+  /** Number of matches, defaults to 10. */
+  readonly topK?: number;
+  /** A metadata filter, e.g. `{ organizationId: "o1" }` or `{ year: { $gte: 2024 } }`. */
+  readonly filter?: VectorMetadata;
+  /** Return each match's metadata. Defaults to `true`. */
+  readonly metadata?: boolean;
+}
+interface VectorIndexClient<M extends VectorMetadata = VectorMetadata> {
+  readonly name: string;
+  readonly dimension: number;
+  /** Inserts or replaces vectors by key, in batches of 500. */
+  put(records: readonly VectorRecord<M>[]): AsyncResult<number>;
+  /** The nearest vectors, closest first. */
+  query(vector: readonly number[], options?: VectorQueryOptions): AsyncResult<readonly VectorHit<M>[]>;
+  /** Vectors by key; missing keys are left out. */
+  get(keys: readonly string[], options?: {
+    readonly vector?: boolean;
+  }): AsyncResult<readonly VectorHit<M>[]>;
+  remove(keys: readonly string[]): AsyncResult<readonly string[]>;
+}
+interface VectorBucketClient<I extends string> {
+  /** Creates the bucket and any missing index. An index with another dimension or metric is a `conflict`. */
+  apply(): AsyncResult<{
+    readonly created: readonly string[];
+  }>;
+  index<M extends VectorMetadata = VectorMetadata>(name: I): VectorIndexClient<M>;
+}
+interface VectorBucket<Id extends string, I extends Readonly<Record<string, VectorIndexConfig>>> {
+  readonly id: Id;
+  readonly indexes: I;
+  connect(client: StorageAdminClient): VectorBucketClient<keyof I & string>;
+}
+/**
+ * A Storage vector bucket with typed indexes. Storage keeps the vectors
+ * outside Postgres; use the `vector-search` module for pgvector in a table.
+ *
+ * ```ts
+ * export const embeddings = defineVectorBucket({
+ *   id: "embeddings",
+ *   indexes: { documents: { dimension: 1536 } },
+ * });
+ * const docs = embeddings.connect(admin).index("documents");
+ * await docs.put([{ key: doc.id, vector, metadata: { organizationId } }]);
+ * ```
+ */
+declare function defineVectorBucket<const Id extends string, const I extends Readonly<Record<string, VectorIndexConfig>>>(config: VectorBucketConfig<Id, I>): VectorBucket<Id, I>;
+//#endregion
+export { defineBuckets as A, BucketIdOf as C, ConnectedRef as D, Buckets as E, StorageImageSize as M, storageImageUrl as N, ResolvedRef as O, fromStorageError as P, AnyBucket as S, BucketWithId as T, IMAGE_TYPES as _, VectorHit as a, avatarBucket as b, VectorMetadata as c, defineVectorBucket as d, AnalyticsBucket as f, AvatarBucketOptions as g, defineAnalyticsBucket as h, VectorDistance as i, StorageImageOptions as j, StoredRef as k, VectorQueryOptions as l, AnalyticsCatalog as m, VectorBucketClient as n, VectorIndexClient as o, AnalyticsBucketClient as p, VectorBucketConfig as r, VectorIndexConfig as s, VectorBucket as t, VectorRecord as u, ImageBucketOptions as v, BucketMap as w, organizationLogoBucket as x, OrganizationLogoBucketOptions as y };