@selvajs/platform 0.21.0-beta.3 → 1.0.0-beta.5

package/dist/testing/suites/platformPermissionStoreSuite.js

@@ -5,12 +5,9 @@
  * `countInstanceAdminsExcluding`, plus the §2 sole-`instance_admin`
  * invariant — `set` must return `'last_admin'` when dropping the only admin,
  * and `countInstanceAdminsExcluding` must exclude the named user.
- *
- * These tests used to live on the auth-provider conformance suite when the
- * invariant was enforced there; the move from `IAuthProvider` to
- * `IPlatformPermissionStore` brought them with it.
  */
 import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { makeSystemCtx } from './helpers.js';
 import { ALL_ORG_PERMISSIONS, ALL_PLATFORM_PERMISSIONS } from '../../index.js';
 export function runPlatformPermissionStoreConformance(opts) {
     const { name, createStore, disableUser, cleanup } = opts;
@@ -89,12 +86,7 @@ export function runPlatformPermissionStoreConformance(opts) {
         it('hasInstanceAdmin returns false on a fresh instance, true after granting', async () => {
             const { store, seedUser } = await createStore();
             const adminId = await seedUser();
-            const sysCtx = {
-                userId: '',
-                platformPermissions: [],
-                orgPermissions: [],
-                system: true
-            };
+            const sysCtx = makeSystemCtx();
             expect(await store.hasInstanceAdmin(sysCtx)).toBe(false);
             await store.set(adminCtx(adminId), adminId, ['instance_admin']);
             expect(await store.hasInstanceAdmin(sysCtx)).toBe(true);
@@ -121,10 +113,8 @@ export function runPlatformPermissionStoreConformance(opts) {
             const after = await store.getFor(adminCtx(adminA), adminB);
             expect(after).toContain('instance_admin');
         });
-        // The invariant has to survive concurrency, not just sequence. Two admins
-        // demoting each other at the same moment used to each read the other as
-        // "another admin exists" and both commit, bricking the instance. Exactly
-        // one must win.
+        // The invariant has to survive concurrency, not just sequence: two admins
+        // demoting each other must not each read the other as the survivor.
         it('concurrent demotions of two admins leave one standing', async () => {
             const { store, seedUser } = await createStore();
             const adminA = await seedUser();
@@ -138,12 +128,7 @@ export function runPlatformPermissionStoreConformance(opts) {
             // One demotion succeeds, the other is refused — never both.
             expect([resA, resB].filter((r) => r === 'ok')).toHaveLength(1);
             expect([resA, resB].filter((r) => r === 'last_admin')).toHaveLength(1);
-            const sysCtx = {
-                userId: '',
-                platformPermissions: [],
-                orgPermissions: [],
-                system: true
-            };
+            const sysCtx = makeSystemCtx();
             expect(await store.hasInstanceAdmin(sysCtx)).toBe(true);
         });
         it('a burst of concurrent demotions never drops the last admin', async () => {
@@ -159,24 +144,14 @@ export function runPlatformPermissionStoreConformance(opts) {
             // Whatever the interleaving, exactly one admin survives.
             expect(results.filter((r) => r === 'ok')).toHaveLength(ids.length - 1);
             expect(results.filter((r) => r === 'last_admin')).toHaveLength(1);
-            const sysCtx = {
-                userId: '',
-                platformPermissions: [],
-                orgPermissions: [],
-                system: true
-            };
+            const sysCtx = makeSystemCtx();
             expect(await store.hasInstanceAdmin(sysCtx)).toBe(true);
         });
         it('claimFirstInstanceAdmin grants on a fresh instance and refuses once claimed', async () => {
             const { store, seedUser } = await createStore();
             const first = await seedUser();
             const second = await seedUser();
-            const sysCtx = {
-                userId: '',
-                platformPermissions: [],
-                orgPermissions: [],
-                system: true
-            };
+            const sysCtx = makeSystemCtx();
             expect(await store.claimFirstInstanceAdmin(sysCtx, first, ['instance_admin'])).toBe(true);
             expect(await store.getFor(adminCtx(first), first)).toContain('instance_admin');
             // The instance is claimed. A later signer must not become a second
@@ -193,12 +168,7 @@ export function runPlatformPermissionStoreConformance(opts) {
             const ids = [];
             for (let i = 0; i < 4; i++)
                 ids.push(await seedUser());
-            const sysCtx = {
-                userId: '',
-                platformPermissions: [],
-                orgPermissions: [],
-                system: true
-            };
+            const sysCtx = makeSystemCtx();
             const results = await Promise.all(ids.map((id) => store.claimFirstInstanceAdmin(sysCtx, id, ['instance_admin'])));
             expect(results.filter(Boolean)).toHaveLength(1);
             const admins = await store.getForBatch(adminCtx(ids[0]), ids);
@@ -210,12 +180,7 @@ export function runPlatformPermissionStoreConformance(opts) {
             const adminB = await seedUser();
             await store.set(adminCtx(adminA), adminA, ['instance_admin']);
             await store.set(adminCtx(adminA), adminB, ['instance_admin']);
-            const sysCtx = {
-                userId: '',
-                platformPermissions: [],
-                orgPermissions: [],
-                system: true
-            };
+            const sysCtx = makeSystemCtx();
             // Excluding adminA: one admin (adminB) remains
             expect(await store.countInstanceAdminsExcluding(sysCtx, adminA)).toBe(1);
             // Excluding adminB: one admin (adminA) remains
@@ -225,23 +190,13 @@ export function runPlatformPermissionStoreConformance(opts) {
             const { store, seedUser } = await createStore();
             const adminId = await seedUser();
             await store.set(adminCtx(adminId), adminId, ['instance_admin']);
-            const sysCtx = {
-                userId: '',
-                platformPermissions: [],
-                orgPermissions: [],
-                system: true
-            };
+            const sysCtx = makeSystemCtx();
             expect(await store.countInstanceAdminsExcluding(sysCtx, adminId)).toBe(0);
         });
         itWithDisable('hasInstanceAdmin ignores disabled admins', async () => {
             const { store, seedUser } = await createStore();
             const adminId = await seedUser();
-            const sysCtx = {
-                userId: '',
-                platformPermissions: [],
-                orgPermissions: [],
-                system: true
-            };
+            const sysCtx = makeSystemCtx();
             await store.set(adminCtx(adminId), adminId, ['instance_admin']);
             expect(await store.hasInstanceAdmin(sysCtx)).toBe(true);
             await disableUser(adminId);
@@ -253,12 +208,7 @@ export function runPlatformPermissionStoreConformance(opts) {
             const adminB = await seedUser();
             await store.set(adminCtx(adminA), adminA, ['instance_admin']);
             await store.set(adminCtx(adminA), adminB, ['instance_admin']);
-            const sysCtx = {
-                userId: '',
-                platformPermissions: [],
-                orgPermissions: [],
-                system: true
-            };
+            const sysCtx = makeSystemCtx();
             await disableUser(adminB);
             // adminB holds the grant but is disabled — must not count as the
             // "other admin" that would allow demoting/disabling adminA.
@@ -312,4 +262,3 @@ export function runPlatformPermissionStoreConformance(opts) {
         });
     });
 }
-//# sourceMappingURL=platformPermissionStoreSuite.js.map

package/dist/testing/suites/platformProjectGrantStoreSuite.d.ts

@@ -17,4 +17,3 @@ export interface PlatformProjectGrantStoreConformanceOptions {
     seedProject?: (projectId: string) => Promise<void>;
 }
 export declare function runPlatformProjectGrantStoreConformance(opts: PlatformProjectGrantStoreConformanceOptions): void;
-//# sourceMappingURL=platformProjectGrantStoreSuite.d.ts.map

package/dist/testing/suites/platformProjectGrantStoreSuite.js

@@ -92,10 +92,6 @@ export function runPlatformProjectGrantStoreConformance(opts) {
             const got = await store.listByProject(SYSTEM_CONTEXT, projectId);
             expect(got).toHaveLength(0);
         });
-        it('delete on unknown id throws', async () => {
-            const store = await createStore();
-            await expect(store.delete(SYSTEM_CONTEXT, makeUuid())).rejects.toThrow();
-        });
         it('deleteByProject removes every grant for that project', async () => {
             const store = await createStore();
             const target = await seed();
@@ -131,4 +127,3 @@ export function runPlatformProjectGrantStoreConformance(opts) {
         });
     });
 }
-//# sourceMappingURL=platformProjectGrantStoreSuite.js.map

package/dist/testing/suites/projectStoreSuite.d.ts

@@ -24,8 +24,12 @@ export interface ProjectStoreConformanceOptions {
      * actually stored — callers use that, not the suggested one.
      */
     seedUser?: SeedUserFn;
+    /**
+     * Seeds the other party in the ctx-isolation cases. Needed where `seedUser` makes
+     * instance admins, who see everything by design.
+     */
+    seedOutsider?: SeedUserFn;
     /** If true, run ctx-isolation tests (adapters with row-level security). */
     ctxIsolation?: boolean;
 }
 export declare function runProjectStoreConformance(opts: ProjectStoreConformanceOptions): void;
-//# sourceMappingURL=projectStoreSuite.d.ts.map

package/dist/testing/suites/projectStoreSuite.js

@@ -32,8 +32,9 @@ function member(projectId, userId, role) {
     };
 }
 export function runProjectStoreConformance(opts) {
-    const { name, createStore: rawCreateStore, seedUser = noopSeedUser, ctxIsolation = false } = opts;
+    const { name, createStore: rawCreateStore, seedUser = noopSeedUser, seedOutsider = seedUser, ctxIsolation = false } = opts;
     const { seed, ctx, registerToken } = makeSeedHelpers(seedUser);
+    const outsider = makeSeedHelpers(seedOutsider);
     const createStore = async () => {
         const result = await rawCreateStore();
         if (result.ownerSessionToken)
@@ -317,22 +318,21 @@ export function runProjectStoreConformance(opts) {
             it('ctx isolation: projects created by one user are not visible to another', async () => {
                 const { store, orgId } = await createStore();
                 const userA = await seed();
-                const userB = await seed();
+                const userB = await outsider.seed();
                 const pA = project(orgId, userA);
                 await store.createProject(ctx(userA), pA);
-                const page = await store.listProjects(ctx(userB), orgId);
+                const page = await store.listProjects(outsider.ctx(userB), orgId);
                 expect(page.items.map((p) => p.id)).not.toContain(pA.id);
             });
             it('ctx isolation: user cannot get a project they do not own', async () => {
                 const { store, orgId } = await createStore();
                 const userA = await seed();
-                const userB = await seed();
+                const userB = await outsider.seed();
                 const pA = project(orgId, userA);
                 await store.createProject(ctx(userA), pA);
-                const got = await store.getProject(ctx(userB), pA.id);
+                const got = await store.getProject(outsider.ctx(userB), pA.id);
                 expect(got).toBeNull();
             });
         }
     });
 }
-//# sourceMappingURL=projectStoreSuite.js.map

package/dist/testing/suites/shareLinkStoreSuite.d.ts

@@ -36,6 +36,7 @@ export interface ShareLinkStoreConformanceOptions {
      * `definitions` row + parent project). Local adapters can return stub ids.
      */
     createScope?: () => Promise<ShareLinkTestScope> | ShareLinkTestScope;
+    /** The scope seeds `orgId` and `otherOrgId`, so the `listByOrg` cases can run. */
+    orgRoster?: boolean;
 }
 export declare function runShareLinkStoreConformance(opts: ShareLinkStoreConformanceOptions): void;
-//# sourceMappingURL=shareLinkStoreSuite.d.ts.map

package/dist/testing/suites/shareLinkStoreSuite.js

@@ -7,13 +7,11 @@
  * local adapter can stub.
  */
 import { describe, it, expect } from 'vitest';
-import { makeCtx, makeUuid } from './helpers.js';
-// Suite-wide token map. `scopeFor` populates it; `ctx` auto-attaches the
-// matching token so DB-side auth (Supabase RLS) sees the right user.
-const tokens = new Map();
-function ctx(userId, opts = {}) {
-    return makeCtx(userId, { ...opts, sessionToken: tokens.get(userId) });
-}
+import { SYSTEM_CONTEXT } from '../../context.js';
+import { makeSeedHelpers, makeUuid } from './helpers.js';
+// `scopeFor` registers the owner's token, so `ctx` runs as them on an adapter with
+// DB-side auth (Supabase RLS). This suite seeds nobody itself.
+const { ctx, registerToken } = makeSeedHelpers(async (userId) => ({ userId }));
 const DEFAULT_SCOPE = {
     ownerId: 'user-1',
     definitionId: 'def-1',
@@ -37,11 +35,11 @@ function link(scope, overrides = {}) {
     };
 }
 export function runShareLinkStoreConformance(opts) {
-    const { name, createStore, createScope } = opts;
+    const { name, createStore, createScope, orgRoster = false } = opts;
     const scopeFor = async () => {
         const s = createScope ? await createScope() : DEFAULT_SCOPE;
         if (s.ownerSessionToken)
-            tokens.set(s.ownerId, s.ownerSessionToken);
+            registerToken(s.ownerId, s.ownerSessionToken);
         return s;
     };
     describe(`IShareLinkStore conformance: ${name}`, () => {
@@ -132,15 +130,12 @@ export function runShareLinkStoreConformance(opts) {
             const got = await store.getByTokenHash(ctx(scope.ownerId), 'not-yet-expired');
             expect(got?.id).toBe(l.id);
         });
-        // The org roster is the only read that answers "what reaches this
-        // tenant's data right now?". `it.skipIf` rather than an omitted block, so
-        // an adapter that stops seeding an org shows as skipped instead of silently
-        // covering nothing.
-        describe('listByOrg', () => {
+        // The org roster is the only read that answers "what reaches this tenant's
+        // data right now?". `skipIf` rather than an omitted block, so an adapter that
+        // doesn't seed an org shows as skipped instead of silently covering nothing.
+        describe.skipIf(!orgRoster)('listByOrg', () => {
             it('returns links across every definition in the org, newest first', async () => {
                 const scope = await scopeFor();
-                if (!scope.orgId)
-                    return;
                 const store = await createStore();
                 const a = link(scope, { createdAt: '2026-04-01T00:00:00.000Z' });
                 const b = link(scope, {
@@ -154,8 +149,6 @@ export function runShareLinkStoreConformance(opts) {
             });
             it('names the parent definition and project on every row', async () => {
                 const scope = await scopeFor();
-                if (!scope.orgId)
-                    return;
                 const store = await createStore();
                 const l = link(scope);
                 await store.create(ctx(scope.ownerId), l);
@@ -169,8 +162,6 @@ export function runShareLinkStoreConformance(opts) {
             });
             it('never carries tokenHash — the roster spans the whole tenant', async () => {
                 const scope = await scopeFor();
-                if (!scope.orgId)
-                    return;
                 const store = await createStore();
                 await store.create(ctx(scope.ownerId), link(scope));
                 const page = await store.listByOrg(ctx(scope.ownerId), scope.orgId, { limit: 100 });
@@ -181,8 +172,6 @@ export function runShareLinkStoreConformance(opts) {
             });
             it('excludes revoked and expired links', async () => {
                 const scope = await scopeFor();
-                if (!scope.orgId)
-                    return;
                 const store = await createStore();
                 const revoked = link(scope);
                 const expired = link(scope, { expiresAt: new Date(Date.now() - 60_000).toISOString() });
@@ -199,14 +188,23 @@ export function runShareLinkStoreConformance(opts) {
             });
             it('does not leak links into another org', async () => {
                 const scope = await scopeFor();
-                if (!scope.orgId || !scope.otherOrgId)
-                    return;
+                if (!scope.otherOrgId)
+                    throw new Error('orgRoster requires scope.otherOrgId');
                 const store = await createStore();
                 await store.create(ctx(scope.ownerId), link(scope));
                 const page = await store.listByOrg(ctx(scope.ownerId), scope.otherOrgId, { limit: 100 });
                 expect(page.items).toHaveLength(0);
             });
         });
+        it('tryIncrementSolveCount holds the cap under concurrent solves', async () => {
+            const store = await createStore();
+            const scope = await scopeFor();
+            const l = link(scope, { maxSolves: 5 });
+            await store.create(ctx(scope.ownerId), l);
+            const results = await Promise.all(Array.from({ length: 20 }, () => store.tryIncrementSolveCount(SYSTEM_CONTEXT, l.id)));
+            expect(results.filter((n) => n !== null)).toHaveLength(5);
+            expect((await store.getById(ctx(scope.ownerId), l.id))?.solveCount).toBe(5);
+        });
         it('revoke is idempotent (no error on double-revoke)', async () => {
             const store = await createStore();
             const scope = await scopeFor();
@@ -251,4 +249,3 @@ export function runShareLinkStoreConformance(opts) {
         });
     });
 }
-//# sourceMappingURL=shareLinkStoreSuite.js.map

package/dist/testing/suites/solveMetricSinkSuite.d.ts

@@ -41,4 +41,3 @@ export interface SolveMetricSinkConformanceOptions {
     cleanup?: () => Promise<void> | void;
 }
 export declare function runSolveMetricSinkConformance(opts: SolveMetricSinkConformanceOptions): void;
-//# sourceMappingURL=solveMetricSinkSuite.d.ts.map

package/dist/testing/suites/solveMetricSinkSuite.js

@@ -10,9 +10,10 @@
  * a backend failure — the compute route depends on that to keep serving the
  * response after a solve.
  */
+import { makeSystemCtx } from './helpers.js';
 import { describe, it, expect, beforeEach, afterEach } from 'vitest';
 function sysCtx(userId) {
-    return { userId, platformPermissions: [], orgPermissions: [], system: true };
+    return makeSystemCtx(userId);
 }
 function baseMetric(overrides = {}) {
     return {
@@ -95,4 +96,3 @@ export function runSolveMetricSinkConformance(opts) {
         }
     });
 }
-//# sourceMappingURL=solveMetricSinkSuite.js.map

package/dist/testing/suites/storageProviderSuite.d.ts

@@ -12,4 +12,3 @@ export interface StorageProviderConformanceOptions {
     createStorage: () => Promise<IStorageProvider> | IStorageProvider;
 }
 export declare function runStorageProviderConformance(opts: StorageProviderConformanceOptions): void;
-//# sourceMappingURL=storageProviderSuite.d.ts.map

package/dist/testing/suites/storageProviderSuite.js

@@ -24,6 +24,10 @@ function checksum(data) {
 export function runStorageProviderConformance(opts) {
     const { name, createStorage } = opts;
     describe(`IStorageProvider conformance: ${name}`, () => {
+        it('put returns the path it stored at', async () => {
+            const storage = await createStorage();
+            expect(await storage.put('test/plain.txt', bytes('data'), 'text/plain')).toBe('test/plain.txt');
+        });
         it('put + get returns the stored data', async () => {
             const storage = await createStorage();
             const data = bytes('Hello, World!');
@@ -77,6 +81,13 @@ export function runStorageProviderConformance(opts) {
             expect(meta1).toBeNull();
             expect(file2).toBeTruthy();
         });
+        it('deletePrefix refuses a prefix that names the whole store', async () => {
+            const storage = await createStorage();
+            await storage.put('test/file.txt', bytes('keep'));
+            await expect(storage.deletePrefix('')).rejects.toThrow();
+            await expect(storage.deletePrefix('/')).rejects.toThrow();
+            expect(await storage.get('test/file.txt')).toEqual(bytes('keep'));
+        });
         it('deletePrefix with no matches is a no-op', async () => {
             const storage = await createStorage();
             await storage.put('other/file.txt', bytes('data'));
@@ -136,18 +147,13 @@ export function runStorageProviderConformance(opts) {
         // Image transcoding
         // ============================================================================
         //
-        // Every adapter MUST run uploads through the shared `transcodeImageIfNeeded`
-        // helper so cover images, archive thumbnails, etc. land as WebP regardless
-        // of what the user uploaded. Otherwise a provider that skipped this would
-        // produce a pipeline that looks correct until someone uploads a PNG.
+        // Part of the `IStorageProvider.put` contract: images land as WebP at a
+        // rewritten path, whatever the user uploaded.
         it('transcodes png input to webp (path rewritten, magic bytes flipped)', async () => {
             const storage = await createStorage();
             // Minimal 1×1 transparent PNG (68 bytes): 8-byte signature + IHDR + IDAT + IEND.
             // The IDAT is a real zlib stream of one scanline (filter 0 + RGBA 0,0,0,0) with a
-            // correct Adler-32. Don't hand-tweak these bytes — the previous fixture carried a
-            // truncated IDAT that older libpng tolerated and sharp >=0.35 rejects outright
-            // ("vipspng: libpng read error"). Regenerate with zlib.deflateSync if it ever needs
-            // to change.
+            // correct Adler-32. Don't hand-tweak these bytes: regenerate with zlib.deflateSync.
             const pngBytes = Uint8Array.from([
                 0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, 0x00, 0x00, 0x00, 0x0d, 0x49, 0x48, 0x44,
                 0x52, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x08, 0x06, 0x00, 0x00, 0x00, 0x1f,
@@ -155,7 +161,7 @@ export function runStorageProviderConformance(opts) {
                 0x00, 0x02, 0x00, 0x00, 0x05, 0x00, 0x01, 0x7a, 0x5e, 0xab, 0x3f, 0x00, 0x00, 0x00, 0x00,
                 0x49, 0x45, 0x4e, 0x44, 0xae, 0x42, 0x60, 0x82
             ]);
-            await storage.put('covers/tiny.png', pngBytes, 'image/png');
+            expect(await storage.put('covers/tiny.png', pngBytes, 'image/png')).toBe('covers/tiny.webp');
             // Image transcoding rewrites the path to .webp — the original path is empty.
             const atPng = await storage.get('covers/tiny.png');
             expect(atPng).toBeNull();
@@ -185,4 +191,3 @@ export function runStorageProviderConformance(opts) {
         });
     });
 }
-//# sourceMappingURL=storageProviderSuite.js.map

package/dist/testing/suites/userProfileStoreSuite.d.ts

@@ -2,7 +2,7 @@
  * Adapter conformance suite for IUserProfileStore.
  *
  * Tests the user-profile mutations (display name, starred definitions,
- * recent runs) that used to live on IAuthProvider. Adapters must seed
+ * recent runs). Adapters must seed
  * a real user before each test since profile mutations target a userId.
  */
 import type { IUserProfileStore } from '../../userProfile/interface.js';
@@ -21,4 +21,3 @@ export interface UserProfileStoreConformanceOptions {
     }>;
 }
 export declare function runUserProfileStoreConformance(opts: UserProfileStoreConformanceOptions): void;
-//# sourceMappingURL=userProfileStoreSuite.d.ts.map

package/dist/testing/suites/userProfileStoreSuite.js

@@ -2,20 +2,56 @@
  * Adapter conformance suite for IUserProfileStore.
  *
  * Tests the user-profile mutations (display name, starred definitions,
- * recent runs) that used to live on IAuthProvider. Adapters must seed
+ * recent runs). Adapters must seed
  * a real user before each test since profile mutations target a userId.
  */
 import { describe, it, expect } from 'vitest';
 import { SYSTEM_CONTEXT } from '../../context.js';
-import { makeUuid } from './helpers.js';
-// Profile mutations need a ctx scoped to the target user (docs/contributing/permissions.md §9 +
-// the `IUserProfileStore` JSDoc auth-boundary note). The conformance suite
-// uses SYSTEM_CONTEXT throughout so it doesn't need to mint per-user ctxs;
-// the per-user authorization is exercised in adapter-specific tests.
+import { makeCtx, makeUuid } from './helpers.js';
+// SYSTEM_CONTEXT, so most cases don't need a ctx minted per user. The scoping case
+// below builds its own.
 const ctx = SYSTEM_CONTEXT;
 export function runUserProfileStoreConformance(opts) {
     const { name, createStore } = opts;
     describe(`IUserProfileStore conformance: ${name}`, () => {
+        it('a user cannot read or change someone else through a plain ctx', async () => {
+            const { store, seedUser } = await createStore();
+            const victim = await seedUser('victim@example.com');
+            const other = makeCtx(makeUuid(), { platformPermissions: [] });
+            await expect(store.getProfile(other, victim.id)).rejects.toThrow();
+            await expect(store.updateProfile(other, victim.id, { displayName: 'Hacked' })).rejects.toThrow();
+        });
+        it('recordRun keeps one entry per definition, newest first', async () => {
+            const { store, seedUser } = await createStore();
+            const user = await seedUser('dedupe@example.com');
+            const run = (definitionId, timestamp) => ({
+                definitionId,
+                runId: makeUuid(),
+                definitionName: 'D',
+                timestamp
+            });
+            const a = makeUuid();
+            const b = makeUuid();
+            await store.recordRun(ctx, user.id, run(a, '2026-01-01T00:00:00.000Z'));
+            await store.recordRun(ctx, user.id, run(b, '2026-01-02T00:00:00.000Z'));
+            await store.recordRun(ctx, user.id, run(a, '2026-01-03T00:00:00.000Z'));
+            const profile = await store.getProfile(ctx, user.id);
+            expect(profile?.recentRuns.map((r) => r.definitionId)).toEqual([a, b]);
+        });
+        it('recordRun caps the list', async () => {
+            const { store, seedUser } = await createStore();
+            const user = await seedUser('cap@example.com');
+            for (let i = 0; i < 30; i++) {
+                await store.recordRun(ctx, user.id, {
+                    definitionId: makeUuid(),
+                    runId: makeUuid(),
+                    definitionName: 'D',
+                    timestamp: new Date(i).toISOString()
+                });
+            }
+            const profile = await store.getProfile(ctx, user.id);
+            expect(profile?.recentRuns.length).toBeLessThan(30);
+        });
         it('getProfile returns null for unknown user', async () => {
             const { store } = await createStore();
             const profile = await store.getProfile(ctx, makeUuid());
@@ -102,4 +138,3 @@ export function runUserProfileStoreConformance(opts) {
         });
     });
 }
-//# sourceMappingURL=userProfileStoreSuite.js.map

package/dist/userProfile/index.d.ts

@@ -1,4 +1,4 @@
 export type { IUserProfileStore } from './interface.js';
 export type { UserProfile, RecentRun } from './types.js';
-export { emptyProfile } from './types.js';
-//# sourceMappingURL=index.d.ts.map
+export { MAX_RECENT_RUNS, emptyProfile } from './types.js';
+export { assertCanAccessProfile } from '../context.js';

package/dist/userProfile/index.js

@@ -1,2 +1,2 @@
-export { emptyProfile } from './types.js';
-//# sourceMappingURL=index.js.map
+export { MAX_RECENT_RUNS, emptyProfile } from './types.js';
+export { assertCanAccessProfile } from '../context.js';

package/dist/userProfile/interface.d.ts

@@ -6,11 +6,11 @@ import type { RecentRun, UserProfile } from './types.js';
  * providers (Entra, Supabase Auth) don't have to model fields they can't
  * persist.
  *
- * Adapters must scope by `ctx`: a caller cannot read or modify another
- * user's profile via the `userId` argument. SQL adapters delegate to RLS;
- * document-store adapters check `ctx.userId === userId` (or
- * `instance_admin` for admin tooling). Pass `SYSTEM_CONTEXT` for trusted
- * server flows (auto-seed on signup, janitors).
+ * Adapters must scope `getProfile` and the writes by `ctx`: a caller cannot read
+ * or modify another user's profile via the `userId` argument. `getProfiles` is
+ * unscoped by design, because rosters show other people's names, so its callers
+ * decide who may see the list. Pass `SYSTEM_CONTEXT` for trusted server flows
+ * (auto-seed on signup, janitors).
  */
 export interface IUserProfileStore {
     /** Returns null when no profile row exists — treat as `emptyProfile(id)`. */
@@ -30,4 +30,3 @@ export interface IUserProfileStore {
      */
     recordRun(ctx: RequestContext, userId: string, run: RecentRun): Promise<UserManagementResult>;
 }
-//# sourceMappingURL=interface.d.ts.map

package/dist/userProfile/interface.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=interface.js.map

package/dist/userProfile/types.d.ts

@@ -1,3 +1,5 @@
+/** How many entries `recordRun` keeps per user. */
+export declare const MAX_RECENT_RUNS = 20;
 export interface RecentRun {
     definitionId: string;
     runId: string;
@@ -14,4 +16,3 @@ export interface UserProfile {
     recentRuns: RecentRun[];
 }
 export declare function emptyProfile(userId: string): UserProfile;
-//# sourceMappingURL=types.d.ts.map

package/dist/userProfile/types.js

@@ -1,4 +1,5 @@
+/** How many entries `recordRun` keeps per user. */
+export const MAX_RECENT_RUNS = 20;
 export function emptyProfile(userId) {
     return { userId, starredDefinitions: [], recentRuns: [] };
 }
-//# sourceMappingURL=types.js.map

package/dist/utils/audit.d.ts

@@ -8,4 +8,3 @@ export interface AuditSoftDelete extends AuditUpdate {
     deletedAt: string;
 }
 export declare function auditSoftDelete(ctx: RequestContext, fallbackActor: string | null | undefined): AuditSoftDelete;
-//# sourceMappingURL=audit.d.ts.map

package/dist/utils/audit.js

@@ -24,4 +24,3 @@ export function auditSoftDelete(ctx, fallbackActor) {
         updatedBy: ctx.userId || fallbackActor || ''
     };
 }
-//# sourceMappingURL=audit.js.map

package/dist/utils/index.d.ts

@@ -1,3 +1 @@
-export type { AuditUpdate, AuditSoftDelete } from './audit.js';
 export { auditUpdate, auditSoftDelete } from './audit.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/utils/index.js

@@ -1,2 +1 @@
 export { auditUpdate, auditSoftDelete } from './audit.js';
-//# sourceMappingURL=index.js.map

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@selvajs/platform",
-  "version": "0.21.0-beta.3",
-  "description": "Pure TypeScript interfaces for Selva platform providers (auth, definitions, compute)",
+  "version": "1.0.0-beta.5",
+  "description": "Interfaces, access rules and conformance suites for Selva platform providers",
   "license": "MIT",
   "author": "VektorNode",
   "homepage": "https://selva.dev",
@@ -25,6 +25,7 @@
     "node": ">=24.0.0"
   },
   "type": "module",
+  "sideEffects": false,
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "exports": {
@@ -131,8 +132,8 @@
     "!**/*.spec.*"
   ],
   "dependencies": {
-    "zod": "^4.6.5",
-    "@selvajs/schemas": "^5.3.0-beta.0"
+    "zod": "^4.6.7",
+    "@selvajs/schemas": "^5.3.0-beta.1"
   },
   "peerDependencies": {
     "sharp": "^0.34.0 || ^0.35.0",
@@ -147,9 +148,9 @@
     }
   },
   "devDependencies": {
-    "sharp": "^0.35.4",
+    "sharp": "^0.35.5",
     "typescript": "~6.0.3",
-    "vitest": "^5.0.2",
+    "vitest": "^5.0.5",
     "@selvajs/config": "0.0.4"
   },
   "scripts": {