@selvajs/platform 0.17.0-beta.3 → 0.17.0

package/dist/metrics/interface.d.ts

@@ -1,9 +1,8 @@
 import type { RequestContext } from '../context.js';
 /**
  * Why a solve did not produce a usable result. `ok` means the solve completed
- * (it may still carry Grasshopper runtime errors — see `errorCount`). The
- * failure kinds mirror the distinct branches the compute route already
- * distinguishes, so the recorded reason matches the HTTP status the client saw.
+ * (it may still carry Grasshopper runtime errors — see `errorCount`). Each
+ * kind mirrors an HTTP status the compute route already distinguishes.
  */
 export type SolveFailureKind = 
 /** Solve completed; the response was returned to the client. */
@@ -27,62 +26,48 @@ export type SolveFailureKind =
 /** Compute server unreachable or the solve threw for any other reason. */
  | 'compute_error';
 /**
- * One solve's timing and outcome, recorded once per solve attempt — including
+ * One solve's timing and outcome, recorded once per attempt — including
  * attempts rejected before `scheduler.solve()` runs (rate limit, share cap).
- *
- * `durationMs` is wall time around the Rhino.Compute solve call only — it
- * excludes definition loading, auth, schema work, and result serialization. It
- * is 0 for attempts rejected before the solve started.
  */
 export interface SolveMetric {
     /** Definition the solve ran against. `local:<guid>` or a remote URL. */
     definitionUrl: string;
-    /**
-     * Local definition id (the `local:` guid), or null for remote-URL solves.
-     * Stored alongside `definitionUrl` so timings join to the definition record.
-     */
+    /** Local definition id (the `local:` guid), or null for remote-URL solves. */
     definitionId: string | null;
-    /**
-     * The exact version solved, or null for remote-URL solves (and for local
-     * attempts rejected before the version resolved). Lets you compare timings
-     * across versions of the same definition.
-     */
+    /** Exact version solved, or null for remote-URL solves and attempts rejected before the version resolved. */
     versionId: string | null;
     /** Channel solved, mirroring the compute request. */
     channel: 'live' | 'draft';
     /** Org whose compute pool served the solve, or null for remote definitions. */
     orgId: string | null;
-    /** Wall-clock duration of `scheduler.solve()` in milliseconds. 0 if never started. */
+    /**
+     * Wall time around the Rhino.Compute solve call only — excludes definition
+     * loading, auth, schema work, and result serialization. 0 if never started.
+     */
     durationMs: number;
     /** Whether the solve completed and returned a result. */
     ok: boolean;
     /** Why the solve did not return a result; `'ok'` when it did. */
     failureKind: SolveFailureKind;
     /**
-     * Count of Grasshopper runtime errors in the solve response. A solve can be
-     * `ok` yet still report component-level errors — this is distinct from
-     * `failureKind`. 0 when the solve never returned a response.
+     * Grasshopper runtime errors in the solve response. A solve can be `ok`
+     * yet still report component-level errors. 0 when no response returned.
      */
     errorCount: number;
-    /** Count of Grasshopper runtime warnings in the solve response. */
+    /** Grasshopper runtime warnings in the solve response. */
     warningCount: number;
 }
 /**
- * Sink for per-solve timing telemetry. Called once per solve attempt from the
- * compute route, AFTER the solve resolves or rejects.
+ * Sink for per-solve timing telemetry, called once per attempt after the
+ * solve resolves or rejects.
  *
  * MUST NOT throw — recording is best-effort and sits on the hot path of every
- * solve. Implementations catch and log their own failures; the only side
- * effect visible to the caller is a fulfilled promise. MAY be fire-and-forget.
+ * solve. Implementations catch and log their own failures.
  */
 export interface ISolveMetricSink {
     record(ctx: RequestContext, metric: SolveMetric): Promise<void>;
 }
-/**
- * Default `ISolveMetricSink` — discards every metric. Used when
- * `SelvaConfig.solveMetrics` is omitted. Swap in a real sink to persist or
- * aggregate solve timings.
- */
+/** Default `ISolveMetricSink` — discards every metric. Used when `SelvaConfig.solveMetrics` is omitted. */
 export declare class NoopSolveMetricSink implements ISolveMetricSink {
     record(_ctx: RequestContext, _metric: SolveMetric): Promise<void>;
 }

package/dist/metrics/interface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"interface.d.ts","sourceRoot":"","sources":["../../src/metrics/interface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB;AAC3B,gEAAgE;AAC9D,IAAI;AACN,8CAA8C;GAC5C,SAAS;AACX,4EAA4E;GAC1E,cAAc;AAChB,sEAAsE;GACpE,cAAc;AAChB,8DAA8D;GAC5D,WAAW;AACb,0DAA0D;GACxD,WAAW;AACb;;;;GAIG;GACD,MAAM;AACR,0EAA0E;GACxE,eAAe,CAAC;AAEnB;;;;;;;GAOG;AACH,MAAM,WAAW,WAAW;IAC3B,wEAAwE;IACxE,aAAa,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B;;;;OAIG;IACH,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,qDAAqD;IACrD,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;IAC1B,+EAA+E;IAC/E,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,sFAAsF;IACtF,UAAU,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,EAAE,EAAE,OAAO,CAAC;IACZ,iEAAiE;IACjE,WAAW,EAAE,gBAAgB,CAAC;IAC9B;;;;OAIG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,mEAAmE;IACnE,YAAY,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAChC,MAAM,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChE;AAED;;;;GAIG;AACH,qBAAa,mBAAoB,YAAW,gBAAgB;IACrD,MAAM,CAAC,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;CACvE"}
+{"version":3,"file":"interface.d.ts","sourceRoot":"","sources":["../../src/metrics/interface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD;;;;GAIG;AACH,MAAM,MAAM,gBAAgB;AAC3B,gEAAgE;AAC9D,IAAI;AACN,8CAA8C;GAC5C,SAAS;AACX,4EAA4E;GAC1E,cAAc;AAChB,sEAAsE;GACpE,cAAc;AAChB,8DAA8D;GAC5D,WAAW;AACb,0DAA0D;GACxD,WAAW;AACb;;;;GAIG;GACD,MAAM;AACR,0EAA0E;GACxE,eAAe,CAAC;AAEnB;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC3B,wEAAwE;IACxE,aAAa,EAAE,MAAM,CAAC;IACtB,8EAA8E;IAC9E,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,6GAA6G;IAC7G,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,qDAAqD;IACrD,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;IAC1B,+EAA+E;IAC/E,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,EAAE,EAAE,OAAO,CAAC;IACZ,iEAAiE;IACjE,WAAW,EAAE,gBAAgB,CAAC;IAC9B;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,0DAA0D;IAC1D,YAAY,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAChC,MAAM,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChE;AAED,2GAA2G;AAC3G,qBAAa,mBAAoB,YAAW,gBAAgB;IACrD,MAAM,CAAC,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;CACvE"}

package/dist/metrics/interface.js

@@ -1,8 +1,4 @@
-/**
- * Default `ISolveMetricSink` — discards every metric. Used when
- * `SelvaConfig.solveMetrics` is omitted. Swap in a real sink to persist or
- * aggregate solve timings.
- */
+/** Default `ISolveMetricSink` — discards every metric. Used when `SelvaConfig.solveMetrics` is omitted. */
 export class NoopSolveMetricSink {
     async record(_ctx, _metric) { }
 }

package/dist/metrics/interface.js.map

@@ -1 +1 @@
-{"version":3,"file":"interface.js","sourceRoot":"","sources":["../../src/metrics/interface.ts"],"names":[],"mappings":"AAoFA;;;;GAIG;AACH,MAAM,OAAO,mBAAmB;IAC/B,KAAK,CAAC,MAAM,CAAC,IAAoB,EAAE,OAAoB,IAAkB,CAAC;CAC1E"}
+{"version":3,"file":"interface.js","sourceRoot":"","sources":["../../src/metrics/interface.ts"],"names":[],"mappings":"AAyEA,2GAA2G;AAC3G,MAAM,OAAO,mBAAmB;IAC/B,KAAK,CAAC,MAAM,CAAC,IAAoB,EAAE,OAAoB,IAAkB,CAAC;CAC1E"}

package/dist/organizations/interface.d.ts

@@ -13,34 +13,25 @@ export interface IOrgStore {
     createOrg(ctx: RequestContext, org: Organization): Promise<void>;
     updateOrg(ctx: RequestContext, id: string, patch: Partial<Pick<Organization, 'name' | 'slug' | 'assets'>>): Promise<void>;
     /**
-     * Soft-delete the org. Cascades soft-delete to org members, projects in the
-     * org, and project members. Definitions and share links cascade through the
-     * project deletion. Invites and the org compute-server override are NOT
-     * cascaded — clean those up explicitly if needed.
+     * Soft-deletes the org, cascading to org members, projects, and project
+     * members (definitions and share links cascade through project deletion).
+     * Invites and the org compute-server override are NOT cascaded — clean
+     * those up explicitly if needed.
      */
     deleteOrg(ctx: RequestContext, id: string): Promise<void>;
     listOrgMembers(ctx: RequestContext, orgId: string, opts?: ListOptions): Promise<Page<OrgMember>>;
     getOrgMember(ctx: RequestContext, orgId: string, userId: string): Promise<OrgMember | null>;
     /**
-     * One user's membership row across many orgs, in a single query. The bulk
-     * counterpart to `getOrgMember`, for evaluating access rules over a list.
-     *
-     * Keys are the requested `orgIds`; an org the user is not a member of maps to
-     * `null` rather than being absent.
+     * Bulk counterpart to `getOrgMember`, for evaluating access rules over a
+     * list of orgs in one query. Keys are the requested `orgIds`; an org the
+     * user is not a member of maps to `null` rather than being absent.
      */
     getOrgMembersFor(ctx: RequestContext, orgIds: readonly string[], userId: string): Promise<Map<string, OrgMember | null>>;
     /**
-     * Find ONE org membership for the user. Used by the request-bootstrap
-     * path to resolve `actingOrgId` without N+1-ing over `listOrgs`.
-     *
-     * Returns `null` when the user has no live membership. When the user has
-     * multiple memberships (multi-tenant deployments), the choice between
-     * them is adapter-defined — single-tenant deployments have exactly one,
-     * and multi-tenant deployments will eventually use a URL prefix
-     * (`/o/{slug}/...`) to pick explicitly. Soft-deleted memberships are
-     * excluded.
-     *
-     * Both `org` and `member` are scoped by `ctx` (RLS-aware on Supabase).
+     * Finds one org membership for the user, to resolve `actingOrgId` during
+     * request bootstrap without N+1-ing over `listOrgs`. Returns `null` when
+     * the user has no live membership (soft-deleted ones are excluded). If the
+     * user has multiple memberships, which one comes back is adapter-defined.
      */
     findUserMembership(ctx: RequestContext, userId: string): Promise<{
         org: Organization;
@@ -49,9 +40,9 @@ export interface IOrgStore {
     addOrgMember(ctx: RequestContext, member: OrgMember): Promise<void>;
     updateOrgMemberRole(ctx: RequestContext, orgId: string, userId: string, role: OrgRole): Promise<void>;
     /**
-     * Replace `OrgPermission` set without changing role. Use this for
-     * permission edits — round-tripping through remove + add cascades the
-     * org-removal soft-delete into project memberships.
+     * Replaces the `OrgPermission` set without changing role. Use this for
+     * permission edits — round-tripping through remove + add would cascade
+     * the org-removal soft-delete into project memberships.
      */
     updateOrgMemberPermissions(ctx: RequestContext, orgId: string, userId: string, permissions: readonly OrgPermission[]): Promise<void>;
     removeOrgMember(ctx: RequestContext, orgId: string, userId: string): Promise<void>;

package/dist/organizations/interface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"interface.d.ts","sourceRoot":"","sources":["../../src/organizations/interface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE3D;;;GAGG;AACH,MAAM,WAAW,SAAS;IAEzB,QAAQ,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IAC/E,MAAM,CAAC,GAAG,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IACtE,YAAY,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAC9E,SAAS,CAAC,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,SAAS,CACR,GAAG,EAAE,cAAc,EACnB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,QAAQ,CAAC,CAAC,GAC5D,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB;;;;;OAKG;IACH,SAAS,CAAC,GAAG,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAG1D,cAAc,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IACjG,YAAY,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAC5F;;;;;;OAMG;IACH,gBAAgB,CACf,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,SAAS,MAAM,EAAE,EACzB,MAAM,EAAE,MAAM,GACZ,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC;IAC1C;;;;;;;;;;;;OAYG;IACH,kBAAkB,CACjB,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,MAAM,GACZ,OAAO,CAAC;QAAE,GAAG,EAAE,YAAY,CAAC;QAAC,MAAM,EAAE,SAAS,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IAC5D,YAAY,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE,mBAAmB,CAClB,GAAG,EAAE,cAAc,EACnB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO,GACX,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB;;;;OAIG;IACH,0BAA0B,CACzB,GAAG,EAAE,cAAc,EACnB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,SAAS,aAAa,EAAE,GACnC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,eAAe,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnF"}
+{"version":3,"file":"interface.d.ts","sourceRoot":"","sources":["../../src/organizations/interface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE3D;;;GAGG;AACH,MAAM,WAAW,SAAS;IAEzB,QAAQ,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IAC/E,MAAM,CAAC,GAAG,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IACtE,YAAY,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAC9E,SAAS,CAAC,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,SAAS,CACR,GAAG,EAAE,cAAc,EACnB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,QAAQ,CAAC,CAAC,GAC5D,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB;;;;;OAKG;IACH,SAAS,CAAC,GAAG,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAG1D,cAAc,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IACjG,YAAY,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAC5F;;;;OAIG;IACH,gBAAgB,CACf,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,SAAS,MAAM,EAAE,EACzB,MAAM,EAAE,MAAM,GACZ,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC;IAC1C;;;;;OAKG;IACH,kBAAkB,CACjB,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,MAAM,GACZ,OAAO,CAAC;QAAE,GAAG,EAAE,YAAY,CAAC;QAAC,MAAM,EAAE,SAAS,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IAC5D,YAAY,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE,mBAAmB,CAClB,GAAG,EAAE,cAAc,EACnB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO,GACX,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB;;;;OAIG;IACH,0BAA0B,CACzB,GAAG,EAAE,cAAc,EACnB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,SAAS,aAAa,EAAE,GACnC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,eAAe,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnF"}

package/dist/organizations/paths.d.ts

@@ -1,21 +1,18 @@
 import type { OrgAssetKind } from './schemas.js';
 /**
- * Storage keys for org-scoped assets. Every branding asset is stored as `.webp`
- * (uploads are rasterized through the shared transcoder), so the path per kind
- * is fixed — a re-upload overwrites in place via `IStorageProvider.put`'s
- * upsert. The filename IS the kind, so the layout is generic: a new branding
- * kind needs no new helper.
+ * Every branding asset is stored as `.webp` (uploads go through the shared
+ * transcoder), so the path per kind is fixed and a re-upload overwrites in
+ * place via `IStorageProvider.put`'s upsert.
  *
- * Branding lives under `orgs/{id}/branding/` because it is a *public* asset
- * class — anyone, incl. logged-out viewers, may read a company logo. The
- * `branding/` segment keeps it distinguishable from future org-private blobs
- * under `orgs/{id}/private/` (e.g. pricing sheets), which are members-only.
- * The serving route and `getPublicUrl` decide public-vs-private by classifying
- * these prefixes — see `classifyAssetPath` / `ASSET_CLASSES`.
+ * Branding lives under `orgs/{id}/branding/` because it's a *public* asset
+ * class — anyone, including logged-out viewers, may read a company logo.
+ * That segment distinguishes it from `orgs/{id}/private/` (members-only).
+ * `classifyAssetPath` / `ASSET_CLASSES` decide public-vs-private from these
+ * prefixes.
  */
 export declare const orgPaths: {
     readonly asset: (id: string, kind: OrgAssetKind) => string;
-    /** Members-only blob under the org's private tier. `name` includes the extension. */
+    /** Members-only blob; `name` includes the extension. */
     readonly privateAsset: (id: string, name: string) => string;
     readonly prefix: (id: string) => string;
 };

package/dist/organizations/paths.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/organizations/paths.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAcjD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,QAAQ;yBACR,MAAM,QAAQ,YAAY;IAKtC,qFAAqF;gCAClE,MAAM,QAAQ,MAAM;0BAK1B,MAAM;CAIV,CAAC"}
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/organizations/paths.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAajD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,QAAQ;yBACR,MAAM,QAAQ,YAAY;IAKtC,wDAAwD;gCACrC,MAAM,QAAQ,MAAM;0BAK1B,MAAM;CAIV,CAAC"}

package/dist/organizations/paths.js

@@ -1,27 +1,23 @@
 /**
- * Path-segment safety check. Blocks traversal, separators, NUL, and empty
- * segments. Allowed alphabet `[A-Za-z0-9._-]+` covers GUIDs and sanitized
- * refs. Called by every helper so a malicious `id` can't escape the
- * `orgs/` prefix. Mirrors `definitionPaths`' guard.
+ * Blocks path traversal, separators, and empty segments. Called by every
+ * helper below so a malicious `id` can't escape the `orgs/` prefix.
  */
 function assertSafeKey(value, label) {
+    // The regex alone allows '.' and '..' — both fully match the allowed alphabet — so they need an explicit check.
     if (!value || !/^[A-Za-z0-9._-]+$/.test(value) || value === '.' || value === '..') {
         throw new Error(`Unsafe ${label}: ${JSON.stringify(value)}`);
     }
 }
 /**
- * Storage keys for org-scoped assets. Every branding asset is stored as `.webp`
- * (uploads are rasterized through the shared transcoder), so the path per kind
- * is fixed — a re-upload overwrites in place via `IStorageProvider.put`'s
- * upsert. The filename IS the kind, so the layout is generic: a new branding
- * kind needs no new helper.
+ * Every branding asset is stored as `.webp` (uploads go through the shared
+ * transcoder), so the path per kind is fixed and a re-upload overwrites in
+ * place via `IStorageProvider.put`'s upsert.
  *
- * Branding lives under `orgs/{id}/branding/` because it is a *public* asset
- * class — anyone, incl. logged-out viewers, may read a company logo. The
- * `branding/` segment keeps it distinguishable from future org-private blobs
- * under `orgs/{id}/private/` (e.g. pricing sheets), which are members-only.
- * The serving route and `getPublicUrl` decide public-vs-private by classifying
- * these prefixes — see `classifyAssetPath` / `ASSET_CLASSES`.
+ * Branding lives under `orgs/{id}/branding/` because it's a *public* asset
+ * class — anyone, including logged-out viewers, may read a company logo.
+ * That segment distinguishes it from `orgs/{id}/private/` (members-only).
+ * `classifyAssetPath` / `ASSET_CLASSES` decide public-vs-private from these
+ * prefixes.
  */
 export const orgPaths = {
     asset: (id, kind) => {
@@ -29,7 +25,7 @@ export const orgPaths = {
         assertSafeKey(kind, 'assetKind');
         return `orgs/${id}/branding/${kind}.webp`;
     },
-    /** Members-only blob under the org's private tier. `name` includes the extension. */
+    /** Members-only blob; `name` includes the extension. */
     privateAsset: (id, name) => {
         assertSafeKey(id, 'orgId');
         assertSafeKey(name, 'assetName');

package/dist/organizations/paths.js.map

@@ -1 +1 @@
-{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/organizations/paths.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,SAAS,aAAa,CAAC,KAAa,EAAE,KAAa;IAClD,IAAI,CAAC,KAAK,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnF,MAAM,IAAI,KAAK,CAAC,UAAU,KAAK,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC9D,CAAC;AACF,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG;IACvB,KAAK,EAAE,CAAC,EAAU,EAAE,IAAkB,EAAE,EAAE;QACzC,aAAa,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC3B,aAAa,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QACjC,OAAO,QAAQ,EAAE,aAAa,IAAI,OAAO,CAAC;IAC3C,CAAC;IACD,qFAAqF;IACrF,YAAY,EAAE,CAAC,EAAU,EAAE,IAAY,EAAE,EAAE;QAC1C,aAAa,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC3B,aAAa,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QACjC,OAAO,QAAQ,EAAE,YAAY,IAAI,EAAE,CAAC;IACrC,CAAC;IACD,MAAM,EAAE,CAAC,EAAU,EAAE,EAAE;QACtB,aAAa,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC3B,OAAO,QAAQ,EAAE,GAAG,CAAC;IACtB,CAAC;CACQ,CAAC"}
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/organizations/paths.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,SAAS,aAAa,CAAC,KAAa,EAAE,KAAa;IAClD,gHAAgH;IAChH,IAAI,CAAC,KAAK,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnF,MAAM,IAAI,KAAK,CAAC,UAAU,KAAK,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC9D,CAAC;AACF,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG;IACvB,KAAK,EAAE,CAAC,EAAU,EAAE,IAAkB,EAAE,EAAE;QACzC,aAAa,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC3B,aAAa,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QACjC,OAAO,QAAQ,EAAE,aAAa,IAAI,OAAO,CAAC;IAC3C,CAAC;IACD,wDAAwD;IACxD,YAAY,EAAE,CAAC,EAAU,EAAE,IAAY,EAAE,EAAE;QAC1C,aAAa,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC3B,aAAa,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QACjC,OAAO,QAAQ,EAAE,YAAY,IAAI,EAAE,CAAC;IACrC,CAAC;IACD,MAAM,EAAE,CAAC,EAAU,EAAE,EAAE;QACtB,aAAa,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC3B,OAAO,QAAQ,EAAE,GAAG,CAAC;IACtB,CAAC;CACQ,CAAC"}

package/dist/organizations/schemas.d.ts

@@ -1,24 +1,18 @@
 import { z } from 'zod';
 /**
  * Top-level path segments a tenant slug must never equal, so a slug can never
- * shadow (or be shadowed by) a route (audit D4). Two forces meet here:
- *  - Reserved multi-org namespace: `/o/{slug}/` is the decided shape for
- *    per-org URLs (see ADR 0006). `o` is reserved even though the length gate
- *    below already makes a 1-char slug impossible — belt-and-suspenders, and it
- *    documents intent for anyone relaxing the length rule later.
- *  - Existing flat top-level routes: reserving these keeps a future move to
- *    `/o/{slug}/…` (or any flat tenant route) collision-free from day one,
- *    before any external link is minted against a slug.
- * Lowercase; the slug is lowercased/matched case-insensitively so `Admin` can't
- * slip through. Keep in sync with the route tree's top-level directories.
+ * shadow (or be shadowed by) a route. `/o/{slug}/` is the planned shape for
+ * per-org URLs, so `o` is reserved even though the length gate below already
+ * makes a 1-char slug impossible — that keeps a future move to `/o/{slug}/…`
+ * collision-free before any external link is minted against a slug.
+ * Lowercase; matching is case-insensitive so `Admin` can't slip through. Keep
+ * in sync with the route tree's top-level directories.
  */
 export declare const RESERVED_SLUGS: readonly string[];
 /**
- * Coerce an arbitrary name into a slug candidate: lowercase, non-alphanumeric
- * runs collapsed to single hyphens, trimmed of edge hyphens, capped at 63 chars.
- * Produces the shape `SlugSchema` validates — but does not itself guarantee
- * validity (a name of all-symbols yields `''`, and reserved words pass through);
- * run the result through `SlugSchema` where a valid slug is required.
+ * Coerces an arbitrary name into a slug candidate. Does not guarantee a valid
+ * slug — an all-symbols name yields `''`, and reserved words pass through
+ * untouched — run the result through `SlugSchema` where validity matters.
  */
 export declare function slugify(name: string): string;
 /** Lowercase alphanumeric with internal hyphens, 3–63 chars, not a reserved word. */
@@ -29,10 +23,7 @@ export declare const OrgRoleSchema: z.ZodEnum<{
     member: "member";
 }>;
 export type OrgRole = z.infer<typeof OrgRoleSchema>;
-/**
- * Kinds of org-scoped branding asset. Adding a new kind is a single entry here
- * — the storage path, upload route, store, and UI are all generic over it.
- */
+/** Kinds of org-scoped branding asset. Adding a kind is a single entry here — path, upload route, store, and UI are all generic over it. */
 export declare const OrgAssetKindSchema: z.ZodEnum<{
     logo: "logo";
     favicon: "favicon";

package/dist/organizations/schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../src/organizations/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,cAAc,EAAE,SAAS,MAAM,EAY3C,CAAC;AAIF;;;;;;GAMG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAO5C;AAED,qFAAqF;AACrF,eAAO,MAAM,UAAU,aAUpB,CAAC;AAEJ,eAAO,MAAM,aAAa;;;;EAAuC,CAAC;AAClE,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAEpD;;;GAGG;AACH,eAAO,MAAM,kBAAkB;;;EAA8B,CAAC;AAC9D,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,mBAAmB,EAAE,SAAS,YAAY,EAA+B,CAAC;AAEvF,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB;;;;;EAK9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,mBAAmB,EAAE,SAAS,aAAa,EAAgC,CAAC;AAEzF,sDAAsD;AACtD,eAAO,MAAM,4BAA4B,EAAE,SAAS,aAAa,EAGhE,CAAC;AAEF,eAAO,MAAM,6BAA6B,EAAE,SAAS,aAAa,EAEjE,CAAC;AAEF,yEAAyE;AACzE,eAAO,MAAM,uBAAuB,EAAE,MAAM,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,CAI7E,CAAC;AAEF,eAAO,MAAM,eAAe;;;iBAG1B,CAAC;AAEH,eAAO,MAAM,eAAe;;;iBAA4B,CAAC;AAEzD,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAC7D,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC"}
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../src/organizations/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,EAAE,SAAS,MAAM,EAY3C,CAAC;AAIF;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAO5C;AAED,qFAAqF;AACrF,eAAO,MAAM,UAAU,aAUpB,CAAC;AAEJ,eAAO,MAAM,aAAa;;;;EAAuC,CAAC;AAClE,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAEpD,4IAA4I;AAC5I,eAAO,MAAM,kBAAkB;;;EAA8B,CAAC;AAC9D,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,mBAAmB,EAAE,SAAS,YAAY,EAA+B,CAAC;AAEvF,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB;;;;;EAK9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,mBAAmB,EAAE,SAAS,aAAa,EAAgC,CAAC;AAEzF,sDAAsD;AACtD,eAAO,MAAM,4BAA4B,EAAE,SAAS,aAAa,EAGhE,CAAC;AAEF,eAAO,MAAM,6BAA6B,EAAE,SAAS,aAAa,EAEjE,CAAC;AAEF,yEAAyE;AACzE,eAAO,MAAM,uBAAuB,EAAE,MAAM,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,CAI7E,CAAC;AAEF,eAAO,MAAM,eAAe;;;iBAG1B,CAAC;AAEH,eAAO,MAAM,eAAe;;;iBAA4B,CAAC;AAEzD,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAC7D,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC"}

package/dist/organizations/schemas.js

@@ -1,16 +1,12 @@
 import { z } from 'zod';
 /**
  * Top-level path segments a tenant slug must never equal, so a slug can never
- * shadow (or be shadowed by) a route (audit D4). Two forces meet here:
- *  - Reserved multi-org namespace: `/o/{slug}/` is the decided shape for
- *    per-org URLs (see ADR 0006). `o` is reserved even though the length gate
- *    below already makes a 1-char slug impossible — belt-and-suspenders, and it
- *    documents intent for anyone relaxing the length rule later.
- *  - Existing flat top-level routes: reserving these keeps a future move to
- *    `/o/{slug}/…` (or any flat tenant route) collision-free from day one,
- *    before any external link is minted against a slug.
- * Lowercase; the slug is lowercased/matched case-insensitively so `Admin` can't
- * slip through. Keep in sync with the route tree's top-level directories.
+ * shadow (or be shadowed by) a route. `/o/{slug}/` is the planned shape for
+ * per-org URLs, so `o` is reserved even though the length gate below already
+ * makes a 1-char slug impossible — that keeps a future move to `/o/{slug}/…`
+ * collision-free before any external link is minted against a slug.
+ * Lowercase; matching is case-insensitive so `Admin` can't slip through. Keep
+ * in sync with the route tree's top-level directories.
  */
 export const RESERVED_SLUGS = [
     'o',
@@ -27,11 +23,9 @@ export const RESERVED_SLUGS = [
 ];
 const RESERVED_SLUG_SET = new Set(RESERVED_SLUGS);
 /**
- * Coerce an arbitrary name into a slug candidate: lowercase, non-alphanumeric
- * runs collapsed to single hyphens, trimmed of edge hyphens, capped at 63 chars.
- * Produces the shape `SlugSchema` validates — but does not itself guarantee
- * validity (a name of all-symbols yields `''`, and reserved words pass through);
- * run the result through `SlugSchema` where a valid slug is required.
+ * Coerces an arbitrary name into a slug candidate. Does not guarantee a valid
+ * slug — an all-symbols name yields `''`, and reserved words pass through
+ * untouched — run the result through `SlugSchema` where validity matters.
  */
 export function slugify(name) {
     return name
@@ -51,10 +45,7 @@ export const SlugSchema = z
     message: 'Slug is reserved and cannot be used'
 });
 export const OrgRoleSchema = z.enum(['owner', 'admin', 'member']);
-/**
- * Kinds of org-scoped branding asset. Adding a new kind is a single entry here
- * — the storage path, upload route, store, and UI are all generic over it.
- */
+/** Kinds of org-scoped branding asset. Adding a kind is a single entry here — path, upload route, store, and UI are all generic over it. */
 export const OrgAssetKindSchema = z.enum(['logo', 'favicon']);
 export const ALL_ORG_ASSET_KINDS = OrgAssetKindSchema.options;
 /** Org-scope permissions. A user may hold different sets in different orgs. */

package/dist/organizations/schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../src/organizations/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,cAAc,GAAsB;IAChD,GAAG;IACH,KAAK;IACL,OAAO;IACP,MAAM;IACN,OAAO;IACP,QAAQ;IACR,OAAO;IACP,MAAM;IACN,SAAS;IACT,UAAU;IACV,eAAe;CACf,CAAC;AAEF,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;AAElD;;;;;;GAMG;AACH,MAAM,UAAU,OAAO,CAAC,IAAY;IACnC,OAAO,IAAI;SACT,IAAI,EAAE;SACN,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;SACrB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAChB,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC;KACzB,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,EAAE,oCAAoC,CAAC;KAC5C,GAAG,CAAC,EAAE,EAAE,oCAAoC,CAAC;KAC7C,KAAK,CACL,iCAAiC,EACjC,4FAA4F,CAC5F;KACA,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;IACzC,OAAO,EAAE,qCAAqC;CAC9C,CAAC,CAAC;AAEJ,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAGlE;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAG9D,MAAM,CAAC,MAAM,mBAAmB,GAA4B,kBAAkB,CAAC,OAAO,CAAC;AAEvF,+EAA+E;AAC/E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,IAAI,CAAC;IACzC,oBAAoB;IACpB,oBAAoB;IACpB,oBAAoB;IACpB,iBAAiB;CACjB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,mBAAmB,GAA6B,mBAAmB,CAAC,OAAO,CAAC;AAEzF,sDAAsD;AACtD,MAAM,CAAC,MAAM,4BAA4B,GAA6B;IACrE,oBAAoB;IACpB,oBAAoB;CACpB,CAAC;AAEF,MAAM,CAAC,MAAM,6BAA6B,GAA6B,mBAAmB,CAAC,MAAM,CAChG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,4BAA4B,CAAC,QAAQ,CAAC,CAAC,CAAC,CAChD,CAAC;AAEF,yEAAyE;AACzE,MAAM,CAAC,MAAM,uBAAuB,GAA8C;IACjF,KAAK,EAAE,CAAC,GAAG,mBAAmB,CAAC;IAC/B,KAAK,EAAE,CAAC,GAAG,mBAAmB,CAAC;IAC/B,MAAM,EAAE,EAAE;CACV,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,+BAA+B,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACjE,IAAI,EAAE,UAAU;CAChB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,eAAe,CAAC,OAAO,EAAE,CAAC"}
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../src/organizations/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAsB;IAChD,GAAG;IACH,KAAK;IACL,OAAO;IACP,MAAM;IACN,OAAO;IACP,QAAQ;IACR,OAAO;IACP,MAAM;IACN,SAAS;IACT,UAAU;IACV,eAAe;CACf,CAAC;AAEF,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;AAElD;;;;GAIG;AACH,MAAM,UAAU,OAAO,CAAC,IAAY;IACnC,OAAO,IAAI;SACT,IAAI,EAAE;SACN,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;SACrB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAChB,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC;KACzB,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,EAAE,oCAAoC,CAAC;KAC5C,GAAG,CAAC,EAAE,EAAE,oCAAoC,CAAC;KAC7C,KAAK,CACL,iCAAiC,EACjC,4FAA4F,CAC5F;KACA,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;IACzC,OAAO,EAAE,qCAAqC;CAC9C,CAAC,CAAC;AAEJ,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAGlE,4IAA4I;AAC5I,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAG9D,MAAM,CAAC,MAAM,mBAAmB,GAA4B,kBAAkB,CAAC,OAAO,CAAC;AAEvF,+EAA+E;AAC/E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,IAAI,CAAC;IACzC,oBAAoB;IACpB,oBAAoB;IACpB,oBAAoB;IACpB,iBAAiB;CACjB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,mBAAmB,GAA6B,mBAAmB,CAAC,OAAO,CAAC;AAEzF,sDAAsD;AACtD,MAAM,CAAC,MAAM,4BAA4B,GAA6B;IACrE,oBAAoB;IACpB,oBAAoB;CACpB,CAAC;AAEF,MAAM,CAAC,MAAM,6BAA6B,GAA6B,mBAAmB,CAAC,MAAM,CAChG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,4BAA4B,CAAC,QAAQ,CAAC,CAAC,CAAC,CAChD,CAAC;AAEF,yEAAyE;AACzE,MAAM,CAAC,MAAM,uBAAuB,GAA8C;IACjF,KAAK,EAAE,CAAC,GAAG,mBAAmB,CAAC;IAC/B,KAAK,EAAE,CAAC,GAAG,mBAAmB,CAAC;IAC/B,MAAM,EAAE,EAAE;CACV,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,+BAA+B,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACjE,IAAI,EAAE,UAAU;CAChB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,eAAe,CAAC,OAAO,EAAE,CAAC"}

package/dist/organizations/types.d.ts

@@ -1,9 +1,8 @@
 import type { OrgRole, OrgPermission, OrgAssetKind } from './schemas.js';
 /**
- * Public URLs of an org's branding assets, keyed by kind. Each value is what
- * `IStorageProvider.getPublicUrl` returned for the stored blob; a kind is
- * absent when unset. One small map so adding a new asset kind never touches
- * the `Organization` shape, the migration, or the row mappers again.
+ * Public URLs of an org's branding assets, keyed by kind; a kind is absent
+ * when unset. Kept as one map so a new asset kind never touches the
+ * `Organization` shape, the migration, or the row mappers.
  */
 export type OrgAssets = Partial<Record<OrgAssetKind, string>>;
 export interface Organization {

package/dist/organizations/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/organizations/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEzE;;;;;GAKG;AACH,MAAM,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;AAE9D,MAAM,WAAW,YAAY;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,IAAI,EAAE,MAAM,CAAC;IACb,+CAA+C;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,4CAA4C;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,uFAAuF;IACvF,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,SAAS;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;IACd;;;OAGG;IACH,WAAW,EAAE,aAAa,EAAE,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/organizations/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEzE;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;AAE9D,MAAM,WAAW,YAAY;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,IAAI,EAAE,MAAM,CAAC;IACb,+CAA+C;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,4CAA4C;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,uFAAuF;IACvF,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,SAAS;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;IACd;;;OAGG;IACH,WAAW,EAAE,aAAa,EAAE,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B"}

package/dist/pagination.d.ts

@@ -1,10 +1,10 @@
 import type { DefinitionStatus } from './definitions/types.js';
 /**
- * Cursor-paginated list options. Adapters MUST provide sensible defaults
- * (limit=50, orderBy=createdAt desc) and clamp limit to a safe upper bound.
+ * Cursor-paginated list options. Adapters default to limit=50, orderBy=createdAt
+ * desc, and clamp limit to `MAX_PAGE_LIMIT`.
  *
- * Cursors are opaque — adapters may use row ids, offsets, or keyset
- * encodings. Callers must not inspect them.
+ * Cursors are opaque — adapters may use row ids, offsets, or keyset encodings.
+ * Callers must not inspect them.
  */
 export interface ListOptions {
     limit?: number;
@@ -16,31 +16,23 @@ export interface ListOptions {
 /** Definition-specific filtering on top of `ListOptions`. */
 export interface DefinitionListOptions extends Omit<ListOptions, 'orderBy'> {
     orderBy?: 'createdAt' | 'updatedAt' | 'name' | 'solveCount';
-    /**
-     * Include records with `status='pending'`. Default false — consumers don't
-     * see half-written state unless they explicitly opt in.
-     */
+    /** Include `status='pending'` records. Default false. */
     includePending?: boolean;
-    /**
-     * Include records with `status='archived'`. Default false — archived
-     * definitions are hidden from normal views; opt in for archive browsers.
-     */
+    /** Include `status='archived'` records. Default false. */
     includeArchived?: boolean;
     /**
      * Filter to specific editorial statuses. Omit for the default view (all
-     * non-pending, non-archived). Pass `['published']` for the runner home.
-     * When set, `includePending` / `includeArchived` are ignored.
+     * non-pending, non-archived). When set, `includePending` / `includeArchived`
+     * are ignored.
      */
     statuses?: DefinitionStatus[];
     /**
-     * Restrict to definitions in these projects. An empty array matches nothing
-     * (an empty page), which is distinct from omitting the filter.
+     * Restrict to definitions in these projects. An empty array matches nothing,
+     * distinct from omitting the filter.
      *
-     * This is what lets visibility filtering happen *in* the query rather than
-     * over the fetched page: the caller resolves the accessible project-id set
-     * first, then passes it here so the adapter applies both the filter and the
-     * cursor. Filtering a fetched page afterwards makes `limit` and `nextCursor`
-     * describe pre-filter positions — a page of 50 can come back with 3 items.
+     * Applying this in the adapter query — rather than filtering a fetched page
+     * afterwards — is what keeps `limit` and `nextCursor` accurate: filtering
+     * post-fetch can return a page of 50 with 3 items.
      */
     projectIds?: readonly string[];
 }

package/dist/pagination.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pagination.d.ts","sourceRoot":"","sources":["../src/pagination.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE/D;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,WAAW,GAAG,WAAW,GAAG,MAAM,CAAC;IAC7C,uBAAuB;IACvB,QAAQ,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;CAC1B;AAED,6DAA6D;AAC7D,MAAM,WAAW,qBAAsB,SAAQ,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC;IAC1E,OAAO,CAAC,EAAE,WAAW,GAAG,WAAW,GAAG,MAAM,GAAG,YAAY,CAAC;IAC5D;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;OAGG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAC9B;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,IAAI,CAAC,CAAC;IACtB,KAAK,EAAE,CAAC,EAAE,CAAC;IACX,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,eAAO,MAAM,kBAAkB,KAAK,CAAC;AACrC,eAAO,MAAM,cAAc,MAAM,CAAC"}
+{"version":3,"file":"pagination.d.ts","sourceRoot":"","sources":["../src/pagination.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE/D;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,WAAW,GAAG,WAAW,GAAG,MAAM,CAAC;IAC7C,uBAAuB;IACvB,QAAQ,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;CAC1B;AAED,6DAA6D;AAC7D,MAAM,WAAW,qBAAsB,SAAQ,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC;IAC1E,OAAO,CAAC,EAAE,WAAW,GAAG,WAAW,GAAG,MAAM,GAAG,YAAY,CAAC;IAC5D,yDAAyD;IACzD,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,0DAA0D;IAC1D,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAC9B;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,IAAI,CAAC,CAAC;IACtB,KAAK,EAAE,CAAC,EAAE,CAAC;IACX,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,eAAO,MAAM,kBAAkB,KAAK,CAAC;AACrC,eAAO,MAAM,cAAc,MAAM,CAAC"}

package/dist/pagination.js.map

@@ -1 +1 @@
-{"version":3,"file":"pagination.js","sourceRoot":"","sources":["../src/pagination.ts"],"names":[],"mappings":"AAsDA,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AACrC,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,CAAC"}
+{"version":3,"file":"pagination.js","sourceRoot":"","sources":["../src/pagination.ts"],"names":[],"mappings":"AA8CA,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AACrC,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,CAAC"}

package/dist/permissions/interface.d.ts

@@ -6,43 +6,34 @@ import type { PlatformPermission } from './types.js';
  * `IAuthProvider`) so external IdPs don't need to model Selva-specific
  * authorization.
  *
- * **The sole-`instance_admin` invariant is enforced here.** Any operation
- * that would leave zero users holding `instance_admin` MUST return
- * `'last_admin'`. Auth providers consult `countInstanceAdminsExcluding`
- * before any destructive op so the invariant holds across edits, deletes,
- * and disables.
+ * **The sole-`instance_admin` invariant is enforced here**: any operation
+ * that would leave zero users holding `instance_admin` must return
+ * `'last_admin'`.
  *
  * Reads are scoped to "self or admin"; writes restricted to `instance_admin`.
  * Pass `SYSTEM_CONTEXT` for trusted server flows (bootstrap, hooks).
  */
 export interface IPlatformPermissionStore {
-    /**
-     * Read permissions for a single user. Empty array for users with no
-     * admin grants (the common case). Non-admin callers may only read self.
-     */
+    /** Empty array for users with no admin grants. Non-admin callers may only read self. */
     getFor(ctx: RequestContext, userId: string): Promise<PlatformPermission[]>;
-    /** Batch-read for the admin user list. Admin-only. */
+    /** Admin-only. */
     getForBatch(ctx: RequestContext, userIds: readonly string[]): Promise<Map<string, PlatformPermission[]>>;
     /**
-     * Replace the user's permissions. Idempotent. Returns:
-     * - `ok` — succeeded
-     * - `not_found` — target user doesn't exist
-     * - `last_admin` — refused; would leave zero `instance_admin` users
-     *
+     * Replace the user's permissions. Idempotent.
+     * `last_admin` — refused; would leave zero `instance_admin` users.
      * `not_supported` is intentionally absent — every deployment must provide
      * a permission store.
      */
     set(ctx: RequestContext, userId: string, permissions: readonly PlatformPermission[]): Promise<UserManagementResult>;
     /**
-     * True if at least one *enabled* user holds `instance_admin`. Used by
-     * first-run detection and the destructive-op invariant check. Adapters
-     * MUST exclude disabled users (over-count is safer than under-count).
+     * True if at least one *enabled* user holds `instance_admin`. Adapters
+     * must exclude disabled users — over-count is safer than under-count.
      */
     hasInstanceAdmin(ctx: RequestContext): Promise<boolean>;
     /**
-     * Count *other* users holding `instance_admin`. `deleteUser` / `disableUser`
-     * call this BEFORE the destructive op — `count === 0` ⇒ `'last_admin'`.
-     * MUST exclude disabled users.
+     * Count *other* users holding `instance_admin`. Callers check this
+     * before a destructive op — `count === 0` means the target is the last
+     * admin and the op must be refused. Must exclude disabled users.
      */
     countInstanceAdminsExcluding(ctx: RequestContext, excludeUserId: string): Promise<number>;
 }

package/dist/permissions/interface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"interface.d.ts","sourceRoot":"","sources":["../../src/permissions/interface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,wBAAwB;IACxC;;;OAGG;IACH,MAAM,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAE3E,sDAAsD;IACtD,WAAW,CACV,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,SAAS,MAAM,EAAE,GACxB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC;IAE9C;;;;;;;;OAQG;IACH,GAAG,CACF,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,SAAS,kBAAkB,EAAE,GACxC,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAEjC;;;;OAIG;IACH,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAExD;;;;OAIG;IACH,4BAA4B,CAAC,GAAG,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC1F"}
+{"version":3,"file":"interface.d.ts","sourceRoot":"","sources":["../../src/permissions/interface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,wBAAwB;IACxC,wFAAwF;IACxF,MAAM,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAE3E,kBAAkB;IAClB,WAAW,CACV,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,SAAS,MAAM,EAAE,GACxB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC;IAE9C;;;;;OAKG;IACH,GAAG,CACF,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,SAAS,kBAAkB,EAAE,GACxC,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAEjC;;;OAGG;IACH,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAExD;;;;OAIG;IACH,4BAA4B,CAAC,GAAG,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC1F"}

package/dist/permissions/types.d.ts

@@ -1,12 +1,12 @@
 import { z } from 'zod';
 /**
- * Platform-scope permissions. Reserved for Selva-staff and instance operators;
+ * Platform-scope permissions. Reserved for Selva staff and instance operators;
  * regular users hold an empty array.
  *
- * - `instance_admin`        — superuser; implies every other permission.
- * - `manage_compute`        — configure the instance-wide Rhino.Compute pool.
- * - `manage_instance_users` — disable/enable any user on the instance.
- * - `manage_updates`        — run system updates.
+ * - `instance_admin`        — superuser; implies every other permission
+ * - `manage_compute`        — configure the instance-wide Rhino.Compute pool
+ * - `manage_instance_users` — disable/enable any user on the instance
+ * - `manage_updates`        — run system updates
  */
 export declare const PlatformPermissionSchema: z.ZodEnum<{
     instance_admin: "instance_admin";

package/dist/permissions/types.js

@@ -1,12 +1,12 @@
 import { z } from 'zod';
 /**
- * Platform-scope permissions. Reserved for Selva-staff and instance operators;
+ * Platform-scope permissions. Reserved for Selva staff and instance operators;
  * regular users hold an empty array.
  *
- * - `instance_admin`        — superuser; implies every other permission.
- * - `manage_compute`        — configure the instance-wide Rhino.Compute pool.
- * - `manage_instance_users` — disable/enable any user on the instance.
- * - `manage_updates`        — run system updates.
+ * - `instance_admin`        — superuser; implies every other permission
+ * - `manage_compute`        — configure the instance-wide Rhino.Compute pool
+ * - `manage_instance_users` — disable/enable any user on the instance
+ * - `manage_updates`        — run system updates
  */
 export const PlatformPermissionSchema = z.enum([
     'instance_admin',