fix(storage): normalize slashes in storage basePath

.changeset/storage-base-path-slashes.md

@@ -0,0 +1,5 @@
+---
+"@hot-updater/plugin-core": patch
+---
+
+Strip leading and trailing slashes from the storage `basePath` in `createStorageKeyBuilder` so a value like `/releases/` no longer produces object keys with an empty path segment.

plugins/plugin-core/src/createStorageKeyBuilder.spec.ts

@@ -0,0 +1,23 @@
+import { describe, expect, it } from "vitest";
+
+import { createStorageKeyBuilder } from "./createStorageKeyBuilder";
+
+describe("createStorageKeyBuilder", () => {
+  it("builds keys under the base path", () => {
+    expect(
+      createStorageKeyBuilder("releases")("bundles/id", "bundle.zip"),
+    ).toBe("releases/bundles/id/bundle.zip");
+  });
+
+  it("strips surrounding slashes from the base path", () => {
+    expect(
+      createStorageKeyBuilder("/releases/")("bundles/id", "bundle.zip"),
+    ).toBe("releases/bundles/id/bundle.zip");
+  });
+
+  it("omits the base path when it is empty or only slashes", () => {
+    expect(createStorageKeyBuilder(undefined)("bundles/id")).toBe("bundles/id");
+    expect(createStorageKeyBuilder("")("bundles/id")).toBe("bundles/id");
+    expect(createStorageKeyBuilder("/")("bundles/id")).toBe("bundles/id");
+  });
+});

plugins/plugin-core/src/createStorageKeyBuilder.ts

@@ -1,5 +1,8 @@
 export const createStorageKeyBuilder =
   (basePath: string | undefined) =>
   (...args: string[]) => {
-    return [basePath || "", ...args].filter(Boolean).join("/");
+    // Surrounding slashes would emit an empty key segment, and the asset
+    // storage URI resolver drops empty segments when it rebuilds those keys.
+    const normalizedBasePath = basePath?.replace(/^\/+|\/+$/g, "") ?? "";
+    return [normalizedBasePath, ...args].filter(Boolean).join("/");
   };

plugins/supabase/src/supabaseStorage.spec.ts

@@ -256,6 +256,40 @@ describe("supabaseStorage", () => {
     await fs.rm(tmpDir, { force: true, recursive: true });
   });
 
+  it("strips surrounding slashes from basePath when building upload keys", async () => {
+    const tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), "hu-supabase-"));
+    const uploadPath = path.join(tmpDir, "bundle.zip");
+    await fs.writeFile(uploadPath, "bundle");
+    bucket.upload.mockResolvedValueOnce({
+      data: { fullPath: "updates/releases/bundles/bundle.zip" },
+      error: null,
+    });
+    bucket.createSignedUrl.mockResolvedValueOnce({
+      data: { signedUrl: "https://example.supabase.co/signed-url" },
+      error: null,
+    });
+
+    const storage = supabaseStorage({
+      basePath: "/releases/",
+      bucketName: "updates",
+      supabaseAnonKey: "anon-key",
+      supabaseUrl: "https://example.supabase.co",
+    })();
+
+    await storage.profiles.node.upload("bundles", uploadPath);
+
+    expect(bucket.upload).toHaveBeenCalledWith(
+      "releases/bundles/bundle.zip",
+      expect.any(Buffer),
+      expect.objectContaining({
+        cacheControl: "max-age=31536000",
+        contentType: "application/zip",
+      }),
+    );
+
+    await fs.rm(tmpDir, { force: true, recursive: true });
+  });
+
   it("surfaces thrown signed URL generation errors", async () => {
     bucket.createSignedUrls.mockRejectedValueOnce(
       new Error("Failed to generate download URL: Object not found"),