@selvajs/platform 0.21.0-beta.2 → 1.0.0-beta.4

package/README.md

@@ -1,6 +1,6 @@
 # @selvajs/platform
 
-Pure TypeScript interfaces defining Selva's contract with its backends — no runtime dependency on a specific database, storage, or auth service. Concrete adapters live in their own packages: `@selvajs/local-provider`, `@selvajs/supabase-provider`, `@selvajs/header-auth-provider`.
+Selva's contract with its backends: the interfaces, plus the logic every adapter shares (access rules, API-token scopes, at-rest secret encryption, Zod request schemas, slugs, the image transcoder) and vitest conformance suites. No dependency on a specific database, storage or auth service. Concrete adapters live in their own packages: `@selvajs/local-provider`, `@selvajs/supabase-provider`, `@selvajs/header-auth-provider`.
 
 This README is the contract. Read it before writing an adapter.
 
@@ -20,6 +20,7 @@ This README is the contract. Read it before writing an adapter.
 | `IShareLinkStore`            | Per-definition anonymous-access tokens.                                           | Yes — every method.                                                  |
 | `IInviteStore`               | Pending org-membership invitations.                                               | Yes — every method.                                                  |
 | `IComputeServerStore`        | Global + per-org compute-server config.                                           | No — not tenant-scoped.                                              |
+| `IApiTokenStore`             | API tokens and their revocation.                                                  | Yes — every method.                                                  |
 | `IStorageProvider`           | Path-based blob storage. Authorization is the caller's responsibility.            | No — callers pass already-authorized paths.                          |
 
 `IDataProvider` composes every store, plus optional `auditQuery` / `events` hooks, an optional `verifySchemaVersion` handshake (for adapters whose schema migrates out-of-band), and the `ensureUser` / `onUserDeleted` lifecycle methods. An adapter typically implements one class per store and aggregates them.
@@ -49,12 +50,12 @@ Providers are two-phase: a metadata store (`IDataProvider`) and a blob store (`I
 
 List queries filter `'pending'` and `'archived'` by default (`DefinitionListOptions.includePending` / `includeArchived` opt in). If step 2 fails, the record stays `'pending'` and is invisible to consumers.
 
-**Delete — blob-first:**
+**Delete — metadata-first:**
 
-1. `storage.deletePrefix(prefix)`.
-2. `data.delete(guid)`.
+1. `data.delete(guid)`, which hides the record at once.
+2. `storage.deletePrefix(prefix)`.
 
-If step 2 fails, a retry re-deletes blobs (no-op) and succeeds.
+If step 2 fails, the blobs are orphans no reader can reach. The reverse order would leave a live record with its blobs gone.
 
 ---
 
@@ -84,7 +85,7 @@ The Selva app normally picks bundled providers from `SELVA_AUTH_PROVIDER` / `SEL
 
 ## Testing your adapter
 
-`@selvajs/platform/testing` ships a conformance suite per store. Adapters import it and run it against their own instance — passing means the adapter behaves the same as the in-memory reference.
+`@selvajs/platform/testing` ships a conformance suite per store. Adapters import it and run it against their own instance — passing means the adapter honours the contract the bundled providers do.
 
 ```ts
 import { runDefinitionStoreConformance } from '@selvajs/platform/testing';
@@ -96,7 +97,9 @@ runDefinitionStoreConformance({
 });
 ```
 
-A suite exists per store, plus auth, email-link auth, storage, event sink, and solve-metric sink. They cover `ctx` scoping, `pending` filtering, `includePending` opt-in, and `ProviderError` shapes; they do not cover performance or concurrency.
+A suite exists per store, plus auth, email-link auth, storage, event sink and solve-metric sink. `runAuthProviderConformance` wraps `runAuthCoreConformance` and `runPasswordAuthConformance`, so a provider without passwords can run the core alone or pass `passwordless`. New cases go behind an option, so an upgrade doesn't turn a third-party adapter red. The suites cover `ctx` scoping, `pending` filtering, `includePending` opt-in, `ProviderError` shapes, and the races a store exists to prevent, such as the share-link solve cap. They don't cover performance.
+
+`sharp` is an optional peer dependency. An adapter that calls `transcodeImageIfNeeded` has to install it.
 
 ---
 

package/dist/access/index.d.ts

@@ -1,3 +1,2 @@
 export type { ProjectAccessInput, DefinitionAccessInput, VisibilityChangeInput, ReclaimAccessInput, CreateProjectAccessInput, OrgOwnerAuthorityInput, OwnerRemovalInput, OwnerRemovalCheck } from './rules.js';
-export { canView, canSolve, canEdit, canManage, canEditProjectSettings, canChangeVisibilityToPublic, canEditDefinition, canReclaim, canCreateProject, canChangeOrgRole, checkOwnerRemoval, withAdminBypass } from './rules.js';
-//# sourceMappingURL=index.d.ts.map
+export { canView, canSolve, canEdit, canCreateDefinition, canManage, canEditProjectSettings, canChangeVisibilityToPublic, canEditDefinition, canReclaim, canCreateProject, canChangeOrgRole, checkOwnerRemoval, withAdminBypass } from './rules.js';

package/dist/access/index.js

@@ -1,2 +1 @@
-export { canView, canSolve, canEdit, canManage, canEditProjectSettings, canChangeVisibilityToPublic, canEditDefinition, canReclaim, canCreateProject, canChangeOrgRole, checkOwnerRemoval, withAdminBypass } from './rules.js';
-//# sourceMappingURL=index.js.map
+export { canView, canSolve, canEdit, canCreateDefinition, canManage, canEditProjectSettings, canChangeVisibilityToPublic, canEditDefinition, canReclaim, canCreateProject, canChangeOrgRole, checkOwnerRemoval, withAdminBypass } from './rules.js';

package/dist/access/rules.d.ts

@@ -50,6 +50,12 @@ export declare function canSolve(input: ProjectAccessInput): boolean;
  * All other visibilities: project owner/editor.
  */
 export declare function canEdit(input: ProjectAccessInput): boolean;
+/**
+ * Adding a new definition. Commons projects (`autoJoinOnUpload`) take uploads
+ * from anyone who can {@link canView} them, and the uploader owns what they
+ * upload; everywhere else it needs {@link canEdit}.
+ */
+export declare function canCreateDefinition(input: ProjectAccessInput): boolean;
 /** Platform projects: `instance_admin` only. All other visibilities: project owner. */
 export declare function canManage(input: ProjectAccessInput): boolean;
 /** Platform projects: `instance_admin` only. All other visibilities: project owner. */
@@ -125,18 +131,12 @@ export interface OrgOwnerAuthorityInput {
     role: OrgRole;
 }
 /**
- * Whether the actor may hand out or take away org `owner`/`admin` standing (§3).
- *
- * Three routes decide this — inviting someone as owner/admin, changing an
- * existing member's role, and removing an owner — and all three had written it
- * out longhand. Two of them had drifted by the time the access audit found
- * them: the invite route let an admin mint an `owner` invite for themselves,
- * and DELETE let an admin remove an owner that PATCH would not let them demote.
- * They are one rule, so they read it from one place.
+ * Whether the actor may hand out or take away org `owner`/`admin` standing.
+ * Inviting someone as owner/admin, changing a member's role and removing an owner
+ * are one rule, so all three read it here.
  *
- * Reads the actor's **membership row**. `Organization.ownerId` is a separate
- * field that can disagree with it — see the sole-`instance_admin` finding — and
- * is not authority for this decision.
+ * Reads the actor's **membership row**. `Organization.ownerId` is a separate field
+ * that can disagree with it and is not authority for this decision.
  */
 export declare function canChangeOrgRole(input: OrgOwnerAuthorityInput): boolean;
 /**
@@ -157,4 +157,3 @@ export interface OwnerRemovalInput {
     confirmed: boolean;
 }
 export declare function checkOwnerRemoval(input: OwnerRemovalInput): OwnerRemovalCheck;
-//# sourceMappingURL=rules.d.ts.map

package/dist/access/rules.js

@@ -33,10 +33,12 @@ export function canView(input) {
         return platformGrants.some((g) => (g.granteeType === 'user' && g.granteeId === userId) ||
             (g.granteeType === 'org' && g.granteeId === actingOrgId));
     }
-    if (project.visibility === 'private')
-        return member !== null;
+    // A project member sees the project at any visibility. Leaving the org ends the
+    // membership, so this only widens access for someone who reclaimed from outside.
+    if (member !== null)
+        return true;
     if (project.visibility === 'org')
-        return orgMember !== null;
+        return orgMember !== null && actingOrgId === project.orgId;
     if (project.visibility === 'public')
         return allowCrossOrgPublic ? true : orgMember !== null;
     return false;
@@ -69,16 +71,28 @@ export function canSolve(input) {
  */
 export function canEdit(input) {
     const { member, project, enablePlatformProjects, platformPermissions } = input;
-    if (project?.visibility === 'platform') {
+    if (!project)
+        return false;
+    if (project.visibility === 'platform') {
         if (!enablePlatformProjects)
             return false;
         return isInstanceAdmin(platformPermissions);
     }
     return member?.role === 'owner' || member?.role === 'editor';
 }
+/**
+ * Adding a new definition. Commons projects (`autoJoinOnUpload`) take uploads
+ * from anyone who can {@link canView} them, and the uploader owns what they
+ * upload; everywhere else it needs {@link canEdit}.
+ */
+export function canCreateDefinition(input) {
+    return (input.project?.autoJoinOnUpload === true && canView(input)) || canEdit(input);
+}
 /** Platform projects: `instance_admin` only. All other visibilities: project owner. */
 export function canManage(input) {
-    if (input.project?.visibility === 'platform') {
+    if (!input.project)
+        return false;
+    if (input.project.visibility === 'platform') {
         if (!input.enablePlatformProjects)
             return false;
         return isInstanceAdmin(input.platformPermissions);
@@ -87,12 +101,7 @@ export function canManage(input) {
 }
 /** Platform projects: `instance_admin` only. All other visibilities: project owner. */
 export function canEditProjectSettings(input) {
-    if (input.project?.visibility === 'platform') {
-        if (!input.enablePlatformProjects)
-            return false;
-        return isInstanceAdmin(input.platformPermissions);
-    }
-    return input.member?.role === 'owner';
+    return canManage(input);
 }
 /**
  * Authorization to flip a project to `public`. The `ALLOW_CROSS_ORG_PUBLIC`
@@ -113,6 +122,8 @@ export function canEditDefinition(input) {
     const { project, definition, member, orgMember, userId, platformPermissions, enablePlatformProjects } = input;
     if (!project || !definition)
         return false;
+    if (definition.projectId !== project.id)
+        return false;
     if (project.visibility === 'platform') {
         if (!enablePlatformProjects)
             return false;
@@ -166,18 +177,12 @@ export function canCreateProject(input) {
     return false;
 }
 /**
- * Whether the actor may hand out or take away org `owner`/`admin` standing (§3).
- *
- * Three routes decide this — inviting someone as owner/admin, changing an
- * existing member's role, and removing an owner — and all three had written it
- * out longhand. Two of them had drifted by the time the access audit found
- * them: the invite route let an admin mint an `owner` invite for themselves,
- * and DELETE let an admin remove an owner that PATCH would not let them demote.
- * They are one rule, so they read it from one place.
+ * Whether the actor may hand out or take away org `owner`/`admin` standing.
+ * Inviting someone as owner/admin, changing a member's role and removing an owner
+ * are one rule, so all three read it here.
  *
- * Reads the actor's **membership row**. `Organization.ownerId` is a separate
- * field that can disagree with it — see the sole-`instance_admin` finding — and
- * is not authority for this decision.
+ * Reads the actor's **membership row**. `Organization.ownerId` is a separate field
+ * that can disagree with it and is not authority for this decision.
  */
 export function canChangeOrgRole(input) {
     if (input.role === 'member')
@@ -194,4 +199,3 @@ export function checkOwnerRemoval(input) {
         return 'needs_confirm';
     return 'ok';
 }
-//# sourceMappingURL=rules.js.map

package/dist/apiTokens/index.d.ts

@@ -1,6 +1,5 @@
 export type { ApiScope, ApiScopeAction, ApiScopeResource, ApiToken, ApiTokenSummary, ApiTokenRevokeReason, ApiTokenLifetimeDays } from './types.js';
-export { ApiScopeActionSchema, ApiScopeStringSchema, ApiTokenRevokeReasonSchema, API_TOKEN_LIFETIME_DAYS, parseApiScope, formatApiScope, describeApiScope } from './types.js';
+export { ApiScopeActionSchema, ApiScopeStringSchema, API_TOKEN_LIFETIME_DAYS, parseApiScope, formatApiScope, describeApiScope } from './types.js';
 export type { IApiTokenStore } from './interface.js';
 export type { ScopeTarget } from './scope.js';
-export { scopeAllows, narrowApiTokenContext, outsideTokenOrg } from './scope.js';
-//# sourceMappingURL=index.d.ts.map
+export { scopeAllows, apiScopeActionCovers, narrowApiTokenContext, outsideTokenOrg } from './scope.js';

package/dist/apiTokens/index.js

@@ -1,3 +1,2 @@
-export { ApiScopeActionSchema, ApiScopeStringSchema, ApiTokenRevokeReasonSchema, API_TOKEN_LIFETIME_DAYS, parseApiScope, formatApiScope, describeApiScope } from './types.js';
-export { scopeAllows, narrowApiTokenContext, outsideTokenOrg } from './scope.js';
-//# sourceMappingURL=index.js.map
+export { ApiScopeActionSchema, ApiScopeStringSchema, API_TOKEN_LIFETIME_DAYS, parseApiScope, formatApiScope, describeApiScope } from './types.js';
+export { scopeAllows, apiScopeActionCovers, narrowApiTokenContext, outsideTokenOrg } from './scope.js';

package/dist/apiTokens/interface.d.ts

@@ -34,4 +34,3 @@ export interface IApiTokenStore {
     /** Called from the `deleteOrg` cascade. */
     deleteByOrg(ctx: RequestContext, orgId: string): Promise<void>;
 }
-//# sourceMappingURL=interface.d.ts.map

package/dist/apiTokens/interface.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=interface.js.map

package/dist/apiTokens/scope.d.ts

@@ -14,6 +14,8 @@ export interface ScopeTarget {
  * checked elsewhere.
  */
 export declare function scopeAllows(ctx: RequestContext, action: ApiScopeAction, target?: ScopeTarget): boolean;
+/** Does a scope granting `granted` allow `wanted`? */
+export declare function apiScopeActionCovers(granted: ApiScopeAction, wanted: ApiScopeAction): boolean;
 /**
  * Narrow the owner's live context to what the token grants. Only removes
  * rights:
@@ -24,7 +26,7 @@ export declare function scopeAllows(ctx: RequestContext, action: ApiScopeAction,
  *
  * Scopes this version can't parse are dropped, so they grant nothing.
  */
-export declare function narrowApiTokenContext(ctx: RequestContext, token: Pick<ApiToken, 'id' | 'orgId' | 'scopes'>): RequestContext;
+export declare function narrowApiTokenContext(ctx: RequestContext, token: Pick<ApiToken, 'id' | 'orgId' | 'scopes' | 'expiresAt'>): RequestContext;
 /**
  * True when an API-token request reaches for something owned by an org other
  * than the token's. A token is bound to one org, so that resource doesn't
@@ -32,4 +34,3 @@ export declare function narrowApiTokenContext(ctx: RequestContext, token: Pick<A
  * not found. Session requests are never outside.
  */
 export declare function outsideTokenOrg(ctx: RequestContext, orgId: string): boolean;
-//# sourceMappingURL=scope.d.ts.map

package/dist/apiTokens/scope.js

@@ -12,10 +12,11 @@ export function scopeAllows(ctx, action, target) {
     const api = ctx.apiScope;
     if (!api)
         return true;
-    return api.scopes.some((s) => actionCovers(s.action, action) && resourceCovers(s, ctx, target));
+    return api.scopes.some((s) => apiScopeActionCovers(s.action, action) && resourceCovers(s, ctx, target));
 }
-function actionCovers(granted, wanted) {
-    return granted === wanted || wanted === 'read';
+/** Does a scope granting `granted` allow `wanted`? */
+export function apiScopeActionCovers(granted, wanted) {
+    return granted === wanted || wanted === 'read' || (granted === 'write' && wanted === 'upload');
 }
 function resourceCovers(scope, ctx, target) {
     const { resource } = scope;
@@ -45,7 +46,11 @@ export function narrowApiTokenContext(ctx, token) {
         throw new ProviderError('API token context must act in the token’s org', 500);
     }
     const scopes = token.scopes.map(parseApiScope).filter((s) => s !== null);
-    return { ...ctx, platformPermissions: [], apiScope: { tokenId: token.id, scopes } };
+    return {
+        ...ctx,
+        platformPermissions: [],
+        apiScope: { tokenId: token.id, scopes, expiresAt: token.expiresAt }
+    };
 }
 /**
  * True when an API-token request reaches for something owned by an org other
@@ -56,4 +61,3 @@ export function narrowApiTokenContext(ctx, token) {
 export function outsideTokenOrg(ctx, orgId) {
     return ctx.apiScope !== undefined && orgId !== ctx.actingOrgId;
 }
-//# sourceMappingURL=scope.js.map

package/dist/apiTokens/types.d.ts

@@ -1,9 +1,15 @@
 import { z } from 'zod';
-/** `write` and `solve` each include `read`; neither includes the other. */
+/**
+ * `write`, `solve` and `upload` each include `read`, and `write` includes
+ * `upload`. `upload` covers only creating definitions, uploading versions,
+ * checking a file's schema before upload and making a version live: it can't
+ * edit metadata, delete or share.
+ */
 export declare const ApiScopeActionSchema: z.ZodEnum<{
     read: "read";
     write: "write";
     solve: "solve";
+    upload: "upload";
 }>;
 export type ApiScopeAction = z.infer<typeof ApiScopeActionSchema>;
 /**
@@ -76,4 +82,3 @@ export declare const API_TOKEN_LIFETIME_DAYS: readonly [30, 90, 180];
 export type ApiTokenLifetimeDays = (typeof API_TOKEN_LIFETIME_DAYS)[number];
 /** "Read and change everything in the org". Names no ids, so it suits an email. */
 export declare function describeApiScope(value: string): string;
-//# sourceMappingURL=types.d.ts.map

package/dist/apiTokens/types.js

@@ -1,9 +1,14 @@
 import { z } from 'zod';
-/** `write` and `solve` each include `read`; neither includes the other. */
-export const ApiScopeActionSchema = z.enum(['read', 'write', 'solve']);
+/**
+ * `write`, `solve` and `upload` each include `read`, and `write` includes
+ * `upload`. `upload` covers only creating definitions, uploading versions,
+ * checking a file's schema before upload and making a version live: it can't
+ * edit metadata, delete or share.
+ */
+export const ApiScopeActionSchema = z.enum(['read', 'write', 'solve', 'upload']);
 // Ids are uuids or guids in practice; the charset only has to keep `:` out so
 // the string form stays unambiguous.
-const SCOPE_PATTERN = /^(read|write|solve):(all|(org|project|definition):([A-Za-z0-9_-]{1,128}))$/;
+const SCOPE_PATTERN = /^(read|write|solve|upload):(all|(org|project|definition):([A-Za-z0-9_-]{1,128}))$/;
 /** `read:all`, `write:org:<id>`, `solve:project:<id>`, `read:definition:<guid>`. */
 export function parseApiScope(value) {
     const m = SCOPE_PATTERN.exec(value);
@@ -37,7 +42,8 @@ export const API_TOKEN_LIFETIME_DAYS = [30, 90, 180];
 const ACTION_WORDS = {
     read: 'Read',
     write: 'Read and change',
-    solve: 'Read and run solves on'
+    solve: 'Read and run solves on',
+    upload: 'Read and upload definitions to'
 };
 /** "Read and change everything in the org". Names no ids, so it suits an email. */
 export function describeApiScope(value) {
@@ -51,4 +57,3 @@ export function describeApiScope(value) {
             : 'everything in the org';
     return `${ACTION_WORDS[scope.action]} ${what}`;
 }
-//# sourceMappingURL=types.js.map

package/dist/auth/index.d.ts

@@ -1,3 +1,2 @@
 export type { AuthUser, UserManagementResult, LoginResult } from './types.js';
 export type { IAuthProvider, IOAuthAuth, ISessionRefresh, IPasswordAuth, IEmailLinkAuth, IProxyAuth, IDelegatedSession, DelegatedSessionStatus } from './interface.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=index.js.map

package/dist/auth/interface.d.ts

@@ -30,9 +30,8 @@ export interface IPasswordAuth {
  *      `getOAuthAuthorizationUrl` and 303s to the result.
  *   2. IdP redirects back to `/auth/{provider}/callback?code=...` → server
  *      calls `exchangeOAuthCode` to mint the session pair.
- *   3. When the access token expires, session-refresh middleware in
- *      `hooks.server.ts` calls `refreshSession` to swap in a fresh pair
- *      without bouncing the user.
+ *
+ * Keeping the session alive afterwards is `ISessionRefresh`'s job.
  *
  * Each method returns `null` rather than throwing on irrecoverable
  * credential failures, so the route layer can pick the right HTTP shape
@@ -64,23 +63,6 @@ export interface IOAuthAuth {
         sessionToken: string;
         refreshToken: string;
     } | null>;
-    /**
-     * Swap a refresh token for a fresh access/refresh pair. Returns null on
-     * irrecoverable failure (revoked, expired, signed by a different secret);
-     * the session-refresh middleware treats null as "force re-login" by
-     * clearing the refresh cookie.
-     *
-     * @deprecated Session refresh is session lifecycle, not OAuth — a consumer
-     * that brokers no OAuth still needs it (refreshing a password session, or
-     * revoking on logout). Moved to `IAuthProvider.sessionRefresh`
-     * (`ISessionRefresh`). This member delegates for one release and will be
-     * removed in the next minor; migrate callers to
-     * `auth.sessionRefresh?.refreshSession(...)`.
-     */
-    refreshSession(refreshToken: string): Promise<{
-        sessionToken: string;
-        refreshToken: string;
-    } | null>;
 }
 /**
  * Optional session-lifecycle surface: refresh an expiring session, revoke one
@@ -245,8 +227,8 @@ export interface IDelegatedSession {
      */
     status(): Promise<DelegatedSessionStatus>;
     /**
-     * A session token acting as `userId` inside `orgId`, valid for about a
-     * minute. It carries no instance-admin rights, whatever the user holds: those
+     * A session token acting as `userId` inside `orgId`, valid for `ttlSeconds`
+     * (default 60 s). It carries no instance-admin rights, whatever the user holds: those
      * never ride on a bearer key. Throws if `status` isn't ok.
      */
     mint(userId: string, opts: {
@@ -327,4 +309,3 @@ export interface IAuthProvider {
      */
     touchLastLogin?(id: string): Promise<void>;
 }
-//# sourceMappingURL=interface.d.ts.map

package/dist/auth/interface.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=interface.js.map

package/dist/auth/types.d.ts

@@ -21,7 +21,10 @@ export interface AuthUser {
  * - `last_admin`    — refused; would leave zero `instance_admin` users
  */
 export type UserManagementResult = 'ok' | 'not_found' | 'not_supported' | 'last_admin';
-/** `success` includes the session token the provider minted. */
+/**
+ * `success` includes the session token the provider minted. `rate_limited` is for
+ * providers that throttle logins; no bundled provider returns it.
+ */
 export type LoginResult = {
     kind: 'success';
     user: AuthUser;
@@ -30,4 +33,3 @@ export type LoginResult = {
     kind: 'failed';
     reason?: 'invalid_credentials' | 'disabled' | 'rate_limited';
 };
-//# sourceMappingURL=types.d.ts.map

package/dist/auth/types.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=types.js.map

package/dist/bindings/index.d.ts

@@ -1,3 +1,2 @@
 export type { IBindingResolver } from './interface.js';
 export { NoopBindingResolver } from './interface.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/bindings/index.js

@@ -1,2 +1 @@
 export { NoopBindingResolver } from './interface.js';
-//# sourceMappingURL=index.js.map

package/dist/bindings/interface.d.ts

@@ -37,4 +37,3 @@ export interface IBindingResolver {
 export declare class NoopBindingResolver implements IBindingResolver {
     resolve(): Promise<Map<string, unknown>>;
 }
-//# sourceMappingURL=interface.d.ts.map

package/dist/bindings/interface.js

@@ -17,4 +17,3 @@ export class NoopBindingResolver {
         return new Map();
     }
 }
-//# sourceMappingURL=interface.js.map

package/dist/computeServer/index.d.ts

@@ -1,8 +1,2 @@
-export type { ComputeServerConfig, ComputeConfig, PlatformComputeServer, OrgComputeServer } from './types.js';
-export { isPlatformServer, isOrgServer } from './types.js';
-export type { IComputeServerStore, GetConfigOptions } from './interface.js';
+export * from './public.js';
 export { isEncryptedSecret, encryptSecret, decryptSecret, decodeSecretKey } from './secrets.js';
-export type { SecretVerificationReport, SecretVerificationFailure, SecretVerificationFailureReason } from './secrets.js';
-export type { ResolveOptions } from './utils.js';
-export { serversVisibleTo, defaultServerIdFor, resolveServerForOrg, findServerById, platformServers, orgServersFor, scopeConfigToOrg } from './utils.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/computeServer/index.js

@@ -1,9 +1,3 @@
-export { isPlatformServer, isOrgServer } from './types.js';
-// At-rest secret crypto (uses `node:crypto`). Server-only — deliberately NOT
-// re-exported from the root barrel, which client `.svelte` code imports and
-// where a browser bundle can't resolve `node:crypto`. Import these from
-// `@selvajs/platform/computeServer` in server code. The report TYPES are erased
-// at build, so they also stay re-exported from the root barrel for convenience.
+export * from './public.js';
+// Server-only: import these from `@selvajs/platform/computeServer`.
 export { isEncryptedSecret, encryptSecret, decryptSecret, decodeSecretKey } from './secrets.js';
-export { serversVisibleTo, defaultServerIdFor, resolveServerForOrg, findServerById, platformServers, orgServersFor, scopeConfigToOrg } from './utils.js';
-//# sourceMappingURL=index.js.map

package/dist/computeServer/interface.d.ts

@@ -28,10 +28,9 @@ export interface GetConfigOptions {
      *
      * Org-facing surfaces must pass this. Without it the store hands back every
      * platform server and every *other* org's private servers, leaving each
-     * caller to re-apply a filter it can silently forget — the global
-     * `defaultServerId` in particular passed straight through before this
-     * existed. Admin surfaces, boot health and the save-diff handlers omit it
-     * deliberately; they act instance-wide.
+     * caller to re-apply a filter it can silently forget. Admin surfaces, boot
+     * health and the save-diff handlers omit it deliberately; they act
+     * instance-wide.
      */
     scopeToOrgId?: string;
 }
@@ -53,6 +52,10 @@ export interface IComputeServerStore {
      * authenticated under the current `SELVA_AT_REST_KEY` (the solve fails
      * later at Rhino.Compute rather than here).
      *
+     * A plaintext key at rest is adapter-defined: local throws, because it never
+     * writes one, and Supabase warns and returns it, because rows can predate
+     * encryption. Both report it through `verifySecrets`.
+     *
      * The narrow path onto the solve hot path: resolve a server from the
      * key-free config, then fetch that one key.
      */
@@ -61,7 +64,8 @@ export interface IComputeServerStore {
     savePlatformServers(ctx: RequestContext, servers: ComputeServerConfig[], defaultServerId: string | undefined): Promise<void>;
     /**
      * Replaces the org-private server set for `orgId` and (optionally) updates
-     * `orgDefaults[orgId]`. Platform rows are left untouched.
+     * `orgDefaults[orgId]`. Platform rows are left untouched, and any non-org entry
+     * in `servers` is ignored.
      *
      * `defaultServerId: null` clears the org's override; `undefined` leaves
      * the existing value alone.
@@ -90,4 +94,3 @@ export interface IComputeServerStore {
      */
     verifySecrets?(): Promise<SecretVerificationReport>;
 }
-//# sourceMappingURL=interface.d.ts.map

package/dist/computeServer/interface.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=interface.js.map

package/dist/computeServer/public.d.ts

@@ -0,0 +1,6 @@
+export type { ComputeServerConfig, ComputeConfig, PlatformComputeServer, OrgComputeServer } from './types.js';
+export { COMPUTE_RETRY_MAX, COMPUTE_TIMEOUT_DEFAULT_MS, COMPUTE_TIMEOUT_MAX_MS, COMPUTE_TIMEOUT_MIN_MS, isPlatformServer, isOrgServer } from './types.js';
+export type { IComputeServerStore, GetConfigOptions } from './interface.js';
+export type { ResolveOptions } from './utils.js';
+export { serversVisibleTo, defaultServerIdFor, clampRetryCount, clampTimeoutMs, pickServer, resolveServerForOrg, findServerById, platformServers, scopeConfigToOrg } from './utils.js';
+export type { SecretVerificationReport, SecretVerificationFailure, SecretVerificationFailureReason } from './secrets.js';

package/dist/computeServer/public.js

@@ -0,0 +1,2 @@
+export { COMPUTE_RETRY_MAX, COMPUTE_TIMEOUT_DEFAULT_MS, COMPUTE_TIMEOUT_MAX_MS, COMPUTE_TIMEOUT_MIN_MS, isPlatformServer, isOrgServer } from './types.js';
+export { serversVisibleTo, defaultServerIdFor, clampRetryCount, clampTimeoutMs, pickServer, resolveServerForOrg, findServerById, platformServers, scopeConfigToOrg } from './utils.js';

package/dist/computeServer/secrets.d.ts

@@ -1,8 +1,12 @@
+export declare function isEncryptedSecret(value: string): boolean;
 /**
  * AES-256-GCM envelope for at-rest secrets (e.g. compute API keys).
  *
- * Wire format: `enc:v1:<base64(iv|tag|ciphertext)>`. The version prefix lets
- * a future migration to a new algorithm tell old and new envelopes apart.
+ * Wire format: `enc:v2:<base64(iv|tag|ciphertext)>`. `v2` authenticates the
+ * record the secret belongs to as AAD, so ciphertext copied onto another record
+ * fails to decrypt instead of handing the plaintext to that record's URL.
+ * `enc:v1:` envelopes have no AAD and still read: a store rewrites them as `v2`
+ * on its next save.
  *
  * Defends against backup leaks, accidental file/DB sharing, and read-only
  * storage access — not against an attacker who also has the master key
@@ -11,10 +15,13 @@
  *
  * Pure `node:crypto`, no fs or DB coupling, so the local and Supabase
  * compute-server stores share this one implementation.
+ *
+ * Pass `aad` to bind the secret to its record. {@link decryptSecret} then needs the
+ * same value.
  */
-export declare function isEncryptedSecret(value: string): boolean;
-export declare function encryptSecret(plaintext: string, key: Buffer): string;
-export declare function decryptSecret(envelope: string, key: Buffer): string;
+export declare function encryptSecret(plaintext: string, key: Buffer, aad?: string): string;
+/** `aad` is ignored for an `enc:v1:` envelope and required for an `enc:v2:` one. */
+export declare function decryptSecret(envelope: string, key: Buffer, aad?: string): string;
 /**
  * Decodes a `SELVA_AT_REST_KEY` env var into a 32-byte buffer (64-char hex or
  * base64, with or without padding). Throws on anything else so a
@@ -46,4 +53,3 @@ export interface SecretVerificationReport {
     /** True if at least one row holds an unencrypted apiKey at rest. */
     plaintextFound: boolean;
 }
-//# sourceMappingURL=secrets.d.ts.map