@selvajs/platform 0.14.3-beta.0 → 0.15.0-beta.2

package/src/errors/interface.ts

@@ -1,45 +0,0 @@
-/**
- * Structured context attached to a reported error. All fields optional — a
- * report can fire before any request context is built (e.g. an
- * `unhandledRejection` with no active request). Deliberately NOT a
- * `RequestContext`: reporters must never receive the opaque `authToken`, so
- * only non-sensitive routing/identity fields are surfaced here.
- */
-export interface ErrorContext {
-	/** HTTP method, when the error happened inside a request. */
-	method?: string;
-	/** Route pathname (never the query string — it can carry share tokens). */
-	route?: string;
-	/** Acting user id, when known. */
-	userId?: string;
-	/** Org the user was acting as, when known. */
-	orgId?: string;
-	/** Non-sensitive tags for grouping/search in the backend. */
-	tags?: Record<string, string>;
-}
-
-/**
- * Sink for unexpected server errors. Called from `handleError` and the
- * process-level `unhandledRejection`/`uncaughtException` hooks.
- *
- * MUST NOT throw — reporting is best-effort and sits on the error path, where a
- * second failure would mask the first. Implementations catch and log their own
- * failures. MAY be fire-and-forget.
- */
-export interface IErrorReporter {
-	/**
-	 * Report an unexpected error. `error` is whatever was thrown/rejected —
-	 * often an `Error`, but adapters occasionally reject with a plain object,
-	 * so implementations must render defensively.
-	 */
-	capture(error: unknown, context?: ErrorContext): void;
-}
-
-/**
- * Default `IErrorReporter` — discards every report. Used when no error-tracking
- * backend is configured (e.g. `SENTRY_DSN` unset), so call sites can report
- * unconditionally. Swap in a real reporter to ship errors off-box.
- */
-export class NoopErrorReporter implements IErrorReporter {
-	capture(_error: unknown, _context?: ErrorContext): void {}
-}

package/src/errors.ts

@@ -1,16 +0,0 @@
-/**
- * Thrown by providers to signal an expected failure that the API layer
- * should forward with a specific status. Unknown errors should propagate as
- * plain `Error` and become 500s.
- *
- * Conventional values: 400, 401, 403, 404, 409, 422, 429, 500.
- */
-export class ProviderError extends Error {
-	readonly statusCode: number;
-
-	constructor(message: string, statusCode: number = 400) {
-		super(message);
-		this.name = 'ProviderError';
-		this.statusCode = statusCode;
-	}
-}

package/src/events/audit.ts

@@ -1,67 +0,0 @@
-import type { RequestContext } from '../context.js';
-import type { DomainEvent, DomainEventType } from './interface.js';
-
-/**
- * Read-side counterpart to `IEventSink`. Persisted by the sink, queried by
- * operator-facing UIs (admin audit log) and future analytics consumers.
- *
- * Kept on its own interface so:
- *   - dev-mode `NoopEventSink` doesn't need a fake `query` returning empty;
- *     `auditQuery` simply stays undefined on the data provider.
- *   - future webhook-dispatcher sinks aren't forced to implement a query path.
- *   - the contract here can throw on backend failure without violating the
- *     sink's "MUST NOT throw" rule.
- *
- * Authorisation is the caller's job — implementations read from a privileged
- * client (Supabase service-role, etc.) and assume the route layer has already
- * gated on `instance_admin`.
- */
-
-export interface AuditEventRow {
-	/** Stable row id from the persistent store (e.g. uuid). */
-	id: string;
-	/** ISO 8601. The persisted timestamp, not when the originating mutation occurred. */
-	occurredAt: string;
-	type: DomainEventType;
-	actorId: string;
-	/** The full `DomainEvent` payload as recorded. */
-	data: DomainEvent;
-}
-
-/**
- * Keyset cursor. `(occurredAt, id)` lexicographic — `occurredAt` alone isn't
- * unique under bursty writes, so a tie-breaker is required to avoid skipped
- * rows on page boundaries.
- */
-export interface AuditCursor {
-	occurredAt: string;
-	id: string;
-}
-
-export interface AuditQueryFilters {
-	/** Restrict to these event types. Empty / undefined = all types. */
-	types?: readonly DomainEventType[];
-	/** Restrict to events emitted by this actor id (or `'system'`). */
-	actorId?: string;
-	/** Inclusive lower bound on `occurredAt`. ISO 8601. */
-	sinceIso?: string;
-	/** Inclusive upper bound on `occurredAt`. ISO 8601. */
-	untilIso?: string;
-	/**
-	 * Page size. Implementations clamp to a sane upper bound (≤200) — callers
-	 * shouldn't be able to request unbounded reads.
-	 */
-	limit?: number;
-	/** Keyset cursor from a previous page's `nextCursor`. */
-	cursor?: AuditCursor;
-}
-
-export interface AuditQueryResult {
-	rows: AuditEventRow[];
-	/** Null when there are no more rows past this page. */
-	nextCursor: AuditCursor | null;
-}
-
-export interface IAuditQuery {
-	list(ctx: RequestContext, filters: AuditQueryFilters): Promise<AuditQueryResult>;
-}

package/src/events/index.ts

@@ -1,9 +0,0 @@
-export type { DomainEvent, DomainEventType, IEventSink } from './interface.js';
-export { actorFrom, NoopEventSink } from './interface.js';
-export type {
-	AuditEventRow,
-	AuditCursor,
-	AuditQueryFilters,
-	AuditQueryResult,
-	IAuditQuery
-} from './audit.js';

package/src/events/interface.ts

@@ -1,102 +0,0 @@
-/**
- * Domain-event sink. Stores call `emit` AFTER a successful mutation; failed
- * writes do not emit. `emit` MUST NOT throw — failures are the sink's
- * problem to log and swallow.
- *
- * `actorId` is the user who triggered the change, or `'system'` for
- * SYSTEM_CONTEXT mutations (bootstrap, janitor, migrations).
- */
-
-export type DomainEvent =
-	| { type: 'org.created'; orgId: string; actorId: string }
-	| { type: 'org.deleted'; orgId: string; actorId: string }
-	| { type: 'org_member.added'; orgId: string; userId: string; actorId: string }
-	| { type: 'org_member.removed'; orgId: string; userId: string; actorId: string }
-	| {
-			type: 'org_member.role_changed';
-			orgId: string;
-			userId: string;
-			role: string;
-			actorId: string;
-	  }
-	| {
-			type: 'org_member.permissions_changed';
-			orgId: string;
-			userId: string;
-			permissions: readonly string[];
-			actorId: string;
-	  }
-	| { type: 'project.created'; projectId: string; orgId: string; actorId: string }
-	| { type: 'project.deleted'; projectId: string; actorId: string }
-	| { type: 'project_member.added'; projectId: string; userId: string; actorId: string }
-	| { type: 'project_member.removed'; projectId: string; userId: string; actorId: string }
-	| {
-			type: 'project_member.role_changed';
-			projectId: string;
-			userId: string;
-			role: string;
-			actorId: string;
-	  }
-	| { type: 'definition.created'; definitionId: string; projectId: string; actorId: string }
-	| { type: 'definition.deleted'; definitionId: string; actorId: string }
-	| { type: 'definition.published'; definitionId: string; versionId: string; actorId: string }
-	| {
-			type: 'definition_version.created';
-			versionId: string;
-			definitionId: string;
-			actorId: string;
-	  }
-	| { type: 'definition_version.deleted'; versionId: string; actorId: string }
-	| { type: 'share_link.minted'; linkId: string; definitionId: string; actorId: string }
-	| { type: 'share_link.revoked'; linkId: string; actorId: string }
-	| {
-			type: 'invite.created';
-			inviteId: string;
-			orgId: string;
-			email: string;
-			actorId: string;
-	  }
-	| { type: 'invite.accepted'; inviteId: string; orgId: string; userId: string; actorId: string }
-	| { type: 'invite.revoked'; inviteId: string; orgId: string; actorId: string };
-
-export type DomainEventType = DomainEvent['type'];
-
-export interface IEventSink {
-	/**
-	 * Record a domain event. Called by stores AFTER a successful mutation; a
-	 * failed write does not emit.
-	 *
-	 * MUST NOT throw — this method is on the hot path of every mutating
-	 * operation, and an exception here would surface as a failed write even
-	 * though the actual mutation already committed. Implementations MUST
-	 * catch network errors, queue overflows, and any other transient or
-	 * persistent failures internally and log them; the only side effect
-	 * visible to the caller is a fulfilled promise.
-	 *
-	 * MAY be fire-and-forget — the contract is "best-effort durable
-	 * recording," not synchronous persistence. Adapters that queue + flush
-	 * asynchronously are valid as long as they preserve event ordering per
-	 * `actorId`.
-	 */
-	emit(event: DomainEvent): Promise<void>;
-}
-
-/**
- * Resolve the actor id from a RequestContext. Returns `ctx.userId` when set,
- * `'system'` otherwise — matches the `SYSTEM_CONTEXT` convention where
- * `userId === ''` denotes a server-internal caller (bootstrap, janitors,
- * migrations).
- */
-export function actorFrom(ctx: { userId: string; system?: boolean }): string {
-	return ctx.userId || 'system';
-}
-
-/**
- * Default `IEventSink` — discards every event. Used when `SelvaConfig.events`
- * is omitted, and as the safe fallback for adapters whose data layer has no
- * event log (local-provider). Drop-in replace via `SelvaConfig.events` once a
- * real dispatcher is wired.
- */
-export class NoopEventSink implements IEventSink {
-	async emit(_event: DomainEvent): Promise<void> {}
-}

package/src/index.ts

@@ -1,247 +0,0 @@
-// @selvajs/platform — published API contract. Every symbol here is breaking-change-protected.
-
-// auth
-export type { AuthUser, UserManagementResult, LoginResult } from './auth/types.js';
-export type {
-	IAuthProvider,
-	IOAuthAuth,
-	IPasswordAuth,
-	IEmailLinkAuth,
-	IProxyAuth
-} from './auth/interface.js';
-
-// ---------------------------------------------------------------------------
-// permissions
-// ---------------------------------------------------------------------------
-export type { PlatformPermission } from './permissions/types.js';
-export { PlatformPermissionSchema, ALL_PLATFORM_PERMISSIONS } from './permissions/types.js';
-export type { IPlatformPermissionStore } from './permissions/interface.js';
-
-// userProfile
-export type { IUserProfileStore } from './userProfile/interface.js';
-export type { UserProfile, RecentRun } from './userProfile/types.js';
-export { emptyProfile } from './userProfile/types.js';
-
-// organizations
-export type { Organization, OrgMember, OrgAssets } from './organizations/types.js';
-export type { IOrgStore } from './organizations/interface.js';
-export { orgPaths } from './organizations/paths.js';
-export type {
-	OrgRole,
-	OrgPermission,
-	OrgAssetKind,
-	CreateOrgInput,
-	UpdateOrgInput
-} from './organizations/schemas.js';
-export {
-	OrgRoleSchema,
-	OrgPermissionSchema,
-	OrgAssetKindSchema,
-	ALL_ORG_ASSET_KINDS,
-	SlugSchema,
-	CreateOrgSchema,
-	UpdateOrgSchema,
-	ALL_ORG_PERMISSIONS,
-	DEFAULT_ORG_PERMISSIONS,
-	OWNER_ADMIN_ONLY_PERMISSIONS,
-	MEMBER_ASSIGNABLE_PERMISSIONS
-} from './organizations/schemas.js';
-
-// invites
-export type { Invite } from './invites/types.js';
-export type { IInviteStore } from './invites/interface.js';
-
-// projects
-export type { Project, ProjectMember } from './projects/types.js';
-export type { IProjectStore } from './projects/interface.js';
-export type { ProjectVisibility, ProjectRole } from './projects/schemas.js';
-export {
-	ProjectVisibilitySchema,
-	ProjectRoleSchema,
-	validateProjectFlags
-} from './projects/schemas.js';
-
-// platformProjects
-export type { PlatformProjectGrant, PlatformProjectGranteeType } from './platformProjects/types.js';
-export type { IPlatformProjectGrantStore } from './platformProjects/interface.js';
-export {
-	PlatformProjectGrantSchema,
-	PlatformProjectGranteeTypeSchema
-} from './platformProjects/schemas.js';
-
-// definitions
-export type {
-	DefinitionFileExt,
-	DefinitionRecord,
-	DefinitionRecordPatch,
-	DefinitionStatus,
-	DefinitionVersion,
-	DefinitionChannel
-} from './definitions/types.js';
-export type { IDefinitionStore } from './definitions/interface.js';
-export type { UISchema } from '@selvajs/schemas';
-export {
-	GH_EXTENSIONS,
-	COVER_IMAGE_EXTENSIONS,
-	ALLOWED_UPLOAD_EXTENSIONS,
-	COVER_IMAGE_CONTENT_TYPES
-} from './definitions/types.js';
-export { definitionPaths } from './definitions/paths.js';
-export type { UpdateMetadataInput } from './definitions/schemas.js';
-export {
-	DefinitionChannelSchema,
-	PublishVersionInputSchema,
-	CreateDefinitionInputSchema,
-	UpdateMetadataInputSchema,
-	GuidSchema,
-	UUID_REGEX
-} from './definitions/schemas.js';
-
-// ---------------------------------------------------------------------------
-// shareLinks
-// ---------------------------------------------------------------------------
-export type { ShareLink } from './shareLinks/types.js';
-export type { IShareLinkStore } from './shareLinks/interface.js';
-export { DEFAULT_SHARE_LINK_MAX_SOLVES } from './shareLinks/types.js';
-export type { CreateShareLinkInput } from './shareLinks/schemas.js';
-export { CreateShareLinkInputSchema } from './shareLinks/schemas.js';
-
-// ---------------------------------------------------------------------------
-// storage
-// ---------------------------------------------------------------------------
-export type { IStorageProvider } from './storage/interface.js';
-export {
-	IMAGE_MAX_WIDTH,
-	IMAGE_WEBP_QUALITY,
-	isImageUpload,
-	toWebpPath,
-	transcodeImageIfNeeded
-} from './storage/image.js';
-export type { TranscodeResult } from './storage/image.js';
-export { ASSET_CLASSES, classifyAssetPath, isPublicAssetPath } from './storage/assetClasses.js';
-export type {
-	AssetVisibility,
-	AssetScope,
-	AssetClass,
-	AssetMatch
-} from './storage/assetClasses.js';
-export { withCacheBust } from './storage/cacheBust.js';
-
-// ---------------------------------------------------------------------------
-// data (composition root)
-// ---------------------------------------------------------------------------
-export type { IDataProvider } from './data/interface.js';
-
-// ---------------------------------------------------------------------------
-// computeServer
-// ---------------------------------------------------------------------------
-export type {
-	ComputeServerConfig,
-	ComputeConfig,
-	PlatformComputeServer,
-	OrgComputeServer
-} from './computeServer/types.js';
-export { isPlatformServer, isOrgServer } from './computeServer/types.js';
-export type { IComputeServerStore } from './computeServer/interface.js';
-// NOTE: the at-rest secret crypto FUNCTIONS (`encryptSecret` etc.) are NOT
-// re-exported here — they use `node:crypto` and this barrel is imported by
-// client `.svelte` code, so a browser bundle would fail to resolve them. Import
-// them from `@selvajs/platform/computeServer` (server-only) instead. The report
-// TYPES are erased at build, so they stay here for convenience.
-export type {
-	SecretVerificationReport,
-	SecretVerificationFailure,
-	SecretVerificationFailureReason
-} from './computeServer/secrets.js';
-export type { ResolveOptions } from './computeServer/utils.js';
-export {
-	serversVisibleTo,
-	defaultServerIdFor,
-	resolveServerForOrg,
-	findServerById,
-	platformServers,
-	orgServersFor
-} from './computeServer/utils.js';
-
-// ---------------------------------------------------------------------------
-// access (pure permission predicates)
-// ---------------------------------------------------------------------------
-export type {
-	ProjectAccessInput,
-	DefinitionAccessInput,
-	VisibilityChangeInput,
-	ReclaimAccessInput,
-	CreateProjectAccessInput,
-	OwnerRemovalInput,
-	OwnerRemovalCheck
-} from './access/rules.js';
-export {
-	canView,
-	canSolve,
-	canEdit,
-	canManage,
-	canEditProjectSettings,
-	canChangeVisibilityToPublic,
-	canEditDefinition,
-	canReclaim,
-	canCreateProject,
-	checkOwnerRemoval,
-	withAdminBypass
-} from './access/rules.js';
-
-// ---------------------------------------------------------------------------
-// events
-// ---------------------------------------------------------------------------
-export type { DomainEvent, DomainEventType, IEventSink } from './events/interface.js';
-export { actorFrom, NoopEventSink } from './events/interface.js';
-export type {
-	AuditEventRow,
-	AuditCursor,
-	AuditQueryFilters,
-	AuditQueryResult,
-	IAuditQuery
-} from './events/audit.js';
-
-// ---------------------------------------------------------------------------
-// metrics (per-solve timing telemetry)
-// ---------------------------------------------------------------------------
-export type { ISolveMetricSink, SolveMetric, SolveFailureKind } from './metrics/interface.js';
-export { NoopSolveMetricSink } from './metrics/interface.js';
-
-// ---------------------------------------------------------------------------
-// errors (unexpected-error reporting)
-// ---------------------------------------------------------------------------
-export type { IErrorReporter, ErrorContext } from './errors/interface.js';
-export { NoopErrorReporter } from './errors/interface.js';
-
-// ---------------------------------------------------------------------------
-// bindings (server-side resolver for schema inputs marked `source.kind === 'server'`)
-// ---------------------------------------------------------------------------
-export type { IBindingResolver } from './bindings/interface.js';
-export { NoopBindingResolver } from './bindings/interface.js';
-
-// ---------------------------------------------------------------------------
-// utils
-// ---------------------------------------------------------------------------
-export type { AuditUpdate, AuditSoftDelete } from './utils/audit.js';
-export { auditUpdate, auditSoftDelete } from './utils/audit.js';
-
-// ---------------------------------------------------------------------------
-// top-level (context, pagination, config, errors)
-// ---------------------------------------------------------------------------
-export type { RequestContext } from './context.js';
-export { SYSTEM_CONTEXT, hasPermission, requireActingOrg } from './context.js';
-
-export type { ListOptions, DefinitionListOptions, Page } from './pagination.js';
-export { DEFAULT_PAGE_LIMIT, MAX_PAGE_LIMIT } from './pagination.js';
-
-export type {
-	TenancyMode,
-	SelvaFlags,
-	SelvaBranding,
-	SelvaConfig,
-	SelvaConfigFactory
-} from './config.js';
-export { isFlagEnabled, defineConfig } from './config.js';
-
-export { ProviderError } from './errors.js';

package/src/invites/index.ts

@@ -1,2 +0,0 @@
-export type { Invite } from './types.js';
-export type { IInviteStore } from './interface.js';

package/src/invites/interface.ts

@@ -1,38 +0,0 @@
-import type { RequestContext } from '../context.js';
-import type { ListOptions, Page } from '../pagination.js';
-import type { Invite } from './types.js';
-
-/**
- * "Admin invites a user, user clicks link and joins" flow. Decoupled from
- * `IAuthProvider` so accept works regardless of how credentials are owned.
- *
- * Mutations require a session (gated by route layer). `getByTokenHash` and
- * `markAccepted` accept `SYSTEM_CONTEXT` because the token is the capability
- * — the public /accept-invite page has no session yet.
- */
-export interface IInviteStore {
-	create(ctx: RequestContext, invite: Invite): Promise<void>;
-
-	/**
-	 * Lookup by HMAC hash of the raw token. Caller hashes the inbound token
-	 * (e.g. via `packages/selva/src/lib/server/invites/token.server.ts`) and
-	 * passes the digest here. Returns null for unknown, expired, or
-	 * consumed invites.
-	 */
-	getByTokenHash(ctx: RequestContext, tokenHash: string): Promise<Invite | null>;
-
-	listByOrg(ctx: RequestContext, orgId: string, opts?: ListOptions): Promise<Page<Invite>>;
-
-	/** No-op if already accepted. */
-	markAccepted(ctx: RequestContext, id: string, userId: string): Promise<void>;
-
-	/** No-op if already consumed or missing. */
-	revoke(ctx: RequestContext, id: string): Promise<void>;
-
-	/**
-	 * Hard-delete every invite belonging to an org. Called from `deleteOrg`
-	 * cascade — pending invites to a deleted org are unredeemable, so leaving
-	 * them behind only creates orphans.
-	 */
-	deleteByOrg(ctx: RequestContext, orgId: string): Promise<void>;
-}

package/src/invites/types.ts

@@ -1,39 +0,0 @@
-import type { OrgRole, OrgPermission } from '../organizations/schemas.js';
-
-/**
- * "The holder of the raw token whose hash is `tokenHash` may join `orgId` at
- * `orgRole` with these org permissions." Accepting creates the user (if
- * needed), the org membership, and marks the invite consumed.
- *
- * The raw token is shown to the admin once at mint time and embedded in the
- * accept URL; the store sees only `HMAC-SHA256(secret, rawToken)`. A DB-only
- * leak therefore can't be replayed — the attacker would need the instance
- * secret too. Mirrors the share-link design (`ShareLink.tokenHash`).
- *
- * `getByTokenHash` is callable without a session — knowing a valid token
- * (and therefore being able to hash it) is the auth.
- */
-export interface Invite {
-	id: string;
-	/**
-	 * `HMAC-SHA256(INVITE_TOKEN_SECRET, rawToken)` — base64url. The raw token
-	 * never crosses the store boundary; the route layer hashes inbound tokens
-	 * before lookup.
-	 */
-	tokenHash: string;
-	/** Lowercase email the invite was issued for. */
-	email: string;
-	orgId: string;
-	orgRole: OrgRole;
-	/**
-	 * Permissions to grant on accept. May be empty — adapters may seed from
-	 * `DEFAULT_ORG_PERMISSIONS` in that case.
-	 */
-	orgPermissions: OrgPermission[];
-	invitedBy: string;
-	createdAt: string;
-	expiresAt: string;
-	/** Set when consumed. Consumed invites are not re-usable. */
-	acceptedAt?: string;
-	acceptedByUserId?: string;
-}

package/src/metrics/interface.ts

@@ -1,86 +0,0 @@
-import type { RequestContext } from '../context.js';
-
-/**
- * Why a solve did not produce a usable result. `ok` means the solve completed
- * (it may still carry Grasshopper runtime errors — see `errorCount`). The
- * failure kinds mirror the distinct branches the compute route already
- * distinguishes, so the recorded reason matches the HTTP status the client saw.
- */
-export type SolveFailureKind =
-	/** Solve completed; the response was returned to the client. */
-	| 'ok'
-	/** Scheduler deadline exceeded (HTTP 504). */
-	| 'timeout'
-	/** Client disconnected mid-solve; the request signal aborted (HTTP 499). */
-	| 'client_abort'
-	/** Rejected by the per-key rate limiter before solving (HTTP 429). */
-	| 'rate_limited'
-	/** Share-link solve cap reached before solving (HTTP 429). */
-	| 'share_cap'
-	/** Result exceeded the response size limit (HTTP 413). */
-	| 'too_large'
-	/** Compute server unreachable or the solve threw for any other reason. */
-	| 'compute_error';
-
-/**
- * One solve's timing and outcome, recorded once per solve attempt — including
- * attempts rejected before `scheduler.solve()` runs (rate limit, share cap).
- *
- * `durationMs` is wall time around the Rhino.Compute solve call only — it
- * excludes definition loading, auth, schema work, and result serialization. It
- * is 0 for attempts rejected before the solve started.
- */
-export interface SolveMetric {
-	/** Definition the solve ran against. `local:<guid>` or a remote URL. */
-	definitionUrl: string;
-	/**
-	 * Local definition id (the `local:` guid), or null for remote-URL solves.
-	 * Stored alongside `definitionUrl` so timings join to the definition record.
-	 */
-	definitionId: string | null;
-	/**
-	 * The exact version solved, or null for remote-URL solves (and for local
-	 * attempts rejected before the version resolved). Lets you compare timings
-	 * across versions of the same definition.
-	 */
-	versionId: string | null;
-	/** Channel solved, mirroring the compute request. */
-	channel: 'live' | 'draft';
-	/** Org whose compute pool served the solve, or null for remote definitions. */
-	orgId: string | null;
-	/** Wall-clock duration of `scheduler.solve()` in milliseconds. 0 if never started. */
-	durationMs: number;
-	/** Whether the solve completed and returned a result. */
-	ok: boolean;
-	/** Why the solve did not return a result; `'ok'` when it did. */
-	failureKind: SolveFailureKind;
-	/**
-	 * Count of Grasshopper runtime errors in the solve response. A solve can be
-	 * `ok` yet still report component-level errors — this is distinct from
-	 * `failureKind`. 0 when the solve never returned a response.
-	 */
-	errorCount: number;
-	/** Count of Grasshopper runtime warnings in the solve response. */
-	warningCount: number;
-}
-
-/**
- * Sink for per-solve timing telemetry. Called once per solve attempt from the
- * compute route, AFTER the solve resolves or rejects.
- *
- * MUST NOT throw — recording is best-effort and sits on the hot path of every
- * solve. Implementations catch and log their own failures; the only side
- * effect visible to the caller is a fulfilled promise. MAY be fire-and-forget.
- */
-export interface ISolveMetricSink {
-	record(ctx: RequestContext, metric: SolveMetric): Promise<void>;
-}
-
-/**
- * Default `ISolveMetricSink` — discards every metric. Used when
- * `SelvaConfig.solveMetrics` is omitted. Swap in a real sink to persist or
- * aggregate solve timings.
- */
-export class NoopSolveMetricSink implements ISolveMetricSink {
-	async record(_ctx: RequestContext, _metric: SolveMetric): Promise<void> {}
-}

package/src/organizations/index.ts

@@ -1,23 +0,0 @@
-export type { Organization, OrgMember, OrgAssets } from './types.js';
-export type { IOrgStore } from './interface.js';
-export { orgPaths } from './paths.js';
-export type {
-	OrgRole,
-	OrgPermission,
-	OrgAssetKind,
-	CreateOrgInput,
-	UpdateOrgInput
-} from './schemas.js';
-export {
-	OrgRoleSchema,
-	OrgPermissionSchema,
-	OrgAssetKindSchema,
-	ALL_ORG_ASSET_KINDS,
-	SlugSchema,
-	CreateOrgSchema,
-	UpdateOrgSchema,
-	ALL_ORG_PERMISSIONS,
-	DEFAULT_ORG_PERMISSIONS,
-	OWNER_ADMIN_ONLY_PERMISSIONS,
-	MEMBER_ASSIGNABLE_PERMISSIONS
-} from './schemas.js';