@selvajs/platform 0.21.0-beta.2 → 1.0.0-beta.4

package/dist/testing/index.js

@@ -1,4 +1,6 @@
-export { runAuthProviderConformance } from './suites/authProviderSuite.js';
+export { runAuthCoreConformance, runAuthProviderConformance, runPasswordAuthConformance } from './suites/authProviderSuite.js';
+export { runOAuthAuthConformance } from './suites/oauthAuthSuite.js';
+export { runAuditQueryConformance } from './suites/auditQuerySuite.js';
 export { runEmailLinkAuthConformance } from './suites/emailLinkAuthSuite.js';
 export { runDefinitionStoreConformance } from './suites/definitionStoreSuite.js';
 export { runOrgStoreConformance } from './suites/orgStoreSuite.js';
@@ -13,4 +15,3 @@ export { runSolveMetricSinkConformance } from './suites/solveMetricSinkSuite.js'
 export { runPlatformPermissionStoreConformance } from './suites/platformPermissionStoreSuite.js';
 export { runPlatformProjectGrantStoreConformance } from './suites/platformProjectGrantStoreSuite.js';
 export { runApiTokenStoreConformance } from './suites/apiTokenStoreSuite.js';
-//# sourceMappingURL=index.js.map

package/dist/testing/suites/apiTokenStoreSuite.d.ts

@@ -26,4 +26,3 @@ export interface ApiTokenStoreConformanceOptions {
     seedUser?: SeedUserFn;
 }
 export declare function runApiTokenStoreConformance(opts: ApiTokenStoreConformanceOptions): void;
-//# sourceMappingURL=apiTokenStoreSuite.d.ts.map

package/dist/testing/suites/apiTokenStoreSuite.js

@@ -203,4 +203,3 @@ export function runApiTokenStoreConformance(opts) {
         });
     });
 }
-//# sourceMappingURL=apiTokenStoreSuite.js.map

package/dist/testing/suites/auditQuerySuite.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Adapter conformance suite for IAuditQuery, read through the sink that writes the
+ * rows. Also holds an IEventSink to what the query shows: per-actor order.
+ */
+import type { IAuditQuery } from '../../events/audit.js';
+import type { IEventSink } from '../../events/interface.js';
+export interface AuditQueryConformanceOptions {
+    name: string;
+    /** A query and the sink that feeds it, over storage that starts empty. */
+    createStores: () => Promise<{
+        query: IAuditQuery;
+        sink: IEventSink;
+    }> | {
+        query: IAuditQuery;
+        sink: IEventSink;
+    };
+}
+export declare function runAuditQueryConformance(opts: AuditQueryConformanceOptions): void;

package/dist/testing/suites/auditQuerySuite.js

@@ -0,0 +1,73 @@
+/**
+ * Adapter conformance suite for IAuditQuery, read through the sink that writes the
+ * rows. Also holds an IEventSink to what the query shows: per-actor order.
+ */
+import { describe, it, expect } from 'vitest';
+import { makeSystemCtx, makeUuid } from './helpers.js';
+const ctx = makeSystemCtx();
+const deleted = (orgId, actorId) => ({
+    type: 'org.deleted',
+    orgId,
+    actorId
+});
+const created = (orgId, actorId) => ({
+    type: 'org.created',
+    orgId,
+    actorId
+});
+export function runAuditQueryConformance(opts) {
+    const { name, createStores } = opts;
+    describe(`IAuditQuery conformance: ${name}`, () => {
+        it("returns one actor's events newest first, in the order they were emitted", async () => {
+            const { query, sink } = await createStores();
+            const actor = makeUuid();
+            const orgs = [makeUuid(), makeUuid(), makeUuid()];
+            for (const org of orgs)
+                await sink.emit(deleted(org, actor));
+            const { rows } = await query.list(ctx, { actorId: actor });
+            expect(rows.map((r) => r.data.orgId)).toEqual([...orgs].reverse());
+        });
+        it('filters by type and actor', async () => {
+            const { query, sink } = await createStores();
+            const actor = makeUuid();
+            await sink.emit(created(makeUuid(), actor));
+            await sink.emit(deleted(makeUuid(), actor));
+            await sink.emit(deleted(makeUuid(), makeUuid()));
+            const { rows } = await query.list(ctx, { actorId: actor, types: ['org.deleted'] });
+            expect(rows.map((r) => r.type)).toEqual(['org.deleted']);
+        });
+        it('honours the time bounds', async () => {
+            const { query, sink } = await createStores();
+            const actor = makeUuid();
+            await sink.emit(deleted(makeUuid(), actor));
+            const future = new Date(Date.now() + 60_000).toISOString();
+            const past = new Date(Date.now() - 60_000).toISOString();
+            expect((await query.list(ctx, { actorId: actor, sinceIso: future })).rows).toEqual([]);
+            expect((await query.list(ctx, { actorId: actor, untilIso: past })).rows).toEqual([]);
+        });
+        it('pages through every row exactly once', async () => {
+            const { query, sink } = await createStores();
+            const actor = makeUuid();
+            for (let i = 0; i < 5; i++)
+                await sink.emit(deleted(makeUuid(), actor));
+            const seen = [];
+            let cursor;
+            for (;;) {
+                const page = await query.list(ctx, { actorId: actor, limit: 2, cursor });
+                seen.push(...page.rows.map((r) => r.id));
+                if (!page.nextCursor)
+                    break;
+                cursor = page.nextCursor;
+            }
+            expect(seen).toHaveLength(5);
+            expect(new Set(seen).size).toBe(5);
+        });
+        it('still returns a row for a fractional limit', async () => {
+            const { query, sink } = await createStores();
+            const actor = makeUuid();
+            await sink.emit(deleted(makeUuid(), actor));
+            const { rows } = await query.list(ctx, { actorId: actor, limit: 0.5 });
+            expect(rows).toHaveLength(1);
+        });
+    });
+}

package/dist/testing/suites/authProviderSuite.d.ts

@@ -8,8 +8,8 @@ export interface AuthProviderConformanceOptions {
      * for password-capable providers. The factory is responsible for seeding
      * the admin user (e.g. via `createUserWithPassword`) before returning.
      *
-     * `adminEmail` defaults to `''` for legacy reasons; new providers should
-     * always return the seeded admin's email.
+     * `adminEmail` defaults to `''`; a password provider should return the seeded
+     * admin's email.
      */
     createProvider: () => Promise<{
         provider: IAuthProvider;
@@ -26,6 +26,17 @@ export interface AuthProviderConformanceOptions {
      * When false those methods are expected to return null / 'not_supported'.
      */
     userManagement?: boolean;
+    /** The provider has no `passwordAuth`, so only the core cases apply. */
+    passwordless?: boolean;
+    /** `passwordAuth.registerUser` is on, so its cases run. */
+    selfRegistration?: boolean;
 }
+/** Cases every auth provider must pass, password or not. */
+export declare function runAuthCoreConformance(opts: Pick<AuthProviderConformanceOptions, 'name' | 'createProvider'>): void;
+/** Cases for a provider with `passwordAuth`. */
+export declare function runPasswordAuthConformance(opts: AuthProviderConformanceOptions): void;
+/**
+ * Both of the above, gated on what the provider has. New cases go behind an option
+ * so a third-party adapter does not turn red on upgrade.
+ */
 export declare function runAuthProviderConformance(opts: AuthProviderConformanceOptions): void;
-//# sourceMappingURL=authProviderSuite.d.ts.map

package/dist/testing/suites/authProviderSuite.js

@@ -1,19 +1,10 @@
 // Conformance suite for IAuthProvider: token round-trips, identity, password auth, admin management.
 import { describe, it, expect } from 'vitest';
 import { makeUuid } from './helpers.js';
-export function runAuthProviderConformance(opts) {
-    const { name, createProvider, userManagement = false } = opts;
-    describe(`IAuthProvider conformance: ${name}`, () => {
-        // Token round-trips
-        it('verifyLogin returns a session token that verifyToken accepts', async () => {
-            const { provider, adminPassword, adminEmail = '' } = await createProvider();
-            const result = await provider.passwordAuth.verifyLogin(adminEmail, adminPassword);
-            expect(result.kind).toBe('success');
-            if (result.kind !== 'success')
-                return;
-            const verified = await provider.verifyToken(result.sessionToken);
-            expect(verified?.id).toBe(result.user.id);
-        });
+/** Cases every auth provider must pass, password or not. */
+export function runAuthCoreConformance(opts) {
+    const { name, createProvider } = opts;
+    describe(`IAuthProvider core conformance: ${name}`, () => {
         it('verifyToken returns null for a garbage token', async () => {
             const { provider } = await createProvider();
             const result = await provider.verifyToken('not-a-valid-token');
@@ -24,35 +15,57 @@ export function runAuthProviderConformance(opts) {
             const result = await provider.verifyToken('');
             expect(result).toBeNull();
         });
+        it('getUser returns null for unknown id', async () => {
+            const { provider } = await createProvider();
+            // Valid UUID shape but not an actual user — stricter backends (Postgres
+            // uuid columns) reject non-UUID ids outright, so we never send those.
+            const result = await provider.getUser(makeUuid());
+            expect(result).toBeNull();
+        });
+    });
+}
+/** Cases for a provider with `passwordAuth`. */
+export function runPasswordAuthConformance(opts) {
+    const { name, createProvider, userManagement = false, selfRegistration = false } = opts;
+    describe(`IAuthProvider password conformance: ${name}`, () => {
+        // Token round-trips
+        it('verifyLogin returns a session token that verifyToken accepts', async () => {
+            const { provider, adminPassword, adminEmail = '' } = await createProvider();
+            const result = await provider.passwordAuth.verifyLogin(adminEmail, adminPassword);
+            expect(result.kind).toBe('success');
+            if (result.kind !== 'success')
+                return;
+            const verified = await provider.verifyToken(result.sessionToken);
+            expect(verified?.id).toBe(result.user.id);
+        });
         // Password auth (only runs when passwordAuth is present)
         it('verifyLogin returns success with correct password', async () => {
             const { provider, adminPassword, adminEmail = '' } = await createProvider();
-            if (!provider.passwordAuth)
-                return;
             const result = await provider.passwordAuth.verifyLogin(adminEmail, adminPassword);
             expect(result.kind).toBe('success');
             if (result.kind !== 'success')
                 return;
-            // Identity-only — platform permissions live on IPlatformPermissionStore now.
+            // Identity-only: platform permissions live on IPlatformPermissionStore.
             expect(result.user.id).toBeTruthy();
             expect(typeof result.sessionToken).toBe('string');
             expect(result.sessionToken.length).toBeGreaterThan(0);
         });
+        if (selfRegistration) {
+            it('registerUser creates an account that can sign in', async () => {
+                const { provider } = await createProvider();
+                const email = `register-${makeUuid()}@example.com`;
+                const user = await provider.passwordAuth.registerUser(email, 'pass12345678');
+                expect(user?.email).toBe(email);
+                const login = await provider.passwordAuth.verifyLogin(email, 'pass12345678');
+                expect(login.kind).toBe('success');
+            });
+        }
         it('verifyLogin returns failed for wrong password', async () => {
             const { provider, adminEmail = '' } = await createProvider();
-            if (!provider.passwordAuth)
-                return;
             const result = await provider.passwordAuth.verifyLogin(adminEmail, 'wrong-password-xyz');
             expect(result.kind).toBe('failed');
         });
         // getUser
-        it('getUser returns null for unknown id', async () => {
-            const { provider } = await createProvider();
-            // Valid UUID shape but not an actual user — stricter backends (Postgres
-            // uuid columns) reject non-UUID ids outright, so we never send those.
-            const result = await provider.getUser(makeUuid());
-            expect(result).toBeNull();
-        });
         // ============================================================================
         // User management (opt-in)
         // ============================================================================
@@ -102,12 +115,8 @@ export function runAuthProviderConformance(opts) {
                 const result = await provider.deleteUser(makeUuid());
                 expect(result).toBe('not_found');
             });
-            // Note: the §2 sole-`instance_admin` invariant is no longer enforced
-            // by IAuthProvider — it lives on IPlatformPermissionStore now and
-            // callers consult `countInstanceAdminsExcluding` before destructive
-            // ops. Auth-side delete/disable just deletes the identity and
-            // trusts the caller. See `runPlatformPermissionStoreConformance`
-            // for the invariant tests.
+            // Auth-side delete/disable trusts the caller: the sole-`instance_admin`
+            // invariant is `runPlatformPermissionStoreConformance`'s to test.
             it('createUserWithPassword returns an identity record without profile fields', async () => {
                 const { provider } = await createProvider();
                 const user = await provider.passwordAuth.createUserWithPassword(`new-${makeUuid()}@example.com`, 'pass12345678');
@@ -127,6 +136,14 @@ export function runAuthProviderConformance(opts) {
                 const fetched = await provider.getUser(created.id);
                 expect(fetched?.disabled).toBe(true);
             });
+            it('verifyLogin refuses a disabled user', async () => {
+                const { provider } = await createProvider();
+                const email = `disabled-${makeUuid()}@example.com`;
+                const created = await provider.passwordAuth.createUserWithPassword(email, 'pass12345678');
+                await provider.disableUser(created.id);
+                const result = await provider.passwordAuth.verifyLogin(email, 'pass12345678');
+                expect(result).toMatchObject({ kind: 'failed' });
+            });
             it('disableUser returns not_found for unknown user', async () => {
                 const { provider } = await createProvider();
                 const result = await provider.disableUser(makeUuid());
@@ -156,4 +173,12 @@ export function runAuthProviderConformance(opts) {
         }
     });
 }
-//# sourceMappingURL=authProviderSuite.js.map
+/**
+ * Both of the above, gated on what the provider has. New cases go behind an option
+ * so a third-party adapter does not turn red on upgrade.
+ */
+export function runAuthProviderConformance(opts) {
+    runAuthCoreConformance(opts);
+    if (!opts.passwordless)
+        runPasswordAuthConformance(opts);
+}

package/dist/testing/suites/computeServerStoreSuite.d.ts

@@ -1,7 +1,7 @@
 /**
  * Adapter conformance suite for IComputeServerStore.
  *
- * Architecture spec §4.8 — servers are scoped (platform vs. org-private), with a global
+ * Servers are scoped (platform vs. org-private), with a global
  * `defaultServerId` and per-org `orgDefaults`. The store surface exposes
  * scope-targeted mutations; visibility filtering is done by callers via
  * the pure helpers in `@selvajs/platform`.
@@ -18,4 +18,3 @@ export interface ComputeServerStoreConformanceOptions {
     seedOrg?: (orgId: string) => Promise<void>;
 }
 export declare function runComputeServerStoreConformance(opts: ComputeServerStoreConformanceOptions): void;
-//# sourceMappingURL=computeServerStoreSuite.d.ts.map

package/dist/testing/suites/computeServerStoreSuite.js

@@ -1,7 +1,7 @@
 /**
  * Adapter conformance suite for IComputeServerStore.
  *
- * Architecture spec §4.8 — servers are scoped (platform vs. org-private), with a global
+ * Servers are scoped (platform vs. org-private), with a global
  * `defaultServerId` and per-org `orgDefaults`. The store surface exposes
  * scope-targeted mutations; visibility filtering is done by callers via
  * the pure helpers in `@selvajs/platform`.
@@ -65,11 +65,76 @@ export function runComputeServerStoreConformance(opts) {
         it('getConfig on empty returns an empty servers list', async () => {
             const store = await createStore();
             const got = await store.getConfig(SYSTEM_CONTEXT);
-            expect(Array.isArray(got.servers)).toBe(true);
+            expect(got.servers).toEqual([]);
+        });
+        it('getConfig hides keys unless asked, and reports that one is stored', async () => {
+            const store = await createStore();
+            const id = makeUuid();
+            await store.savePlatformServers(SYSTEM_CONTEXT, [
+                {
+                    id,
+                    scope: 'platform',
+                    sharedWith: 'all',
+                    label: 'Keyed',
+                    serverUrl: 'http://compute.test',
+                    apiKey: 'rhino-key'
+                }
+            ], id);
+            const plain = await store.getConfig(SYSTEM_CONTEXT);
+            expect(plain.servers[0].apiKey).toBeUndefined();
+            expect(plain.servers[0].hasApiKey).toBe(true);
+            const keyed = await store.getConfig(SYSTEM_CONTEXT, { includeApiKeys: true });
+            expect(keyed.servers[0].apiKey).toBe('rhino-key');
+        });
+        it('getServerApiKey returns one key, and undefined for an unknown server', async () => {
+            const store = await createStore();
+            const id = makeUuid();
+            await store.savePlatformServers(SYSTEM_CONTEXT, [
+                {
+                    id,
+                    scope: 'platform',
+                    sharedWith: 'all',
+                    label: 'Keyed',
+                    serverUrl: 'http://compute.test',
+                    apiKey: 'rhino-key'
+                }
+            ], id);
+            expect(await store.getServerApiKey(SYSTEM_CONTEXT, id)).toBe('rhino-key');
+            expect(await store.getServerApiKey(SYSTEM_CONTEXT, makeUuid())).toBeUndefined();
+        });
+        it('verifySecrets passes on keys this store wrote', async () => {
+            const store = await createStore();
+            const id = makeUuid();
+            await store.savePlatformServers(SYSTEM_CONTEXT, [
+                {
+                    id,
+                    scope: 'platform',
+                    sharedWith: 'all',
+                    label: 'Keyed',
+                    serverUrl: 'http://compute.test',
+                    apiKey: 'rhino-key'
+                }
+            ], id);
+            const report = await store.verifySecrets?.();
+            if (report)
+                expect(report).toEqual({ ok: true, failures: [], plaintextFound: false });
         });
         // ============================================================================
-        // Org-private servers + orgDefaults (Architecture spec §4.8)
+        // Org-private servers + orgDefaults
         // ============================================================================
+        it('saveOrgServers ignores an entry that is not an org server', async () => {
+            const store = await createStore();
+            const orgId = await seed();
+            const stray = {
+                id: makeUuid(),
+                scope: 'platform',
+                sharedWith: 'all',
+                label: 'Stray',
+                serverUrl: 'http://compute.test'
+            };
+            await store.saveOrgServers(SYSTEM_CONTEXT, orgId, [stray]);
+            expect((await store.getConfig(SYSTEM_CONTEXT)).servers).toEqual([]);
+        });
         it('saveOrgServers stores rows owned by the org', async () => {
             const store = await createStore();
             const orgId = await seed();
@@ -136,4 +201,3 @@ export function runComputeServerStoreConformance(opts) {
         });
     });
 }
-//# sourceMappingURL=computeServerStoreSuite.js.map

package/dist/testing/suites/definitionStoreSuite.d.ts

@@ -26,6 +26,8 @@ export interface DefinitionTestScope {
      * Must reference a real row for FK-enforcing adapters.
      */
     secondaryProjectId: string;
+    /** Used by the ctx-isolation cases when `projectId` is one anyone can see. */
+    privateProjectId?: string;
     /** Optional third user id for ctx-isolation tests. Required when ctxIsolation is set. */
     secondaryUserId?: string;
     /** Token for `secondaryUserId`, when used. */
@@ -49,4 +51,3 @@ export interface DefinitionStoreConformanceOptions {
     ctxIsolation?: boolean;
 }
 export declare function runDefinitionStoreConformance(opts: DefinitionStoreConformanceOptions): void;
-//# sourceMappingURL=definitionStoreSuite.d.ts.map

package/dist/testing/suites/definitionStoreSuite.js

@@ -6,25 +6,21 @@
  * reference protection (Permissions spec §6), and error shapes.
  */
 import { describe, it, expect } from 'vitest';
-import { makeCtx, makeUuid } from './helpers.js';
+import { makeSeedHelpers, makeUuid } from './helpers.js';
 const DEFAULT_SCOPE = {
     ownerId: 'user-1',
     projectId: 'project-1',
     secondaryProjectId: 'project-2',
     secondaryUserId: 'user-b'
 };
-// Suite-wide token map. `scopeFor` populates it from the scope; `ctx`
-// auto-attaches the matching token so adapters with DB-side auth (Supabase
-// RLS) run as the right user. Local providers ignore tokens entirely.
-const tokens = new Map();
-function ctx(userId, opts = {}) {
-    return makeCtx(userId, { ...opts, sessionToken: tokens.get(userId) });
-}
+// `scopeFor` registers the scope's tokens, so `ctx` runs as the right user on an
+// adapter with DB-side auth (Supabase RLS). This suite seeds nobody itself.
+const { ctx, registerToken } = makeSeedHelpers(async (userId) => ({ userId }));
 function recordTokensFromScope(scope) {
     if (scope.ownerSessionToken)
-        tokens.set(scope.ownerId, scope.ownerSessionToken);
+        registerToken(scope.ownerId, scope.ownerSessionToken);
     if (scope.secondaryUserId && scope.secondaryUserSessionToken) {
-        tokens.set(scope.secondaryUserId, scope.secondaryUserSessionToken);
+        registerToken(scope.secondaryUserId, scope.secondaryUserSessionToken);
     }
 }
 function record(scope, overrides = {}) {
@@ -163,6 +159,15 @@ export function runDefinitionStoreConformance(opts) {
             expect(got?.displayName).toBe('New');
             expect(got.updatedAt >= created.updatedAt).toBe(true);
         });
+        it('update with null tags clears them', async () => {
+            const store = await createStore();
+            const scope = await scopeFor();
+            const guid = makeUuid();
+            await store.create(ctx(scope.ownerId), record(scope, { guid, tags: ['roof'] }));
+            await store.update(ctx(scope.ownerId), guid, { tags: null });
+            const got = await store.get(ctx(scope.ownerId), guid);
+            expect(got?.tags ?? []).toEqual([]);
+        });
         it('solveCacheLimit round-trips: absent → inherit, set → value, null → cleared', async () => {
             const store = await createStore();
             const scope = await scopeFor();
@@ -180,6 +185,35 @@ export function runDefinitionStoreConformance(opts) {
             await store.update(ctx(scope.ownerId), guid, { solveCacheLimit: null });
             expect((await store.get(ctx(scope.ownerId), guid))?.solveCacheLimit).toBeUndefined();
         });
+        it('sourceDocumentId round-trips through create, update and clear', async () => {
+            const store = await createStore();
+            const scope = await scopeFor();
+            const guid = makeUuid();
+            const docA = makeUuid();
+            const docB = makeUuid();
+            await store.create(ctx(scope.ownerId), record(scope, { guid, sourceDocumentId: docA }));
+            expect((await store.get(ctx(scope.ownerId), guid))?.sourceDocumentId).toBe(docA);
+            await store.update(ctx(scope.ownerId), guid, { sourceDocumentId: docB });
+            expect((await store.get(ctx(scope.ownerId), guid))?.sourceDocumentId).toBe(docB);
+            await store.update(ctx(scope.ownerId), guid, { sourceDocumentId: null });
+            expect((await store.get(ctx(scope.ownerId), guid))?.sourceDocumentId).toBeUndefined();
+        });
+        it('list filters by sourceDocumentId in the query', async () => {
+            const store = await createStore();
+            const scope = await scopeFor();
+            const doc = makeUuid();
+            const match = makeUuid();
+            await store.create(ctx(scope.ownerId), record(scope, { guid: match, sourceDocumentId: doc }));
+            await store.create(ctx(scope.ownerId), record(scope, { guid: makeUuid(), sourceDocumentId: makeUuid() }));
+            await store.create(ctx(scope.ownerId), record(scope, { guid: makeUuid() }));
+            const page = await store.list(ctx(scope.ownerId), {
+                sourceDocumentId: doc,
+                projectIds: [scope.projectId],
+                limit: 1
+            });
+            expect(page.items.map((r) => r.guid)).toEqual([match]);
+            expect(page.nextCursor).toBeUndefined();
+        });
         it('update on missing guid throws ProviderError with status 404', async () => {
             const store = await createStore();
             const scope = await scopeFor();
@@ -240,9 +274,8 @@ export function runDefinitionStoreConformance(opts) {
             expect(got?.nextVersionNumber).toBe(4);
         });
         it('reserveNextVersionNumber mints a FRESH number after delete-latest (fileKeys never collide)', async () => {
-            // The whole reason the counter exists: max(existing)+1 reused a number
-            // after deleting the latest version, colliding the fileKey. The monotonic
-            // counter must hand out a number BEYOND any deleted version's.
+            // The counter exists because max(existing)+1 would reuse a deleted number
+            // and collide the fileKey, so it must go beyond any deleted version's.
             const store = await createStore();
             const scope = await scopeFor();
             const guid = makeUuid();
@@ -545,7 +578,7 @@ export function runDefinitionStoreConformance(opts) {
                 if (!otherUser)
                     throw new Error('ctxIsolation requires scope.secondaryUserId');
                 const guid = makeUuid();
-                await store.create(ctx(scope.ownerId), record(scope, { guid }));
+                await store.create(ctx(scope.ownerId), record(scope, { guid, projectId: scope.privateProjectId ?? scope.projectId }));
                 const page = await store.list(ctx(otherUser));
                 expect(page.items.map((r) => r.guid)).not.toContain(guid);
             });
@@ -556,11 +589,10 @@ export function runDefinitionStoreConformance(opts) {
                 if (!otherUser)
                     throw new Error('ctxIsolation requires scope.secondaryUserId');
                 const guid = makeUuid();
-                await store.create(ctx(scope.ownerId), record(scope, { guid }));
+                await store.create(ctx(scope.ownerId), record(scope, { guid, projectId: scope.privateProjectId ?? scope.projectId }));
                 const got = await store.get(ctx(otherUser), guid);
                 expect(got).toBeNull();
             });
         }
     });
 }
-//# sourceMappingURL=definitionStoreSuite.js.map

package/dist/testing/suites/emailLinkAuthSuite.d.ts

@@ -18,15 +18,12 @@ export interface EmailLinkAuthConformanceOptions {
      * with self-signup enabled or disabled — the suite's tests are robust to
      * either, since they don't assume new users get created.
      *
-     * `validEmail` is an address the adapter will accept (must pass adapter
-     * validation; doesn't need to actually receive mail). `invalidEmail` is
-     * one the adapter must reject as malformed.
+     * `invalidEmail` is an address the adapter must reject as malformed. A valid
+     * send isn't tested here: it needs real mail delivery.
      */
     createAdapter: () => Promise<{
         adapter: IEmailLinkAuth;
-        validEmail: string;
         invalidEmail: string;
     }>;
 }
 export declare function runEmailLinkAuthConformance(opts: EmailLinkAuthConformanceOptions): void;
-//# sourceMappingURL=emailLinkAuthSuite.d.ts.map

package/dist/testing/suites/emailLinkAuthSuite.js

@@ -36,16 +36,8 @@ export function runEmailLinkAuthConformance(opts) {
             const result = await adapter.sendMagicLink(invalidEmail, 'https://example.com/auth/email/callback');
             expect(result.ok).toBe(false);
             if (!result.ok) {
-                expect(['invalid_email', 'rate_limited']).toContain(result.reason);
+                expect(result.reason).toBe('invalid_email');
             }
         });
-        // `sendMagicLink` for a valid email is intentionally NOT tested here:
-        // it requires real Supabase project credentials with email delivery
-        // enabled, and we'd be asserting on side-effects (mail sent) we can't
-        // observe. Adapter-specific integration tests cover that path.
-        void '';
     });
-    // keep `createAdapter` referenced for adapters that have nothing more to test
-    void createAdapter;
 }
-//# sourceMappingURL=emailLinkAuthSuite.js.map

package/dist/testing/suites/eventSinkSuite.d.ts

@@ -49,4 +49,3 @@ export interface EventSinkConformanceOptions {
     cleanup?: () => Promise<void> | void;
 }
 export declare function runEventSinkConformance(opts: EventSinkConformanceOptions): void;
-//# sourceMappingURL=eventSinkSuite.d.ts.map

package/dist/testing/suites/eventSinkSuite.js

@@ -151,6 +151,15 @@ export function runEventSinkConformance(opts) {
             await expect(provider.orgs.createOrg(ctx, makeOrg({ id: orgId, ownerId: actorId }))).rejects.toThrow();
             expect(sink.ofType('org.created')).toHaveLength(0);
         });
+        it('stamps tokenId on an event from an API-token request', async () => {
+            const tokenId = makeUuid();
+            const keyed = {
+                ...ctx,
+                apiScope: { tokenId, scopes: [], expiresAt: '2099-01-01T00:00:00.000Z' }
+            };
+            await provider.orgs.createOrg(keyed, makeOrg({ id: makeUuid(), ownerId: actorId }));
+            expect(sink.ofType('org.created')[0]).toMatchObject({ actorId, tokenId });
+        });
         it('system-context mutations emit with actorId="system"', async () => {
             const sysCtx = {
                 userId: '',
@@ -261,4 +270,3 @@ function makeShareLink(overrides) {
         solveCount: 0
     };
 }
-//# sourceMappingURL=eventSinkSuite.js.map

package/dist/testing/suites/helpers.d.ts

@@ -14,6 +14,11 @@ export declare function makeCtx(userId: string, opts?: {
     orgPermissions?: RequestContext['orgPermissions'];
     sessionToken?: string;
 }): RequestContext;
+/**
+ * A system context holding no permissions of its own, for proving a store leans on
+ * `system` rather than on a permission `SYSTEM_CONTEXT` happens to carry.
+ */
+export declare function makeSystemCtx(userId?: string): RequestContext;
 export declare function makeUuid(): string;
 /**
  * Optional hook adapters pass when their backend enforces referential
@@ -52,4 +57,3 @@ export declare function makeSeedHelpers(seedUser: SeedUserFn): {
     registerToken: (userId: string, sessionToken: string) => void;
     tokens: Map<string, string>;
 };
-//# sourceMappingURL=helpers.d.ts.map

package/dist/testing/suites/helpers.js

@@ -17,6 +17,13 @@ export function makeCtx(userId, opts = {}) {
         adapterContext: opts.sessionToken ? { sessionToken: opts.sessionToken } : undefined
     };
 }
+/**
+ * A system context holding no permissions of its own, for proving a store leans on
+ * `system` rather than on a permission `SYSTEM_CONTEXT` happens to carry.
+ */
+export function makeSystemCtx(userId = '') {
+    return { userId, platformPermissions: [], orgPermissions: [], system: true };
+}
 export function makeUuid() {
     return crypto.randomUUID();
 }
@@ -44,4 +51,3 @@ export function makeSeedHelpers(seedUser) {
     }
     return { seed, ctx, registerToken, tokens };
 }
-//# sourceMappingURL=helpers.js.map

package/dist/testing/suites/inviteStoreSuite.d.ts

@@ -31,4 +31,3 @@ export interface InviteStoreConformanceOptions {
     seedUser?: SeedUserFn;
 }
 export declare function runInviteStoreConformance(opts: InviteStoreConformanceOptions): void;
-//# sourceMappingURL=inviteStoreSuite.d.ts.map