@selvajs/platform 0.14.2 → 0.15.0-beta.1

package/src/config.ts

@@ -1,99 +0,0 @@
-import type { IAuthProvider } from './auth/interface.js';
-import type { IDataProvider } from './data/interface.js';
-import type { IStorageProvider } from './storage/interface.js';
-import type { IEventSink } from './events/interface.js';
-import type { ISolveMetricSink } from './metrics/interface.js';
-import type { IBindingResolver } from './bindings/interface.js';
-
-/**
- * - `single`: one org per deployment. Setup creates it; `ctx.actingOrgId`
- *   resolves to that org for every authenticated user.
- * - `multi`: orgs are first-class. Setup creates only a platform admin; orgs
- *   are created by users. `ctx.actingOrgId` resolves per-request.
- */
-export type TenancyMode = 'single' | 'multi';
-
-/**
- * White-label branding. All fields optional; the selva app applies sensible
- * "Selva" defaults for anything omitted. Use this to rebrand the instance
- * (header name, footer copyright, landing-page copy, page titles) without
- * forking the UI.
- */
-export interface SelvaBranding {
-	/** Product name shown in header, footer, page titles. Default: "Selva". */
-	name?: string;
-	/** Footer copyright owner. Default: same as `name`. */
-	copyrightName?: string;
-	/** Landing-page tagline under the product name. */
-	tagline?: string;
-	/** Meta description for SEO / social previews. */
-	description?: string;
-}
-
-/** Opt-in platform features. All default false when absent. */
-export interface SelvaFlags {
-	/** Projects with `visibility='public'` visible across orgs on the instance. */
-	ALLOW_CROSS_ORG_PUBLIC?: boolean;
-	/** Orgs may override the instance compute pool with their own server. */
-	ALLOW_ORG_COMPUTE_OVERRIDE?: boolean;
-	/** Authenticated users may create new orgs. */
-	ALLOW_ORG_CREATION?: boolean;
-	/**
-	 * Per-definition share links — anonymous external access via tokenized URLs.
-	 * When off, share-link admin routes reject mint/list/revoke and the
-	 * token-resolution path stops honouring any existing tokens.
-	 */
-	ENABLE_SHARING?: boolean;
-	/**
-	 * Platform projects — projects owned by instance admins and granted to orgs
-	 * or individual users without normal membership. When off, the
-	 * `/admin/projects` surface 404s, platform-visibility projects are hidden
-	 * from every list, and access rules treat them as inaccessible. Existing
-	 * data is preserved; flipping back on restores access.
-	 */
-	ENABLE_PLATFORM_PROJECTS?: boolean;
-}
-
-export interface SelvaConfig {
-	tenancy?: TenancyMode;
-	flags?: SelvaFlags;
-	branding?: SelvaBranding;
-	auth: IAuthProvider;
-	/**
-	 * Orgs, projects, members, definitions, compute config, user profiles,
-	 * and platform permissions. All database-layer concerns live here.
-	 */
-	data: IDataProvider;
-	/** Blob storage — .gh/.ghx files, archived versions, images. */
-	storage: IStorageProvider;
-	/** Optional. Defaults to `NoopEventSink`. */
-	events?: IEventSink;
-	/**
-	 * Optional. Records per-solve timing (wall time of the Rhino.Compute solve
-	 * call). Defaults to `NoopSolveMetricSink`, which discards every metric.
-	 * Supply a real sink to persist or aggregate solve durations.
-	 */
-	solveMetrics?: ISolveMetricSink;
-	/**
-	 * Optional. Resolves values for inputs marked as `source.kind === 'server'`
-	 * in the schema. Defaults to `NoopBindingResolver`, which returns nothing
-	 * — combined with the schema's `onMissing: 'fail'` default, that causes
-	 * any solve involving a server-resolved input to error loudly until a real
-	 * resolver is configured. Hosts that want server-resolved inputs must supply one.
-	 */
-	bindingResolver?: IBindingResolver;
-}
-
-export type SelvaConfigFactory = (env: Record<string, string | undefined>) => SelvaConfig;
-
-/** Safe accessor — omitted flags resolve to false. */
-export function isFlagEnabled(config: SelvaConfig, flag: keyof SelvaFlags): boolean {
-	return Boolean(config.flags?.[flag]);
-}
-
-/** For TypeScript inference / IDE autocomplete only, Vite-style. */
-export function defineConfig(
-	config: SelvaConfig | SelvaConfigFactory
-): SelvaConfig | SelvaConfigFactory {
-	return config;
-}

package/src/context.ts

@@ -1,66 +0,0 @@
-import type { PlatformPermission } from './permissions/types.js';
-import { ALL_PLATFORM_PERMISSIONS } from './permissions/types.js';
-import type { OrgPermission } from './organizations/schemas.js';
-import { ALL_ORG_PERMISSIONS } from './organizations/schemas.js';
-
-/**
- * Per-request identity + scope passed to every data provider call. Built
- * once per HTTP request from the authenticated session.
- *
- * `actingOrgId` is the org the user is currently acting as — NOT "an org the
- * user is a member of." Tenancy checks compare it to the resource's `orgId`.
- *
- * `instance_admin` implies every other permission, everywhere — encoded by
- * `hasPermission`. `system: true` is a trusted server-internal call;
- * adapters with RLS treat it as fully authorized.
- */
-export interface RequestContext {
-	/** Empty string for system contexts. */
-	userId: string;
-	/** Undefined for instance-admin global reads and pre-org routes. */
-	actingOrgId?: string;
-	platformPermissions: PlatformPermission[];
-	/** Empty when `actingOrgId` is undefined. */
-	orgPermissions: OrgPermission[];
-	/** Never derive from a user session. */
-	system?: true;
-	/**
-	 * Opaque adapter payload. The Supabase adapter passes the user JWT through
-	 * for RLS; local ignores it.
-	 */
-	adapterContext?: unknown;
-}
-
-/**
- * For server-internal operations outside any HTTP request (bootstrap,
- * janitors, migrations). Treated as fully authorized.
- */
-export const SYSTEM_CONTEXT: RequestContext = {
-	userId: '',
-	platformPermissions: [...ALL_PLATFORM_PERMISSIONS],
-	orgPermissions: [...ALL_ORG_PERMISSIONS],
-	system: true
-};
-
-/**
- * Does NOT cross-check `ctx.actingOrgId` — the caller builds a context scoped
- * to the org they're acting on. An org permission against a ctx without
- * `actingOrgId` returns false unless `instance_admin` or `system`.
- */
-export function hasPermission(
-	ctx: RequestContext,
-	permission: PlatformPermission | OrgPermission
-): boolean {
-	if (ctx.system) return true;
-	if (ctx.platformPermissions.includes('instance_admin')) return true;
-	if (isPlatformPermission(permission)) {
-		return ctx.platformPermissions.includes(permission);
-	}
-	return ctx.orgPermissions.includes(permission);
-}
-
-const PLATFORM_PERMISSION_VALUES = new Set<string>(ALL_PLATFORM_PERMISSIONS);
-
-function isPlatformPermission(p: string): p is PlatformPermission {
-	return PLATFORM_PERMISSION_VALUES.has(p);
-}

package/src/data/index.ts

@@ -1 +0,0 @@
-export type { IDataProvider } from './interface.js';

package/src/data/interface.ts

@@ -1,70 +0,0 @@
-/**
- * `IDataProvider` is the composition root that bundles every store an adapter
- * implements. Individual interfaces (`IOrgStore`, `IProjectStore`, …) live
- * next to their types in their respective subdirs — only the composition
- * lives here.
- *
- * Every store method takes a `RequestContext` first. **The query itself is
- * the security boundary** — adapters MUST scope reads/writes by `ctx`. An
- * unauthorized caller sees an empty page, `null`, or a `ProviderError`.
- *
- * Access-control predicates live in `@selvajs/platform/access` (pure rules).
- * Stores do storage; rules do rules.
- */
-
-import type { IOrgStore } from '../organizations/interface.js';
-import type { IProjectStore } from '../projects/interface.js';
-import type { IDefinitionStore } from '../definitions/interface.js';
-import type { IComputeServerStore } from '../computeServer/interface.js';
-import type { IShareLinkStore } from '../shareLinks/interface.js';
-import type { IPlatformProjectGrantStore } from '../platformProjects/interface.js';
-import type { IInviteStore } from '../invites/interface.js';
-import type { IUserProfileStore } from '../userProfile/interface.js';
-import type { IPlatformPermissionStore } from '../permissions/interface.js';
-import type { IAuditQuery } from '../events/audit.js';
-import type { RequestContext } from '../context.js';
-
-export interface IDataProvider {
-	orgs: IOrgStore;
-	projects: IProjectStore;
-	definitions: IDefinitionStore;
-	computeServer: IComputeServerStore;
-	invites: IInviteStore;
-	shareLinks: IShareLinkStore;
-	userProfile: IUserProfileStore;
-	permissions: IPlatformPermissionStore;
-	platformProjectGrants: IPlatformProjectGrantStore;
-	/**
-	 * Read-side for the persisted event log. Optional — providers whose event
-	 * sink is a noop (local-provider) leave this undefined and the
-	 * `/admin/audit` UI degrades to its "no backend wired" state.
-	 */
-	auditQuery?: IAuditQuery;
-
-	/**
-	 * Idempotently register a user in the data layer. Called by `hooks.server.ts`
-	 * after `verifyToken` succeeds, so the data layer always has a row for the
-	 * authenticated user regardless of which auth provider issued the ID.
-	 *
-	 * Adapters with a DB-side trigger that auto-seeds on auth signup (Supabase)
-	 * make this a no-op. Adapters that own a separate user-data table without a
-	 * trigger (local-provider) upsert here.
-	 *
-	 * MUST be safe to call concurrently and on every request. MUST NOT throw on
-	 * a duplicate userId.
-	 */
-	ensureUser(ctx: RequestContext, userId: string): Promise<void>;
-
-	/**
-	 * Cascade hook called after the auth provider deletes a user. Removes any
-	 * data-layer rows tied to that user (the user-data row, anything else
-	 * keyed by `userId` that should die with the identity).
-	 *
-	 * Adapters whose data-layer FKs cascade on delete (Supabase via
-	 * `on delete cascade` against `auth.users`) no-op. Adapters that own
-	 * separate tables (local-provider) clean up here.
-	 *
-	 * MUST tolerate a missing user (idempotent — caller may retry).
-	 */
-	onUserDeleted(ctx: RequestContext, userId: string): Promise<void>;
-}

package/src/definitions/index.ts

@@ -1,26 +0,0 @@
-export type {
-	DefinitionFileExt,
-	DefinitionRecord,
-	DefinitionRecordPatch,
-	DefinitionStatus,
-	DefinitionVersion,
-	DefinitionChannel
-} from './types.js';
-export type { IDefinitionStore } from './interface.js';
-export type { UISchema } from '@selvajs/schemas';
-export {
-	GH_EXTENSIONS,
-	COVER_IMAGE_EXTENSIONS,
-	ALLOWED_UPLOAD_EXTENSIONS,
-	COVER_IMAGE_CONTENT_TYPES
-} from './types.js';
-export { definitionPaths } from './paths.js';
-export type { UpdateMetadataInput } from './schemas.js';
-export {
-	DefinitionChannelSchema,
-	PublishVersionInputSchema,
-	CreateDefinitionInputSchema,
-	UpdateMetadataInputSchema,
-	GuidSchema,
-	UUID_REGEX
-} from './schemas.js';

package/src/definitions/interface.ts

@@ -1,78 +0,0 @@
-import type { RequestContext } from '../context.js';
-import type { ListOptions, DefinitionListOptions, Page } from '../pagination.js';
-import type { UISchema } from '@selvajs/schemas';
-import type { DefinitionRecord, DefinitionRecordPatch, DefinitionVersion } from './types.js';
-
-/**
- * Definition metadata + version store. Blob contents live in `IStorageProvider`;
- * this interface tracks the parent record plus immutable version rows and the
- * `live` / `draft` channel pointers.
- */
-export interface IDefinitionStore {
-	// Definitions
-	list(ctx: RequestContext, opts?: DefinitionListOptions): Promise<Page<DefinitionRecord>>;
-	listByProject(
-		ctx: RequestContext,
-		projectId: string,
-		opts?: DefinitionListOptions
-	): Promise<Page<DefinitionRecord>>;
-	/**
-	 * List definitions whose parent project has `visibility === 'public'`.
-	 * Pass `orgId` to restrict to one org; omit for cross-org listing within
-	 * whatever tenant boundary the adapter already enforces.
-	 */
-	listPublic(
-		ctx: RequestContext,
-		opts?: DefinitionListOptions & { orgId?: string }
-	): Promise<Page<DefinitionRecord>>;
-	get(ctx: RequestContext, guid: string): Promise<DefinitionRecord | null>;
-	create(ctx: RequestContext, record: DefinitionRecord): Promise<void>;
-	update(ctx: RequestContext, guid: string, patch: DefinitionRecordPatch): Promise<void>;
-	delete(ctx: RequestContext, guid: string): Promise<void>;
-
-	/** Atomic +1 on the solve counter. No-op if the record doesn't exist. */
-	incrementSolveCount(ctx: RequestContext, guid: string): Promise<void>;
-
-	// Versions (immutable rows)
-	createVersion(ctx: RequestContext, version: DefinitionVersion): Promise<void>;
-	/** Newest first by `versionNumber`. */
-	listVersions(
-		ctx: RequestContext,
-		definitionId: string,
-		opts?: ListOptions
-	): Promise<Page<DefinitionVersion>>;
-	getVersion(ctx: RequestContext, versionId: string): Promise<DefinitionVersion | null>;
-
-	/**
-	 * Set the cached compute-extracted schema on a version row. Used by the
-	 * upload path (writes the schema validated up-front) and the temporary
-	 * solve-time backfill bridge (see selva/specs/SchemaCaching.md). No-op if
-	 * the version doesn't exist.
-	 */
-	setVersionSchema(ctx: RequestContext, versionId: string, schema: UISchema): Promise<void>;
-	/**
-	 * Throws 409 if the version is referenced by `liveVersionId` or
-	 * `draftVersionId`. Caller deletes the blob separately.
-	 */
-	deleteVersion(ctx: RequestContext, versionId: string): Promise<void>;
-
-	/** Atomically point `liveVersionId` at a target version of this definition. */
-	setLiveVersion(ctx: RequestContext, definitionId: string, versionId: string): Promise<void>;
-	setDraftVersion(ctx: RequestContext, definitionId: string, versionId: string): Promise<void>;
-
-	/**
-	 * Atomic `'pending'` → `'draft'` bootstrap. Sets BOTH `liveVersionId` and
-	 * `draftVersionId` to `versionId` and flips `status` to `'draft'` in a
-	 * single update — used by the create flow so a mid-flight failure can't
-	 * leave the record half-promoted (status='draft' with a null channel
-	 * pointer, or status='pending' with channels set).
-	 *
-	 * Validates that `versionId` belongs to `definitionId` (404 if not).
-	 *
-	 * Does NOT emit `definition.published`. The bootstrap is covered by the
-	 * parent's `definition.created` + `definition_version.created` pair;
-	 * `definition.published` is reserved for explicit publish ops via
-	 * `setLiveVersion`.
-	 */
-	attachInitialVersion(ctx: RequestContext, definitionId: string, versionId: string): Promise<void>;
-}

package/src/definitions/paths.ts

@@ -1,31 +0,0 @@
-import type { DefinitionFileExt } from './types.js';
-
-/**
- * Path-segment safety check. Blocks traversal, separators, NUL, and empty
- * segments. Allowed alphabet `[A-Za-z0-9._-]+` covers GUIDs and sanitized
- * refs. Called by every helper so a malicious `guid` can't escape the
- * `definitions/` prefix.
- */
-function assertSafeKey(value: string, label: string): void {
-	if (!value || !/^[A-Za-z0-9._-]+$/.test(value) || value === '.' || value === '..') {
-		throw new Error(`Unsafe ${label}: ${JSON.stringify(value)}`);
-	}
-}
-
-export const definitionPaths = {
-	version: (guid: string, versionNumber: number, ext: DefinitionFileExt) => {
-		assertSafeKey(guid, 'guid');
-		if (!Number.isInteger(versionNumber) || versionNumber < 1) {
-			throw new Error(`Unsafe versionNumber: ${versionNumber}`);
-		}
-		return `definitions/${guid}/versions/v${versionNumber}.${ext}`;
-	},
-	image: (guid: string) => {
-		assertSafeKey(guid, 'guid');
-		return `definitions/${guid}/cover.webp`;
-	},
-	prefix: (guid: string) => {
-		assertSafeKey(guid, 'guid');
-		return `definitions/${guid}/`;
-	}
-} as const;

package/src/definitions/schemas.ts

@@ -1,64 +0,0 @@
-import { z } from 'zod';
-
-export const UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-
-export const GuidSchema = z.string().regex(UUID_REGEX, 'Invalid GUID format');
-
-export const DefinitionStatusSchema = z.enum(['draft', 'published', 'archived']);
-
-export const DefinitionFileExtSchema = z.enum(['gh', 'ghx']);
-
-export const DefinitionVersionSchema = z.object({
-	id: GuidSchema,
-	definitionId: GuidSchema,
-	versionNumber: z.number().int().min(1),
-	fileExt: DefinitionFileExtSchema,
-	fileKey: z.string().min(1),
-	originalFilename: z.string().max(256).optional(),
-	uploadedBy: z.string().min(1),
-	uploadedAt: z.string(),
-	changeNote: z.string().max(1000).optional(),
-	// Cached compute-extracted UI schema. Structural correctness is validated by
-	// Rhino.Compute at upload, not here — this only asserts it's an object.
-	schema: z.record(z.string(), z.unknown()).optional(),
-	schemaExtractedAt: z.string().optional()
-});
-
-export const DefinitionChannelSchema = z.enum(['live', 'draft']);
-
-/** HTTP-body validator for new-definition input. */
-export const CreateDefinitionInputSchema = z.object({
-	displayName: z.string().min(1, 'Display name is required').max(256),
-	description: z.string().max(2000).optional(),
-	coverImage: z.string().max(2048).optional(),
-	category: z.string().max(128).optional(),
-	tags: z.array(z.string().max(64)).max(20).optional(),
-	projectId: GuidSchema,
-	computeServerId: GuidSchema.optional()
-});
-
-/**
- * PATCH validator. Field semantics match `DefinitionRecordPatch`:
- * - missing / `undefined` — leave unchanged
- * - `null` — clear (only on nullable fields)
- * - value — set
- */
-export const UpdateMetadataInputSchema = z.object({
-	displayName: z.string().min(1, 'Display name is required').max(256).optional(),
-	description: z.string().max(2000).nullable().optional(),
-	coverImage: z.string().max(2048).nullable().optional(),
-	category: z.string().max(128).nullable().optional(),
-	tags: z.array(z.string().max(64)).max(20).nullable().optional(),
-	projectId: GuidSchema.optional(),
-	computeServerId: GuidSchema.nullable().optional(),
-	status: DefinitionStatusSchema.optional()
-});
-
-export type UpdateMetadataInput = z.infer<typeof UpdateMetadataInputSchema>;
-
-/** Body for `POST /api/definitions/[guid]/publish`. */
-export const PublishVersionInputSchema = z
-	.object({
-		versionId: GuidSchema.optional()
-	})
-	.default({});

package/src/definitions/types.ts

@@ -1,111 +0,0 @@
-import type { UISchema } from '@selvajs/schemas';
-
-export type DefinitionFileExt = 'gh' | 'ghx';
-
-export const GH_EXTENSIONS: string[] = ['.gh', '.ghx'];
-export const COVER_IMAGE_EXTENSIONS: string[] = ['.jpg', '.jpeg', '.png', '.webp', '.gif'];
-export const ALLOWED_UPLOAD_EXTENSIONS: string[] = [...GH_EXTENSIONS, ...COVER_IMAGE_EXTENSIONS];
-
-export const COVER_IMAGE_CONTENT_TYPES: Record<string, string> = {
-	'.jpg': 'image/jpeg',
-	'.jpeg': 'image/jpeg',
-	'.png': 'image/png',
-	'.webp': 'image/webp',
-	'.gif': 'image/gif'
-};
-
-/**
- * - `pending` — internal: metadata written, blob upload may be in flight.
- * - `draft` — work in progress, not visible to runners.
- * - `published` — live, visible to all with solve access.
- * - `archived` — retired but preserved. Versions and channel pointers remain
- *   intact; restore via `update({ status: 'draft' | 'published' })`.
- *
- * List endpoints filter `pending` and `archived` by default (opt in via
- * `DefinitionListOptions.includePending` / `includeArchived`, or pass an
- * explicit `statuses` filter).
- */
-export type DefinitionStatus = 'pending' | 'draft' | 'published' | 'archived';
-
-/**
- * Immutable snapshot of a definition's `.gh` file at a point in time. New
- * uploads create new versions; rollback re-points the parent's
- * `liveVersionId` (it never mutates the version itself).
- */
-export interface DefinitionVersion {
-	id: string;
-	definitionId: string;
-	/** Monotonic integer starting at 1; never reused. */
-	versionNumber: number;
-	fileExt: DefinitionFileExt;
-	/** Full storage key. Opaque to callers. */
-	fileKey: string;
-	originalFilename?: string;
-	uploadedBy: string;
-	uploadedAt: string;
-	/** Free-form note describing what changed in this version. */
-	changeNote?: string;
-	/**
-	 * Compute-extracted UI schema, cached at upload so the render path doesn't
-	 * re-fetch it from Rhino.Compute on every load. Optional only because of the
-	 * lazy-backfill bridge for pre-existing versions (see
-	 * selva/specs/SchemaCaching.md); new uploads always set it.
-	 */
-	schema?: UISchema;
-	/** ISO timestamp of when `schema` was extracted. */
-	schemaExtractedAt?: string;
-}
-
-export interface DefinitionRecord {
-	guid: string;
-	projectId: string;
-	/** Current owner — separate from `createdBy` so ownership can transfer. */
-	ownerId: string;
-	createdBy: string;
-	updatedBy: string;
-	/** Falls back to the org default, then the platform default. */
-	computeServerId?: string;
-	displayName: string;
-	description?: string;
-	category?: string;
-	tags?: string[];
-	/** Provider-dependent public URL — must be safe to send to clients. */
-	coverImage?: string;
-	status: DefinitionStatus;
-	solveCount: number;
-	/**
-	 * Both null only during the brief `pending` window between metadata create
-	 * and v1 upload; otherwise both reference live `DefinitionVersion` rows.
-	 */
-	liveVersionId: string | null;
-	draftVersionId: string | null;
-	createdAt: string;
-	updatedAt: string;
-	deletedAt?: string | null;
-}
-
-/**
- * Patch omits immutable fields and provider-managed ones (use
- * `setLiveVersion`/`setDraftVersion` for the latter).
- *
- * - `undefined` — leave unchanged
- * - `null` — clear (only on nullable fields)
- * - value — set
- *
- * Use `incrementSolveCount` for atomic +1 bumps instead of patching `solveCount`.
- */
-export interface DefinitionRecordPatch {
-	displayName?: string;
-	description?: string | null;
-	category?: string | null;
-	tags?: string[] | null;
-	coverImage?: string | null;
-	projectId?: string;
-	computeServerId?: string | null;
-	status?: DefinitionStatus;
-	/** Ownership transfer. */
-	ownerId?: string;
-}
-
-/** Channel for solve dispatch. */
-export type DefinitionChannel = 'live' | 'draft';

package/src/errors.ts

@@ -1,16 +0,0 @@
-/**
- * Thrown by providers to signal an expected failure that the API layer
- * should forward with a specific status. Unknown errors should propagate as
- * plain `Error` and become 500s.
- *
- * Conventional values: 400, 401, 403, 404, 409, 422, 429, 500.
- */
-export class ProviderError extends Error {
-	readonly statusCode: number;
-
-	constructor(message: string, statusCode: number = 400) {
-		super(message);
-		this.name = 'ProviderError';
-		this.statusCode = statusCode;
-	}
-}

package/src/events/audit.ts

@@ -1,67 +0,0 @@
-import type { RequestContext } from '../context.js';
-import type { DomainEvent, DomainEventType } from './interface.js';
-
-/**
- * Read-side counterpart to `IEventSink`. Persisted by the sink, queried by
- * operator-facing UIs (admin audit log) and future analytics consumers.
- *
- * Kept on its own interface so:
- *   - dev-mode `NoopEventSink` doesn't need a fake `query` returning empty;
- *     `auditQuery` simply stays undefined on the data provider.
- *   - future webhook-dispatcher sinks aren't forced to implement a query path.
- *   - the contract here can throw on backend failure without violating the
- *     sink's "MUST NOT throw" rule.
- *
- * Authorisation is the caller's job — implementations read from a privileged
- * client (Supabase service-role, etc.) and assume the route layer has already
- * gated on `instance_admin`.
- */
-
-export interface AuditEventRow {
-	/** Stable row id from the persistent store (e.g. uuid). */
-	id: string;
-	/** ISO 8601. The persisted timestamp, not when the originating mutation occurred. */
-	occurredAt: string;
-	type: DomainEventType;
-	actorId: string;
-	/** The full `DomainEvent` payload as recorded. */
-	data: DomainEvent;
-}
-
-/**
- * Keyset cursor. `(occurredAt, id)` lexicographic — `occurredAt` alone isn't
- * unique under bursty writes, so a tie-breaker is required to avoid skipped
- * rows on page boundaries.
- */
-export interface AuditCursor {
-	occurredAt: string;
-	id: string;
-}
-
-export interface AuditQueryFilters {
-	/** Restrict to these event types. Empty / undefined = all types. */
-	types?: readonly DomainEventType[];
-	/** Restrict to events emitted by this actor id (or `'system'`). */
-	actorId?: string;
-	/** Inclusive lower bound on `occurredAt`. ISO 8601. */
-	sinceIso?: string;
-	/** Inclusive upper bound on `occurredAt`. ISO 8601. */
-	untilIso?: string;
-	/**
-	 * Page size. Implementations clamp to a sane upper bound (≤200) — callers
-	 * shouldn't be able to request unbounded reads.
-	 */
-	limit?: number;
-	/** Keyset cursor from a previous page's `nextCursor`. */
-	cursor?: AuditCursor;
-}
-
-export interface AuditQueryResult {
-	rows: AuditEventRow[];
-	/** Null when there are no more rows past this page. */
-	nextCursor: AuditCursor | null;
-}
-
-export interface IAuditQuery {
-	list(ctx: RequestContext, filters: AuditQueryFilters): Promise<AuditQueryResult>;
-}

package/src/events/index.ts

@@ -1,9 +0,0 @@
-export type { DomainEvent, DomainEventType, IEventSink } from './interface.js';
-export { actorFrom, NoopEventSink } from './interface.js';
-export type {
-	AuditEventRow,
-	AuditCursor,
-	AuditQueryFilters,
-	AuditQueryResult,
-	IAuditQuery
-} from './audit.js';