@selvajs/platform 0.21.0-beta.3 → 1.0.0-beta.5

package/README.md

@@ -1,6 +1,6 @@
 # @selvajs/platform
 
-Pure TypeScript interfaces defining Selva's contract with its backends — no runtime dependency on a specific database, storage, or auth service. Concrete adapters live in their own packages: `@selvajs/local-provider`, `@selvajs/supabase-provider`, `@selvajs/header-auth-provider`.
+Selva's contract with its backends: the interfaces, plus the logic every adapter shares (access rules, API-token scopes, at-rest secret encryption, Zod request schemas, slugs, the image transcoder) and vitest conformance suites. No dependency on a specific database, storage or auth service. Concrete adapters live in their own packages: `@selvajs/local-provider`, `@selvajs/supabase-provider`, `@selvajs/header-auth-provider`.
 
 This README is the contract. Read it before writing an adapter.
 
@@ -20,6 +20,7 @@ This README is the contract. Read it before writing an adapter.
 | `IShareLinkStore`            | Per-definition anonymous-access tokens.                                           | Yes — every method.                                                  |
 | `IInviteStore`               | Pending org-membership invitations.                                               | Yes — every method.                                                  |
 | `IComputeServerStore`        | Global + per-org compute-server config.                                           | No — not tenant-scoped.                                              |
+| `IApiTokenStore`             | API tokens and their revocation.                                                  | Yes — every method.                                                  |
 | `IStorageProvider`           | Path-based blob storage. Authorization is the caller's responsibility.            | No — callers pass already-authorized paths.                          |
 
 `IDataProvider` composes every store, plus optional `auditQuery` / `events` hooks, an optional `verifySchemaVersion` handshake (for adapters whose schema migrates out-of-band), and the `ensureUser` / `onUserDeleted` lifecycle methods. An adapter typically implements one class per store and aggregates them.
@@ -49,12 +50,12 @@ Providers are two-phase: a metadata store (`IDataProvider`) and a blob store (`I
 
 List queries filter `'pending'` and `'archived'` by default (`DefinitionListOptions.includePending` / `includeArchived` opt in). If step 2 fails, the record stays `'pending'` and is invisible to consumers.
 
-**Delete — blob-first:**
+**Delete — metadata-first:**
 
-1. `storage.deletePrefix(prefix)`.
-2. `data.delete(guid)`.
+1. `data.delete(guid)`, which hides the record at once.
+2. `storage.deletePrefix(prefix)`.
 
-If step 2 fails, a retry re-deletes blobs (no-op) and succeeds.
+If step 2 fails, the blobs are orphans no reader can reach. The reverse order would leave a live record with its blobs gone.
 
 ---
 
@@ -84,7 +85,7 @@ The Selva app normally picks bundled providers from `SELVA_AUTH_PROVIDER` / `SEL
 
 ## Testing your adapter
 
-`@selvajs/platform/testing` ships a conformance suite per store. Adapters import it and run it against their own instance — passing means the adapter behaves the same as the in-memory reference.
+`@selvajs/platform/testing` ships a conformance suite per store. Adapters import it and run it against their own instance — passing means the adapter honours the contract the bundled providers do.
 
 ```ts
 import { runDefinitionStoreConformance } from '@selvajs/platform/testing';
@@ -96,7 +97,9 @@ runDefinitionStoreConformance({
 });
 ```
 
-A suite exists per store, plus auth, email-link auth, storage, event sink, and solve-metric sink. They cover `ctx` scoping, `pending` filtering, `includePending` opt-in, and `ProviderError` shapes; they do not cover performance or concurrency.
+A suite exists per store, plus auth, email-link auth, storage, event sink and solve-metric sink. `runAuthProviderConformance` wraps `runAuthCoreConformance` and `runPasswordAuthConformance`, so a provider without passwords can run the core alone or pass `passwordless`. New cases go behind an option, so an upgrade doesn't turn a third-party adapter red. The suites cover `ctx` scoping, `pending` filtering, `includePending` opt-in, `ProviderError` shapes, and the races a store exists to prevent, such as the share-link solve cap. They don't cover performance.
+
+`sharp` is an optional peer dependency. An adapter that calls `transcodeImageIfNeeded` has to install it.
 
 ---
 
@@ -108,7 +111,7 @@ Throw `ProviderError` for user-facing failures (`new ProviderError('...', 404)`)
 
 ## Data privacy
 
-Identity and credentials belong to whichever `IAuthProvider` is configured — for Supabase that's a separate service; for the local provider, Selva itself is the auth provider and holds email addresses and password hashes on disk. This package's own stores hold user IDs, authorization metadata, display names, invite email addresses, and audit payloads. **The operator is the data controller.** See [data privacy](../../docs/self-hosting/concepts/data-privacy.md) for the full inventory and what erasure reaches, plus [providers](../../docs/self-hosting/providers/overview.md) and [security & limits](../../docs/self-hosting/concepts/security-and-limits.md).
+Identity and credentials belong to whichever `IAuthProvider` is configured — for Supabase that's a separate service; for the local provider, Selva itself is the auth provider and holds email addresses and password hashes on disk. This package's own stores hold user IDs, authorization metadata, display names, invite email addresses, and audit payloads. **The operator is the data controller.** See [data privacy](../../docs/self-hosting/concepts/data-privacy.md) for the full inventory and what erasure reaches, plus [providers](../../docs/self-hosting/providers/overview.md) and [security & limits](../../docs/self-hosting/deployment/security-and-limits.md).
 
 ---
 

package/dist/access/index.d.ts

@@ -1,3 +1,2 @@
 export type { ProjectAccessInput, DefinitionAccessInput, VisibilityChangeInput, ReclaimAccessInput, CreateProjectAccessInput, OrgOwnerAuthorityInput, OwnerRemovalInput, OwnerRemovalCheck } from './rules.js';
 export { canView, canSolve, canEdit, canCreateDefinition, canManage, canEditProjectSettings, canChangeVisibilityToPublic, canEditDefinition, canReclaim, canCreateProject, canChangeOrgRole, checkOwnerRemoval, withAdminBypass } from './rules.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/access/index.js

@@ -1,2 +1 @@
 export { canView, canSolve, canEdit, canCreateDefinition, canManage, canEditProjectSettings, canChangeVisibilityToPublic, canEditDefinition, canReclaim, canCreateProject, canChangeOrgRole, checkOwnerRemoval, withAdminBypass } from './rules.js';
-//# sourceMappingURL=index.js.map

package/dist/access/rules.d.ts

@@ -52,8 +52,8 @@ export declare function canSolve(input: ProjectAccessInput): boolean;
 export declare function canEdit(input: ProjectAccessInput): boolean;
 /**
  * Adding a new definition. Commons projects (`autoJoinOnUpload`) take uploads
- * from anyone who reaches them, and the uploader owns what they upload;
- * everywhere else it needs {@link canEdit}.
+ * from anyone who can {@link canView} them, and the uploader owns what they
+ * upload; everywhere else it needs {@link canEdit}.
  */
 export declare function canCreateDefinition(input: ProjectAccessInput): boolean;
 /** Platform projects: `instance_admin` only. All other visibilities: project owner. */
@@ -131,18 +131,12 @@ export interface OrgOwnerAuthorityInput {
     role: OrgRole;
 }
 /**
- * Whether the actor may hand out or take away org `owner`/`admin` standing (§3).
+ * Whether the actor may hand out or take away org `owner`/`admin` standing.
+ * Inviting someone as owner/admin, changing a member's role and removing an owner
+ * are one rule, so all three read it here.
  *
- * Three routes decide this — inviting someone as owner/admin, changing an
- * existing member's role, and removing an owner — and all three had written it
- * out longhand. Two of them had drifted by the time the access audit found
- * them: the invite route let an admin mint an `owner` invite for themselves,
- * and DELETE let an admin remove an owner that PATCH would not let them demote.
- * They are one rule, so they read it from one place.
- *
- * Reads the actor's **membership row**. `Organization.ownerId` is a separate
- * field that can disagree with it — see the sole-`instance_admin` finding — and
- * is not authority for this decision.
+ * Reads the actor's **membership row**. `Organization.ownerId` is a separate field
+ * that can disagree with it and is not authority for this decision.
  */
 export declare function canChangeOrgRole(input: OrgOwnerAuthorityInput): boolean;
 /**
@@ -163,4 +157,3 @@ export interface OwnerRemovalInput {
     confirmed: boolean;
 }
 export declare function checkOwnerRemoval(input: OwnerRemovalInput): OwnerRemovalCheck;
-//# sourceMappingURL=rules.d.ts.map

package/dist/access/rules.js

@@ -33,10 +33,12 @@ export function canView(input) {
         return platformGrants.some((g) => (g.granteeType === 'user' && g.granteeId === userId) ||
             (g.granteeType === 'org' && g.granteeId === actingOrgId));
     }
-    if (project.visibility === 'private')
-        return member !== null;
+    // A project member sees the project at any visibility. Leaving the org ends the
+    // membership, so this only widens access for someone who reclaimed from outside.
+    if (member !== null)
+        return true;
     if (project.visibility === 'org')
-        return orgMember !== null;
+        return orgMember !== null && actingOrgId === project.orgId;
     if (project.visibility === 'public')
         return allowCrossOrgPublic ? true : orgMember !== null;
     return false;
@@ -69,7 +71,9 @@ export function canSolve(input) {
  */
 export function canEdit(input) {
     const { member, project, enablePlatformProjects, platformPermissions } = input;
-    if (project?.visibility === 'platform') {
+    if (!project)
+        return false;
+    if (project.visibility === 'platform') {
         if (!enablePlatformProjects)
             return false;
         return isInstanceAdmin(platformPermissions);
@@ -78,15 +82,17 @@ export function canEdit(input) {
 }
 /**
  * Adding a new definition. Commons projects (`autoJoinOnUpload`) take uploads
- * from anyone who reaches them, and the uploader owns what they upload;
- * everywhere else it needs {@link canEdit}.
+ * from anyone who can {@link canView} them, and the uploader owns what they
+ * upload; everywhere else it needs {@link canEdit}.
  */
 export function canCreateDefinition(input) {
-    return input.project?.autoJoinOnUpload === true || canEdit(input);
+    return (input.project?.autoJoinOnUpload === true && canView(input)) || canEdit(input);
 }
 /** Platform projects: `instance_admin` only. All other visibilities: project owner. */
 export function canManage(input) {
-    if (input.project?.visibility === 'platform') {
+    if (!input.project)
+        return false;
+    if (input.project.visibility === 'platform') {
         if (!input.enablePlatformProjects)
             return false;
         return isInstanceAdmin(input.platformPermissions);
@@ -95,12 +101,7 @@ export function canManage(input) {
 }
 /** Platform projects: `instance_admin` only. All other visibilities: project owner. */
 export function canEditProjectSettings(input) {
-    if (input.project?.visibility === 'platform') {
-        if (!input.enablePlatformProjects)
-            return false;
-        return isInstanceAdmin(input.platformPermissions);
-    }
-    return input.member?.role === 'owner';
+    return canManage(input);
 }
 /**
  * Authorization to flip a project to `public`. The `ALLOW_CROSS_ORG_PUBLIC`
@@ -121,6 +122,8 @@ export function canEditDefinition(input) {
     const { project, definition, member, orgMember, userId, platformPermissions, enablePlatformProjects } = input;
     if (!project || !definition)
         return false;
+    if (definition.projectId !== project.id)
+        return false;
     if (project.visibility === 'platform') {
         if (!enablePlatformProjects)
             return false;
@@ -174,18 +177,12 @@ export function canCreateProject(input) {
     return false;
 }
 /**
- * Whether the actor may hand out or take away org `owner`/`admin` standing (§3).
- *
- * Three routes decide this — inviting someone as owner/admin, changing an
- * existing member's role, and removing an owner — and all three had written it
- * out longhand. Two of them had drifted by the time the access audit found
- * them: the invite route let an admin mint an `owner` invite for themselves,
- * and DELETE let an admin remove an owner that PATCH would not let them demote.
- * They are one rule, so they read it from one place.
+ * Whether the actor may hand out or take away org `owner`/`admin` standing.
+ * Inviting someone as owner/admin, changing a member's role and removing an owner
+ * are one rule, so all three read it here.
  *
- * Reads the actor's **membership row**. `Organization.ownerId` is a separate
- * field that can disagree with it — see the sole-`instance_admin` finding — and
- * is not authority for this decision.
+ * Reads the actor's **membership row**. `Organization.ownerId` is a separate field
+ * that can disagree with it and is not authority for this decision.
  */
 export function canChangeOrgRole(input) {
     if (input.role === 'member')
@@ -202,4 +199,3 @@ export function checkOwnerRemoval(input) {
         return 'needs_confirm';
     return 'ok';
 }
-//# sourceMappingURL=rules.js.map

package/dist/apiTokens/index.d.ts

@@ -1,6 +1,5 @@
 export type { ApiScope, ApiScopeAction, ApiScopeResource, ApiToken, ApiTokenSummary, ApiTokenRevokeReason, ApiTokenLifetimeDays } from './types.js';
-export { ApiScopeActionSchema, ApiScopeStringSchema, ApiTokenRevokeReasonSchema, API_TOKEN_LIFETIME_DAYS, parseApiScope, formatApiScope, describeApiScope } from './types.js';
+export { ApiScopeActionSchema, ApiScopeStringSchema, API_TOKEN_LIFETIME_DAYS, parseApiScope, formatApiScope, describeApiScope } from './types.js';
 export type { IApiTokenStore } from './interface.js';
 export type { ScopeTarget } from './scope.js';
 export { scopeAllows, apiScopeActionCovers, narrowApiTokenContext, outsideTokenOrg } from './scope.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/apiTokens/index.js

@@ -1,3 +1,2 @@
-export { ApiScopeActionSchema, ApiScopeStringSchema, ApiTokenRevokeReasonSchema, API_TOKEN_LIFETIME_DAYS, parseApiScope, formatApiScope, describeApiScope } from './types.js';
+export { ApiScopeActionSchema, ApiScopeStringSchema, API_TOKEN_LIFETIME_DAYS, parseApiScope, formatApiScope, describeApiScope } from './types.js';
 export { scopeAllows, apiScopeActionCovers, narrowApiTokenContext, outsideTokenOrg } from './scope.js';
-//# sourceMappingURL=index.js.map

package/dist/apiTokens/interface.d.ts

@@ -34,4 +34,3 @@ export interface IApiTokenStore {
     /** Called from the `deleteOrg` cascade. */
     deleteByOrg(ctx: RequestContext, orgId: string): Promise<void>;
 }
-//# sourceMappingURL=interface.d.ts.map

package/dist/apiTokens/interface.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=interface.js.map

package/dist/apiTokens/scope.d.ts

@@ -34,4 +34,3 @@ export declare function narrowApiTokenContext(ctx: RequestContext, token: Pick<A
  * not found. Session requests are never outside.
  */
 export declare function outsideTokenOrg(ctx: RequestContext, orgId: string): boolean;
-//# sourceMappingURL=scope.d.ts.map

package/dist/apiTokens/scope.js

@@ -61,4 +61,3 @@ export function narrowApiTokenContext(ctx, token) {
 export function outsideTokenOrg(ctx, orgId) {
     return ctx.apiScope !== undefined && orgId !== ctx.actingOrgId;
 }
-//# sourceMappingURL=scope.js.map

package/dist/apiTokens/types.d.ts

@@ -82,4 +82,3 @@ export declare const API_TOKEN_LIFETIME_DAYS: readonly [30, 90, 180];
 export type ApiTokenLifetimeDays = (typeof API_TOKEN_LIFETIME_DAYS)[number];
 /** "Read and change everything in the org". Names no ids, so it suits an email. */
 export declare function describeApiScope(value: string): string;
-//# sourceMappingURL=types.d.ts.map

package/dist/apiTokens/types.js

@@ -57,4 +57,3 @@ export function describeApiScope(value) {
             : 'everything in the org';
     return `${ACTION_WORDS[scope.action]} ${what}`;
 }
-//# sourceMappingURL=types.js.map

package/dist/auth/index.d.ts

@@ -1,3 +1,2 @@
 export type { AuthUser, UserManagementResult, LoginResult } from './types.js';
 export type { IAuthProvider, IOAuthAuth, ISessionRefresh, IPasswordAuth, IEmailLinkAuth, IProxyAuth, IDelegatedSession, DelegatedSessionStatus } from './interface.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=index.js.map

package/dist/auth/interface.d.ts

@@ -30,9 +30,8 @@ export interface IPasswordAuth {
  *      `getOAuthAuthorizationUrl` and 303s to the result.
  *   2. IdP redirects back to `/auth/{provider}/callback?code=...` → server
  *      calls `exchangeOAuthCode` to mint the session pair.
- *   3. When the access token expires, session-refresh middleware in
- *      `hooks.server.ts` calls `refreshSession` to swap in a fresh pair
- *      without bouncing the user.
+ *
+ * Keeping the session alive afterwards is `ISessionRefresh`'s job.
  *
  * Each method returns `null` rather than throwing on irrecoverable
  * credential failures, so the route layer can pick the right HTTP shape
@@ -64,23 +63,6 @@ export interface IOAuthAuth {
         sessionToken: string;
         refreshToken: string;
     } | null>;
-    /**
-     * Swap a refresh token for a fresh access/refresh pair. Returns null on
-     * irrecoverable failure (revoked, expired, signed by a different secret);
-     * the session-refresh middleware treats null as "force re-login" by
-     * clearing the refresh cookie.
-     *
-     * @deprecated Session refresh is session lifecycle, not OAuth — a consumer
-     * that brokers no OAuth still needs it (refreshing a password session, or
-     * revoking on logout). Moved to `IAuthProvider.sessionRefresh`
-     * (`ISessionRefresh`). This member delegates for one release and will be
-     * removed in the next minor; migrate callers to
-     * `auth.sessionRefresh?.refreshSession(...)`.
-     */
-    refreshSession(refreshToken: string): Promise<{
-        sessionToken: string;
-        refreshToken: string;
-    } | null>;
 }
 /**
  * Optional session-lifecycle surface: refresh an expiring session, revoke one
@@ -245,8 +227,8 @@ export interface IDelegatedSession {
      */
     status(): Promise<DelegatedSessionStatus>;
     /**
-     * A session token acting as `userId` inside `orgId`, valid for about a
-     * minute. It carries no instance-admin rights, whatever the user holds: those
+     * A session token acting as `userId` inside `orgId`, valid for `ttlSeconds`
+     * (default 60 s). It carries no instance-admin rights, whatever the user holds: those
      * never ride on a bearer key. Throws if `status` isn't ok.
      */
     mint(userId: string, opts: {
@@ -327,4 +309,3 @@ export interface IAuthProvider {
      */
     touchLastLogin?(id: string): Promise<void>;
 }
-//# sourceMappingURL=interface.d.ts.map

package/dist/auth/interface.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=interface.js.map

package/dist/auth/types.d.ts

@@ -21,7 +21,10 @@ export interface AuthUser {
  * - `last_admin`    — refused; would leave zero `instance_admin` users
  */
 export type UserManagementResult = 'ok' | 'not_found' | 'not_supported' | 'last_admin';
-/** `success` includes the session token the provider minted. */
+/**
+ * `success` includes the session token the provider minted. `rate_limited` is for
+ * providers that throttle logins; no bundled provider returns it.
+ */
 export type LoginResult = {
     kind: 'success';
     user: AuthUser;
@@ -30,4 +33,3 @@ export type LoginResult = {
     kind: 'failed';
     reason?: 'invalid_credentials' | 'disabled' | 'rate_limited';
 };
-//# sourceMappingURL=types.d.ts.map

package/dist/auth/types.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=types.js.map

package/dist/bindings/index.d.ts

@@ -1,3 +1,2 @@
 export type { IBindingResolver } from './interface.js';
 export { NoopBindingResolver } from './interface.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/bindings/index.js

@@ -1,2 +1 @@
 export { NoopBindingResolver } from './interface.js';
-//# sourceMappingURL=index.js.map

package/dist/bindings/interface.d.ts

@@ -37,4 +37,3 @@ export interface IBindingResolver {
 export declare class NoopBindingResolver implements IBindingResolver {
     resolve(): Promise<Map<string, unknown>>;
 }
-//# sourceMappingURL=interface.d.ts.map

package/dist/bindings/interface.js

@@ -17,4 +17,3 @@ export class NoopBindingResolver {
         return new Map();
     }
 }
-//# sourceMappingURL=interface.js.map

package/dist/computeServer/index.d.ts

@@ -1,8 +1,2 @@
-export type { ComputeServerConfig, ComputeConfig, PlatformComputeServer, OrgComputeServer } from './types.js';
-export { isPlatformServer, isOrgServer } from './types.js';
-export type { IComputeServerStore, GetConfigOptions } from './interface.js';
+export * from './public.js';
 export { isEncryptedSecret, encryptSecret, decryptSecret, decodeSecretKey } from './secrets.js';
-export type { SecretVerificationReport, SecretVerificationFailure, SecretVerificationFailureReason } from './secrets.js';
-export type { ResolveOptions } from './utils.js';
-export { serversVisibleTo, defaultServerIdFor, resolveServerForOrg, findServerById, platformServers, orgServersFor, scopeConfigToOrg } from './utils.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/computeServer/index.js

@@ -1,9 +1,3 @@
-export { isPlatformServer, isOrgServer } from './types.js';
-// At-rest secret crypto (uses `node:crypto`). Server-only — deliberately NOT
-// re-exported from the root barrel, which client `.svelte` code imports and
-// where a browser bundle can't resolve `node:crypto`. Import these from
-// `@selvajs/platform/computeServer` in server code. The report TYPES are erased
-// at build, so they also stay re-exported from the root barrel for convenience.
+export * from './public.js';
+// Server-only: import these from `@selvajs/platform/computeServer`.
 export { isEncryptedSecret, encryptSecret, decryptSecret, decodeSecretKey } from './secrets.js';
-export { serversVisibleTo, defaultServerIdFor, resolveServerForOrg, findServerById, platformServers, orgServersFor, scopeConfigToOrg } from './utils.js';
-//# sourceMappingURL=index.js.map

package/dist/computeServer/interface.d.ts

@@ -28,10 +28,9 @@ export interface GetConfigOptions {
      *
      * Org-facing surfaces must pass this. Without it the store hands back every
      * platform server and every *other* org's private servers, leaving each
-     * caller to re-apply a filter it can silently forget — the global
-     * `defaultServerId` in particular passed straight through before this
-     * existed. Admin surfaces, boot health and the save-diff handlers omit it
-     * deliberately; they act instance-wide.
+     * caller to re-apply a filter it can silently forget. Admin surfaces, boot
+     * health and the save-diff handlers omit it deliberately; they act
+     * instance-wide.
      */
     scopeToOrgId?: string;
 }
@@ -53,6 +52,10 @@ export interface IComputeServerStore {
      * authenticated under the current `SELVA_AT_REST_KEY` (the solve fails
      * later at Rhino.Compute rather than here).
      *
+     * A plaintext key at rest is adapter-defined: local throws, because it never
+     * writes one, and Supabase warns and returns it, because rows can predate
+     * encryption. Both report it through `verifySecrets`.
+     *
      * The narrow path onto the solve hot path: resolve a server from the
      * key-free config, then fetch that one key.
      */
@@ -61,7 +64,8 @@ export interface IComputeServerStore {
     savePlatformServers(ctx: RequestContext, servers: ComputeServerConfig[], defaultServerId: string | undefined): Promise<void>;
     /**
      * Replaces the org-private server set for `orgId` and (optionally) updates
-     * `orgDefaults[orgId]`. Platform rows are left untouched.
+     * `orgDefaults[orgId]`. Platform rows are left untouched, and any non-org entry
+     * in `servers` is ignored.
      *
      * `defaultServerId: null` clears the org's override; `undefined` leaves
      * the existing value alone.
@@ -90,4 +94,3 @@ export interface IComputeServerStore {
      */
     verifySecrets?(): Promise<SecretVerificationReport>;
 }
-//# sourceMappingURL=interface.d.ts.map

package/dist/computeServer/interface.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=interface.js.map

package/dist/computeServer/public.d.ts

@@ -0,0 +1,6 @@
+export type { ComputeServerConfig, ComputeConfig, PlatformComputeServer, OrgComputeServer } from './types.js';
+export { COMPUTE_RETRY_MAX, COMPUTE_TIMEOUT_DEFAULT_MS, COMPUTE_TIMEOUT_MAX_MS, COMPUTE_TIMEOUT_MIN_MS, isPlatformServer, isOrgServer } from './types.js';
+export type { IComputeServerStore, GetConfigOptions } from './interface.js';
+export type { ResolveOptions } from './utils.js';
+export { serversVisibleTo, defaultServerIdFor, clampRetryCount, clampTimeoutMs, pickServer, resolveServerForOrg, findServerById, platformServers, scopeConfigToOrg } from './utils.js';
+export type { SecretVerificationReport, SecretVerificationFailure, SecretVerificationFailureReason } from './secrets.js';

package/dist/computeServer/public.js

@@ -0,0 +1,2 @@
+export { COMPUTE_RETRY_MAX, COMPUTE_TIMEOUT_DEFAULT_MS, COMPUTE_TIMEOUT_MAX_MS, COMPUTE_TIMEOUT_MIN_MS, isPlatformServer, isOrgServer } from './types.js';
+export { serversVisibleTo, defaultServerIdFor, clampRetryCount, clampTimeoutMs, pickServer, resolveServerForOrg, findServerById, platformServers, scopeConfigToOrg } from './utils.js';

package/dist/computeServer/secrets.d.ts

@@ -1,8 +1,12 @@
+export declare function isEncryptedSecret(value: string): boolean;
 /**
  * AES-256-GCM envelope for at-rest secrets (e.g. compute API keys).
  *
- * Wire format: `enc:v1:<base64(iv|tag|ciphertext)>`. The version prefix lets
- * a future migration to a new algorithm tell old and new envelopes apart.
+ * Wire format: `enc:v2:<base64(iv|tag|ciphertext)>`. `v2` authenticates the
+ * record the secret belongs to as AAD, so ciphertext copied onto another record
+ * fails to decrypt instead of handing the plaintext to that record's URL.
+ * `enc:v1:` envelopes have no AAD and still read: a store rewrites them as `v2`
+ * on its next save.
  *
  * Defends against backup leaks, accidental file/DB sharing, and read-only
  * storage access — not against an attacker who also has the master key
@@ -11,10 +15,13 @@
  *
  * Pure `node:crypto`, no fs or DB coupling, so the local and Supabase
  * compute-server stores share this one implementation.
+ *
+ * Pass `aad` to bind the secret to its record. {@link decryptSecret} then needs the
+ * same value.
  */
-export declare function isEncryptedSecret(value: string): boolean;
-export declare function encryptSecret(plaintext: string, key: Buffer): string;
-export declare function decryptSecret(envelope: string, key: Buffer): string;
+export declare function encryptSecret(plaintext: string, key: Buffer, aad?: string): string;
+/** `aad` is ignored for an `enc:v1:` envelope and required for an `enc:v2:` one. */
+export declare function decryptSecret(envelope: string, key: Buffer, aad?: string): string;
 /**
  * Decodes a `SELVA_AT_REST_KEY` env var into a 32-byte buffer (64-char hex or
  * base64, with or without padding). Throws on anything else so a
@@ -46,4 +53,3 @@ export interface SecretVerificationReport {
     /** True if at least one row holds an unencrypted apiKey at rest. */
     plaintextFound: boolean;
 }
-//# sourceMappingURL=secrets.d.ts.map

package/dist/computeServer/secrets.js

@@ -2,12 +2,19 @@ import { randomBytes, createCipheriv, createDecipheriv } from 'node:crypto';
 const ALGO = 'aes-256-gcm';
 const IV_BYTES = 12;
 const TAG_BYTES = 16;
-const PREFIX = 'enc:v1:';
+const PREFIX_V1 = 'enc:v1:';
+const PREFIX_V2 = 'enc:v2:';
+export function isEncryptedSecret(value) {
+    return value.startsWith(PREFIX_V1) || value.startsWith(PREFIX_V2);
+}
 /**
  * AES-256-GCM envelope for at-rest secrets (e.g. compute API keys).
  *
- * Wire format: `enc:v1:<base64(iv|tag|ciphertext)>`. The version prefix lets
- * a future migration to a new algorithm tell old and new envelopes apart.
+ * Wire format: `enc:v2:<base64(iv|tag|ciphertext)>`. `v2` authenticates the
+ * record the secret belongs to as AAD, so ciphertext copied onto another record
+ * fails to decrypt instead of handing the plaintext to that record's URL.
+ * `enc:v1:` envelopes have no AAD and still read: a store rewrites them as `v2`
+ * on its next save.
  *
  * Defends against backup leaks, accidental file/DB sharing, and read-only
  * storage access — not against an attacker who also has the master key
@@ -16,11 +23,11 @@ const PREFIX = 'enc:v1:';
  *
  * Pure `node:crypto`, no fs or DB coupling, so the local and Supabase
  * compute-server stores share this one implementation.
+ *
+ * Pass `aad` to bind the secret to its record. {@link decryptSecret} then needs the
+ * same value.
  */
-export function isEncryptedSecret(value) {
-    return value.startsWith(PREFIX);
-}
-export function encryptSecret(plaintext, key) {
+export function encryptSecret(plaintext, key, aad) {
     if (key.length !== 32) {
         throw new Error(`Secret key must be 32 bytes; got ${key.length}`);
     }
@@ -29,23 +36,33 @@ export function encryptSecret(plaintext, key) {
     }
     const iv = randomBytes(IV_BYTES);
     const cipher = createCipheriv(ALGO, key, iv);
+    if (aad !== undefined)
+        cipher.setAAD(Buffer.from(aad, 'utf8'));
     const ciphertext = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
     const tag = cipher.getAuthTag();
-    return PREFIX + Buffer.concat([iv, tag, ciphertext]).toString('base64');
+    const prefix = aad === undefined ? PREFIX_V1 : PREFIX_V2;
+    return prefix + Buffer.concat([iv, tag, ciphertext]).toString('base64');
 }
-export function decryptSecret(envelope, key) {
+/** `aad` is ignored for an `enc:v1:` envelope and required for an `enc:v2:` one. */
+export function decryptSecret(envelope, key, aad) {
     if (key.length !== 32) {
         throw new Error(`Secret key must be 32 bytes; got ${key.length}`);
     }
     if (!isEncryptedSecret(envelope)) {
         throw new Error('Value is not an encrypted secret envelope');
     }
-    const buf = Buffer.from(envelope.slice(PREFIX.length), 'base64');
+    const bound = envelope.startsWith(PREFIX_V2);
+    if (bound && aad === undefined) {
+        throw new Error('This secret is bound to a record: pass its id');
+    }
+    const buf = Buffer.from(envelope.slice(PREFIX_V2.length), 'base64');
     const iv = buf.subarray(0, IV_BYTES);
     const tag = buf.subarray(IV_BYTES, IV_BYTES + TAG_BYTES);
     const ciphertext = buf.subarray(IV_BYTES + TAG_BYTES);
     const decipher = createDecipheriv(ALGO, key, iv);
     decipher.setAuthTag(tag);
+    if (bound)
+        decipher.setAAD(Buffer.from(aad, 'utf8'));
     return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString('utf8');
 }
 /**
@@ -55,12 +72,15 @@ export function decryptSecret(envelope, key) {
  * ciphertext nothing can decrypt.
  */
 export function decodeSecretKey(raw) {
-    if (/^[0-9a-fA-F]{64}$/.test(raw))
-        return Buffer.from(raw, 'hex');
-    const buf = Buffer.from(raw, 'base64');
-    if (buf.length === 32)
+    const key = raw.trim();
+    if (/^[0-9a-fA-F]{64}$/.test(key))
+        return Buffer.from(key, 'hex');
+    // `Buffer.from` skips what it can't decode, so only a round trip proves the
+    // whole string was base64 rather than 32 bytes of it.
+    const buf = Buffer.from(key, 'base64');
+    if (buf.length === 32 && buf.toString('base64').replace(/=+$/, '') === key.replace(/=+$/, '')) {
         return buf;
+    }
     throw new Error('SELVA_AT_REST_KEY must be 32 bytes encoded as 64-char hex or base64. ' +
         "Generate one with: node -e \"console.log(require('crypto').randomBytes(32).toString('hex'))\"");
 }
-//# sourceMappingURL=secrets.js.map

package/dist/computeServer/types.d.ts

@@ -1,3 +1,7 @@
+export declare const COMPUTE_TIMEOUT_DEFAULT_MS = 30000;
+export declare const COMPUTE_TIMEOUT_MIN_MS = 1000;
+export declare const COMPUTE_TIMEOUT_MAX_MS = 300000;
+export declare const COMPUTE_RETRY_MAX = 5;
 /**
  * Compute servers belong to one of two scopes — never both.
  *
@@ -29,7 +33,7 @@ interface ComputeServerCommon {
      * they'd only throw away.
      */
     hasApiKey?: boolean;
-    /** Default: 30000. */
+    /** Default: {@link COMPUTE_TIMEOUT_DEFAULT_MS}. */
     timeoutMs?: number;
     /** Default: 0. */
     retryCount?: number;
@@ -68,4 +72,3 @@ export interface ComputeConfig {
 export declare function isPlatformServer(s: ComputeServerConfig): s is PlatformComputeServer;
 export declare function isOrgServer(s: ComputeServerConfig): s is OrgComputeServer;
 export {};
-//# sourceMappingURL=types.d.ts.map

package/dist/computeServer/types.js

@@ -1,3 +1,7 @@
+export const COMPUTE_TIMEOUT_DEFAULT_MS = 30000;
+export const COMPUTE_TIMEOUT_MIN_MS = 1000;
+export const COMPUTE_TIMEOUT_MAX_MS = 300000;
+export const COMPUTE_RETRY_MAX = 5;
 // ============================================================================
 // Type guards
 // ============================================================================
@@ -7,4 +11,3 @@ export function isPlatformServer(s) {
 export function isOrgServer(s) {
     return s.scope === 'org';
 }
-//# sourceMappingURL=types.js.map