@selvajs/platform 0.21.0-beta.2 → 1.0.0-beta.4

package/dist/errors.js

@@ -2,12 +2,22 @@
  * Thrown by providers to signal an expected failure the API layer forwards with
  * a specific status. Unknown errors should propagate as plain `Error` and become 500s.
  */
+const BRAND = Symbol.for('@selvajs/platform/ProviderError');
 export class ProviderError extends Error {
     statusCode;
+    [BRAND] = true;
+    /**
+     * Providers depend on this package, so a version mismatch installs two copies
+     * and plain `instanceof` would turn a 403 from one into a 500 in the other.
+     */
+    static [Symbol.hasInstance](value) {
+        if (this !== ProviderError)
+            return Function.prototype[Symbol.hasInstance].call(this, value);
+        return typeof value === 'object' && value !== null && BRAND in value;
+    }
     constructor(message, statusCode = 400) {
         super(message);
         this.name = 'ProviderError';
         this.statusCode = statusCode;
     }
 }
-//# sourceMappingURL=errors.js.map

package/dist/events/audit.d.ts

@@ -34,7 +34,7 @@ export interface AuditQueryFilters {
     /** Inclusive bounds, ISO 8601. */
     sinceIso?: string;
     untilIso?: string;
-    /** Implementations clamp to a sane upper bound (<=200). */
+    /** Implementations clamp to at least 1 and at most 200. */
     limit?: number;
     cursor?: AuditCursor;
 }
@@ -46,4 +46,3 @@ export interface AuditQueryResult {
 export interface IAuditQuery {
     list(ctx: RequestContext, filters: AuditQueryFilters): Promise<AuditQueryResult>;
 }
-//# sourceMappingURL=audit.d.ts.map

package/dist/events/audit.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=audit.js.map

package/dist/events/index.d.ts

@@ -1,4 +1,3 @@
 export type { DomainEvent, DomainEventType, IEventSink } from './interface.js';
 export { actorFrom, actorOf, NoopEventSink, AUDIT_EVENT_VERSION } from './interface.js';
 export type { AuditEventRow, AuditCursor, AuditQueryFilters, AuditQueryResult, IAuditQuery } from './audit.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/events/index.js

@@ -1,2 +1 @@
 export { actorFrom, actorOf, NoopEventSink, AUDIT_EVENT_VERSION } from './interface.js';
-//# sourceMappingURL=index.js.map

package/dist/events/interface.d.ts

@@ -227,4 +227,3 @@ export declare class NoopEventSink implements IEventSink {
     emit(_event: DomainEvent): Promise<void>;
 }
 export {};
-//# sourceMappingURL=interface.d.ts.map

package/dist/events/interface.js

@@ -21,4 +21,3 @@ export function actorOf(ctx) {
 export class NoopEventSink {
     async emit(_event) { }
 }
-//# sourceMappingURL=interface.js.map

package/dist/index.d.ts

@@ -1,58 +1,20 @@
-export type { AuthUser, UserManagementResult, LoginResult } from './auth/types.js';
-export type { IAuthProvider, IOAuthAuth, ISessionRefresh, IPasswordAuth, IEmailLinkAuth, IProxyAuth, IDelegatedSession, DelegatedSessionStatus } from './auth/interface.js';
-export type { PlatformPermission } from './permissions/types.js';
-export { PlatformPermissionSchema, ALL_PLATFORM_PERMISSIONS, OPERATOR_PLATFORM_PERMISSIONS } from './permissions/types.js';
-export type { IPlatformPermissionStore } from './permissions/interface.js';
-export type { IUserProfileStore } from './userProfile/interface.js';
-export type { UserProfile, RecentRun } from './userProfile/types.js';
-export { emptyProfile } from './userProfile/types.js';
-export type { Organization, OrgMember, OrgAssets } from './organizations/types.js';
-export type { IOrgStore } from './organizations/interface.js';
-export { orgPaths } from './organizations/paths.js';
-export type { OrgRole, OrgPermission, OrgAssetKind, CreateOrgInput, UpdateOrgInput } from './organizations/schemas.js';
-export { OrgRoleSchema, OrgPermissionSchema, OrgAssetKindSchema, ALL_ORG_ASSET_KINDS, SlugSchema, slugify, RESERVED_SLUGS, CreateOrgSchema, UpdateOrgSchema, ALL_ORG_PERMISSIONS, DEFAULT_ORG_PERMISSIONS, OWNER_ADMIN_ONLY_PERMISSIONS, MEMBER_ASSIGNABLE_PERMISSIONS } from './organizations/schemas.js';
-export type { Invite } from './invites/types.js';
-export type { IInviteStore } from './invites/interface.js';
-export type { ApiScope, ApiScopeAction, ApiScopeResource, ApiToken, ApiTokenSummary, ApiTokenRevokeReason, ApiTokenLifetimeDays, IApiTokenStore, ScopeTarget } from './apiTokens/index.js';
-export { ApiScopeActionSchema, ApiScopeStringSchema, ApiTokenRevokeReasonSchema, API_TOKEN_LIFETIME_DAYS, parseApiScope, formatApiScope, describeApiScope, scopeAllows, narrowApiTokenContext, outsideTokenOrg } from './apiTokens/index.js';
-export type { Project, ProjectMember } from './projects/types.js';
-export type { IProjectStore } from './projects/interface.js';
-export type { ProjectVisibility, ProjectRole } from './projects/schemas.js';
-export { ProjectVisibilitySchema, ProjectRoleSchema, validateProjectFlags } from './projects/schemas.js';
-export type { PlatformProjectGrant, PlatformProjectGranteeType } from './platformProjects/types.js';
-export type { IPlatformProjectGrantStore } from './platformProjects/interface.js';
-export { PlatformProjectGrantSchema, PlatformProjectGranteeTypeSchema } from './platformProjects/schemas.js';
-export type { DefinitionFileExt, DefinitionListItem, DefinitionRecord, DefinitionRecordPatch, DefinitionStatus, DefinitionVersion, DefinitionChannel } from './definitions/types.js';
-export type { IDefinitionStore } from './definitions/interface.js';
-export type { UISchema } from '@selvajs/schemas';
-export { GH_EXTENSIONS, COVER_IMAGE_EXTENSIONS, ALLOWED_UPLOAD_EXTENSIONS, COVER_IMAGE_CONTENT_TYPES, toDefinitionListItem } from './definitions/types.js';
-export { definitionPaths } from './definitions/paths.js';
-export type { UpdateMetadataInput } from './definitions/schemas.js';
-export { DefinitionChannelSchema, PublishVersionInputSchema, CreateDefinitionInputSchema, UpdateMetadataInputSchema, GuidSchema, UUID_REGEX } from './definitions/schemas.js';
-export type { OrgShareLink, ShareLink } from './shareLinks/types.js';
-export type { IShareLinkStore } from './shareLinks/interface.js';
-export { DEFAULT_SHARE_LINK_MAX_SOLVES } from './shareLinks/types.js';
-export type { CreateShareLinkInput } from './shareLinks/schemas.js';
-export { CreateShareLinkInputSchema } from './shareLinks/schemas.js';
-export type { IStorageProvider } from './storage/interface.js';
-export { IMAGE_MAX_WIDTH, IMAGE_WEBP_QUALITY, isImageUpload, toWebpPath, transcodeImageIfNeeded } from './storage/image.js';
-export type { TranscodeResult } from './storage/image.js';
-export { ASSET_CLASSES, classifyAssetPath, isPublicAssetPath } from './storage/assetClasses.js';
-export type { AssetVisibility, AssetScope, AssetClass, AssetMatch } from './storage/assetClasses.js';
-export { withCacheBust } from './storage/cacheBust.js';
-export type { IDataProvider, SchemaVersionReport, UserErasureOptions } from './data/interface.js';
-export { ERASED_ACTOR_ID } from './data/interface.js';
-export type { ComputeServerConfig, ComputeConfig, PlatformComputeServer, OrgComputeServer } from './computeServer/types.js';
-export { isPlatformServer, isOrgServer } from './computeServer/types.js';
-export type { IComputeServerStore, GetConfigOptions } from './computeServer/interface.js';
-export type { SecretVerificationReport, SecretVerificationFailure, SecretVerificationFailureReason } from './computeServer/secrets.js';
-export type { ResolveOptions } from './computeServer/utils.js';
-export { serversVisibleTo, defaultServerIdFor, resolveServerForOrg, findServerById, platformServers, orgServersFor, scopeConfigToOrg } from './computeServer/utils.js';
-export type { ProjectAccessInput, DefinitionAccessInput, VisibilityChangeInput, ReclaimAccessInput, CreateProjectAccessInput, OrgOwnerAuthorityInput, OwnerRemovalInput, OwnerRemovalCheck } from './access/rules.js';
-export { canView, canSolve, canEdit, canManage, canEditProjectSettings, canChangeVisibilityToPublic, canEditDefinition, canReclaim, canCreateProject, canChangeOrgRole, checkOwnerRemoval, withAdminBypass } from './access/rules.js';
-export type { DomainEvent, DomainEventType, IEventSink } from './events/interface.js';
-export { actorFrom, actorOf, NoopEventSink, AUDIT_EVENT_VERSION } from './events/interface.js';
-export type { AuditEventRow, AuditCursor, AuditQueryFilters, AuditQueryResult, IAuditQuery } from './events/audit.js';
+export * from './access/index.js';
+export * from './apiTokens/index.js';
+export * from './auth/index.js';
+export * from './computeServer/public.js';
+export * from './data/index.js';
+export * from './definitions/index.js';
+export * from './events/index.js';
+export * from './invites/index.js';
+export * from './notifications/index.js';
+export * from './organizations/index.js';
+export * from './permissions/index.js';
+export * from './platformProjects/index.js';
+export * from './projects/index.js';
+export * from './shareLinks/index.js';
+export * from './storage/index.js';
+export * from './userProfile/index.js';
+export * from './utils/index.js';
 export type { ISolveMetricSink, SolveMetric, SolveFailureKind } from './metrics/interface.js';
 export { NoopSolveMetricSink } from './metrics/interface.js';
 export type { ISolveResultCache, SolveCacheKey, SolveCacheSetOptions } from './solveCache/interface.js';
@@ -61,17 +23,12 @@ export type { IErrorReporter, ErrorContext } from './errors/interface.js';
 export { NoopErrorReporter } from './errors/interface.js';
 export type { ILogger, LogFields, LogLevel } from './logging/interface.js';
 export { NoopLogger } from './logging/interface.js';
-export type { INotificationProvider, NotificationKind, OutboundMessage, SendResult } from './notifications/index.js';
-export { NoopNotificationProvider } from './notifications/index.js';
 export type { IBindingResolver } from './bindings/interface.js';
 export { NoopBindingResolver } from './bindings/interface.js';
-export type { AuditUpdate, AuditSoftDelete } from './utils/audit.js';
-export { auditUpdate, auditSoftDelete } from './utils/audit.js';
 export type { RequestContext } from './context.js';
 export { SYSTEM_CONTEXT, hasPermission, requireActingOrg, isShareContext, assertNotShareContext } from './context.js';
 export type { ListOptions, DefinitionListOptions, Page } from './pagination.js';
-export { DEFAULT_PAGE_LIMIT, MAX_PAGE_LIMIT } from './pagination.js';
+export { DEFAULT_PAGE_LIMIT, MAX_PAGE_LIMIT, clampPageLimit, decodeOffsetCursor, encodeOffsetCursor } from './pagination.js';
 export type { TenancyMode, SelvaFlags, SelvaBranding, SelvaConfig, SelvaConfigFactory } from './config.js';
 export { isFlagEnabled, defineConfig } from './config.js';
 export { ProviderError } from './errors.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -1,33 +1,27 @@
 // @selvajs/platform — published API contract. Every symbol here is breaking-change-protected.
-export { PlatformPermissionSchema, ALL_PLATFORM_PERMISSIONS, OPERATOR_PLATFORM_PERMISSIONS } from './permissions/types.js';
-export { emptyProfile } from './userProfile/types.js';
-export { orgPaths } from './organizations/paths.js';
-export { OrgRoleSchema, OrgPermissionSchema, OrgAssetKindSchema, ALL_ORG_ASSET_KINDS, SlugSchema, slugify, RESERVED_SLUGS, CreateOrgSchema, UpdateOrgSchema, ALL_ORG_PERMISSIONS, DEFAULT_ORG_PERMISSIONS, OWNER_ADMIN_ONLY_PERMISSIONS, MEMBER_ASSIGNABLE_PERMISSIONS } from './organizations/schemas.js';
-export { ApiScopeActionSchema, ApiScopeStringSchema, ApiTokenRevokeReasonSchema, API_TOKEN_LIFETIME_DAYS, parseApiScope, formatApiScope, describeApiScope, scopeAllows, narrowApiTokenContext, outsideTokenOrg } from './apiTokens/index.js';
-export { ProjectVisibilitySchema, ProjectRoleSchema, validateProjectFlags } from './projects/schemas.js';
-export { PlatformProjectGrantSchema, PlatformProjectGranteeTypeSchema } from './platformProjects/schemas.js';
-export { GH_EXTENSIONS, COVER_IMAGE_EXTENSIONS, ALLOWED_UPLOAD_EXTENSIONS, COVER_IMAGE_CONTENT_TYPES, toDefinitionListItem } from './definitions/types.js';
-export { definitionPaths } from './definitions/paths.js';
-export { DefinitionChannelSchema, PublishVersionInputSchema, CreateDefinitionInputSchema, UpdateMetadataInputSchema, GuidSchema, UUID_REGEX } from './definitions/schemas.js';
-export { DEFAULT_SHARE_LINK_MAX_SOLVES } from './shareLinks/types.js';
-export { CreateShareLinkInputSchema } from './shareLinks/schemas.js';
-export { IMAGE_MAX_WIDTH, IMAGE_WEBP_QUALITY, isImageUpload, toWebpPath, transcodeImageIfNeeded } from './storage/image.js';
-export { ASSET_CLASSES, classifyAssetPath, isPublicAssetPath } from './storage/assetClasses.js';
-export { withCacheBust } from './storage/cacheBust.js';
-export { ERASED_ACTOR_ID } from './data/interface.js';
-export { isPlatformServer, isOrgServer } from './computeServer/types.js';
-export { serversVisibleTo, defaultServerIdFor, resolveServerForOrg, findServerById, platformServers, orgServersFor, scopeConfigToOrg } from './computeServer/utils.js';
-export { canView, canSolve, canEdit, canManage, canEditProjectSettings, canChangeVisibilityToPublic, canEditDefinition, canReclaim, canCreateProject, canChangeOrgRole, checkOwnerRemoval, withAdminBypass } from './access/rules.js';
-export { actorFrom, actorOf, NoopEventSink, AUDIT_EVENT_VERSION } from './events/interface.js';
+export * from './access/index.js';
+export * from './apiTokens/index.js';
+export * from './auth/index.js';
+export * from './computeServer/public.js';
+export * from './data/index.js';
+export * from './definitions/index.js';
+export * from './events/index.js';
+export * from './invites/index.js';
+export * from './notifications/index.js';
+export * from './organizations/index.js';
+export * from './permissions/index.js';
+export * from './platformProjects/index.js';
+export * from './projects/index.js';
+export * from './shareLinks/index.js';
+export * from './storage/index.js';
+export * from './userProfile/index.js';
+export * from './utils/index.js';
 export { NoopSolveMetricSink } from './metrics/interface.js';
 export { NoopSolveResultCache } from './solveCache/interface.js';
 export { NoopErrorReporter } from './errors/interface.js';
 export { NoopLogger } from './logging/interface.js';
-export { NoopNotificationProvider } from './notifications/index.js';
 export { NoopBindingResolver } from './bindings/interface.js';
-export { auditUpdate, auditSoftDelete } from './utils/audit.js';
 export { SYSTEM_CONTEXT, hasPermission, requireActingOrg, isShareContext, assertNotShareContext } from './context.js';
-export { DEFAULT_PAGE_LIMIT, MAX_PAGE_LIMIT } from './pagination.js';
+export { DEFAULT_PAGE_LIMIT, MAX_PAGE_LIMIT, clampPageLimit, decodeOffsetCursor, encodeOffsetCursor } from './pagination.js';
 export { isFlagEnabled, defineConfig } from './config.js';
 export { ProviderError } from './errors.js';
-//# sourceMappingURL=index.js.map

package/dist/invites/index.d.ts

@@ -1,3 +1,2 @@
 export type { Invite } from './types.js';
 export type { IInviteStore } from './interface.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/invites/index.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=index.js.map

package/dist/invites/interface.d.ts

@@ -18,7 +18,8 @@ export interface IInviteStore {
     getByTokenHash(ctx: RequestContext, tokenHash: string): Promise<Invite | null>;
     listByOrg(ctx: RequestContext, orgId: string, opts?: ListOptions): Promise<Page<Invite>>;
     /** No-op if already accepted. */
-    markAccepted(ctx: RequestContext, id: string, userId: string): Promise<void>;
+    /** True if this call accepted the invite, false if it was already accepted or is gone. */
+    markAccepted(ctx: RequestContext, id: string, userId: string): Promise<boolean>;
     /** No-op if already consumed or missing. */
     revoke(ctx: RequestContext, id: string): Promise<void>;
     /**
@@ -26,10 +27,9 @@ export interface IInviteStore {
      * revoked. Accepted invites are left alone — consuming one is history, not
      * a live grant.
      *
-     * Offboarding needs this: `removeOrgMember` cascades `project_members` but
-     * has never touched invites, so a dormant invite let a removed user walk
-     * back in at their original role for the rest of its TTL. Matching by email
-     * rather than user id is deliberate — an invite names an address, and the
+     * Offboarding needs this: `removeOrgMember` does not touch invites, so a
+     * dormant invite would let a removed user walk back in at their original role
+     * for the rest of its TTL. Matching by email rather than user id is deliberate — an invite names an address, and the
      * account it will create may not exist yet.
      *
      * One call rather than list-then-revoke-each: the loop would race a
@@ -39,4 +39,3 @@ export interface IInviteStore {
     /** Called from the `deleteOrg` cascade — invites to a deleted org are unredeemable orphans otherwise. */
     deleteByOrg(ctx: RequestContext, orgId: string): Promise<void>;
 }
-//# sourceMappingURL=interface.d.ts.map

package/dist/invites/interface.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=interface.js.map

package/dist/invites/types.d.ts

@@ -39,4 +39,3 @@ export interface Invite {
     acceptedAt?: string;
     acceptedByUserId?: string;
 }
-//# sourceMappingURL=types.d.ts.map

package/dist/invites/types.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=types.js.map

package/dist/logging/interface.d.ts

@@ -65,4 +65,3 @@ export declare class NoopLogger implements ILogger {
     error(_message: string, _fields?: LogFields): void;
     child(_fields: LogFields): ILogger;
 }
-//# sourceMappingURL=interface.d.ts.map

package/dist/logging/interface.js

@@ -22,4 +22,3 @@ export class NoopLogger {
         return this;
     }
 }
-//# sourceMappingURL=interface.js.map

package/dist/metrics/interface.d.ts

@@ -71,4 +71,3 @@ export interface ISolveMetricSink {
 export declare class NoopSolveMetricSink implements ISolveMetricSink {
     record(_ctx: RequestContext, _metric: SolveMetric): Promise<void>;
 }
-//# sourceMappingURL=interface.d.ts.map

package/dist/metrics/interface.js

@@ -2,4 +2,3 @@
 export class NoopSolveMetricSink {
     async record(_ctx, _metric) { }
 }
-//# sourceMappingURL=interface.js.map

package/dist/notifications/index.d.ts

@@ -1,4 +1,3 @@
 export type { NotificationKind, OutboundMessage, SendResult } from './types.js';
 export type { INotificationProvider } from './interface.js';
 export { NoopNotificationProvider } from './interface.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/notifications/index.js

@@ -1,2 +1 @@
 export { NoopNotificationProvider } from './interface.js';
-//# sourceMappingURL=index.js.map

package/dist/notifications/interface.d.ts

@@ -35,12 +35,10 @@ export interface INotificationProvider {
  * Default `INotificationProvider` — sends nothing, reports `not-configured`.
  *
  * Mail is optional in every deployment, so this is a supported wiring rather
- * than a test double: callers already handle `not-configured` as "no mail",
- * which keeps the no-SMTP path identical to the pre-notification behaviour.
+ * than a test double: callers already handle `not-configured` as "no mail".
  */
 export declare class NoopNotificationProvider implements INotificationProvider {
     readonly name = "None";
     send(_message: OutboundMessage, _log?: ILogger): Promise<SendResult>;
     isConfigured(): boolean;
 }
-//# sourceMappingURL=interface.d.ts.map

package/dist/notifications/interface.js

@@ -2,8 +2,7 @@
  * Default `INotificationProvider` — sends nothing, reports `not-configured`.
  *
  * Mail is optional in every deployment, so this is a supported wiring rather
- * than a test double: callers already handle `not-configured` as "no mail",
- * which keeps the no-SMTP path identical to the pre-notification behaviour.
+ * than a test double: callers already handle `not-configured` as "no mail".
  */
 export class NoopNotificationProvider {
     name = 'None';
@@ -14,4 +13,3 @@ export class NoopNotificationProvider {
         return false;
     }
 }
-//# sourceMappingURL=interface.js.map

package/dist/notifications/types.d.ts

@@ -37,4 +37,3 @@ export type SendResult = {
     status: 'failed';
     reason: string;
 };
-//# sourceMappingURL=types.d.ts.map

package/dist/notifications/types.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=types.js.map

package/dist/organizations/index.d.ts

@@ -1,6 +1,5 @@
 export type { Organization, OrgMember, OrgAssets } from './types.js';
 export type { IOrgStore } from './interface.js';
 export { orgPaths } from './paths.js';
-export type { OrgRole, OrgPermission, OrgAssetKind, CreateOrgInput, UpdateOrgInput } from './schemas.js';
-export { OrgRoleSchema, OrgPermissionSchema, OrgAssetKindSchema, ALL_ORG_ASSET_KINDS, SlugSchema, slugify, RESERVED_SLUGS, CreateOrgSchema, UpdateOrgSchema, ALL_ORG_PERMISSIONS, DEFAULT_ORG_PERMISSIONS, OWNER_ADMIN_ONLY_PERMISSIONS, MEMBER_ASSIGNABLE_PERMISSIONS } from './schemas.js';
-//# sourceMappingURL=index.d.ts.map
+export type { OrgRole, OrgPermission, OrgAssetKind } from './schemas.js';
+export { OrgRoleSchema, OrgPermissionSchema, OrgAssetKindSchema, SlugSchema, slugify, RESERVED_SLUGS, orgSlugFromName, CreateOrgSchema, UpdateOrgSchema, ALL_ORG_PERMISSIONS, DEFAULT_ORG_PERMISSIONS, OWNER_ADMIN_ONLY_PERMISSIONS, MEMBER_ASSIGNABLE_PERMISSIONS } from './schemas.js';

package/dist/organizations/index.js

@@ -1,3 +1,2 @@
 export { orgPaths } from './paths.js';
-export { OrgRoleSchema, OrgPermissionSchema, OrgAssetKindSchema, ALL_ORG_ASSET_KINDS, SlugSchema, slugify, RESERVED_SLUGS, CreateOrgSchema, UpdateOrgSchema, ALL_ORG_PERMISSIONS, DEFAULT_ORG_PERMISSIONS, OWNER_ADMIN_ONLY_PERMISSIONS, MEMBER_ASSIGNABLE_PERMISSIONS } from './schemas.js';
-//# sourceMappingURL=index.js.map
+export { OrgRoleSchema, OrgPermissionSchema, OrgAssetKindSchema, SlugSchema, slugify, RESERVED_SLUGS, orgSlugFromName, CreateOrgSchema, UpdateOrgSchema, ALL_ORG_PERMISSIONS, DEFAULT_ORG_PERMISSIONS, OWNER_ADMIN_ONLY_PERMISSIONS, MEMBER_ASSIGNABLE_PERMISSIONS } from './schemas.js';

package/dist/organizations/interface.d.ts

@@ -13,10 +13,9 @@ export interface IOrgStore {
     createOrg(ctx: RequestContext, org: Organization): Promise<void>;
     updateOrg(ctx: RequestContext, id: string, patch: Partial<Pick<Organization, 'name' | 'slug' | 'assets'>>): Promise<void>;
     /**
-     * Soft-deletes the org, cascading to org members, projects, and project
-     * members (definitions and share links cascade through project deletion).
-     * Invites and the org compute-server override are NOT cascaded — clean
-     * those up explicitly if needed.
+     * Soft-deletes the org, cascading to org members, projects, project members and
+     * definitions. Share links die with their definition. Hard-deletes its invites,
+     * API tokens, compute servers and compute defaults.
      */
     deleteOrg(ctx: RequestContext, id: string): Promise<void>;
     listOrgMembers(ctx: RequestContext, orgId: string, opts?: ListOptions): Promise<Page<OrgMember>>;
@@ -47,4 +46,3 @@ export interface IOrgStore {
     updateOrgMemberPermissions(ctx: RequestContext, orgId: string, userId: string, permissions: readonly OrgPermission[]): Promise<void>;
     removeOrgMember(ctx: RequestContext, orgId: string, userId: string): Promise<void>;
 }
-//# sourceMappingURL=interface.d.ts.map

package/dist/organizations/interface.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=interface.js.map

package/dist/organizations/paths.d.ts

@@ -6,14 +6,9 @@ import type { OrgAssetKind } from './schemas.js';
  *
  * Branding lives under `orgs/{id}/branding/` because it's a *public* asset
  * class — anyone, including logged-out viewers, may read a company logo.
- * That segment distinguishes it from `orgs/{id}/private/` (members-only).
- * `classifyAssetPath` / `ASSET_CLASSES` decide public-vs-private from these
- * prefixes.
+ * `classifyAssetPath` / `ASSET_CLASSES` decide visibility from these prefixes.
  */
 export declare const orgPaths: {
     readonly asset: (id: string, kind: OrgAssetKind) => string;
-    /** Members-only blob; `name` includes the extension. */
-    readonly privateAsset: (id: string, name: string) => string;
     readonly prefix: (id: string) => string;
 };
-//# sourceMappingURL=paths.d.ts.map

package/dist/organizations/paths.js

@@ -1,13 +1,4 @@
-/**
- * Blocks path traversal, separators, and empty segments. Called by every
- * helper below so a malicious `id` can't escape the `orgs/` prefix.
- */
-function assertSafeKey(value, label) {
-    // The regex alone allows '.' and '..' — both fully match the allowed alphabet — so they need an explicit check.
-    if (!value || !/^[A-Za-z0-9._-]+$/.test(value) || value === '.' || value === '..') {
-        throw new Error(`Unsafe ${label}: ${JSON.stringify(value)}`);
-    }
-}
+import { assertSafeKey } from '../storage/safeKey.js';
 /**
  * Every branding asset is stored as `.webp` (uploads go through the shared
  * transcoder), so the path per kind is fixed and a re-upload overwrites in
@@ -15,9 +6,7 @@ function assertSafeKey(value, label) {
  *
  * Branding lives under `orgs/{id}/branding/` because it's a *public* asset
  * class — anyone, including logged-out viewers, may read a company logo.
- * That segment distinguishes it from `orgs/{id}/private/` (members-only).
- * `classifyAssetPath` / `ASSET_CLASSES` decide public-vs-private from these
- * prefixes.
+ * `classifyAssetPath` / `ASSET_CLASSES` decide visibility from these prefixes.
  */
 export const orgPaths = {
     asset: (id, kind) => {
@@ -25,15 +14,8 @@ export const orgPaths = {
         assertSafeKey(kind, 'assetKind');
         return `orgs/${id}/branding/${kind}.webp`;
     },
-    /** Members-only blob; `name` includes the extension. */
-    privateAsset: (id, name) => {
-        assertSafeKey(id, 'orgId');
-        assertSafeKey(name, 'assetName');
-        return `orgs/${id}/private/${name}`;
-    },
     prefix: (id) => {
         assertSafeKey(id, 'orgId');
         return `orgs/${id}/`;
     }
 };
-//# sourceMappingURL=paths.js.map

package/dist/organizations/schemas.d.ts

@@ -1,12 +1,9 @@
 import { z } from 'zod';
 /**
  * Top-level path segments a tenant slug must never equal, so a slug can never
- * shadow (or be shadowed by) a route. `/o/{slug}/` is the planned shape for
- * per-org URLs, so `o` is reserved even though the length gate below already
- * makes a 1-char slug impossible — that keeps a future move to `/o/{slug}/…`
- * collision-free before any external link is minted against a slug.
- * Lowercase; matching is case-insensitive so `Admin` can't slip through. Keep
- * in sync with the route tree's top-level directories.
+ * shadow (or be shadowed by) a route. `o` is reserved for `/o/{slug}/` even though
+ * the length gate below already makes a 1-char slug impossible.
+ * `reserved-slugs.test.ts` in the selva app holds this to the route tree.
  */
 export declare const RESERVED_SLUGS: readonly string[];
 /**
@@ -15,6 +12,8 @@ export declare const RESERVED_SLUGS: readonly string[];
  * untouched — run the result through `SlugSchema` where validity matters.
  */
 export declare function slugify(name: string): string;
+/** A slug for an org named without a slug of its own. Always passes `SlugSchema`. */
+export declare function orgSlugFromName(name: string, fallback?: string): string;
 /** Lowercase alphanumeric with internal hyphens, 3–63 chars, not a reserved word. */
 export declare const SlugSchema: z.ZodString;
 export declare const OrgRoleSchema: z.ZodEnum<{
@@ -54,4 +53,3 @@ export declare const UpdateOrgSchema: z.ZodObject<{
 }, z.core.$strip>;
 export type CreateOrgInput = z.infer<typeof CreateOrgSchema>;
 export type UpdateOrgInput = z.infer<typeof UpdateOrgSchema>;
-//# sourceMappingURL=schemas.d.ts.map

package/dist/organizations/schemas.js

@@ -1,12 +1,9 @@
 import { z } from 'zod';
 /**
  * Top-level path segments a tenant slug must never equal, so a slug can never
- * shadow (or be shadowed by) a route. `/o/{slug}/` is the planned shape for
- * per-org URLs, so `o` is reserved even though the length gate below already
- * makes a 1-char slug impossible — that keeps a future move to `/o/{slug}/…`
- * collision-free before any external link is minted against a slug.
- * Lowercase; matching is case-insensitive so `Admin` can't slip through. Keep
- * in sync with the route tree's top-level directories.
+ * shadow (or be shadowed by) a route. `o` is reserved for `/o/{slug}/` even though
+ * the length gate below already makes a 1-char slug impossible.
+ * `reserved-slugs.test.ts` in the selva app holds this to the route tree.
  */
 export const RESERVED_SLUGS = [
     'o',
@@ -16,11 +13,13 @@ export const RESERVED_SLUGS = [
     'login',
     'logout',
     'setup',
-    'settings',
     'team',
     'library',
     'projects',
-    'accept-invite'
+    'accept-invite',
+    'docs',
+    'mcp',
+    'oauth'
 ];
 const RESERVED_SLUG_SET = new Set(RESERVED_SLUGS);
 /**
@@ -30,18 +29,27 @@ const RESERVED_SLUG_SET = new Set(RESERVED_SLUGS);
  */
 export function slugify(name) {
     return name
+        .normalize('NFKD')
+        .replace(/\p{M}/gu, '')
         .trim()
         .toLowerCase()
         .replace(/[^a-z0-9]+/g, '-')
-        .replace(/^-|-$/g, '')
-        .slice(0, 63);
+        .slice(0, 63)
+        .replace(/^-+|-+$/g, '');
+}
+/** A slug for an org named without a slug of its own. Always passes `SlugSchema`. */
+export function orgSlugFromName(name, fallback = 'default') {
+    const slug = slugify(name);
+    if (slug.length < 3)
+        return fallback;
+    return RESERVED_SLUG_SET.has(slug) ? `${slug}-org` : slug;
 }
 /** Lowercase alphanumeric with internal hyphens, 3–63 chars, not a reserved word. */
 export const SlugSchema = z
     .string()
     .min(3, 'Slug must be at least 3 characters')
     .max(63, 'Slug must be at most 63 characters')
-    .regex(/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/, 'Slug must be lowercase alphanumeric with hyphens (no leading/trailing/consecutive hyphens)')
+    .regex(/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/, 'Slug must be lowercase alphanumeric with hyphens (no leading or trailing hyphen)')
     .refine((s) => !RESERVED_SLUG_SET.has(s), {
     message: 'Slug is reserved and cannot be used'
 });
@@ -70,8 +78,7 @@ export const DEFAULT_ORG_PERMISSIONS = {
     member: []
 };
 export const CreateOrgSchema = z.object({
-    name: z.string().min(1, 'Organization name is required').max(128),
+    name: z.string().trim().min(1, 'Organization name is required').max(128),
     slug: SlugSchema
 });
 export const UpdateOrgSchema = CreateOrgSchema.partial();
-//# sourceMappingURL=schemas.js.map

package/dist/organizations/types.d.ts

@@ -35,4 +35,3 @@ export interface OrgMember {
     updatedBy: string;
     deletedAt?: string | null;
 }
-//# sourceMappingURL=types.d.ts.map

package/dist/organizations/types.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=types.js.map

package/dist/pagination.d.ts

@@ -1,7 +1,9 @@
 import type { DefinitionStatus } from './definitions/types.js';
 /**
- * Cursor-paginated list options. Adapters default to limit=50, orderBy=createdAt
- * desc, and clamp limit to `MAX_PAGE_LIMIT`.
+ * Cursor-paginated list options. Adapters default to limit=50 and clamp limit to
+ * `MAX_PAGE_LIMIT`. Order is `createdAt` desc unless a store says otherwise: local
+ * definitions default to `name` asc, and the Supabase member, invite and token
+ * lists have one fixed order and ignore `orderBy`.
  *
  * Cursors are opaque — adapters may use row ids, offsets, or keyset encodings.
  * Callers must not inspect them.
@@ -35,6 +37,8 @@ export interface DefinitionListOptions extends Omit<ListOptions, 'orderBy'> {
      * post-fetch can return a page of 50 with 3 items.
      */
     projectIds?: readonly string[];
+    /** Only definitions whose `sourceDocumentId` equals this lowercase GUID. */
+    sourceDocumentId?: string;
 }
 export interface Page<T> {
     items: T[];
@@ -42,4 +46,8 @@ export interface Page<T> {
 }
 export declare const DEFAULT_PAGE_LIMIT = 50;
 export declare const MAX_PAGE_LIMIT = 200;
-//# sourceMappingURL=pagination.d.ts.map
+/** For adapters paging by offset. Junk and negatives read as the first page. */
+export declare function decodeOffsetCursor(cursor: string | undefined): number;
+export declare function encodeOffsetCursor(offset: number): string;
+/** The effective page size for a requested limit. */
+export declare function clampPageLimit(limit: number | undefined): number;

package/dist/pagination.js

@@ -1,3 +1,17 @@
 export const DEFAULT_PAGE_LIMIT = 50;
 export const MAX_PAGE_LIMIT = 200;
-//# sourceMappingURL=pagination.js.map
+/** For adapters paging by offset. Junk and negatives read as the first page. */
+export function decodeOffsetCursor(cursor) {
+    const offset = cursor ? parseInt(cursor, 10) : 0;
+    return Number.isFinite(offset) && offset >= 0 ? offset : 0;
+}
+export function encodeOffsetCursor(offset) {
+    return String(offset);
+}
+/** The effective page size for a requested limit. */
+export function clampPageLimit(limit) {
+    const requested = limit ?? DEFAULT_PAGE_LIMIT;
+    if (!Number.isFinite(requested))
+        return DEFAULT_PAGE_LIMIT;
+    return Math.min(Math.max(1, Math.floor(requested)), MAX_PAGE_LIMIT);
+}