@selvajs/platform 0.21.0-beta.2 → 1.0.0-beta.4

package/dist/permissions/index.d.ts

@@ -1,4 +1,4 @@
 export type { PlatformPermission } from './types.js';
-export { PlatformPermissionSchema, ALL_PLATFORM_PERMISSIONS } from './types.js';
+export { PlatformPermissionSchema, ALL_PLATFORM_PERMISSIONS, OPERATOR_PLATFORM_PERMISSIONS } from './types.js';
 export type { IPlatformPermissionStore } from './interface.js';
-//# sourceMappingURL=index.d.ts.map
+export { assertCanManagePermissions, assertCanReadPermissions, assertCanReadPermissionsBatch } from '../context.js';

package/dist/permissions/index.js

@@ -1,2 +1,2 @@
-export { PlatformPermissionSchema, ALL_PLATFORM_PERMISSIONS } from './types.js';
-//# sourceMappingURL=index.js.map
+export { PlatformPermissionSchema, ALL_PLATFORM_PERMISSIONS, OPERATOR_PLATFORM_PERMISSIONS } from './types.js';
+export { assertCanManagePermissions, assertCanReadPermissions, assertCanReadPermissionsBatch } from '../context.js';

package/dist/permissions/interface.d.ts

@@ -27,7 +27,9 @@ export interface IPlatformPermissionStore {
     set(ctx: RequestContext, userId: string, permissions: readonly PlatformPermission[]): Promise<UserManagementResult>;
     /**
      * True if at least one *enabled* user holds `instance_admin`. Adapters
-     * must exclude disabled users — over-count is safer than under-count.
+     * must exclude disabled users. One that can't see the disabled flag, like local,
+     * relies on the routes: disabling revokes `instance_admin` first, and a disabled
+     * user can't be granted it.
      */
     hasInstanceAdmin(ctx: RequestContext): Promise<boolean>;
     /**
@@ -45,8 +47,7 @@ export interface IPlatformPermissionStore {
      * write: on a fresh single-tenant install with no
      * `BOOTSTRAP_INSTANCE_ADMIN_EMAIL` configured, any signer is eligible, so
      * two people signing in at the same moment both observe "no admin" and both
-     * become permanent platform admins. §2 promises "first signer wins" — this
-     * is what makes that true rather than aspirational.
+     * become permanent platform admins. This is what makes first signer win.
      *
      * Same shape as the sole-admin invariant (`set`), pointing the other way:
      * that one refuses to drop the last admin, this one refuses to create a
@@ -54,4 +55,3 @@ export interface IPlatformPermissionStore {
      */
     claimFirstInstanceAdmin(ctx: RequestContext, userId: string, permissions: readonly PlatformPermission[]): Promise<boolean>;
 }
-//# sourceMappingURL=interface.d.ts.map

package/dist/permissions/interface.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=interface.js.map

package/dist/permissions/types.d.ts

@@ -23,4 +23,3 @@ export declare const ALL_PLATFORM_PERMISSIONS: readonly PlatformPermission[];
  * `manage_api_tokens` is granted to ordinary users, who have no business there.
  */
 export declare const OPERATOR_PLATFORM_PERMISSIONS: readonly PlatformPermission[];
-//# sourceMappingURL=types.d.ts.map

package/dist/permissions/types.js

@@ -22,4 +22,3 @@ export const ALL_PLATFORM_PERMISSIONS = PlatformPermissionSchema.options;
  * `manage_api_tokens` is granted to ordinary users, who have no business there.
  */
 export const OPERATOR_PLATFORM_PERMISSIONS = ALL_PLATFORM_PERMISSIONS.filter((p) => p !== 'manage_api_tokens');
-//# sourceMappingURL=types.js.map

package/dist/platformProjects/index.d.ts

@@ -1,4 +1,2 @@
-export type { PlatformProjectGrant, PlatformProjectGranteeType } from './types.js';
+export type { PlatformProjectGrant } from './types.js';
 export type { IPlatformProjectGrantStore } from './interface.js';
-export { PlatformProjectGrantSchema, PlatformProjectGranteeTypeSchema } from './schemas.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/platformProjects/index.js

@@ -1,2 +1 @@
-export { PlatformProjectGrantSchema, PlatformProjectGranteeTypeSchema } from './schemas.js';
-//# sourceMappingURL=index.js.map
+export {};

package/dist/platformProjects/interface.d.ts

@@ -22,4 +22,3 @@ export interface IPlatformProjectGrantStore {
      */
     deleteByGranteeOrg(ctx: RequestContext, orgId: string): Promise<void>;
 }
-//# sourceMappingURL=interface.d.ts.map

package/dist/platformProjects/interface.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=interface.js.map

package/dist/platformProjects/schemas.d.ts

@@ -15,4 +15,3 @@ export declare const PlatformProjectGrantSchema: z.ZodObject<{
     createdBy: z.ZodString;
     createdAt: z.ZodString;
 }, z.core.$strip>;
-//# sourceMappingURL=schemas.d.ts.map

package/dist/platformProjects/schemas.js

@@ -9,4 +9,3 @@ export const PlatformProjectGrantSchema = z.object({
     createdBy: z.string(),
     createdAt: z.string()
 });
-//# sourceMappingURL=schemas.js.map

package/dist/platformProjects/types.d.ts

@@ -1,4 +1,6 @@
-export type PlatformProjectGranteeType = 'org' | 'user';
+import type { z } from 'zod';
+import type { PlatformProjectGranteeTypeSchema } from './schemas.js';
+export type PlatformProjectGranteeType = z.infer<typeof PlatformProjectGranteeTypeSchema>;
 /**
  * Grants view-only or view+solve access to a `platform`-visibility project
  * for an org or an individual user, without creating project membership rows.
@@ -16,4 +18,3 @@ export interface PlatformProjectGrant {
     createdBy: string;
     createdAt: string;
 }
-//# sourceMappingURL=types.d.ts.map

package/dist/platformProjects/types.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=types.js.map

package/dist/projects/index.d.ts

@@ -2,4 +2,3 @@ export type { Project, ProjectMember } from './types.js';
 export type { IProjectStore } from './interface.js';
 export type { ProjectVisibility, ProjectRole } from './schemas.js';
 export { ProjectVisibilitySchema, ProjectRoleSchema, validateProjectFlags } from './schemas.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/projects/index.js

@@ -1,2 +1 @@
 export { ProjectVisibilitySchema, ProjectRoleSchema, validateProjectFlags } from './schemas.js';
-//# sourceMappingURL=index.js.map

package/dist/projects/interface.d.ts

@@ -38,4 +38,3 @@ export interface IProjectStore {
     updateProjectMemberRole(ctx: RequestContext, projectId: string, userId: string, role: ProjectRole): Promise<void>;
     removeProjectMember(ctx: RequestContext, projectId: string, userId: string): Promise<void>;
 }
-//# sourceMappingURL=interface.d.ts.map

package/dist/projects/interface.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=interface.js.map

package/dist/projects/schemas.d.ts

@@ -20,4 +20,3 @@ export declare function validateProjectFlags(merged: {
     path: string;
     message: string;
 }[];
-//# sourceMappingURL=schemas.d.ts.map

package/dist/projects/schemas.js

@@ -18,4 +18,3 @@ export function validateProjectFlags(merged) {
     }
     return issues;
 }
-//# sourceMappingURL=schemas.js.map

package/dist/projects/types.d.ts

@@ -32,4 +32,3 @@ export interface ProjectMember {
     updatedBy: string;
     deletedAt?: string | null;
 }
-//# sourceMappingURL=types.d.ts.map

package/dist/projects/types.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=types.js.map

package/dist/shareLinks/index.d.ts

@@ -3,4 +3,3 @@ export type { IShareLinkStore } from './interface.js';
 export { DEFAULT_SHARE_LINK_MAX_SOLVES } from './types.js';
 export type { CreateShareLinkInput } from './schemas.js';
 export { CreateShareLinkInputSchema } from './schemas.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/shareLinks/index.js

@@ -1,3 +1,2 @@
 export { DEFAULT_SHARE_LINK_MAX_SOLVES } from './types.js';
 export { CreateShareLinkInputSchema } from './schemas.js';
-//# sourceMappingURL=index.js.map

package/dist/shareLinks/interface.d.ts

@@ -6,7 +6,8 @@ import type { OrgShareLink, ShareLink } from './types.js';
  * (definitionId, channel). The store sees only the HMAC hash; the raw token
  * is generated and shown to the minter at the route layer.
  *
- * Reads filter `revokedAt IS NULL` defensively.
+ * List and token reads treat a revoked or expired link as gone. `getById` does
+ * not, so a caller can tell a dead link from a missing one.
  */
 export interface IShareLinkStore {
     /** Caller has already hashed the raw token. */
@@ -29,7 +30,10 @@ export interface IShareLinkStore {
     getById(ctx: RequestContext, id: string): Promise<ShareLink | null>;
     /** Returns null when the link doesn't exist, is revoked, or its parent definition is soft-deleted. */
     getByTokenHash(ctx: RequestContext, tokenHash: string): Promise<ShareLink | null>;
-    /** Soft-delete (set `revokedAt`). Idempotent. */
+    /**
+     * Soft-delete (set `revokedAt`). Idempotent: emits once, and a repeat is a no-op.
+     * Throws `ProviderError` when the caller may not revoke it.
+     */
     revoke(ctx: RequestContext, id: string): Promise<void>;
     /**
      * Atomic check-and-increment; must be a single statement, since
@@ -38,4 +42,3 @@ export interface IShareLinkStore {
      */
     tryIncrementSolveCount(ctx: RequestContext, id: string): Promise<number | null>;
 }
-//# sourceMappingURL=interface.d.ts.map

package/dist/shareLinks/interface.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=interface.js.map

package/dist/shareLinks/schemas.d.ts

@@ -14,4 +14,3 @@ export declare const CreateShareLinkInputSchema: z.ZodObject<{
     expiresAt: z.ZodOptional<z.ZodNullable<z.ZodISODateTime>>;
 }, z.core.$strip>;
 export type CreateShareLinkInput = z.infer<typeof CreateShareLinkInputSchema>;
-//# sourceMappingURL=schemas.d.ts.map

package/dist/shareLinks/schemas.js

@@ -8,8 +8,10 @@ export const CreateShareLinkInputSchema = z.object({
     channel: DefinitionChannelSchema.default('live'),
     name: z.string().max(128).optional(),
     allowSolve: z.boolean().default(true),
-    /** Null is the minter's deliberate "uncap" choice; omitted applies the default cap. */
+    /**
+     * Null is the minter's deliberate "uncap" choice. Omitted stays undefined here:
+     * the mint handler applies `DEFAULT_SHARE_LINK_MAX_SOLVES`.
+     */
     maxSolves: z.number().int().min(1).nullable().optional(),
     expiresAt: z.iso.datetime().nullable().optional()
 });
-//# sourceMappingURL=schemas.js.map

package/dist/shareLinks/types.d.ts

@@ -46,4 +46,3 @@ export interface OrgShareLink extends Omit<ShareLink, 'tokenHash'> {
  * worst-case denial-of-wallet damage.
  */
 export declare const DEFAULT_SHARE_LINK_MAX_SOLVES = 1000;
-//# sourceMappingURL=types.d.ts.map

package/dist/shareLinks/types.js

@@ -4,4 +4,3 @@
  * worst-case denial-of-wallet damage.
  */
 export const DEFAULT_SHARE_LINK_MAX_SOLVES = 1000;
-//# sourceMappingURL=types.js.map

package/dist/solveCache/interface.d.ts

@@ -6,8 +6,8 @@ import type { RequestContext } from '../context.js';
  *
  * Design contract:
  *
- * - **Async from day one.** The in-memory backend returns promises too, so a
- *   network store (Redis) drops in later without any call site changing shape.
+ * - **Async.** The in-memory backend returns promises too, so a network store
+ *   (Redis) fits without any call site changing shape.
  * - **Entries are opaque bytes** — the pre-gzipped response envelope plus a
  *   small metadata header. The backend never inspects them, so a hit stays
  *   near-CPU-free in either backend and there's no serialization drift between
@@ -81,4 +81,3 @@ export declare class NoopSolveResultCache implements ISolveResultCache {
     get(_ctx: RequestContext, _key: SolveCacheKey): Promise<Uint8Array | null>;
     set(_ctx: RequestContext, _key: SolveCacheKey, _bytes: Uint8Array, _opts: SolveCacheSetOptions): Promise<void>;
 }
-//# sourceMappingURL=interface.d.ts.map

package/dist/solveCache/interface.js

@@ -9,4 +9,3 @@ export class NoopSolveResultCache {
     }
     async set(_ctx, _key, _bytes, _opts) { }
 }
-//# sourceMappingURL=interface.js.map

package/dist/storage/assetClasses.d.ts

@@ -4,16 +4,15 @@
  * entry in {@link ASSET_CLASSES} rather than a new route.
  *
  * - `public`  — anyone, including logged-out visitors (branding: logo, favicon).
- * - `org`     — members of the owning org only; route resolves orgId from the path.
  * - `project` — members of the owning project only; route resolves the
  *   definition guid to its project (cover images, per-definition blobs).
  */
-export type AssetVisibility = 'public' | 'org' | 'project';
+export type AssetVisibility = 'public' | 'project';
 /**
  * What scope id the route must authorize against. `none` for public assets
- * (no scope to check); `org`/`project` carry the id extracted from the path.
+ * (no scope to check); `project` carries the guid extracted from the path.
  */
-export type AssetScope = 'none' | 'org' | 'project';
+export type AssetScope = 'none' | 'project';
 export interface AssetClass {
     /** Stable identifier — for logging and tests, not user-facing. */
     readonly id: string;
@@ -21,7 +20,7 @@ export interface AssetClass {
     readonly scope: AssetScope;
     /**
      * Anchored matcher for this class's storage paths. Capture group 1 (when
-     * present) is the scope id (orgId or guid) the route authorizes against.
+     * present) is the scope id the route authorizes against.
      */
     readonly pattern: RegExp;
 }
@@ -46,6 +45,3 @@ export declare const ASSET_CLASSES: readonly AssetClass[];
  * captures an id (e.g. `org-branding` captures orgId but is public).
  */
 export declare function classifyAssetPath(storagePath: string): AssetMatch | null;
-/** True when the path belongs to a `public` asset class (CDN-servable, no auth). */
-export declare function isPublicAssetPath(storagePath: string): boolean;
-//# sourceMappingURL=assetClasses.d.ts.map

package/dist/storage/assetClasses.js

@@ -1,15 +1,9 @@
 import { ALL_ORG_ASSET_KINDS } from '../organizations/schemas.js';
-import { COVER_IMAGE_EXTENSIONS } from '../definitions/types.js';
+import { UUID_REGEX } from '../definitions/schemas.js';
+import { SAFE_SEGMENT } from './safeKey.js';
 // Built from the schema enum so a new branding kind extends this pattern automatically.
 const BRANDING_KINDS = ALL_ORG_ASSET_KINDS.join('|');
-// Derived from COVER_IMAGE_EXTENSIONS so a new cover format propagates here
-// instead of silently 404ing legit covers.
-const COVER_EXTS = COVER_IMAGE_EXTENSIONS.map((ext) => ext.replace(/^\./, '').replace(/[.*+?^${}()|[\]\\]/g, '\\$&')).join('|');
-// SAFE_SEGMENT mirrors the assertSafeKey alphabet in the path helpers
-// (traversal/empty segments are rejected separately by hasUnsafeSegment);
-// GUID is kept in sync with UUID_REGEX in definitions/schemas.ts.
-const SAFE_SEGMENT = String.raw `[A-Za-z0-9._-]+`;
-const GUID = String.raw `[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}`;
+const GUID = UUID_REGEX.source.slice(1, -1);
 /**
  * The closed registry of servable asset classes. Patterns are mutually
  * exclusive by prefix, order doesn't matter. Anything matching no class is
@@ -22,17 +16,13 @@ export const ASSET_CLASSES = [
         scope: 'none',
         pattern: new RegExp(String.raw `^orgs\/(${SAFE_SEGMENT})\/branding\/(?:${BRANDING_KINDS})\.webp$`)
     },
-    {
-        id: 'org-private',
-        visibility: 'org',
-        scope: 'org',
-        pattern: new RegExp(String.raw `^orgs\/(${SAFE_SEGMENT})\/private\/${SAFE_SEGMENT}$`)
-    },
     {
         id: 'definition-cover',
         visibility: 'project',
         scope: 'project',
-        pattern: new RegExp(String.raw `^definitions\/(${GUID})\/cover\.(?:${COVER_EXTS})$`, 'i')
+        // `put` transcodes every cover and `definitionPaths.image` names it, so this is
+        // the only cover that can exist.
+        pattern: new RegExp(String.raw `^definitions\/(${GUID})\/cover\.webp$`, 'i')
     }
 ];
 /**
@@ -72,8 +62,3 @@ export function classifyAssetPath(storagePath) {
     }
     return null;
 }
-/** True when the path belongs to a `public` asset class (CDN-servable, no auth). */
-export function isPublicAssetPath(storagePath) {
-    return classifyAssetPath(storagePath)?.class.visibility === 'public';
-}
-//# sourceMappingURL=assetClasses.js.map

package/dist/storage/cacheBust.d.ts

@@ -16,4 +16,3 @@
  * degrades to "no cache-bust" rather than `?v=`.
  */
 export declare function withCacheBust(url: string, token: string | number | undefined | null): string;
-//# sourceMappingURL=cacheBust.d.ts.map

package/dist/storage/cacheBust.js

@@ -21,7 +21,9 @@ export function withCacheBust(url, token) {
     const value = String(token).trim();
     if (value === '')
         return url;
-    const sep = url.includes('?') ? '&' : '?';
-    return `${url}${sep}v=${encodeURIComponent(value)}`;
+    const hash = url.indexOf('#');
+    const base = hash === -1 ? url : url.slice(0, hash);
+    const fragment = hash === -1 ? '' : url.slice(hash);
+    const sep = base.includes('?') ? '&' : '?';
+    return `${base}${sep}v=${encodeURIComponent(value)}${fragment}`;
 }
-//# sourceMappingURL=cacheBust.js.map

package/dist/storage/image.d.ts

@@ -1,20 +1,21 @@
 /**
  * Shared image-transcoding helper for `IStorageProvider` implementations.
- * Normalizes uploads to WebP (capped at 1200px, quality 85) so storage,
- * bandwidth, and the viewer path stay predictable.
+ * Normalizes uploads to WebP (at most 1200px on either side, quality 85) so
+ * storage, bandwidth, and the viewer path stay predictable.
  *
  * `sharp` is a dynamic import, not a hard dependency of this package —
  * providers that need transcoding install it themselves.
  */
 export declare const IMAGE_MAX_WIDTH = 1200;
 export declare const IMAGE_WEBP_QUALITY = 85;
+export declare const MAX_CONCURRENT_TRANSCODES = 2;
 export interface TranscodeResult {
     data: Uint8Array;
     contentType: string;
     /** Possibly-rewritten path (non-webp inputs become `.webp`). */
     path: string;
 }
-/** True if the input looks like an image to process — by content type or path extension. */
+/** True if the input is an image to process. The content type decides, unless it says nothing. */
 export declare function isImageUpload(contentType: string | undefined, storagePath: string): boolean;
 /**
  * Rewrites a path's extension to `.webp`; unchanged for non-image extensions.
@@ -26,7 +27,9 @@ export declare function toWebpPath(storagePath: string): string;
  * Transcodes images to WebP; passes non-images through unchanged, so
  * providers can call this unconditionally before `put`.
  *
- * Throws if `sharp` isn't installed — a config error, not a fallback.
+ * Throws `ProviderError(422)` for bytes it won't process, and a plain error if
+ * `sharp` isn't installed, which is a config problem rather than a bad upload.
  */
 export declare function transcodeImageIfNeeded(data: Uint8Array, contentType: string | undefined, storagePath: string): Promise<TranscodeResult>;
-//# sourceMappingURL=image.d.ts.map
+/** Runs `fn` when a slot is free. A finishing transcode hands its slot straight to the next. */
+export declare function withTranscodeSlot<T>(fn: () => Promise<T>): Promise<T>;

package/dist/storage/image.js

@@ -1,17 +1,26 @@
 /**
  * Shared image-transcoding helper for `IStorageProvider` implementations.
- * Normalizes uploads to WebP (capped at 1200px, quality 85) so storage,
- * bandwidth, and the viewer path stay predictable.
+ * Normalizes uploads to WebP (at most 1200px on either side, quality 85) so
+ * storage, bandwidth, and the viewer path stay predictable.
  *
  * `sharp` is a dynamic import, not a hard dependency of this package —
  * providers that need transcoding install it themselves.
  */
+import { ProviderError } from '../errors.js';
 export const IMAGE_MAX_WIDTH = 1200;
 export const IMAGE_WEBP_QUALITY = 85;
-/** True if the input looks like an image to process — by content type or path extension. */
+// A small upload can decode to gigabytes or burn seconds of CPU: the size cap on
+// the request says nothing about either. 60 MP covers a phone camera's full frame.
+const MAX_INPUT_PIXELS = 60_000_000;
+const TRANSCODE_TIMEOUT_SECONDS = 10;
+export const MAX_CONCURRENT_TRANSCODES = 2;
+// What `metadata()` found in the bytes, whatever the client declared.
+const ALLOWED_FORMATS = new Set(['jpeg', 'png', 'webp', 'gif', 'tiff', 'svg']);
+/** True if the input is an image to process. The content type decides, unless it says nothing. */
 export function isImageUpload(contentType, storagePath) {
-    if (contentType?.startsWith('image/'))
-        return true;
+    if (contentType && contentType !== 'application/octet-stream') {
+        return contentType.startsWith('image/');
+    }
     return /\.(webp|png|jpe?g|gif|bmp|tif?f|svg)$/i.test(storagePath);
 }
 /**
@@ -26,29 +35,83 @@ export function toWebpPath(storagePath) {
  * Transcodes images to WebP; passes non-images through unchanged, so
  * providers can call this unconditionally before `put`.
  *
- * Throws if `sharp` isn't installed — a config error, not a fallback.
+ * Throws `ProviderError(422)` for bytes it won't process, and a plain error if
+ * `sharp` isn't installed, which is a config problem rather than a bad upload.
  */
 export async function transcodeImageIfNeeded(data, contentType, storagePath) {
     if (!isImageUpload(contentType, storagePath)) {
         return { data, contentType: contentType ?? 'application/octet-stream', path: storagePath };
     }
     const sharp = await loadSharp();
-    const compressed = await sharp(Buffer.from(data))
-        .resize({ width: IMAGE_MAX_WIDTH, withoutEnlargement: true })
-        .webp({ quality: IMAGE_WEBP_QUALITY })
-        .toBuffer();
+    const compressed = await withTranscodeSlot(() => rasterize(sharp, Buffer.from(data), contentType, storagePath));
     return {
         data: new Uint8Array(compressed),
         contentType: 'image/webp',
         path: toWebpPath(storagePath)
     };
 }
+async function rasterize(sharp, input, contentType, storagePath) {
+    try {
+        // Unlimited here: this only reads the header, and sharp's own limit would hide
+        // the reason from the check below.
+        const header = sharp(input, { limitInputPixels: false });
+        const { format, width = 0, height = 0 } = await header.metadata();
+        // SVG is the expensive format, so it has to be asked for: a route that only
+        // checks the declared type must not let one in as a PNG.
+        const declaredSvg = contentType === 'image/svg+xml' || /\.svg$/i.test(storagePath);
+        if (!ALLOWED_FORMATS.has(format) || (format === 'svg' && !declaredSvg)) {
+            throw new ProviderError(`Unsupported image format: ${format}`, 422);
+        }
+        if (width * height > MAX_INPUT_PIXELS) {
+            throw new ProviderError('Image has too many pixels', 422);
+        }
+        return await sharp(input, { limitInputPixels: MAX_INPUT_PIXELS })
+            .autoOrient()
+            .resize({
+            width: IMAGE_MAX_WIDTH,
+            height: IMAGE_MAX_WIDTH,
+            fit: 'inside',
+            withoutEnlargement: true
+        })
+            .webp({ quality: IMAGE_WEBP_QUALITY })
+            .timeout({ seconds: TRANSCODE_TIMEOUT_SECONDS })
+            .toBuffer();
+    }
+    catch (err) {
+        if (err instanceof ProviderError)
+            throw err;
+        throw new ProviderError('The image could not be read', 422);
+    }
+}
+let activeTranscodes = 0;
+const waitingTranscodes = [];
+/** Runs `fn` when a slot is free. A finishing transcode hands its slot straight to the next. */
+export async function withTranscodeSlot(fn) {
+    if (activeTranscodes < MAX_CONCURRENT_TRANSCODES) {
+        activeTranscodes += 1;
+    }
+    else {
+        await new Promise((resolve) => waitingTranscodes.push(resolve));
+    }
+    try {
+        return await fn();
+    }
+    finally {
+        const next = waitingTranscodes.shift();
+        if (next)
+            next();
+        else
+            activeTranscodes -= 1;
+    }
+}
+// Not a literal: a browser build of the root barrel would try to resolve it.
+const SHARP_MODULE = 'sharp';
 let cachedSharp = null;
 async function loadSharp() {
     if (cachedSharp)
         return cachedSharp;
     try {
-        const mod = (await import('sharp'));
+        const mod = (await import(/* @vite-ignore */ SHARP_MODULE));
         cachedSharp = mod.default ?? mod;
         return cachedSharp;
     }
@@ -56,4 +119,3 @@ async function loadSharp() {
         throw new Error('Image transcoding requires `sharp` to be installed. Add it as a dependency in your provider package.', { cause: err });
     }
 }
-//# sourceMappingURL=image.js.map

package/dist/storage/index.d.ts

@@ -1,7 +1,5 @@
 export type { IStorageProvider } from './interface.js';
-export { IMAGE_MAX_WIDTH, IMAGE_WEBP_QUALITY, isImageUpload, toWebpPath, transcodeImageIfNeeded } from './image.js';
+export { transcodeImageIfNeeded } from './image.js';
 export type { TranscodeResult } from './image.js';
-export { ASSET_CLASSES, classifyAssetPath, isPublicAssetPath } from './assetClasses.js';
-export type { AssetVisibility, AssetScope, AssetClass, AssetMatch } from './assetClasses.js';
+export { ASSET_CLASSES, classifyAssetPath } from './assetClasses.js';
 export { withCacheBust } from './cacheBust.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/storage/index.js

@@ -1,4 +1,3 @@
-export { IMAGE_MAX_WIDTH, IMAGE_WEBP_QUALITY, isImageUpload, toWebpPath, transcodeImageIfNeeded } from './image.js';
-export { ASSET_CLASSES, classifyAssetPath, isPublicAssetPath } from './assetClasses.js';
+export { transcodeImageIfNeeded } from './image.js';
+export { ASSET_CLASSES, classifyAssetPath } from './assetClasses.js';
 export { withCacheBust } from './cacheBust.js';
-//# sourceMappingURL=index.js.map

package/dist/storage/interface.d.ts

@@ -10,10 +10,19 @@
 export interface IStorageProvider {
     /** Returns null if the path does not exist. */
     get(path: string): Promise<Uint8Array | null>;
-    put(path: string, data: Uint8Array, contentType?: string): Promise<void>;
+    /**
+     * Stores the bytes, replacing what is there, and returns the path they landed
+     * at. Images go through `transcodeImageIfNeeded` first: they are stored as WebP
+     * and a `.png` or similar path becomes `.webp`, so read back with the returned
+     * path. Throws `ProviderError(422)` for an image the transcoder refuses.
+     */
+    put(path: string, data: Uint8Array, contentType?: string): Promise<string>;
     /** No-op if the path does not exist. */
     delete(path: string): Promise<void>;
-    /** Delete every file whose path starts with `prefix`. */
+    /**
+     * Delete every file under the directory `prefix`, so `a/b` does not reach
+     * `a/bc`. Throws on an empty prefix or `/`, which would name the whole store.
+     */
     deletePrefix(prefix: string): Promise<void>;
     /**
      * Public URL for a stored file. Local: a relative API path; S3/CDN: a
@@ -21,4 +30,3 @@ export interface IStorageProvider {
      */
     getPublicUrl(path: string): string;
 }
-//# sourceMappingURL=interface.d.ts.map

package/dist/storage/interface.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=interface.js.map

package/dist/storage/safeKey.d.ts

@@ -0,0 +1,7 @@
+/** Alphabet of one storage path segment, as regex source. Covers GUIDs and sanitized refs. */
+export declare const SAFE_SEGMENT: string;
+/**
+ * Blocks traversal, separators, NUL and empty segments, so a malicious id can't
+ * escape its prefix. The alphabet admits `.` and `..`, so those need their own check.
+ */
+export declare function assertSafeKey(value: string, label: string): void;

package/dist/storage/safeKey.js

@@ -0,0 +1,12 @@
+/** Alphabet of one storage path segment, as regex source. Covers GUIDs and sanitized refs. */
+export const SAFE_SEGMENT = String.raw `[A-Za-z0-9._-]+`;
+const SAFE_SEGMENT_ONLY = new RegExp(`^${SAFE_SEGMENT}$`);
+/**
+ * Blocks traversal, separators, NUL and empty segments, so a malicious id can't
+ * escape its prefix. The alphabet admits `.` and `..`, so those need their own check.
+ */
+export function assertSafeKey(value, label) {
+    if (!value || !SAFE_SEGMENT_ONLY.test(value) || value === '.' || value === '..') {
+        throw new Error(`Unsafe ${label}: ${JSON.stringify(value)}`);
+    }
+}

package/dist/testing/index.d.ts

@@ -1,5 +1,9 @@
-export { runAuthProviderConformance } from './suites/authProviderSuite.js';
+export { runAuthCoreConformance, runAuthProviderConformance, runPasswordAuthConformance } from './suites/authProviderSuite.js';
 export type { AuthProviderConformanceOptions } from './suites/authProviderSuite.js';
+export { runOAuthAuthConformance } from './suites/oauthAuthSuite.js';
+export type { OAuthAuthConformanceOptions } from './suites/oauthAuthSuite.js';
+export { runAuditQueryConformance } from './suites/auditQuerySuite.js';
+export type { AuditQueryConformanceOptions } from './suites/auditQuerySuite.js';
 export { runEmailLinkAuthConformance } from './suites/emailLinkAuthSuite.js';
 export type { EmailLinkAuthConformanceOptions } from './suites/emailLinkAuthSuite.js';
 export { runDefinitionStoreConformance } from './suites/definitionStoreSuite.js';
@@ -28,4 +32,3 @@ export { runPlatformProjectGrantStoreConformance } from './suites/platformProjec
 export type { PlatformProjectGrantStoreConformanceOptions } from './suites/platformProjectGrantStoreSuite.js';
 export { runApiTokenStoreConformance } from './suites/apiTokenStoreSuite.js';
 export type { ApiTokenStoreConformanceOptions, ApiTokenTestScope } from './suites/apiTokenStoreSuite.js';
-//# sourceMappingURL=index.d.ts.map