@selvajs/platform 0.21.0-beta.3 → 1.0.0-beta.5

package/dist/index.js

@@ -1,33 +1,27 @@
 // @selvajs/platform — published API contract. Every symbol here is breaking-change-protected.
-export { PlatformPermissionSchema, ALL_PLATFORM_PERMISSIONS, OPERATOR_PLATFORM_PERMISSIONS } from './permissions/types.js';
-export { emptyProfile } from './userProfile/types.js';
-export { orgPaths } from './organizations/paths.js';
-export { OrgRoleSchema, OrgPermissionSchema, OrgAssetKindSchema, ALL_ORG_ASSET_KINDS, SlugSchema, slugify, RESERVED_SLUGS, CreateOrgSchema, UpdateOrgSchema, ALL_ORG_PERMISSIONS, DEFAULT_ORG_PERMISSIONS, OWNER_ADMIN_ONLY_PERMISSIONS, MEMBER_ASSIGNABLE_PERMISSIONS } from './organizations/schemas.js';
-export { ApiScopeActionSchema, ApiScopeStringSchema, ApiTokenRevokeReasonSchema, API_TOKEN_LIFETIME_DAYS, parseApiScope, formatApiScope, describeApiScope, scopeAllows, apiScopeActionCovers, narrowApiTokenContext, outsideTokenOrg } from './apiTokens/index.js';
-export { ProjectVisibilitySchema, ProjectRoleSchema, validateProjectFlags } from './projects/schemas.js';
-export { PlatformProjectGrantSchema, PlatformProjectGranteeTypeSchema } from './platformProjects/schemas.js';
-export { GH_EXTENSIONS, COVER_IMAGE_EXTENSIONS, ALLOWED_UPLOAD_EXTENSIONS, COVER_IMAGE_CONTENT_TYPES, toDefinitionListItem } from './definitions/types.js';
-export { definitionPaths } from './definitions/paths.js';
-export { DefinitionChannelSchema, PublishVersionInputSchema, CreateDefinitionInputSchema, UpdateMetadataInputSchema, GuidSchema, UUID_REGEX, toSourceDocumentId } from './definitions/schemas.js';
-export { DEFAULT_SHARE_LINK_MAX_SOLVES } from './shareLinks/types.js';
-export { CreateShareLinkInputSchema } from './shareLinks/schemas.js';
-export { IMAGE_MAX_WIDTH, IMAGE_WEBP_QUALITY, isImageUpload, toWebpPath, transcodeImageIfNeeded } from './storage/image.js';
-export { ASSET_CLASSES, classifyAssetPath, isPublicAssetPath } from './storage/assetClasses.js';
-export { withCacheBust } from './storage/cacheBust.js';
-export { ERASED_ACTOR_ID } from './data/interface.js';
-export { isPlatformServer, isOrgServer } from './computeServer/types.js';
-export { serversVisibleTo, defaultServerIdFor, resolveServerForOrg, findServerById, platformServers, orgServersFor, scopeConfigToOrg } from './computeServer/utils.js';
-export { canView, canSolve, canEdit, canCreateDefinition, canManage, canEditProjectSettings, canChangeVisibilityToPublic, canEditDefinition, canReclaim, canCreateProject, canChangeOrgRole, checkOwnerRemoval, withAdminBypass } from './access/rules.js';
-export { actorFrom, actorOf, NoopEventSink, AUDIT_EVENT_VERSION } from './events/interface.js';
+export * from './access/index.js';
+export * from './apiTokens/index.js';
+export * from './auth/index.js';
+export * from './computeServer/public.js';
+export * from './data/index.js';
+export * from './definitions/index.js';
+export * from './events/index.js';
+export * from './invites/index.js';
+export * from './notifications/index.js';
+export * from './organizations/index.js';
+export * from './permissions/index.js';
+export * from './platformProjects/index.js';
+export * from './projects/index.js';
+export * from './shareLinks/index.js';
+export * from './storage/index.js';
+export * from './userProfile/index.js';
+export * from './utils/index.js';
 export { NoopSolveMetricSink } from './metrics/interface.js';
 export { NoopSolveResultCache } from './solveCache/interface.js';
 export { NoopErrorReporter } from './errors/interface.js';
 export { NoopLogger } from './logging/interface.js';
-export { NoopNotificationProvider } from './notifications/index.js';
 export { NoopBindingResolver } from './bindings/interface.js';
-export { auditUpdate, auditSoftDelete } from './utils/audit.js';
 export { SYSTEM_CONTEXT, hasPermission, requireActingOrg, isShareContext, assertNotShareContext } from './context.js';
-export { DEFAULT_PAGE_LIMIT, MAX_PAGE_LIMIT } from './pagination.js';
+export { DEFAULT_PAGE_LIMIT, MAX_PAGE_LIMIT, clampPageLimit, decodeOffsetCursor, encodeOffsetCursor, listAll, walkPages } from './pagination.js';
 export { isFlagEnabled, defineConfig } from './config.js';
 export { ProviderError } from './errors.js';
-//# sourceMappingURL=index.js.map

package/dist/invites/index.d.ts

@@ -1,3 +1,2 @@
 export type { Invite } from './types.js';
 export type { IInviteStore } from './interface.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/invites/index.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=index.js.map

package/dist/invites/interface.d.ts

@@ -18,7 +18,8 @@ export interface IInviteStore {
     getByTokenHash(ctx: RequestContext, tokenHash: string): Promise<Invite | null>;
     listByOrg(ctx: RequestContext, orgId: string, opts?: ListOptions): Promise<Page<Invite>>;
     /** No-op if already accepted. */
-    markAccepted(ctx: RequestContext, id: string, userId: string): Promise<void>;
+    /** True if this call accepted the invite, false if it was already accepted or is gone. */
+    markAccepted(ctx: RequestContext, id: string, userId: string): Promise<boolean>;
     /** No-op if already consumed or missing. */
     revoke(ctx: RequestContext, id: string): Promise<void>;
     /**
@@ -26,10 +27,9 @@ export interface IInviteStore {
      * revoked. Accepted invites are left alone — consuming one is history, not
      * a live grant.
      *
-     * Offboarding needs this: `removeOrgMember` cascades `project_members` but
-     * has never touched invites, so a dormant invite let a removed user walk
-     * back in at their original role for the rest of its TTL. Matching by email
-     * rather than user id is deliberate — an invite names an address, and the
+     * Offboarding needs this: `removeOrgMember` does not touch invites, so a
+     * dormant invite would let a removed user walk back in at their original role
+     * for the rest of its TTL. Matching by email rather than user id is deliberate — an invite names an address, and the
      * account it will create may not exist yet.
      *
      * One call rather than list-then-revoke-each: the loop would race a
@@ -39,4 +39,3 @@ export interface IInviteStore {
     /** Called from the `deleteOrg` cascade — invites to a deleted org are unredeemable orphans otherwise. */
     deleteByOrg(ctx: RequestContext, orgId: string): Promise<void>;
 }
-//# sourceMappingURL=interface.d.ts.map

package/dist/invites/interface.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=interface.js.map

package/dist/invites/types.d.ts

@@ -39,4 +39,3 @@ export interface Invite {
     acceptedAt?: string;
     acceptedByUserId?: string;
 }
-//# sourceMappingURL=types.d.ts.map

package/dist/invites/types.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=types.js.map

package/dist/logging/interface.d.ts

@@ -65,4 +65,3 @@ export declare class NoopLogger implements ILogger {
     error(_message: string, _fields?: LogFields): void;
     child(_fields: LogFields): ILogger;
 }
-//# sourceMappingURL=interface.d.ts.map

package/dist/logging/interface.js

@@ -22,4 +22,3 @@ export class NoopLogger {
         return this;
     }
 }
-//# sourceMappingURL=interface.js.map

package/dist/metrics/interface.d.ts

@@ -71,4 +71,3 @@ export interface ISolveMetricSink {
 export declare class NoopSolveMetricSink implements ISolveMetricSink {
     record(_ctx: RequestContext, _metric: SolveMetric): Promise<void>;
 }
-//# sourceMappingURL=interface.d.ts.map

package/dist/metrics/interface.js

@@ -2,4 +2,3 @@
 export class NoopSolveMetricSink {
     async record(_ctx, _metric) { }
 }
-//# sourceMappingURL=interface.js.map

package/dist/notifications/index.d.ts

@@ -1,4 +1,3 @@
 export type { NotificationKind, OutboundMessage, SendResult } from './types.js';
 export type { INotificationProvider } from './interface.js';
 export { NoopNotificationProvider } from './interface.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/notifications/index.js

@@ -1,2 +1 @@
 export { NoopNotificationProvider } from './interface.js';
-//# sourceMappingURL=index.js.map

package/dist/notifications/interface.d.ts

@@ -35,12 +35,10 @@ export interface INotificationProvider {
  * Default `INotificationProvider` — sends nothing, reports `not-configured`.
  *
  * Mail is optional in every deployment, so this is a supported wiring rather
- * than a test double: callers already handle `not-configured` as "no mail",
- * which keeps the no-SMTP path identical to the pre-notification behaviour.
+ * than a test double: callers already handle `not-configured` as "no mail".
  */
 export declare class NoopNotificationProvider implements INotificationProvider {
     readonly name = "None";
     send(_message: OutboundMessage, _log?: ILogger): Promise<SendResult>;
     isConfigured(): boolean;
 }
-//# sourceMappingURL=interface.d.ts.map

package/dist/notifications/interface.js

@@ -2,8 +2,7 @@
  * Default `INotificationProvider` — sends nothing, reports `not-configured`.
  *
  * Mail is optional in every deployment, so this is a supported wiring rather
- * than a test double: callers already handle `not-configured` as "no mail",
- * which keeps the no-SMTP path identical to the pre-notification behaviour.
+ * than a test double: callers already handle `not-configured` as "no mail".
  */
 export class NoopNotificationProvider {
     name = 'None';
@@ -14,4 +13,3 @@ export class NoopNotificationProvider {
         return false;
     }
 }
-//# sourceMappingURL=interface.js.map

package/dist/notifications/types.d.ts

@@ -37,4 +37,3 @@ export type SendResult = {
     status: 'failed';
     reason: string;
 };
-//# sourceMappingURL=types.d.ts.map

package/dist/notifications/types.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=types.js.map

package/dist/organizations/index.d.ts

@@ -1,6 +1,5 @@
 export type { Organization, OrgMember, OrgAssets } from './types.js';
 export type { IOrgStore } from './interface.js';
 export { orgPaths } from './paths.js';
-export type { OrgRole, OrgPermission, OrgAssetKind, CreateOrgInput, UpdateOrgInput } from './schemas.js';
-export { OrgRoleSchema, OrgPermissionSchema, OrgAssetKindSchema, ALL_ORG_ASSET_KINDS, SlugSchema, slugify, RESERVED_SLUGS, CreateOrgSchema, UpdateOrgSchema, ALL_ORG_PERMISSIONS, DEFAULT_ORG_PERMISSIONS, OWNER_ADMIN_ONLY_PERMISSIONS, MEMBER_ASSIGNABLE_PERMISSIONS } from './schemas.js';
-//# sourceMappingURL=index.d.ts.map
+export type { OrgRole, OrgPermission, OrgAssetKind } from './schemas.js';
+export { OrgRoleSchema, OrgPermissionSchema, OrgAssetKindSchema, SlugSchema, slugify, RESERVED_SLUGS, orgSlugFromName, CreateOrgSchema, UpdateOrgSchema, ALL_ORG_PERMISSIONS, DEFAULT_ORG_PERMISSIONS, OWNER_ADMIN_ONLY_PERMISSIONS, MEMBER_ASSIGNABLE_PERMISSIONS } from './schemas.js';

package/dist/organizations/index.js

@@ -1,3 +1,2 @@
 export { orgPaths } from './paths.js';
-export { OrgRoleSchema, OrgPermissionSchema, OrgAssetKindSchema, ALL_ORG_ASSET_KINDS, SlugSchema, slugify, RESERVED_SLUGS, CreateOrgSchema, UpdateOrgSchema, ALL_ORG_PERMISSIONS, DEFAULT_ORG_PERMISSIONS, OWNER_ADMIN_ONLY_PERMISSIONS, MEMBER_ASSIGNABLE_PERMISSIONS } from './schemas.js';
-//# sourceMappingURL=index.js.map
+export { OrgRoleSchema, OrgPermissionSchema, OrgAssetKindSchema, SlugSchema, slugify, RESERVED_SLUGS, orgSlugFromName, CreateOrgSchema, UpdateOrgSchema, ALL_ORG_PERMISSIONS, DEFAULT_ORG_PERMISSIONS, OWNER_ADMIN_ONLY_PERMISSIONS, MEMBER_ASSIGNABLE_PERMISSIONS } from './schemas.js';

package/dist/organizations/interface.d.ts

@@ -13,10 +13,9 @@ export interface IOrgStore {
     createOrg(ctx: RequestContext, org: Organization): Promise<void>;
     updateOrg(ctx: RequestContext, id: string, patch: Partial<Pick<Organization, 'name' | 'slug' | 'assets'>>): Promise<void>;
     /**
-     * Soft-deletes the org, cascading to org members, projects, and project
-     * members (definitions and share links cascade through project deletion).
-     * Invites and the org compute-server override are NOT cascaded — clean
-     * those up explicitly if needed.
+     * Soft-deletes the org, cascading to org members, projects, project members and
+     * definitions. Share links die with their definition. Hard-deletes its invites,
+     * API tokens, compute servers and compute defaults.
      */
     deleteOrg(ctx: RequestContext, id: string): Promise<void>;
     listOrgMembers(ctx: RequestContext, orgId: string, opts?: ListOptions): Promise<Page<OrgMember>>;
@@ -47,4 +46,3 @@ export interface IOrgStore {
     updateOrgMemberPermissions(ctx: RequestContext, orgId: string, userId: string, permissions: readonly OrgPermission[]): Promise<void>;
     removeOrgMember(ctx: RequestContext, orgId: string, userId: string): Promise<void>;
 }
-//# sourceMappingURL=interface.d.ts.map

package/dist/organizations/interface.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=interface.js.map

package/dist/organizations/paths.d.ts

@@ -6,14 +6,9 @@ import type { OrgAssetKind } from './schemas.js';
  *
  * Branding lives under `orgs/{id}/branding/` because it's a *public* asset
  * class — anyone, including logged-out viewers, may read a company logo.
- * That segment distinguishes it from `orgs/{id}/private/` (members-only).
- * `classifyAssetPath` / `ASSET_CLASSES` decide public-vs-private from these
- * prefixes.
+ * `classifyAssetPath` / `ASSET_CLASSES` decide visibility from these prefixes.
  */
 export declare const orgPaths: {
     readonly asset: (id: string, kind: OrgAssetKind) => string;
-    /** Members-only blob; `name` includes the extension. */
-    readonly privateAsset: (id: string, name: string) => string;
     readonly prefix: (id: string) => string;
 };
-//# sourceMappingURL=paths.d.ts.map

package/dist/organizations/paths.js

@@ -1,13 +1,4 @@
-/**
- * Blocks path traversal, separators, and empty segments. Called by every
- * helper below so a malicious `id` can't escape the `orgs/` prefix.
- */
-function assertSafeKey(value, label) {
-    // The regex alone allows '.' and '..' — both fully match the allowed alphabet — so they need an explicit check.
-    if (!value || !/^[A-Za-z0-9._-]+$/.test(value) || value === '.' || value === '..') {
-        throw new Error(`Unsafe ${label}: ${JSON.stringify(value)}`);
-    }
-}
+import { assertSafeKey } from '../storage/safeKey.js';
 /**
  * Every branding asset is stored as `.webp` (uploads go through the shared
  * transcoder), so the path per kind is fixed and a re-upload overwrites in
@@ -15,9 +6,7 @@ function assertSafeKey(value, label) {
  *
  * Branding lives under `orgs/{id}/branding/` because it's a *public* asset
  * class — anyone, including logged-out viewers, may read a company logo.
- * That segment distinguishes it from `orgs/{id}/private/` (members-only).
- * `classifyAssetPath` / `ASSET_CLASSES` decide public-vs-private from these
- * prefixes.
+ * `classifyAssetPath` / `ASSET_CLASSES` decide visibility from these prefixes.
  */
 export const orgPaths = {
     asset: (id, kind) => {
@@ -25,15 +14,8 @@ export const orgPaths = {
         assertSafeKey(kind, 'assetKind');
         return `orgs/${id}/branding/${kind}.webp`;
     },
-    /** Members-only blob; `name` includes the extension. */
-    privateAsset: (id, name) => {
-        assertSafeKey(id, 'orgId');
-        assertSafeKey(name, 'assetName');
-        return `orgs/${id}/private/${name}`;
-    },
     prefix: (id) => {
         assertSafeKey(id, 'orgId');
         return `orgs/${id}/`;
     }
 };
-//# sourceMappingURL=paths.js.map

package/dist/organizations/schemas.d.ts

@@ -1,12 +1,9 @@
 import { z } from 'zod';
 /**
  * Top-level path segments a tenant slug must never equal, so a slug can never
- * shadow (or be shadowed by) a route. `/o/{slug}/` is the planned shape for
- * per-org URLs, so `o` is reserved even though the length gate below already
- * makes a 1-char slug impossible — that keeps a future move to `/o/{slug}/…`
- * collision-free before any external link is minted against a slug.
- * Lowercase; matching is case-insensitive so `Admin` can't slip through. Keep
- * in sync with the route tree's top-level directories.
+ * shadow (or be shadowed by) a route. `o` is reserved for `/o/{slug}/` even though
+ * the length gate below already makes a 1-char slug impossible.
+ * `reserved-slugs.test.ts` in the selva app holds this to the route tree.
  */
 export declare const RESERVED_SLUGS: readonly string[];
 /**
@@ -15,6 +12,8 @@ export declare const RESERVED_SLUGS: readonly string[];
  * untouched — run the result through `SlugSchema` where validity matters.
  */
 export declare function slugify(name: string): string;
+/** A slug for an org named without a slug of its own. Always passes `SlugSchema`. */
+export declare function orgSlugFromName(name: string, fallback?: string): string;
 /** Lowercase alphanumeric with internal hyphens, 3–63 chars, not a reserved word. */
 export declare const SlugSchema: z.ZodString;
 export declare const OrgRoleSchema: z.ZodEnum<{
@@ -54,4 +53,3 @@ export declare const UpdateOrgSchema: z.ZodObject<{
 }, z.core.$strip>;
 export type CreateOrgInput = z.infer<typeof CreateOrgSchema>;
 export type UpdateOrgInput = z.infer<typeof UpdateOrgSchema>;
-//# sourceMappingURL=schemas.d.ts.map

package/dist/organizations/schemas.js

@@ -1,12 +1,9 @@
 import { z } from 'zod';
 /**
  * Top-level path segments a tenant slug must never equal, so a slug can never
- * shadow (or be shadowed by) a route. `/o/{slug}/` is the planned shape for
- * per-org URLs, so `o` is reserved even though the length gate below already
- * makes a 1-char slug impossible — that keeps a future move to `/o/{slug}/…`
- * collision-free before any external link is minted against a slug.
- * Lowercase; matching is case-insensitive so `Admin` can't slip through. Keep
- * in sync with the route tree's top-level directories.
+ * shadow (or be shadowed by) a route. `o` is reserved for `/o/{slug}/` even though
+ * the length gate below already makes a 1-char slug impossible.
+ * `reserved-slugs.test.ts` in the selva app holds this to the route tree.
  */
 export const RESERVED_SLUGS = [
     'o',
@@ -16,11 +13,13 @@ export const RESERVED_SLUGS = [
     'login',
     'logout',
     'setup',
-    'settings',
     'team',
     'library',
     'projects',
-    'accept-invite'
+    'accept-invite',
+    'docs',
+    'mcp',
+    'oauth'
 ];
 const RESERVED_SLUG_SET = new Set(RESERVED_SLUGS);
 /**
@@ -30,18 +29,27 @@ const RESERVED_SLUG_SET = new Set(RESERVED_SLUGS);
  */
 export function slugify(name) {
     return name
+        .normalize('NFKD')
+        .replace(/\p{M}/gu, '')
         .trim()
         .toLowerCase()
         .replace(/[^a-z0-9]+/g, '-')
-        .replace(/^-|-$/g, '')
-        .slice(0, 63);
+        .slice(0, 63)
+        .replace(/^-+|-+$/g, '');
+}
+/** A slug for an org named without a slug of its own. Always passes `SlugSchema`. */
+export function orgSlugFromName(name, fallback = 'default') {
+    const slug = slugify(name);
+    if (slug.length < 3)
+        return fallback;
+    return RESERVED_SLUG_SET.has(slug) ? `${slug}-org` : slug;
 }
 /** Lowercase alphanumeric with internal hyphens, 3–63 chars, not a reserved word. */
 export const SlugSchema = z
     .string()
     .min(3, 'Slug must be at least 3 characters')
     .max(63, 'Slug must be at most 63 characters')
-    .regex(/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/, 'Slug must be lowercase alphanumeric with hyphens (no leading/trailing/consecutive hyphens)')
+    .regex(/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/, 'Slug must be lowercase alphanumeric with hyphens (no leading or trailing hyphen)')
     .refine((s) => !RESERVED_SLUG_SET.has(s), {
     message: 'Slug is reserved and cannot be used'
 });
@@ -70,8 +78,7 @@ export const DEFAULT_ORG_PERMISSIONS = {
     member: []
 };
 export const CreateOrgSchema = z.object({
-    name: z.string().min(1, 'Organization name is required').max(128),
+    name: z.string().trim().min(1, 'Organization name is required').max(128),
     slug: SlugSchema
 });
 export const UpdateOrgSchema = CreateOrgSchema.partial();
-//# sourceMappingURL=schemas.js.map

package/dist/organizations/types.d.ts

@@ -35,4 +35,3 @@ export interface OrgMember {
     updatedBy: string;
     deletedAt?: string | null;
 }
-//# sourceMappingURL=types.d.ts.map

package/dist/organizations/types.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=types.js.map

package/dist/pagination.d.ts

@@ -1,7 +1,9 @@
 import type { DefinitionStatus } from './definitions/types.js';
 /**
- * Cursor-paginated list options. Adapters default to limit=50, orderBy=createdAt
- * desc, and clamp limit to `MAX_PAGE_LIMIT`.
+ * Cursor-paginated list options. Adapters default to limit=50 and clamp limit to
+ * `MAX_PAGE_LIMIT`. Order is `createdAt` desc unless a store says otherwise: local
+ * definitions default to `name` asc, and the Supabase member, invite and token
+ * lists have one fixed order and ignore `orderBy`.
  *
  * Cursors are opaque — adapters may use row ids, offsets, or keyset encodings.
  * Callers must not inspect them.
@@ -44,4 +46,20 @@ export interface Page<T> {
 }
 export declare const DEFAULT_PAGE_LIMIT = 50;
 export declare const MAX_PAGE_LIMIT = 200;
-//# sourceMappingURL=pagination.d.ts.map
+/** For adapters paging by offset. Junk and negatives read as the first page. */
+export declare function decodeOffsetCursor(cursor: string | undefined): number;
+export declare function encodeOffsetCursor(offset: number): string;
+type PageFetcher<T> = (page: {
+    limit: number;
+    cursor?: string;
+}) => Promise<Page<T>>;
+/**
+ * Every page of a list, in order. One call stops at `MAX_PAGE_LIMIT` without saying so, which is
+ * fatal for a read that must see every row. Break out of the loop to stop reading.
+ */
+export declare function walkPages<T>(fetchPage: PageFetcher<T>): AsyncGenerator<Page<T>>;
+/** Every row of a list, across all its pages. */
+export declare function listAll<T>(fetchPage: PageFetcher<T>): Promise<T[]>;
+/** The effective page size for a requested limit. */
+export declare function clampPageLimit(limit: number | undefined): number;
+export {};

package/dist/pagination.js

@@ -1,3 +1,36 @@
 export const DEFAULT_PAGE_LIMIT = 50;
 export const MAX_PAGE_LIMIT = 200;
-//# sourceMappingURL=pagination.js.map
+/** For adapters paging by offset. Junk and negatives read as the first page. */
+export function decodeOffsetCursor(cursor) {
+    const offset = cursor ? parseInt(cursor, 10) : 0;
+    return Number.isFinite(offset) && offset >= 0 ? offset : 0;
+}
+export function encodeOffsetCursor(offset) {
+    return String(offset);
+}
+/**
+ * Every page of a list, in order. One call stops at `MAX_PAGE_LIMIT` without saying so, which is
+ * fatal for a read that must see every row. Break out of the loop to stop reading.
+ */
+export async function* walkPages(fetchPage) {
+    let cursor;
+    do {
+        const page = await fetchPage({ limit: MAX_PAGE_LIMIT, cursor });
+        yield page;
+        cursor = page.nextCursor;
+    } while (cursor);
+}
+/** Every row of a list, across all its pages. */
+export async function listAll(fetchPage) {
+    const items = [];
+    for await (const page of walkPages(fetchPage))
+        items.push(...page.items);
+    return items;
+}
+/** The effective page size for a requested limit. */
+export function clampPageLimit(limit) {
+    const requested = limit ?? DEFAULT_PAGE_LIMIT;
+    if (!Number.isFinite(requested))
+        return DEFAULT_PAGE_LIMIT;
+    return Math.min(Math.max(1, Math.floor(requested)), MAX_PAGE_LIMIT);
+}

package/dist/permissions/index.d.ts

@@ -1,4 +1,4 @@
 export type { PlatformPermission } from './types.js';
-export { PlatformPermissionSchema, ALL_PLATFORM_PERMISSIONS } from './types.js';
+export { PlatformPermissionSchema, ALL_PLATFORM_PERMISSIONS, OPERATOR_PLATFORM_PERMISSIONS } from './types.js';
 export type { IPlatformPermissionStore } from './interface.js';
-//# sourceMappingURL=index.d.ts.map
+export { assertCanManagePermissions, assertCanReadPermissions, assertCanReadPermissionsBatch } from '../context.js';

package/dist/permissions/index.js

@@ -1,2 +1,2 @@
-export { PlatformPermissionSchema, ALL_PLATFORM_PERMISSIONS } from './types.js';
-//# sourceMappingURL=index.js.map
+export { PlatformPermissionSchema, ALL_PLATFORM_PERMISSIONS, OPERATOR_PLATFORM_PERMISSIONS } from './types.js';
+export { assertCanManagePermissions, assertCanReadPermissions, assertCanReadPermissionsBatch } from '../context.js';

package/dist/permissions/interface.d.ts

@@ -27,7 +27,9 @@ export interface IPlatformPermissionStore {
     set(ctx: RequestContext, userId: string, permissions: readonly PlatformPermission[]): Promise<UserManagementResult>;
     /**
      * True if at least one *enabled* user holds `instance_admin`. Adapters
-     * must exclude disabled users — over-count is safer than under-count.
+     * must exclude disabled users. One that can't see the disabled flag, like local,
+     * relies on the routes: disabling revokes `instance_admin` first, and a disabled
+     * user can't be granted it.
      */
     hasInstanceAdmin(ctx: RequestContext): Promise<boolean>;
     /**
@@ -45,8 +47,7 @@ export interface IPlatformPermissionStore {
      * write: on a fresh single-tenant install with no
      * `BOOTSTRAP_INSTANCE_ADMIN_EMAIL` configured, any signer is eligible, so
      * two people signing in at the same moment both observe "no admin" and both
-     * become permanent platform admins. §2 promises "first signer wins" — this
-     * is what makes that true rather than aspirational.
+     * become permanent platform admins. This is what makes first signer win.
      *
      * Same shape as the sole-admin invariant (`set`), pointing the other way:
      * that one refuses to drop the last admin, this one refuses to create a
@@ -54,4 +55,3 @@ export interface IPlatformPermissionStore {
      */
     claimFirstInstanceAdmin(ctx: RequestContext, userId: string, permissions: readonly PlatformPermission[]): Promise<boolean>;
 }
-//# sourceMappingURL=interface.d.ts.map

package/dist/permissions/interface.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=interface.js.map

package/dist/permissions/types.d.ts

@@ -23,4 +23,3 @@ export declare const ALL_PLATFORM_PERMISSIONS: readonly PlatformPermission[];
  * `manage_api_tokens` is granted to ordinary users, who have no business there.
  */
 export declare const OPERATOR_PLATFORM_PERMISSIONS: readonly PlatformPermission[];
-//# sourceMappingURL=types.d.ts.map

package/dist/permissions/types.js

@@ -22,4 +22,3 @@ export const ALL_PLATFORM_PERMISSIONS = PlatformPermissionSchema.options;
  * `manage_api_tokens` is granted to ordinary users, who have no business there.
  */
 export const OPERATOR_PLATFORM_PERMISSIONS = ALL_PLATFORM_PERMISSIONS.filter((p) => p !== 'manage_api_tokens');
-//# sourceMappingURL=types.js.map

package/dist/platformProjects/index.d.ts

@@ -1,4 +1,2 @@
-export type { PlatformProjectGrant, PlatformProjectGranteeType } from './types.js';
+export type { PlatformProjectGrant } from './types.js';
 export type { IPlatformProjectGrantStore } from './interface.js';
-export { PlatformProjectGrantSchema, PlatformProjectGranteeTypeSchema } from './schemas.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/platformProjects/index.js

@@ -1,2 +1 @@
-export { PlatformProjectGrantSchema, PlatformProjectGranteeTypeSchema } from './schemas.js';
-//# sourceMappingURL=index.js.map
+export {};

package/dist/platformProjects/interface.d.ts

@@ -22,4 +22,3 @@ export interface IPlatformProjectGrantStore {
      */
     deleteByGranteeOrg(ctx: RequestContext, orgId: string): Promise<void>;
 }
-//# sourceMappingURL=interface.d.ts.map

package/dist/platformProjects/interface.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=interface.js.map

package/dist/platformProjects/schemas.d.ts

@@ -15,4 +15,3 @@ export declare const PlatformProjectGrantSchema: z.ZodObject<{
     createdBy: z.ZodString;
     createdAt: z.ZodString;
 }, z.core.$strip>;
-//# sourceMappingURL=schemas.d.ts.map

package/dist/platformProjects/schemas.js

@@ -9,4 +9,3 @@ export const PlatformProjectGrantSchema = z.object({
     createdBy: z.string(),
     createdAt: z.string()
 });
-//# sourceMappingURL=schemas.js.map

package/dist/platformProjects/types.d.ts

@@ -1,4 +1,6 @@
-export type PlatformProjectGranteeType = 'org' | 'user';
+import type { z } from 'zod';
+import type { PlatformProjectGranteeTypeSchema } from './schemas.js';
+export type PlatformProjectGranteeType = z.infer<typeof PlatformProjectGranteeTypeSchema>;
 /**
  * Grants view-only or view+solve access to a `platform`-visibility project
  * for an org or an individual user, without creating project membership rows.
@@ -16,4 +18,3 @@ export interface PlatformProjectGrant {
     createdBy: string;
     createdAt: string;
 }
-//# sourceMappingURL=types.d.ts.map

package/dist/platformProjects/types.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=types.js.map

package/dist/projects/index.d.ts

@@ -2,4 +2,3 @@ export type { Project, ProjectMember } from './types.js';
 export type { IProjectStore } from './interface.js';
 export type { ProjectVisibility, ProjectRole } from './schemas.js';
 export { ProjectVisibilitySchema, ProjectRoleSchema, validateProjectFlags } from './schemas.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/projects/index.js

@@ -1,2 +1 @@
 export { ProjectVisibilitySchema, ProjectRoleSchema, validateProjectFlags } from './schemas.js';
-//# sourceMappingURL=index.js.map

package/dist/projects/interface.d.ts

@@ -38,4 +38,3 @@ export interface IProjectStore {
     updateProjectMemberRole(ctx: RequestContext, projectId: string, userId: string, role: ProjectRole): Promise<void>;
     removeProjectMember(ctx: RequestContext, projectId: string, userId: string): Promise<void>;
 }
-//# sourceMappingURL=interface.d.ts.map

package/dist/projects/interface.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=interface.js.map

package/dist/projects/schemas.d.ts

@@ -20,4 +20,3 @@ export declare function validateProjectFlags(merged: {
     path: string;
     message: string;
 }[];
-//# sourceMappingURL=schemas.d.ts.map

package/dist/projects/schemas.js

@@ -18,4 +18,3 @@ export function validateProjectFlags(merged) {
     }
     return issues;
 }
-//# sourceMappingURL=schemas.js.map