@selvajs/platform 0.21.0-beta.3 → 1.0.0-beta.5

package/dist/projects/types.d.ts

@@ -32,4 +32,3 @@ export interface ProjectMember {
     updatedBy: string;
     deletedAt?: string | null;
 }
-//# sourceMappingURL=types.d.ts.map

package/dist/projects/types.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=types.js.map

package/dist/shareLinks/index.d.ts

@@ -3,4 +3,3 @@ export type { IShareLinkStore } from './interface.js';
 export { DEFAULT_SHARE_LINK_MAX_SOLVES } from './types.js';
 export type { CreateShareLinkInput } from './schemas.js';
 export { CreateShareLinkInputSchema } from './schemas.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/shareLinks/index.js

@@ -1,3 +1,2 @@
 export { DEFAULT_SHARE_LINK_MAX_SOLVES } from './types.js';
 export { CreateShareLinkInputSchema } from './schemas.js';
-//# sourceMappingURL=index.js.map

package/dist/shareLinks/interface.d.ts

@@ -6,7 +6,8 @@ import type { OrgShareLink, ShareLink } from './types.js';
  * (definitionId, channel). The store sees only the HMAC hash; the raw token
  * is generated and shown to the minter at the route layer.
  *
- * Reads filter `revokedAt IS NULL` defensively.
+ * List and token reads treat a revoked or expired link as gone. `getById` does
+ * not, so a caller can tell a dead link from a missing one.
  */
 export interface IShareLinkStore {
     /** Caller has already hashed the raw token. */
@@ -29,7 +30,10 @@ export interface IShareLinkStore {
     getById(ctx: RequestContext, id: string): Promise<ShareLink | null>;
     /** Returns null when the link doesn't exist, is revoked, or its parent definition is soft-deleted. */
     getByTokenHash(ctx: RequestContext, tokenHash: string): Promise<ShareLink | null>;
-    /** Soft-delete (set `revokedAt`). Idempotent. */
+    /**
+     * Soft-delete (set `revokedAt`). Idempotent: emits once, and a repeat is a no-op.
+     * Throws `ProviderError` when the caller may not revoke it.
+     */
     revoke(ctx: RequestContext, id: string): Promise<void>;
     /**
      * Atomic check-and-increment; must be a single statement, since
@@ -38,4 +42,3 @@ export interface IShareLinkStore {
      */
     tryIncrementSolveCount(ctx: RequestContext, id: string): Promise<number | null>;
 }
-//# sourceMappingURL=interface.d.ts.map

package/dist/shareLinks/interface.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=interface.js.map

package/dist/shareLinks/schemas.d.ts

@@ -14,4 +14,3 @@ export declare const CreateShareLinkInputSchema: z.ZodObject<{
     expiresAt: z.ZodOptional<z.ZodNullable<z.ZodISODateTime>>;
 }, z.core.$strip>;
 export type CreateShareLinkInput = z.infer<typeof CreateShareLinkInputSchema>;
-//# sourceMappingURL=schemas.d.ts.map

package/dist/shareLinks/schemas.js

@@ -8,8 +8,10 @@ export const CreateShareLinkInputSchema = z.object({
     channel: DefinitionChannelSchema.default('live'),
     name: z.string().max(128).optional(),
     allowSolve: z.boolean().default(true),
-    /** Null is the minter's deliberate "uncap" choice; omitted applies the default cap. */
+    /**
+     * Null is the minter's deliberate "uncap" choice. Omitted stays undefined here:
+     * the mint handler applies `DEFAULT_SHARE_LINK_MAX_SOLVES`.
+     */
     maxSolves: z.number().int().min(1).nullable().optional(),
     expiresAt: z.iso.datetime().nullable().optional()
 });
-//# sourceMappingURL=schemas.js.map

package/dist/shareLinks/types.d.ts

@@ -46,4 +46,3 @@ export interface OrgShareLink extends Omit<ShareLink, 'tokenHash'> {
  * worst-case denial-of-wallet damage.
  */
 export declare const DEFAULT_SHARE_LINK_MAX_SOLVES = 1000;
-//# sourceMappingURL=types.d.ts.map

package/dist/shareLinks/types.js

@@ -4,4 +4,3 @@
  * worst-case denial-of-wallet damage.
  */
 export const DEFAULT_SHARE_LINK_MAX_SOLVES = 1000;
-//# sourceMappingURL=types.js.map

package/dist/solveCache/interface.d.ts

@@ -6,8 +6,8 @@ import type { RequestContext } from '../context.js';
  *
  * Design contract:
  *
- * - **Async from day one.** The in-memory backend returns promises too, so a
- *   network store (Redis) drops in later without any call site changing shape.
+ * - **Async.** The in-memory backend returns promises too, so a network store
+ *   (Redis) fits without any call site changing shape.
  * - **Entries are opaque bytes** — the pre-gzipped response envelope plus a
  *   small metadata header. The backend never inspects them, so a hit stays
  *   near-CPU-free in either backend and there's no serialization drift between
@@ -81,4 +81,3 @@ export declare class NoopSolveResultCache implements ISolveResultCache {
     get(_ctx: RequestContext, _key: SolveCacheKey): Promise<Uint8Array | null>;
     set(_ctx: RequestContext, _key: SolveCacheKey, _bytes: Uint8Array, _opts: SolveCacheSetOptions): Promise<void>;
 }
-//# sourceMappingURL=interface.d.ts.map

package/dist/solveCache/interface.js

@@ -9,4 +9,3 @@ export class NoopSolveResultCache {
     }
     async set(_ctx, _key, _bytes, _opts) { }
 }
-//# sourceMappingURL=interface.js.map

package/dist/storage/assetClasses.d.ts

@@ -4,16 +4,15 @@
  * entry in {@link ASSET_CLASSES} rather than a new route.
  *
  * - `public`  — anyone, including logged-out visitors (branding: logo, favicon).
- * - `org`     — members of the owning org only; route resolves orgId from the path.
  * - `project` — members of the owning project only; route resolves the
  *   definition guid to its project (cover images, per-definition blobs).
  */
-export type AssetVisibility = 'public' | 'org' | 'project';
+export type AssetVisibility = 'public' | 'project';
 /**
  * What scope id the route must authorize against. `none` for public assets
- * (no scope to check); `org`/`project` carry the id extracted from the path.
+ * (no scope to check); `project` carries the guid extracted from the path.
  */
-export type AssetScope = 'none' | 'org' | 'project';
+export type AssetScope = 'none' | 'project';
 export interface AssetClass {
     /** Stable identifier — for logging and tests, not user-facing. */
     readonly id: string;
@@ -21,7 +20,7 @@ export interface AssetClass {
     readonly scope: AssetScope;
     /**
      * Anchored matcher for this class's storage paths. Capture group 1 (when
-     * present) is the scope id (orgId or guid) the route authorizes against.
+     * present) is the scope id the route authorizes against.
      */
     readonly pattern: RegExp;
 }
@@ -46,6 +45,3 @@ export declare const ASSET_CLASSES: readonly AssetClass[];
  * captures an id (e.g. `org-branding` captures orgId but is public).
  */
 export declare function classifyAssetPath(storagePath: string): AssetMatch | null;
-/** True when the path belongs to a `public` asset class (CDN-servable, no auth). */
-export declare function isPublicAssetPath(storagePath: string): boolean;
-//# sourceMappingURL=assetClasses.d.ts.map

package/dist/storage/assetClasses.js

@@ -1,15 +1,9 @@
 import { ALL_ORG_ASSET_KINDS } from '../organizations/schemas.js';
-import { COVER_IMAGE_EXTENSIONS } from '../definitions/types.js';
+import { UUID_REGEX } from '../definitions/schemas.js';
+import { SAFE_SEGMENT } from './safeKey.js';
 // Built from the schema enum so a new branding kind extends this pattern automatically.
 const BRANDING_KINDS = ALL_ORG_ASSET_KINDS.join('|');
-// Derived from COVER_IMAGE_EXTENSIONS so a new cover format propagates here
-// instead of silently 404ing legit covers.
-const COVER_EXTS = COVER_IMAGE_EXTENSIONS.map((ext) => ext.replace(/^\./, '').replace(/[.*+?^${}()|[\]\\]/g, '\\$&')).join('|');
-// SAFE_SEGMENT mirrors the assertSafeKey alphabet in the path helpers
-// (traversal/empty segments are rejected separately by hasUnsafeSegment);
-// GUID is kept in sync with UUID_REGEX in definitions/schemas.ts.
-const SAFE_SEGMENT = String.raw `[A-Za-z0-9._-]+`;
-const GUID = String.raw `[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}`;
+const GUID = UUID_REGEX.source.slice(1, -1);
 /**
  * The closed registry of servable asset classes. Patterns are mutually
  * exclusive by prefix, order doesn't matter. Anything matching no class is
@@ -22,17 +16,13 @@ export const ASSET_CLASSES = [
         scope: 'none',
         pattern: new RegExp(String.raw `^orgs\/(${SAFE_SEGMENT})\/branding\/(?:${BRANDING_KINDS})\.webp$`)
     },
-    {
-        id: 'org-private',
-        visibility: 'org',
-        scope: 'org',
-        pattern: new RegExp(String.raw `^orgs\/(${SAFE_SEGMENT})\/private\/${SAFE_SEGMENT}$`)
-    },
     {
         id: 'definition-cover',
         visibility: 'project',
         scope: 'project',
-        pattern: new RegExp(String.raw `^definitions\/(${GUID})\/cover\.(?:${COVER_EXTS})$`, 'i')
+        // `put` transcodes every cover and `definitionPaths.image` names it, so this is
+        // the only cover that can exist.
+        pattern: new RegExp(String.raw `^definitions\/(${GUID})\/cover\.webp$`, 'i')
     }
 ];
 /**
@@ -72,8 +62,3 @@ export function classifyAssetPath(storagePath) {
     }
     return null;
 }
-/** True when the path belongs to a `public` asset class (CDN-servable, no auth). */
-export function isPublicAssetPath(storagePath) {
-    return classifyAssetPath(storagePath)?.class.visibility === 'public';
-}
-//# sourceMappingURL=assetClasses.js.map

package/dist/storage/cacheBust.d.ts

@@ -16,4 +16,3 @@
  * degrades to "no cache-bust" rather than `?v=`.
  */
 export declare function withCacheBust(url: string, token: string | number | undefined | null): string;
-//# sourceMappingURL=cacheBust.d.ts.map

package/dist/storage/cacheBust.js

@@ -21,7 +21,9 @@ export function withCacheBust(url, token) {
     const value = String(token).trim();
     if (value === '')
         return url;
-    const sep = url.includes('?') ? '&' : '?';
-    return `${url}${sep}v=${encodeURIComponent(value)}`;
+    const hash = url.indexOf('#');
+    const base = hash === -1 ? url : url.slice(0, hash);
+    const fragment = hash === -1 ? '' : url.slice(hash);
+    const sep = base.includes('?') ? '&' : '?';
+    return `${base}${sep}v=${encodeURIComponent(value)}${fragment}`;
 }
-//# sourceMappingURL=cacheBust.js.map

package/dist/storage/image.d.ts

@@ -1,20 +1,21 @@
 /**
  * Shared image-transcoding helper for `IStorageProvider` implementations.
- * Normalizes uploads to WebP (capped at 1200px, quality 85) so storage,
- * bandwidth, and the viewer path stay predictable.
+ * Normalizes uploads to WebP (at most 1200px on either side, quality 85) so
+ * storage, bandwidth, and the viewer path stay predictable.
  *
  * `sharp` is a dynamic import, not a hard dependency of this package —
  * providers that need transcoding install it themselves.
  */
 export declare const IMAGE_MAX_WIDTH = 1200;
 export declare const IMAGE_WEBP_QUALITY = 85;
+export declare const MAX_CONCURRENT_TRANSCODES = 2;
 export interface TranscodeResult {
     data: Uint8Array;
     contentType: string;
     /** Possibly-rewritten path (non-webp inputs become `.webp`). */
     path: string;
 }
-/** True if the input looks like an image to process — by content type or path extension. */
+/** True if the input is an image to process. The content type decides, unless it says nothing. */
 export declare function isImageUpload(contentType: string | undefined, storagePath: string): boolean;
 /**
  * Rewrites a path's extension to `.webp`; unchanged for non-image extensions.
@@ -26,7 +27,9 @@ export declare function toWebpPath(storagePath: string): string;
  * Transcodes images to WebP; passes non-images through unchanged, so
  * providers can call this unconditionally before `put`.
  *
- * Throws if `sharp` isn't installed — a config error, not a fallback.
+ * Throws `ProviderError(422)` for bytes it won't process, and a plain error if
+ * `sharp` isn't installed, which is a config problem rather than a bad upload.
  */
 export declare function transcodeImageIfNeeded(data: Uint8Array, contentType: string | undefined, storagePath: string): Promise<TranscodeResult>;
-//# sourceMappingURL=image.d.ts.map
+/** Runs `fn` when a slot is free. A finishing transcode hands its slot straight to the next. */
+export declare function withTranscodeSlot<T>(fn: () => Promise<T>): Promise<T>;

package/dist/storage/image.js

@@ -1,17 +1,26 @@
 /**
  * Shared image-transcoding helper for `IStorageProvider` implementations.
- * Normalizes uploads to WebP (capped at 1200px, quality 85) so storage,
- * bandwidth, and the viewer path stay predictable.
+ * Normalizes uploads to WebP (at most 1200px on either side, quality 85) so
+ * storage, bandwidth, and the viewer path stay predictable.
  *
  * `sharp` is a dynamic import, not a hard dependency of this package —
  * providers that need transcoding install it themselves.
  */
+import { ProviderError } from '../errors.js';
 export const IMAGE_MAX_WIDTH = 1200;
 export const IMAGE_WEBP_QUALITY = 85;
-/** True if the input looks like an image to process — by content type or path extension. */
+// A small upload can decode to gigabytes or burn seconds of CPU: the size cap on
+// the request says nothing about either. 60 MP covers a phone camera's full frame.
+const MAX_INPUT_PIXELS = 60_000_000;
+const TRANSCODE_TIMEOUT_SECONDS = 10;
+export const MAX_CONCURRENT_TRANSCODES = 2;
+// What `metadata()` found in the bytes, whatever the client declared.
+const ALLOWED_FORMATS = new Set(['jpeg', 'png', 'webp', 'gif', 'tiff', 'svg']);
+/** True if the input is an image to process. The content type decides, unless it says nothing. */
 export function isImageUpload(contentType, storagePath) {
-    if (contentType?.startsWith('image/'))
-        return true;
+    if (contentType && contentType !== 'application/octet-stream') {
+        return contentType.startsWith('image/');
+    }
     return /\.(webp|png|jpe?g|gif|bmp|tif?f|svg)$/i.test(storagePath);
 }
 /**
@@ -26,29 +35,83 @@ export function toWebpPath(storagePath) {
  * Transcodes images to WebP; passes non-images through unchanged, so
  * providers can call this unconditionally before `put`.
  *
- * Throws if `sharp` isn't installed — a config error, not a fallback.
+ * Throws `ProviderError(422)` for bytes it won't process, and a plain error if
+ * `sharp` isn't installed, which is a config problem rather than a bad upload.
  */
 export async function transcodeImageIfNeeded(data, contentType, storagePath) {
     if (!isImageUpload(contentType, storagePath)) {
         return { data, contentType: contentType ?? 'application/octet-stream', path: storagePath };
     }
     const sharp = await loadSharp();
-    const compressed = await sharp(Buffer.from(data))
-        .resize({ width: IMAGE_MAX_WIDTH, withoutEnlargement: true })
-        .webp({ quality: IMAGE_WEBP_QUALITY })
-        .toBuffer();
+    const compressed = await withTranscodeSlot(() => rasterize(sharp, Buffer.from(data), contentType, storagePath));
     return {
         data: new Uint8Array(compressed),
         contentType: 'image/webp',
         path: toWebpPath(storagePath)
     };
 }
+async function rasterize(sharp, input, contentType, storagePath) {
+    try {
+        // Unlimited here: this only reads the header, and sharp's own limit would hide
+        // the reason from the check below.
+        const header = sharp(input, { limitInputPixels: false });
+        const { format, width = 0, height = 0 } = await header.metadata();
+        // SVG is the expensive format, so it has to be asked for: a route that only
+        // checks the declared type must not let one in as a PNG.
+        const declaredSvg = contentType === 'image/svg+xml' || /\.svg$/i.test(storagePath);
+        if (!ALLOWED_FORMATS.has(format) || (format === 'svg' && !declaredSvg)) {
+            throw new ProviderError(`Unsupported image format: ${format}`, 422);
+        }
+        if (width * height > MAX_INPUT_PIXELS) {
+            throw new ProviderError('Image has too many pixels', 422);
+        }
+        return await sharp(input, { limitInputPixels: MAX_INPUT_PIXELS })
+            .autoOrient()
+            .resize({
+            width: IMAGE_MAX_WIDTH,
+            height: IMAGE_MAX_WIDTH,
+            fit: 'inside',
+            withoutEnlargement: true
+        })
+            .webp({ quality: IMAGE_WEBP_QUALITY })
+            .timeout({ seconds: TRANSCODE_TIMEOUT_SECONDS })
+            .toBuffer();
+    }
+    catch (err) {
+        if (err instanceof ProviderError)
+            throw err;
+        throw new ProviderError('The image could not be read', 422);
+    }
+}
+let activeTranscodes = 0;
+const waitingTranscodes = [];
+/** Runs `fn` when a slot is free. A finishing transcode hands its slot straight to the next. */
+export async function withTranscodeSlot(fn) {
+    if (activeTranscodes < MAX_CONCURRENT_TRANSCODES) {
+        activeTranscodes += 1;
+    }
+    else {
+        await new Promise((resolve) => waitingTranscodes.push(resolve));
+    }
+    try {
+        return await fn();
+    }
+    finally {
+        const next = waitingTranscodes.shift();
+        if (next)
+            next();
+        else
+            activeTranscodes -= 1;
+    }
+}
+// Not a literal: a browser build of the root barrel would try to resolve it.
+const SHARP_MODULE = 'sharp';
 let cachedSharp = null;
 async function loadSharp() {
     if (cachedSharp)
         return cachedSharp;
     try {
-        const mod = (await import('sharp'));
+        const mod = (await import(/* @vite-ignore */ SHARP_MODULE));
         cachedSharp = mod.default ?? mod;
         return cachedSharp;
     }
@@ -56,4 +119,3 @@ async function loadSharp() {
         throw new Error('Image transcoding requires `sharp` to be installed. Add it as a dependency in your provider package.', { cause: err });
     }
 }
-//# sourceMappingURL=image.js.map

package/dist/storage/index.d.ts

@@ -1,7 +1,5 @@
 export type { IStorageProvider } from './interface.js';
-export { IMAGE_MAX_WIDTH, IMAGE_WEBP_QUALITY, isImageUpload, toWebpPath, transcodeImageIfNeeded } from './image.js';
+export { transcodeImageIfNeeded } from './image.js';
 export type { TranscodeResult } from './image.js';
-export { ASSET_CLASSES, classifyAssetPath, isPublicAssetPath } from './assetClasses.js';
-export type { AssetVisibility, AssetScope, AssetClass, AssetMatch } from './assetClasses.js';
+export { ASSET_CLASSES, classifyAssetPath } from './assetClasses.js';
 export { withCacheBust } from './cacheBust.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/storage/index.js

@@ -1,4 +1,3 @@
-export { IMAGE_MAX_WIDTH, IMAGE_WEBP_QUALITY, isImageUpload, toWebpPath, transcodeImageIfNeeded } from './image.js';
-export { ASSET_CLASSES, classifyAssetPath, isPublicAssetPath } from './assetClasses.js';
+export { transcodeImageIfNeeded } from './image.js';
+export { ASSET_CLASSES, classifyAssetPath } from './assetClasses.js';
 export { withCacheBust } from './cacheBust.js';
-//# sourceMappingURL=index.js.map

package/dist/storage/interface.d.ts

@@ -10,10 +10,19 @@
 export interface IStorageProvider {
     /** Returns null if the path does not exist. */
     get(path: string): Promise<Uint8Array | null>;
-    put(path: string, data: Uint8Array, contentType?: string): Promise<void>;
+    /**
+     * Stores the bytes, replacing what is there, and returns the path they landed
+     * at. Images go through `transcodeImageIfNeeded` first: they are stored as WebP
+     * and a `.png` or similar path becomes `.webp`, so read back with the returned
+     * path. Throws `ProviderError(422)` for an image the transcoder refuses.
+     */
+    put(path: string, data: Uint8Array, contentType?: string): Promise<string>;
     /** No-op if the path does not exist. */
     delete(path: string): Promise<void>;
-    /** Delete every file whose path starts with `prefix`. */
+    /**
+     * Delete every file under the directory `prefix`, so `a/b` does not reach
+     * `a/bc`. Throws on an empty prefix or `/`, which would name the whole store.
+     */
     deletePrefix(prefix: string): Promise<void>;
     /**
      * Public URL for a stored file. Local: a relative API path; S3/CDN: a
@@ -21,4 +30,3 @@ export interface IStorageProvider {
      */
     getPublicUrl(path: string): string;
 }
-//# sourceMappingURL=interface.d.ts.map

package/dist/storage/interface.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=interface.js.map

package/dist/storage/safeKey.d.ts

@@ -0,0 +1,7 @@
+/** Alphabet of one storage path segment, as regex source. Covers GUIDs and sanitized refs. */
+export declare const SAFE_SEGMENT: string;
+/**
+ * Blocks traversal, separators, NUL and empty segments, so a malicious id can't
+ * escape its prefix. The alphabet admits `.` and `..`, so those need their own check.
+ */
+export declare function assertSafeKey(value: string, label: string): void;

package/dist/storage/safeKey.js

@@ -0,0 +1,12 @@
+/** Alphabet of one storage path segment, as regex source. Covers GUIDs and sanitized refs. */
+export const SAFE_SEGMENT = String.raw `[A-Za-z0-9._-]+`;
+const SAFE_SEGMENT_ONLY = new RegExp(`^${SAFE_SEGMENT}$`);
+/**
+ * Blocks traversal, separators, NUL and empty segments, so a malicious id can't
+ * escape its prefix. The alphabet admits `.` and `..`, so those need their own check.
+ */
+export function assertSafeKey(value, label) {
+    if (!value || !SAFE_SEGMENT_ONLY.test(value) || value === '.' || value === '..') {
+        throw new Error(`Unsafe ${label}: ${JSON.stringify(value)}`);
+    }
+}

package/dist/testing/index.d.ts

@@ -1,5 +1,9 @@
-export { runAuthProviderConformance } from './suites/authProviderSuite.js';
+export { runAuthCoreConformance, runAuthProviderConformance, runPasswordAuthConformance } from './suites/authProviderSuite.js';
 export type { AuthProviderConformanceOptions } from './suites/authProviderSuite.js';
+export { runOAuthAuthConformance } from './suites/oauthAuthSuite.js';
+export type { OAuthAuthConformanceOptions } from './suites/oauthAuthSuite.js';
+export { runAuditQueryConformance } from './suites/auditQuerySuite.js';
+export type { AuditQueryConformanceOptions } from './suites/auditQuerySuite.js';
 export { runEmailLinkAuthConformance } from './suites/emailLinkAuthSuite.js';
 export type { EmailLinkAuthConformanceOptions } from './suites/emailLinkAuthSuite.js';
 export { runDefinitionStoreConformance } from './suites/definitionStoreSuite.js';
@@ -28,4 +32,3 @@ export { runPlatformProjectGrantStoreConformance } from './suites/platformProjec
 export type { PlatformProjectGrantStoreConformanceOptions } from './suites/platformProjectGrantStoreSuite.js';
 export { runApiTokenStoreConformance } from './suites/apiTokenStoreSuite.js';
 export type { ApiTokenStoreConformanceOptions, ApiTokenTestScope } from './suites/apiTokenStoreSuite.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/testing/index.js

@@ -1,4 +1,6 @@
-export { runAuthProviderConformance } from './suites/authProviderSuite.js';
+export { runAuthCoreConformance, runAuthProviderConformance, runPasswordAuthConformance } from './suites/authProviderSuite.js';
+export { runOAuthAuthConformance } from './suites/oauthAuthSuite.js';
+export { runAuditQueryConformance } from './suites/auditQuerySuite.js';
 export { runEmailLinkAuthConformance } from './suites/emailLinkAuthSuite.js';
 export { runDefinitionStoreConformance } from './suites/definitionStoreSuite.js';
 export { runOrgStoreConformance } from './suites/orgStoreSuite.js';
@@ -13,4 +15,3 @@ export { runSolveMetricSinkConformance } from './suites/solveMetricSinkSuite.js'
 export { runPlatformPermissionStoreConformance } from './suites/platformPermissionStoreSuite.js';
 export { runPlatformProjectGrantStoreConformance } from './suites/platformProjectGrantStoreSuite.js';
 export { runApiTokenStoreConformance } from './suites/apiTokenStoreSuite.js';
-//# sourceMappingURL=index.js.map

package/dist/testing/suites/apiTokenStoreSuite.d.ts

@@ -26,4 +26,3 @@ export interface ApiTokenStoreConformanceOptions {
     seedUser?: SeedUserFn;
 }
 export declare function runApiTokenStoreConformance(opts: ApiTokenStoreConformanceOptions): void;
-//# sourceMappingURL=apiTokenStoreSuite.d.ts.map

package/dist/testing/suites/apiTokenStoreSuite.js

@@ -203,4 +203,3 @@ export function runApiTokenStoreConformance(opts) {
         });
     });
 }
-//# sourceMappingURL=apiTokenStoreSuite.js.map

package/dist/testing/suites/auditQuerySuite.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Adapter conformance suite for IAuditQuery, read through the sink that writes the
+ * rows. Also holds an IEventSink to what the query shows: per-actor order.
+ */
+import type { IAuditQuery } from '../../events/audit.js';
+import type { IEventSink } from '../../events/interface.js';
+export interface AuditQueryConformanceOptions {
+    name: string;
+    /** A query and the sink that feeds it, over storage that starts empty. */
+    createStores: () => Promise<{
+        query: IAuditQuery;
+        sink: IEventSink;
+    }> | {
+        query: IAuditQuery;
+        sink: IEventSink;
+    };
+}
+export declare function runAuditQueryConformance(opts: AuditQueryConformanceOptions): void;

package/dist/testing/suites/auditQuerySuite.js

@@ -0,0 +1,73 @@
+/**
+ * Adapter conformance suite for IAuditQuery, read through the sink that writes the
+ * rows. Also holds an IEventSink to what the query shows: per-actor order.
+ */
+import { describe, it, expect } from 'vitest';
+import { makeSystemCtx, makeUuid } from './helpers.js';
+const ctx = makeSystemCtx();
+const deleted = (orgId, actorId) => ({
+    type: 'org.deleted',
+    orgId,
+    actorId
+});
+const created = (orgId, actorId) => ({
+    type: 'org.created',
+    orgId,
+    actorId
+});
+export function runAuditQueryConformance(opts) {
+    const { name, createStores } = opts;
+    describe(`IAuditQuery conformance: ${name}`, () => {
+        it("returns one actor's events newest first, in the order they were emitted", async () => {
+            const { query, sink } = await createStores();
+            const actor = makeUuid();
+            const orgs = [makeUuid(), makeUuid(), makeUuid()];
+            for (const org of orgs)
+                await sink.emit(deleted(org, actor));
+            const { rows } = await query.list(ctx, { actorId: actor });
+            expect(rows.map((r) => r.data.orgId)).toEqual([...orgs].reverse());
+        });
+        it('filters by type and actor', async () => {
+            const { query, sink } = await createStores();
+            const actor = makeUuid();
+            await sink.emit(created(makeUuid(), actor));
+            await sink.emit(deleted(makeUuid(), actor));
+            await sink.emit(deleted(makeUuid(), makeUuid()));
+            const { rows } = await query.list(ctx, { actorId: actor, types: ['org.deleted'] });
+            expect(rows.map((r) => r.type)).toEqual(['org.deleted']);
+        });
+        it('honours the time bounds', async () => {
+            const { query, sink } = await createStores();
+            const actor = makeUuid();
+            await sink.emit(deleted(makeUuid(), actor));
+            const future = new Date(Date.now() + 60_000).toISOString();
+            const past = new Date(Date.now() - 60_000).toISOString();
+            expect((await query.list(ctx, { actorId: actor, sinceIso: future })).rows).toEqual([]);
+            expect((await query.list(ctx, { actorId: actor, untilIso: past })).rows).toEqual([]);
+        });
+        it('pages through every row exactly once', async () => {
+            const { query, sink } = await createStores();
+            const actor = makeUuid();
+            for (let i = 0; i < 5; i++)
+                await sink.emit(deleted(makeUuid(), actor));
+            const seen = [];
+            let cursor;
+            for (;;) {
+                const page = await query.list(ctx, { actorId: actor, limit: 2, cursor });
+                seen.push(...page.rows.map((r) => r.id));
+                if (!page.nextCursor)
+                    break;
+                cursor = page.nextCursor;
+            }
+            expect(seen).toHaveLength(5);
+            expect(new Set(seen).size).toBe(5);
+        });
+        it('still returns a row for a fractional limit', async () => {
+            const { query, sink } = await createStores();
+            const actor = makeUuid();
+            await sink.emit(deleted(makeUuid(), actor));
+            const { rows } = await query.list(ctx, { actorId: actor, limit: 0.5 });
+            expect(rows).toHaveLength(1);
+        });
+    });
+}

package/dist/testing/suites/authProviderSuite.d.ts

@@ -8,8 +8,8 @@ export interface AuthProviderConformanceOptions {
      * for password-capable providers. The factory is responsible for seeding
      * the admin user (e.g. via `createUserWithPassword`) before returning.
      *
-     * `adminEmail` defaults to `''` for legacy reasons; new providers should
-     * always return the seeded admin's email.
+     * `adminEmail` defaults to `''`; a password provider should return the seeded
+     * admin's email.
      */
     createProvider: () => Promise<{
         provider: IAuthProvider;
@@ -26,6 +26,17 @@ export interface AuthProviderConformanceOptions {
      * When false those methods are expected to return null / 'not_supported'.
      */
     userManagement?: boolean;
+    /** The provider has no `passwordAuth`, so only the core cases apply. */
+    passwordless?: boolean;
+    /** `passwordAuth.registerUser` is on, so its cases run. */
+    selfRegistration?: boolean;
 }
+/** Cases every auth provider must pass, password or not. */
+export declare function runAuthCoreConformance(opts: Pick<AuthProviderConformanceOptions, 'name' | 'createProvider'>): void;
+/** Cases for a provider with `passwordAuth`. */
+export declare function runPasswordAuthConformance(opts: AuthProviderConformanceOptions): void;
+/**
+ * Both of the above, gated on what the provider has. New cases go behind an option
+ * so a third-party adapter does not turn red on upgrade.
+ */
 export declare function runAuthProviderConformance(opts: AuthProviderConformanceOptions): void;
-//# sourceMappingURL=authProviderSuite.d.ts.map