@selvajs/platform 0.21.0-beta.3 → 1.0.0-beta.4

package/README.md

@@ -1,6 +1,6 @@
 # @selvajs/platform
 
-Pure TypeScript interfaces defining Selva's contract with its backends — no runtime dependency on a specific database, storage, or auth service. Concrete adapters live in their own packages: `@selvajs/local-provider`, `@selvajs/supabase-provider`, `@selvajs/header-auth-provider`.
+Selva's contract with its backends: the interfaces, plus the logic every adapter shares (access rules, API-token scopes, at-rest secret encryption, Zod request schemas, slugs, the image transcoder) and vitest conformance suites. No dependency on a specific database, storage or auth service. Concrete adapters live in their own packages: `@selvajs/local-provider`, `@selvajs/supabase-provider`, `@selvajs/header-auth-provider`.
 
 This README is the contract. Read it before writing an adapter.
 
@@ -20,6 +20,7 @@ This README is the contract. Read it before writing an adapter.
 | `IShareLinkStore`            | Per-definition anonymous-access tokens.                                           | Yes — every method.                                                  |
 | `IInviteStore`               | Pending org-membership invitations.                                               | Yes — every method.                                                  |
 | `IComputeServerStore`        | Global + per-org compute-server config.                                           | No — not tenant-scoped.                                              |
+| `IApiTokenStore`             | API tokens and their revocation.                                                  | Yes — every method.                                                  |
 | `IStorageProvider`           | Path-based blob storage. Authorization is the caller's responsibility.            | No — callers pass already-authorized paths.                          |
 
 `IDataProvider` composes every store, plus optional `auditQuery` / `events` hooks, an optional `verifySchemaVersion` handshake (for adapters whose schema migrates out-of-band), and the `ensureUser` / `onUserDeleted` lifecycle methods. An adapter typically implements one class per store and aggregates them.
@@ -49,12 +50,12 @@ Providers are two-phase: a metadata store (`IDataProvider`) and a blob store (`I
 
 List queries filter `'pending'` and `'archived'` by default (`DefinitionListOptions.includePending` / `includeArchived` opt in). If step 2 fails, the record stays `'pending'` and is invisible to consumers.
 
-**Delete — blob-first:**
+**Delete — metadata-first:**
 
-1. `storage.deletePrefix(prefix)`.
-2. `data.delete(guid)`.
+1. `data.delete(guid)`, which hides the record at once.
+2. `storage.deletePrefix(prefix)`.
 
-If step 2 fails, a retry re-deletes blobs (no-op) and succeeds.
+If step 2 fails, the blobs are orphans no reader can reach. The reverse order would leave a live record with its blobs gone.
 
 ---
 
@@ -84,7 +85,7 @@ The Selva app normally picks bundled providers from `SELVA_AUTH_PROVIDER` / `SEL
 
 ## Testing your adapter
 
-`@selvajs/platform/testing` ships a conformance suite per store. Adapters import it and run it against their own instance — passing means the adapter behaves the same as the in-memory reference.
+`@selvajs/platform/testing` ships a conformance suite per store. Adapters import it and run it against their own instance — passing means the adapter honours the contract the bundled providers do.
 
 ```ts
 import { runDefinitionStoreConformance } from '@selvajs/platform/testing';
@@ -96,7 +97,9 @@ runDefinitionStoreConformance({
 });
 ```
 
-A suite exists per store, plus auth, email-link auth, storage, event sink, and solve-metric sink. They cover `ctx` scoping, `pending` filtering, `includePending` opt-in, and `ProviderError` shapes; they do not cover performance or concurrency.
+A suite exists per store, plus auth, email-link auth, storage, event sink and solve-metric sink. `runAuthProviderConformance` wraps `runAuthCoreConformance` and `runPasswordAuthConformance`, so a provider without passwords can run the core alone or pass `passwordless`. New cases go behind an option, so an upgrade doesn't turn a third-party adapter red. The suites cover `ctx` scoping, `pending` filtering, `includePending` opt-in, `ProviderError` shapes, and the races a store exists to prevent, such as the share-link solve cap. They don't cover performance.
+
+`sharp` is an optional peer dependency. An adapter that calls `transcodeImageIfNeeded` has to install it.
 
 ---
 

package/dist/access/index.d.ts

@@ -1,3 +1,2 @@
 export type { ProjectAccessInput, DefinitionAccessInput, VisibilityChangeInput, ReclaimAccessInput, CreateProjectAccessInput, OrgOwnerAuthorityInput, OwnerRemovalInput, OwnerRemovalCheck } from './rules.js';
 export { canView, canSolve, canEdit, canCreateDefinition, canManage, canEditProjectSettings, canChangeVisibilityToPublic, canEditDefinition, canReclaim, canCreateProject, canChangeOrgRole, checkOwnerRemoval, withAdminBypass } from './rules.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/access/index.js

@@ -1,2 +1 @@
 export { canView, canSolve, canEdit, canCreateDefinition, canManage, canEditProjectSettings, canChangeVisibilityToPublic, canEditDefinition, canReclaim, canCreateProject, canChangeOrgRole, checkOwnerRemoval, withAdminBypass } from './rules.js';
-//# sourceMappingURL=index.js.map

package/dist/access/rules.d.ts

@@ -52,8 +52,8 @@ export declare function canSolve(input: ProjectAccessInput): boolean;
 export declare function canEdit(input: ProjectAccessInput): boolean;
 /**
  * Adding a new definition. Commons projects (`autoJoinOnUpload`) take uploads
- * from anyone who reaches them, and the uploader owns what they upload;
- * everywhere else it needs {@link canEdit}.
+ * from anyone who can {@link canView} them, and the uploader owns what they
+ * upload; everywhere else it needs {@link canEdit}.
  */
 export declare function canCreateDefinition(input: ProjectAccessInput): boolean;
 /** Platform projects: `instance_admin` only. All other visibilities: project owner. */
@@ -131,18 +131,12 @@ export interface OrgOwnerAuthorityInput {
     role: OrgRole;
 }
 /**
- * Whether the actor may hand out or take away org `owner`/`admin` standing (§3).
+ * Whether the actor may hand out or take away org `owner`/`admin` standing.
+ * Inviting someone as owner/admin, changing a member's role and removing an owner
+ * are one rule, so all three read it here.
  *
- * Three routes decide this — inviting someone as owner/admin, changing an
- * existing member's role, and removing an owner — and all three had written it
- * out longhand. Two of them had drifted by the time the access audit found
- * them: the invite route let an admin mint an `owner` invite for themselves,
- * and DELETE let an admin remove an owner that PATCH would not let them demote.
- * They are one rule, so they read it from one place.
- *
- * Reads the actor's **membership row**. `Organization.ownerId` is a separate
- * field that can disagree with it — see the sole-`instance_admin` finding — and
- * is not authority for this decision.
+ * Reads the actor's **membership row**. `Organization.ownerId` is a separate field
+ * that can disagree with it and is not authority for this decision.
  */
 export declare function canChangeOrgRole(input: OrgOwnerAuthorityInput): boolean;
 /**
@@ -163,4 +157,3 @@ export interface OwnerRemovalInput {
     confirmed: boolean;
 }
 export declare function checkOwnerRemoval(input: OwnerRemovalInput): OwnerRemovalCheck;
-//# sourceMappingURL=rules.d.ts.map

package/dist/access/rules.js

@@ -33,10 +33,12 @@ export function canView(input) {
         return platformGrants.some((g) => (g.granteeType === 'user' && g.granteeId === userId) ||
             (g.granteeType === 'org' && g.granteeId === actingOrgId));
     }
-    if (project.visibility === 'private')
-        return member !== null;
+    // A project member sees the project at any visibility. Leaving the org ends the
+    // membership, so this only widens access for someone who reclaimed from outside.
+    if (member !== null)
+        return true;
     if (project.visibility === 'org')
-        return orgMember !== null;
+        return orgMember !== null && actingOrgId === project.orgId;
     if (project.visibility === 'public')
         return allowCrossOrgPublic ? true : orgMember !== null;
     return false;
@@ -69,7 +71,9 @@ export function canSolve(input) {
  */
 export function canEdit(input) {
     const { member, project, enablePlatformProjects, platformPermissions } = input;
-    if (project?.visibility === 'platform') {
+    if (!project)
+        return false;
+    if (project.visibility === 'platform') {
         if (!enablePlatformProjects)
             return false;
         return isInstanceAdmin(platformPermissions);
@@ -78,15 +82,17 @@ export function canEdit(input) {
 }
 /**
  * Adding a new definition. Commons projects (`autoJoinOnUpload`) take uploads
- * from anyone who reaches them, and the uploader owns what they upload;
- * everywhere else it needs {@link canEdit}.
+ * from anyone who can {@link canView} them, and the uploader owns what they
+ * upload; everywhere else it needs {@link canEdit}.
  */
 export function canCreateDefinition(input) {
-    return input.project?.autoJoinOnUpload === true || canEdit(input);
+    return (input.project?.autoJoinOnUpload === true && canView(input)) || canEdit(input);
 }
 /** Platform projects: `instance_admin` only. All other visibilities: project owner. */
 export function canManage(input) {
-    if (input.project?.visibility === 'platform') {
+    if (!input.project)
+        return false;
+    if (input.project.visibility === 'platform') {
         if (!input.enablePlatformProjects)
             return false;
         return isInstanceAdmin(input.platformPermissions);
@@ -95,12 +101,7 @@ export function canManage(input) {
 }
 /** Platform projects: `instance_admin` only. All other visibilities: project owner. */
 export function canEditProjectSettings(input) {
-    if (input.project?.visibility === 'platform') {
-        if (!input.enablePlatformProjects)
-            return false;
-        return isInstanceAdmin(input.platformPermissions);
-    }
-    return input.member?.role === 'owner';
+    return canManage(input);
 }
 /**
  * Authorization to flip a project to `public`. The `ALLOW_CROSS_ORG_PUBLIC`
@@ -121,6 +122,8 @@ export function canEditDefinition(input) {
     const { project, definition, member, orgMember, userId, platformPermissions, enablePlatformProjects } = input;
     if (!project || !definition)
         return false;
+    if (definition.projectId !== project.id)
+        return false;
     if (project.visibility === 'platform') {
         if (!enablePlatformProjects)
             return false;
@@ -174,18 +177,12 @@ export function canCreateProject(input) {
     return false;
 }
 /**
- * Whether the actor may hand out or take away org `owner`/`admin` standing (§3).
- *
- * Three routes decide this — inviting someone as owner/admin, changing an
- * existing member's role, and removing an owner — and all three had written it
- * out longhand. Two of them had drifted by the time the access audit found
- * them: the invite route let an admin mint an `owner` invite for themselves,
- * and DELETE let an admin remove an owner that PATCH would not let them demote.
- * They are one rule, so they read it from one place.
+ * Whether the actor may hand out or take away org `owner`/`admin` standing.
+ * Inviting someone as owner/admin, changing a member's role and removing an owner
+ * are one rule, so all three read it here.
  *
- * Reads the actor's **membership row**. `Organization.ownerId` is a separate
- * field that can disagree with it — see the sole-`instance_admin` finding — and
- * is not authority for this decision.
+ * Reads the actor's **membership row**. `Organization.ownerId` is a separate field
+ * that can disagree with it and is not authority for this decision.
  */
 export function canChangeOrgRole(input) {
     if (input.role === 'member')
@@ -202,4 +199,3 @@ export function checkOwnerRemoval(input) {
         return 'needs_confirm';
     return 'ok';
 }
-//# sourceMappingURL=rules.js.map

package/dist/apiTokens/index.d.ts

@@ -1,6 +1,5 @@
 export type { ApiScope, ApiScopeAction, ApiScopeResource, ApiToken, ApiTokenSummary, ApiTokenRevokeReason, ApiTokenLifetimeDays } from './types.js';
-export { ApiScopeActionSchema, ApiScopeStringSchema, ApiTokenRevokeReasonSchema, API_TOKEN_LIFETIME_DAYS, parseApiScope, formatApiScope, describeApiScope } from './types.js';
+export { ApiScopeActionSchema, ApiScopeStringSchema, API_TOKEN_LIFETIME_DAYS, parseApiScope, formatApiScope, describeApiScope } from './types.js';
 export type { IApiTokenStore } from './interface.js';
 export type { ScopeTarget } from './scope.js';
 export { scopeAllows, apiScopeActionCovers, narrowApiTokenContext, outsideTokenOrg } from './scope.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/apiTokens/index.js

@@ -1,3 +1,2 @@
-export { ApiScopeActionSchema, ApiScopeStringSchema, ApiTokenRevokeReasonSchema, API_TOKEN_LIFETIME_DAYS, parseApiScope, formatApiScope, describeApiScope } from './types.js';
+export { ApiScopeActionSchema, ApiScopeStringSchema, API_TOKEN_LIFETIME_DAYS, parseApiScope, formatApiScope, describeApiScope } from './types.js';
 export { scopeAllows, apiScopeActionCovers, narrowApiTokenContext, outsideTokenOrg } from './scope.js';
-//# sourceMappingURL=index.js.map

package/dist/apiTokens/interface.d.ts

@@ -34,4 +34,3 @@ export interface IApiTokenStore {
     /** Called from the `deleteOrg` cascade. */
     deleteByOrg(ctx: RequestContext, orgId: string): Promise<void>;
 }
-//# sourceMappingURL=interface.d.ts.map

package/dist/apiTokens/interface.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=interface.js.map

package/dist/apiTokens/scope.d.ts

@@ -34,4 +34,3 @@ export declare function narrowApiTokenContext(ctx: RequestContext, token: Pick<A
  * not found. Session requests are never outside.
  */
 export declare function outsideTokenOrg(ctx: RequestContext, orgId: string): boolean;
-//# sourceMappingURL=scope.d.ts.map

package/dist/apiTokens/scope.js

@@ -61,4 +61,3 @@ export function narrowApiTokenContext(ctx, token) {
 export function outsideTokenOrg(ctx, orgId) {
     return ctx.apiScope !== undefined && orgId !== ctx.actingOrgId;
 }
-//# sourceMappingURL=scope.js.map

package/dist/apiTokens/types.d.ts

@@ -82,4 +82,3 @@ export declare const API_TOKEN_LIFETIME_DAYS: readonly [30, 90, 180];
 export type ApiTokenLifetimeDays = (typeof API_TOKEN_LIFETIME_DAYS)[number];
 /** "Read and change everything in the org". Names no ids, so it suits an email. */
 export declare function describeApiScope(value: string): string;
-//# sourceMappingURL=types.d.ts.map

package/dist/apiTokens/types.js

@@ -57,4 +57,3 @@ export function describeApiScope(value) {
             : 'everything in the org';
     return `${ACTION_WORDS[scope.action]} ${what}`;
 }
-//# sourceMappingURL=types.js.map

package/dist/auth/index.d.ts

@@ -1,3 +1,2 @@
 export type { AuthUser, UserManagementResult, LoginResult } from './types.js';
 export type { IAuthProvider, IOAuthAuth, ISessionRefresh, IPasswordAuth, IEmailLinkAuth, IProxyAuth, IDelegatedSession, DelegatedSessionStatus } from './interface.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=index.js.map

package/dist/auth/interface.d.ts

@@ -30,9 +30,8 @@ export interface IPasswordAuth {
  *      `getOAuthAuthorizationUrl` and 303s to the result.
  *   2. IdP redirects back to `/auth/{provider}/callback?code=...` → server
  *      calls `exchangeOAuthCode` to mint the session pair.
- *   3. When the access token expires, session-refresh middleware in
- *      `hooks.server.ts` calls `refreshSession` to swap in a fresh pair
- *      without bouncing the user.
+ *
+ * Keeping the session alive afterwards is `ISessionRefresh`'s job.
  *
  * Each method returns `null` rather than throwing on irrecoverable
  * credential failures, so the route layer can pick the right HTTP shape
@@ -64,23 +63,6 @@ export interface IOAuthAuth {
         sessionToken: string;
         refreshToken: string;
     } | null>;
-    /**
-     * Swap a refresh token for a fresh access/refresh pair. Returns null on
-     * irrecoverable failure (revoked, expired, signed by a different secret);
-     * the session-refresh middleware treats null as "force re-login" by
-     * clearing the refresh cookie.
-     *
-     * @deprecated Session refresh is session lifecycle, not OAuth — a consumer
-     * that brokers no OAuth still needs it (refreshing a password session, or
-     * revoking on logout). Moved to `IAuthProvider.sessionRefresh`
-     * (`ISessionRefresh`). This member delegates for one release and will be
-     * removed in the next minor; migrate callers to
-     * `auth.sessionRefresh?.refreshSession(...)`.
-     */
-    refreshSession(refreshToken: string): Promise<{
-        sessionToken: string;
-        refreshToken: string;
-    } | null>;
 }
 /**
  * Optional session-lifecycle surface: refresh an expiring session, revoke one
@@ -245,8 +227,8 @@ export interface IDelegatedSession {
      */
     status(): Promise<DelegatedSessionStatus>;
     /**
-     * A session token acting as `userId` inside `orgId`, valid for about a
-     * minute. It carries no instance-admin rights, whatever the user holds: those
+     * A session token acting as `userId` inside `orgId`, valid for `ttlSeconds`
+     * (default 60 s). It carries no instance-admin rights, whatever the user holds: those
      * never ride on a bearer key. Throws if `status` isn't ok.
      */
     mint(userId: string, opts: {
@@ -327,4 +309,3 @@ export interface IAuthProvider {
      */
     touchLastLogin?(id: string): Promise<void>;
 }
-//# sourceMappingURL=interface.d.ts.map

package/dist/auth/interface.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=interface.js.map

package/dist/auth/types.d.ts

@@ -21,7 +21,10 @@ export interface AuthUser {
  * - `last_admin`    — refused; would leave zero `instance_admin` users
  */
 export type UserManagementResult = 'ok' | 'not_found' | 'not_supported' | 'last_admin';
-/** `success` includes the session token the provider minted. */
+/**
+ * `success` includes the session token the provider minted. `rate_limited` is for
+ * providers that throttle logins; no bundled provider returns it.
+ */
 export type LoginResult = {
     kind: 'success';
     user: AuthUser;
@@ -30,4 +33,3 @@ export type LoginResult = {
     kind: 'failed';
     reason?: 'invalid_credentials' | 'disabled' | 'rate_limited';
 };
-//# sourceMappingURL=types.d.ts.map

package/dist/auth/types.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=types.js.map

package/dist/bindings/index.d.ts

@@ -1,3 +1,2 @@
 export type { IBindingResolver } from './interface.js';
 export { NoopBindingResolver } from './interface.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/bindings/index.js

@@ -1,2 +1 @@
 export { NoopBindingResolver } from './interface.js';
-//# sourceMappingURL=index.js.map

package/dist/bindings/interface.d.ts

@@ -37,4 +37,3 @@ export interface IBindingResolver {
 export declare class NoopBindingResolver implements IBindingResolver {
     resolve(): Promise<Map<string, unknown>>;
 }
-//# sourceMappingURL=interface.d.ts.map

package/dist/bindings/interface.js

@@ -17,4 +17,3 @@ export class NoopBindingResolver {
         return new Map();
     }
 }
-//# sourceMappingURL=interface.js.map

package/dist/computeServer/index.d.ts

@@ -1,8 +1,2 @@
-export type { ComputeServerConfig, ComputeConfig, PlatformComputeServer, OrgComputeServer } from './types.js';
-export { isPlatformServer, isOrgServer } from './types.js';
-export type { IComputeServerStore, GetConfigOptions } from './interface.js';
+export * from './public.js';
 export { isEncryptedSecret, encryptSecret, decryptSecret, decodeSecretKey } from './secrets.js';
-export type { SecretVerificationReport, SecretVerificationFailure, SecretVerificationFailureReason } from './secrets.js';
-export type { ResolveOptions } from './utils.js';
-export { serversVisibleTo, defaultServerIdFor, resolveServerForOrg, findServerById, platformServers, orgServersFor, scopeConfigToOrg } from './utils.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/computeServer/index.js

@@ -1,9 +1,3 @@
-export { isPlatformServer, isOrgServer } from './types.js';
-// At-rest secret crypto (uses `node:crypto`). Server-only — deliberately NOT
-// re-exported from the root barrel, which client `.svelte` code imports and
-// where a browser bundle can't resolve `node:crypto`. Import these from
-// `@selvajs/platform/computeServer` in server code. The report TYPES are erased
-// at build, so they also stay re-exported from the root barrel for convenience.
+export * from './public.js';
+// Server-only: import these from `@selvajs/platform/computeServer`.
 export { isEncryptedSecret, encryptSecret, decryptSecret, decodeSecretKey } from './secrets.js';
-export { serversVisibleTo, defaultServerIdFor, resolveServerForOrg, findServerById, platformServers, orgServersFor, scopeConfigToOrg } from './utils.js';
-//# sourceMappingURL=index.js.map

package/dist/computeServer/interface.d.ts

@@ -28,10 +28,9 @@ export interface GetConfigOptions {
      *
      * Org-facing surfaces must pass this. Without it the store hands back every
      * platform server and every *other* org's private servers, leaving each
-     * caller to re-apply a filter it can silently forget — the global
-     * `defaultServerId` in particular passed straight through before this
-     * existed. Admin surfaces, boot health and the save-diff handlers omit it
-     * deliberately; they act instance-wide.
+     * caller to re-apply a filter it can silently forget. Admin surfaces, boot
+     * health and the save-diff handlers omit it deliberately; they act
+     * instance-wide.
      */
     scopeToOrgId?: string;
 }
@@ -53,6 +52,10 @@ export interface IComputeServerStore {
      * authenticated under the current `SELVA_AT_REST_KEY` (the solve fails
      * later at Rhino.Compute rather than here).
      *
+     * A plaintext key at rest is adapter-defined: local throws, because it never
+     * writes one, and Supabase warns and returns it, because rows can predate
+     * encryption. Both report it through `verifySecrets`.
+     *
      * The narrow path onto the solve hot path: resolve a server from the
      * key-free config, then fetch that one key.
      */
@@ -61,7 +64,8 @@ export interface IComputeServerStore {
     savePlatformServers(ctx: RequestContext, servers: ComputeServerConfig[], defaultServerId: string | undefined): Promise<void>;
     /**
      * Replaces the org-private server set for `orgId` and (optionally) updates
-     * `orgDefaults[orgId]`. Platform rows are left untouched.
+     * `orgDefaults[orgId]`. Platform rows are left untouched, and any non-org entry
+     * in `servers` is ignored.
      *
      * `defaultServerId: null` clears the org's override; `undefined` leaves
      * the existing value alone.
@@ -90,4 +94,3 @@ export interface IComputeServerStore {
      */
     verifySecrets?(): Promise<SecretVerificationReport>;
 }
-//# sourceMappingURL=interface.d.ts.map

package/dist/computeServer/interface.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=interface.js.map

package/dist/computeServer/public.d.ts

@@ -0,0 +1,6 @@
+export type { ComputeServerConfig, ComputeConfig, PlatformComputeServer, OrgComputeServer } from './types.js';
+export { COMPUTE_RETRY_MAX, COMPUTE_TIMEOUT_DEFAULT_MS, COMPUTE_TIMEOUT_MAX_MS, COMPUTE_TIMEOUT_MIN_MS, isPlatformServer, isOrgServer } from './types.js';
+export type { IComputeServerStore, GetConfigOptions } from './interface.js';
+export type { ResolveOptions } from './utils.js';
+export { serversVisibleTo, defaultServerIdFor, clampRetryCount, clampTimeoutMs, pickServer, resolveServerForOrg, findServerById, platformServers, scopeConfigToOrg } from './utils.js';
+export type { SecretVerificationReport, SecretVerificationFailure, SecretVerificationFailureReason } from './secrets.js';

package/dist/computeServer/public.js

@@ -0,0 +1,2 @@
+export { COMPUTE_RETRY_MAX, COMPUTE_TIMEOUT_DEFAULT_MS, COMPUTE_TIMEOUT_MAX_MS, COMPUTE_TIMEOUT_MIN_MS, isPlatformServer, isOrgServer } from './types.js';
+export { serversVisibleTo, defaultServerIdFor, clampRetryCount, clampTimeoutMs, pickServer, resolveServerForOrg, findServerById, platformServers, scopeConfigToOrg } from './utils.js';

package/dist/computeServer/secrets.d.ts

@@ -1,8 +1,12 @@
+export declare function isEncryptedSecret(value: string): boolean;
 /**
  * AES-256-GCM envelope for at-rest secrets (e.g. compute API keys).
  *
- * Wire format: `enc:v1:<base64(iv|tag|ciphertext)>`. The version prefix lets
- * a future migration to a new algorithm tell old and new envelopes apart.
+ * Wire format: `enc:v2:<base64(iv|tag|ciphertext)>`. `v2` authenticates the
+ * record the secret belongs to as AAD, so ciphertext copied onto another record
+ * fails to decrypt instead of handing the plaintext to that record's URL.
+ * `enc:v1:` envelopes have no AAD and still read: a store rewrites them as `v2`
+ * on its next save.
  *
  * Defends against backup leaks, accidental file/DB sharing, and read-only
  * storage access — not against an attacker who also has the master key
@@ -11,10 +15,13 @@
  *
  * Pure `node:crypto`, no fs or DB coupling, so the local and Supabase
  * compute-server stores share this one implementation.
+ *
+ * Pass `aad` to bind the secret to its record. {@link decryptSecret} then needs the
+ * same value.
  */
-export declare function isEncryptedSecret(value: string): boolean;
-export declare function encryptSecret(plaintext: string, key: Buffer): string;
-export declare function decryptSecret(envelope: string, key: Buffer): string;
+export declare function encryptSecret(plaintext: string, key: Buffer, aad?: string): string;
+/** `aad` is ignored for an `enc:v1:` envelope and required for an `enc:v2:` one. */
+export declare function decryptSecret(envelope: string, key: Buffer, aad?: string): string;
 /**
  * Decodes a `SELVA_AT_REST_KEY` env var into a 32-byte buffer (64-char hex or
  * base64, with or without padding). Throws on anything else so a
@@ -46,4 +53,3 @@ export interface SecretVerificationReport {
     /** True if at least one row holds an unencrypted apiKey at rest. */
     plaintextFound: boolean;
 }
-//# sourceMappingURL=secrets.d.ts.map

package/dist/computeServer/secrets.js

@@ -2,12 +2,19 @@ import { randomBytes, createCipheriv, createDecipheriv } from 'node:crypto';
 const ALGO = 'aes-256-gcm';
 const IV_BYTES = 12;
 const TAG_BYTES = 16;
-const PREFIX = 'enc:v1:';
+const PREFIX_V1 = 'enc:v1:';
+const PREFIX_V2 = 'enc:v2:';
+export function isEncryptedSecret(value) {
+    return value.startsWith(PREFIX_V1) || value.startsWith(PREFIX_V2);
+}
 /**
  * AES-256-GCM envelope for at-rest secrets (e.g. compute API keys).
  *
- * Wire format: `enc:v1:<base64(iv|tag|ciphertext)>`. The version prefix lets
- * a future migration to a new algorithm tell old and new envelopes apart.
+ * Wire format: `enc:v2:<base64(iv|tag|ciphertext)>`. `v2` authenticates the
+ * record the secret belongs to as AAD, so ciphertext copied onto another record
+ * fails to decrypt instead of handing the plaintext to that record's URL.
+ * `enc:v1:` envelopes have no AAD and still read: a store rewrites them as `v2`
+ * on its next save.
  *
  * Defends against backup leaks, accidental file/DB sharing, and read-only
  * storage access — not against an attacker who also has the master key
@@ -16,11 +23,11 @@ const PREFIX = 'enc:v1:';
  *
  * Pure `node:crypto`, no fs or DB coupling, so the local and Supabase
  * compute-server stores share this one implementation.
+ *
+ * Pass `aad` to bind the secret to its record. {@link decryptSecret} then needs the
+ * same value.
  */
-export function isEncryptedSecret(value) {
-    return value.startsWith(PREFIX);
-}
-export function encryptSecret(plaintext, key) {
+export function encryptSecret(plaintext, key, aad) {
     if (key.length !== 32) {
         throw new Error(`Secret key must be 32 bytes; got ${key.length}`);
     }
@@ -29,23 +36,33 @@ export function encryptSecret(plaintext, key) {
     }
     const iv = randomBytes(IV_BYTES);
     const cipher = createCipheriv(ALGO, key, iv);
+    if (aad !== undefined)
+        cipher.setAAD(Buffer.from(aad, 'utf8'));
     const ciphertext = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
     const tag = cipher.getAuthTag();
-    return PREFIX + Buffer.concat([iv, tag, ciphertext]).toString('base64');
+    const prefix = aad === undefined ? PREFIX_V1 : PREFIX_V2;
+    return prefix + Buffer.concat([iv, tag, ciphertext]).toString('base64');
 }
-export function decryptSecret(envelope, key) {
+/** `aad` is ignored for an `enc:v1:` envelope and required for an `enc:v2:` one. */
+export function decryptSecret(envelope, key, aad) {
     if (key.length !== 32) {
         throw new Error(`Secret key must be 32 bytes; got ${key.length}`);
     }
     if (!isEncryptedSecret(envelope)) {
         throw new Error('Value is not an encrypted secret envelope');
     }
-    const buf = Buffer.from(envelope.slice(PREFIX.length), 'base64');
+    const bound = envelope.startsWith(PREFIX_V2);
+    if (bound && aad === undefined) {
+        throw new Error('This secret is bound to a record: pass its id');
+    }
+    const buf = Buffer.from(envelope.slice(PREFIX_V2.length), 'base64');
     const iv = buf.subarray(0, IV_BYTES);
     const tag = buf.subarray(IV_BYTES, IV_BYTES + TAG_BYTES);
     const ciphertext = buf.subarray(IV_BYTES + TAG_BYTES);
     const decipher = createDecipheriv(ALGO, key, iv);
     decipher.setAuthTag(tag);
+    if (bound)
+        decipher.setAAD(Buffer.from(aad, 'utf8'));
     return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString('utf8');
 }
 /**
@@ -55,12 +72,15 @@ export function decryptSecret(envelope, key) {
  * ciphertext nothing can decrypt.
  */
 export function decodeSecretKey(raw) {
-    if (/^[0-9a-fA-F]{64}$/.test(raw))
-        return Buffer.from(raw, 'hex');
-    const buf = Buffer.from(raw, 'base64');
-    if (buf.length === 32)
+    const key = raw.trim();
+    if (/^[0-9a-fA-F]{64}$/.test(key))
+        return Buffer.from(key, 'hex');
+    // `Buffer.from` skips what it can't decode, so only a round trip proves the
+    // whole string was base64 rather than 32 bytes of it.
+    const buf = Buffer.from(key, 'base64');
+    if (buf.length === 32 && buf.toString('base64').replace(/=+$/, '') === key.replace(/=+$/, '')) {
         return buf;
+    }
     throw new Error('SELVA_AT_REST_KEY must be 32 bytes encoded as 64-char hex or base64. ' +
         "Generate one with: node -e \"console.log(require('crypto').randomBytes(32).toString('hex'))\"");
 }
-//# sourceMappingURL=secrets.js.map

package/dist/computeServer/types.d.ts

@@ -1,3 +1,7 @@
+export declare const COMPUTE_TIMEOUT_DEFAULT_MS = 30000;
+export declare const COMPUTE_TIMEOUT_MIN_MS = 1000;
+export declare const COMPUTE_TIMEOUT_MAX_MS = 300000;
+export declare const COMPUTE_RETRY_MAX = 5;
 /**
  * Compute servers belong to one of two scopes — never both.
  *
@@ -29,7 +33,7 @@ interface ComputeServerCommon {
      * they'd only throw away.
      */
     hasApiKey?: boolean;
-    /** Default: 30000. */
+    /** Default: {@link COMPUTE_TIMEOUT_DEFAULT_MS}. */
     timeoutMs?: number;
     /** Default: 0. */
     retryCount?: number;
@@ -68,4 +72,3 @@ export interface ComputeConfig {
 export declare function isPlatformServer(s: ComputeServerConfig): s is PlatformComputeServer;
 export declare function isOrgServer(s: ComputeServerConfig): s is OrgComputeServer;
 export {};
-//# sourceMappingURL=types.d.ts.map

package/dist/computeServer/types.js

@@ -1,3 +1,7 @@
+export const COMPUTE_TIMEOUT_DEFAULT_MS = 30000;
+export const COMPUTE_TIMEOUT_MIN_MS = 1000;
+export const COMPUTE_TIMEOUT_MAX_MS = 300000;
+export const COMPUTE_RETRY_MAX = 5;
 // ============================================================================
 // Type guards
 // ============================================================================
@@ -7,4 +11,3 @@ export function isPlatformServer(s) {
 export function isOrgServer(s) {
     return s.scope === 'org';
 }
-//# sourceMappingURL=types.js.map