@elevasis/core 0.7.1 → 0.8.2

package/src/_gen/__tests__/scaffold-contracts.test.ts

@@ -1,53 +1,64 @@
-/**
- * Snapshot test for the scaffold-contracts generator wrapper.
- *
- * Calls generate() (which runs the real script) and asserts:
- * 1. The output file exists and has content.
- * 2. The content matches the stored snapshot (drift detection).
- *
- * If the snapshot is missing it is created on first run. Subsequent runs fail
- * if the output changes without an intentional snapshot update.
- */
-
+/**
+ * Snapshot test for the scaffold-contracts generator wrapper.
+ *
+ * Calls generate() (which runs the real script) and asserts:
+ * 1. The output file exists and has content.
+ * 2. The content matches the stored snapshot (drift detection).
+ *
+ * If the snapshot is missing it is created on first run. Subsequent runs fail
+ * if the output changes without an intentional snapshot update.
+ */
+
 import { readFileSync } from 'node:fs'
 import { resolve } from 'node:path'
 import { describe, it, expect } from 'vitest'
-
-/** Monorepo root relative to packages/core/src/_gen/__tests__/ */
+
+/** Monorepo root relative to packages/core/src/_gen/__tests__/ */
 const ROOT = resolve(import.meta.dirname, '..', '..', '..', '..', '..')
 
 const OUTPUT_PATH = resolve(ROOT, 'packages/core/src/reference/_generated/contracts.md')
+const SNAPSHOT_PATH = resolve(import.meta.dirname, '__snapshots__', 'contracts.md.snap')
 
+function normalizeSnapshotContent(content: string) {
+  return content
+    .replace(/\r\n/g, '\n')
+    .replace(
+      /<!-- Auto-generated on \d{4}-\d{2}-\d{2} by scripts\/monorepo\/generate-scaffold-contracts\.js -->/,
+      '<!-- Auto-generated on YYYY-MM-DD by scripts/monorepo/generate-scaffold-contracts.js -->'
+    )
+}
+
 describe('scaffold-contracts generator', () => {
-  it('output file exists and has content', () => {
-    // The generator must have been run (either manually or by CI gen step).
-    // This test validates the committed artifact — it does NOT re-run the generator
-    // so the test suite stays fast and deterministic.
+  it('output file exists and has content', () => {
+    // The generator must have been run (either manually or by CI gen step).
+    // This test validates the committed artifact — it does NOT re-run the generator
+    // so the test suite stays fast and deterministic.
+    let content: string
+    try {
+      content = readFileSync(OUTPUT_PATH, 'utf8')
+    } catch {
+      throw new Error(
+        `Generated file not found: ${OUTPUT_PATH}\n` +
+          `Run "pnpm scaffold:generate" or "node scripts/monorepo/generate-scaffold-contracts.js" first.`
+      )
+    }
+
+    expect(content.length).toBeGreaterThan(0)
+  })
+
+  it('output file matches stored snapshot', () => {
     let content: string
     try {
       content = readFileSync(OUTPUT_PATH, 'utf8')
-    } catch {
-      throw new Error(
-        `Generated file not found: ${OUTPUT_PATH}\n` +
-          `Run "pnpm scaffold:generate" or "node scripts/monorepo/generate-scaffold-contracts.js" first.`
+    } catch {
+      throw new Error(
+        `Generated file not found: ${OUTPUT_PATH}\n` +
+        `Run "pnpm scaffold:generate" first to produce the artifact before snapshotting.`
       )
     }
 
-    expect(content.length).toBeGreaterThan(0)
-  })
-
-  it('output file matches stored snapshot', async () => {
-    let content: string
-    try {
-      content = readFileSync(OUTPUT_PATH, 'utf8')
-    } catch {
-      throw new Error(
-        `Generated file not found: ${OUTPUT_PATH}\n` +
-          `Run "pnpm scaffold:generate" first to produce the artifact before snapshotting.`
-      )
-    }
+    const snapshot = readFileSync(SNAPSHOT_PATH, 'utf8')
 
-    // Snapshot stored alongside test file in __snapshots__/
-    await expect(content).toMatchFileSnapshot(resolve(import.meta.dirname, '__snapshots__', 'contracts.md.snap'))
+    expect(normalizeSnapshotContent(content)).toBe(normalizeSnapshotContent(snapshot))
   })
 })

package/src/_gen/scaffold-contracts.ts

@@ -1,45 +1,45 @@
-/**
- * Thin _gen/ wrapper for the scaffold-contracts generator.
- *
- * The actual generation logic lives in scripts/monorepo/generate-scaffold-contracts.js.
- * This wrapper provides the canonical generate() entry point so the generator
- * participates in the @repo/gen-utils pattern (snapshot tests, drift detection,
- * Turbo gen task).
- *
- * DO NOT move logic here — edit the script instead, then re-run generate().
- */
-
-import { spawnSync } from 'node:child_process'
-import { fileURLToPath } from 'node:url'
-import { resolve, dirname } from 'node:path'
-
-const __filename = fileURLToPath(import.meta.url)
-const __dirname = dirname(__filename)
-
-/** Monorepo root — four levels up from packages/core/src/_gen/ */
-const ROOT = resolve(__dirname, '..', '..', '..', '..')
-
-/**
- * Run the scaffold-contracts generator.
- * Delegates to scripts/monorepo/generate-scaffold-contracts.js via child process
- * so the existing script is the single source of implementation.
- */
-export function generate(): void {
-  const result = spawnSync('node', ['scripts/monorepo/generate-scaffold-contracts.js'], {
-    stdio: 'inherit',
-    cwd: ROOT
-  })
-
-  if (result.error) {
-    throw new Error(`scaffold-contracts generator failed to spawn: ${result.error.message}`)
-  }
-
-  if (result.status !== 0) {
-    throw new Error(`scaffold-contracts generator exited with status ${result.status}`)
-  }
-}
-
-// Allow direct invocation: node packages/core/src/_gen/scaffold-contracts.ts
-if (process.argv[1] && resolve(process.argv[1]) === __filename) {
-  generate()
-}
+/**
+ * Thin _gen/ wrapper for the scaffold-contracts generator.
+ *
+ * The actual generation logic lives in scripts/monorepo/generate-scaffold-contracts.js.
+ * This wrapper provides the canonical generate() entry point so the generator
+ * participates in the @repo/gen-utils pattern (snapshot tests, drift detection,
+ * Turbo gen task).
+ *
+ * DO NOT move logic here — edit the script instead, then re-run generate().
+ */
+
+import { spawnSync } from 'node:child_process'
+import { fileURLToPath } from 'node:url'
+import { resolve, dirname } from 'node:path'
+
+const __filename = fileURLToPath(import.meta.url)
+const __dirname = dirname(__filename)
+
+/** Monorepo root — four levels up from packages/core/src/_gen/ */
+const ROOT = resolve(__dirname, '..', '..', '..', '..')
+
+/**
+ * Run the scaffold-contracts generator.
+ * Delegates to scripts/monorepo/generate-scaffold-contracts.js via child process
+ * so the existing script is the single source of implementation.
+ */
+export function generate(): void {
+  const result = spawnSync('node', ['scripts/monorepo/generate-scaffold-contracts.js'], {
+    stdio: 'inherit',
+    cwd: ROOT
+  })
+
+  if (result.error) {
+    throw new Error(`scaffold-contracts generator failed to spawn: ${result.error.message}`)
+  }
+
+  if (result.status !== 0) {
+    throw new Error(`scaffold-contracts generator exited with status ${result.status}`)
+  }
+}
+
+// Allow direct invocation: node packages/core/src/_gen/scaffold-contracts.ts
+if (process.argv[1] && resolve(process.argv[1]) === __filename) {
+  generate()
+}

package/src/auth/multi-tenancy/credentials/README.md

@@ -1,38 +1,38 @@
-# Credentials Module
-
-Organization credentials management with AES-256-GCM encryption.
-
-## Import Patterns
-
-### Server/Backend (API)
-```typescript
-// Import server-side functions (uses Node.js crypto and process.env)
-import {
-  prepareCredentialForInsert,
-  decryptCredentialValue,
-  encryptCredential,
-  decryptCredential,
-  type CreateCredentialParams
-} from '@elevasis/core/server'
-```
-
-### Browser/Frontend
-
-Credential encryption helpers are server-only. Browser code should not import this module or its helper types directly.
-
-## Architecture
-
-- **`index.ts`**: Type-only re-exports for internal source usage
-- **`server.ts`**: Server-only exports (encryption functions, service helpers)
-- **`encryption.ts`**: AES-256-GCM encryption/decryption (Node.js only)
-- **`service.ts`**: Helper functions for credential operations (Node.js only)
-
-## Published Surface Note
-
-This directory is source-adjacent. Published app code should import credential helpers from `@elevasis/core/server`, while browser-safe code should treat credentials as an internal server concern.
-
-## Why the Split?
-
-The encryption module uses Node.js `crypto` and `process.env`, which don't exist in the browser.
-By separating server-only exports into `@elevasis/core/server`, we prevent these Node.js dependencies
-from being bundled into the browser application.
+# Credentials Module
+
+Organization credentials management with AES-256-GCM encryption.
+
+## Import Patterns
+
+### Server/Backend (API)
+```typescript
+// Import server-side functions (uses Node.js crypto and process.env)
+import {
+  prepareCredentialForInsert,
+  decryptCredentialValue,
+  encryptCredential,
+  decryptCredential,
+  type CreateCredentialParams
+} from '@elevasis/core/server'
+```
+
+### Browser/Frontend
+
+Credential encryption helpers are server-only. Browser code should not import this module or its helper types directly.
+
+## Architecture
+
+- **`index.ts`**: Type-only re-exports for internal source usage
+- **`server.ts`**: Server-only exports (encryption functions, service helpers)
+- **`encryption.ts`**: AES-256-GCM encryption/decryption (Node.js only)
+- **`service.ts`**: Helper functions for credential operations (Node.js only)
+
+## Published Surface Note
+
+This directory is source-adjacent. Published app code should import credential helpers from `@elevasis/core/server`, while browser-safe code should treat credentials as an internal server concern.
+
+## Why the Split?
+
+The encryption module uses Node.js `crypto` and `process.env`, which don't exist in the browser.
+By separating server-only exports into `@elevasis/core/server`, we prevent these Node.js dependencies
+from being bundled into the browser application.

package/src/auth/multi-tenancy/credentials/index.ts

@@ -1,6 +1,6 @@
-// NOTE: Server-side code in ./server/ is intentionally NOT exported here
-// Encryption/decryption and server-side credential helpers should ONLY be used in API
-// Browser imports of @repo/core should not pull in Node.js crypto
-
-// Only export types that are safe for browser use
-export type { CreateCredentialParams, CredentialMetadata } from './server/service'
+// NOTE: Server-side code in ./server/ is intentionally NOT exported here
+// Encryption/decryption and server-side credential helpers should ONLY be used in API
+// Browser imports of @repo/core should not pull in Node.js crypto
+
+// Only export types that are safe for browser use
+export type { CreateCredentialParams, CredentialMetadata } from './server/service'

package/src/auth/multi-tenancy/credentials/server/encryption.ts

@@ -1,39 +1,39 @@
-import crypto from 'crypto'
-
-const MASTER_KEY = process.env.SECRETS_ENCRYPTION_KEY
-const ALGORITHM = 'aes-256-gcm'
-
-interface EncryptedData {
-  iv: string
-  authTag: string
-  data: string
-}
-
-export function encryptCredential(plaintext: string): string {
-  if (!MASTER_KEY) {
-    throw new Error('SECRETS_ENCRYPTION_KEY not configured')
-  }
-
-  const iv = crypto.randomBytes(16)
-  const cipher = crypto.createCipheriv(ALGORITHM, Buffer.from(MASTER_KEY, 'hex'), iv)
-  const encrypted = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()])
-  const authTag = cipher.getAuthTag()
-
-  return JSON.stringify({
-    iv: iv.toString('base64'),
-    authTag: authTag.toString('base64'),
-    data: encrypted.toString('base64')
-  })
-}
-
-export function decryptCredential(encrypted: string): string {
-  if (!MASTER_KEY) {
-    throw new Error('SECRETS_ENCRYPTION_KEY not configured')
-  }
-
-  const { iv, authTag, data } = JSON.parse(encrypted) as EncryptedData
-  const decipher = crypto.createDecipheriv(ALGORITHM, Buffer.from(MASTER_KEY, 'hex'), Buffer.from(iv, 'base64'))
-  decipher.setAuthTag(Buffer.from(authTag, 'base64'))
-
-  return Buffer.concat([decipher.update(Buffer.from(data, 'base64')), decipher.final()]).toString('utf8')
-}
+import crypto from 'crypto'
+
+const MASTER_KEY = process.env.SECRETS_ENCRYPTION_KEY
+const ALGORITHM = 'aes-256-gcm'
+
+interface EncryptedData {
+  iv: string
+  authTag: string
+  data: string
+}
+
+export function encryptCredential(plaintext: string): string {
+  if (!MASTER_KEY) {
+    throw new Error('SECRETS_ENCRYPTION_KEY not configured')
+  }
+
+  const iv = crypto.randomBytes(16)
+  const cipher = crypto.createCipheriv(ALGORITHM, Buffer.from(MASTER_KEY, 'hex'), iv)
+  const encrypted = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()])
+  const authTag = cipher.getAuthTag()
+
+  return JSON.stringify({
+    iv: iv.toString('base64'),
+    authTag: authTag.toString('base64'),
+    data: encrypted.toString('base64')
+  })
+}
+
+export function decryptCredential(encrypted: string): string {
+  if (!MASTER_KEY) {
+    throw new Error('SECRETS_ENCRYPTION_KEY not configured')
+  }
+
+  const { iv, authTag, data } = JSON.parse(encrypted) as EncryptedData
+  const decipher = crypto.createDecipheriv(ALGORITHM, Buffer.from(MASTER_KEY, 'hex'), Buffer.from(iv, 'base64'))
+  decipher.setAuthTag(Buffer.from(authTag, 'base64'))
+
+  return Buffer.concat([decipher.update(Buffer.from(data, 'base64')), decipher.final()]).toString('utf8')
+}

package/src/auth/multi-tenancy/credentials/server/service.ts

@@ -1,60 +1,60 @@
-import type { Database } from '../../../../supabase/database.types'
-import { encryptCredential, decryptCredential } from './encryption'
-
-type CredentialInsert = Database['public']['Tables']['credentials']['Insert']
-type CredentialRow = Database['public']['Tables']['credentials']['Row']
-
-export interface CreateCredentialParams {
-  organizationId: string
-  name: string
-  type: string
-  value: Record<string, unknown>
-  createdBy: string | null
-  provider?: string // OAuth provider ID ('dropbox', 'notion', 'google-sheets')
-}
-
-export interface CredentialMetadata {
-  id: string
-  name: string
-  type: string
-  provider?: string // OAuth provider ID or undefined for non-OAuth
-  createdAt: string
-}
-
-/**
- * Prepare credential data for insertion (encrypts the value)
- */
-export function prepareCredentialForInsert(
-  params: CreateCredentialParams
-): Omit<CredentialInsert, 'id' | 'created_at' | 'updated_at'> {
-  const encrypted = encryptCredential(JSON.stringify(params.value))
-
-  return {
-    organization_id: params.organizationId,
-    name: params.name,
-    type: params.type,
-    encrypted_value: encrypted,
-    created_by: params.createdBy,
-    provider: params.provider ?? null // Store provider or null for non-OAuth
-  }
-}
-
-/**
- * Decrypt credential value from database row
- */
-export function decryptCredentialValue(encryptedValue: string): Record<string, unknown> {
-  return JSON.parse(decryptCredential(encryptedValue))
-}
-
-/**
- * Transform database row to metadata (without decrypted value)
- */
-export function transformToMetadata(row: CredentialRow): CredentialMetadata {
-  return {
-    id: row.id,
-    name: row.name,
-    type: row.type,
-    provider: row.provider ?? undefined, // Convert null to undefined
-    createdAt: row.created_at
-  }
-}
+import type { Database } from '../../../../supabase/database.types'
+import { encryptCredential, decryptCredential } from './encryption'
+
+type CredentialInsert = Database['public']['Tables']['credentials']['Insert']
+type CredentialRow = Database['public']['Tables']['credentials']['Row']
+
+export interface CreateCredentialParams {
+  organizationId: string
+  name: string
+  type: string
+  value: Record<string, unknown>
+  createdBy: string | null
+  provider?: string // OAuth provider ID ('dropbox', 'notion', 'google-sheets')
+}
+
+export interface CredentialMetadata {
+  id: string
+  name: string
+  type: string
+  provider?: string // OAuth provider ID or undefined for non-OAuth
+  createdAt: string
+}
+
+/**
+ * Prepare credential data for insertion (encrypts the value)
+ */
+export function prepareCredentialForInsert(
+  params: CreateCredentialParams
+): Omit<CredentialInsert, 'id' | 'created_at' | 'updated_at'> {
+  const encrypted = encryptCredential(JSON.stringify(params.value))
+
+  return {
+    organization_id: params.organizationId,
+    name: params.name,
+    type: params.type,
+    encrypted_value: encrypted,
+    created_by: params.createdBy,
+    provider: params.provider ?? null // Store provider or null for non-OAuth
+  }
+}
+
+/**
+ * Decrypt credential value from database row
+ */
+export function decryptCredentialValue(encryptedValue: string): Record<string, unknown> {
+  return JSON.parse(decryptCredential(encryptedValue))
+}
+
+/**
+ * Transform database row to metadata (without decrypted value)
+ */
+export function transformToMetadata(row: CredentialRow): CredentialMetadata {
+  return {
+    id: row.id,
+    name: row.name,
+    type: row.type,
+    provider: row.provider ?? undefined, // Convert null to undefined
+    createdAt: row.created_at
+  }
+}

package/src/auth/multi-tenancy/index.ts

@@ -1,17 +1,17 @@
-// Config types
-export * from './types'
-
-// Organization types
-export * from './organizations/index'
-
-// User types
-export * from './users/index'
-
-// Membership types
-export * from './memberships/index'
-
-// Invitation types
-export * from './invitations/index'
-
-// Credentials types
-export * from './credentials/index'
+// Config types
+export * from './types'
+
+// Organization types
+export * from './organizations/index'
+
+// User types
+export * from './users/index'
+
+// Membership types
+export * from './memberships/index'
+
+// Invitation types
+export * from './invitations/index'
+
+// Credentials types
+export * from './credentials/index'