@selvajs/platform 0.14.3-beta.0 → 0.15.0-beta.2

package/src/organizations/interface.ts

@@ -1,68 +0,0 @@
-import type { RequestContext } from '../context.js';
-import type { ListOptions, Page } from '../pagination.js';
-import type { Organization, OrgMember } from './types.js';
-import type { OrgRole, OrgPermission } from './schemas.js';
-
-/**
- * Organizations + org members. Tenancy boundary for everything else; reads and
- * writes scope by `ctx.actingOrgId`.
- */
-export interface IOrgStore {
-	// Organizations
-	listOrgs(ctx: RequestContext, opts?: ListOptions): Promise<Page<Organization>>;
-	getOrg(ctx: RequestContext, id: string): Promise<Organization | null>;
-	getOrgBySlug(ctx: RequestContext, slug: string): Promise<Organization | null>;
-	createOrg(ctx: RequestContext, org: Organization): Promise<void>;
-	updateOrg(
-		ctx: RequestContext,
-		id: string,
-		patch: Partial<Pick<Organization, 'name' | 'slug' | 'assets'>>
-	): Promise<void>;
-	/**
-	 * Soft-delete the org. Cascades soft-delete to org members, projects in the
-	 * org, and project members. Definitions and share links cascade through the
-	 * project deletion. Invites and the org compute-server override are NOT
-	 * cascaded — clean those up explicitly if needed.
-	 */
-	deleteOrg(ctx: RequestContext, id: string): Promise<void>;
-
-	// Org members
-	listOrgMembers(ctx: RequestContext, orgId: string, opts?: ListOptions): Promise<Page<OrgMember>>;
-	getOrgMember(ctx: RequestContext, orgId: string, userId: string): Promise<OrgMember | null>;
-	/**
-	 * Find ONE org membership for the user. Used by the request-bootstrap
-	 * path to resolve `actingOrgId` without N+1-ing over `listOrgs`.
-	 *
-	 * Returns `null` when the user has no live membership. When the user has
-	 * multiple memberships (multi-tenant deployments), the choice between
-	 * them is adapter-defined — single-tenant deployments have exactly one,
-	 * and multi-tenant deployments will eventually use a URL prefix
-	 * (`/o/{slug}/...`) to pick explicitly. Soft-deleted memberships are
-	 * excluded.
-	 *
-	 * Both `org` and `member` are scoped by `ctx` (RLS-aware on Supabase).
-	 */
-	findUserMembership(
-		ctx: RequestContext,
-		userId: string
-	): Promise<{ org: Organization; member: OrgMember } | null>;
-	addOrgMember(ctx: RequestContext, member: OrgMember): Promise<void>;
-	updateOrgMemberRole(
-		ctx: RequestContext,
-		orgId: string,
-		userId: string,
-		role: OrgRole
-	): Promise<void>;
-	/**
-	 * Replace `OrgPermission` set without changing role. Use this for
-	 * permission edits — round-tripping through remove + add cascades the
-	 * org-removal soft-delete into project memberships.
-	 */
-	updateOrgMemberPermissions(
-		ctx: RequestContext,
-		orgId: string,
-		userId: string,
-		permissions: readonly OrgPermission[]
-	): Promise<void>;
-	removeOrgMember(ctx: RequestContext, orgId: string, userId: string): Promise<void>;
-}

package/src/organizations/paths.ts

@@ -1,45 +0,0 @@
-import type { OrgAssetKind } from './schemas.js';
-
-/**
- * Path-segment safety check. Blocks traversal, separators, NUL, and empty
- * segments. Allowed alphabet `[A-Za-z0-9._-]+` covers GUIDs and sanitized
- * refs. Called by every helper so a malicious `id` can't escape the
- * `orgs/` prefix. Mirrors `definitionPaths`' guard.
- */
-function assertSafeKey(value: string, label: string): void {
-	if (!value || !/^[A-Za-z0-9._-]+$/.test(value) || value === '.' || value === '..') {
-		throw new Error(`Unsafe ${label}: ${JSON.stringify(value)}`);
-	}
-}
-
-/**
- * Storage keys for org-scoped assets. Every branding asset is stored as `.webp`
- * (uploads are rasterized through the shared transcoder), so the path per kind
- * is fixed — a re-upload overwrites in place via `IStorageProvider.put`'s
- * upsert. The filename IS the kind, so the layout is generic: a new branding
- * kind needs no new helper.
- *
- * Branding lives under `orgs/{id}/branding/` because it is a *public* asset
- * class — anyone, incl. logged-out viewers, may read a company logo. The
- * `branding/` segment keeps it distinguishable from future org-private blobs
- * under `orgs/{id}/private/` (e.g. pricing sheets), which are members-only.
- * The serving route and `getPublicUrl` decide public-vs-private by classifying
- * these prefixes — see `classifyAssetPath` / `ASSET_CLASSES`.
- */
-export const orgPaths = {
-	asset: (id: string, kind: OrgAssetKind) => {
-		assertSafeKey(id, 'orgId');
-		assertSafeKey(kind, 'assetKind');
-		return `orgs/${id}/branding/${kind}.webp`;
-	},
-	/** Members-only blob under the org's private tier. `name` includes the extension. */
-	privateAsset: (id: string, name: string) => {
-		assertSafeKey(id, 'orgId');
-		assertSafeKey(name, 'assetName');
-		return `orgs/${id}/private/${name}`;
-	},
-	prefix: (id: string) => {
-		assertSafeKey(id, 'orgId');
-		return `orgs/${id}/`;
-	}
-} as const;

package/src/organizations/schemas.ts

@@ -1,61 +0,0 @@
-import { z } from 'zod';
-
-/** Lowercase alphanumeric with internal hyphens, 3–63 chars. */
-export const SlugSchema = z
-	.string()
-	.min(3, 'Slug must be at least 3 characters')
-	.max(63, 'Slug must be at most 63 characters')
-	.regex(
-		/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/,
-		'Slug must be lowercase alphanumeric with hyphens (no leading/trailing/consecutive hyphens)'
-	);
-
-export const OrgRoleSchema = z.enum(['owner', 'admin', 'member']);
-export type OrgRole = z.infer<typeof OrgRoleSchema>;
-
-/**
- * Kinds of org-scoped branding asset. Adding a new kind is a single entry here
- * — the storage path, upload route, store, and UI are all generic over it.
- */
-export const OrgAssetKindSchema = z.enum(['logo', 'favicon']);
-export type OrgAssetKind = z.infer<typeof OrgAssetKindSchema>;
-
-export const ALL_ORG_ASSET_KINDS: readonly OrgAssetKind[] = OrgAssetKindSchema.options;
-
-/** Org-scope permissions. A user may hold different sets in different orgs. */
-export const OrgPermissionSchema = z.enum([
-	'manage_org_members',
-	'manage_org_compute',
-	'manage_definitions',
-	'manage_projects'
-]);
-export type OrgPermission = z.infer<typeof OrgPermissionSchema>;
-
-export const ALL_ORG_PERMISSIONS: readonly OrgPermission[] = OrgPermissionSchema.options;
-
-/** Governance perms — never grantable to `member`. */
-export const OWNER_ADMIN_ONLY_PERMISSIONS: readonly OrgPermission[] = [
-	'manage_org_members',
-	'manage_org_compute'
-];
-
-export const MEMBER_ASSIGNABLE_PERMISSIONS: readonly OrgPermission[] = ALL_ORG_PERMISSIONS.filter(
-	(p) => !OWNER_ADMIN_ONLY_PERMISSIONS.includes(p)
-);
-
-/** Applied when adding a member without an explicit permissions list. */
-export const DEFAULT_ORG_PERMISSIONS: Record<OrgRole, readonly OrgPermission[]> = {
-	owner: [...ALL_ORG_PERMISSIONS],
-	admin: [...ALL_ORG_PERMISSIONS],
-	member: []
-};
-
-export const CreateOrgSchema = z.object({
-	name: z.string().min(1, 'Organization name is required').max(128),
-	slug: SlugSchema
-});
-
-export const UpdateOrgSchema = CreateOrgSchema.partial();
-
-export type CreateOrgInput = z.infer<typeof CreateOrgSchema>;
-export type UpdateOrgInput = z.infer<typeof UpdateOrgSchema>;

package/src/organizations/types.ts

@@ -1,41 +0,0 @@
-import type { OrgRole, OrgPermission, OrgAssetKind } from './schemas.js';
-
-/**
- * Public URLs of an org's branding assets, keyed by kind. Each value is what
- * `IStorageProvider.getPublicUrl` returned for the stored blob; a kind is
- * absent when unset. One small map so adding a new asset kind never touches
- * the `Organization` shape, the migration, or the row mappers again.
- */
-export type OrgAssets = Partial<Record<OrgAssetKind, string>>;
-
-export interface Organization {
-	id: string;
-	name: string;
-	/** URL-safe unique identifier, e.g. "acme-corp". */
-	slug: string;
-	/** Transferable; distinct from `createdBy`. */
-	ownerId: string;
-	/** Immutable even on ownership transfer. */
-	createdBy: string;
-	updatedBy: string;
-	/** Branding assets (logo, favicon, …) by kind. Blobs live under `orgPaths.asset()`. */
-	assets?: OrgAssets;
-	createdAt: string;
-	updatedAt: string;
-	deletedAt?: string | null;
-}
-
-export interface OrgMember {
-	orgId: string;
-	userId: string;
-	role: OrgRole;
-	/**
-	 * `role` is the user-facing summary; `permissions` is what adapters check.
-	 * Seeded from `DEFAULT_ORG_PERMISSIONS[role]` when not specified.
-	 */
-	permissions: OrgPermission[];
-	joinedAt: string;
-	updatedAt: string;
-	updatedBy: string;
-	deletedAt?: string | null;
-}

package/src/pagination.ts

@@ -1,45 +0,0 @@
-import type { DefinitionStatus } from './definitions/types.js';
-
-/**
- * Cursor-paginated list options. Adapters MUST provide sensible defaults
- * (limit=50, orderBy=createdAt desc) and clamp limit to a safe upper bound.
- *
- * Cursors are opaque — adapters may use row ids, offsets, or keyset
- * encodings. Callers must not inspect them.
- */
-export interface ListOptions {
-	limit?: number;
-	cursor?: string;
-	orderBy?: 'createdAt' | 'updatedAt' | 'name';
-	/** Default: 'desc'. */
-	orderDir?: 'asc' | 'desc';
-}
-
-/** Definition-specific filtering on top of `ListOptions`. */
-export interface DefinitionListOptions extends Omit<ListOptions, 'orderBy'> {
-	orderBy?: 'createdAt' | 'updatedAt' | 'name' | 'solveCount';
-	/**
-	 * Include records with `status='pending'`. Default false — consumers don't
-	 * see half-written state unless they explicitly opt in.
-	 */
-	includePending?: boolean;
-	/**
-	 * Include records with `status='archived'`. Default false — archived
-	 * definitions are hidden from normal views; opt in for archive browsers.
-	 */
-	includeArchived?: boolean;
-	/**
-	 * Filter to specific editorial statuses. Omit for the default view (all
-	 * non-pending, non-archived). Pass `['published']` for the runner home.
-	 * When set, `includePending` / `includeArchived` are ignored.
-	 */
-	statuses?: DefinitionStatus[];
-}
-
-export interface Page<T> {
-	items: T[];
-	nextCursor?: string;
-}
-
-export const DEFAULT_PAGE_LIMIT = 50;
-export const MAX_PAGE_LIMIT = 200;

package/src/permissions/index.ts

@@ -1,3 +0,0 @@
-export type { PlatformPermission } from './types.js';
-export { PlatformPermissionSchema, ALL_PLATFORM_PERMISSIONS } from './types.js';
-export type { IPlatformPermissionStore } from './interface.js';

package/src/permissions/interface.ts

@@ -1,60 +0,0 @@
-import type { UserManagementResult } from '../auth/types.js';
-import type { RequestContext } from '../context.js';
-import type { PlatformPermission } from './types.js';
-
-/**
- * Per-user platform permissions. Lives at the data layer (not on
- * `IAuthProvider`) so external IdPs don't need to model Selva-specific
- * authorization.
- *
- * **The sole-`instance_admin` invariant is enforced here.** Any operation
- * that would leave zero users holding `instance_admin` MUST return
- * `'last_admin'`. Auth providers consult `countInstanceAdminsExcluding`
- * before any destructive op so the invariant holds across edits, deletes,
- * and disables.
- *
- * Reads are scoped to "self or admin"; writes restricted to `instance_admin`.
- * Pass `SYSTEM_CONTEXT` for trusted server flows (bootstrap, hooks).
- */
-export interface IPlatformPermissionStore {
-	/**
-	 * Read permissions for a single user. Empty array for users with no
-	 * admin grants (the common case). Non-admin callers may only read self.
-	 */
-	getFor(ctx: RequestContext, userId: string): Promise<PlatformPermission[]>;
-
-	/** Batch-read for the admin user list. Admin-only. */
-	getForBatch(
-		ctx: RequestContext,
-		userIds: readonly string[]
-	): Promise<Map<string, PlatformPermission[]>>;
-
-	/**
-	 * Replace the user's permissions. Idempotent. Returns:
-	 * - `ok` — succeeded
-	 * - `not_found` — target user doesn't exist
-	 * - `last_admin` — refused; would leave zero `instance_admin` users
-	 *
-	 * `not_supported` is intentionally absent — every deployment must provide
-	 * a permission store.
-	 */
-	set(
-		ctx: RequestContext,
-		userId: string,
-		permissions: readonly PlatformPermission[]
-	): Promise<UserManagementResult>;
-
-	/**
-	 * True if at least one *enabled* user holds `instance_admin`. Used by
-	 * first-run detection and the destructive-op invariant check. Adapters
-	 * MUST exclude disabled users (over-count is safer than under-count).
-	 */
-	hasInstanceAdmin(ctx: RequestContext): Promise<boolean>;
-
-	/**
-	 * Count *other* users holding `instance_admin`. `deleteUser` / `disableUser`
-	 * call this BEFORE the destructive op — `count === 0` ⇒ `'last_admin'`.
-	 * MUST exclude disabled users.
-	 */
-	countInstanceAdminsExcluding(ctx: RequestContext, excludeUserId: string): Promise<number>;
-}

package/src/permissions/types.ts

@@ -1,21 +0,0 @@
-import { z } from 'zod';
-
-/**
- * Platform-scope permissions. Reserved for Selva-staff and instance operators;
- * regular users hold an empty array.
- *
- * - `instance_admin`        — superuser; implies every other permission.
- * - `manage_compute`        — configure the instance-wide Rhino.Compute pool.
- * - `manage_instance_users` — disable/enable any user on the instance.
- * - `manage_updates`        — run system updates.
- */
-export const PlatformPermissionSchema = z.enum([
-	'instance_admin',
-	'manage_compute',
-	'manage_instance_users',
-	'manage_updates'
-]);
-export type PlatformPermission = z.infer<typeof PlatformPermissionSchema>;
-
-export const ALL_PLATFORM_PERMISSIONS: readonly PlatformPermission[] =
-	PlatformPermissionSchema.options;

package/src/platformProjects/index.ts

@@ -1,3 +0,0 @@
-export type { PlatformProjectGrant, PlatformProjectGranteeType } from './types.js';
-export type { IPlatformProjectGrantStore } from './interface.js';
-export { PlatformProjectGrantSchema, PlatformProjectGranteeTypeSchema } from './schemas.js';

package/src/platformProjects/interface.ts

@@ -1,27 +0,0 @@
-import type { RequestContext } from '../context.js';
-import type { PlatformProjectGrant } from './types.js';
-
-/**
- * Grants for `platform`-visibility projects. Enables `instance_admin` to
- * grant orgs or individual users view-only or view+solve access without
- * creating project membership rows.
- *
- * All deletes are hard-deletes — grants have no downstream references and
- * revocation is immediate.
- */
-export interface IPlatformProjectGrantStore {
-	listByProject(ctx: RequestContext, projectId: string): Promise<PlatformProjectGrant[]>;
-	create(ctx: RequestContext, grant: PlatformProjectGrant): Promise<void>;
-	delete(ctx: RequestContext, id: string): Promise<void>;
-	/**
-	 * Cascade hook: drop every grant for a project. Called by `deleteProject`.
-	 * No-op when none exist.
-	 */
-	deleteByProject(ctx: RequestContext, projectId: string): Promise<void>;
-	/**
-	 * Cascade hook: drop every org grant whose `granteeId === orgId`. Called by
-	 * `deleteOrg`. User grants are identity-scoped and remain. No-op when none
-	 * exist.
-	 */
-	deleteByGranteeOrg(ctx: RequestContext, orgId: string): Promise<void>;
-}

package/src/platformProjects/schemas.ts

@@ -1,13 +0,0 @@
-import { z } from 'zod';
-
-export const PlatformProjectGranteeTypeSchema = z.enum(['org', 'user']);
-
-export const PlatformProjectGrantSchema = z.object({
-	id: z.string(),
-	projectId: z.string(),
-	granteeType: PlatformProjectGranteeTypeSchema,
-	granteeId: z.string(),
-	canSolve: z.boolean(),
-	createdBy: z.string(),
-	createdAt: z.string()
-});

package/src/platformProjects/types.ts

@@ -1,22 +0,0 @@
-export type PlatformProjectGranteeType = 'org' | 'user';
-
-/**
- * Grants view-only or view+solve access to a `platform`-visibility project
- * for an org or an individual user, without creating project membership rows.
- *
- * - `granteeType: 'org'`  → applies to all members of that org
- * - `granteeType: 'user'` → applies to that specific user regardless of org
- * - `canSolve: false`     → schema fetch / view only; submit-solve is blocked
- * - `canSolve: true`      → view + solve
- *
- * Grants are hard-deleted on revocation — no soft-delete.
- */
-export interface PlatformProjectGrant {
-	id: string;
-	projectId: string;
-	granteeType: PlatformProjectGranteeType;
-	granteeId: string;
-	canSolve: boolean;
-	createdBy: string;
-	createdAt: string;
-}

package/src/projects/index.ts

@@ -1,4 +0,0 @@
-export type { Project, ProjectMember } from './types.js';
-export type { IProjectStore } from './interface.js';
-export type { ProjectVisibility, ProjectRole } from './schemas.js';
-export { ProjectVisibilitySchema, ProjectRoleSchema, validateProjectFlags } from './schemas.js';

package/src/projects/interface.ts

@@ -1,58 +0,0 @@
-import type { RequestContext } from '../context.js';
-import type { ListOptions, Page } from '../pagination.js';
-import type { Project, ProjectMember } from './types.js';
-import type { ProjectRole } from './schemas.js';
-
-/**
- * Projects + project members. Soft-delete cascades to members and definitions;
- * see also the cross-store cascade hook on `IPlatformProjectGrantStore`.
- */
-export interface IProjectStore {
-	// Projects
-	listProjects(ctx: RequestContext, orgId: string, opts?: ListOptions): Promise<Page<Project>>;
-	getProject(ctx: RequestContext, id: string): Promise<Project | null>;
-	getProjectBySlug(ctx: RequestContext, orgId: string, slug: string): Promise<Project | null>;
-	createProject(ctx: RequestContext, project: Project): Promise<void>;
-	updateProject(
-		ctx: RequestContext,
-		id: string,
-		patch: Partial<
-			Pick<Project, 'name' | 'slug' | 'description' | 'visibility' | 'autoJoinOnUpload'>
-		>
-	): Promise<void>;
-	/**
-	 * Soft-delete the project. Cascades to project members and definitions.
-	 * Definition versions and share links cascade through the definition delete.
-	 */
-	deleteProject(ctx: RequestContext, id: string): Promise<void>;
-	/**
-	 * Reactivate a previously soft-deleted project identified by its org + slug.
-	 * Clears `deleted_at` and reactivates the owner's `project_members` row.
-	 * Returns the live project, or `null` if no tombstone with that slug exists.
-	 *
-	 * Use this when `createProject` fails with a duplicate-key error on a slug
-	 * that was soft-deleted — the unconditional unique constraint blocks creation
-	 * even though `getProjectBySlug` returns null for tombstones.
-	 */
-	reactivateProject(ctx: RequestContext, orgId: string, slug: string): Promise<Project | null>;
-
-	// Project members
-	listProjectMembers(
-		ctx: RequestContext,
-		projectId: string,
-		opts?: ListOptions
-	): Promise<Page<ProjectMember>>;
-	getProjectMember(
-		ctx: RequestContext,
-		projectId: string,
-		userId: string
-	): Promise<ProjectMember | null>;
-	addProjectMember(ctx: RequestContext, member: ProjectMember): Promise<void>;
-	updateProjectMemberRole(
-		ctx: RequestContext,
-		projectId: string,
-		userId: string,
-		role: ProjectRole
-	): Promise<void>;
-	removeProjectMember(ctx: RequestContext, projectId: string, userId: string): Promise<void>;
-}

package/src/projects/schemas.ts

@@ -1,28 +0,0 @@
-import { z } from 'zod';
-
-export const ProjectVisibilitySchema = z.enum(['public', 'org', 'private', 'platform']);
-export type ProjectVisibility = z.infer<typeof ProjectVisibilitySchema>;
-
-export const ProjectRoleSchema = z.enum(['owner', 'editor', 'viewer']);
-export type ProjectRole = z.infer<typeof ProjectRoleSchema>;
-
-/** Cross-field check for PATCH flows. Call on the merged post-patch shape. */
-export function validateProjectFlags(merged: {
-	visibility: ProjectVisibility;
-	autoJoinOnUpload?: boolean;
-}): { path: string; message: string }[] {
-	const issues: { path: string; message: string }[] = [];
-	if (merged.autoJoinOnUpload && merged.visibility !== 'public') {
-		issues.push({
-			path: 'autoJoinOnUpload',
-			message: 'autoJoinOnUpload requires visibility=public'
-		});
-	}
-	if (merged.visibility === 'platform' && merged.autoJoinOnUpload) {
-		issues.push({
-			path: 'autoJoinOnUpload',
-			message: 'autoJoinOnUpload is not allowed on platform projects'
-		});
-	}
-	return issues;
-}

package/src/projects/types.ts

@@ -1,36 +0,0 @@
-import type { ProjectRole, ProjectVisibility } from './schemas.js';
-
-/**
- * Visibility:
- * - `public`   — any authenticated user can view/solve (cross-org gated by `ALLOW_CROSS_ORG_PUBLIC`)
- * - `org`      — any member of the parent organization
- * - `private`  — only listed `ProjectMember`s
- * - `platform` — instance-admin-managed; access via `IPlatformProjectGrantStore`
- */
-export interface Project {
-	id: string;
-	orgId: string;
-	name: string;
-	slug: string;
-	description?: string;
-	visibility: ProjectVisibility;
-	/** Transferable; distinct from `createdBy`. */
-	ownerId: string;
-	createdBy: string;
-	updatedBy: string;
-	/** Commons mode — only valid when `visibility='public'`. */
-	autoJoinOnUpload: boolean;
-	createdAt: string;
-	updatedAt: string;
-	deletedAt?: string | null;
-}
-
-export interface ProjectMember {
-	projectId: string;
-	userId: string;
-	role: ProjectRole;
-	joinedAt: string;
-	updatedAt: string;
-	updatedBy: string;
-	deletedAt?: string | null;
-}

package/src/shareLinks/index.ts

@@ -1,5 +0,0 @@
-export type { ShareLink } from './types.js';
-export type { IShareLinkStore } from './interface.js';
-export { DEFAULT_SHARE_LINK_MAX_SOLVES } from './types.js';
-export type { CreateShareLinkInput } from './schemas.js';
-export { CreateShareLinkInputSchema } from './schemas.js';

package/src/shareLinks/interface.ts

@@ -1,35 +0,0 @@
-import type { RequestContext } from '../context.js';
-import type { ListOptions, Page } from '../pagination.js';
-import type { ShareLink } from './types.js';
-
-/**
- * Per-definition tokens granting unauthenticated access to one
- * (definitionId, channel). The store sees only the HMAC hash; the raw token
- * is generated and shown to the minter at the route layer.
- *
- * Reads filter `revokedAt IS NULL` defensively.
- */
-export interface IShareLinkStore {
-	/** Insert a new link. Caller has already hashed the raw token. */
-	create(ctx: RequestContext, link: ShareLink): Promise<void>;
-	/** Newest first by `createdAt`. Excludes revoked links. */
-	listByDefinition(
-		ctx: RequestContext,
-		definitionId: string,
-		opts?: ListOptions
-	): Promise<Page<ShareLink>>;
-	getById(ctx: RequestContext, id: string): Promise<ShareLink | null>;
-	/**
-	 * Lookup by HMAC hash. Returns null when the link doesn't exist OR is
-	 * revoked OR its parent definition is soft-deleted.
-	 */
-	getByTokenHash(ctx: RequestContext, tokenHash: string): Promise<ShareLink | null>;
-	/** Soft-delete (set `revokedAt`). Idempotent. */
-	revoke(ctx: RequestContext, id: string): Promise<void>;
-	/**
-	 * Atomic check-and-increment. Returns the new `solveCount`, or null when
-	 * the cap was reached. MUST be a single statement — read-then-write races
-	 * under load. `null` maxSolves means uncapped.
-	 */
-	tryIncrementSolveCount(ctx: RequestContext, id: string): Promise<number | null>;
-}

package/src/shareLinks/schemas.ts

@@ -1,21 +0,0 @@
-import { z } from 'zod';
-import { DefinitionChannelSchema } from '../definitions/schemas.js';
-
-/**
- * HTTP body for `POST /api/definitions/[guid]/share-links`. The route returns
- * the raw token exactly once.
- */
-export const CreateShareLinkInputSchema = z.object({
-	channel: DefinitionChannelSchema.default('live'),
-	name: z.string().max(128).optional(),
-	allowSolve: z.boolean().default(true),
-	/**
-	 * Null explicitly removes the cap. Omitted = apply default — null is the
-	 * minter's deliberate "uncap" choice.
-	 */
-	maxSolves: z.number().int().min(1).nullable().optional(),
-	/** Optional ISO timestamp. Resolution compares to `now()`. */
-	expiresAt: z.iso.datetime().nullable().optional()
-});
-
-export type CreateShareLinkInput = z.infer<typeof CreateShareLinkInputSchema>;

package/src/shareLinks/types.ts

@@ -1,34 +0,0 @@
-import type { DefinitionChannel } from '../definitions/types.js';
-
-/**
- * Per-definition token granting access to one (definitionId, channel)
- * without an account. The raw token is HMAC-hashed at rest; `tokenHash` is
- * the stored value. The plaintext token is shown to the minter exactly once.
- */
-export interface ShareLink {
-	id: string;
-	definitionId: string;
-	channel: DefinitionChannel;
-	/** HMAC of the raw token. Lookup hashes the supplied token, then matches. */
-	tokenHash: string;
-	/** Optional UX label, e.g. "Demo for Acme". */
-	name?: string;
-	createdBy: string;
-	createdAt: string;
-	/** Null = never expires. */
-	expiresAt?: string | null;
-	/** Non-null = revoked. Resolution checks IS NULL. */
-	revokedAt?: string | null;
-	/** false = view/schema only; true = solve allowed. */
-	allowSolve: boolean;
-	/** Per-link cap. Null = unlimited. */
-	maxSolves?: number | null;
-	solveCount: number;
-}
-
-/**
- * Default cap applied when the minter doesn't specify one. Tokens are
- * leak-prone by design (visible in iframes), so a default bounds the
- * worst-case denial-of-wallet damage.
- */
-export const DEFAULT_SHARE_LINK_MAX_SOLVES = 1000;