@selvajs/platform 0.14.3-beta.0 → 0.15.0-beta.2

package/src/auth/interface.ts

@@ -1,279 +0,0 @@
-import type { AuthUser, LoginResult, UserManagementResult } from './types.js';
-import type { ListOptions, Page } from '../pagination.js';
-
-/**
- * Optional password-based authentication surface. Implemented by providers
- * that own credentials (Local, Supabase Auth). OIDC-only providers leave
- * `IAuthProvider.passwordAuth` undefined.
- */
-export interface IPasswordAuth {
-	/**
-	 * Verify credentials. Discriminated union — callers MUST `switch (result.kind)`,
-	 * never treat truthiness as authenticated.
-	 */
-	verifyLogin(email: string, password: string): Promise<LoginResult>;
-
-	/**
-	 * Admin-initiated user creation. Pure identity — callers grant platform
-	 * permissions separately via `IPlatformPermissionStore.set`.
-	 */
-	createUserWithPassword(email: string, password: string): Promise<AuthUser>;
-
-	/** Self-service registration. Return null when self-registration is disabled. */
-	registerUser?(email: string, password: string): Promise<AuthUser | null>;
-}
-
-/**
- * Optional OAuth surface. Implemented by providers that broker OAuth flows
- * (Supabase Auth, future Eterna/Auth0/etc.). Local credential-only providers
- * leave `IAuthProvider.oauth` undefined.
- *
- * Lifecycle is the standard authorization-code flow:
- *
- *   1. Browser hits `/auth/{provider}/start?provider=google` → server calls
- *      `getOAuthAuthorizationUrl` and 303s to the result.
- *   2. IdP redirects back to `/auth/{provider}/callback?code=...` →
- *      server calls `exchangeOAuthCode` to mint the session pair.
- *   3. When the access token expires, the session-refresh middleware in
- *      `hooks.server.ts` calls `refreshSession` with the stored refresh
- *      token to swap for a fresh pair without bouncing the user.
- *
- * Each method returns `null` (rather than throwing) on irrecoverable
- * credential failures — the route layer translates `null` into the right
- * HTTP shape (401 for refresh, login redirect for callback).
- */
-export interface IOAuthAuth {
-	/**
-	 * The OAuth providers this adapter is configured to broker. Returned as
-	 * lowercased identifiers ("google", "github", …) — the adapter reads its
-	 * own configuration source (env var, dashboard, hard-coded list) and
-	 * decides what's available. Empty array when none are wired.
-	 *
-	 * Driving adapters (HTTP routes, UI) call this instead of reading
-	 * provider-specific env vars directly — keeps the provider name out of
-	 * `selva`.
-	 */
-	listProviders(): readonly string[];
-
-	/**
-	 * Build the IdP authorization URL the browser should be redirected to.
-	 * `redirectTo` is the full callback URL — must be the route that handles
-	 * the `?code=...` exchange. Provider-name validation is the caller's job;
-	 * passing an unconfigured provider may surface as an upstream error.
-	 */
-	getOAuthAuthorizationUrl(
-		provider: 'google' | 'github' | 'azure' | 'gitlab',
-		redirectTo: string
-	): Promise<string>;
-
-	/**
-	 * Exchange an authorization code for a session. Returns the resolved
-	 * identity and an access/refresh token pair. `null` when the code is
-	 * invalid, expired, or already redeemed — callers MUST treat null as
-	 * "send the user back to /login".
-	 */
-	exchangeOAuthCode(code: string): Promise<{
-		user: AuthUser;
-		sessionToken: string;
-		refreshToken: string;
-	} | null>;
-
-	/**
-	 * Swap a refresh token for a fresh access/refresh pair. Returns null on
-	 * irrecoverable failure (revoked, expired, signed by a different secret);
-	 * the session-refresh middleware treats null as "force re-login" by
-	 * clearing the refresh cookie.
-	 */
-	refreshSession(refreshToken: string): Promise<{
-		sessionToken: string;
-		refreshToken: string;
-	} | null>;
-}
-
-/**
- * Optional passwordless email surface — "type your email, click the link in
- * your inbox, you're in." Implemented by providers that broker email delivery
- * + token verification (Supabase Auth, future Eterna ID, …). Adapters that
- * can't send mail or don't model this flow leave `IAuthProvider.emailLink`
- * undefined.
- *
- * Lifecycle is two phases mirroring OAuth's start/callback split:
- *
- *   1. User submits an email → server calls `sendMagicLink(email,
- *      callbackUrl)`. The adapter delivers a link to that callback URL with
- *      whatever verification token shape it uses (Supabase: `?token_hash=…
- *      &type=magiclink`).
- *   2. User clicks the link, browser hits the callback route → server calls
- *      `verifyMagicLink(rawTokenFromUrl)` to mint a session.
- *
- * The driving adapter never inspects the token itself — it forwards the raw
- * URL string. Adapter-specific token shapes stay inside the adapter.
- */
-export interface IEmailLinkAuth {
-	/**
-	 * Send a magic-link email. `callbackUrl` is the absolute URL the
-	 * adapter should embed in the link — must point at the route that
-	 * handles `verifyMagicLink`.
-	 *
-	 * Returns `{ ok: true }` on success. On adapter-classified failures
-	 * (rate limit, signup disabled, invalid email) returns
-	 * `{ ok: false, reason }` so the route can render a user-friendly
-	 * message without exposing provider internals. Network/unknown errors
-	 * still throw.
-	 */
-	sendMagicLink(
-		email: string,
-		callbackUrl: string
-	): Promise<
-		{ ok: true } | { ok: false; reason: 'rate_limited' | 'signup_disabled' | 'invalid_email' }
-	>;
-
-	/**
-	 * Verify the token the IdP sent the user. `rawCallbackUrl` is the full
-	 * URL the user landed on (or an opaque adapter-specific token string —
-	 * adapters document which); the adapter pulls whatever fields it needs.
-	 *
-	 * Returns `null` for invalid/expired/already-redeemed tokens — callers
-	 * MUST treat null as "send the user back to /login". `refreshToken` is
-	 * present only for adapters that issue refresh tokens for email-link
-	 * sessions (Supabase does); omit otherwise.
-	 */
-	verifyMagicLink(rawCallbackUrl: string): Promise<{
-		user: AuthUser;
-		sessionToken: string;
-		refreshToken?: string;
-	} | null>;
-}
-
-/**
- * Optional forward-proxy authentication surface. Implemented by providers
- * that derive identity from signals injected by a trusted upstream reverse
- * proxy (HTTP headers, mTLS, etc.) — e.g. Caddy `forward_auth`,
- * oauth2-proxy, Authelia, Pomerium, Traefik forward-auth.
- *
- * ⚠ TRUST BOUNDARY — READ BEFORE IMPLEMENTING ⚠
- *
- * The signals this surface consumes are NOT verified cryptographically by
- * Selva. They are trusted because the deployment runs the app behind a
- * proxy that:
- *
- *   1. Authenticates the user against an upstream IdP, AND
- *   2. STRIPS any client-supplied copies of the trusted headers from
- *      inbound requests before adding its own, AND
- *   3. Is the ONLY network path that can reach the app process (bind to
- *      127.0.0.1, firewall the app port, or a private socket).
- *
- * If any condition fails, an attacker can spoof the headers and become
- * anyone. **Each implementer of this interface MUST ship a README that
- * states, loudly, the exact proxy configuration required.** The platform
- * layer cannot verify this — it is the provider's contract with its
- * operator.
- *
- * Lifecycle: `identifyFromHeaders` is called from `hooks.server.ts` on
- * every authed request whose session cookie is missing or invalid. It MUST
- * be cheap — a header read plus at most one indexed lookup. No network
- * calls, no synchronous disk scans of unbounded size.
- */
-export interface IProxyAuth {
-	/**
-	 * Identify the caller from trusted upstream-proxy signals on the
-	 * incoming request. Return `null` for "not identified" (header missing,
-	 * UPN not allowlisted, account disabled). MUST NOT throw for absent
-	 * headers — those are the normal anonymous case.
-	 *
-	 * On first identification of a previously-allowlisted user, the
-	 * implementation MAY materialize stored fields (display name, email)
-	 * from the same headers. Auto-creating arbitrary users from headers
-	 * is forbidden: the allowlist IS the security boundary.
-	 */
-	identifyFromHeaders(headers: Headers): Promise<AuthUser | null>;
-
-	/**
-	 * Diagnostic helper. Returns true iff none of the identity headers this
-	 * provider trusts arrived on the request. The hook layer uses this on
-	 * `/login` misses to distinguish "proxy never reached us" from "proxy is
-	 * here but didn't recognise the user" so operators can tell silent
-	 * forward-auth misconfigurations apart from real allowlist gaps without
-	 * leaking the trusted header names to end users.
-	 */
-	hasNoIdentityHeaders(headers: Headers): boolean;
-
-	/**
-	 * Diagnostic helper. Returns the identity-header names this provider is
-	 * configured to read. Used purely for log output — never surfaced to end
-	 * users.
-	 */
-	readonly configuredHeaderNames: readonly string[];
-}
-
-/**
- * Authentication provider — identity verification only. Profile state lives
- * in `IUserProfileStore`, platform permissions in `IPlatformPermissionStore`,
- * password ops in optional `passwordAuth`, OAuth in optional `oauth`.
- *
- * Methods here do NOT take a `RequestContext` — the provider produces the
- * identity used to *build* the context.
- */
-export interface IAuthProvider {
-	/** Display name shown in admin UI (e.g. "Local", "Microsoft Entra ID"). */
-	readonly name: string;
-
-	/** Present for credential-owning providers; undefined for OIDC-only. */
-	readonly passwordAuth?: IPasswordAuth;
-
-	/** Present for providers that broker OAuth flows; undefined otherwise. */
-	readonly oauth?: IOAuthAuth;
-
-	/**
-	 * Present for providers that send sign-in links over email (Supabase Auth,
-	 * future Eterna ID). Undefined otherwise.
-	 */
-	readonly emailLink?: IEmailLinkAuth;
-
-	/**
-	 * Present for providers that derive identity from a trusted upstream
-	 * proxy (forward-auth headers, mTLS, etc.). Undefined for credential
-	 * or OIDC-broker providers. See `IProxyAuth` for the trust contract.
-	 *
-	 * When set, the platform treats sign-out as the proxy/IdP's job and
-	 * does not render a logout button — Selva has no session to destroy.
-	 */
-	readonly proxyAuth?: IProxyAuth;
-
-	/**
-	 * Verify a token (session cookie, JWT, ID token, etc.). Returns the user
-	 * or null when invalid/expired.
-	 */
-	verifyToken(token: string): Promise<AuthUser | null>;
-
-	getUser(id: string): Promise<AuthUser | null>;
-
-	/** Returns null if the provider does not support user management. */
-	listUsers(opts?: ListOptions): Promise<Page<AuthUser> | null>;
-
-	/**
-	 * Optional: allowlist a user without a password (OAuth providers). Pure
-	 * identity — callers grant permissions via `IPlatformPermissionStore.set`.
-	 */
-	createUser?(email: string): Promise<AuthUser>;
-
-	/**
-	 * Delete a user identity. The sole-`instance_admin` invariant is NOT
-	 * enforced here — callers MUST consult
-	 * `IPlatformPermissionStore.countInstanceAdminsExcluding(id)` first and
-	 * surface `'last_admin'` themselves.
-	 */
-	deleteUser(id: string): Promise<UserManagementResult>;
-
-	/**
-	 * Disable a user. Sessions become invalid; identity is preserved (preferred
-	 * over deletion). Same invariant rules as `deleteUser`.
-	 */
-	disableUser(id: string): Promise<UserManagementResult>;
-
-	/**
-	 * Stamp `lastLoginAt`. Best-effort — failure MUST NOT block auth.
-	 * Adapters MAY debounce (e.g. skip if existing timestamp < 60s old).
-	 */
-	touchLastLogin?(id: string): Promise<void>;
-}

package/src/auth/types.ts

@@ -1,32 +0,0 @@
-/**
- * Identity record from an auth provider. Pure identity — no Selva-specific
- * authorization or profile state. Platform permissions live in
- * `IPlatformPermissionStore`; profile state lives in `IUserProfileStore`.
- */
-export interface AuthUser {
-	id: string;
-	email?: string;
-	/** Provider-specific only — never PII, credentials, or tokens. */
-	metadata?: Record<string, unknown>;
-	createdAt?: string;
-	/** Provider-updated only; never client-writable. */
-	lastLoginAt?: string;
-	/** When true, `verifyToken` and `verifyLogin` MUST fail. Prefer over deletion. */
-	disabled?: boolean;
-}
-
-/**
- * - `ok`            — succeeded
- * - `not_found`     — target user doesn't exist
- * - `not_supported` — provider doesn't implement user management
- * - `last_admin`    — refused; would leave zero `instance_admin` users
- */
-export type UserManagementResult = 'ok' | 'not_found' | 'not_supported' | 'last_admin';
-
-/**
- * - `success` — credentials valid; includes session token the provider minted.
- * - `failed` — credentials invalid, user disabled, or rate-limited.
- */
-export type LoginResult =
-	| { kind: 'success'; user: AuthUser; sessionToken: string }
-	| { kind: 'failed'; reason?: 'invalid_credentials' | 'disabled' | 'rate_limited' };

package/src/bindings/index.ts

@@ -1,2 +0,0 @@
-export type { IBindingResolver } from './interface.js';
-export { NoopBindingResolver } from './interface.js';

package/src/bindings/interface.ts

@@ -1,61 +0,0 @@
-/**
- * Server-side resolver for inputs marked as `source: { kind: 'server', key }`
- * in the schema. The host (selva app or a fork) supplies an implementation;
- * the platform stays domain-agnostic.
- *
- * Keys are opaque strings. The host defines the namespace
- * (e.g. 'capture.geometry', 'parcel.boundary') and the resolver interprets it
- * however it likes — typically as an address into the host's own domain store.
- *
- * Status: preliminary. The interface is expected to refine once we wire a
- * real binding end-to-end (see docs/upstream-binding-prep PR plan). Current
- * shape is the minimum needed to slot a host implementation behind
- * `SelvaConfig.bindingResolver`.
- */
-
-import type { RequestContext } from '../context.js';
-
-export interface IBindingResolver {
-	/**
-	 * Resolve a batch of bound keys in one call.
-	 *
-	 *   - `keys` is what the schema author wrote (`source.key`) — opaque to the
-	 *     platform, interpreted by the resolver. The author writes keys at
-	 *     design time, so the key should describe WHAT attribute to read, not
-	 *     WHICH entity to read it from.
-	 *   - `scope` is set by the calling route at solve time — opaque to the
-	 *     platform, supplies the "which entity" anchor that varies per
-	 *     request (capture id, parcel id, custom struct). Optional because
-	 *     not every host needs it.
-	 *
-	 * Implementations should return ONLY the keys they successfully
-	 * resolved — absent entries in the returned map signal "missing" to the
-	 * caller, who then decides what to do (e.g. error the solve, or fall back
-	 * to the input's `default`).
-	 *
-	 * Do not throw for individual missing keys. Throw only for resolver-wide
-	 * failures (DB unreachable, configuration error). Per-key "not found" is
-	 * normal and is signalled by omitting the entry.
-	 *
-	 * Batching is intentional: a single solve often binds multiple inputs
-	 * from one domain object, and the resolver should be able to do that
-	 * with a single DB round-trip.
-	 */
-	resolve(
-		ctx: RequestContext,
-		keys: readonly string[],
-		scope?: unknown
-	): Promise<Map<string, unknown>>;
-}
-
-/**
- * Default resolver used when the host hasn't configured one. Returns an
- * empty map for any request, which makes every bound input fail at solve
- * time — a loud signal that a resolver needs to be wired up. Drop-in replace
- * via `SelvaConfig.bindingResolver` once the host has a real implementation.
- */
-export class NoopBindingResolver implements IBindingResolver {
-	async resolve(): Promise<Map<string, unknown>> {
-		return new Map();
-	}
-}

package/src/computeServer/index.ts

@@ -1,28 +0,0 @@
-export type {
-	ComputeServerConfig,
-	ComputeConfig,
-	PlatformComputeServer,
-	OrgComputeServer
-} from './types.js';
-export { isPlatformServer, isOrgServer } from './types.js';
-export type { IComputeServerStore } from './interface.js';
-// At-rest secret crypto (uses `node:crypto`). Server-only — deliberately NOT
-// re-exported from the root barrel, which client `.svelte` code imports and
-// where a browser bundle can't resolve `node:crypto`. Import these from
-// `@selvajs/platform/computeServer` in server code. The report TYPES are erased
-// at build, so they also stay re-exported from the root barrel for convenience.
-export { isEncryptedSecret, encryptSecret, decryptSecret, decodeSecretKey } from './secrets.js';
-export type {
-	SecretVerificationReport,
-	SecretVerificationFailure,
-	SecretVerificationFailureReason
-} from './secrets.js';
-export type { ResolveOptions } from './utils.js';
-export {
-	serversVisibleTo,
-	defaultServerIdFor,
-	resolveServerForOrg,
-	findServerById,
-	platformServers,
-	orgServersFor
-} from './utils.js';

package/src/computeServer/interface.ts

@@ -1,73 +0,0 @@
-import type { RequestContext } from '../context.js';
-import type { ComputeConfig, ComputeServerConfig } from './types.js';
-import type { SecretVerificationReport } from './secrets.js';
-
-/**
- * Compute-server configuration. Architecture spec §4.8.
- *
- * One config doc holds *all* servers (platform + org-private) plus the
- * global `defaultServerId` and per-org `orgDefaults` map. Authorization is
- * the route layer's job — `manage_compute` for platform-server mutations,
- * `manage_org_compute` (gated by the `ALLOW_ORG_COMPUTE_OVERRIDE` flag) for
- * org-private mutations and `orgDefaults[orgId]`.
- */
-export interface IComputeServerStore {
-	/**
-	 * Read the full config. Callers (resolver, page loaders, route handlers)
-	 * apply the visibility predicate from `serversVisibleTo` themselves —
-	 * the store does not pre-filter, because the same row set is needed at
-	 * different scopes (admin manage vs. org manage vs. solve).
-	 */
-	getConfig(ctx: RequestContext): Promise<ComputeConfig>;
-
-	/**
-	 * Replace the entire platform-server set + global `defaultServerId`.
-	 * Org-private rows and `orgDefaults` are left untouched.
-	 */
-	savePlatformServers(
-		ctx: RequestContext,
-		servers: ComputeServerConfig[],
-		defaultServerId: string | undefined
-	): Promise<void>;
-
-	/**
-	 * Replace the org-private server set for `orgId` and (optionally) update
-	 * `orgDefaults[orgId]`. Platform rows are left untouched.
-	 *
-	 * Pass `defaultServerId: null` to clear the org's override; `undefined`
-	 * leaves the existing value alone.
-	 */
-	saveOrgServers(
-		ctx: RequestContext,
-		orgId: string,
-		servers: ComputeServerConfig[],
-		defaultServerId?: string | null
-	): Promise<void>;
-
-	/**
-	 * Set or clear `orgDefaults[orgId]`. The route layer is responsible for
-	 * verifying the chosen server is visible to the org before calling this.
-	 *
-	 * `serverId === null` clears the override.
-	 */
-	setOrgDefault(ctx: RequestContext, orgId: string, serverId: string | null): Promise<void>;
-
-	/**
-	 * Hard-delete this org's compute rows: org-private servers, the
-	 * `orgDefaults[orgId]` entry, and any references to this org inside
-	 * platform servers' `sharedWith` allowlists. No-op when none exist.
-	 * Called from `deleteOrg` so soft-deleting an org does not leave its
-	 * compute config behind.
-	 */
-	deleteByOrg(ctx: RequestContext, orgId: string): Promise<void>;
-
-	/**
-	 * Boot-time integrity check: attempt to decrypt every stored `apiKey` and
-	 * report any that are plaintext-at-rest or fail to decrypt under the current
-	 * `SELVA_AT_REST_KEY`. Does NOT throw — returns a structured report so the
-	 * caller (boot health) decides whether to refuse boot / drive `/api/health`
-	 * to 503. Both encrypting stores (local file, Supabase) implement this;
-	 * optional so a hypothetical non-encrypting store can omit it.
-	 */
-	verifySecrets?(): Promise<SecretVerificationReport>;
-}

package/src/computeServer/secrets.ts

@@ -1,102 +0,0 @@
-import { randomBytes, createCipheriv, createDecipheriv } from 'node:crypto';
-
-const ALGO = 'aes-256-gcm';
-const IV_BYTES = 12;
-const TAG_BYTES = 16;
-const PREFIX = 'enc:v1:';
-
-/**
- * AES-256-GCM envelope for at-rest secrets (e.g. compute API keys).
- *
- * Wire format: `enc:v1:<base64(iv|tag|ciphertext)>`. The version prefix lets
- * us migrate to a new algorithm later without ambiguity. Plaintext never sits
- * at rest — on disk (local provider) or in the DB (Supabase provider).
- *
- * Security model: defends against backup leaks, accidental file/DB sharing,
- * and read-only storage access. An attacker with both the stored ciphertext
- * *and* the master key (`SELVA_AT_REST_KEY` env var, process memory) can still
- * decrypt — this is encryption at rest, not a secret manager.
- *
- * Provider-agnostic: pure `node:crypto`, no fs or DB coupling, so both the
- * local and Supabase compute-server stores share this one implementation.
- */
-
-export function isEncryptedSecret(value: string): boolean {
-	return value.startsWith(PREFIX);
-}
-
-export function encryptSecret(plaintext: string, key: Buffer): string {
-	if (key.length !== 32) {
-		throw new Error(`Secret key must be 32 bytes; got ${key.length}`);
-	}
-	if (isEncryptedSecret(plaintext)) {
-		throw new Error('Refusing to encrypt a value that is already encrypted');
-	}
-	const iv = randomBytes(IV_BYTES);
-	const cipher = createCipheriv(ALGO, key, iv);
-	const ciphertext = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
-	const tag = cipher.getAuthTag();
-	return PREFIX + Buffer.concat([iv, tag, ciphertext]).toString('base64');
-}
-
-export function decryptSecret(envelope: string, key: Buffer): string {
-	if (key.length !== 32) {
-		throw new Error(`Secret key must be 32 bytes; got ${key.length}`);
-	}
-	if (!isEncryptedSecret(envelope)) {
-		throw new Error('Value is not an encrypted secret envelope');
-	}
-	const buf = Buffer.from(envelope.slice(PREFIX.length), 'base64');
-	const iv = buf.subarray(0, IV_BYTES);
-	const tag = buf.subarray(IV_BYTES, IV_BYTES + TAG_BYTES);
-	const ciphertext = buf.subarray(IV_BYTES + TAG_BYTES);
-	const decipher = createDecipheriv(ALGO, key, iv);
-	decipher.setAuthTag(tag);
-	return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString('utf8');
-}
-
-/**
- * Decode a `SELVA_AT_REST_KEY` env var into a 32-byte buffer. Accepts either
- * 64-char hex or base64 (with or without padding). Throws on anything else
- * so misconfiguration fails loudly at boot rather than silently producing
- * an undecryptable value.
- */
-export function decodeSecretKey(raw: string): Buffer {
-	if (/^[0-9a-fA-F]{64}$/.test(raw)) return Buffer.from(raw, 'hex');
-	const buf = Buffer.from(raw, 'base64');
-	if (buf.length === 32) return buf;
-	throw new Error(
-		'SELVA_AT_REST_KEY must be 32 bytes encoded as 64-char hex or base64. ' +
-			"Generate one with: node -e \"console.log(require('crypto').randomBytes(32).toString('hex'))\""
-	);
-}
-
-/**
- * Result of a compute-server store's `verifySecrets()`. One `failures` entry
- * per server whose `apiKey` couldn't be loaded:
- *  - `plaintext_on_disk` — the field exists but isn't an `enc:v1:` envelope.
- *    Either a hand-edit, a legacy row from before encryption, or a migration
- *    regression. Security-relevant.
- *  - `key_mismatch`      — envelope is valid but GCM auth-tag verification
- *    fails under the current `SELVA_AT_REST_KEY`. The key was rotated or the
- *    data came from another deployment.
- *
- * Storage-agnostic (`plaintext_on_disk` reads "plaintext at rest" for both the
- * file- and DB-backed stores) so boot health can treat every provider alike.
- */
-export type SecretVerificationFailureReason = 'key_mismatch' | 'plaintext_on_disk';
-
-export interface SecretVerificationFailure {
-	serverId: string;
-	serverLabel: string;
-	reason: SecretVerificationFailureReason;
-	/** Underlying error message for `key_mismatch`. Absent for plaintext. */
-	cause?: string;
-}
-
-export interface SecretVerificationReport {
-	ok: boolean;
-	failures: SecretVerificationFailure[];
-	/** True if at least one row holds an unencrypted apiKey at rest. */
-	plaintextFound: boolean;
-}

package/src/computeServer/types.ts

@@ -1,74 +0,0 @@
-/**
- * Compute servers belong to one of two scopes — never both.
- *
- * - **Platform server** (`scope: 'platform'`) — created by `manage_compute`.
- *   `sharedWith` controls which orgs see it. The single global
- *   `defaultServerId` (in {@link ComputeConfig}) must reference a platform
- *   server and is *always* visible to every org regardless of `sharedWith`.
- *
- * - **Org-private server** (`scope: 'org'`) — created by an org owner/admin
- *   with `manage_org_compute`. Visible only to its `ownerOrgId`. Gated by
- *   the `ALLOW_ORG_COMPUTE_OVERRIDE` platform flag.
- *
- * Architecture spec §4.8.
- */
-export type ComputeServerConfig = PlatformComputeServer | OrgComputeServer;
-
-interface ComputeServerCommon {
-	id: string;
-	label: string;
-	/** Base URL of the Rhino.Compute instance. */
-	serverUrl: string;
-	/** Sent as `RhinoComputeKey` header. */
-	apiKey?: string;
-	/** Default: 30000. */
-	timeoutMs?: number;
-	/** Default: 0. */
-	retryCount?: number;
-}
-
-export interface PlatformComputeServer extends ComputeServerCommon {
-	scope: 'platform';
-	/**
-	 * Which orgs can see this server in pickers / use it for solves.
-	 *   - `'all'`  — every org. Default in `tenancy: 'single'`.
-	 *   - `string[]` — explicit org-id allowlist. `[]` = dormant
-	 *     (admin-only) unless this server is the global `defaultServerId`,
-	 *     which is always usable everywhere.
-	 */
-	sharedWith: 'all' | string[];
-}
-
-export interface OrgComputeServer extends ComputeServerCommon {
-	scope: 'org';
-	/** The org that owns this server. Visible only to members of this org. */
-	ownerOrgId: string;
-}
-
-export interface ComputeConfig {
-	servers: ComputeServerConfig[];
-	/**
-	 * Global default. Must reference a platform server. Always usable by
-	 * every org regardless of that server's `sharedWith` — this is the
-	 * "baseline server any user uses" floor.
-	 */
-	defaultServerId?: string;
-	/**
-	 * Per-org default override. `orgDefaults[orgId]` must reference a server
-	 * that is visible to `orgId` (a platform server with `orgId` in
-	 * `sharedWith` or `'all'`, or an org server owned by `orgId`).
-	 */
-	orgDefaults?: Record<string, string>;
-}
-
-// ============================================================================
-// Type guards
-// ============================================================================
-
-export function isPlatformServer(s: ComputeServerConfig): s is PlatformComputeServer {
-	return s.scope === 'platform';
-}
-
-export function isOrgServer(s: ComputeServerConfig): s is OrgComputeServer {
-	return s.scope === 'org';
-}