@selvajs/platform 0.14.3-beta.0 → 0.15.0-beta.2

package/dist/index.js

@@ -2,7 +2,7 @@
 export { PlatformPermissionSchema, ALL_PLATFORM_PERMISSIONS } from './permissions/types.js';
 export { emptyProfile } from './userProfile/types.js';
 export { orgPaths } from './organizations/paths.js';
-export { OrgRoleSchema, OrgPermissionSchema, OrgAssetKindSchema, ALL_ORG_ASSET_KINDS, SlugSchema, CreateOrgSchema, UpdateOrgSchema, ALL_ORG_PERMISSIONS, DEFAULT_ORG_PERMISSIONS, OWNER_ADMIN_ONLY_PERMISSIONS, MEMBER_ASSIGNABLE_PERMISSIONS } from './organizations/schemas.js';
+export { OrgRoleSchema, OrgPermissionSchema, OrgAssetKindSchema, ALL_ORG_ASSET_KINDS, SlugSchema, RESERVED_SLUGS, CreateOrgSchema, UpdateOrgSchema, ALL_ORG_PERMISSIONS, DEFAULT_ORG_PERMISSIONS, OWNER_ADMIN_ONLY_PERMISSIONS, MEMBER_ASSIGNABLE_PERMISSIONS } from './organizations/schemas.js';
 export { ProjectVisibilitySchema, ProjectRoleSchema, validateProjectFlags } from './projects/schemas.js';
 export { PlatformProjectGrantSchema, PlatformProjectGranteeTypeSchema } from './platformProjects/schemas.js';
 export { GH_EXTENSIONS, COVER_IMAGE_EXTENSIONS, ALLOWED_UPLOAD_EXTENSIONS, COVER_IMAGE_CONTENT_TYPES } from './definitions/types.js';
@@ -13,12 +13,15 @@ export { CreateShareLinkInputSchema } from './shareLinks/schemas.js';
 export { IMAGE_MAX_WIDTH, IMAGE_WEBP_QUALITY, isImageUpload, toWebpPath, transcodeImageIfNeeded } from './storage/image.js';
 export { ASSET_CLASSES, classifyAssetPath, isPublicAssetPath } from './storage/assetClasses.js';
 export { withCacheBust } from './storage/cacheBust.js';
+export { ERASED_ACTOR_ID } from './data/interface.js';
 export { isPlatformServer, isOrgServer } from './computeServer/types.js';
 export { serversVisibleTo, defaultServerIdFor, resolveServerForOrg, findServerById, platformServers, orgServersFor } from './computeServer/utils.js';
 export { canView, canSolve, canEdit, canManage, canEditProjectSettings, canChangeVisibilityToPublic, canEditDefinition, canReclaim, canCreateProject, checkOwnerRemoval, withAdminBypass } from './access/rules.js';
-export { actorFrom, NoopEventSink } from './events/interface.js';
+export { actorFrom, NoopEventSink, AUDIT_EVENT_VERSION } from './events/interface.js';
 export { NoopSolveMetricSink } from './metrics/interface.js';
+export { NoopSolveResultCache } from './solveCache/interface.js';
 export { NoopErrorReporter } from './errors/interface.js';
+export { NoopLogger } from './logging/interface.js';
 export { NoopBindingResolver } from './bindings/interface.js';
 export { auditUpdate, auditSoftDelete } from './utils/audit.js';
 export { SYSTEM_CONTEXT, hasPermission, requireActingOrg } from './context.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAgB9F,OAAO,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAM5F,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAKtD,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAQpD,OAAO,EACN,aAAa,EACb,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,UAAU,EACV,eAAe,EACf,eAAe,EACf,mBAAmB,EACnB,uBAAuB,EACvB,4BAA4B,EAC5B,6BAA6B,EAC7B,MAAM,4BAA4B,CAAC;AAUpC,OAAO,EACN,uBAAuB,EACvB,iBAAiB,EACjB,oBAAoB,EACpB,MAAM,uBAAuB,CAAC;AAK/B,OAAO,EACN,0BAA0B,EAC1B,gCAAgC,EAChC,MAAM,+BAA+B,CAAC;AAavC,OAAO,EACN,aAAa,EACb,sBAAsB,EACtB,yBAAyB,EACzB,yBAAyB,EACzB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,EACN,uBAAuB,EACvB,yBAAyB,EACzB,2BAA2B,EAC3B,yBAAyB,EACzB,UAAU,EACV,UAAU,EACV,MAAM,0BAA0B,CAAC;AAOlC,OAAO,EAAE,6BAA6B,EAAE,MAAM,uBAAuB,CAAC;AAEtE,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AAMrE,OAAO,EACN,eAAe,EACf,kBAAkB,EAClB,aAAa,EACb,UAAU,EACV,sBAAsB,EACtB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAOhG,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAgBvD,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAazE,OAAO,EACN,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,aAAa,EACb,MAAM,0BAA0B,CAAC;AAclC,OAAO,EACN,OAAO,EACP,QAAQ,EACR,OAAO,EACP,SAAS,EACT,sBAAsB,EACtB,2BAA2B,EAC3B,iBAAiB,EACjB,UAAU,EACV,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,MAAM,mBAAmB,CAAC;AAM3B,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAajE,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAM7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAM1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAM9D,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAMhE,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAG/E,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AASrE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE1D,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAgB9F,OAAO,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAM5F,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAKtD,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAQpD,OAAO,EACN,aAAa,EACb,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,UAAU,EACV,cAAc,EACd,eAAe,EACf,eAAe,EACf,mBAAmB,EACnB,uBAAuB,EACvB,4BAA4B,EAC5B,6BAA6B,EAC7B,MAAM,4BAA4B,CAAC;AAUpC,OAAO,EACN,uBAAuB,EACvB,iBAAiB,EACjB,oBAAoB,EACpB,MAAM,uBAAuB,CAAC;AAK/B,OAAO,EACN,0BAA0B,EAC1B,gCAAgC,EAChC,MAAM,+BAA+B,CAAC;AAavC,OAAO,EACN,aAAa,EACb,sBAAsB,EACtB,yBAAyB,EACzB,yBAAyB,EACzB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,EACN,uBAAuB,EACvB,yBAAyB,EACzB,2BAA2B,EAC3B,yBAAyB,EACzB,UAAU,EACV,UAAU,EACV,MAAM,0BAA0B,CAAC;AAOlC,OAAO,EAAE,6BAA6B,EAAE,MAAM,uBAAuB,CAAC;AAEtE,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AAMrE,OAAO,EACN,eAAe,EACf,kBAAkB,EAClB,aAAa,EACb,UAAU,EACV,sBAAsB,EACtB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAOhG,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAMvD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAWtD,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAazE,OAAO,EACN,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,aAAa,EACb,MAAM,0BAA0B,CAAC;AAclC,OAAO,EACN,OAAO,EACP,QAAQ,EACR,OAAO,EACP,SAAS,EACT,sBAAsB,EACtB,2BAA2B,EAC3B,iBAAiB,EACjB,UAAU,EACV,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,MAAM,mBAAmB,CAAC;AAM3B,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAatF,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAU7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAMjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAM1D,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAMpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAM9D,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAMhE,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAG/E,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AASrE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE1D,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC"}

package/dist/logging/interface.d.ts

@@ -0,0 +1,82 @@
+/**
+ * Structured logging seam. Mirrors the `IErrorReporter` split next door: the
+ * interface + a safe default live here, the real backend (pino) ships from
+ * `@selvajs/server` so nothing in `@selvajs/platform` gains a logging
+ * dependency and browser-side consumers never pull a Node logger into a bundle.
+ *
+ * Why an interface rather than importing pino directly at call sites:
+ *  - `@selvajs/platform` and `@selvajs/server` are consumed as libraries. A
+ *    hard pino import would impose a logger (and its transport config) on every
+ *    embedder, including ones that already own their logging stack.
+ *  - Tests capture log output by passing a fake, with no transport to stub.
+ *  - Call sites stay honest: they describe WHAT happened and hand over fields;
+ *    formatting, redaction and routing are the backend's business.
+ */
+/**
+ * Structured fields attached to one log record. Deliberately `unknown` values
+ * rather than `string`: a field's whole point is to survive as typed JSON
+ * (numbers stay numbers, so a log backend can range-query them) instead of
+ * being flattened into a message string the way the old `console.log`
+ * template-literal calls did.
+ *
+ * Never put secrets here — session tokens, API keys, refresh tokens, raw share
+ * tokens. Log records routinely leave the box (stdout → collector → third-party
+ * index) and are retained far longer than the credential's own lifetime.
+ */
+export type LogFields = Record<string, unknown>;
+/**
+ * Severity levels, ordered. Chosen to match pino's standard set so the backend
+ * is a thin pass-through and operators get the level names they expect.
+ *
+ * Guidance, since the old `console.*` calls used levels inconsistently:
+ *  - `debug` — detail only useful when actively diagnosing; off in production.
+ *  - `info`  — a thing happened that an operator would want in the record
+ *              (boot, config resolved, request completed).
+ *  - `warn`  — degraded or suspicious, but handled; the system continues.
+ *  - `error` — an operation failed. Pair with `IErrorReporter` when it's
+ *              genuinely unexpected: logs are for the operator reading stdout,
+ *              the reporter is for off-box triage.
+ */
+export type LogLevel = 'debug' | 'info' | 'warn' | 'error';
+/**
+ * A structured logger.
+ *
+ * MUST NOT throw — logging sits on every path including the error path, where a
+ * failing logger would mask the original fault. Implementations swallow their
+ * own failures.
+ */
+export interface ILogger {
+    debug(message: string, fields?: LogFields): void;
+    info(message: string, fields?: LogFields): void;
+    warn(message: string, fields?: LogFields): void;
+    error(message: string, fields?: LogFields): void;
+    /**
+     * Derive a logger that stamps `fields` onto every record it writes.
+     *
+     * This is the whole point of the seam: the request hook binds `requestId`
+     * (plus method/route) ONCE, and every downstream call site logs without
+     * knowing a request id exists. Correlation stops being each call site's
+     * problem — which is exactly why the 199 `console.*` calls had none.
+     *
+     * Children compose; a child of a child carries both parents' fields. A
+     * child's field overwrites a parent's on key collision.
+     */
+    child(fields: LogFields): ILogger;
+}
+/**
+ * Default `ILogger` — discards everything. Lets library code log
+ * unconditionally without a configured backend, and keeps test output clean.
+ *
+ * Note this is the DEFAULT, not the fallback used in production: the app wires
+ * a real logger at its composition root. A library consumer that wires nothing
+ * gets silence rather than unsolicited stdout writes — the same bargain
+ * `NoopErrorReporter` makes.
+ */
+export declare class NoopLogger implements ILogger {
+    debug(_message: string, _fields?: LogFields): void;
+    info(_message: string, _fields?: LogFields): void;
+    warn(_message: string, _fields?: LogFields): void;
+    error(_message: string, _fields?: LogFields): void;
+    child(_fields: LogFields): ILogger;
+}
+//# sourceMappingURL=interface.d.ts.map

package/dist/logging/interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interface.d.ts","sourceRoot":"","sources":["../../src/logging/interface.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH;;;;;;;;;;GAUG;AACH,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEhD;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAE3D;;;;;;GAMG;AACH,MAAM,WAAW,OAAO;IACvB,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC;IACjD,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC;IAChD,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC;IAChD,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC;IACjD;;;;;;;;;;OAUG;IACH,KAAK,CAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC;CAClC;AAED;;;;;;;;GAQG;AACH,qBAAa,UAAW,YAAW,OAAO;IACzC,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,GAAG,IAAI;IAClD,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,GAAG,IAAI;IACjD,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,GAAG,IAAI;IACjD,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,GAAG,IAAI;IAClD,KAAK,CAAC,OAAO,EAAE,SAAS,GAAG,OAAO;CAGlC"}

package/dist/logging/interface.js

@@ -0,0 +1,33 @@
+/**
+ * Structured logging seam. Mirrors the `IErrorReporter` split next door: the
+ * interface + a safe default live here, the real backend (pino) ships from
+ * `@selvajs/server` so nothing in `@selvajs/platform` gains a logging
+ * dependency and browser-side consumers never pull a Node logger into a bundle.
+ *
+ * Why an interface rather than importing pino directly at call sites:
+ *  - `@selvajs/platform` and `@selvajs/server` are consumed as libraries. A
+ *    hard pino import would impose a logger (and its transport config) on every
+ *    embedder, including ones that already own their logging stack.
+ *  - Tests capture log output by passing a fake, with no transport to stub.
+ *  - Call sites stay honest: they describe WHAT happened and hand over fields;
+ *    formatting, redaction and routing are the backend's business.
+ */
+/**
+ * Default `ILogger` — discards everything. Lets library code log
+ * unconditionally without a configured backend, and keeps test output clean.
+ *
+ * Note this is the DEFAULT, not the fallback used in production: the app wires
+ * a real logger at its composition root. A library consumer that wires nothing
+ * gets silence rather than unsolicited stdout writes — the same bargain
+ * `NoopErrorReporter` makes.
+ */
+export class NoopLogger {
+    debug(_message, _fields) { }
+    info(_message, _fields) { }
+    warn(_message, _fields) { }
+    error(_message, _fields) { }
+    child(_fields) {
+        return this;
+    }
+}
+//# sourceMappingURL=interface.js.map

package/dist/logging/interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interface.js","sourceRoot":"","sources":["../../src/logging/interface.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAwDH;;;;;;;;GAQG;AACH,MAAM,OAAO,UAAU;IACtB,KAAK,CAAC,QAAgB,EAAE,OAAmB,IAAS,CAAC;IACrD,IAAI,CAAC,QAAgB,EAAE,OAAmB,IAAS,CAAC;IACpD,IAAI,CAAC,QAAgB,EAAE,OAAmB,IAAS,CAAC;IACpD,KAAK,CAAC,QAAgB,EAAE,OAAmB,IAAS,CAAC;IACrD,KAAK,CAAC,OAAkB;QACvB,OAAO,IAAI,CAAC;IACb,CAAC;CACD"}

package/dist/metrics/interface.d.ts

@@ -18,6 +18,12 @@ export type SolveFailureKind =
  | 'share_cap'
 /** Result exceeded the response size limit (HTTP 413). */
  | 'too_large'
+/**
+ * Shed by scheduler backpressure — the per-server queue was full, or the solve
+ * sat queued past its wait deadline, so it was rejected before executing
+ * (HTTP 503 + Retry-After). Distinct from `compute_error`: no compute ran.
+ */
+ | 'shed'
 /** Compute server unreachable or the solve threw for any other reason. */
  | 'compute_error';
 /**

package/dist/metrics/interface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"interface.d.ts","sourceRoot":"","sources":["../../src/metrics/interface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB;AAC3B,gEAAgE;AAC9D,IAAI;AACN,8CAA8C;GAC5C,SAAS;AACX,4EAA4E;GAC1E,cAAc;AAChB,sEAAsE;GACpE,cAAc;AAChB,8DAA8D;GAC5D,WAAW;AACb,0DAA0D;GACxD,WAAW;AACb,0EAA0E;GACxE,eAAe,CAAC;AAEnB;;;;;;;GAOG;AACH,MAAM,WAAW,WAAW;IAC3B,wEAAwE;IACxE,aAAa,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B;;;;OAIG;IACH,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,qDAAqD;IACrD,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;IAC1B,+EAA+E;IAC/E,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,sFAAsF;IACtF,UAAU,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,EAAE,EAAE,OAAO,CAAC;IACZ,iEAAiE;IACjE,WAAW,EAAE,gBAAgB,CAAC;IAC9B;;;;OAIG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,mEAAmE;IACnE,YAAY,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAChC,MAAM,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChE;AAED;;;;GAIG;AACH,qBAAa,mBAAoB,YAAW,gBAAgB;IACrD,MAAM,CAAC,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;CACvE"}
+{"version":3,"file":"interface.d.ts","sourceRoot":"","sources":["../../src/metrics/interface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB;AAC3B,gEAAgE;AAC9D,IAAI;AACN,8CAA8C;GAC5C,SAAS;AACX,4EAA4E;GAC1E,cAAc;AAChB,sEAAsE;GACpE,cAAc;AAChB,8DAA8D;GAC5D,WAAW;AACb,0DAA0D;GACxD,WAAW;AACb;;;;GAIG;GACD,MAAM;AACR,0EAA0E;GACxE,eAAe,CAAC;AAEnB;;;;;;;GAOG;AACH,MAAM,WAAW,WAAW;IAC3B,wEAAwE;IACxE,aAAa,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B;;;;OAIG;IACH,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,qDAAqD;IACrD,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;IAC1B,+EAA+E;IAC/E,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,sFAAsF;IACtF,UAAU,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,EAAE,EAAE,OAAO,CAAC;IACZ,iEAAiE;IACjE,WAAW,EAAE,gBAAgB,CAAC;IAC9B;;;;OAIG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,mEAAmE;IACnE,YAAY,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAChC,MAAM,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChE;AAED;;;;GAIG;AACH,qBAAa,mBAAoB,YAAW,gBAAgB;IACrD,MAAM,CAAC,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;CACvE"}

package/dist/metrics/interface.js.map

@@ -1 +1 @@
-{"version":3,"file":"interface.js","sourceRoot":"","sources":["../../src/metrics/interface.ts"],"names":[],"mappings":"AA8EA;;;;GAIG;AACH,MAAM,OAAO,mBAAmB;IAC/B,KAAK,CAAC,MAAM,CAAC,IAAoB,EAAE,OAAoB,IAAkB,CAAC;CAC1E"}
+{"version":3,"file":"interface.js","sourceRoot":"","sources":["../../src/metrics/interface.ts"],"names":[],"mappings":"AAoFA;;;;GAIG;AACH,MAAM,OAAO,mBAAmB;IAC/B,KAAK,CAAC,MAAM,CAAC,IAAoB,EAAE,OAAoB,IAAkB,CAAC;CAC1E"}

package/dist/organizations/__tests__/slug-schema.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=slug-schema.test.d.ts.map

package/dist/organizations/__tests__/slug-schema.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"slug-schema.test.d.ts","sourceRoot":"","sources":["../../../src/organizations/__tests__/slug-schema.test.ts"],"names":[],"mappings":""}

package/dist/organizations/__tests__/slug-schema.test.js

@@ -0,0 +1,38 @@
+import { describe, it, expect } from 'vitest';
+import { SlugSchema, RESERVED_SLUGS } from '../schemas.js';
+/**
+ * Reserved-slug guard (audit D4). A tenant slug must never equal a top-level
+ * route segment, or it could shadow (or be shadowed by) a route once flat
+ * tenant URLs — `/o/{slug}/…` per ADR 0006 — exist. These tests pin that the
+ * guard rejects every reserved word and still accepts ordinary slugs, so the
+ * reservation can't silently regress before the multi-org routing is built.
+ */
+describe('SlugSchema', () => {
+    it('accepts a normal lowercase-hyphenated slug', () => {
+        expect(SlugSchema.safeParse('acme-studio').success).toBe(true);
+    });
+    it('rejects every reserved slug', () => {
+        for (const reserved of RESERVED_SLUGS) {
+            const result = SlugSchema.safeParse(reserved);
+            expect(result.success, `"${reserved}" must be rejected`).toBe(false);
+        }
+    });
+    it('reserves the multi-org namespace prefix `o` even though the length gate already blocks it', () => {
+        // `o` is 1 char, so `min(3)` rejects it regardless — but it stays in the
+        // reserved set so intent survives any future relaxation of the length rule.
+        expect(RESERVED_SLUGS).toContain('o');
+        expect(SlugSchema.safeParse('o').success).toBe(false);
+    });
+    it('still enforces the format rules (length, charset)', () => {
+        expect(SlugSchema.safeParse('ab').success).toBe(false); // too short
+        expect(SlugSchema.safeParse('-lead').success).toBe(false); // leading hyphen
+        expect(SlugSchema.safeParse('UPPER').success).toBe(false); // uppercase
+        expect(SlugSchema.safeParse('a'.repeat(64)).success).toBe(false); // too long
+    });
+    it('does not over-reject: a slug that merely contains a reserved word is fine', () => {
+        // The guard is exact-match, not substring — `team-alpha` is not `team`.
+        expect(SlugSchema.safeParse('team-alpha').success).toBe(true);
+        expect(SlugSchema.safeParse('my-api').success).toBe(true);
+    });
+});
+//# sourceMappingURL=slug-schema.test.js.map

package/dist/organizations/__tests__/slug-schema.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"slug-schema.test.js","sourceRoot":"","sources":["../../../src/organizations/__tests__/slug-schema.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE3D;;;;;;GAMG;AACH,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;IAC3B,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACrD,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACtC,KAAK,MAAM,QAAQ,IAAI,cAAc,EAAE,CAAC;YACvC,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YAC9C,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,QAAQ,oBAAoB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtE,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2FAA2F,EAAE,GAAG,EAAE;QACpG,yEAAyE;QACzE,4EAA4E;QAC5E,MAAM,CAAC,cAAc,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC5D,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY;QACpE,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,iBAAiB;QAC5E,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY;QACvE,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW;IAC9E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,GAAG,EAAE;QACpF,wEAAwE;QACxE,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9D,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/organizations/index.d.ts

@@ -2,5 +2,5 @@ export type { Organization, OrgMember, OrgAssets } from './types.js';
 export type { IOrgStore } from './interface.js';
 export { orgPaths } from './paths.js';
 export type { OrgRole, OrgPermission, OrgAssetKind, CreateOrgInput, UpdateOrgInput } from './schemas.js';
-export { OrgRoleSchema, OrgPermissionSchema, OrgAssetKindSchema, ALL_ORG_ASSET_KINDS, SlugSchema, CreateOrgSchema, UpdateOrgSchema, ALL_ORG_PERMISSIONS, DEFAULT_ORG_PERMISSIONS, OWNER_ADMIN_ONLY_PERMISSIONS, MEMBER_ASSIGNABLE_PERMISSIONS } from './schemas.js';
+export { OrgRoleSchema, OrgPermissionSchema, OrgAssetKindSchema, ALL_ORG_ASSET_KINDS, SlugSchema, RESERVED_SLUGS, CreateOrgSchema, UpdateOrgSchema, ALL_ORG_PERMISSIONS, DEFAULT_ORG_PERMISSIONS, OWNER_ADMIN_ONLY_PERMISSIONS, MEMBER_ASSIGNABLE_PERMISSIONS } from './schemas.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/organizations/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/organizations/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACrE,YAAY,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,YAAY,EACX,OAAO,EACP,aAAa,EACb,YAAY,EACZ,cAAc,EACd,cAAc,EACd,MAAM,cAAc,CAAC;AACtB,OAAO,EACN,aAAa,EACb,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,UAAU,EACV,eAAe,EACf,eAAe,EACf,mBAAmB,EACnB,uBAAuB,EACvB,4BAA4B,EAC5B,6BAA6B,EAC7B,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/organizations/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACrE,YAAY,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,YAAY,EACX,OAAO,EACP,aAAa,EACb,YAAY,EACZ,cAAc,EACd,cAAc,EACd,MAAM,cAAc,CAAC;AACtB,OAAO,EACN,aAAa,EACb,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,UAAU,EACV,cAAc,EACd,eAAe,EACf,eAAe,EACf,mBAAmB,EACnB,uBAAuB,EACvB,4BAA4B,EAC5B,6BAA6B,EAC7B,MAAM,cAAc,CAAC"}

package/dist/organizations/index.js

@@ -1,3 +1,3 @@
 export { orgPaths } from './paths.js';
-export { OrgRoleSchema, OrgPermissionSchema, OrgAssetKindSchema, ALL_ORG_ASSET_KINDS, SlugSchema, CreateOrgSchema, UpdateOrgSchema, ALL_ORG_PERMISSIONS, DEFAULT_ORG_PERMISSIONS, OWNER_ADMIN_ONLY_PERMISSIONS, MEMBER_ASSIGNABLE_PERMISSIONS } from './schemas.js';
+export { OrgRoleSchema, OrgPermissionSchema, OrgAssetKindSchema, ALL_ORG_ASSET_KINDS, SlugSchema, RESERVED_SLUGS, CreateOrgSchema, UpdateOrgSchema, ALL_ORG_PERMISSIONS, DEFAULT_ORG_PERMISSIONS, OWNER_ADMIN_ONLY_PERMISSIONS, MEMBER_ASSIGNABLE_PERMISSIONS } from './schemas.js';
 //# sourceMappingURL=index.js.map

package/dist/organizations/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/organizations/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAQtC,OAAO,EACN,aAAa,EACb,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,UAAU,EACV,eAAe,EACf,eAAe,EACf,mBAAmB,EACnB,uBAAuB,EACvB,4BAA4B,EAC5B,6BAA6B,EAC7B,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/organizations/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAQtC,OAAO,EACN,aAAa,EACb,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,UAAU,EACV,cAAc,EACd,eAAe,EACf,eAAe,EACf,mBAAmB,EACnB,uBAAuB,EACvB,4BAA4B,EAC5B,6BAA6B,EAC7B,MAAM,cAAc,CAAC"}

package/dist/organizations/schemas.d.ts

@@ -1,9 +1,23 @@
 import { z } from 'zod';
-/** Lowercase alphanumeric with internal hyphens, 3–63 chars. */
+/**
+ * Top-level path segments a tenant slug must never equal, so a slug can never
+ * shadow (or be shadowed by) a route (audit D4). Two forces meet here:
+ *  - Reserved multi-org namespace: `/o/{slug}/` is the decided shape for
+ *    per-org URLs (see ADR 0006). `o` is reserved even though the length gate
+ *    below already makes a 1-char slug impossible — belt-and-suspenders, and it
+ *    documents intent for anyone relaxing the length rule later.
+ *  - Existing flat top-level routes: reserving these keeps a future move to
+ *    `/o/{slug}/…` (or any flat tenant route) collision-free from day one,
+ *    before any external link is minted against a slug.
+ * Lowercase; the slug is lowercased/matched case-insensitively so `Admin` can't
+ * slip through. Keep in sync with the route tree's top-level directories.
+ */
+export declare const RESERVED_SLUGS: readonly string[];
+/** Lowercase alphanumeric with internal hyphens, 3–63 chars, not a reserved word. */
 export declare const SlugSchema: z.ZodString;
 export declare const OrgRoleSchema: z.ZodEnum<{
-    owner: "owner";
     admin: "admin";
+    owner: "owner";
     member: "member";
 }>;
 export type OrgRole = z.infer<typeof OrgRoleSchema>;

package/dist/organizations/schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../src/organizations/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,gEAAgE;AAChE,eAAO,MAAM,UAAU,aAOrB,CAAC;AAEH,eAAO,MAAM,aAAa;;;;EAAuC,CAAC;AAClE,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAEpD;;;GAGG;AACH,eAAO,MAAM,kBAAkB;;;EAA8B,CAAC;AAC9D,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,mBAAmB,EAAE,SAAS,YAAY,EAA+B,CAAC;AAEvF,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB;;;;;EAK9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,mBAAmB,EAAE,SAAS,aAAa,EAAgC,CAAC;AAEzF,sDAAsD;AACtD,eAAO,MAAM,4BAA4B,EAAE,SAAS,aAAa,EAGhE,CAAC;AAEF,eAAO,MAAM,6BAA6B,EAAE,SAAS,aAAa,EAEjE,CAAC;AAEF,yEAAyE;AACzE,eAAO,MAAM,uBAAuB,EAAE,MAAM,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,CAI7E,CAAC;AAEF,eAAO,MAAM,eAAe;;;iBAG1B,CAAC;AAEH,eAAO,MAAM,eAAe;;;iBAA4B,CAAC;AAEzD,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAC7D,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC"}
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../src/organizations/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,cAAc,EAAE,SAAS,MAAM,EAY3C,CAAC;AAIF,qFAAqF;AACrF,eAAO,MAAM,UAAU,aAUpB,CAAC;AAEJ,eAAO,MAAM,aAAa;;;;EAAuC,CAAC;AAClE,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAEpD;;;GAGG;AACH,eAAO,MAAM,kBAAkB;;;EAA8B,CAAC;AAC9D,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,mBAAmB,EAAE,SAAS,YAAY,EAA+B,CAAC;AAEvF,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB;;;;;EAK9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,mBAAmB,EAAE,SAAS,aAAa,EAAgC,CAAC;AAEzF,sDAAsD;AACtD,eAAO,MAAM,4BAA4B,EAAE,SAAS,aAAa,EAGhE,CAAC;AAEF,eAAO,MAAM,6BAA6B,EAAE,SAAS,aAAa,EAEjE,CAAC;AAEF,yEAAyE;AACzE,eAAO,MAAM,uBAAuB,EAAE,MAAM,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,CAI7E,CAAC;AAEF,eAAO,MAAM,eAAe;;;iBAG1B,CAAC;AAEH,eAAO,MAAM,eAAe;;;iBAA4B,CAAC;AAEzD,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAC7D,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC"}

package/dist/organizations/schemas.js

@@ -1,10 +1,40 @@
 import { z } from 'zod';
-/** Lowercase alphanumeric with internal hyphens, 3–63 chars. */
+/**
+ * Top-level path segments a tenant slug must never equal, so a slug can never
+ * shadow (or be shadowed by) a route (audit D4). Two forces meet here:
+ *  - Reserved multi-org namespace: `/o/{slug}/` is the decided shape for
+ *    per-org URLs (see ADR 0006). `o` is reserved even though the length gate
+ *    below already makes a 1-char slug impossible — belt-and-suspenders, and it
+ *    documents intent for anyone relaxing the length rule later.
+ *  - Existing flat top-level routes: reserving these keeps a future move to
+ *    `/o/{slug}/…` (or any flat tenant route) collision-free from day one,
+ *    before any external link is minted against a slug.
+ * Lowercase; the slug is lowercased/matched case-insensitively so `Admin` can't
+ * slip through. Keep in sync with the route tree's top-level directories.
+ */
+export const RESERVED_SLUGS = [
+    'o',
+    'api',
+    'admin',
+    'auth',
+    'login',
+    'logout',
+    'setup',
+    'team',
+    'library',
+    'projects',
+    'accept-invite'
+];
+const RESERVED_SLUG_SET = new Set(RESERVED_SLUGS);
+/** Lowercase alphanumeric with internal hyphens, 3–63 chars, not a reserved word. */
 export const SlugSchema = z
     .string()
     .min(3, 'Slug must be at least 3 characters')
     .max(63, 'Slug must be at most 63 characters')
-    .regex(/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/, 'Slug must be lowercase alphanumeric with hyphens (no leading/trailing/consecutive hyphens)');
+    .regex(/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/, 'Slug must be lowercase alphanumeric with hyphens (no leading/trailing/consecutive hyphens)')
+    .refine((s) => !RESERVED_SLUG_SET.has(s), {
+    message: 'Slug is reserved and cannot be used'
+});
 export const OrgRoleSchema = z.enum(['owner', 'admin', 'member']);
 /**
  * Kinds of org-scoped branding asset. Adding a new kind is a single entry here

package/dist/organizations/schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../src/organizations/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,gEAAgE;AAChE,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC;KACzB,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,EAAE,oCAAoC,CAAC;KAC5C,GAAG,CAAC,EAAE,EAAE,oCAAoC,CAAC;KAC7C,KAAK,CACL,iCAAiC,EACjC,4FAA4F,CAC5F,CAAC;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAGlE;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAG9D,MAAM,CAAC,MAAM,mBAAmB,GAA4B,kBAAkB,CAAC,OAAO,CAAC;AAEvF,+EAA+E;AAC/E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,IAAI,CAAC;IACzC,oBAAoB;IACpB,oBAAoB;IACpB,oBAAoB;IACpB,iBAAiB;CACjB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,mBAAmB,GAA6B,mBAAmB,CAAC,OAAO,CAAC;AAEzF,sDAAsD;AACtD,MAAM,CAAC,MAAM,4BAA4B,GAA6B;IACrE,oBAAoB;IACpB,oBAAoB;CACpB,CAAC;AAEF,MAAM,CAAC,MAAM,6BAA6B,GAA6B,mBAAmB,CAAC,MAAM,CAChG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,4BAA4B,CAAC,QAAQ,CAAC,CAAC,CAAC,CAChD,CAAC;AAEF,yEAAyE;AACzE,MAAM,CAAC,MAAM,uBAAuB,GAA8C;IACjF,KAAK,EAAE,CAAC,GAAG,mBAAmB,CAAC;IAC/B,KAAK,EAAE,CAAC,GAAG,mBAAmB,CAAC;IAC/B,MAAM,EAAE,EAAE;CACV,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,+BAA+B,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACjE,IAAI,EAAE,UAAU;CAChB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,eAAe,CAAC,OAAO,EAAE,CAAC"}
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../src/organizations/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,cAAc,GAAsB;IAChD,GAAG;IACH,KAAK;IACL,OAAO;IACP,MAAM;IACN,OAAO;IACP,QAAQ;IACR,OAAO;IACP,MAAM;IACN,SAAS;IACT,UAAU;IACV,eAAe;CACf,CAAC;AAEF,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;AAElD,qFAAqF;AACrF,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC;KACzB,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,EAAE,oCAAoC,CAAC;KAC5C,GAAG,CAAC,EAAE,EAAE,oCAAoC,CAAC;KAC7C,KAAK,CACL,iCAAiC,EACjC,4FAA4F,CAC5F;KACA,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;IACzC,OAAO,EAAE,qCAAqC;CAC9C,CAAC,CAAC;AAEJ,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAGlE;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAG9D,MAAM,CAAC,MAAM,mBAAmB,GAA4B,kBAAkB,CAAC,OAAO,CAAC;AAEvF,+EAA+E;AAC/E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,IAAI,CAAC;IACzC,oBAAoB;IACpB,oBAAoB;IACpB,oBAAoB;IACpB,iBAAiB;CACjB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,mBAAmB,GAA6B,mBAAmB,CAAC,OAAO,CAAC;AAEzF,sDAAsD;AACtD,MAAM,CAAC,MAAM,4BAA4B,GAA6B;IACrE,oBAAoB;IACpB,oBAAoB;CACpB,CAAC;AAEF,MAAM,CAAC,MAAM,6BAA6B,GAA6B,mBAAmB,CAAC,MAAM,CAChG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,4BAA4B,CAAC,QAAQ,CAAC,CAAC,CAAC,CAChD,CAAC;AAEF,yEAAyE;AACzE,MAAM,CAAC,MAAM,uBAAuB,GAA8C;IACjF,KAAK,EAAE,CAAC,GAAG,mBAAmB,CAAC;IAC/B,KAAK,EAAE,CAAC,GAAG,mBAAmB,CAAC;IAC/B,MAAM,EAAE,EAAE;CACV,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,+BAA+B,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACjE,IAAI,EAAE,UAAU;CAChB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,eAAe,CAAC,OAAO,EAAE,CAAC"}

package/dist/solveCache/interface.d.ts

@@ -0,0 +1,86 @@
+import type { RequestContext } from '../context.js';
+/**
+ * Durable L2 solve-result cache (H1). The scheduler's in-process `Map` is L1 —
+ * 20 entries, 5-min TTL, per app instance. This is the shared, longer-lived
+ * layer keyed on `(orgId, definitionId, versionId, inputKey)` where `inputKey`
+ * is a wide (SHA-256) hash of the transformed input tree plus the solve-affecting
+ * config subset (H2/R8). A hit skips compute entirely.
+ *
+ * Design contract (decided 2026-07-11):
+ *
+ * - **Async from day one.** The memory backend returns promises too, so no call
+ *   site changes shape when a network store (Redis) arrives later.
+ * - **Entries are opaque bytes** — the pre-gzipped response envelope (R6) plus a
+ *   small metadata header. The backend never inspects them; memory stores the
+ *   same buffer Redis would, so a hit stays near-CPU-free in either backend and
+ *   there is no serialization drift between impls.
+ * - **Best-effort.** `get` may miss at any time (restart, eviction, network
+ *   blip); `set` may silently drop. Correctness NEVER depends on cache presence —
+ *   this is what makes backends interchangeable and what makes the
+ *   no-TTL/versionId keying safe under any eviction policy.
+ * - **Per-definition quota, passed at write time.** `set` carries
+ *   `maxEntriesForDefinition` so the backend holds no policy, only data. Eviction
+ *   is LRU *within* the definition: a slider-heavy definition churns only its own
+ *   entries, not everyone else's.
+ * - **Version keying = no invalidation.** Publishing mints a new `versionId` →
+ *   fresh keyspace; rollback re-hits old entries; there is nothing to invalidate.
+ */
+/** The parts that address a cached solve. All four are folded into the stored key. */
+export interface SolveCacheKey {
+    /**
+     * Owning org (defense-in-depth against cross-tenant reads). Null for
+     * remote-URL solves that have no org — those are not cached (the app passes
+     * the cache hook only for org-scoped live-channel solves).
+     */
+    orgId: string;
+    /** The definition guid — the quota scope. */
+    definitionId: string;
+    /** The immutable version id — no TTL needed, so entries never go stale. */
+    versionId: string;
+    /**
+     * Wide hash of the transformed input tree + solve-affecting config subset
+     * (SHA-256 hex; see the pipeline's key builder). This is the only part that
+     * varies per solve of a given version.
+     */
+    inputKey: string;
+}
+/** Options for a write; carries the per-definition quota so the backend stays stateless. */
+export interface SolveCacheSetOptions {
+    /**
+     * Max cached entries this definition may retain. The backend evicts
+     * LRU-within-definition down to this count on write. A definition's quota is
+     * `solveCacheLimit` (absent → the global default); the app never calls `set`
+     * when the resolved quota is `0` (caching off), so this is always `>= 1`.
+     */
+    maxEntriesForDefinition: number;
+}
+/**
+ * Durable solve-result cache. The solve pipeline talks only to this interface;
+ * the backend (memory today, Redis later) is a config change, not a redesign.
+ *
+ * Implementations MUST NOT throw — both methods are best-effort on the hot path
+ * of every live solve. A backend failure resolves as a miss (`get`) or a silent
+ * drop (`set`); it never becomes a request error.
+ */
+export interface ISolveResultCache {
+    /**
+     * Look up a cached envelope. Resolves the opaque bytes on a hit, or `null` on
+     * a miss (including any backend error). Bumps the entry's recency.
+     */
+    get(ctx: RequestContext, key: SolveCacheKey): Promise<Uint8Array | null>;
+    /**
+     * Store an envelope, evicting LRU-within-definition down to
+     * `opts.maxEntriesForDefinition`. Best-effort: silently drops on any failure.
+     */
+    set(ctx: RequestContext, key: SolveCacheKey, bytes: Uint8Array, opts: SolveCacheSetOptions): Promise<void>;
+}
+/**
+ * Default `ISolveResultCache` — never stores, always misses. Used when
+ * `SOLVE_CACHE_PROVIDER=off` (or unset). Swap in the memory backend
+ * (`@selvajs/server`) or a shared store to enable the durable L2.
+ */
+export declare class NoopSolveResultCache implements ISolveResultCache {
+    get(_ctx: RequestContext, _key: SolveCacheKey): Promise<Uint8Array | null>;
+    set(_ctx: RequestContext, _key: SolveCacheKey, _bytes: Uint8Array, _opts: SolveCacheSetOptions): Promise<void>;
+}
+//# sourceMappingURL=interface.d.ts.map

package/dist/solveCache/interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interface.d.ts","sourceRoot":"","sources":["../../src/solveCache/interface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,sFAAsF;AACtF,MAAM,WAAW,aAAa;IAC7B;;;;OAIG;IACH,KAAK,EAAE,MAAM,CAAC;IACd,6CAA6C;IAC7C,YAAY,EAAE,MAAM,CAAC;IACrB,2EAA2E;IAC3E,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAC;CACjB;AAED,4FAA4F;AAC5F,MAAM,WAAW,oBAAoB;IACpC;;;;;OAKG;IACH,uBAAuB,EAAE,MAAM,CAAC;CAChC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IACjC;;;OAGG;IACH,GAAG,CAAC,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACzE;;;OAGG;IACH,GAAG,CACF,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,aAAa,EAClB,KAAK,EAAE,UAAU,EACjB,IAAI,EAAE,oBAAoB,GACxB,OAAO,CAAC,IAAI,CAAC,CAAC;CACjB;AAED;;;;GAIG;AACH,qBAAa,oBAAqB,YAAW,iBAAiB;IACvD,GAAG,CAAC,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAG1E,GAAG,CACR,IAAI,EAAE,cAAc,EACpB,IAAI,EAAE,aAAa,EACnB,MAAM,EAAE,UAAU,EAClB,KAAK,EAAE,oBAAoB,GACzB,OAAO,CAAC,IAAI,CAAC;CAChB"}

package/dist/solveCache/interface.js

@@ -0,0 +1,12 @@
+/**
+ * Default `ISolveResultCache` — never stores, always misses. Used when
+ * `SOLVE_CACHE_PROVIDER=off` (or unset). Swap in the memory backend
+ * (`@selvajs/server`) or a shared store to enable the durable L2.
+ */
+export class NoopSolveResultCache {
+    async get(_ctx, _key) {
+        return null;
+    }
+    async set(_ctx, _key, _bytes, _opts) { }
+}
+//# sourceMappingURL=interface.js.map

package/dist/solveCache/interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interface.js","sourceRoot":"","sources":["../../src/solveCache/interface.ts"],"names":[],"mappings":"AAsFA;;;;GAIG;AACH,MAAM,OAAO,oBAAoB;IAChC,KAAK,CAAC,GAAG,CAAC,IAAoB,EAAE,IAAmB;QAClD,OAAO,IAAI,CAAC;IACb,CAAC;IACD,KAAK,CAAC,GAAG,CACR,IAAoB,EACpB,IAAmB,EACnB,MAAkB,EAClB,KAA2B,IACV,CAAC;CACnB"}

package/dist/testing/suites/definitionStoreSuite.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"definitionStoreSuite.d.ts","sourceRoot":"","sources":["../../../src/testing/suites/definitionStoreSuite.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAKvE;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IACnC,qEAAqE;IACrE,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,yEAAyE;IACzE,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAC3B,yFAAyF;IACzF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,8CAA8C;IAC9C,yBAAyB,CAAC,EAAE,MAAM,CAAC;CACnC;AAED,MAAM,WAAW,iCAAiC;IACjD,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAC;IACb,0DAA0D;IAC1D,WAAW,EAAE,MAAM,OAAO,CAAC,gBAAgB,CAAC,GAAG,gBAAgB,CAAC;IAChE;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,mBAAmB,CAAC,GAAG,mBAAmB,CAAC;IACvE;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACvB;AA0ED,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,iCAAiC,GAAG,IAAI,CAmf3F"}
+{"version":3,"file":"definitionStoreSuite.d.ts","sourceRoot":"","sources":["../../../src/testing/suites/definitionStoreSuite.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAKvE;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IACnC,qEAAqE;IACrE,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,yEAAyE;IACzE,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAC3B,yFAAyF;IACzF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,8CAA8C;IAC9C,yBAAyB,CAAC,EAAE,MAAM,CAAC;CACnC;AAED,MAAM,WAAW,iCAAiC;IACjD,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAC;IACb,0DAA0D;IAC1D,WAAW,EAAE,MAAM,OAAO,CAAC,gBAAgB,CAAC,GAAG,gBAAgB,CAAC;IAChE;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,mBAAmB,CAAC,GAAG,mBAAmB,CAAC;IACvE;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACvB;AA2ED,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,iCAAiC,GAAG,IAAI,CAwjB3F"}

package/dist/testing/suites/definitionStoreSuite.js

@@ -38,6 +38,7 @@ function record(scope, overrides = {}) {
         displayName: overrides.displayName ?? 'Test',
         status: overrides.status ?? 'published',
         solveCount: overrides.solveCount ?? 0,
+        nextVersionNumber: overrides.nextVersionNumber ?? 2,
         liveVersionId: overrides.liveVersionId ?? null,
         draftVersionId: overrides.draftVersionId ?? null,
         createdAt: overrides.createdAt ?? now,
@@ -139,6 +140,23 @@ export function runDefinitionStoreConformance(opts) {
             expect(got?.displayName).toBe('New');
             expect(got.updatedAt >= created.updatedAt).toBe(true);
         });
+        it('solveCacheLimit round-trips: absent → inherit, set → value, null → cleared', async () => {
+            const store = await createStore();
+            const scope = await scopeFor();
+            const guid = makeUuid();
+            await store.create(ctx(scope.ownerId), record(scope, { guid }));
+            // Absent on create → undefined (inherit the global default).
+            expect((await store.get(ctx(scope.ownerId), guid))?.solveCacheLimit).toBeUndefined();
+            // Set a per-definition quota.
+            await store.update(ctx(scope.ownerId), guid, { solveCacheLimit: 25 });
+            expect((await store.get(ctx(scope.ownerId), guid))?.solveCacheLimit).toBe(25);
+            // 0 means "caching off" and must persist as 0 (distinct from absent/inherit).
+            await store.update(ctx(scope.ownerId), guid, { solveCacheLimit: 0 });
+            expect((await store.get(ctx(scope.ownerId), guid))?.solveCacheLimit).toBe(0);
+            // null clears back to inherit.
+            await store.update(ctx(scope.ownerId), guid, { solveCacheLimit: null });
+            expect((await store.get(ctx(scope.ownerId), guid))?.solveCacheLimit).toBeUndefined();
+        });
         it('update on missing guid throws ProviderError with status 404', async () => {
             const store = await createStore();
             const scope = await scopeFor();
@@ -185,6 +203,45 @@ export function runDefinitionStoreConformance(opts) {
             }
             expect(threw).toBe(false);
         });
+        it('reserveNextVersionNumber returns the record counter then advances it', async () => {
+            const store = await createStore();
+            const scope = await scopeFor();
+            const guid = makeUuid();
+            await store.create(ctx(scope.ownerId), record(scope, { guid, nextVersionNumber: 2 }));
+            const first = await store.reserveNextVersionNumber(ctx(scope.ownerId), guid);
+            const second = await store.reserveNextVersionNumber(ctx(scope.ownerId), guid);
+            expect(first).toBe(2);
+            expect(second).toBe(3);
+            // Counter persisted, never reused.
+            const got = await store.get(ctx(scope.ownerId), guid);
+            expect(got?.nextVersionNumber).toBe(4);
+        });
+        it('reserveNextVersionNumber mints a FRESH number after delete-latest (fileKeys never collide)', async () => {
+            // The whole reason the counter exists: max(existing)+1 reused a number
+            // after deleting the latest version, colliding the fileKey. The monotonic
+            // counter must hand out a number BEYOND any deleted version's.
+            const store = await createStore();
+            const scope = await scopeFor();
+            const guid = makeUuid();
+            await store.create(ctx(scope.ownerId), record(scope, { guid, nextVersionNumber: 2 }));
+            // Simulate an upload of v2 (reserve, create), then delete it.
+            const n2 = await store.reserveNextVersionNumber(ctx(scope.ownerId), guid);
+            expect(n2).toBe(2);
+            const v2 = version(guid, n2, scope.ownerId);
+            await store.createVersion(ctx(scope.ownerId), v2);
+            await store.deleteVersion(ctx(scope.ownerId), v2.id);
+            // The next reservation must be 3 — NOT 2 again — even though the highest
+            // surviving version number is now 1 (v1 was never created here; the point
+            // is the counter ignores the version list entirely).
+            const n3 = await store.reserveNextVersionNumber(ctx(scope.ownerId), guid);
+            expect(n3).toBe(3);
+            expect(n3).not.toBe(n2);
+        });
+        it('reserveNextVersionNumber throws for a missing definition', async () => {
+            const store = await createStore();
+            const scope = await scopeFor();
+            await expect(store.reserveNextVersionNumber(ctx(scope.ownerId), makeUuid())).rejects.toThrow();
+        });
         it('update advances updatedBy to the caller', async () => {
             const store = await createStore();
             const scope = await scopeFor();