@selvajs/local-provider 0.11.0

package/dist/invites/LocalInviteProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"LocalInviteProvider.js","sourceRoot":"","sources":["../../src/invites/LocalInviteProvider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAQlC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAK3D,MAAM,KAAK,GAAgB,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;AAE3C;;;;;GAKG;AACH,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC/B,cAAc;IACd,gBAAgB;IAChB,oBAAoB;IACpB,iBAAiB;CACjB,CAAC,CAAC;AAEH,SAAS,aAAa,CAAC,CAAsC;IAC5D,IAAI,CAAC,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC;QACnC,CAAC,CAAC,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAA6B,CAAC;QAC5F,OAAO,CAAC,CAAC,WAAW,CAAC;IACtB,CAAC;IACD,OAAO,CAAC,CAAC;AACV,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,OAAO,mBAAmB;IACd,QAAQ,CAAS;IAElC,MAAM,CAAC,OAAO,CAAC,GAAuC;QACrD,IAAI,CAAC,GAAG,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QAC3E,OAAO,IAAI,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC/C,CAAC;IAED,YAAY,QAAgB;QAC3B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IACrD,CAAC;IAEO,KAAK,CAAC,IAAI;QACjB,OAAO,YAAY,CAAc,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACxD,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,IAAiB;QACnC,MAAM,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAoB,EAAE,MAAc;QAChD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1B,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,IAAoB,EAAE,KAAa;QACnD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,IAAI,MAAM,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC;QACnC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,IAAI,CAAC;QAC5D,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,SAAS,CACd,IAAoB,EACpB,KAAa,EACb,IAAkB;QAElB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAC7E,OAAO,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAAoB,EAAE,EAAU,EAAE,MAAc;QAClE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU;YAAE,OAAO;QACzC,MAAM,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC7C,MAAM,CAAC,gBAAgB,GAAG,MAAM,CAAC;QACjC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAoB,EAAE,EAAU;QAC5C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QACnC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC;QACvE,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM;YAAE,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3D,CAAC;CACD"}

package/dist/invites/__tests__/conformance.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=conformance.test.d.ts.map

package/dist/invites/__tests__/conformance.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"conformance.test.d.ts","sourceRoot":"","sources":["../../../src/invites/__tests__/conformance.test.ts"],"names":[],"mappings":""}

package/dist/invites/__tests__/conformance.test.js

@@ -0,0 +1,21 @@
+import { describe, beforeEach, afterEach } from 'vitest';
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+import * as os from 'node:os';
+import { runInviteStoreConformance } from '@selva/platform/testing';
+import { LocalInviteProvider } from '../LocalInviteProvider.js';
+describe('LocalInviteProvider', () => {
+    let tempDir;
+    beforeEach(async () => {
+        tempDir = await fs.mkdtemp(path.join(os.tmpdir(), 'selva-invites-'));
+    });
+    afterEach(async () => {
+        await fs.rm(tempDir, { recursive: true, force: true });
+    });
+    // Local provider has no FK constraints so the default scope ids are fine.
+    runInviteStoreConformance({
+        name: 'LocalInviteProvider',
+        createStore: () => new LocalInviteProvider(tempDir)
+    });
+});
+//# sourceMappingURL=conformance.test.js.map

package/dist/invites/__tests__/conformance.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"conformance.test.js","sourceRoot":"","sources":["../../../src/invites/__tests__/conformance.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAEhE,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACpC,IAAI,OAAe,CAAC;IAEpB,UAAU,CAAC,KAAK,IAAI,EAAE;QACrB,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,KAAK,IAAI,EAAE;QACpB,MAAM,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,yBAAyB,CAAC;QACzB,IAAI,EAAE,qBAAqB;QAC3B,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,mBAAmB,CAAC,OAAO,CAAC;KACnD,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/organizations/LocalOrganizationProvider.d.ts

@@ -0,0 +1,41 @@
+import type { IOrgStore, Organization, OrgRole, OrgMember, Project, ProjectMember, RequestContext, ListOptions, Page } from '@selva/platform';
+export interface LocalOrgStore {
+    orgs: Organization[];
+    projects: Project[];
+    orgMembers: OrgMember[];
+    projectMembers: ProjectMember[];
+}
+/**
+ * Shared loader for the local-org.json file. Both LocalOrganizationProvider
+ * and LocalProjectProvider point to the same instance so all reads and writes
+ * go through one cache and one atomic write path.
+ *
+ * The store starts empty — orgs are created explicitly via `createOrg`
+ * (typically from the setup flow). No lazy seeding.
+ */
+export declare class LocalOrgStoreLoader {
+    readonly storePath: string;
+    private readonly usersPath;
+    private readonly userMeta;
+    private store;
+    constructor(dataPath: string);
+    get(): Promise<LocalOrgStore>;
+    write(store: LocalOrgStore): Promise<void>;
+}
+export declare class LocalOrganizationProvider implements IOrgStore {
+    private readonly loader;
+    static fromEnv(env: Record<string, string | undefined>): LocalOrganizationProvider;
+    constructor(loader: LocalOrgStoreLoader);
+    listOrgs(_ctx: RequestContext, opts?: ListOptions): Promise<Page<Organization>>;
+    getOrg(_ctx: RequestContext, id: string): Promise<Organization | null>;
+    getOrgBySlug(_ctx: RequestContext, slug: string): Promise<Organization | null>;
+    createOrg(_ctx: RequestContext, org: Organization): Promise<void>;
+    updateOrg(_ctx: RequestContext, id: string, patch: Partial<Pick<Organization, 'name' | 'slug'>>): Promise<void>;
+    deleteOrg(_ctx: RequestContext, id: string): Promise<void>;
+    listOrgMembers(_ctx: RequestContext, orgId: string, opts?: ListOptions): Promise<Page<OrgMember>>;
+    getOrgMember(_ctx: RequestContext, orgId: string, userId: string): Promise<OrgMember | null>;
+    addOrgMember(_ctx: RequestContext, member: OrgMember): Promise<void>;
+    updateOrgMemberRole(_ctx: RequestContext, orgId: string, userId: string, role: OrgRole): Promise<void>;
+    removeOrgMember(_ctx: RequestContext, orgId: string, userId: string): Promise<void>;
+}
+//# sourceMappingURL=LocalOrganizationProvider.d.ts.map

package/dist/organizations/LocalOrganizationProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"LocalOrganizationProvider.d.ts","sourceRoot":"","sources":["../../src/organizations/LocalOrganizationProvider.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACX,SAAS,EACT,YAAY,EACZ,OAAO,EAEP,SAAS,EACT,OAAO,EACP,aAAa,EACb,cAAc,EACd,WAAW,EACX,IAAI,EACJ,MAAM,iBAAiB,CAAC;AAOzB,MAAM,WAAW,aAAa;IAC7B,IAAI,EAAE,YAAY,EAAE,CAAC;IACrB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,UAAU,EAAE,SAAS,EAAE,CAAC;IACxB,cAAc,EAAE,aAAa,EAAE,CAAC;CAChC;AAqCD;;;;;;;GAOG;AACH,qBAAa,mBAAmB;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+B;IACxD,OAAO,CAAC,KAAK,CAA8B;gBAE/B,QAAQ,EAAE,MAAM;IAMtB,GAAG,IAAI,OAAO,CAAC,aAAa,CAAC;IA2C7B,KAAK,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;CAIhD;AAED,qBAAa,yBAA0B,YAAW,SAAS;IAC1D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsB;IAE7C,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,yBAAyB;gBAKtE,MAAM,EAAE,mBAAmB;IAMjC,QAAQ,CAAC,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAK/E,MAAM,CAAC,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAKtE,YAAY,CAAC,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAK9E,SAAS,CAAC,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAqBjE,SAAS,CACd,IAAI,EAAE,cAAc,EACpB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC,GACjD,OAAO,CAAC,IAAI,CAAC;IAaV,SAAS,CAAC,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAiB1D,cAAc,CACnB,IAAI,EAAE,cAAc,EACpB,KAAK,EAAE,MAAM,EACb,IAAI,CAAC,EAAE,WAAW,GAChB,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAQrB,YAAY,CACjB,IAAI,EAAE,cAAc,EACpB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GACZ,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IAMtB,YAAY,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAWpE,mBAAmB,CACxB,IAAI,EAAE,cAAc,EACpB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO,GACX,OAAO,CAAC,IAAI,CAAC;IAYV,eAAe,CAAC,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAOzF"}

package/dist/organizations/LocalOrganizationProvider.js

@@ -0,0 +1,198 @@
+import * as path from 'node:path';
+import { DEFAULT_ORG_PERMISSIONS, ProviderError, ALL_ORG_PERMISSIONS } from '@selva/platform';
+import { createLocalUserMetaProvider } from '../auth/users.js';
+import { paginate, applyOrder } from '../pagination.js';
+import { readJsonFile, writeJsonFile } from '../fsJson.js';
+const EMPTY_STORE = {
+    orgs: [],
+    projects: [],
+    orgMembers: [],
+    projectMembers: []
+};
+const VALID_ORG_PERMS = new Set(ALL_ORG_PERMISSIONS);
+function sanitizeOrgPermissions(raw) {
+    if (!raw)
+        return [];
+    return raw.filter((p) => VALID_ORG_PERMS.has(p));
+}
+/**
+ * Pre-§1g OrgMember records had no `permissions` field. Backfill from the
+ * role's defaults so existing `local-org.json` files keep working.
+ */
+function migrateOrgMember(m) {
+    if (!m.permissions)
+        m.permissions = [...DEFAULT_ORG_PERMISSIONS[m.role]];
+    return m;
+}
+/**
+ * Shared loader for the local-org.json file. Both LocalOrganizationProvider
+ * and LocalProjectProvider point to the same instance so all reads and writes
+ * go through one cache and one atomic write path.
+ *
+ * The store starts empty — orgs are created explicitly via `createOrg`
+ * (typically from the setup flow). No lazy seeding.
+ */
+export class LocalOrgStoreLoader {
+    storePath;
+    usersPath;
+    userMeta;
+    store = null;
+    constructor(dataPath) {
+        this.storePath = path.join(dataPath, 'local-org.json');
+        this.usersPath = path.join(dataPath, 'users.json');
+        this.userMeta = createLocalUserMetaProvider(this.usersPath);
+    }
+    async get() {
+        if (this.store) {
+            return this.store;
+        }
+        const raw = await readJsonFile(this.storePath, null);
+        if (!raw) {
+            this.store = { ...EMPTY_STORE, orgs: [], projects: [], orgMembers: [], projectMembers: [] };
+            return this.store;
+        }
+        // Migrate the singleton `org` field to the new `orgs[]` array.
+        const orgs = raw.orgs ?? (raw.org ? [raw.org] : []);
+        const store = {
+            orgs,
+            projects: raw.projects ?? [],
+            orgMembers: raw.orgMembers ?? [],
+            projectMembers: raw.projectMembers ?? []
+        };
+        // Migrate legacy members (no permissions field) in place.
+        let changed = raw.orgs === undefined && raw.org !== undefined;
+        for (const m of store.orgMembers) {
+            const before = m.permissions;
+            migrateOrgMember(m);
+            if (before === undefined)
+                changed = true;
+        }
+        // One-time sweep: apply legacy user-level OrgPermissions to memberships.
+        if (this.userMeta) {
+            for (const m of store.orgMembers) {
+                const legacy = await this.userMeta.consumeLegacyOrgPermissions(m.userId);
+                if (legacy) {
+                    const extra = sanitizeOrgPermissions(legacy);
+                    m.permissions = Array.from(new Set([...(m.permissions ?? []), ...extra]));
+                    changed = true;
+                }
+            }
+        }
+        this.store = store;
+        if (changed)
+            await this.write(store);
+        return store;
+    }
+    async write(store) {
+        this.store = store;
+        await writeJsonFile(this.storePath, store);
+    }
+}
+export class LocalOrganizationProvider {
+    loader;
+    static fromEnv(env) {
+        if (!env.DATA_PATH)
+            throw new Error('Missing required env var: DATA_PATH');
+        return new LocalOrganizationProvider(new LocalOrgStoreLoader(env.DATA_PATH));
+    }
+    constructor(loader) {
+        this.loader = loader;
+    }
+    // ── Organizations ────────────────────────────────────────────────────────────
+    async listOrgs(_ctx, opts) {
+        const { orgs } = await this.loader.get();
+        return paginate(applyOrder(orgs, opts), opts);
+    }
+    async getOrg(_ctx, id) {
+        const { orgs } = await this.loader.get();
+        return orgs.find((o) => o.id === id) ?? null;
+    }
+    async getOrgBySlug(_ctx, slug) {
+        const { orgs } = await this.loader.get();
+        return orgs.find((o) => o.slug === slug) ?? null;
+    }
+    async createOrg(_ctx, org) {
+        const store = await this.loader.get();
+        if (store.orgs.some((o) => o.id === org.id)) {
+            throw new ProviderError(`Org '${org.id}' already exists`, 409);
+        }
+        if (store.orgs.some((o) => o.slug === org.slug)) {
+            throw new ProviderError(`Org slug '${org.slug}' already in use`, 409);
+        }
+        store.orgs.push(org);
+        // Seed the owner membership so the creator can see their own org through
+        // downstream permission checks. Mirrors SupabaseOrgStore.createOrg.
+        store.orgMembers.push({
+            orgId: org.id,
+            userId: org.ownerId,
+            role: 'owner',
+            permissions: [...DEFAULT_ORG_PERMISSIONS.owner],
+            joinedAt: new Date().toISOString()
+        });
+        await this.loader.write(store);
+    }
+    async updateOrg(_ctx, id, patch) {
+        const store = await this.loader.get();
+        const idx = store.orgs.findIndex((o) => o.id === id);
+        if (idx === -1)
+            throw new ProviderError(`Org '${id}' not found`, 404);
+        if (patch.slug && patch.slug !== store.orgs[idx].slug) {
+            if (store.orgs.some((o) => o.id !== id && o.slug === patch.slug)) {
+                throw new ProviderError(`Org slug '${patch.slug}' already in use`, 409);
+            }
+        }
+        store.orgs[idx] = { ...store.orgs[idx], ...patch, updatedAt: new Date().toISOString() };
+        await this.loader.write(store);
+    }
+    async deleteOrg(_ctx, id) {
+        const store = await this.loader.get();
+        const idx = store.orgs.findIndex((o) => o.id === id);
+        if (idx === -1)
+            throw new ProviderError(`Org '${id}' not found`, 404);
+        store.orgs.splice(idx, 1);
+        store.orgMembers = store.orgMembers.filter((m) => m.orgId !== id);
+        // Cascade: drop projects + project members in this org.
+        const droppedProjectIds = new Set(store.projects.filter((p) => p.orgId === id).map((p) => p.id));
+        store.projects = store.projects.filter((p) => p.orgId !== id);
+        store.projectMembers = store.projectMembers.filter((m) => !droppedProjectIds.has(m.projectId));
+        await this.loader.write(store);
+    }
+    // ── Org members ──────────────────────────────────────────────────────────────
+    async listOrgMembers(_ctx, orgId, opts) {
+        const { orgMembers } = await this.loader.get();
+        return paginate(orgMembers.filter((m) => m.orgId === orgId).map(migrateOrgMember), opts);
+    }
+    async getOrgMember(_ctx, orgId, userId) {
+        const { orgMembers } = await this.loader.get();
+        const m = orgMembers.find((m) => m.orgId === orgId && m.userId === userId);
+        return m ? migrateOrgMember(m) : null;
+    }
+    async addOrgMember(_ctx, member) {
+        const store = await this.loader.get();
+        // If callers forget to pass permissions, seed from role defaults.
+        const full = {
+            ...member,
+            permissions: member.permissions ?? [...DEFAULT_ORG_PERMISSIONS[member.role]]
+        };
+        store.orgMembers.push(full);
+        await this.loader.write(store);
+    }
+    async updateOrgMemberRole(_ctx, orgId, userId, role) {
+        const store = await this.loader.get();
+        const m = store.orgMembers.find((m) => m.orgId === orgId && m.userId === userId);
+        if (!m)
+            throw new ProviderError(`Org member '${userId}' not found`, 404);
+        m.role = role;
+        // Role change re-seeds the permission defaults. Callers that want to
+        // preserve a custom OrgPermission set must call updateOrgMemberPermissions
+        // (once §1g-ui adds it) after updating the role.
+        m.permissions = [...DEFAULT_ORG_PERMISSIONS[role]];
+        await this.loader.write(store);
+    }
+    async removeOrgMember(_ctx, orgId, userId) {
+        const store = await this.loader.get();
+        store.orgMembers = store.orgMembers.filter((m) => !(m.orgId === orgId && m.userId === userId));
+        await this.loader.write(store);
+    }
+}
+//# sourceMappingURL=LocalOrganizationProvider.js.map

package/dist/organizations/LocalOrganizationProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"LocalOrganizationProvider.js","sourceRoot":"","sources":["../../src/organizations/LocalOrganizationProvider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAalC,OAAO,EAAE,uBAAuB,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAC9F,OAAO,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAE/D,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAS3D,MAAM,WAAW,GAAkB;IAClC,IAAI,EAAE,EAAE;IACR,QAAQ,EAAE,EAAE;IACZ,UAAU,EAAE,EAAE;IACd,cAAc,EAAE,EAAE;CAClB,CAAC;AAEF,MAAM,eAAe,GAAG,IAAI,GAAG,CAAgB,mBAAmB,CAAC,CAAC;AAEpE,SAAS,sBAAsB,CAAC,GAAkC;IACjE,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAsB,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAkB,CAAC,CAAC,CAAC;AACvF,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,CAAgD;IACzE,IAAI,CAAC,CAAC,CAAC,WAAW;QAAE,CAAC,CAAC,WAAW,GAAG,CAAC,GAAG,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACzE,OAAO,CAAC,CAAC;AACV,CAAC;AAcD;;;;;;;GAOG;AACH,MAAM,OAAO,mBAAmB;IACtB,SAAS,CAAS;IACV,SAAS,CAAS;IAClB,QAAQ,CAA+B;IAChD,KAAK,GAAyB,IAAI,CAAC;IAE3C,YAAY,QAAgB;QAC3B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;QACvD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QACnD,IAAI,CAAC,QAAQ,GAAG,2BAA2B,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,GAAG;QACR,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC,KAAK,CAAC;QACnB,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,YAAY,CAA6B,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACjF,IAAI,CAAC,GAAG,EAAE,CAAC;YACV,IAAI,CAAC,KAAK,GAAG,EAAE,GAAG,WAAW,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC;YAC5F,OAAO,IAAI,CAAC,KAAK,CAAC;QACnB,CAAC;QAED,+DAA+D;QAC/D,MAAM,IAAI,GAAmB,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACpE,MAAM,KAAK,GAAkB;YAC5B,IAAI;YACJ,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE;YAC5B,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,EAAE;YAChC,cAAc,EAAE,GAAG,CAAC,cAAc,IAAI,EAAE;SACxC,CAAC;QAEF,0DAA0D;QAC1D,IAAI,OAAO,GAAG,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC;QAC9D,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YAClC,MAAM,MAAM,GAAG,CAAC,CAAC,WAAW,CAAC;YAC7B,gBAAgB,CAAC,CAAC,CAAC,CAAC;YACpB,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,GAAG,IAAI,CAAC;QAC1C,CAAC;QACD,yEAAyE;QACzE,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;gBAClC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,2BAA2B,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;gBACzE,IAAI,MAAM,EAAE,CAAC;oBACZ,MAAM,KAAK,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;oBAC7C,CAAC,CAAC,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;oBAC1E,OAAO,GAAG,IAAI,CAAC;gBAChB,CAAC;YACF,CAAC;QACF,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,OAAO;YAAE,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACrC,OAAO,KAAK,CAAC;IACd,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAAoB;QAC/B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,MAAM,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC5C,CAAC;CACD;AAED,MAAM,OAAO,yBAAyB;IACpB,MAAM,CAAsB;IAE7C,MAAM,CAAC,OAAO,CAAC,GAAuC;QACrD,IAAI,CAAC,GAAG,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QAC3E,OAAO,IAAI,yBAAyB,CAAC,IAAI,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IAC9E,CAAC;IAED,YAAY,MAA2B;QACtC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACtB,CAAC;IAED,gFAAgF;IAEhF,KAAK,CAAC,QAAQ,CAAC,IAAoB,EAAE,IAAkB;QACtD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACzC,OAAO,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAoB,EAAE,EAAU;QAC5C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACzC,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,IAAI,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAAoB,EAAE,IAAY;QACpD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACzC,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,IAAoB,EAAE,GAAiB;QACtD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,aAAa,CAAC,QAAQ,GAAG,CAAC,EAAE,kBAAkB,EAAE,GAAG,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,aAAa,CAAC,aAAa,GAAG,CAAC,IAAI,kBAAkB,EAAE,GAAG,CAAC,CAAC;QACvE,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrB,yEAAyE;QACzE,oEAAoE;QACpE,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;YACrB,KAAK,EAAE,GAAG,CAAC,EAAE;YACb,MAAM,EAAE,GAAG,CAAC,OAAO;YACnB,IAAI,EAAE,OAAO;YACb,WAAW,EAAE,CAAC,GAAG,uBAAuB,CAAC,KAAK,CAAC;YAC/C,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SAClC,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,SAAS,CACd,IAAoB,EACpB,EAAU,EACV,KAAmD;QAEnD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACrD,IAAI,GAAG,KAAK,CAAC,CAAC;YAAE,MAAM,IAAI,aAAa,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;QACtE,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YACvD,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClE,MAAM,IAAI,aAAa,CAAC,aAAa,KAAK,CAAC,IAAI,kBAAkB,EAAE,GAAG,CAAC,CAAC;YACzE,CAAC;QACF,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QACxF,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,IAAoB,EAAE,EAAU;QAC/C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACrD,IAAI,GAAG,KAAK,CAAC,CAAC;YAAE,MAAM,IAAI,aAAa,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;QACtE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC1B,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;QAClE,wDAAwD;QACxD,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAChC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAC7D,CAAC;QACF,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;QAC9D,KAAK,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QAC/F,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAED,gFAAgF;IAEhF,KAAK,CAAC,cAAc,CACnB,IAAoB,EACpB,KAAa,EACb,IAAkB;QAElB,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QAC/C,OAAO,QAAQ,CACd,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,EACjE,IAAI,CACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CACjB,IAAoB,EACpB,KAAa,EACb,MAAc;QAEd,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QAC/C,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;QAC3E,OAAO,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAAoB,EAAE,MAAiB;QACzD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACtC,kEAAkE;QAClE,MAAM,IAAI,GAAc;YACvB,GAAG,MAAM;YACT,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,CAAC,GAAG,uBAAuB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;SAC5E,CAAC;QACF,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,mBAAmB,CACxB,IAAoB,EACpB,KAAa,EACb,MAAc,EACd,IAAa;QAEb,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;QACjF,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,aAAa,CAAC,eAAe,MAAM,aAAa,EAAE,GAAG,CAAC,CAAC;QACzE,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC;QACd,qEAAqE;QACrE,2EAA2E;QAC3E,iDAAiD;QACjD,CAAC,CAAC,WAAW,GAAG,CAAC,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC;QACnD,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,IAAoB,EAAE,KAAa,EAAE,MAAc;QACxE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACtC,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CACzC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAClD,CAAC;QACF,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;CACD"}

package/dist/organizations/__tests__/conformance.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=conformance.test.d.ts.map

package/dist/organizations/__tests__/conformance.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"conformance.test.d.ts","sourceRoot":"","sources":["../../../src/organizations/__tests__/conformance.test.ts"],"names":[],"mappings":""}

package/dist/organizations/__tests__/conformance.test.js

@@ -0,0 +1,20 @@
+import { describe, beforeEach, afterEach } from 'vitest';
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+import * as os from 'node:os';
+import { runOrgStoreConformance } from '@selva/platform/testing';
+import { LocalOrganizationProvider, LocalOrgStoreLoader } from '../LocalOrganizationProvider.js';
+describe('LocalOrganizationProvider', () => {
+    let tempDir;
+    beforeEach(async () => {
+        tempDir = await fs.mkdtemp(path.join(os.tmpdir(), 'selva-test-'));
+    });
+    afterEach(async () => {
+        await fs.rm(tempDir, { recursive: true, force: true });
+    });
+    runOrgStoreConformance({
+        name: 'LocalOrganizationProvider',
+        createStore: () => new LocalOrganizationProvider(new LocalOrgStoreLoader(tempDir))
+    });
+});
+//# sourceMappingURL=conformance.test.js.map

package/dist/organizations/__tests__/conformance.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"conformance.test.js","sourceRoot":"","sources":["../../../src/organizations/__tests__/conformance.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAEjG,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;IAC1C,IAAI,OAAe,CAAC;IAEpB,UAAU,CAAC,KAAK,IAAI,EAAE;QACrB,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,KAAK,IAAI,EAAE;QACpB,MAAM,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,sBAAsB,CAAC;QACtB,IAAI,EAAE,2BAA2B;QACjC,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,yBAAyB,CAAC,IAAI,mBAAmB,CAAC,OAAO,CAAC,CAAC;KAClF,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/organizations/index.d.ts

@@ -0,0 +1,2 @@
+export { LocalOrganizationProvider, LocalOrgStoreLoader } from './LocalOrganizationProvider.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/organizations/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/organizations/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC"}

package/dist/organizations/index.js

@@ -0,0 +1,2 @@
+export { LocalOrganizationProvider, LocalOrgStoreLoader } from './LocalOrganizationProvider.js';
+//# sourceMappingURL=index.js.map

package/dist/organizations/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/organizations/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC"}

package/dist/pagination.d.ts

@@ -0,0 +1,15 @@
+import { type ListOptions, type DefinitionListOptions, type Page } from '@selva/platform';
+type AnyListOptions = ListOptions | DefinitionListOptions;
+/**
+ * In-memory pagination for filesystem-backed adapters.
+ * Cursor is an offset encoded as a string. Good enough for single-node local use.
+ */
+export declare function paginate<T>(items: T[], opts?: AnyListOptions): Page<T>;
+/**
+ * Sort a list in place per ListOptions. Mutates the input.
+ * Pass `keyFn` to customize how the comparison value is derived (e.g. nested
+ * fields, case-folded strings).
+ */
+export declare function applyOrder<T>(items: T[], opts?: AnyListOptions, keyFn?: (item: T, field: string) => unknown): T[];
+export {};
+//# sourceMappingURL=pagination.d.ts.map

package/dist/pagination.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pagination.d.ts","sourceRoot":"","sources":["../src/pagination.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsC,KAAK,WAAW,EAAE,KAAK,qBAAqB,EAAE,KAAK,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAE9H,KAAK,cAAc,GAAG,WAAW,GAAG,qBAAqB,CAAC;AAE1D;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC,CAAC,CAAC,CAStE;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAC3B,KAAK,EAAE,CAAC,EAAE,EACV,IAAI,CAAC,EAAE,cAAc,EACrB,KAAK,GAAE,CAAC,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,KAAK,OACM,GACvC,CAAC,EAAE,CAYL"}

package/dist/pagination.js

@@ -0,0 +1,36 @@
+import { DEFAULT_PAGE_LIMIT, MAX_PAGE_LIMIT } from '@selva/platform';
+/**
+ * In-memory pagination for filesystem-backed adapters.
+ * Cursor is an offset encoded as a string. Good enough for single-node local use.
+ */
+export function paginate(items, opts) {
+    const limit = Math.min(Math.max(1, opts?.limit ?? DEFAULT_PAGE_LIMIT), MAX_PAGE_LIMIT);
+    const offset = opts?.cursor ? parseInt(opts.cursor, 10) || 0 : 0;
+    const slice = items.slice(offset, offset + limit);
+    const nextOffset = offset + slice.length;
+    return {
+        items: slice,
+        nextCursor: nextOffset < items.length ? String(nextOffset) : undefined
+    };
+}
+/**
+ * Sort a list in place per ListOptions. Mutates the input.
+ * Pass `keyFn` to customize how the comparison value is derived (e.g. nested
+ * fields, case-folded strings).
+ */
+export function applyOrder(items, opts, keyFn = (item, field) => item[field]) {
+    const field = opts?.orderBy ?? 'createdAt';
+    const dir = opts?.orderDir ?? 'desc';
+    const mul = dir === 'asc' ? 1 : -1;
+    items.sort((a, b) => {
+        const av = (keyFn(a, field) ?? '');
+        const bv = (keyFn(b, field) ?? '');
+        if (av < bv)
+            return -1 * mul;
+        if (av > bv)
+            return 1 * mul;
+        return 0;
+    });
+    return items;
+}
+//# sourceMappingURL=pagination.js.map

package/dist/pagination.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pagination.js","sourceRoot":"","sources":["../src/pagination.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAA2D,MAAM,iBAAiB,CAAC;AAI9H;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAI,KAAU,EAAE,IAAqB;IAC5D,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,IAAI,kBAAkB,CAAC,EAAE,cAAc,CAAC,CAAC;IACvF,MAAM,MAAM,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC,CAAC;IAClD,MAAM,UAAU,GAAG,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IACzC,OAAO;QACN,KAAK,EAAE,KAAK;QACZ,UAAU,EAAE,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS;KACtE,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CACzB,KAAU,EACV,IAAqB,EACrB,QAA6C,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAC3D,IAAgC,CAAC,KAAK,CAAC;IAEzC,MAAM,KAAK,GAAG,IAAI,EAAE,OAAO,IAAI,WAAW,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAI,EAAE,QAAQ,IAAI,MAAM,CAAC;IACrC,MAAM,GAAG,GAAG,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACnB,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,EAAE,CAAoB,CAAC;QACtD,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,EAAE,CAAoB,CAAC;QACtD,IAAI,EAAE,GAAG,EAAE;YAAE,OAAO,CAAC,CAAC,GAAG,GAAG,CAAC;QAC7B,IAAI,EAAE,GAAG,EAAE;YAAE,OAAO,CAAC,GAAG,GAAG,CAAC;QAC5B,OAAO,CAAC,CAAC;IACV,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACd,CAAC"}

package/dist/permissions/LocalPlatformPermissionStore.d.ts

@@ -0,0 +1,39 @@
+import type { IPlatformPermissionStore, PlatformPermission, RequestContext, UserManagementResult } from '@selvajs/platform';
+/**
+ * Filesystem-backed platform-permission store. Reads and writes the
+ * `platformPermissions` field on `user-data.json` — a data-layer file owned
+ * by `LocalDataProvider`, distinct from `auth-users.json` which the
+ * `LocalAuthProvider` owns. This split lets the local data layer pair with
+ * any auth provider (local, Supabase, Entra, Eterna, …): the data layer only
+ * cares about the user ID, never about how identity is stored.
+ *
+ * The "user is known to the data layer" precondition is established by
+ * `IDataProvider.ensureUser`, called from `hooks.server.ts` on every authed
+ * request — the local equivalent of the Supabase `handle_new_auth_user`
+ * trigger. After that call, `set` finds a row and `getFor` reads it; before
+ * it, `set` returns `not_found` (matching the conformance contract).
+ *
+ * Enforces:
+ *   - The §2 sole-`instance_admin` invariant on `set` (refuses to drop the
+ *     last admin)
+ *   - Authorization on read/write (`assertCanRead` / `assertCanWrite`)
+ *
+ * "Disabled" state lives on the auth provider's user record. The local
+ * provider's permission store can't see across that boundary, so the
+ * invariant counters here treat every row in `user-data.json` as enabled.
+ * Code that disables a user is expected to also drop their `instance_admin`
+ * grant via `set` (the §2 invariant kicks in there) before the auth-side
+ * disable lands — see `LocalAuthProvider.disableUser`.
+ */
+export declare class LocalPlatformPermissionStore implements IPlatformPermissionStore {
+    private readonly data;
+    static fromEnv(env: Record<string, string | undefined>): LocalPlatformPermissionStore;
+    constructor(userDataFilePath: string);
+    getFor(ctx: RequestContext, userId: string): Promise<PlatformPermission[]>;
+    getForBatch(ctx: RequestContext, userIds: readonly string[]): Promise<Map<string, PlatformPermission[]>>;
+    set(ctx: RequestContext, userId: string, permissions: readonly PlatformPermission[]): Promise<UserManagementResult>;
+    hasInstanceAdmin(_ctx: RequestContext): Promise<boolean>;
+    countInstanceAdminsExcluding(_ctx: RequestContext, excludeUserId: string): Promise<number>;
+    private countOtherAdmins;
+}
+//# sourceMappingURL=LocalPlatformPermissionStore.d.ts.map

package/dist/permissions/LocalPlatformPermissionStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"LocalPlatformPermissionStore.d.ts","sourceRoot":"","sources":["../../src/permissions/LocalPlatformPermissionStore.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACX,wBAAwB,EACxB,kBAAkB,EAClB,cAAc,EACd,oBAAoB,EACpB,MAAM,mBAAmB,CAAC;AAI3B;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,qBAAa,4BAA6B,YAAW,wBAAwB;IAC5E,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAqB;IAE1C,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,4BAA4B;gBAKzE,gBAAgB,EAAE,MAAM;IAI9B,MAAM,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAM1E,WAAW,CAChB,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,SAAS,MAAM,EAAE,GACxB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAWvC,GAAG,CACR,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,SAAS,kBAAkB,EAAE,GACxC,OAAO,CAAC,oBAAoB,CAAC;IAmB1B,gBAAgB,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC;IAOxD,4BAA4B,CAAC,IAAI,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAIlF,gBAAgB;CAM9B"}

package/dist/permissions/LocalPlatformPermissionStore.js

@@ -0,0 +1,117 @@
+import * as path from 'node:path';
+import { ProviderError, hasPermission } from '@selvajs/platform';
+import { createLocalUserDataStore } from '../data/userData.js';
+/**
+ * Filesystem-backed platform-permission store. Reads and writes the
+ * `platformPermissions` field on `user-data.json` — a data-layer file owned
+ * by `LocalDataProvider`, distinct from `auth-users.json` which the
+ * `LocalAuthProvider` owns. This split lets the local data layer pair with
+ * any auth provider (local, Supabase, Entra, Eterna, …): the data layer only
+ * cares about the user ID, never about how identity is stored.
+ *
+ * The "user is known to the data layer" precondition is established by
+ * `IDataProvider.ensureUser`, called from `hooks.server.ts` on every authed
+ * request — the local equivalent of the Supabase `handle_new_auth_user`
+ * trigger. After that call, `set` finds a row and `getFor` reads it; before
+ * it, `set` returns `not_found` (matching the conformance contract).
+ *
+ * Enforces:
+ *   - The §2 sole-`instance_admin` invariant on `set` (refuses to drop the
+ *     last admin)
+ *   - Authorization on read/write (`assertCanRead` / `assertCanWrite`)
+ *
+ * "Disabled" state lives on the auth provider's user record. The local
+ * provider's permission store can't see across that boundary, so the
+ * invariant counters here treat every row in `user-data.json` as enabled.
+ * Code that disables a user is expected to also drop their `instance_admin`
+ * grant via `set` (the §2 invariant kicks in there) before the auth-side
+ * disable lands — see `LocalAuthProvider.disableUser`.
+ */
+export class LocalPlatformPermissionStore {
+    data;
+    static fromEnv(env) {
+        if (!env.DATA_PATH)
+            throw new Error('Missing required env var: DATA_PATH');
+        return new LocalPlatformPermissionStore(path.join(env.DATA_PATH, 'user-data.json'));
+    }
+    constructor(userDataFilePath) {
+        this.data = createLocalUserDataStore(userDataFilePath);
+    }
+    async getFor(ctx, userId) {
+        assertCanRead(ctx, userId);
+        const row = await this.data.findById(userId);
+        return row?.platformPermissions ?? [];
+    }
+    async getForBatch(ctx, userIds) {
+        assertCanReadBatch(ctx);
+        const all = await this.data.listAll();
+        const wanted = new Set(userIds);
+        const out = new Map();
+        for (const u of all) {
+            if (wanted.has(u.userId))
+                out.set(u.userId, u.platformPermissions ?? []);
+        }
+        return out;
+    }
+    async set(ctx, userId, permissions) {
+        assertAdmin(ctx);
+        const target = await this.data.findById(userId);
+        if (!target)
+            return 'not_found';
+        const wasAdmin = target.platformPermissions.includes('instance_admin');
+        const willBeAdmin = permissions.includes('instance_admin');
+        if (wasAdmin && !willBeAdmin) {
+            const others = await this.countOtherAdmins(userId);
+            if (others === 0)
+                return 'last_admin';
+        }
+        try {
+            await this.data.updatePermissions(userId, [...permissions]);
+            return 'ok';
+        }
+        catch (err) {
+            if (err instanceof ProviderError && err.statusCode === 404)
+                return 'not_found';
+            throw err;
+        }
+    }
+    async hasInstanceAdmin(_ctx) {
+        // First-run + invariant check — always allowed (read-only existence
+        // probe). The route layer decides what to do with the answer.
+        const all = await this.data.listAll();
+        return all.some((u) => u.platformPermissions.includes('instance_admin'));
+    }
+    async countInstanceAdminsExcluding(_ctx, excludeUserId) {
+        return this.countOtherAdmins(excludeUserId);
+    }
+    async countOtherAdmins(excludeUserId) {
+        const all = await this.data.listAll();
+        return all.filter((u) => u.userId !== excludeUserId && u.platformPermissions.includes('instance_admin')).length;
+    }
+}
+function assertCanRead(ctx, userId) {
+    if (ctx.system)
+        return;
+    if (ctx.userId === userId)
+        return;
+    if (hasPermission(ctx, 'instance_admin'))
+        return;
+    throw new ProviderError('Forbidden: cannot read another user’s permissions', 403);
+}
+function assertAdmin(ctx) {
+    if (ctx.system)
+        return;
+    if (hasPermission(ctx, 'instance_admin'))
+        return;
+    throw new ProviderError('Forbidden: instance admin required', 403);
+}
+function assertCanReadBatch(ctx) {
+    if (ctx.system)
+        return;
+    if (hasPermission(ctx, 'instance_admin'))
+        return;
+    if (hasPermission(ctx, 'manage_instance_users'))
+        return;
+    throw new ProviderError('Forbidden: instance admin or manage_instance_users required', 403);
+}
+//# sourceMappingURL=LocalPlatformPermissionStore.js.map

package/dist/permissions/LocalPlatformPermissionStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"LocalPlatformPermissionStore.js","sourceRoot":"","sources":["../../src/permissions/LocalPlatformPermissionStore.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAOlC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,wBAAwB,EAA2B,MAAM,qBAAqB,CAAC;AAExF;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,OAAO,4BAA4B;IACvB,IAAI,CAAqB;IAE1C,MAAM,CAAC,OAAO,CAAC,GAAuC;QACrD,IAAI,CAAC,GAAG,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QAC3E,OAAO,IAAI,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACrF,CAAC;IAED,YAAY,gBAAwB;QACnC,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAmB,EAAE,MAAc;QAC/C,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC3B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC7C,OAAO,GAAG,EAAE,mBAAmB,IAAI,EAAE,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,WAAW,CAChB,GAAmB,EACnB,OAA0B;QAE1B,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACxB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAChC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAgC,CAAC;QACpD,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;YACrB,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;gBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,GAAG,CAAC;IACZ,CAAC;IAED,KAAK,CAAC,GAAG,CACR,GAAmB,EACnB,MAAc,EACd,WAA0C;QAE1C,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM;YAAE,OAAO,WAAW,CAAC;QAChC,MAAM,QAAQ,GAAG,MAAM,CAAC,mBAAmB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QACvE,MAAM,WAAW,GAAG,WAAW,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QAC3D,IAAI,QAAQ,IAAI,CAAC,WAAW,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;YACnD,IAAI,MAAM,KAAK,CAAC;gBAAE,OAAO,YAAY,CAAC;QACvC,CAAC;QACD,IAAI,CAAC;YACJ,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC;YAC5D,OAAO,IAAI,CAAC;QACb,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,GAAG,YAAY,aAAa,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG;gBAAE,OAAO,WAAW,CAAC;YAC/E,MAAM,GAAG,CAAC;QACX,CAAC;IACF,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,IAAoB;QAC1C,oEAAoE;QACpE,8DAA8D;QAC9D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACtC,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,mBAAmB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC1E,CAAC;IAED,KAAK,CAAC,4BAA4B,CAAC,IAAoB,EAAE,aAAqB;QAC7E,OAAO,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;IAC7C,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,aAAqB;QACnD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACtC,OAAO,GAAG,CAAC,MAAM,CAChB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,aAAa,IAAI,CAAC,CAAC,mBAAmB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CACrF,CAAC,MAAM,CAAC;IACV,CAAC;CACD;AAED,SAAS,aAAa,CAAC,GAAmB,EAAE,MAAc;IACzD,IAAI,GAAG,CAAC,MAAM;QAAE,OAAO;IACvB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO;IAClC,IAAI,aAAa,CAAC,GAAG,EAAE,gBAAgB,CAAC;QAAE,OAAO;IACjD,MAAM,IAAI,aAAa,CAAC,mDAAmD,EAAE,GAAG,CAAC,CAAC;AACnF,CAAC;AAED,SAAS,WAAW,CAAC,GAAmB;IACvC,IAAI,GAAG,CAAC,MAAM;QAAE,OAAO;IACvB,IAAI,aAAa,CAAC,GAAG,EAAE,gBAAgB,CAAC;QAAE,OAAO;IACjD,MAAM,IAAI,aAAa,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAmB;IAC9C,IAAI,GAAG,CAAC,MAAM;QAAE,OAAO;IACvB,IAAI,aAAa,CAAC,GAAG,EAAE,gBAAgB,CAAC;QAAE,OAAO;IACjD,IAAI,aAAa,CAAC,GAAG,EAAE,uBAAuB,CAAC;QAAE,OAAO;IACxD,MAAM,IAAI,aAAa,CAAC,6DAA6D,EAAE,GAAG,CAAC,CAAC;AAC7F,CAAC"}

package/dist/permissions/__tests__/conformance.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=conformance.test.d.ts.map

package/dist/permissions/__tests__/conformance.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"conformance.test.d.ts","sourceRoot":"","sources":["../../../src/permissions/__tests__/conformance.test.ts"],"names":[],"mappings":""}

package/dist/permissions/__tests__/conformance.test.js

@@ -0,0 +1,37 @@
+import { describe, beforeEach, afterEach } from 'vitest';
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+import * as os from 'node:os';
+import { runPlatformPermissionStoreConformance } from '@selvajs/platform/testing';
+import { LocalPlatformPermissionStore } from '../LocalPlatformPermissionStore.js';
+import { createLocalUserDataStore } from '../../data/userData.js';
+import { randomUUID } from 'node:crypto';
+describe('LocalPlatformPermissionStore', () => {
+    let tempDir;
+    beforeEach(async () => {
+        tempDir = await fs.mkdtemp(path.join(os.tmpdir(), 'selva-perm-test-'));
+    });
+    afterEach(async () => {
+        await fs.rm(tempDir, { recursive: true, force: true });
+    });
+    runPlatformPermissionStoreConformance({
+        name: 'LocalPlatformPermissionStore',
+        createStore: async () => {
+            const userDataPath = path.join(tempDir, 'user-data.json');
+            const userData = createLocalUserDataStore(userDataPath);
+            const store = new LocalPlatformPermissionStore(userDataPath);
+            return {
+                store,
+                seedUser: async () => {
+                    // Mirrors `IDataProvider.ensureUser` — produces a user the data
+                    // layer knows about, regardless of which auth provider would
+                    // hand out the ID in production.
+                    const id = randomUUID();
+                    await userData.ensure(id);
+                    return id;
+                }
+            };
+        }
+    });
+});
+//# sourceMappingURL=conformance.test.js.map