@selvajs/platform 0.14.2 → 0.15.0-beta.1

package/src/auth/interface.ts

@@ -1,279 +0,0 @@
-import type { AuthUser, LoginResult, UserManagementResult } from './types.js';
-import type { ListOptions, Page } from '../pagination.js';
-
-/**
- * Optional password-based authentication surface. Implemented by providers
- * that own credentials (Local, Supabase Auth). OIDC-only providers leave
- * `IAuthProvider.passwordAuth` undefined.
- */
-export interface IPasswordAuth {
-	/**
-	 * Verify credentials. Discriminated union — callers MUST `switch (result.kind)`,
-	 * never treat truthiness as authenticated.
-	 */
-	verifyLogin(email: string, password: string): Promise<LoginResult>;
-
-	/**
-	 * Admin-initiated user creation. Pure identity — callers grant platform
-	 * permissions separately via `IPlatformPermissionStore.set`.
-	 */
-	createUserWithPassword(email: string, password: string): Promise<AuthUser>;
-
-	/** Self-service registration. Return null when self-registration is disabled. */
-	registerUser?(email: string, password: string): Promise<AuthUser | null>;
-}
-
-/**
- * Optional OAuth surface. Implemented by providers that broker OAuth flows
- * (Supabase Auth, future Eterna/Auth0/etc.). Local credential-only providers
- * leave `IAuthProvider.oauth` undefined.
- *
- * Lifecycle is the standard authorization-code flow:
- *
- *   1. Browser hits `/auth/{provider}/start?provider=google` → server calls
- *      `getOAuthAuthorizationUrl` and 303s to the result.
- *   2. IdP redirects back to `/auth/{provider}/callback?code=...` →
- *      server calls `exchangeOAuthCode` to mint the session pair.
- *   3. When the access token expires, the session-refresh middleware in
- *      `hooks.server.ts` calls `refreshSession` with the stored refresh
- *      token to swap for a fresh pair without bouncing the user.
- *
- * Each method returns `null` (rather than throwing) on irrecoverable
- * credential failures — the route layer translates `null` into the right
- * HTTP shape (401 for refresh, login redirect for callback).
- */
-export interface IOAuthAuth {
-	/**
-	 * The OAuth providers this adapter is configured to broker. Returned as
-	 * lowercased identifiers ("google", "github", …) — the adapter reads its
-	 * own configuration source (env var, dashboard, hard-coded list) and
-	 * decides what's available. Empty array when none are wired.
-	 *
-	 * Driving adapters (HTTP routes, UI) call this instead of reading
-	 * provider-specific env vars directly — keeps the provider name out of
-	 * `selva`.
-	 */
-	listProviders(): readonly string[];
-
-	/**
-	 * Build the IdP authorization URL the browser should be redirected to.
-	 * `redirectTo` is the full callback URL — must be the route that handles
-	 * the `?code=...` exchange. Provider-name validation is the caller's job;
-	 * passing an unconfigured provider may surface as an upstream error.
-	 */
-	getOAuthAuthorizationUrl(
-		provider: 'google' | 'github' | 'azure' | 'gitlab',
-		redirectTo: string
-	): Promise<string>;
-
-	/**
-	 * Exchange an authorization code for a session. Returns the resolved
-	 * identity and an access/refresh token pair. `null` when the code is
-	 * invalid, expired, or already redeemed — callers MUST treat null as
-	 * "send the user back to /login".
-	 */
-	exchangeOAuthCode(code: string): Promise<{
-		user: AuthUser;
-		sessionToken: string;
-		refreshToken: string;
-	} | null>;
-
-	/**
-	 * Swap a refresh token for a fresh access/refresh pair. Returns null on
-	 * irrecoverable failure (revoked, expired, signed by a different secret);
-	 * the session-refresh middleware treats null as "force re-login" by
-	 * clearing the refresh cookie.
-	 */
-	refreshSession(refreshToken: string): Promise<{
-		sessionToken: string;
-		refreshToken: string;
-	} | null>;
-}
-
-/**
- * Optional passwordless email surface — "type your email, click the link in
- * your inbox, you're in." Implemented by providers that broker email delivery
- * + token verification (Supabase Auth, future Eterna ID, …). Adapters that
- * can't send mail or don't model this flow leave `IAuthProvider.emailLink`
- * undefined.
- *
- * Lifecycle is two phases mirroring OAuth's start/callback split:
- *
- *   1. User submits an email → server calls `sendMagicLink(email,
- *      callbackUrl)`. The adapter delivers a link to that callback URL with
- *      whatever verification token shape it uses (Supabase: `?token_hash=…
- *      &type=magiclink`).
- *   2. User clicks the link, browser hits the callback route → server calls
- *      `verifyMagicLink(rawTokenFromUrl)` to mint a session.
- *
- * The driving adapter never inspects the token itself — it forwards the raw
- * URL string. Adapter-specific token shapes stay inside the adapter.
- */
-export interface IEmailLinkAuth {
-	/**
-	 * Send a magic-link email. `callbackUrl` is the absolute URL the
-	 * adapter should embed in the link — must point at the route that
-	 * handles `verifyMagicLink`.
-	 *
-	 * Returns `{ ok: true }` on success. On adapter-classified failures
-	 * (rate limit, signup disabled, invalid email) returns
-	 * `{ ok: false, reason }` so the route can render a user-friendly
-	 * message without exposing provider internals. Network/unknown errors
-	 * still throw.
-	 */
-	sendMagicLink(
-		email: string,
-		callbackUrl: string
-	): Promise<
-		{ ok: true } | { ok: false; reason: 'rate_limited' | 'signup_disabled' | 'invalid_email' }
-	>;
-
-	/**
-	 * Verify the token the IdP sent the user. `rawCallbackUrl` is the full
-	 * URL the user landed on (or an opaque adapter-specific token string —
-	 * adapters document which); the adapter pulls whatever fields it needs.
-	 *
-	 * Returns `null` for invalid/expired/already-redeemed tokens — callers
-	 * MUST treat null as "send the user back to /login". `refreshToken` is
-	 * present only for adapters that issue refresh tokens for email-link
-	 * sessions (Supabase does); omit otherwise.
-	 */
-	verifyMagicLink(rawCallbackUrl: string): Promise<{
-		user: AuthUser;
-		sessionToken: string;
-		refreshToken?: string;
-	} | null>;
-}
-
-/**
- * Optional forward-proxy authentication surface. Implemented by providers
- * that derive identity from signals injected by a trusted upstream reverse
- * proxy (HTTP headers, mTLS, etc.) — e.g. Caddy `forward_auth`,
- * oauth2-proxy, Authelia, Pomerium, Traefik forward-auth.
- *
- * ⚠ TRUST BOUNDARY — READ BEFORE IMPLEMENTING ⚠
- *
- * The signals this surface consumes are NOT verified cryptographically by
- * Selva. They are trusted because the deployment runs the app behind a
- * proxy that:
- *
- *   1. Authenticates the user against an upstream IdP, AND
- *   2. STRIPS any client-supplied copies of the trusted headers from
- *      inbound requests before adding its own, AND
- *   3. Is the ONLY network path that can reach the app process (bind to
- *      127.0.0.1, firewall the app port, or a private socket).
- *
- * If any condition fails, an attacker can spoof the headers and become
- * anyone. **Each implementer of this interface MUST ship a README that
- * states, loudly, the exact proxy configuration required.** The platform
- * layer cannot verify this — it is the provider's contract with its
- * operator.
- *
- * Lifecycle: `identifyFromHeaders` is called from `hooks.server.ts` on
- * every authed request whose session cookie is missing or invalid. It MUST
- * be cheap — a header read plus at most one indexed lookup. No network
- * calls, no synchronous disk scans of unbounded size.
- */
-export interface IProxyAuth {
-	/**
-	 * Identify the caller from trusted upstream-proxy signals on the
-	 * incoming request. Return `null` for "not identified" (header missing,
-	 * UPN not allowlisted, account disabled). MUST NOT throw for absent
-	 * headers — those are the normal anonymous case.
-	 *
-	 * On first identification of a previously-allowlisted user, the
-	 * implementation MAY materialize stored fields (display name, email)
-	 * from the same headers. Auto-creating arbitrary users from headers
-	 * is forbidden: the allowlist IS the security boundary.
-	 */
-	identifyFromHeaders(headers: Headers): Promise<AuthUser | null>;
-
-	/**
-	 * Diagnostic helper. Returns true iff none of the identity headers this
-	 * provider trusts arrived on the request. The hook layer uses this on
-	 * `/login` misses to distinguish "proxy never reached us" from "proxy is
-	 * here but didn't recognise the user" so operators can tell silent
-	 * forward-auth misconfigurations apart from real allowlist gaps without
-	 * leaking the trusted header names to end users.
-	 */
-	hasNoIdentityHeaders(headers: Headers): boolean;
-
-	/**
-	 * Diagnostic helper. Returns the identity-header names this provider is
-	 * configured to read. Used purely for log output — never surfaced to end
-	 * users.
-	 */
-	readonly configuredHeaderNames: readonly string[];
-}
-
-/**
- * Authentication provider — identity verification only. Profile state lives
- * in `IUserProfileStore`, platform permissions in `IPlatformPermissionStore`,
- * password ops in optional `passwordAuth`, OAuth in optional `oauth`.
- *
- * Methods here do NOT take a `RequestContext` — the provider produces the
- * identity used to *build* the context.
- */
-export interface IAuthProvider {
-	/** Display name shown in admin UI (e.g. "Local", "Microsoft Entra ID"). */
-	readonly name: string;
-
-	/** Present for credential-owning providers; undefined for OIDC-only. */
-	readonly passwordAuth?: IPasswordAuth;
-
-	/** Present for providers that broker OAuth flows; undefined otherwise. */
-	readonly oauth?: IOAuthAuth;
-
-	/**
-	 * Present for providers that send sign-in links over email (Supabase Auth,
-	 * future Eterna ID). Undefined otherwise.
-	 */
-	readonly emailLink?: IEmailLinkAuth;
-
-	/**
-	 * Present for providers that derive identity from a trusted upstream
-	 * proxy (forward-auth headers, mTLS, etc.). Undefined for credential
-	 * or OIDC-broker providers. See `IProxyAuth` for the trust contract.
-	 *
-	 * When set, the platform treats sign-out as the proxy/IdP's job and
-	 * does not render a logout button — Selva has no session to destroy.
-	 */
-	readonly proxyAuth?: IProxyAuth;
-
-	/**
-	 * Verify a token (session cookie, JWT, ID token, etc.). Returns the user
-	 * or null when invalid/expired.
-	 */
-	verifyToken(token: string): Promise<AuthUser | null>;
-
-	getUser(id: string): Promise<AuthUser | null>;
-
-	/** Returns null if the provider does not support user management. */
-	listUsers(opts?: ListOptions): Promise<Page<AuthUser> | null>;
-
-	/**
-	 * Optional: allowlist a user without a password (OAuth providers). Pure
-	 * identity — callers grant permissions via `IPlatformPermissionStore.set`.
-	 */
-	createUser?(email: string): Promise<AuthUser>;
-
-	/**
-	 * Delete a user identity. The sole-`instance_admin` invariant is NOT
-	 * enforced here — callers MUST consult
-	 * `IPlatformPermissionStore.countInstanceAdminsExcluding(id)` first and
-	 * surface `'last_admin'` themselves.
-	 */
-	deleteUser(id: string): Promise<UserManagementResult>;
-
-	/**
-	 * Disable a user. Sessions become invalid; identity is preserved (preferred
-	 * over deletion). Same invariant rules as `deleteUser`.
-	 */
-	disableUser(id: string): Promise<UserManagementResult>;
-
-	/**
-	 * Stamp `lastLoginAt`. Best-effort — failure MUST NOT block auth.
-	 * Adapters MAY debounce (e.g. skip if existing timestamp < 60s old).
-	 */
-	touchLastLogin?(id: string): Promise<void>;
-}

package/src/auth/types.ts

@@ -1,32 +0,0 @@
-/**
- * Identity record from an auth provider. Pure identity — no Selva-specific
- * authorization or profile state. Platform permissions live in
- * `IPlatformPermissionStore`; profile state lives in `IUserProfileStore`.
- */
-export interface AuthUser {
-	id: string;
-	email?: string;
-	/** Provider-specific only — never PII, credentials, or tokens. */
-	metadata?: Record<string, unknown>;
-	createdAt?: string;
-	/** Provider-updated only; never client-writable. */
-	lastLoginAt?: string;
-	/** When true, `verifyToken` and `verifyLogin` MUST fail. Prefer over deletion. */
-	disabled?: boolean;
-}
-
-/**
- * - `ok`            — succeeded
- * - `not_found`     — target user doesn't exist
- * - `not_supported` — provider doesn't implement user management
- * - `last_admin`    — refused; would leave zero `instance_admin` users
- */
-export type UserManagementResult = 'ok' | 'not_found' | 'not_supported' | 'last_admin';
-
-/**
- * - `success` — credentials valid; includes session token the provider minted.
- * - `failed` — credentials invalid, user disabled, or rate-limited.
- */
-export type LoginResult =
-	| { kind: 'success'; user: AuthUser; sessionToken: string }
-	| { kind: 'failed'; reason?: 'invalid_credentials' | 'disabled' | 'rate_limited' };

package/src/bindings/index.ts

@@ -1,2 +0,0 @@
-export type { IBindingResolver } from './interface.js';
-export { NoopBindingResolver } from './interface.js';

package/src/bindings/interface.ts

@@ -1,61 +0,0 @@
-/**
- * Server-side resolver for inputs marked as `source: { kind: 'server', key }`
- * in the schema. The host (selva app or a fork) supplies an implementation;
- * the platform stays domain-agnostic.
- *
- * Keys are opaque strings. The host defines the namespace
- * (e.g. 'capture.geometry', 'parcel.boundary') and the resolver interprets it
- * however it likes — typically as an address into the host's own domain store.
- *
- * Status: preliminary. The interface is expected to refine once we wire a
- * real binding end-to-end (see docs/upstream-binding-prep PR plan). Current
- * shape is the minimum needed to slot a host implementation behind
- * `SelvaConfig.bindingResolver`.
- */
-
-import type { RequestContext } from '../context.js';
-
-export interface IBindingResolver {
-	/**
-	 * Resolve a batch of bound keys in one call.
-	 *
-	 *   - `keys` is what the schema author wrote (`source.key`) — opaque to the
-	 *     platform, interpreted by the resolver. The author writes keys at
-	 *     design time, so the key should describe WHAT attribute to read, not
-	 *     WHICH entity to read it from.
-	 *   - `scope` is set by the calling route at solve time — opaque to the
-	 *     platform, supplies the "which entity" anchor that varies per
-	 *     request (capture id, parcel id, custom struct). Optional because
-	 *     not every host needs it.
-	 *
-	 * Implementations should return ONLY the keys they successfully
-	 * resolved — absent entries in the returned map signal "missing" to the
-	 * caller, who then decides what to do (e.g. error the solve, or fall back
-	 * to the input's `default`).
-	 *
-	 * Do not throw for individual missing keys. Throw only for resolver-wide
-	 * failures (DB unreachable, configuration error). Per-key "not found" is
-	 * normal and is signalled by omitting the entry.
-	 *
-	 * Batching is intentional: a single solve often binds multiple inputs
-	 * from one domain object, and the resolver should be able to do that
-	 * with a single DB round-trip.
-	 */
-	resolve(
-		ctx: RequestContext,
-		keys: readonly string[],
-		scope?: unknown
-	): Promise<Map<string, unknown>>;
-}
-
-/**
- * Default resolver used when the host hasn't configured one. Returns an
- * empty map for any request, which makes every bound input fail at solve
- * time — a loud signal that a resolver needs to be wired up. Drop-in replace
- * via `SelvaConfig.bindingResolver` once the host has a real implementation.
- */
-export class NoopBindingResolver implements IBindingResolver {
-	async resolve(): Promise<Map<string, unknown>> {
-		return new Map();
-	}
-}

package/src/computeServer/index.ts

@@ -1,17 +0,0 @@
-export type {
-	ComputeServerConfig,
-	ComputeConfig,
-	PlatformComputeServer,
-	OrgComputeServer
-} from './types.js';
-export { isPlatformServer, isOrgServer } from './types.js';
-export type { IComputeServerStore } from './interface.js';
-export type { ResolveOptions } from './utils.js';
-export {
-	serversVisibleTo,
-	defaultServerIdFor,
-	resolveServerForOrg,
-	findServerById,
-	platformServers,
-	orgServersFor
-} from './utils.js';

package/src/computeServer/interface.ts

@@ -1,62 +0,0 @@
-import type { RequestContext } from '../context.js';
-import type { ComputeConfig, ComputeServerConfig } from './types.js';
-
-/**
- * Compute-server configuration. Architecture spec §4.8.
- *
- * One config doc holds *all* servers (platform + org-private) plus the
- * global `defaultServerId` and per-org `orgDefaults` map. Authorization is
- * the route layer's job — `manage_compute` for platform-server mutations,
- * `manage_org_compute` (gated by the `ALLOW_ORG_COMPUTE_OVERRIDE` flag) for
- * org-private mutations and `orgDefaults[orgId]`.
- */
-export interface IComputeServerStore {
-	/**
-	 * Read the full config. Callers (resolver, page loaders, route handlers)
-	 * apply the visibility predicate from `serversVisibleTo` themselves —
-	 * the store does not pre-filter, because the same row set is needed at
-	 * different scopes (admin manage vs. org manage vs. solve).
-	 */
-	getConfig(ctx: RequestContext): Promise<ComputeConfig>;
-
-	/**
-	 * Replace the entire platform-server set + global `defaultServerId`.
-	 * Org-private rows and `orgDefaults` are left untouched.
-	 */
-	savePlatformServers(
-		ctx: RequestContext,
-		servers: ComputeServerConfig[],
-		defaultServerId: string | undefined
-	): Promise<void>;
-
-	/**
-	 * Replace the org-private server set for `orgId` and (optionally) update
-	 * `orgDefaults[orgId]`. Platform rows are left untouched.
-	 *
-	 * Pass `defaultServerId: null` to clear the org's override; `undefined`
-	 * leaves the existing value alone.
-	 */
-	saveOrgServers(
-		ctx: RequestContext,
-		orgId: string,
-		servers: ComputeServerConfig[],
-		defaultServerId?: string | null
-	): Promise<void>;
-
-	/**
-	 * Set or clear `orgDefaults[orgId]`. The route layer is responsible for
-	 * verifying the chosen server is visible to the org before calling this.
-	 *
-	 * `serverId === null` clears the override.
-	 */
-	setOrgDefault(ctx: RequestContext, orgId: string, serverId: string | null): Promise<void>;
-
-	/**
-	 * Hard-delete this org's compute rows: org-private servers, the
-	 * `orgDefaults[orgId]` entry, and any references to this org inside
-	 * platform servers' `sharedWith` allowlists. No-op when none exist.
-	 * Called from `deleteOrg` so soft-deleting an org does not leave its
-	 * compute config behind.
-	 */
-	deleteByOrg(ctx: RequestContext, orgId: string): Promise<void>;
-}

package/src/computeServer/types.ts

@@ -1,74 +0,0 @@
-/**
- * Compute servers belong to one of two scopes — never both.
- *
- * - **Platform server** (`scope: 'platform'`) — created by `manage_compute`.
- *   `sharedWith` controls which orgs see it. The single global
- *   `defaultServerId` (in {@link ComputeConfig}) must reference a platform
- *   server and is *always* visible to every org regardless of `sharedWith`.
- *
- * - **Org-private server** (`scope: 'org'`) — created by an org owner/admin
- *   with `manage_org_compute`. Visible only to its `ownerOrgId`. Gated by
- *   the `ALLOW_ORG_COMPUTE_OVERRIDE` platform flag.
- *
- * Architecture spec §4.8.
- */
-export type ComputeServerConfig = PlatformComputeServer | OrgComputeServer;
-
-interface ComputeServerCommon {
-	id: string;
-	label: string;
-	/** Base URL of the Rhino.Compute instance. */
-	serverUrl: string;
-	/** Sent as `RhinoComputeKey` header. */
-	apiKey?: string;
-	/** Default: 30000. */
-	timeoutMs?: number;
-	/** Default: 0. */
-	retryCount?: number;
-}
-
-export interface PlatformComputeServer extends ComputeServerCommon {
-	scope: 'platform';
-	/**
-	 * Which orgs can see this server in pickers / use it for solves.
-	 *   - `'all'`  — every org. Default in `tenancy: 'single'`.
-	 *   - `string[]` — explicit org-id allowlist. `[]` = dormant
-	 *     (admin-only) unless this server is the global `defaultServerId`,
-	 *     which is always usable everywhere.
-	 */
-	sharedWith: 'all' | string[];
-}
-
-export interface OrgComputeServer extends ComputeServerCommon {
-	scope: 'org';
-	/** The org that owns this server. Visible only to members of this org. */
-	ownerOrgId: string;
-}
-
-export interface ComputeConfig {
-	servers: ComputeServerConfig[];
-	/**
-	 * Global default. Must reference a platform server. Always usable by
-	 * every org regardless of that server's `sharedWith` — this is the
-	 * "baseline server any user uses" floor.
-	 */
-	defaultServerId?: string;
-	/**
-	 * Per-org default override. `orgDefaults[orgId]` must reference a server
-	 * that is visible to `orgId` (a platform server with `orgId` in
-	 * `sharedWith` or `'all'`, or an org server owned by `orgId`).
-	 */
-	orgDefaults?: Record<string, string>;
-}
-
-// ============================================================================
-// Type guards
-// ============================================================================
-
-export function isPlatformServer(s: ComputeServerConfig): s is PlatformComputeServer {
-	return s.scope === 'platform';
-}
-
-export function isOrgServer(s: ComputeServerConfig): s is OrgComputeServer {
-	return s.scope === 'org';
-}

package/src/computeServer/utils.ts

@@ -1,112 +0,0 @@
-import {
-	isOrgServer,
-	isPlatformServer,
-	type ComputeConfig,
-	type ComputeServerConfig
-} from './types.js';
-
-/**
- * Servers an org can see in pickers and use for solves. Architecture spec §4.8.
- *
- * = platform servers shared with this org (or `'all'`, or the global default)
- * ∪ org-private servers owned by this org
- *
- * The global default is always included — it's the floor of the system.
- */
-export function serversVisibleTo(
-	config: ComputeConfig,
-	orgId: string | null | undefined
-): ComputeServerConfig[] {
-	return config.servers.filter((s) => {
-		if (isPlatformServer(s)) {
-			if (s.id === config.defaultServerId) return true;
-			if (s.sharedWith === 'all') return true;
-			if (orgId && s.sharedWith.includes(orgId)) return true;
-			return false;
-		}
-		// Org-private — visible only to its owner org.
-		return !!orgId && s.ownerOrgId === orgId;
-	});
-}
-
-/**
- * Resolve the default server id for an org. Per-org override → global default.
- * Returns `undefined` if neither is set or the chosen id is not visible.
- */
-export function defaultServerIdFor(
-	config: ComputeConfig,
-	orgId: string | null | undefined
-): string | undefined {
-	const visible = serversVisibleTo(config, orgId);
-	const visibleIds = new Set(visible.map((s) => s.id));
-
-	if (orgId) {
-		const orgChoice = config.orgDefaults?.[orgId];
-		if (orgChoice && visibleIds.has(orgChoice)) return orgChoice;
-	}
-	if (config.defaultServerId && visibleIds.has(config.defaultServerId)) {
-		return config.defaultServerId;
-	}
-	return undefined;
-}
-
-/**
- * Resolve a definition's compute server. Architecture spec §4.8 resolution order:
- *   1. Definition pin (`computeServerId`) if visible to the project's org.
- *   2. `orgDefaults[orgId]` if set.
- *   3. Global `defaultServerId`.
- *
- * Pure — throws if no usable server exists.
- */
-export interface ResolveOptions {
-	/** Per-definition pin. Falls through silently if not visible. */
-	definitionPin?: string | null;
-}
-
-export function resolveServerForOrg(
-	config: ComputeConfig,
-	orgId: string | null | undefined,
-	opts: ResolveOptions = {}
-): ComputeServerConfig {
-	const visible = serversVisibleTo(config, orgId);
-	if (visible.length === 0) {
-		throw new Error('No compute servers are configured or visible for this org.');
-	}
-
-	if (opts.definitionPin) {
-		const pinned = visible.find((s) => s.id === opts.definitionPin);
-		if (pinned) return pinned;
-		// Fall through — admin may have un-shared the server since the pin
-		// was set.
-	}
-
-	const defaultId = defaultServerIdFor(config, orgId);
-	if (defaultId) {
-		const found = visible.find((s) => s.id === defaultId);
-		if (found) return found;
-	}
-
-	// Last resort — return the first visible server. Mostly applies in tests
-	// and during initial setup before a default is chosen.
-	return visible[0];
-}
-
-/**
- * Lookup by id, regardless of scope or visibility. Useful in admin contexts
- * that need to display a server independently of the visibility filter.
- */
-export function findServerById(config: ComputeConfig, id: string): ComputeServerConfig | undefined {
-	return config.servers.find((s) => s.id === id);
-}
-
-// ============================================================================
-// Filters
-// ============================================================================
-
-export function platformServers(config: ComputeConfig) {
-	return config.servers.filter(isPlatformServer);
-}
-
-export function orgServersFor(config: ComputeConfig, orgId: string) {
-	return config.servers.filter((s) => isOrgServer(s) && s.ownerOrgId === orgId);
-}