@selvajs/platform 0.16.1-beta.2 → 0.17.0

package/dist/auth/interface.d.ts

@@ -7,13 +7,13 @@ import type { ListOptions, Page } from '../pagination.js';
  */
 export interface IPasswordAuth {
     /**
-     * Verify credentials. Discriminated union — callers MUST `switch (result.kind)`,
-     * never treat truthiness as authenticated.
+     * Verify credentials. Returns a discriminated union — callers must
+     * `switch (result.kind)`, never treat truthiness as authenticated.
      */
     verifyLogin(email: string, password: string): Promise<LoginResult>;
     /**
-     * Admin-initiated user creation. Pure identity — callers grant platform
-     * permissions separately via `IPlatformPermissionStore.set`.
+     * Admin-initiated user creation. Grant platform permissions separately
+     * via `IPlatformPermissionStore.set`.
      */
     createUserWithPassword(email: string, password: string): Promise<AuthUser>;
     /** Self-service registration. Return null when self-registration is disabled. */
@@ -21,47 +21,43 @@ export interface IPasswordAuth {
 }
 /**
  * Optional OAuth surface. Implemented by providers that broker OAuth flows
- * (Supabase Auth, future Eterna/Auth0/etc.). Local credential-only providers
+ * (Supabase Auth, future Eterna/Auth0/etc.); local credential-only providers
  * leave `IAuthProvider.oauth` undefined.
  *
- * Lifecycle is the standard authorization-code flow:
+ * Standard authorization-code flow:
  *
  *   1. Browser hits `/auth/{provider}/start?provider=google` → server calls
  *      `getOAuthAuthorizationUrl` and 303s to the result.
- *   2. IdP redirects back to `/auth/{provider}/callback?code=...` →
- *      server calls `exchangeOAuthCode` to mint the session pair.
- *   3. When the access token expires, the session-refresh middleware in
- *      `hooks.server.ts` calls `refreshSession` with the stored refresh
- *      token to swap for a fresh pair without bouncing the user.
+ *   2. IdP redirects back to `/auth/{provider}/callback?code=...` → server
+ *      calls `exchangeOAuthCode` to mint the session pair.
+ *   3. When the access token expires, session-refresh middleware in
+ *      `hooks.server.ts` calls `refreshSession` to swap in a fresh pair
+ *      without bouncing the user.
  *
- * Each method returns `null` (rather than throwing) on irrecoverable
- * credential failures — the route layer translates `null` into the right
- * HTTP shape (401 for refresh, login redirect for callback).
+ * Each method returns `null` rather than throwing on irrecoverable
+ * credential failures, so the route layer can pick the right HTTP shape
+ * (401 for refresh, login redirect for callback).
  */
 export interface IOAuthAuth {
     /**
-     * The OAuth providers this adapter is configured to broker. Returned as
-     * lowercased identifiers ("google", "github", …) — the adapter reads its
-     * own configuration source (env var, dashboard, hard-coded list) and
-     * decides what's available. Empty array when none are wired.
+     * OAuth providers this adapter is configured to broker, as lowercased
+     * identifiers ("google", "github", …). Empty array when none are wired.
      *
-     * Driving adapters (HTTP routes, UI) call this instead of reading
-     * provider-specific env vars directly — keeps the provider name out of
-     * `selva`.
+     * Route/UI code calls this instead of reading provider-specific env vars
+     * directly, keeping provider config out of `selva`.
      */
     listProviders(): readonly string[];
     /**
-     * Build the IdP authorization URL the browser should be redirected to.
-     * `redirectTo` is the full callback URL — must be the route that handles
-     * the `?code=...` exchange. Provider-name validation is the caller's job;
-     * passing an unconfigured provider may surface as an upstream error.
+     * Build the IdP authorization URL to redirect the browser to. `redirectTo`
+     * must be the route that handles the `?code=...` exchange. Provider-name
+     * validation is the caller's job — an unconfigured provider may surface
+     * as an upstream error.
      */
     getOAuthAuthorizationUrl(provider: 'google' | 'github' | 'azure' | 'gitlab', redirectTo: string): Promise<string>;
     /**
-     * Exchange an authorization code for a session. Returns the resolved
-     * identity and an access/refresh token pair. `null` when the code is
-     * invalid, expired, or already redeemed — callers MUST treat null as
-     * "send the user back to /login".
+     * Exchange an authorization code for a session: the resolved identity plus
+     * an access/refresh token pair, or `null` if the code is invalid, expired,
+     * or already redeemed. Callers must treat null as "send back to /login".
      */
     exchangeOAuthCode(code: string): Promise<{
         user: AuthUser;
@@ -75,8 +71,8 @@ export interface IOAuthAuth {
      * clearing the refresh cookie.
      *
      * @deprecated Session refresh is session lifecycle, not OAuth — a consumer
-     * that brokers no OAuth still needs it (to refresh a password session, or
-     * to revoke on logout). Moved to `IAuthProvider.sessionRefresh`
+     * that brokers no OAuth still needs it (refreshing a password session, or
+     * revoking on logout). Moved to `IAuthProvider.sessionRefresh`
      * (`ISessionRefresh`). This member delegates for one release and will be
      * removed in the next minor; migrate callers to
      * `auth.sessionRefresh?.refreshSession(...)`.
@@ -87,16 +83,14 @@ export interface IOAuthAuth {
     } | null>;
 }
 /**
- * Optional session-lifecycle surface: refresh an expiring session, and revoke
- * one server-side. Deliberately NOT part of `IOAuthAuth` — refresh and revoke
- * are properties of a *session*, regardless of how that session was minted.
- * A deployment that brokers no OAuth (`oauth.listProviders()` → `[]`) still
- * needs to revoke on logout, and would otherwise have to reach into an OAuth
- * capability whose stated precondition it does not meet.
+ * Optional session-lifecycle surface: refresh an expiring session, revoke one
+ * server-side. Deliberately not part of `IOAuthAuth` — refresh and revoke are
+ * properties of a *session*, regardless of how it was minted. A deployment
+ * that brokers no OAuth still needs to revoke on logout.
  *
- * Undefined for providers that cannot invalidate a session server-side (the
- * local HMAC provider mints stateless tokens; there is nothing to revoke).
- * Callers MUST treat absence as "cookie deletion is all we can do".
+ * Undefined for providers that can't invalidate a session server-side (the
+ * local HMAC provider mints stateless tokens — nothing to revoke). Callers
+ * must treat absence as "cookie deletion is all we can do".
  */
 export interface ISessionRefresh {
     /**
@@ -110,30 +104,30 @@ export interface ISessionRefresh {
         refreshToken: string;
     } | null>;
     /**
-     * Invalidate a session server-side so the token stops being accepted
+     * Invalidate a session server-side so its token stops being accepted
      * before it would naturally expire. Called on logout.
      *
-     * `token` is the session's access token (the value the driving layer holds
-     * in its session cookie). Adapters that revoke by refresh token instead
-     * accept either — the contract is "the credential the caller has".
+     * `token` is the session's access token (what the driving layer holds in
+     * its session cookie). Adapters that revoke by refresh token accept
+     * either — the contract is "the credential the caller has".
      *
      * Best-effort and idempotent: revoking an already-revoked, expired, or
-     * unknown token returns `true`, because the desired end state (that token
+     * unknown token returns `true`, since the desired end state (that token
      * grants nothing) holds either way. Returns `false` only when the provider
-     * could not carry out the revocation and the token may still be live —
-     * callers SHOULD still clear the cookie, but MAY log the failure. Never
-     * throws: a failed revoke MUST NOT prevent a user from logging out.
+     * couldn't carry out the revocation and the token may still be live —
+     * callers should still clear the cookie but may log the failure. Never
+     * throws: a failed revoke must not block logout.
      */
     revokeSession(token: string): Promise<boolean>;
 }
 /**
  * Optional passwordless email surface — "type your email, click the link in
  * your inbox, you're in." Implemented by providers that broker email delivery
- * + token verification (Supabase Auth, future Eterna ID, …). Adapters that
+ * and token verification (Supabase Auth, future Eterna ID, …). Adapters that
  * can't send mail or don't model this flow leave `IAuthProvider.emailLink`
  * undefined.
  *
- * Lifecycle is two phases mirroring OAuth's start/callback split:
+ * Two phases, mirroring OAuth's start/callback split:
  *
  *   1. User submits an email → server calls `sendMagicLink(email,
  *      callbackUrl)`. The adapter delivers a link to that callback URL with
@@ -142,20 +136,19 @@ export interface ISessionRefresh {
  *   2. User clicks the link, browser hits the callback route → server calls
  *      `verifyMagicLink(rawTokenFromUrl)` to mint a session.
  *
- * The driving adapter never inspects the token itself — it forwards the raw
- * URL string. Adapter-specific token shapes stay inside the adapter.
+ * The route layer never inspects the token — it just forwards the raw URL
+ * string. Adapter-specific token shapes stay inside the adapter.
  */
 export interface IEmailLinkAuth {
     /**
-     * Send a magic-link email. `callbackUrl` is the absolute URL the
-     * adapter should embed in the link — must point at the route that
-     * handles `verifyMagicLink`.
+     * Send a magic-link email. `callbackUrl` is the absolute URL the adapter
+     * embeds in the link — must point at the route that handles
+     * `verifyMagicLink`.
      *
-     * Returns `{ ok: true }` on success. On adapter-classified failures
-     * (rate limit, signup disabled, invalid email) returns
-     * `{ ok: false, reason }` so the route can render a user-friendly
-     * message without exposing provider internals. Network/unknown errors
-     * still throw.
+     * Returns `{ ok: false, reason }` for adapter-classified failures (rate
+     * limit, signup disabled, invalid email) so the route can render a
+     * user-friendly message without exposing provider internals. Network or
+     * unknown errors still throw.
      */
     sendMagicLink(email: string, callbackUrl: string): Promise<{
         ok: true;
@@ -164,12 +157,12 @@ export interface IEmailLinkAuth {
         reason: 'rate_limited' | 'signup_disabled' | 'invalid_email';
     }>;
     /**
-     * Verify the token the IdP sent the user. `rawCallbackUrl` is the full
-     * URL the user landed on (or an opaque adapter-specific token string —
+     * Verify the token the IdP sent the user. `rawCallbackUrl` is the full URL
+     * the user landed on (or an opaque adapter-specific token string —
      * adapters document which); the adapter pulls whatever fields it needs.
      *
-     * Returns `null` for invalid/expired/already-redeemed tokens — callers
-     * MUST treat null as "send the user back to /login". `refreshToken` is
+     * Returns `null` for invalid, expired, or already-redeemed tokens —
+     * callers must treat null as "send back to /login". `refreshToken` is
      * present only for adapters that issue refresh tokens for email-link
      * sessions (Supabase does); omit otherwise.
      */
@@ -182,59 +175,52 @@ export interface IEmailLinkAuth {
 /**
  * Optional forward-proxy authentication surface. Implemented by providers
  * that derive identity from signals injected by a trusted upstream reverse
- * proxy (HTTP headers, mTLS, etc.) — e.g. Caddy `forward_auth`,
- * oauth2-proxy, Authelia, Pomerium, Traefik forward-auth.
+ * proxy (HTTP headers, mTLS, etc.) — e.g. Caddy `forward_auth`, oauth2-proxy,
+ * Authelia, Pomerium, Traefik forward-auth.
  *
- * ⚠ TRUST BOUNDARY — READ BEFORE IMPLEMENTING ⚠
+ * TRUST BOUNDARY — READ BEFORE IMPLEMENTING
  *
  * The signals this surface consumes are NOT verified cryptographically by
- * Selva. They are trusted because the deployment runs the app behind a
+ * Selva. They're trusted only because the deployment runs the app behind a
  * proxy that:
  *
  *   1. Authenticates the user against an upstream IdP, AND
- *   2. STRIPS any client-supplied copies of the trusted headers from
+ *   2. Strips any client-supplied copies of the trusted headers from
  *      inbound requests before adding its own, AND
- *   3. Is the ONLY network path that can reach the app process (bind to
- *      127.0.0.1, firewall the app port, or a private socket).
+ *   3. Is the only network path that can reach the app process (bind to
+ *      127.0.0.1, firewall the app port, or use a private socket).
  *
  * If any condition fails, an attacker can spoof the headers and become
- * anyone. **Each implementer of this interface MUST ship a README that
- * states, loudly, the exact proxy configuration required.** The platform
- * layer cannot verify this — it is the provider's contract with its
- * operator.
+ * anyone. Each implementer of this interface MUST ship a README stating the
+ * exact proxy configuration required — the platform layer can't verify this;
+ * it's the provider's contract with its operator.
  *
- * Lifecycle: `identifyFromHeaders` is called from `hooks.server.ts` on
- * every authed request whose session cookie is missing or invalid. It MUST
- * be cheap — a header read plus at most one indexed lookup. No network
- * calls, no synchronous disk scans of unbounded size.
+ * `identifyFromHeaders` is called from `hooks.server.ts` on every authed
+ * request whose session cookie is missing or invalid. It must be cheap — a
+ * header read plus at most one indexed lookup, no network calls, no
+ * unbounded disk scans.
  */
 export interface IProxyAuth {
     /**
-     * Identify the caller from trusted upstream-proxy signals on the
-     * incoming request. Return `null` for "not identified" (header missing,
-     * UPN not allowlisted, account disabled). MUST NOT throw for absent
-     * headers — those are the normal anonymous case.
+     * Identify the caller from trusted upstream-proxy signals on the incoming
+     * request. Returns `null` for "not identified" (header missing, UPN not
+     * allowlisted, account disabled) — must not throw for absent headers,
+     * since that's the normal anonymous case.
      *
      * On first identification of a previously-allowlisted user, the
-     * implementation MAY materialize stored fields (display name, email)
-     * from the same headers. Auto-creating arbitrary users from headers
-     * is forbidden: the allowlist IS the security boundary.
+     * implementation may materialize stored fields (display name, email) from
+     * the same headers. Auto-creating arbitrary users from headers is
+     * forbidden: the allowlist is the security boundary.
      */
     identifyFromHeaders(headers: Headers): Promise<AuthUser | null>;
     /**
-     * Diagnostic helper. Returns true iff none of the identity headers this
-     * provider trusts arrived on the request. The hook layer uses this on
-     * `/login` misses to distinguish "proxy never reached us" from "proxy is
-     * here but didn't recognise the user" so operators can tell silent
-     * forward-auth misconfigurations apart from real allowlist gaps without
-     * leaking the trusted header names to end users.
+     * True iff none of the identity headers this provider trusts arrived on
+     * the request. The hook layer uses this on `/login` misses to tell
+     * "proxy never reached us" apart from "proxy is here but didn't recognise
+     * the user", without leaking the trusted header names to end users.
      */
     hasNoIdentityHeaders(headers: Headers): boolean;
-    /**
-     * Diagnostic helper. Returns the identity-header names this provider is
-     * configured to read. Used purely for log output — never surfaced to end
-     * users.
-     */
+    /** Identity-header names this provider reads. Log output only, never surfaced to end users. */
     readonly configuredHeaderNames: readonly string[];
 }
 /**
@@ -242,8 +228,8 @@ export interface IProxyAuth {
  * in `IUserProfileStore`, platform permissions in `IPlatformPermissionStore`,
  * password ops in optional `passwordAuth`, OAuth in optional `oauth`.
  *
- * Methods here do NOT take a `RequestContext` — the provider produces the
- * identity used to *build* the context.
+ * Methods here don't take a `RequestContext` — the provider produces the
+ * identity used to build the context, not the other way around.
  */
 export interface IAuthProvider {
     /** Display name shown in admin UI (e.g. "Local", "Microsoft Entra ID"). */
@@ -265,38 +251,35 @@ export interface IAuthProvider {
     readonly emailLink?: IEmailLinkAuth;
     /**
      * Present for providers that derive identity from a trusted upstream
-     * proxy (forward-auth headers, mTLS, etc.). Undefined for credential
-     * or OIDC-broker providers. See `IProxyAuth` for the trust contract.
+     * proxy (forward-auth headers, mTLS, etc.). Undefined for credential or
+     * OIDC-broker providers. See `IProxyAuth` for the trust contract.
      *
-     * When set, the platform treats sign-out as the proxy/IdP's job and
-     * does not render a logout button — Selva has no session to destroy.
+     * When set, the platform treats sign-out as the proxy/IdP's job and skips
+     * the logout button — Selva has no session to destroy.
      */
     readonly proxyAuth?: IProxyAuth;
-    /**
-     * Verify a token (session cookie, JWT, ID token, etc.). Returns the user
-     * or null when invalid/expired.
-     */
+    /** Verify a token (session cookie, JWT, ID token, etc.); null if invalid or expired. */
     verifyToken(token: string): Promise<AuthUser | null>;
     getUser(id: string): Promise<AuthUser | null>;
     /** Returns null if the provider does not support user management. */
     listUsers(opts?: ListOptions): Promise<Page<AuthUser> | null>;
     /**
-     * Optional: allowlist a user without a password (OAuth providers). Pure
-     * identity — callers grant permissions via `IPlatformPermissionStore.set`.
+     * Allowlist a user without a password (OAuth providers). Callers grant
+     * permissions via `IPlatformPermissionStore.set`.
      */
     createUser?(email: string): Promise<AuthUser>;
     /**
-     * Delete a user identity. The sole-`instance_admin` invariant is NOT
-     * enforced here — callers MUST consult
+     * Delete a user identity. Callers must consult
      * `IPlatformPermissionStore.countInstanceAdminsExcluding(id)` first and
-     * surface `'last_admin'` themselves.
+     * surface `'last_admin'` themselves — the sole-`instance_admin` invariant
+     * isn't enforced here.
      */
     deleteUser(id: string): Promise<UserManagementResult>;
     /**
-     * Disable a user. Identity is preserved (preferred over deletion). Same
+     * Disable a user, preserving identity (preferred over deletion). Same
      * invariant rules as `deleteUser`.
      *
-     * Existing sessions are NOT guaranteed to stop working the instant this
+     * Existing sessions aren't guaranteed to stop working the instant this
      * returns — adapters that verify tokens locally may keep accepting an
      * already-issued access token until their next revalidation (the Supabase
      * adapter bounds this by `revalidateMs`, default 60s). Callers needing
@@ -304,8 +287,8 @@ export interface IAuthProvider {
      */
     disableUser(id: string): Promise<UserManagementResult>;
     /**
-     * Stamp `lastLoginAt`. Best-effort — failure MUST NOT block auth.
-     * Adapters MAY debounce (e.g. skip if existing timestamp < 60s old).
+     * Stamp `lastLoginAt`. Best-effort — failure must not block auth. Adapters
+     * may debounce (e.g. skip if the existing timestamp is under 60s old).
      */
     touchLastLogin?(id: string): Promise<void>;
 }

package/dist/auth/interface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"interface.d.ts","sourceRoot":"","sources":["../../src/auth/interface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAC9E,OAAO,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAE1D;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC7B;;;OAGG;IACH,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAEnE;;;OAGG;IACH,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAE3E,iFAAiF;IACjF,YAAY,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;CACzE;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,UAAU;IAC1B;;;;;;;;;OASG;IACH,aAAa,IAAI,SAAS,MAAM,EAAE,CAAC;IAEnC;;;;;OAKG;IACH,wBAAwB,CACvB,QAAQ,EAAE,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,QAAQ,EAClD,UAAU,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB;;;;;OAKG;IACH,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QACxC,IAAI,EAAE,QAAQ,CAAC;QACf,YAAY,EAAE,MAAM,CAAC;QACrB,YAAY,EAAE,MAAM,CAAC;KACrB,GAAG,IAAI,CAAC,CAAC;IAEV;;;;;;;;;;;;OAYG;IACH,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;QAC7C,YAAY,EAAE,MAAM,CAAC;QACrB,YAAY,EAAE,MAAM,CAAC;KACrB,GAAG,IAAI,CAAC,CAAC;CACV;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,eAAe;IAC/B;;;;;OAKG;IACH,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;QAC7C,YAAY,EAAE,MAAM,CAAC;QACrB,YAAY,EAAE,MAAM,CAAC;KACrB,GAAG,IAAI,CAAC,CAAC;IAEV;;;;;;;;;;;;;;OAcG;IACH,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC/C;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,cAAc;IAC9B;;;;;;;;;;OAUG;IACH,aAAa,CACZ,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,GACjB,OAAO,CACT;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,cAAc,GAAG,iBAAiB,GAAG,eAAe,CAAA;KAAE,CAC1F,CAAC;IAEF;;;;;;;;;OASG;IACH,eAAe,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC;QAChD,IAAI,EAAE,QAAQ,CAAC;QACf,YAAY,EAAE,MAAM,CAAC;QACrB,YAAY,CAAC,EAAE,MAAM,CAAC;KACtB,GAAG,IAAI,CAAC,CAAC;CACV;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,WAAW,UAAU;IAC1B;;;;;;;;;;OAUG;IACH,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAEhE;;;;;;;OAOG;IACH,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC;IAEhD;;;;OAIG;IACH,QAAQ,CAAC,qBAAqB,EAAE,SAAS,MAAM,EAAE,CAAC;CAClD;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC7B,2EAA2E;IAC3E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,wEAAwE;IACxE,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC;IAEtC,0EAA0E;IAC1E,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC;IAE5B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,eAAe,CAAC;IAE1C;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,cAAc,CAAC;IAEpC;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC;IAEhC;;;OAGG;IACH,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAErD,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAE9C,qEAAqE;IACrE,SAAS,CAAC,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC;IAE9D;;;OAGG;IACH,UAAU,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAE9C;;;;;OAKG;IACH,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAEtD;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAEvD;;;OAGG;IACH,cAAc,CAAC,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3C"}
+{"version":3,"file":"interface.d.ts","sourceRoot":"","sources":["../../src/auth/interface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAC9E,OAAO,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAE1D;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC7B;;;OAGG;IACH,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAEnE;;;OAGG;IACH,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAE3E,iFAAiF;IACjF,YAAY,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;CACzE;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,UAAU;IAC1B;;;;;;OAMG;IACH,aAAa,IAAI,SAAS,MAAM,EAAE,CAAC;IAEnC;;;;;OAKG;IACH,wBAAwB,CACvB,QAAQ,EAAE,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,QAAQ,EAClD,UAAU,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB;;;;OAIG;IACH,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QACxC,IAAI,EAAE,QAAQ,CAAC;QACf,YAAY,EAAE,MAAM,CAAC;QACrB,YAAY,EAAE,MAAM,CAAC;KACrB,GAAG,IAAI,CAAC,CAAC;IAEV;;;;;;;;;;;;OAYG;IACH,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;QAC7C,YAAY,EAAE,MAAM,CAAC;QACrB,YAAY,EAAE,MAAM,CAAC;KACrB,GAAG,IAAI,CAAC,CAAC;CACV;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,eAAe;IAC/B;;;;;OAKG;IACH,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;QAC7C,YAAY,EAAE,MAAM,CAAC;QACrB,YAAY,EAAE,MAAM,CAAC;KACrB,GAAG,IAAI,CAAC,CAAC;IAEV;;;;;;;;;;;;;;OAcG;IACH,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC/C;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,cAAc;IAC9B;;;;;;;;;OASG;IACH,aAAa,CACZ,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,GACjB,OAAO,CACT;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,cAAc,GAAG,iBAAiB,GAAG,eAAe,CAAA;KAAE,CAC1F,CAAC;IAEF;;;;;;;;;OASG;IACH,eAAe,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC;QAChD,IAAI,EAAE,QAAQ,CAAC;QACf,YAAY,EAAE,MAAM,CAAC;QACrB,YAAY,CAAC,EAAE,MAAM,CAAC;KACtB,GAAG,IAAI,CAAC,CAAC;CACV;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,WAAW,UAAU;IAC1B;;;;;;;;;;OAUG;IACH,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAEhE;;;;;OAKG;IACH,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC;IAEhD,+FAA+F;IAC/F,QAAQ,CAAC,qBAAqB,EAAE,SAAS,MAAM,EAAE,CAAC;CAClD;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC7B,2EAA2E;IAC3E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,wEAAwE;IACxE,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC;IAEtC,0EAA0E;IAC1E,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC;IAE5B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,eAAe,CAAC;IAE1C;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,cAAc,CAAC;IAEpC;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC;IAEhC,wFAAwF;IACxF,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAErD,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAE9C,qEAAqE;IACrE,SAAS,CAAC,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC;IAE9D;;;OAGG;IACH,UAAU,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAE9C;;;;;OAKG;IACH,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAEtD;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAEvD;;;OAGG;IACH,cAAc,CAAC,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3C"}

package/dist/auth/types.d.ts

@@ -21,10 +21,7 @@ export interface AuthUser {
  * - `last_admin`    — refused; would leave zero `instance_admin` users
  */
 export type UserManagementResult = 'ok' | 'not_found' | 'not_supported' | 'last_admin';
-/**
- * - `success` — credentials valid; includes session token the provider minted.
- * - `failed` — credentials invalid, user disabled, or rate-limited.
- */
+/** `success` includes the session token the provider minted. */
 export type LoginResult = {
     kind: 'success';
     user: AuthUser;

package/dist/auth/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,WAAW,QAAQ;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oDAAoD;IACpD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kFAAkF;IAClF,QAAQ,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;;;;GAKG;AACH,MAAM,MAAM,oBAAoB,GAAG,IAAI,GAAG,WAAW,GAAG,eAAe,GAAG,YAAY,CAAC;AAEvF;;;GAGG;AACH,MAAM,MAAM,WAAW,GACpB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,CAAC,EAAE,qBAAqB,GAAG,UAAU,GAAG,cAAc,CAAA;CAAE,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,WAAW,QAAQ;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oDAAoD;IACpD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kFAAkF;IAClF,QAAQ,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;;;;GAKG;AACH,MAAM,MAAM,oBAAoB,GAAG,IAAI,GAAG,WAAW,GAAG,eAAe,GAAG,YAAY,CAAC;AAEvF,gEAAgE;AAChE,MAAM,MAAM,WAAW,GACpB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,CAAC,EAAE,qBAAqB,GAAG,UAAU,GAAG,cAAc,CAAA;CAAE,CAAC"}

package/dist/bindings/interface.d.ts

@@ -3,49 +3,36 @@
  * in the schema. The host (selva app or a fork) supplies an implementation;
  * the platform stays domain-agnostic.
  *
- * Keys are opaque strings. The host defines the namespace
- * (e.g. 'capture.geometry', 'parcel.boundary') and the resolver interprets it
- * however it likes — typically as an address into the host's own domain store.
- *
- * Status: preliminary. The interface is expected to refine once we wire a
- * real binding end-to-end (see docs/upstream-binding-prep PR plan). Current
- * shape is the minimum needed to slot a host implementation behind
- * `SelvaConfig.bindingResolver`.
+ * Keys are opaque strings namespaced by the host (e.g. 'capture.geometry',
+ * 'parcel.boundary') and interpreted however it likes — typically as an
+ * address into the host's own domain store.
  */
 import type { RequestContext } from '../context.js';
 export interface IBindingResolver {
     /**
-     * Resolve a batch of bound keys in one call.
-     *
-     *   - `keys` is what the schema author wrote (`source.key`) — opaque to the
-     *     platform, interpreted by the resolver. The author writes keys at
-     *     design time, so the key should describe WHAT attribute to read, not
-     *     WHICH entity to read it from.
-     *   - `scope` is set by the calling route at solve time — opaque to the
-     *     platform, supplies the "which entity" anchor that varies per
-     *     request (capture id, parcel id, custom struct). Optional because
-     *     not every host needs it.
+     * Resolves a batch of bound keys in one call.
      *
-     * Implementations should return ONLY the keys they successfully
-     * resolved — absent entries in the returned map signal "missing" to the
-     * caller, who then decides what to do (e.g. error the solve, or fall back
-     * to the input's `default`).
+     * `keys` is what the schema author wrote (`source.key`) — describes WHAT
+     * attribute to read, not WHICH entity. `scope` is set by the calling
+     * route at solve time and supplies the "which entity" anchor that varies
+     * per request (capture id, parcel id, custom struct); optional because
+     * not every host needs it.
      *
-     * Do not throw for individual missing keys. Throw only for resolver-wide
-     * failures (DB unreachable, configuration error). Per-key "not found" is
-     * normal and is signalled by omitting the entry.
+     * Return only the keys that resolved successfully — an absent entry
+     * signals "missing" to the caller, which then errors the solve or falls
+     * back to the input's `default`. Throw only for resolver-wide failures
+     * (DB unreachable, configuration error); a missing individual key is not
+     * an error condition.
      *
-     * Batching is intentional: a single solve often binds multiple inputs
-     * from one domain object, and the resolver should be able to do that
-     * with a single DB round-trip.
+     * Batched because a single solve often binds multiple inputs from one
+     * domain object, and the resolver should do that in one DB round-trip.
      */
     resolve(ctx: RequestContext, keys: readonly string[], scope?: unknown): Promise<Map<string, unknown>>;
 }
 /**
- * Default resolver used when the host hasn't configured one. Returns an
- * empty map for any request, which makes every bound input fail at solve
- * time — a loud signal that a resolver needs to be wired up. Drop-in replace
- * via `SelvaConfig.bindingResolver` once the host has a real implementation.
+ * Default resolver for when the host hasn't configured one. Returns an
+ * empty map for any request, so every bound input fails at solve time —
+ * a loud signal that a resolver needs wiring up.
  */
 export declare class NoopBindingResolver implements IBindingResolver {
     resolve(): Promise<Map<string, unknown>>;

package/dist/bindings/interface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"interface.d.ts","sourceRoot":"","sources":["../../src/bindings/interface.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,MAAM,WAAW,gBAAgB;IAChC;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,OAAO,CACN,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,KAAK,CAAC,EAAE,OAAO,GACb,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACjC;AAED;;;;;GAKG;AACH,qBAAa,mBAAoB,YAAW,gBAAgB;IACrD,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAG9C"}
+{"version":3,"file":"interface.d.ts","sourceRoot":"","sources":["../../src/bindings/interface.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,MAAM,WAAW,gBAAgB;IAChC;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CACN,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,KAAK,CAAC,EAAE,OAAO,GACb,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACjC;AAED;;;;GAIG;AACH,qBAAa,mBAAoB,YAAW,gBAAgB;IACrD,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAG9C"}

package/dist/bindings/interface.js

@@ -3,20 +3,14 @@
  * in the schema. The host (selva app or a fork) supplies an implementation;
  * the platform stays domain-agnostic.
  *
- * Keys are opaque strings. The host defines the namespace
- * (e.g. 'capture.geometry', 'parcel.boundary') and the resolver interprets it
- * however it likes — typically as an address into the host's own domain store.
- *
- * Status: preliminary. The interface is expected to refine once we wire a
- * real binding end-to-end (see docs/upstream-binding-prep PR plan). Current
- * shape is the minimum needed to slot a host implementation behind
- * `SelvaConfig.bindingResolver`.
+ * Keys are opaque strings namespaced by the host (e.g. 'capture.geometry',
+ * 'parcel.boundary') and interpreted however it likes — typically as an
+ * address into the host's own domain store.
  */
 /**
- * Default resolver used when the host hasn't configured one. Returns an
- * empty map for any request, which makes every bound input fail at solve
- * time — a loud signal that a resolver needs to be wired up. Drop-in replace
- * via `SelvaConfig.bindingResolver` once the host has a real implementation.
+ * Default resolver for when the host hasn't configured one. Returns an
+ * empty map for any request, so every bound input fails at solve time —
+ * a loud signal that a resolver needs wiring up.
  */
 export class NoopBindingResolver {
     async resolve() {

package/dist/bindings/interface.js.map

@@ -1 +1 @@
-{"version":3,"file":"interface.js","sourceRoot":"","sources":["../../src/bindings/interface.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAqCH;;;;;GAKG;AACH,MAAM,OAAO,mBAAmB;IAC/B,KAAK,CAAC,OAAO;QACZ,OAAO,IAAI,GAAG,EAAE,CAAC;IAClB,CAAC;CACD"}
+{"version":3,"file":"interface.js","sourceRoot":"","sources":["../../src/bindings/interface.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA8BH;;;;GAIG;AACH,MAAM,OAAO,mBAAmB;IAC/B,KAAK,CAAC,OAAO;QACZ,OAAO,IAAI,GAAG,EAAE,CAAC;IAClB,CAAC;CACD"}