@selvajs/platform 0.14.2 → 0.15.0-beta.1

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2025 Selva FelixBrunold VektorNode
+Copyright (c) 2025 Selva VektorNode AG
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/dist/auth.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Authentication provider interface.
+ *
+ * Implement this to plug in any auth backend:
+ * - Local HMAC sessions (built-in default)
+ * - Firebase Auth
+ * - Supabase Auth
+ * - AWS Cognito
+ * - Any OIDC/JWT provider
+ */
+export type UserRole = 'platform_admin' | 'user';
+export interface AuthUser {
+    id: string;
+    email?: string;
+    displayName?: string;
+    role: UserRole;
+    metadata?: Record<string, unknown>;
+}
+export interface IAuthProvider {
+    /**
+     * Verify a token string — session cookie value, JWT, Firebase ID token, etc.
+     * Returns the authenticated user, or null if the token is invalid or expired.
+     */
+    verifyToken(token: string): Promise<AuthUser | null>;
+    /**
+     * Look up a user by their provider-specific ID.
+     * Returns null if the user does not exist.
+     */
+    getUser(id: string): Promise<AuthUser | null>;
+    /**
+     * Create a new opaque session token for an authenticated user.
+     * Stored in a cookie by the transport layer. Format is provider-specific:
+     * HMAC string, signed JWT, Firebase custom token, etc.
+     */
+    createSessionToken(user: AuthUser): Promise<string>;
+    /**
+     * Verify login credentials (email + password).
+     * Returns the authenticated user, or null if credentials are invalid.
+     * Email may be an empty string for password-only auth (no users.json configured).
+     */
+    verifyLoginCredentials(email: string, password: string): Promise<AuthUser | null>;
+    /**
+     * List all users. Returns null if this provider does not support user management
+     * (e.g. single-password mode).
+     */
+    listUsers(): Promise<AuthUser[] | null>;
+    /**
+     * Create a new user. Returns null if not supported.
+     */
+    createUser(email: string, password: string, role: UserRole): Promise<AuthUser | null>;
+    /**
+     * Update a user's role. Returns false if not supported or user not found.
+     */
+    updateUserRole(id: string, role: UserRole): Promise<boolean>;
+    /**
+     * Delete a user by ID. Returns false if not supported or user not found.
+     */
+    deleteUser(id: string): Promise<boolean>;
+}
+//# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,MAAM,QAAQ,GAAG,gBAAgB,GAAG,MAAM,CAAC;AAEjD,MAAM,WAAW,QAAQ;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,QAAQ,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,aAAa;IAC7B;;;OAGG;IACH,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAErD;;;OAGG;IACH,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAE9C;;;;OAIG;IACH,kBAAkB,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAEpD;;;;OAIG;IACH,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAIlF;;;OAGG;IACH,SAAS,IAAI,OAAO,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,CAAC;IAExC;;OAEG;IACH,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAEtF;;OAEG;IACH,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE7D;;OAEG;IACH,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACzC"}

package/dist/auth.js

@@ -0,0 +1,12 @@
+/**
+ * Authentication provider interface.
+ *
+ * Implement this to plug in any auth backend:
+ * - Local HMAC sessions (built-in default)
+ * - Firebase Auth
+ * - Supabase Auth
+ * - AWS Cognito
+ * - Any OIDC/JWT provider
+ */
+export {};
+//# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG"}

package/dist/compute.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Compute server provider interface.
+ *
+ * Implement to support:
+ * - Single server (built-in default)
+ * - Server pool with load balancing
+ * - Per-definition routing (e.g. definition A always goes to server B)
+ * - Dynamic provisioning
+ */
+export interface ComputeServerConfig {
+    /** UUID v4 primary key */
+    id: string;
+    /** Human-readable display label */
+    label: string;
+    /** Base URL of the Rhino.Compute instance, e.g. http://localhost:5000 */
+    serverUrl: string;
+    /** Optional API key sent as RhinoComputeKey header */
+    apiKey?: string;
+    /** Request timeout in milliseconds. Default: 30000 */
+    timeoutMs?: number;
+    /** Number of retries on transient failure. Default: 0 */
+    retryCount?: number;
+}
+export interface ComputeConfig {
+    servers: ComputeServerConfig[];
+    /** UUID of the server to use when no routing rule matches. Falls back to servers[0]. */
+    defaultServerId?: string;
+}
+export interface SolveRequest {
+    /** GUID of the definition being solved — enables per-definition routing */
+    definitionGuid?: string;
+    /** Arbitrary hints for routing decisions (e.g. required plugin versions) */
+    hints?: Record<string, string>;
+}
+export interface IComputeServerProvider {
+    /** Resolve which compute server to use for a given solve request. */
+    getServer(request?: SolveRequest): Promise<ComputeServerConfig>;
+    /** Return the default server, or undefined if none configured. */
+    getDefaultServer(): Promise<ComputeServerConfig | undefined>;
+    /** Look up a specific server by its UUID. Returns undefined if not found. */
+    getServerById(id: string): Promise<ComputeServerConfig | undefined>;
+    /** Return the full config. Used by the admin UI. */
+    getConfig(): Promise<ComputeConfig>;
+    /** Replace the full config atomically. Used by the admin UI. */
+    saveConfig(config: ComputeConfig): Promise<void>;
+}
+//# sourceMappingURL=compute.d.ts.map

package/dist/compute.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compute.d.ts","sourceRoot":"","sources":["../src/compute.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,WAAW,mBAAmB;IACnC,0BAA0B;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,mCAAmC;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,yEAAyE;IACzE,SAAS,EAAE,MAAM,CAAC;IAClB,sDAAsD;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC7B,OAAO,EAAE,mBAAmB,EAAE,CAAC;IAC/B,wFAAwF;IACxF,eAAe,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC5B,2EAA2E;IAC3E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,4EAA4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,sBAAsB;IACtC,qEAAqE;IACrE,SAAS,CAAC,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAEhE,kEAAkE;IAClE,gBAAgB,IAAI,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC,CAAC;IAE7D,6EAA6E;IAC7E,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC,CAAC;IAEpE,oDAAoD;IACpD,SAAS,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC;IAEpC,gEAAgE;IAChE,UAAU,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjD"}

package/dist/compute.js

@@ -0,0 +1,11 @@
+/**
+ * Compute server provider interface.
+ *
+ * Implement to support:
+ * - Single server (built-in default)
+ * - Server pool with load balancing
+ * - Per-definition routing (e.g. definition A always goes to server B)
+ * - Dynamic provisioning
+ */
+export {};
+//# sourceMappingURL=compute.js.map

package/dist/compute.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compute.js","sourceRoot":"","sources":["../src/compute.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG"}

package/dist/computeServer/index.d.ts

@@ -1,6 +1,8 @@
 export type { ComputeServerConfig, ComputeConfig, PlatformComputeServer, OrgComputeServer } from './types.js';
 export { isPlatformServer, isOrgServer } from './types.js';
 export type { IComputeServerStore } from './interface.js';
+export { isEncryptedSecret, encryptSecret, decryptSecret, decodeSecretKey } from './secrets.js';
+export type { SecretVerificationReport, SecretVerificationFailure, SecretVerificationFailureReason } from './secrets.js';
 export type { ResolveOptions } from './utils.js';
 export { serversVisibleTo, defaultServerIdFor, resolveServerForOrg, findServerById, platformServers, orgServersFor } from './utils.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/computeServer/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/computeServer/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACX,mBAAmB,EACnB,aAAa,EACb,qBAAqB,EACrB,gBAAgB,EAChB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC3D,YAAY,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,YAAY,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EACN,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,aAAa,EACb,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/computeServer/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACX,mBAAmB,EACnB,aAAa,EACb,qBAAqB,EACrB,gBAAgB,EAChB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC3D,YAAY,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAM1D,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAChG,YAAY,EACX,wBAAwB,EACxB,yBAAyB,EACzB,+BAA+B,EAC/B,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EACN,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,aAAa,EACb,MAAM,YAAY,CAAC"}

package/dist/computeServer/index.js

@@ -1,3 +1,9 @@
 export { isPlatformServer, isOrgServer } from './types.js';
+// At-rest secret crypto (uses `node:crypto`). Server-only — deliberately NOT
+// re-exported from the root barrel, which client `.svelte` code imports and
+// where a browser bundle can't resolve `node:crypto`. Import these from
+// `@selvajs/platform/computeServer` in server code. The report TYPES are erased
+// at build, so they also stay re-exported from the root barrel for convenience.
+export { isEncryptedSecret, encryptSecret, decryptSecret, decodeSecretKey } from './secrets.js';
 export { serversVisibleTo, defaultServerIdFor, resolveServerForOrg, findServerById, platformServers, orgServersFor } from './utils.js';
 //# sourceMappingURL=index.js.map

package/dist/computeServer/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/computeServer/index.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAG3D,OAAO,EACN,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,aAAa,EACb,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/computeServer/index.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE3D,6EAA6E;AAC7E,4EAA4E;AAC5E,wEAAwE;AACxE,gFAAgF;AAChF,gFAAgF;AAChF,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAOhG,OAAO,EACN,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,aAAa,EACb,MAAM,YAAY,CAAC"}

package/dist/computeServer/interface.d.ts

@@ -1,5 +1,6 @@
 import type { RequestContext } from '../context.js';
 import type { ComputeConfig, ComputeServerConfig } from './types.js';
+import type { SecretVerificationReport } from './secrets.js';
 /**
  * Compute-server configuration. Architecture spec §4.8.
  *
@@ -45,5 +46,14 @@ export interface IComputeServerStore {
      * compute config behind.
      */
     deleteByOrg(ctx: RequestContext, orgId: string): Promise<void>;
+    /**
+     * Boot-time integrity check: attempt to decrypt every stored `apiKey` and
+     * report any that are plaintext-at-rest or fail to decrypt under the current
+     * `SELVA_AT_REST_KEY`. Does NOT throw — returns a structured report so the
+     * caller (boot health) decides whether to refuse boot / drive `/api/health`
+     * to 503. Both encrypting stores (local file, Supabase) implement this;
+     * optional so a hypothetical non-encrypting store can omit it.
+     */
+    verifySecrets?(): Promise<SecretVerificationReport>;
 }
 //# sourceMappingURL=interface.d.ts.map

package/dist/computeServer/interface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"interface.d.ts","sourceRoot":"","sources":["../../src/computeServer/interface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,KAAK,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAErE;;;;;;;;GAQG;AACH,MAAM,WAAW,mBAAmB;IACnC;;;;;OAKG;IACH,SAAS,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAEvD;;;OAGG;IACH,mBAAmB,CAClB,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,mBAAmB,EAAE,EAC9B,eAAe,EAAE,MAAM,GAAG,SAAS,GACjC,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB;;;;;;OAMG;IACH,cAAc,CACb,GAAG,EAAE,cAAc,EACnB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,mBAAmB,EAAE,EAC9B,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,GAC7B,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB;;;;;OAKG;IACH,aAAa,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE1F;;;;;;OAMG;IACH,WAAW,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/D"}
+{"version":3,"file":"interface.d.ts","sourceRoot":"","sources":["../../src/computeServer/interface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,KAAK,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACrE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAE7D;;;;;;;;GAQG;AACH,MAAM,WAAW,mBAAmB;IACnC;;;;;OAKG;IACH,SAAS,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAEvD;;;OAGG;IACH,mBAAmB,CAClB,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,mBAAmB,EAAE,EAC9B,eAAe,EAAE,MAAM,GAAG,SAAS,GACjC,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB;;;;;;OAMG;IACH,cAAc,CACb,GAAG,EAAE,cAAc,EACnB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,mBAAmB,EAAE,EAC9B,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,GAC7B,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB;;;;;OAKG;IACH,aAAa,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE1F;;;;;;OAMG;IACH,WAAW,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE/D;;;;;;;OAOG;IACH,aAAa,CAAC,IAAI,OAAO,CAAC,wBAAwB,CAAC,CAAC;CACpD"}

package/dist/computeServer/secrets.d.ts

@@ -0,0 +1,53 @@
+/**
+ * AES-256-GCM envelope for at-rest secrets (e.g. compute API keys).
+ *
+ * Wire format: `enc:v1:<base64(iv|tag|ciphertext)>`. The version prefix lets
+ * us migrate to a new algorithm later without ambiguity. Plaintext never sits
+ * at rest — on disk (local provider) or in the DB (Supabase provider).
+ *
+ * Security model: defends against backup leaks, accidental file/DB sharing,
+ * and read-only storage access. An attacker with both the stored ciphertext
+ * *and* the master key (`SELVA_AT_REST_KEY` env var, process memory) can still
+ * decrypt — this is encryption at rest, not a secret manager.
+ *
+ * Provider-agnostic: pure `node:crypto`, no fs or DB coupling, so both the
+ * local and Supabase compute-server stores share this one implementation.
+ */
+export declare function isEncryptedSecret(value: string): boolean;
+export declare function encryptSecret(plaintext: string, key: Buffer): string;
+export declare function decryptSecret(envelope: string, key: Buffer): string;
+/**
+ * Decode a `SELVA_AT_REST_KEY` env var into a 32-byte buffer. Accepts either
+ * 64-char hex or base64 (with or without padding). Throws on anything else
+ * so misconfiguration fails loudly at boot rather than silently producing
+ * an undecryptable value.
+ */
+export declare function decodeSecretKey(raw: string): Buffer;
+/**
+ * Result of a compute-server store's `verifySecrets()`. One `failures` entry
+ * per server whose `apiKey` couldn't be loaded:
+ *  - `plaintext_on_disk` — the field exists but isn't an `enc:v1:` envelope.
+ *    Either a hand-edit, a legacy row from before encryption, or a migration
+ *    regression. Security-relevant.
+ *  - `key_mismatch`      — envelope is valid but GCM auth-tag verification
+ *    fails under the current `SELVA_AT_REST_KEY`. The key was rotated or the
+ *    data came from another deployment.
+ *
+ * Storage-agnostic (`plaintext_on_disk` reads "plaintext at rest" for both the
+ * file- and DB-backed stores) so boot health can treat every provider alike.
+ */
+export type SecretVerificationFailureReason = 'key_mismatch' | 'plaintext_on_disk';
+export interface SecretVerificationFailure {
+    serverId: string;
+    serverLabel: string;
+    reason: SecretVerificationFailureReason;
+    /** Underlying error message for `key_mismatch`. Absent for plaintext. */
+    cause?: string;
+}
+export interface SecretVerificationReport {
+    ok: boolean;
+    failures: SecretVerificationFailure[];
+    /** True if at least one row holds an unencrypted apiKey at rest. */
+    plaintextFound: boolean;
+}
+//# sourceMappingURL=secrets.d.ts.map

package/dist/computeServer/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/computeServer/secrets.ts"],"names":[],"mappings":"AAOA;;;;;;;;;;;;;;GAcG;AAEH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAExD;AAED,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAYpE;AAED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAcnE;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAQnD;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,+BAA+B,GAAG,cAAc,GAAG,mBAAmB,CAAC;AAEnF,MAAM,WAAW,yBAAyB;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,+BAA+B,CAAC;IACxC,yEAAyE;IACzE,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,wBAAwB;IACxC,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,EAAE,yBAAyB,EAAE,CAAC;IACtC,oEAAoE;IACpE,cAAc,EAAE,OAAO,CAAC;CACxB"}

package/dist/computeServer/secrets.js

@@ -0,0 +1,67 @@
+import { randomBytes, createCipheriv, createDecipheriv } from 'node:crypto';
+const ALGO = 'aes-256-gcm';
+const IV_BYTES = 12;
+const TAG_BYTES = 16;
+const PREFIX = 'enc:v1:';
+/**
+ * AES-256-GCM envelope for at-rest secrets (e.g. compute API keys).
+ *
+ * Wire format: `enc:v1:<base64(iv|tag|ciphertext)>`. The version prefix lets
+ * us migrate to a new algorithm later without ambiguity. Plaintext never sits
+ * at rest — on disk (local provider) or in the DB (Supabase provider).
+ *
+ * Security model: defends against backup leaks, accidental file/DB sharing,
+ * and read-only storage access. An attacker with both the stored ciphertext
+ * *and* the master key (`SELVA_AT_REST_KEY` env var, process memory) can still
+ * decrypt — this is encryption at rest, not a secret manager.
+ *
+ * Provider-agnostic: pure `node:crypto`, no fs or DB coupling, so both the
+ * local and Supabase compute-server stores share this one implementation.
+ */
+export function isEncryptedSecret(value) {
+    return value.startsWith(PREFIX);
+}
+export function encryptSecret(plaintext, key) {
+    if (key.length !== 32) {
+        throw new Error(`Secret key must be 32 bytes; got ${key.length}`);
+    }
+    if (isEncryptedSecret(plaintext)) {
+        throw new Error('Refusing to encrypt a value that is already encrypted');
+    }
+    const iv = randomBytes(IV_BYTES);
+    const cipher = createCipheriv(ALGO, key, iv);
+    const ciphertext = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return PREFIX + Buffer.concat([iv, tag, ciphertext]).toString('base64');
+}
+export function decryptSecret(envelope, key) {
+    if (key.length !== 32) {
+        throw new Error(`Secret key must be 32 bytes; got ${key.length}`);
+    }
+    if (!isEncryptedSecret(envelope)) {
+        throw new Error('Value is not an encrypted secret envelope');
+    }
+    const buf = Buffer.from(envelope.slice(PREFIX.length), 'base64');
+    const iv = buf.subarray(0, IV_BYTES);
+    const tag = buf.subarray(IV_BYTES, IV_BYTES + TAG_BYTES);
+    const ciphertext = buf.subarray(IV_BYTES + TAG_BYTES);
+    const decipher = createDecipheriv(ALGO, key, iv);
+    decipher.setAuthTag(tag);
+    return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString('utf8');
+}
+/**
+ * Decode a `SELVA_AT_REST_KEY` env var into a 32-byte buffer. Accepts either
+ * 64-char hex or base64 (with or without padding). Throws on anything else
+ * so misconfiguration fails loudly at boot rather than silently producing
+ * an undecryptable value.
+ */
+export function decodeSecretKey(raw) {
+    if (/^[0-9a-fA-F]{64}$/.test(raw))
+        return Buffer.from(raw, 'hex');
+    const buf = Buffer.from(raw, 'base64');
+    if (buf.length === 32)
+        return buf;
+    throw new Error('SELVA_AT_REST_KEY must be 32 bytes encoded as 64-char hex or base64. ' +
+        "Generate one with: node -e \"console.log(require('crypto').randomBytes(32).toString('hex'))\"");
+}
+//# sourceMappingURL=secrets.js.map

package/dist/computeServer/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/computeServer/secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE5E,MAAM,IAAI,GAAG,aAAa,CAAC;AAC3B,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,MAAM,GAAG,SAAS,CAAC;AAEzB;;;;;;;;;;;;;;GAcG;AAEH,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC9C,OAAO,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE,GAAW;IAC3D,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,oCAAoC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,iBAAiB,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACrF,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAChC,OAAO,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,QAAgB,EAAE,GAAW;IAC1D,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,oCAAoC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC;IACjE,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,GAAG,SAAS,CAAC,CAAC;IACzD,MAAM,UAAU,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACjD,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACzB,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACxF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IAC1C,IAAI,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACvC,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,GAAG,CAAC;IAClC,MAAM,IAAI,KAAK,CACd,uEAAuE;QACtE,+FAA+F,CAChG,CAAC;AACH,CAAC"}

package/dist/context.d.ts

@@ -38,4 +38,11 @@ export declare const SYSTEM_CONTEXT: RequestContext;
  * `actingOrgId` returns false unless `instance_admin` or `system`.
  */
 export declare function hasPermission(ctx: RequestContext, permission: PlatformPermission | OrgPermission): boolean;
+/**
+ * Return the org the caller is acting as, or throw `ProviderError(403)` when
+ * the context has none. Stores that scope every row to an acting org repeat
+ * this guard; centralizing it keeps the failure a single, consistent 403
+ * rather than a `null` that leaks into a query as `org_id = undefined`.
+ */
+export declare function requireActingOrg(ctx: RequestContext): string;
 //# sourceMappingURL=context.d.ts.map

package/dist/context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAEjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAGhE;;;;;;;;;;GAUG;AACH,MAAM,WAAW,cAAc;IAC9B,wCAAwC;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,kBAAkB,EAAE,CAAC;IAC1C,6CAA6C;IAC7C,cAAc,EAAE,aAAa,EAAE,CAAC;IAChC,wCAAwC;IACxC,MAAM,CAAC,EAAE,IAAI,CAAC;IACd;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;GAGG;AACH,eAAO,MAAM,cAAc,EAAE,cAK5B,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,aAAa,CAC5B,GAAG,EAAE,cAAc,EACnB,UAAU,EAAE,kBAAkB,GAAG,aAAa,GAC5C,OAAO,CAOT"}
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAEjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAIhE;;;;;;;;;;GAUG;AACH,MAAM,WAAW,cAAc;IAC9B,wCAAwC;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,kBAAkB,EAAE,CAAC;IAC1C,6CAA6C;IAC7C,cAAc,EAAE,aAAa,EAAE,CAAC;IAChC,wCAAwC;IACxC,MAAM,CAAC,EAAE,IAAI,CAAC;IACd;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;GAGG;AACH,eAAO,MAAM,cAAc,EAAE,cAK5B,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,aAAa,CAC5B,GAAG,EAAE,cAAc,EACnB,UAAU,EAAE,kBAAkB,GAAG,aAAa,GAC5C,OAAO,CAOT;AAQD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,MAAM,CAK5D"}

package/dist/context.js

@@ -1,5 +1,6 @@
 import { ALL_PLATFORM_PERMISSIONS } from './permissions/types.js';
 import { ALL_ORG_PERMISSIONS } from './organizations/schemas.js';
+import { ProviderError } from './errors.js';
 /**
  * For server-internal operations outside any HTTP request (bootstrap,
  * janitors, migrations). Treated as fully authorized.
@@ -29,4 +30,16 @@ const PLATFORM_PERMISSION_VALUES = new Set(ALL_PLATFORM_PERMISSIONS);
 function isPlatformPermission(p) {
     return PLATFORM_PERMISSION_VALUES.has(p);
 }
+/**
+ * Return the org the caller is acting as, or throw `ProviderError(403)` when
+ * the context has none. Stores that scope every row to an acting org repeat
+ * this guard; centralizing it keeps the failure a single, consistent 403
+ * rather than a `null` that leaks into a query as `org_id = undefined`.
+ */
+export function requireActingOrg(ctx) {
+    if (!ctx.actingOrgId) {
+        throw new ProviderError('No acting organization in context', 403);
+    }
+    return ctx.actingOrgId;
+}
 //# sourceMappingURL=context.js.map

package/dist/context.js.map

@@ -1 +1 @@
-{"version":3,"file":"context.js","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAElE,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AA8BjE;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAmB;IAC7C,MAAM,EAAE,EAAE;IACV,mBAAmB,EAAE,CAAC,GAAG,wBAAwB,CAAC;IAClD,cAAc,EAAE,CAAC,GAAG,mBAAmB,CAAC;IACxC,MAAM,EAAE,IAAI;CACZ,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC5B,GAAmB,EACnB,UAA8C;IAE9C,IAAI,GAAG,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,GAAG,CAAC,mBAAmB,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAAE,OAAO,IAAI,CAAC;IACpE,IAAI,oBAAoB,CAAC,UAAU,CAAC,EAAE,CAAC;QACtC,OAAO,GAAG,CAAC,mBAAmB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,GAAG,CAAC,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAS,wBAAwB,CAAC,CAAC;AAE7E,SAAS,oBAAoB,CAAC,CAAS;IACtC,OAAO,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC1C,CAAC"}
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAElE,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AA8B5C;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAmB;IAC7C,MAAM,EAAE,EAAE;IACV,mBAAmB,EAAE,CAAC,GAAG,wBAAwB,CAAC;IAClD,cAAc,EAAE,CAAC,GAAG,mBAAmB,CAAC;IACxC,MAAM,EAAE,IAAI;CACZ,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC5B,GAAmB,EACnB,UAA8C;IAE9C,IAAI,GAAG,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,GAAG,CAAC,mBAAmB,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAAE,OAAO,IAAI,CAAC;IACpE,IAAI,oBAAoB,CAAC,UAAU,CAAC,EAAE,CAAC;QACtC,OAAO,GAAG,CAAC,mBAAmB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,GAAG,CAAC,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAS,wBAAwB,CAAC,CAAC;AAE7E,SAAS,oBAAoB,CAAC,CAAS;IACtC,OAAO,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAmB;IACnD,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QACtB,MAAM,IAAI,aAAa,CAAC,mCAAmC,EAAE,GAAG,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,GAAG,CAAC,WAAW,CAAC;AACxB,CAAC"}

package/dist/data/interface.d.ts

@@ -21,7 +21,21 @@ import type { IInviteStore } from '../invites/interface.js';
 import type { IUserProfileStore } from '../userProfile/interface.js';
 import type { IPlatformPermissionStore } from '../permissions/interface.js';
 import type { IAuditQuery } from '../events/audit.js';
+import type { IEventSink } from '../events/interface.js';
 import type { RequestContext } from '../context.js';
+/**
+ * Result of the app↔DB schema handshake (audit O3). `expected` is the
+ * migration head the running app was built against; `actual` is what the
+ * database reports (`null` when the database can't even answer — e.g. the
+ * handshake function itself was never migrated in).
+ */
+export interface SchemaVersionReport {
+    ok: boolean;
+    expected: string;
+    actual: string | null;
+    /** Operator-facing explanation + recovery hint when not ok. */
+    message?: string;
+}
 export interface IDataProvider {
     orgs: IOrgStore;
     projects: IProjectStore;
@@ -38,6 +52,25 @@ export interface IDataProvider {
      * `/admin/audit` UI degrades to its "no backend wired" state.
      */
     auditQuery?: IAuditQuery;
+    /**
+     * The write-side event sink this provider's stores emit into. Optional —
+     * exposed so app code with no store mutation to piggyback on (e.g. the
+     * self-update route, audit O2) can emit domain events into the same log.
+     * Callers fall back to `NoopEventSink` when absent.
+     */
+    events?: IEventSink;
+    /**
+     * App↔DB schema handshake (audit O3). Optional — implemented by adapters
+     * whose schema is migrated out-of-band (Supabase: `supabase db push` is a
+     * manual operator step the app can't run itself). Boot health calls this
+     * structurally (same pattern as `IComputeServerStore.verifySecrets`) and
+     * drives `/api/health` to 503 when the database is behind the app, so
+     * monitoring — and the self-update runner's health probe — catch schema
+     * skew instead of surfacing it as per-request store errors.
+     *
+     * MUST NOT throw: report failure via `ok: false`.
+     */
+    verifySchemaVersion?(): Promise<SchemaVersionReport>;
     /**
      * Idempotently register a user in the data layer. Called by `hooks.server.ts`
      * after `verifyToken` succeeds, so the data layer always has a row for the

package/dist/data/interface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"interface.d.ts","sourceRoot":"","sources":["../../src/data/interface.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AACnF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAC5E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,MAAM,WAAW,aAAa;IAC7B,IAAI,EAAE,SAAS,CAAC;IAChB,QAAQ,EAAE,aAAa,CAAC;IACxB,WAAW,EAAE,gBAAgB,CAAC;IAC9B,aAAa,EAAE,mBAAmB,CAAC;IACnC,OAAO,EAAE,YAAY,CAAC;IACtB,UAAU,EAAE,eAAe,CAAC;IAC5B,WAAW,EAAE,iBAAiB,CAAC;IAC/B,WAAW,EAAE,wBAAwB,CAAC;IACtC,qBAAqB,EAAE,0BAA0B,CAAC;IAClD;;;;OAIG;IACH,UAAU,CAAC,EAAE,WAAW,CAAC;IAEzB;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE/D;;;;;;;;;;OAUG;IACH,aAAa,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClE"}
+{"version":3,"file":"interface.d.ts","sourceRoot":"","sources":["../../src/data/interface.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AACnF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAC5E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IACnC,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,+DAA+D;IAC/D,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC7B,IAAI,EAAE,SAAS,CAAC;IAChB,QAAQ,EAAE,aAAa,CAAC;IACxB,WAAW,EAAE,gBAAgB,CAAC;IAC9B,aAAa,EAAE,mBAAmB,CAAC;IACnC,OAAO,EAAE,YAAY,CAAC;IACtB,UAAU,EAAE,eAAe,CAAC;IAC5B,WAAW,EAAE,iBAAiB,CAAC;IAC/B,WAAW,EAAE,wBAAwB,CAAC;IACtC,qBAAqB,EAAE,0BAA0B,CAAC;IAClD;;;;OAIG;IACH,UAAU,CAAC,EAAE,WAAW,CAAC;IACzB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,UAAU,CAAC;IAEpB;;;;;;;;;;OAUG;IACH,mBAAmB,CAAC,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAErD;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE/D;;;;;;;;;;OAUG;IACH,aAAa,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClE"}

package/dist/definitions/interface.d.ts

@@ -22,8 +22,26 @@ export interface IDefinitionStore {
     create(ctx: RequestContext, record: DefinitionRecord): Promise<void>;
     update(ctx: RequestContext, guid: string, patch: DefinitionRecordPatch): Promise<void>;
     delete(ctx: RequestContext, guid: string): Promise<void>;
+    /**
+     * Cascade hook: soft-delete every live definition in a project. Called by
+     * `IProjectStore.deleteProject` — a deleted project must never keep serving
+     * its definitions (they surface in the library/public listings independent
+     * of the project row). No-op when the project has none. Mirrors the
+     * `deleteByProject` cascade hooks on `IPlatformProjectGrantStore`.
+     */
+    deleteByProject(ctx: RequestContext, projectId: string): Promise<void>;
     /** Atomic +1 on the solve counter. No-op if the record doesn't exist. */
     incrementSolveCount(ctx: RequestContext, guid: string): Promise<void>;
+    /**
+     * Atomically reserve the next `versionNumber` for a new version: returns the
+     * current `nextVersionNumber` and advances the counter by 1 in a single
+     * operation (so concurrent uploads never collide on a number/fileKey). The
+     * counter is monotonic and NEVER decremented — deleting the latest version
+     * does not free its number, so a delete-then-reupload mints a fresh number and
+     * fresh `fileKey` instead of overwriting the deleted blob's key. Throws if the
+     * definition doesn't exist.
+     */
+    reserveNextVersionNumber(ctx: RequestContext, guid: string): Promise<number>;
     createVersion(ctx: RequestContext, version: DefinitionVersion): Promise<void>;
     /** Newest first by `versionNumber`. */
     listVersions(ctx: RequestContext, definitionId: string, opts?: ListOptions): Promise<Page<DefinitionVersion>>;

package/dist/definitions/interface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"interface.d.ts","sourceRoot":"","sources":["../../src/definitions/interface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACjF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,KAAK,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE7F;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAEhC,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACzF,aAAa,CACZ,GAAG,EAAE,cAAc,EACnB,SAAS,EAAE,MAAM,EACjB,IAAI,CAAC,EAAE,qBAAqB,GAC1B,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACnC;;;;OAIG;IACH,UAAU,CACT,GAAG,EAAE,cAAc,EACnB,IAAI,CAAC,EAAE,qBAAqB,GAAG;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAC/C,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACnC,GAAG,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACzE,MAAM,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,MAAM,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvF,MAAM,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzD,yEAAyE;IACzE,mBAAmB,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAGtE,aAAa,CAAC,GAAG,EAAE,cAAc,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,uCAAuC;IACvC,YAAY,CACX,GAAG,EAAE,cAAc,EACnB,YAAY,EAAE,MAAM,EACpB,IAAI,CAAC,EAAE,WAAW,GAChB,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACpC,UAAU,CAAC,GAAG,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;IAEtF;;;;;OAKG;IACH,gBAAgB,CAAC,GAAG,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1F;;;OAGG;IACH,aAAa,CAAC,GAAG,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAErE,+EAA+E;IAC/E,cAAc,CAAC,GAAG,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5F,eAAe,CAAC,GAAG,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE7F;;;;;;;;;;;;;OAaG;IACH,oBAAoB,CAAC,GAAG,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClG"}
+{"version":3,"file":"interface.d.ts","sourceRoot":"","sources":["../../src/definitions/interface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACjF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,KAAK,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE7F;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAEhC,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACzF,aAAa,CACZ,GAAG,EAAE,cAAc,EACnB,SAAS,EAAE,MAAM,EACjB,IAAI,CAAC,EAAE,qBAAqB,GAC1B,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACnC;;;;OAIG;IACH,UAAU,CACT,GAAG,EAAE,cAAc,EACnB,IAAI,CAAC,EAAE,qBAAqB,GAAG;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAC/C,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACnC,GAAG,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACzE,MAAM,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,MAAM,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvF,MAAM,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzD;;;;;;OAMG;IACH,eAAe,CAAC,GAAG,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvE,yEAAyE;IACzE,mBAAmB,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtE;;;;;;;;OAQG;IACH,wBAAwB,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAG7E,aAAa,CAAC,GAAG,EAAE,cAAc,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,uCAAuC;IACvC,YAAY,CACX,GAAG,EAAE,cAAc,EACnB,YAAY,EAAE,MAAM,EACpB,IAAI,CAAC,EAAE,WAAW,GAChB,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACpC,UAAU,CAAC,GAAG,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;IAEtF;;;;;OAKG;IACH,gBAAgB,CAAC,GAAG,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1F;;;OAGG;IACH,aAAa,CAAC,GAAG,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAErE,+EAA+E;IAC/E,cAAc,CAAC,GAAG,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5F,eAAe,CAAC,GAAG,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE7F;;;;;;;;;;;;;OAaG;IACH,oBAAoB,CAAC,GAAG,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClG"}

package/dist/definitions/schemas.d.ts

@@ -54,6 +54,7 @@ export declare const UpdateMetadataInputSchema: z.ZodObject<{
     tags: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
     projectId: z.ZodOptional<z.ZodString>;
     computeServerId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    solveCacheLimit: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
     status: z.ZodOptional<z.ZodEnum<{
         draft: "draft";
         published: "published";

package/dist/definitions/schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../src/definitions/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,UAAU,QAAoE,CAAC;AAE5F,eAAO,MAAM,UAAU,aAAsD,CAAC;AAE9E,eAAO,MAAM,sBAAsB;;;;EAA6C,CAAC;AAEjF,eAAO,MAAM,uBAAuB;;;EAAwB,CAAC;AAE7D,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;iBAclC,CAAC;AAEH,eAAO,MAAM,uBAAuB;;;EAA4B,CAAC;AAEjE,oDAAoD;AACpD,eAAO,MAAM,2BAA2B;;;;;;;;iBAQtC,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;iBASpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,uDAAuD;AACvD,eAAO,MAAM,yBAAyB;;kBAIzB,CAAC"}
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../src/definitions/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,UAAU,QAAoE,CAAC;AAE5F,eAAO,MAAM,UAAU,aAAsD,CAAC;AAE9E,eAAO,MAAM,sBAAsB;;;;EAA6C,CAAC;AAEjF,eAAO,MAAM,uBAAuB;;;EAAwB,CAAC;AAE7D,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;iBAclC,CAAC;AAEH,eAAO,MAAM,uBAAuB;;;EAA4B,CAAC;AAEjE,oDAAoD;AACpD,eAAO,MAAM,2BAA2B;;;;;;;;iBAQtC,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;iBAYpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,uDAAuD;AACvD,eAAO,MAAM,yBAAyB;;kBAIzB,CAAC"}

package/dist/definitions/schemas.js

@@ -43,6 +43,9 @@ export const UpdateMetadataInputSchema = z.object({
     tags: z.array(z.string().max(64)).max(20).nullable().optional(),
     projectId: GuidSchema.optional(),
     computeServerId: GuidSchema.nullable().optional(),
+    // L2 cache quota (R9): 0 = off, N = per-definition entry cap, null = inherit
+    // the global default. Bounded so a settings typo can't request a runaway quota.
+    solveCacheLimit: z.number().int().min(0).max(100_000).nullable().optional(),
     status: DefinitionStatusSchema.optional()
 });
 /** Body for `POST /api/definitions/[guid]/publish`. */

package/dist/definitions/schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../src/definitions/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,UAAU,GAAG,iEAAiE,CAAC;AAE5F,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,qBAAqB,CAAC,CAAC;AAE9E,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;AAEjF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;AAE7D,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,EAAE,EAAE,UAAU;IACd,YAAY,EAAE,UAAU;IACxB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,OAAO,EAAE,uBAAuB;IAChC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAChD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IAC3C,6EAA6E;IAC7E,wEAAwE;IACxE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpD,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAEjE,oDAAoD;AACpD,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACnE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IAC5C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IAC3C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACxC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpD,SAAS,EAAE,UAAU;IACrB,eAAe,EAAE,UAAU,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC9E,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACvD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACtD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACnD,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC/D,SAAS,EAAE,UAAU,CAAC,QAAQ,EAAE;IAChC,eAAe,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACjD,MAAM,EAAE,sBAAsB,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AAIH,uDAAuD;AACvD,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC;KACxC,MAAM,CAAC;IACP,SAAS,EAAE,UAAU,CAAC,QAAQ,EAAE;CAChC,CAAC;KACD,OAAO,CAAC,EAAE,CAAC,CAAC"}
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../src/definitions/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,UAAU,GAAG,iEAAiE,CAAC;AAE5F,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,qBAAqB,CAAC,CAAC;AAE9E,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;AAEjF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;AAE7D,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,EAAE,EAAE,UAAU;IACd,YAAY,EAAE,UAAU;IACxB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,OAAO,EAAE,uBAAuB;IAChC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAChD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IAC3C,6EAA6E;IAC7E,wEAAwE;IACxE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpD,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAEjE,oDAAoD;AACpD,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACnE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IAC5C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IAC3C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACxC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpD,SAAS,EAAE,UAAU;IACrB,eAAe,EAAE,UAAU,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC9E,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACvD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACtD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACnD,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC/D,SAAS,EAAE,UAAU,CAAC,QAAQ,EAAE;IAChC,eAAe,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACjD,6EAA6E;IAC7E,gFAAgF;IAChF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC3E,MAAM,EAAE,sBAAsB,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AAIH,uDAAuD;AACvD,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC;KACxC,MAAM,CAAC;IACP,SAAS,EAAE,UAAU,CAAC,QAAQ,EAAE;CAChC,CAAC;KACD,OAAO,CAAC,EAAE,CAAC,CAAC"}

package/dist/definitions/service.d.ts

@@ -0,0 +1,62 @@
+import type { IDataProvider } from '../data/interface.js';
+import type { IStorageProvider } from '../storage/interface.js';
+import type { RequestContext } from '../context.js';
+import type { DefinitionRecord, DefinitionFileExt, DefinitionMeta } from './types.js';
+import type { UpdateMetadataInput } from './schemas.js';
+export interface CreateDefinitionInput {
+    guid: string;
+    projectId: string;
+    ownerId: string;
+    fileExt: DefinitionFileExt;
+    meta: DefinitionMeta;
+    computeServerId?: string;
+    maxHistory?: number;
+}
+/**
+ * Default age threshold after which a 'pending' record is considered stale.
+ * Conservative — covers slow uploads over weak connections.
+ */
+export declare const PENDING_GC_AGE_MS: number;
+/**
+ * Orchestrates writes that span IDataProvider + IStorageProvider.
+ *
+ * Ordering rules (see Phase 4 of the provider refactor):
+ *
+ *   create — metadata-first:
+ *     1. Write record with status='pending'
+ *     2. Upload blob
+ *     3. Flip status to 'ready'
+ *   If step 2 fails the record stays 'pending' with no blob. List queries
+ *   filter 'pending' by default, so no consumer sees the half-written state.
+ *   The janitor (gcStalePending) sweeps records older than PENDING_GC_AGE_MS.
+ *
+ *   updateFile — best-effort with retry-safe shape:
+ *     1. Archive current file to history blob
+ *     2. Append history entry to record
+ *     3. Write new file to the active blob path
+ *     4. Prune history beyond maxHistory
+ *   A failure between 2 and 3 leaves the record pointing at a missing active
+ *   blob. The operation is idempotent — retrying with the same file restores
+ *   a consistent state. This is an acknowledged limitation; the create path
+ *   is where orphan risk is highest and is the one we fully guard.
+ */
+export declare class DefinitionService {
+    private data;
+    private storage;
+    constructor(data: IDataProvider, storage: IStorageProvider);
+    create(ctx: RequestContext, input: CreateDefinitionInput, file: Uint8Array): Promise<DefinitionRecord>;
+    updateFile(ctx: RequestContext, guid: string, file: Uint8Array, ext: DefinitionFileExt, originalName: string): Promise<void>;
+    updateMeta(ctx: RequestContext, guid: string, patch: UpdateMetadataInput): Promise<void>;
+    saveCoverImage(ctx: RequestContext, guid: string, imageData: Uint8Array): Promise<void>;
+    revertToVersion(ctx: RequestContext, guid: string, ref: string): Promise<void>;
+    delete(ctx: RequestContext, guid: string): Promise<void>;
+    /**
+     * Janitor — delete records stuck in 'pending' for longer than ageMs and
+     * any blobs they may have written. Safe to run on a schedule.
+     * Runs under SYSTEM_CONTEXT; callers don't pass one.
+     *
+     * @returns Number of records reclaimed.
+     */
+    gcStalePending(ageMs?: number): Promise<number>;
+}
+//# sourceMappingURL=service.d.ts.map

package/dist/definitions/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/definitions/service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAGpD,OAAO,KAAK,EACX,gBAAgB,EAEhB,iBAAiB,EACjB,cAAc,EACd,MAAM,YAAY,CAAC;AAEpB,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAExD,MAAM,WAAW,qBAAqB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,iBAAiB,CAAC;IAC3B,IAAI,EAAE,cAAc,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,eAAO,MAAM,iBAAiB,QAAiB,CAAC;AAEhD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAAa,iBAAiB;IAE5B,OAAO,CAAC,IAAI;IACZ,OAAO,CAAC,OAAO;gBADP,IAAI,EAAE,aAAa,EACnB,OAAO,EAAE,gBAAgB;IAG5B,MAAM,CACX,GAAG,EAAE,cAAc,EACnB,KAAK,EAAE,qBAAqB,EAC5B,IAAI,EAAE,UAAU,GACd,OAAO,CAAC,gBAAgB,CAAC;IAiCtB,UAAU,CACf,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,UAAU,EAChB,GAAG,EAAE,iBAAiB,EACtB,YAAY,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC;IAwCV,UAAU,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;IAYxF,cAAc,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAOvF,eAAe,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAc9E,MAAM,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ9D;;;;;;OAMG;IACG,cAAc,CAAC,KAAK,GAAE,MAA0B,GAAG,OAAO,CAAC,MAAM,CAAC;CASxE"}