chore: import upstream snapshot with attribution

apps/sim/tools/supabase/utils.ts

@@ -0,0 +1,35 @@
+import { validateSupabaseProjectId } from '@/lib/core/security/input-validation'
+
+/**
+ * Returns the validated Supabase REST API base URL for a given project ID.
+ * Throws if the project ID contains characters that could alter the URL
+ * (e.g. `#`, `/`, `@`), preventing SSRF via fragment injection.
+ */
+export function supabaseBaseUrl(projectId: string): string {
+  const result = validateSupabaseProjectId(projectId)
+  if (!result.isValid) {
+    throw new Error(result.error)
+  }
+  return `https://${result.sanitized}.supabase.co`
+}
+
+/**
+ * URL-encodes a single storage path segment (bucket name), trimming
+ * copy-paste whitespace first so the value is safe to interpolate into a URL.
+ */
+export function encodeStorageSegment(segment: string): string {
+  return encodeURIComponent(segment.trim())
+}
+
+/**
+ * URL-encodes a storage object path for use inside a URL, preserving `/`
+ * as a path separator while encoding each segment (and trimming
+ * copy-paste whitespace) so spaces, `#`, `?`, and other reserved
+ * characters in file names don't corrupt the request.
+ */
+export function encodeStoragePath(path: string): string {
+  return path
+    .split('/')
+    .map((segment) => encodeURIComponent(segment.trim()))
+    .join('/')
+}