@columnus/shared 0.1.47

package/dist/studioBoot.d.ts

@@ -0,0 +1,49 @@
+export type StudioBootEnv = {
+    host: string;
+    managementConvexUrl?: string;
+    viteConvexUrl?: string;
+    viteConvexSiteUrl?: string;
+};
+export type StudioBootPlan = {
+    mode: "management";
+    host: string;
+    slug: string;
+    managementConvexUrl: string;
+} | {
+    mode: "baked";
+    convexUrl: string;
+    convexSiteUrl: string;
+    reason: "preview" | "no-tenant-host" | "no-management-url";
+} | {
+    mode: "error";
+    code: "missing_config" | "not_a_tenant_host";
+    message: string;
+};
+/** Preview Studio hosts (`preview-*.columnus.app`). */
+export declare function isPreviewStudioHost(host: string): boolean;
+/**
+ * Decide how Studio should obtain its tenant Convex URL.
+ * Does not call the network — management mode still needs resolveTenantByHost.
+ */
+export declare function planStudioBoot(env: StudioBootEnv): StudioBootPlan;
+export type StudioHardGateReason = "unknown" | "disabled" | "resolve_failed" | "config";
+export type StudioBootResult = {
+    ok: true;
+    convexUrl: string;
+    convexSiteUrl: string;
+    source: "management" | "baked";
+    slug?: string;
+    displayName?: string;
+} | {
+    ok: false;
+    reason: StudioHardGateReason;
+    message: string;
+    slug?: string;
+    displayName?: string;
+};
+/**
+ * Guest share URLs (`/s/{token}`) must open the Convex WebSocket without a JWT.
+ * `expectAuth: true` pauses the socket until `setAuth`, which never runs for
+ * anonymous recipients — they stay stuck on "Opening secure link…".
+ */
+export declare function shouldExpectConvexAuth(pathname: string): boolean;

package/dist/studioBoot.js

@@ -0,0 +1,167 @@
+// packages/@columnus/shared/src/tenantHosts.ts
+var RESERVED_TENANT_SLUGS = ["manage", "deploy", "www"];
+var RESERVED_SLUG_SET = new Set(RESERVED_TENANT_SLUGS);
+var TENANT_SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+function isReservedTenantSlug(slug) {
+  const normalized = slug.trim().toLowerCase();
+  if (!normalized) return true;
+  if (RESERVED_SLUG_SET.has(normalized)) return true;
+  if (normalized.startsWith("preview-")) return true;
+  return false;
+}
+function isValidTenantSlug(slug) {
+  const trimmed = slug.trim();
+  if (!TENANT_SLUG_RE.test(trimmed)) return false;
+  return !isReservedTenantSlug(trimmed);
+}
+function hostnameFromHostHeader(host) {
+  const trimmed = host.trim().toLowerCase();
+  if (!trimmed) return "";
+  if (trimmed.startsWith("[")) {
+    const end = trimmed.indexOf("]");
+    return end === -1 ? trimmed : trimmed.slice(1, end);
+  }
+  const colon = trimmed.lastIndexOf(":");
+  if (colon > -1 && /^\d+$/.test(trimmed.slice(colon + 1))) {
+    return trimmed.slice(0, colon);
+  }
+  return trimmed;
+}
+function tenantSlugFromHost(host) {
+  const hostname = hostnameFromHostHeader(host);
+  const match = hostname.match(/^([a-z0-9-]+)\.columnus\.(app|localhost)$/);
+  if (!match) return null;
+  const slug = match[1];
+  if (!slug || !isValidTenantSlug(slug)) return null;
+  return slug;
+}
+var PREVIEW_TENANT_SLUG_RE = /^preview-[a-z0-9]+(?:-[a-z0-9]+)*$/;
+function isValidPreviewTenantSlug(slug) {
+  return PREVIEW_TENANT_SLUG_RE.test(slug.trim().toLowerCase());
+}
+function previewSlugFromHost(host) {
+  const hostname = hostnameFromHostHeader(host);
+  const match = hostname.match(/^(preview-[a-z0-9-]+)\.columnus\.(app|localhost)$/);
+  if (!match) return null;
+  const slug = match[1];
+  if (!slug || !isValidPreviewTenantSlug(slug)) return null;
+  return slug;
+}
+function anyTenantSlugFromHost(host) {
+  return tenantSlugFromHost(host) ?? previewSlugFromHost(host);
+}
+
+// packages/@columnus/shared/src/convexSiteUrl.ts
+function convexCloudToSiteUrl(convexUrl) {
+  const trimmed = convexUrl.trim().replace(/\/$/, "");
+  if (trimmed.includes(".convex.site")) return trimmed;
+  if (trimmed.includes(".convex.cloud")) {
+    return trimmed.replace(/\.convex\.cloud\b/, ".convex.site");
+  }
+  return trimmed;
+}
+function trimOptional(value) {
+  const trimmed = value?.trim();
+  return trimmed || void 0;
+}
+function normalizeTrailingSlash(url) {
+  return url.trim().replace(/\/$/, "");
+}
+function deriveSiteFromCloudUrl(cloud) {
+  const trimmed = cloud?.trim();
+  if (!trimmed) return void 0;
+  if (trimmed.includes(".convex.cloud") || trimmed.includes(".convex.site")) {
+    return convexCloudToSiteUrl(trimmed);
+  }
+  return void 0;
+}
+function convexDeploymentSlug(url) {
+  const match = url.match(/https:\/\/([^.]+)\.convex\.(?:cloud|site)/);
+  return match?.[1];
+}
+function explicitSiteMatchesCloud(explicit, cloud) {
+  const explicitSlug = convexDeploymentSlug(explicit);
+  const cloudSlug = convexDeploymentSlug(cloud);
+  if (!explicitSlug || !cloudSlug) return true;
+  return explicitSlug === cloudSlug;
+}
+function resolveConvexSiteUrlFromEnv(env) {
+  const explicit = trimOptional(env.convexSiteUrl) ?? trimOptional(env.viteConvexSiteUrl);
+  const cloud = trimOptional(env.convexUrl) ?? trimOptional(env.viteConvexUrl) ?? trimOptional(env.convexCloudUrl);
+  if (explicit && cloud && !explicitSiteMatchesCloud(explicit, cloud)) {
+    return deriveSiteFromCloudUrl(cloud) ?? normalizeTrailingSlash(explicit);
+  }
+  if (explicit) return normalizeTrailingSlash(explicit);
+  return deriveSiteFromCloudUrl(cloud) ?? "";
+}
+
+// packages/@columnus/shared/src/studioBoot.ts
+function isPreviewStudioHost(host) {
+  const hostname = hostnameFromHostHeader(host);
+  return /^preview-[a-z0-9-]+\.columnus\.app$/i.test(hostname);
+}
+function normalizeUrl(url) {
+  return url.trim().replace(/\/+$/, "");
+}
+function siteUrlFromCloudOrExplicit(cloudUrl, explicitSite) {
+  return resolveConvexSiteUrlFromEnv({
+    convexUrl: cloudUrl,
+    convexSiteUrl: explicitSite
+  });
+}
+function planStudioBoot(env) {
+  const management = env.managementConvexUrl?.trim();
+  const baked = env.viteConvexUrl?.trim();
+  const host = env.host;
+  if (management) {
+    const slug = anyTenantSlugFromHost(host);
+    if (slug) {
+      return {
+        mode: "management",
+        host: hostnameFromHostHeader(host),
+        slug,
+        managementConvexUrl: normalizeUrl(management)
+      };
+    }
+    return {
+      mode: "error",
+      code: "not_a_tenant_host",
+      message: "This host is not a tenant subdomain (expected {slug}.columnus.app or {slug}.columnus.localhost). Open a registered tenant host such as https://app.columnus.localhost."
+    };
+  }
+  if (isPreviewStudioHost(host)) {
+    if (!baked) {
+      return {
+        mode: "error",
+        code: "missing_config",
+        message: "Preview hosts require VITE_MANAGEMENT_CONVEX_URL (Manage resolve) or VITE_CONVEX_URL (legacy bake)."
+      };
+    }
+    return {
+      mode: "baked",
+      convexUrl: normalizeUrl(baked),
+      convexSiteUrl: siteUrlFromCloudOrExplicit(normalizeUrl(baked), env.viteConvexSiteUrl),
+      reason: "preview"
+    };
+  }
+  if (baked) {
+    return {
+      mode: "baked",
+      convexUrl: normalizeUrl(baked),
+      convexSiteUrl: siteUrlFromCloudOrExplicit(normalizeUrl(baked), env.viteConvexSiteUrl),
+      reason: "no-management-url"
+    };
+  }
+  return {
+    mode: "error",
+    code: "missing_config",
+    message: "Set VITE_MANAGEMENT_CONVEX_URL (multi-tenant) or VITE_CONVEX_URL (single deployment)."
+  };
+}
+function shouldExpectConvexAuth(pathname) {
+  return !pathname.startsWith("/s/");
+}
+
+export { isPreviewStudioHost, planStudioBoot, shouldExpectConvexAuth };
+//# sourceMappingURL=studioBoot.js.map
+//# sourceMappingURL=studioBoot.js.map

package/dist/studioBoot.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/tenantHosts.ts","../src/convexSiteUrl.ts","../src/studioBoot.ts"],"names":[],"mappings":";AACO,IAAM,qBAAA,GAAwB,CAAC,QAAA,EAAU,QAAA,EAAU,KAAK,CAAA;AAE/D,IAAM,iBAAA,GAAoB,IAAI,GAAA,CAAY,qBAAqB,CAAA;AAGxD,IAAM,cAAA,GAAiB,4BAAA;AAEvB,SAAS,qBAAqB,IAAA,EAAuB;AAC1D,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,IAAA,EAAK,CAAE,WAAA,EAAY;AAC3C,EAAA,IAAI,CAAC,YAAY,OAAO,IAAA;AACxB,EAAA,IAAI,iBAAA,CAAkB,GAAA,CAAI,UAAU,CAAA,EAAG,OAAO,IAAA;AAC9C,EAAA,IAAI,UAAA,CAAW,UAAA,CAAW,UAAU,CAAA,EAAG,OAAO,IAAA;AAC9C,EAAA,OAAO,KAAA;AACT;AAEO,SAAS,kBAAkB,IAAA,EAAuB;AACvD,EAAA,MAAM,OAAA,GAAU,KAAK,IAAA,EAAK;AAE1B,EAAA,IAAI,CAAC,cAAA,CAAe,IAAA,CAAK,OAAO,GAAG,OAAO,KAAA;AAC1C,EAAA,OAAO,CAAC,qBAAqB,OAAO,CAAA;AACtC;AAGO,SAAS,uBAAuB,IAAA,EAAsB;AAC3D,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,IAAA,EAAK,CAAE,WAAA,EAAY;AACxC,EAAA,IAAI,CAAC,SAAS,OAAO,EAAA;AAErB,EAAA,IAAI,OAAA,CAAQ,UAAA,CAAW,GAAG,CAAA,EAAG;AAC3B,IAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,OAAA,CAAQ,GAAG,CAAA;AAC/B,IAAA,OAAO,QAAQ,EAAA,GAAK,OAAA,GAAU,OAAA,CAAQ,KAAA,CAAM,GAAG,GAAG,CAAA;AAAA,EACpD;AACA,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,WAAA,CAAY,GAAG,CAAA;AACrC,EAAA,IAAI,KAAA,GAAQ,MAAM,OAAA,CAAQ,IAAA,CAAK,QAAQ,KAAA,CAAM,KAAA,GAAQ,CAAC,CAAC,CAAA,EAAG;AACxD,IAAA,OAAO,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAG,KAAK,CAAA;AAAA,EAC/B;AACA,EAAA,OAAO,OAAA;AACT;AAOO,SAAS,mBAAmB,IAAA,EAA6B;AAC9D,EAAA,MAAM,QAAA,GAAW,uBAAuB,IAAI,CAAA;AAC5C,EAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,KAAA,CAAM,2CAA2C,CAAA;AACxE,EAAA,IAAI,CAAC,OAAO,OAAO,IAAA;AACnB,EAAA,MAAM,IAAA,GAAO,MAAM,CAAC,CAAA;AACpB,EAAA,IAAI,CAAC,IAAA,IAAQ,CAAC,iBAAA,CAAkB,IAAI,GAAG,OAAO,IAAA;AAC9C,EAAA,OAAO,IAAA;AACT;AAWO,IAAM,sBAAA,GAAyB,oCAAA;AAE/B,SAAS,yBAAyB,IAAA,EAAuB;AAC9D,EAAA,OAAO,uBAAuB,IAAA,CAAK,IAAA,CAAK,IAAA,EAAK,CAAE,aAAa,CAAA;AAC9D;AAMO,SAAS,oBAAoB,IAAA,EAA6B;AAC/D,EAAA,MAAM,QAAA,GAAW,uBAAuB,IAAI,CAAA;AAC5C,EAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,KAAA,CAAM,mDAAmD,CAAA;AAChF,EAAA,IAAI,CAAC,OAAO,OAAO,IAAA;AACnB,EAAA,MAAM,IAAA,GAAO,MAAM,CAAC,CAAA;AACpB,EAAA,IAAI,CAAC,IAAA,IAAQ,CAAC,wBAAA,CAAyB,IAAI,GAAG,OAAO,IAAA;AACrD,EAAA,OAAO,IAAA;AACT;AAMO,SAAS,sBAAsB,IAAA,EAA6B;AACjE,EAAA,OAAO,kBAAA,CAAmB,IAAI,CAAA,IAAK,mBAAA,CAAoB,IAAI,CAAA;AAC7D;;;ACtFO,SAAS,qBAAqB,SAAA,EAA2B;AAC9D,EAAA,MAAM,UAAU,SAAA,CAAU,IAAA,EAAK,CAAE,OAAA,CAAQ,OAAO,EAAE,CAAA;AAClD,EAAA,IAAI,OAAA,CAAQ,QAAA,CAAS,cAAc,CAAA,EAAG,OAAO,OAAA;AAC7C,EAAA,IAAI,OAAA,CAAQ,QAAA,CAAS,eAAe,CAAA,EAAG;AACrC,IAAA,OAAO,OAAA,CAAQ,OAAA,CAAQ,mBAAA,EAAqB,cAAc,CAAA;AAAA,EAC5D;AACA,EAAA,OAAO,OAAA;AACT;AAaA,SAAS,aAAa,KAAA,EAAoC;AACxD,EAAA,MAAM,OAAA,GAAU,OAAO,IAAA,EAAK;AAC5B,EAAA,OAAO,OAAA,IAAW,MAAA;AACpB;AAEA,SAAS,uBAAuB,GAAA,EAAqB;AACnD,EAAA,OAAO,GAAA,CAAI,IAAA,EAAK,CAAE,OAAA,CAAQ,OAAO,EAAE,CAAA;AACrC;AAEA,SAAS,uBAAuB,KAAA,EAAoC;AAClE,EAAA,MAAM,OAAA,GAAU,OAAO,IAAA,EAAK;AAC5B,EAAA,IAAI,CAAC,SAAS,OAAO,MAAA;AACrB,EAAA,IAAI,QAAQ,QAAA,CAAS,eAAe,KAAK,OAAA,CAAQ,QAAA,CAAS,cAAc,CAAA,EAAG;AACzE,IAAA,OAAO,qBAAqB,OAAO,CAAA;AAAA,EACrC;AACA,EAAA,OAAO,MAAA;AACT;AA6CA,SAAS,qBAAqB,GAAA,EAAiC;AAC7D,EAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,KAAA,CAAM,2CAA2C,CAAA;AACnE,EAAA,OAAO,QAAQ,CAAC,CAAA;AAClB;AAgBA,SAAS,wBAAA,CAAyB,UAAkB,KAAA,EAAwB;AAC1E,EAAA,MAAM,YAAA,GAAe,qBAAqB,QAAQ,CAAA;AAClD,EAAA,MAAM,SAAA,GAAY,qBAAqB,KAAK,CAAA;AAC5C,EAAA,IAAI,CAAC,YAAA,IAAgB,CAAC,SAAA,EAAW,OAAO,IAAA;AACxC,EAAA,OAAO,YAAA,KAAiB,SAAA;AAC1B;AAgCO,SAAS,4BAA4B,GAAA,EAA+B;AACzE,EAAA,MAAM,WAAW,YAAA,CAAa,GAAA,CAAI,aAAa,CAAA,IAAK,YAAA,CAAa,IAAI,iBAAiB,CAAA;AACtF,EAAA,MAAM,KAAA,GACJ,YAAA,CAAa,GAAA,CAAI,SAAS,CAAA,IAC1B,YAAA,CAAa,GAAA,CAAI,aAAa,CAAA,IAC9B,YAAA,CAAa,GAAA,CAAI,cAAc,CAAA;AAEjC,EAAA,IAAI,YAAY,KAAA,IAAS,CAAC,wBAAA,CAAyB,QAAA,EAAU,KAAK,CAAA,EAAG;AACnE,IAAA,OAAO,sBAAA,CAAuB,KAAK,CAAA,IAAK,sBAAA,CAAuB,QAAQ,CAAA;AAAA,EACzE;AAEA,EAAA,IAAI,QAAA,EAAU,OAAO,sBAAA,CAAuB,QAAQ,CAAA;AAEpD,EAAA,OAAO,sBAAA,CAAuB,KAAK,CAAA,IAAK,EAAA;AAC1C;;;ACnIO,SAAS,oBAAoB,IAAA,EAAuB;AACzD,EAAA,MAAM,QAAA,GAAW,uBAAuB,IAAI,CAAA;AAC5C,EAAA,OAAO,sCAAA,CAAuC,KAAK,QAAQ,CAAA;AAC7D;AAEA,SAAS,aAAa,GAAA,EAAqB;AACzC,EAAA,OAAO,GAAA,CAAI,IAAA,EAAK,CAAE,OAAA,CAAQ,QAAQ,EAAE,CAAA;AACtC;AAEA,SAAS,0BAAA,CAA2B,UAAkB,YAAA,EAA+B;AACnF,EAAA,OAAO,2BAAA,CAA4B;AAAA,IACjC,SAAA,EAAW,QAAA;AAAA,IACX,aAAA,EAAe;AAAA,GAChB,CAAA;AACH;AAMO,SAAS,eAAe,GAAA,EAAoC;AACjE,EAAA,MAAM,UAAA,GAAa,GAAA,CAAI,mBAAA,EAAqB,IAAA,EAAK;AACjD,EAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,aAAA,EAAe,IAAA,EAAK;AACtC,EAAA,MAAM,OAAO,GAAA,CAAI,IAAA;AAEjB,EAAA,IAAI,UAAA,EAAY;AACd,IAAA,MAAM,IAAA,GAAO,sBAAsB,IAAI,CAAA;AACvC,IAAA,IAAI,IAAA,EAAM;AACR,MAAA,OAAO;AAAA,QACL,IAAA,EAAM,YAAA;AAAA,QACN,IAAA,EAAM,uBAAuB,IAAI,CAAA;AAAA,QACjC,IAAA;AAAA,QACA,mBAAA,EAAqB,aAAa,UAAU;AAAA,OAC9C;AAAA,IACF;AAEA,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,OAAA;AAAA,MACN,IAAA,EAAM,mBAAA;AAAA,MACN,OAAA,EACE;AAAA,KACJ;AAAA,EACF;AAGA,EAAA,IAAI,mBAAA,CAAoB,IAAI,CAAA,EAAG;AAC7B,IAAA,IAAI,CAAC,KAAA,EAAO;AACV,MAAA,OAAO;AAAA,QACL,IAAA,EAAM,OAAA;AAAA,QACN,IAAA,EAAM,gBAAA;AAAA,QACN,OAAA,EACE;AAAA,OACJ;AAAA,IACF;AACA,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,OAAA;AAAA,MACN,SAAA,EAAW,aAAa,KAAK,CAAA;AAAA,MAC7B,eAAe,0BAAA,CAA2B,YAAA,CAAa,KAAK,CAAA,EAAG,IAAI,iBAAiB,CAAA;AAAA,MACpF,MAAA,EAAQ;AAAA,KACV;AAAA,EACF;AAEA,EAAA,IAAI,KAAA,EAAO;AACT,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,OAAA;AAAA,MACN,SAAA,EAAW,aAAa,KAAK,CAAA;AAAA,MAC7B,eAAe,0BAAA,CAA2B,YAAA,CAAa,KAAK,CAAA,EAAG,IAAI,iBAAiB,CAAA;AAAA,MACpF,MAAA,EAAQ;AAAA,KACV;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,OAAA;AAAA,IACN,IAAA,EAAM,gBAAA;AAAA,IACN,OAAA,EACE;AAAA,GACJ;AACF;AA0BO,SAAS,uBAAuB,QAAA,EAA2B;AAChE,EAAA,OAAO,CAAC,QAAA,CAAS,UAAA,CAAW,KAAK,CAAA;AACnC","file":"studioBoot.js","sourcesContent":["/** Reserved first labels under `*.columnus.app` / `*.columnus.localhost` — not tenants. */\nexport const RESERVED_TENANT_SLUGS = [\"manage\", \"deploy\", \"www\"] as const;\n\nconst RESERVED_SLUG_SET = new Set<string>(RESERVED_TENANT_SLUGS);\n\n/** Lowercase slug: letters/digits with optional hyphen segments (e.g. `app`, `acme-prod`). */\nexport const TENANT_SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;\n\nexport function isReservedTenantSlug(slug: string): boolean {\n  const normalized = slug.trim().toLowerCase();\n  if (!normalized) return true;\n  if (RESERVED_SLUG_SET.has(normalized)) return true;\n  if (normalized.startsWith(\"preview-\")) return true;\n  return false;\n}\n\nexport function isValidTenantSlug(slug: string): boolean {\n  const trimmed = slug.trim();\n  // Require already-lowercase slugs (hosts are normalized before parse).\n  if (!TENANT_SLUG_RE.test(trimmed)) return false;\n  return !isReservedTenantSlug(trimmed);\n}\n\n/** Strip optional port from a Host header or `window.location.host` value. */\nexport function hostnameFromHostHeader(host: string): string {\n  const trimmed = host.trim().toLowerCase();\n  if (!trimmed) return \"\";\n  // IPv6 bracket form is not used for tenant hosts; strip :port for hostname:port.\n  if (trimmed.startsWith(\"[\")) {\n    const end = trimmed.indexOf(\"]\");\n    return end === -1 ? trimmed : trimmed.slice(1, end);\n  }\n  const colon = trimmed.lastIndexOf(\":\");\n  if (colon > -1 && /^\\d+$/.test(trimmed.slice(colon + 1))) {\n    return trimmed.slice(0, colon);\n  }\n  return trimmed;\n}\n\n/**\n * Extract tenant slug from a hostname.\n * Supports `{slug}.columnus.app` and `{slug}.columnus.localhost`.\n * Returns null for apex, reserved, invalid, or unrecognized hosts.\n */\nexport function tenantSlugFromHost(host: string): string | null {\n  const hostname = hostnameFromHostHeader(host);\n  const match = hostname.match(/^([a-z0-9-]+)\\.columnus\\.(app|localhost)$/);\n  if (!match) return null;\n  const slug = match[1];\n  if (!slug || !isValidTenantSlug(slug)) return null;\n  return slug;\n}\n\nexport type TenantPublicHostEnv = \"prod\" | \"local\";\n\n/** Public hostname for a tenant slug (no scheme). */\nexport function tenantPublicHost(slug: string, env: TenantPublicHostEnv = \"prod\"): string {\n  const normalized = slug.trim().toLowerCase();\n  return env === \"local\" ? `${normalized}.columnus.localhost` : `${normalized}.columnus.app`;\n}\n\n/** Preview tenant slug: `preview-<label>` (e.g. `preview-12`). */\nexport const PREVIEW_TENANT_SLUG_RE = /^preview-[a-z0-9]+(?:-[a-z0-9]+)*$/;\n\nexport function isValidPreviewTenantSlug(slug: string): boolean {\n  return PREVIEW_TENANT_SLUG_RE.test(slug.trim().toLowerCase());\n}\n\n/**\n * Extract preview tenant slug from hostname (`preview-12.columnus.app`).\n * Returns null for non-preview or invalid hosts.\n */\nexport function previewSlugFromHost(host: string): string | null {\n  const hostname = hostnameFromHostHeader(host);\n  const match = hostname.match(/^(preview-[a-z0-9-]+)\\.columnus\\.(app|localhost)$/);\n  if (!match) return null;\n  const slug = match[1];\n  if (!slug || !isValidPreviewTenantSlug(slug)) return null;\n  return slug;\n}\n\n/**\n * Resolve either a standard tenant slug or a registered preview slug from a host.\n * Does not check Management DB — only host shape.\n */\nexport function anyTenantSlugFromHost(host: string): string | null {\n  return tenantSlugFromHost(host) ?? previewSlugFromHost(host);\n}\n","/** Convex deployment cloud URL (.convex.cloud) → HTTP actions / auth issuer (.convex.site). */\nexport function convexCloudToSiteUrl(convexUrl: string): string {\n  const trimmed = convexUrl.trim().replace(/\\/$/, \"\");\n  if (trimmed.includes(\".convex.site\")) return trimmed;\n  if (trimmed.includes(\".convex.cloud\")) {\n    return trimmed.replace(/\\.convex\\.cloud\\b/, \".convex.site\");\n  }\n  return trimmed;\n}\n\nexport function convexSiteToCloudUrl(siteUrl: string): string {\n  const trimmed = siteUrl.trim().replace(/\\/$/, \"\");\n  if (trimmed.includes(\".convex.cloud\")) return trimmed;\n  if (trimmed.includes(\".convex.site\")) {\n    return trimmed.replace(/\\.convex\\.site\\b/, \".convex.cloud\");\n  }\n  return trimmed;\n}\n\ntype ProcessEnvLike = Record<string, string | undefined>;\n\nfunction trimOptional(value?: string): string | undefined {\n  const trimmed = value?.trim();\n  return trimmed || undefined;\n}\n\nfunction normalizeTrailingSlash(url: string): string {\n  return url.trim().replace(/\\/$/, \"\");\n}\n\nfunction deriveSiteFromCloudUrl(cloud?: string): string | undefined {\n  const trimmed = cloud?.trim();\n  if (!trimmed) return undefined;\n  if (trimmed.includes(\".convex.cloud\") || trimmed.includes(\".convex.site\")) {\n    return convexCloudToSiteUrl(trimmed);\n  }\n  return undefined;\n}\n\n/** Docker runtime-base verify placeholder — must not be used for real BFF prepare. */\nexport function isPlaceholderManagementSiteUrl(url: string): boolean {\n  try {\n    const host = new URL(/:\\/\\//.test(url) ? url : `https://${url}`).hostname;\n    return host === \"placeholder.convex.site\" || host.endsWith(\".placeholder.convex.site\");\n  } catch {\n    return /placeholder\\.convex\\.site/i.test(url);\n  }\n}\n\n/**\n * Management `.convex.site` origin for BFF `prepare`.\n * Prefers explicit management site env vars, else derives from `VITE_MANAGEMENT_CONVEX_URL`.\n * Does not read `VITE_CONVEX_SITE_URL` — on web that is the tenant site, not Manage.\n */\nexport function resolveBffManagementSiteUrl(env: ProcessEnvLike = process.env): string | undefined {\n  for (const key of [\"COLUMNUS_MANAGEMENT_SITE_URL\", \"MANAGEMENT_CONVEX_SITE_URL\"] as const) {\n    const value = trimOptional(env[key]);\n    if (value && !isPlaceholderManagementSiteUrl(value)) {\n      return normalizeTrailingSlash(value);\n    }\n  }\n  const managementCloud = trimOptional(env.VITE_MANAGEMENT_CONVEX_URL);\n  if (managementCloud) return convexCloudToSiteUrl(managementCloud);\n  return undefined;\n}\n\n/**\n * Runtime BFF management site: prefer image-baked URL over Coolify env.\n * Preview Coolify often injects prod `MANAGEMENT_CONVEX_SITE_URL`, which shadows the\n * ephemeral Manage preview bake and makes prepare return HTTP 404 (no routes on prod).\n */\nexport function resolveRuntimeManagementSiteUrl(options: {\n  bakedSiteUrl?: string | null;\n  env?: ProcessEnvLike;\n}): string | undefined {\n  const bakedSite = trimOptional(options.bakedSiteUrl ?? undefined);\n  if (bakedSite && !isPlaceholderManagementSiteUrl(bakedSite)) {\n    return normalizeTrailingSlash(bakedSite);\n  }\n  return resolveBffManagementSiteUrl(options.env ?? process.env);\n}\n\nfunction convexDeploymentSlug(url: string): string | undefined {\n  const match = url.match(/https:\\/\\/([^.]+)\\.convex\\.(?:cloud|site)/);\n  return match?.[1];\n}\n\n/** Deployment name from a Convex cloud/site URL (`https://{name}.convex.cloud`). */\nexport function convexDeploymentSlugFromUrl(url: string): string | undefined {\n  return convexDeploymentSlug(url);\n}\n\n/**\n * Best-effort `CONVEX_DEPLOYMENT` when only the cloud URL is known (e.g. after `columnus-api pull`).\n * Defaults to `dev:{slug}` — preview/prod deployments may need an explicit value in `.env.local`.\n */\nexport function deriveConvexDeploymentFromCloudUrl(cloudUrl: string): string | undefined {\n  const slug = convexDeploymentSlug(cloudUrl);\n  return slug ? `dev:${slug}` : undefined;\n}\n\nfunction explicitSiteMatchesCloud(explicit: string, cloud: string): boolean {\n  const explicitSlug = convexDeploymentSlug(explicit);\n  const cloudSlug = convexDeploymentSlug(cloud);\n  if (!explicitSlug || !cloudSlug) return true;\n  return explicitSlug === cloudSlug;\n}\n\nexport type ConvexSiteUrlEnv = {\n  /** CONVEX_SITE_URL */\n  convexSiteUrl?: string;\n  /** VITE_CONVEX_SITE_URL */\n  viteConvexSiteUrl?: string;\n  /** CONVEX_URL */\n  convexUrl?: string;\n  /** VITE_CONVEX_URL */\n  viteConvexUrl?: string;\n  /** CONVEX_CLOUD_URL */\n  convexCloudUrl?: string;\n};\n\n/** @deprecated Use `ConvexSiteUrlEnv` */\nexport type ResolveConvexSiteUrlOptions = ConvexSiteUrlEnv;\n\nexport function readConvexSiteUrlEnv(env: ProcessEnvLike): ConvexSiteUrlEnv {\n  return {\n    convexSiteUrl: env.CONVEX_SITE_URL,\n    viteConvexSiteUrl: env.VITE_CONVEX_SITE_URL,\n    convexUrl: env.CONVEX_URL,\n    viteConvexUrl: env.VITE_CONVEX_URL,\n    convexCloudUrl: env.CONVEX_CLOUD_URL,\n  };\n}\n\n/**\n * Resolve .convex.site URL from env: explicit site URLs first, then derive from Convex cloud/site URLs.\n * Returns empty string when nothing is configured.\n */\nexport function resolveConvexSiteUrlFromEnv(env: ConvexSiteUrlEnv): string {\n  const explicit = trimOptional(env.convexSiteUrl) ?? trimOptional(env.viteConvexSiteUrl);\n  const cloud =\n    trimOptional(env.convexUrl) ??\n    trimOptional(env.viteConvexUrl) ??\n    trimOptional(env.convexCloudUrl);\n\n  if (explicit && cloud && !explicitSiteMatchesCloud(explicit, cloud)) {\n    return deriveSiteFromCloudUrl(cloud) ?? normalizeTrailingSlash(explicit);\n  }\n\n  if (explicit) return normalizeTrailingSlash(explicit);\n\n  return deriveSiteFromCloudUrl(cloud) ?? \"\";\n}\n\n/** Better Auth `baseURL` from standard Convex process env. */\nexport function convexSiteUrlFromProcessEnv(env: ProcessEnvLike = process.env): string {\n  return resolveConvexSiteUrlFromEnv(readConvexSiteUrlEnv(env));\n}\n\n/** Resolve .convex.site URL for OTP sign-in and scripts (throws when unset). */\nexport function resolveConvexSiteUrl(env?: ConvexSiteUrlEnv): string {\n  const url = resolveConvexSiteUrlFromEnv(env ?? {});\n  if (!url) {\n    throw new Error(\"Convex URL required to derive .convex.site URL for OTP sign-in\");\n  }\n  return url;\n}\n\nexport type AuthConfigIssuerEnv = ConvexSiteUrlEnv & {\n  /** BAKED_AUTH_ISSUER patched at deploy time */\n  bakedAuthIssuer?: string;\n};\n\n/**\n * Auth issuer for deploy scripts: baked deploy patch → convex site URL env chain.\n */\nexport function resolveAuthConfigIssuerFromEnv(env: AuthConfigIssuerEnv): string {\n  const baked = trimOptional(env.bakedAuthIssuer);\n  if (baked) return normalizeTrailingSlash(baked);\n\n  return resolveConvexSiteUrlFromEnv(env);\n}\n\nexport type AuthConfigIssuerFromProcessEnvOptions = {\n  bakedAuthIssuer?: string;\n  /** Derive from CONVEX_URL / VITE_CONVEX_URL when issuer env vars are unset (deploy scripts). */\n  deriveFromCloudUrl?: boolean;\n};\n\n/** JWT issuer from process env (auth.config.ts bundle vs deploy scripts). */\nexport function authConfigIssuerFromProcessEnv(\n  env: ProcessEnvLike = process.env,\n  options: AuthConfigIssuerFromProcessEnvOptions = {},\n): string {\n  return resolveAuthConfigIssuerFromEnv({\n    bakedAuthIssuer: options.bakedAuthIssuer,\n    convexSiteUrl: env.CONVEX_SITE_URL,\n    ...(options.deriveFromCloudUrl\n      ? {\n          convexUrl: env.CONVEX_URL,\n          viteConvexUrl: env.VITE_CONVEX_URL,\n        }\n      : {}),\n  });\n}\n\n/** Comma-separated browser origins (SITE_URL) for Better Auth trustedOrigins / crossDomain. */\nexport function parseTrustedSiteUrls(siteUrlRaw?: string): string[] {\n  const raw = siteUrlRaw?.trim() ?? \"\";\n  if (!raw) return [];\n  return raw\n    .split(\",\")\n    .map((url) => url.trim())\n    .filter(Boolean);\n}\n\nexport function primaryTrustedSiteUrl(siteUrlRaw?: string): string {\n  const urls = parseTrustedSiteUrls(siteUrlRaw);\n  return urls[0] ?? siteUrlRaw?.trim() ?? \"\";\n}\n\n/** Better Auth `trustedOrigins` from SITE_URL. */\nexport function betterAuthTrustedOrigins(siteUrlRaw?: string): string[] {\n  const urls = parseTrustedSiteUrls(siteUrlRaw);\n  if (urls.length > 0) return urls;\n  const primary = primaryTrustedSiteUrl(siteUrlRaw);\n  return primary ? [primary] : [];\n}\n","import { anyTenantSlugFromHost, hostnameFromHostHeader } from \"./tenantHosts.ts\";\nimport { resolveConvexSiteUrlFromEnv } from \"./convexSiteUrl.ts\";\n\nexport type StudioBootEnv = {\n  host: string;\n  managementConvexUrl?: string;\n  viteConvexUrl?: string;\n  viteConvexSiteUrl?: string;\n};\n\nexport type StudioBootPlan =\n  | { mode: \"management\"; host: string; slug: string; managementConvexUrl: string }\n  | {\n      mode: \"baked\";\n      convexUrl: string;\n      convexSiteUrl: string;\n      reason: \"preview\" | \"no-tenant-host\" | \"no-management-url\";\n    }\n  | { mode: \"error\"; code: \"missing_config\" | \"not_a_tenant_host\"; message: string };\n\n/** Preview Studio hosts (`preview-*.columnus.app`). */\nexport function isPreviewStudioHost(host: string): boolean {\n  const hostname = hostnameFromHostHeader(host);\n  return /^preview-[a-z0-9-]+\\.columnus\\.app$/i.test(hostname);\n}\n\nfunction normalizeUrl(url: string): string {\n  return url.trim().replace(/\\/+$/, \"\");\n}\n\nfunction siteUrlFromCloudOrExplicit(cloudUrl: string, explicitSite?: string): string {\n  return resolveConvexSiteUrlFromEnv({\n    convexUrl: cloudUrl,\n    convexSiteUrl: explicitSite,\n  });\n}\n\n/**\n * Decide how Studio should obtain its tenant Convex URL.\n * Does not call the network — management mode still needs resolveTenantByHost.\n */\nexport function planStudioBoot(env: StudioBootEnv): StudioBootPlan {\n  const management = env.managementConvexUrl?.trim();\n  const baked = env.viteConvexUrl?.trim();\n  const host = env.host;\n\n  if (management) {\n    const slug = anyTenantSlugFromHost(host);\n    if (slug) {\n      return {\n        mode: \"management\",\n        host: hostnameFromHostHeader(host),\n        slug,\n        managementConvexUrl: normalizeUrl(management),\n      };\n    }\n    // Multi-tenant default: hard-gate apex / loopback / unknown hosts (D49).\n    return {\n      mode: \"error\",\n      code: \"not_a_tenant_host\",\n      message:\n        \"This host is not a tenant subdomain (expected {slug}.columnus.app or {slug}.columnus.localhost). Open a registered tenant host such as https://app.columnus.localhost.\",\n    };\n  }\n\n  // A baked single-deployment host does not need Management resolution.\n  if (isPreviewStudioHost(host)) {\n    if (!baked) {\n      return {\n        mode: \"error\",\n        code: \"missing_config\",\n        message:\n          \"Preview hosts require VITE_MANAGEMENT_CONVEX_URL (Manage resolve) or VITE_CONVEX_URL (legacy bake).\",\n      };\n    }\n    return {\n      mode: \"baked\",\n      convexUrl: normalizeUrl(baked),\n      convexSiteUrl: siteUrlFromCloudOrExplicit(normalizeUrl(baked), env.viteConvexSiteUrl),\n      reason: \"preview\",\n    };\n  }\n\n  if (baked) {\n    return {\n      mode: \"baked\",\n      convexUrl: normalizeUrl(baked),\n      convexSiteUrl: siteUrlFromCloudOrExplicit(normalizeUrl(baked), env.viteConvexSiteUrl),\n      reason: \"no-management-url\",\n    };\n  }\n\n  return {\n    mode: \"error\",\n    code: \"missing_config\",\n    message:\n      \"Set VITE_MANAGEMENT_CONVEX_URL (multi-tenant) or VITE_CONVEX_URL (single deployment).\",\n  };\n}\n\nexport type StudioHardGateReason = \"unknown\" | \"disabled\" | \"resolve_failed\" | \"config\";\n\nexport type StudioBootResult =\n  | {\n      ok: true;\n      convexUrl: string;\n      convexSiteUrl: string;\n      source: \"management\" | \"baked\";\n      slug?: string;\n      displayName?: string;\n    }\n  | {\n      ok: false;\n      reason: StudioHardGateReason;\n      message: string;\n      slug?: string;\n      displayName?: string;\n    };\n\n/**\n * Guest share URLs (`/s/{token}`) must open the Convex WebSocket without a JWT.\n * `expectAuth: true` pauses the socket until `setAuth`, which never runs for\n * anonymous recipients — they stay stuck on \"Opening secure link…\".\n */\nexport function shouldExpectConvexAuth(pathname: string): boolean {\n  return !pathname.startsWith(\"/s/\");\n}\n"]}

package/dist/syncClampMembership.d.ts

@@ -0,0 +1,22 @@
+import type { ApiTableAccess } from "./apiProfile.ts";
+import type { Predicate } from "./queryTypes.ts";
+/** Sync change after host membership resolution (null = suppress for this profile). */
+export type SyncMembershipOp = "upsert" | "delete";
+export type SyncRowSnapshot = Record<string, unknown> | null | undefined;
+/**
+ * Clamp predicates that gate webhook Sync membership for a table.
+ * Empty / missing → unrestricted (all rows in the syncing table).
+ * Sync ignores clamp `order` / `search` (Read/list defaults only).
+ */
+export declare function syncClampPredicates(tableAccess: ApiTableAccess[] | undefined, table: string): Predicate[];
+export declare function documentMatchesSyncClamp(doc: Record<string, unknown> | null | undefined, predicates: Predicate[]): boolean;
+/**
+ * Resolve the outbox op for one profile after a host row mutation.
+ * See plan 046 grill lock (leave → delete; hard-delete outside clamp → suppress).
+ */
+export declare function resolveSyncMembershipOp(args: {
+    predicates: Predicate[];
+    before: SyncRowSnapshot;
+    after: SyncRowSnapshot;
+    requestedOp: SyncMembershipOp;
+}): SyncMembershipOp | null;

package/dist/syncClampMembership.js

@@ -0,0 +1,74 @@
+// packages/@columnus/shared/src/queryBetween.ts
+function matchesBetween(value, between) {
+  if (between.min != null && compareOrdered(value, between.min) < 0) return false;
+  if (between.max != null && compareOrdered(value, between.max) > 0) return false;
+  return true;
+}
+function compareOrdered(a, b) {
+  if (typeof a === "number" && typeof b === "number") return a - b;
+  if (typeof a === "string" && typeof b === "string") return a < b ? -1 : a > b ? 1 : 0;
+  if (typeof a === "bigint" && typeof b === "bigint") return a < b ? -1 : a > b ? 1 : 0;
+  if (a === b) return 0;
+  return String(a) < String(b) ? -1 : String(a) > String(b) ? 1 : 0;
+}
+
+// packages/@columnus/shared/src/queryExecution.ts
+function documentMatchesPredicates(doc, predicates) {
+  for (const predicate of predicates) {
+    if (!documentMatchesPredicate(doc, predicate)) return false;
+  }
+  return true;
+}
+function documentMatchesPredicate(doc, predicate) {
+  const value = doc[predicate.field];
+  switch (predicate.op) {
+    case "eq":
+      return value === predicate.value;
+    case "neq":
+      return value !== predicate.value;
+    case "in":
+      return predicate.value.some((candidate) => candidate === value);
+    case "gt":
+      return compareOrdered(value, predicate.value) > 0;
+    case "gte":
+      return compareOrdered(value, predicate.value) >= 0;
+    case "lt":
+      return compareOrdered(value, predicate.value) < 0;
+    case "lte":
+      return compareOrdered(value, predicate.value) <= 0;
+    case "between":
+      return matchesBetween(value, predicate.value);
+    case "containsAll":
+      return Array.isArray(value) && predicate.value.every((candidate) => value.includes(candidate));
+    default: {
+      const exhaustive = predicate;
+      return exhaustive;
+    }
+  }
+}
+
+// packages/@columnus/shared/src/syncClampMembership.ts
+function syncClampPredicates(tableAccess, table) {
+  const access = tableAccess?.find((candidate) => candidate.table === table);
+  return access?.rowQuery?.predicates ?? [];
+}
+function documentMatchesSyncClamp(doc, predicates) {
+  if (!doc) return false;
+  return documentMatchesPredicates(doc, predicates);
+}
+function resolveSyncMembershipOp(args) {
+  const { predicates, before, after, requestedOp } = args;
+  if (predicates.length === 0) return requestedOp;
+  const beforeMatch = documentMatchesSyncClamp(before, predicates);
+  const afterMatch = documentMatchesSyncClamp(after, predicates);
+  if (requestedOp === "delete") {
+    return beforeMatch ? "delete" : null;
+  }
+  if (afterMatch) return "upsert";
+  if (beforeMatch) return "delete";
+  return null;
+}
+
+export { documentMatchesSyncClamp, resolveSyncMembershipOp, syncClampPredicates };
+//# sourceMappingURL=syncClampMembership.js.map
+//# sourceMappingURL=syncClampMembership.js.map

package/dist/syncClampMembership.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/queryBetween.ts","../src/queryExecution.ts","../src/syncClampMembership.ts"],"names":[],"mappings":";AAwBO,SAAS,cAAA,CAAe,OAAgB,OAAA,EAAgC;AAC7E,EAAA,IAAI,OAAA,CAAQ,OAAO,IAAA,IAAQ,cAAA,CAAe,OAAO,OAAA,CAAQ,GAAG,CAAA,GAAI,CAAA,EAAG,OAAO,KAAA;AAC1E,EAAA,IAAI,OAAA,CAAQ,OAAO,IAAA,IAAQ,cAAA,CAAe,OAAO,OAAA,CAAQ,GAAG,CAAA,GAAI,CAAA,EAAG,OAAO,KAAA;AAC1E,EAAA,OAAO,IAAA;AACT;AAEO,SAAS,cAAA,CAAe,GAAY,CAAA,EAAoB;AAC7D,EAAA,IAAI,OAAO,CAAA,KAAM,QAAA,IAAY,OAAO,CAAA,KAAM,QAAA,SAAiB,CAAA,GAAI,CAAA;AAC/D,EAAA,IAAI,OAAO,CAAA,KAAM,QAAA,IAAY,OAAO,CAAA,KAAM,QAAA,EAAU,OAAO,CAAA,GAAI,CAAA,GAAI,EAAA,GAAK,CAAA,GAAI,CAAA,GAAI,CAAA,GAAI,CAAA;AACpF,EAAA,IAAI,OAAO,CAAA,KAAM,QAAA,IAAY,OAAO,CAAA,KAAM,QAAA,EAAU,OAAO,CAAA,GAAI,CAAA,GAAI,EAAA,GAAK,CAAA,GAAI,CAAA,GAAI,CAAA,GAAI,CAAA;AACpF,EAAA,IAAI,CAAA,KAAM,GAAG,OAAO,CAAA;AACpB,EAAA,OAAO,MAAA,CAAO,CAAC,CAAA,GAAI,MAAA,CAAO,CAAC,CAAA,GAAI,EAAA,GAAK,MAAA,CAAO,CAAC,CAAA,GAAI,MAAA,CAAO,CAAC,IAAI,CAAA,GAAI,CAAA;AAClE;;;AChCO,SAAS,yBAAA,CACd,KACA,UAAA,EACS;AACT,EAAA,KAAA,MAAW,aAAa,UAAA,EAAY;AAClC,IAAA,IAAI,CAAC,wBAAA,CAAyB,GAAA,EAAK,SAAS,GAAG,OAAO,KAAA;AAAA,EACxD;AACA,EAAA,OAAO,IAAA;AACT;AAEO,SAAS,wBAAA,CACd,KACA,SAAA,EACS;AACT,EAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,SAAA,CAAU,KAAK,CAAA;AACjC,EAAA,QAAQ,UAAU,EAAA;AAAI,IACpB,KAAK,IAAA;AACH,MAAA,OAAO,UAAU,SAAA,CAAU,KAAA;AAAA,IAC7B,KAAK,KAAA;AACH,MAAA,OAAO,UAAU,SAAA,CAAU,KAAA;AAAA,IAC7B,KAAK,IAAA;AACH,MAAA,OAAO,UAAU,KAAA,CAAM,IAAA,CAAK,CAAC,SAAA,KAAc,cAAc,KAAK,CAAA;AAAA,IAChE,KAAK,IAAA;AACH,MAAA,OAAO,cAAA,CAAe,KAAA,EAAO,SAAA,CAAU,KAAK,CAAA,GAAI,CAAA;AAAA,IAClD,KAAK,KAAA;AACH,MAAA,OAAO,cAAA,CAAe,KAAA,EAAO,SAAA,CAAU,KAAK,CAAA,IAAK,CAAA;AAAA,IACnD,KAAK,IAAA;AACH,MAAA,OAAO,cAAA,CAAe,KAAA,EAAO,SAAA,CAAU,KAAK,CAAA,GAAI,CAAA;AAAA,IAClD,KAAK,KAAA;AACH,MAAA,OAAO,cAAA,CAAe,KAAA,EAAO,SAAA,CAAU,KAAK,CAAA,IAAK,CAAA;AAAA,IACnD,KAAK,SAAA;AACH,MAAA,OAAO,cAAA,CAAe,KAAA,EAAO,SAAA,CAAU,KAAK,CAAA;AAAA,IAC9C,KAAK,aAAA;AACH,MAAA,OACE,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,IAAK,SAAA,CAAU,KAAA,CAAM,KAAA,CAAM,CAAC,SAAA,KAAc,KAAA,CAAM,QAAA,CAAS,SAAS,CAAC,CAAA;AAAA,IAE1F,SAAS;AACP,MAAA,MAAM,UAAA,GAAoB,SAAA;AAC1B,MAAA,OAAO,UAAA;AAAA,IACT;AAAA;AAEJ;;;AC/BO,SAAS,mBAAA,CACd,aACA,KAAA,EACa;AACb,EAAA,MAAM,SAAS,WAAA,EAAa,IAAA,CAAK,CAAC,SAAA,KAAc,SAAA,CAAU,UAAU,KAAK,CAAA;AACzE,EAAA,OAAO,MAAA,EAAQ,QAAA,EAAU,UAAA,IAAc,EAAC;AAC1C;AAEO,SAAS,wBAAA,CACd,KACA,UAAA,EACS;AACT,EAAA,IAAI,CAAC,KAAK,OAAO,KAAA;AACjB,EAAA,OAAO,yBAAA,CAA0B,KAAK,UAAU,CAAA;AAClD;AAMO,SAAS,wBAAwB,IAAA,EAKZ;AAC1B,EAAA,MAAM,EAAE,UAAA,EAAY,MAAA,EAAQ,KAAA,EAAO,aAAY,GAAI,IAAA;AACnD,EAAA,IAAI,UAAA,CAAW,MAAA,KAAW,CAAA,EAAG,OAAO,WAAA;AAEpC,EAAA,MAAM,WAAA,GAAc,wBAAA,CAAyB,MAAA,EAAQ,UAAU,CAAA;AAC/D,EAAA,MAAM,UAAA,GAAa,wBAAA,CAAyB,KAAA,EAAO,UAAU,CAAA;AAE7D,EAAA,IAAI,gBAAgB,QAAA,EAAU;AAC5B,IAAA,OAAO,cAAc,QAAA,GAAW,IAAA;AAAA,EAClC;AAEA,EAAA,IAAI,YAAY,OAAO,QAAA;AACvB,EAAA,IAAI,aAAa,OAAO,QAAA;AACxB,EAAA,OAAO,IAAA;AACT","file":"syncClampMembership.js","sourcesContent":["export type BetweenValue = {\n  min: unknown;\n  max: unknown;\n};\n\nexport type BetweenIndexBound =\n  | { op: \"gte\"; value: unknown }\n  | { op: \"lte\"; value: unknown }\n  | { op: \"between\"; min: unknown; max: unknown };\n\nexport function isCompleteBetween(value: BetweenValue): boolean {\n  return value.min != null && value.max != null;\n}\n\n/** Convert inclusive `between` UI state into the strongest available index range. */\nexport function betweenToIndexBound(value: BetweenValue): BetweenIndexBound | null {\n  if (isCompleteBetween(value)) {\n    return { op: \"between\", min: value.min, max: value.max };\n  }\n  if (value.min != null) return { op: \"gte\", value: value.min };\n  if (value.max != null) return { op: \"lte\", value: value.max };\n  return null;\n}\n\nexport function matchesBetween(value: unknown, between: BetweenValue): boolean {\n  if (between.min != null && compareOrdered(value, between.min) < 0) return false;\n  if (between.max != null && compareOrdered(value, between.max) > 0) return false;\n  return true;\n}\n\nexport function compareOrdered(a: unknown, b: unknown): number {\n  if (typeof a === \"number\" && typeof b === \"number\") return a - b;\n  if (typeof a === \"string\" && typeof b === \"string\") return a < b ? -1 : a > b ? 1 : 0;\n  if (typeof a === \"bigint\" && typeof b === \"bigint\") return a < b ? -1 : a > b ? 1 : 0;\n  if (a === b) return 0;\n  return String(a) < String(b) ? -1 : String(a) > String(b) ? 1 : 0;\n}\n","import { compareOrdered, matchesBetween } from \"./queryBetween.ts\";\nimport type { Predicate, QueryOrder } from \"./queryTypes.ts\";\n\n/** Evaluate residual predicates against a document. */\nexport function documentMatchesPredicates(\n  doc: Record<string, unknown>,\n  predicates: Predicate[],\n): boolean {\n  for (const predicate of predicates) {\n    if (!documentMatchesPredicate(doc, predicate)) return false;\n  }\n  return true;\n}\n\nexport function documentMatchesPredicate(\n  doc: Record<string, unknown>,\n  predicate: Predicate,\n): boolean {\n  const value = doc[predicate.field];\n  switch (predicate.op) {\n    case \"eq\":\n      return value === predicate.value;\n    case \"neq\":\n      return value !== predicate.value;\n    case \"in\":\n      return predicate.value.some((candidate) => candidate === value);\n    case \"gt\":\n      return compareOrdered(value, predicate.value) > 0;\n    case \"gte\":\n      return compareOrdered(value, predicate.value) >= 0;\n    case \"lt\":\n      return compareOrdered(value, predicate.value) < 0;\n    case \"lte\":\n      return compareOrdered(value, predicate.value) <= 0;\n    case \"between\":\n      return matchesBetween(value, predicate.value);\n    case \"containsAll\":\n      return (\n        Array.isArray(value) && predicate.value.every((candidate) => value.includes(candidate))\n      );\n    default: {\n      const exhaustive: never = predicate;\n      return exhaustive;\n    }\n  }\n}\n\nexport function sortDocuments<T extends Record<string, unknown>>(\n  docs: T[],\n  order: QueryOrder,\n): T[] {\n  const direction = order.direction === \"desc\" ? -1 : 1;\n  return [...docs].sort(\n    (left, right) => direction * compareOrdered(left[order.field], right[order.field]),\n  );\n}\n","import type { ApiTableAccess } from \"./apiProfile.ts\";\nimport { documentMatchesPredicates } from \"./queryExecution.ts\";\nimport type { Predicate } from \"./queryTypes.ts\";\n\n/** Sync change after host membership resolution (null = suppress for this profile). */\nexport type SyncMembershipOp = \"upsert\" | \"delete\";\n\nexport type SyncRowSnapshot = Record<string, unknown> | null | undefined;\n\n/**\n * Clamp predicates that gate webhook Sync membership for a table.\n * Empty / missing → unrestricted (all rows in the syncing table).\n * Sync ignores clamp `order` / `search` (Read/list defaults only).\n */\nexport function syncClampPredicates(\n  tableAccess: ApiTableAccess[] | undefined,\n  table: string,\n): Predicate[] {\n  const access = tableAccess?.find((candidate) => candidate.table === table);\n  return access?.rowQuery?.predicates ?? [];\n}\n\nexport function documentMatchesSyncClamp(\n  doc: Record<string, unknown> | null | undefined,\n  predicates: Predicate[],\n): boolean {\n  if (!doc) return false;\n  return documentMatchesPredicates(doc, predicates);\n}\n\n/**\n * Resolve the outbox op for one profile after a host row mutation.\n * See plan 046 grill lock (leave → delete; hard-delete outside clamp → suppress).\n */\nexport function resolveSyncMembershipOp(args: {\n  predicates: Predicate[];\n  before: SyncRowSnapshot;\n  after: SyncRowSnapshot;\n  requestedOp: SyncMembershipOp;\n}): SyncMembershipOp | null {\n  const { predicates, before, after, requestedOp } = args;\n  if (predicates.length === 0) return requestedOp;\n\n  const beforeMatch = documentMatchesSyncClamp(before, predicates);\n  const afterMatch = documentMatchesSyncClamp(after, predicates);\n\n  if (requestedOp === \"delete\") {\n    return beforeMatch ? \"delete\" : null;\n  }\n\n  if (afterMatch) return \"upsert\";\n  if (beforeMatch) return \"delete\";\n  return null;\n}\n"]}

package/dist/tenantHosts.d.ts

@@ -0,0 +1,30 @@
+/** Reserved first labels under `*.columnus.app` / `*.columnus.localhost` — not tenants. */
+export declare const RESERVED_TENANT_SLUGS: readonly ["manage", "deploy", "www"];
+/** Lowercase slug: letters/digits with optional hyphen segments (e.g. `app`, `acme-prod`). */
+export declare const TENANT_SLUG_RE: RegExp;
+export declare function isReservedTenantSlug(slug: string): boolean;
+export declare function isValidTenantSlug(slug: string): boolean;
+/** Strip optional port from a Host header or `window.location.host` value. */
+export declare function hostnameFromHostHeader(host: string): string;
+/**
+ * Extract tenant slug from a hostname.
+ * Supports `{slug}.columnus.app` and `{slug}.columnus.localhost`.
+ * Returns null for apex, reserved, invalid, or unrecognized hosts.
+ */
+export declare function tenantSlugFromHost(host: string): string | null;
+export type TenantPublicHostEnv = "prod" | "local";
+/** Public hostname for a tenant slug (no scheme). */
+export declare function tenantPublicHost(slug: string, env?: TenantPublicHostEnv): string;
+/** Preview tenant slug: `preview-<label>` (e.g. `preview-12`). */
+export declare const PREVIEW_TENANT_SLUG_RE: RegExp;
+export declare function isValidPreviewTenantSlug(slug: string): boolean;
+/**
+ * Extract preview tenant slug from hostname (`preview-12.columnus.app`).
+ * Returns null for non-preview or invalid hosts.
+ */
+export declare function previewSlugFromHost(host: string): string | null;
+/**
+ * Resolve either a standard tenant slug or a registered preview slug from a host.
+ * Does not check Management DB — only host shape.
+ */
+export declare function anyTenantSlugFromHost(host: string): string | null;

package/dist/tenantHosts.js

@@ -0,0 +1,60 @@
+// packages/@columnus/shared/src/tenantHosts.ts
+var RESERVED_TENANT_SLUGS = ["manage", "deploy", "www"];
+var RESERVED_SLUG_SET = new Set(RESERVED_TENANT_SLUGS);
+var TENANT_SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+function isReservedTenantSlug(slug) {
+  const normalized = slug.trim().toLowerCase();
+  if (!normalized) return true;
+  if (RESERVED_SLUG_SET.has(normalized)) return true;
+  if (normalized.startsWith("preview-")) return true;
+  return false;
+}
+function isValidTenantSlug(slug) {
+  const trimmed = slug.trim();
+  if (!TENANT_SLUG_RE.test(trimmed)) return false;
+  return !isReservedTenantSlug(trimmed);
+}
+function hostnameFromHostHeader(host) {
+  const trimmed = host.trim().toLowerCase();
+  if (!trimmed) return "";
+  if (trimmed.startsWith("[")) {
+    const end = trimmed.indexOf("]");
+    return end === -1 ? trimmed : trimmed.slice(1, end);
+  }
+  const colon = trimmed.lastIndexOf(":");
+  if (colon > -1 && /^\d+$/.test(trimmed.slice(colon + 1))) {
+    return trimmed.slice(0, colon);
+  }
+  return trimmed;
+}
+function tenantSlugFromHost(host) {
+  const hostname = hostnameFromHostHeader(host);
+  const match = hostname.match(/^([a-z0-9-]+)\.columnus\.(app|localhost)$/);
+  if (!match) return null;
+  const slug = match[1];
+  if (!slug || !isValidTenantSlug(slug)) return null;
+  return slug;
+}
+function tenantPublicHost(slug, env = "prod") {
+  const normalized = slug.trim().toLowerCase();
+  return env === "local" ? `${normalized}.columnus.localhost` : `${normalized}.columnus.app`;
+}
+var PREVIEW_TENANT_SLUG_RE = /^preview-[a-z0-9]+(?:-[a-z0-9]+)*$/;
+function isValidPreviewTenantSlug(slug) {
+  return PREVIEW_TENANT_SLUG_RE.test(slug.trim().toLowerCase());
+}
+function previewSlugFromHost(host) {
+  const hostname = hostnameFromHostHeader(host);
+  const match = hostname.match(/^(preview-[a-z0-9-]+)\.columnus\.(app|localhost)$/);
+  if (!match) return null;
+  const slug = match[1];
+  if (!slug || !isValidPreviewTenantSlug(slug)) return null;
+  return slug;
+}
+function anyTenantSlugFromHost(host) {
+  return tenantSlugFromHost(host) ?? previewSlugFromHost(host);
+}
+
+export { PREVIEW_TENANT_SLUG_RE, RESERVED_TENANT_SLUGS, TENANT_SLUG_RE, anyTenantSlugFromHost, hostnameFromHostHeader, isReservedTenantSlug, isValidPreviewTenantSlug, isValidTenantSlug, previewSlugFromHost, tenantPublicHost, tenantSlugFromHost };
+//# sourceMappingURL=tenantHosts.js.map
+//# sourceMappingURL=tenantHosts.js.map

package/dist/tenantHosts.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/tenantHosts.ts"],"names":[],"mappings":";AACO,IAAM,qBAAA,GAAwB,CAAC,QAAA,EAAU,QAAA,EAAU,KAAK;AAE/D,IAAM,iBAAA,GAAoB,IAAI,GAAA,CAAY,qBAAqB,CAAA;AAGxD,IAAM,cAAA,GAAiB;AAEvB,SAAS,qBAAqB,IAAA,EAAuB;AAC1D,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,IAAA,EAAK,CAAE,WAAA,EAAY;AAC3C,EAAA,IAAI,CAAC,YAAY,OAAO,IAAA;AACxB,EAAA,IAAI,iBAAA,CAAkB,GAAA,CAAI,UAAU,CAAA,EAAG,OAAO,IAAA;AAC9C,EAAA,IAAI,UAAA,CAAW,UAAA,CAAW,UAAU,CAAA,EAAG,OAAO,IAAA;AAC9C,EAAA,OAAO,KAAA;AACT;AAEO,SAAS,kBAAkB,IAAA,EAAuB;AACvD,EAAA,MAAM,OAAA,GAAU,KAAK,IAAA,EAAK;AAE1B,EAAA,IAAI,CAAC,cAAA,CAAe,IAAA,CAAK,OAAO,GAAG,OAAO,KAAA;AAC1C,EAAA,OAAO,CAAC,qBAAqB,OAAO,CAAA;AACtC;AAGO,SAAS,uBAAuB,IAAA,EAAsB;AAC3D,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,IAAA,EAAK,CAAE,WAAA,EAAY;AACxC,EAAA,IAAI,CAAC,SAAS,OAAO,EAAA;AAErB,EAAA,IAAI,OAAA,CAAQ,UAAA,CAAW,GAAG,CAAA,EAAG;AAC3B,IAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,OAAA,CAAQ,GAAG,CAAA;AAC/B,IAAA,OAAO,QAAQ,EAAA,GAAK,OAAA,GAAU,OAAA,CAAQ,KAAA,CAAM,GAAG,GAAG,CAAA;AAAA,EACpD;AACA,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,WAAA,CAAY,GAAG,CAAA;AACrC,EAAA,IAAI,KAAA,GAAQ,MAAM,OAAA,CAAQ,IAAA,CAAK,QAAQ,KAAA,CAAM,KAAA,GAAQ,CAAC,CAAC,CAAA,EAAG;AACxD,IAAA,OAAO,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAG,KAAK,CAAA;AAAA,EAC/B;AACA,EAAA,OAAO,OAAA;AACT;AAOO,SAAS,mBAAmB,IAAA,EAA6B;AAC9D,EAAA,MAAM,QAAA,GAAW,uBAAuB,IAAI,CAAA;AAC5C,EAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,KAAA,CAAM,2CAA2C,CAAA;AACxE,EAAA,IAAI,CAAC,OAAO,OAAO,IAAA;AACnB,EAAA,MAAM,IAAA,GAAO,MAAM,CAAC,CAAA;AACpB,EAAA,IAAI,CAAC,IAAA,IAAQ,CAAC,iBAAA,CAAkB,IAAI,GAAG,OAAO,IAAA;AAC9C,EAAA,OAAO,IAAA;AACT;AAKO,SAAS,gBAAA,CAAiB,IAAA,EAAc,GAAA,GAA2B,MAAA,EAAgB;AACxF,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,IAAA,EAAK,CAAE,WAAA,EAAY;AAC3C,EAAA,OAAO,QAAQ,OAAA,GAAU,CAAA,EAAG,UAAU,CAAA,mBAAA,CAAA,GAAwB,GAAG,UAAU,CAAA,aAAA,CAAA;AAC7E;AAGO,IAAM,sBAAA,GAAyB;AAE/B,SAAS,yBAAyB,IAAA,EAAuB;AAC9D,EAAA,OAAO,uBAAuB,IAAA,CAAK,IAAA,CAAK,IAAA,EAAK,CAAE,aAAa,CAAA;AAC9D;AAMO,SAAS,oBAAoB,IAAA,EAA6B;AAC/D,EAAA,MAAM,QAAA,GAAW,uBAAuB,IAAI,CAAA;AAC5C,EAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,KAAA,CAAM,mDAAmD,CAAA;AAChF,EAAA,IAAI,CAAC,OAAO,OAAO,IAAA;AACnB,EAAA,MAAM,IAAA,GAAO,MAAM,CAAC,CAAA;AACpB,EAAA,IAAI,CAAC,IAAA,IAAQ,CAAC,wBAAA,CAAyB,IAAI,GAAG,OAAO,IAAA;AACrD,EAAA,OAAO,IAAA;AACT;AAMO,SAAS,sBAAsB,IAAA,EAA6B;AACjE,EAAA,OAAO,kBAAA,CAAmB,IAAI,CAAA,IAAK,mBAAA,CAAoB,IAAI,CAAA;AAC7D","file":"tenantHosts.js","sourcesContent":["/** Reserved first labels under `*.columnus.app` / `*.columnus.localhost` — not tenants. */\nexport const RESERVED_TENANT_SLUGS = [\"manage\", \"deploy\", \"www\"] as const;\n\nconst RESERVED_SLUG_SET = new Set<string>(RESERVED_TENANT_SLUGS);\n\n/** Lowercase slug: letters/digits with optional hyphen segments (e.g. `app`, `acme-prod`). */\nexport const TENANT_SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;\n\nexport function isReservedTenantSlug(slug: string): boolean {\n  const normalized = slug.trim().toLowerCase();\n  if (!normalized) return true;\n  if (RESERVED_SLUG_SET.has(normalized)) return true;\n  if (normalized.startsWith(\"preview-\")) return true;\n  return false;\n}\n\nexport function isValidTenantSlug(slug: string): boolean {\n  const trimmed = slug.trim();\n  // Require already-lowercase slugs (hosts are normalized before parse).\n  if (!TENANT_SLUG_RE.test(trimmed)) return false;\n  return !isReservedTenantSlug(trimmed);\n}\n\n/** Strip optional port from a Host header or `window.location.host` value. */\nexport function hostnameFromHostHeader(host: string): string {\n  const trimmed = host.trim().toLowerCase();\n  if (!trimmed) return \"\";\n  // IPv6 bracket form is not used for tenant hosts; strip :port for hostname:port.\n  if (trimmed.startsWith(\"[\")) {\n    const end = trimmed.indexOf(\"]\");\n    return end === -1 ? trimmed : trimmed.slice(1, end);\n  }\n  const colon = trimmed.lastIndexOf(\":\");\n  if (colon > -1 && /^\\d+$/.test(trimmed.slice(colon + 1))) {\n    return trimmed.slice(0, colon);\n  }\n  return trimmed;\n}\n\n/**\n * Extract tenant slug from a hostname.\n * Supports `{slug}.columnus.app` and `{slug}.columnus.localhost`.\n * Returns null for apex, reserved, invalid, or unrecognized hosts.\n */\nexport function tenantSlugFromHost(host: string): string | null {\n  const hostname = hostnameFromHostHeader(host);\n  const match = hostname.match(/^([a-z0-9-]+)\\.columnus\\.(app|localhost)$/);\n  if (!match) return null;\n  const slug = match[1];\n  if (!slug || !isValidTenantSlug(slug)) return null;\n  return slug;\n}\n\nexport type TenantPublicHostEnv = \"prod\" | \"local\";\n\n/** Public hostname for a tenant slug (no scheme). */\nexport function tenantPublicHost(slug: string, env: TenantPublicHostEnv = \"prod\"): string {\n  const normalized = slug.trim().toLowerCase();\n  return env === \"local\" ? `${normalized}.columnus.localhost` : `${normalized}.columnus.app`;\n}\n\n/** Preview tenant slug: `preview-<label>` (e.g. `preview-12`). */\nexport const PREVIEW_TENANT_SLUG_RE = /^preview-[a-z0-9]+(?:-[a-z0-9]+)*$/;\n\nexport function isValidPreviewTenantSlug(slug: string): boolean {\n  return PREVIEW_TENANT_SLUG_RE.test(slug.trim().toLowerCase());\n}\n\n/**\n * Extract preview tenant slug from hostname (`preview-12.columnus.app`).\n * Returns null for non-preview or invalid hosts.\n */\nexport function previewSlugFromHost(host: string): string | null {\n  const hostname = hostnameFromHostHeader(host);\n  const match = hostname.match(/^(preview-[a-z0-9-]+)\\.columnus\\.(app|localhost)$/);\n  if (!match) return null;\n  const slug = match[1];\n  if (!slug || !isValidPreviewTenantSlug(slug)) return null;\n  return slug;\n}\n\n/**\n * Resolve either a standard tenant slug or a registered preview slug from a host.\n * Does not check Management DB — only host shape.\n */\nexport function anyTenantSlugFromHost(host: string): string | null {\n  return tenantSlugFromHost(host) ?? previewSlugFromHost(host);\n}\n"]}

package/dist/tenantSecretsCrypto.d.ts

@@ -0,0 +1,31 @@
+/**
+ * App-level encryption for management-plane tenant secrets (deploy keys).
+ * AES-256-GCM, random 12-byte IV, version byte prefix in the ciphertext blob.
+ *
+ * KEK: set `TENANT_SECRETS_KEK` on the management Convex deployment to 32 raw
+ * bytes encoded as standard/base64url base64 or 64-char hex
+ * (`openssl rand -base64 32`).
+ */
+export declare const TENANT_SECRETS_KEK_ENV = "TENANT_SECRETS_KEK";
+/** Ciphertext format / algorithm version (stored as first byte + `keyVersion`). */
+export declare const TENANT_SECRET_CRYPTO_VERSION = 1;
+export type EncryptedTenantSecret = {
+    /** base64url(version || iv || ciphertext+tag) */
+    ciphertext: string;
+    keyVersion: number;
+};
+type ProcessEnvLike = Record<string, string | undefined>;
+/** Parse a 32-byte KEK from base64, base64url, or hex. */
+export declare function parseTenantSecretsKek(raw: string): Uint8Array;
+export declare function readTenantSecretsKekFromEnv(env: ProcessEnvLike): Uint8Array;
+/**
+ * Encrypt a tenant secret (e.g. Convex deploy key).
+ * Returns opaque ciphertext for `tenant_secrets.convexDeployKeyCiphertext`
+ * and `keyVersion` for the schema column.
+ */
+export declare function encryptTenantSecret(plaintext: string, kek: Uint8Array): Promise<EncryptedTenantSecret>;
+/** Decrypt a blob produced by {@link encryptTenantSecret}. */
+export declare function decryptTenantSecret(ciphertext: string, kek: Uint8Array): Promise<string>;
+/** Generate a new KEK suitable for `TENANT_SECRETS_KEK` (base64). */
+export declare function generateTenantSecretsKekBase64(): string;
+export {};