@selvajs/selva 4.6.21-beta.0 → 4.7.0-beta.2

package/build/server/chunks/chunks/{providers.server.js-D0hpk-aq.js → providers.server.js-CIHOepKv.js}

@@ -1,5 +1,5 @@
 import { b as private_env } from './shared-server.js-DaWdgxVh.js';
-import { c as classifyAssetPath, D as DEFAULT_ORG_PERMISSIONS, S as SYSTEM_CONTEXT, h as hasPermission, P as PlatformPermissionSchema } from './context.js-D8E0GFTw.js';
+import { A as ALL_PLATFORM_PERMISSIONS, c as classifyAssetPath, D as DEFAULT_ORG_PERMISSIONS, S as SYSTEM_CONTEXT, h as hasPermission } from './context.js-DsQGiS2x.js';
 import { pathToFileURL } from 'node:url';
 import * as path from 'node:path';
 import { resolve } from 'node:path';
@@ -155,6 +155,16 @@ function readPositiveInt(env, name, fallback) {
   }
   return Math.floor(parsed);
 }
+function readNonNegativeInt(env, name, fallback) {
+  const raw = env[name];
+  if (!raw) return fallback;
+  const parsed = Number(raw);
+  if (!Number.isFinite(parsed) || parsed < 0) {
+    console.warn(`[selva] Invalid ${name}=${raw}, falling back to ${fallback}`);
+    return fallback;
+  }
+  return Math.floor(parsed);
+}
 function readBool(env, name, fallback) {
   const raw = env[name];
   if (raw == null || raw === "") return fallback;
@@ -184,7 +194,24 @@ function resolveComputeLimits(env) {
     definitionCacheTtlMs: readPositiveInt(env, "DEFINITION_CACHE_TTL_MS", 5 * 60 * 1e3),
     computeReuseDefinitionCache: readBool(env, "COMPUTE_REUSE_DEFINITION_CACHE", true),
     computeServerCachesolve: readBool(env, "COMPUTE_SERVER_CACHESOLVE", true),
-    computeCacheErroredSolves: readBool(env, "COMPUTE_CACHE_ERRORED_SOLVES", false)
+    computeCacheErroredSolves: readBool(env, "COMPUTE_CACHE_ERRORED_SOLVES", false),
+    // 4 matches rhino.compute's default --childcount; tune to the actual VM.
+    computeMaxConcurrentSolves: readPositiveInt(env, "COMPUTE_MAX_CONCURRENT", 4),
+    // Both 0 (unbounded / no deadline) by default — nothing sheds until an
+    // operator who's measured their pool opts in. readNonNegativeInt so `0` is a
+    // valid "disabled" value, not treated as invalid.
+    computeMaxQueueDepth: readNonNegativeInt(env, "COMPUTE_MAX_QUEUE_DEPTH", 0),
+    computeQueueWaitMs: readNonNegativeInt(env, "COMPUTE_QUEUE_WAIT_MS", 0),
+    // Env is MB; 0 disables. Default 256 MB holds a handful of typical
+    // definitions warm without pinning gigabytes. readNonNegativeInt so `0`
+    // (disable) is honored rather than treated as invalid.
+    computeDefinitionByteCacheBytes: readNonNegativeInt(env, "COMPUTE_DEFINITION_BYTE_CACHE_MB", 256) * MB,
+    // L2 durable solve cache (H1). Default per-definition quota 0 = inherit-to-off
+    // until an operator opts in; the memory backend also only mounts under
+    // SOLVE_CACHE_PROVIDER=memory, so nothing caches by accident. Byte backstop
+    // 512 MB caps total heap use across all definitions (env is MB).
+    solveCacheDefaultMaxEntries: readNonNegativeInt(env, "SOLVE_CACHE_DEFAULT_MAX_ENTRIES", 0),
+    solveCacheMaxTotalBytes: readNonNegativeInt(env, "SOLVE_CACHE_MAX_TOTAL_MB", 512) * MB
   };
 }
 const FLAG_KEYS = [
@@ -463,6 +490,7 @@ function applyOrder(items, opts, keyFn = (item, field) => item[field]) {
   return items;
 }
 const SESSION_MAX_AGE_MS = 8 * 60 * 60 * 1e3;
+const MIN_HMAC_SECRET_LENGTH = 32;
 function toAuthUser$1(u) {
   return {
     id: u.id,
@@ -534,6 +562,11 @@ class LocalAuthProvider {
   static fromEnv(env) {
     const hmacSecret = env.SELVA_HMAC_KEY;
     if (!hmacSecret) throw new Error("Missing required env var: SELVA_HMAC_KEY");
+    if (hmacSecret.length < MIN_HMAC_SECRET_LENGTH) {
+      throw new Error(
+        `SELVA_HMAC_KEY must be at least ${MIN_HMAC_SECRET_LENGTH} characters (got ${hmacSecret.length}). Generate one with: openssl rand -base64 32`
+      );
+    }
     return new LocalAuthProvider({
       hmacSecret,
       usersFilePath: env.DATA_PATH ? path.join(env.DATA_PATH, "auth-users.json") : void 0
@@ -1556,6 +1589,9 @@ class LocalDefinitionStore {
       ...patch.computeServerId !== void 0 && {
         computeServerId: clearable(patch.computeServerId)
       },
+      ...patch.solveCacheLimit !== void 0 && {
+        solveCacheLimit: clearable(patch.solveCacheLimit)
+      },
       ...patch.status !== void 0 && { status: patch.status },
       ...patch.ownerId !== void 0 && { ownerId: patch.ownerId },
       ...auditUpdate(ctx, existing.updatedBy ?? existing.ownerId)
@@ -1601,6 +1637,28 @@ class LocalDefinitionStore {
     existing.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
     await this.writeConfig(config);
   }
+  async reserveNextVersionNumber(_ctx, guid) {
+    const config = await this.readConfig();
+    const existing = config.definitions[guid];
+    if (!this.live(existing)) throw new ProviderError(`Definition '${guid}' not found`, 404);
+    const current = existing.nextVersionNumber ?? this.highestVersionNumber(config, guid) + 1;
+    existing.nextVersionNumber = current + 1;
+    existing.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+    await this.writeConfig(config);
+    return current;
+  }
+  /**
+   * Highest `versionNumber` currently on disk for a definition (0 if none). Only
+   * used as the seed when a legacy record predates `nextVersionNumber`; new
+   * records carry the counter and never take this path.
+   */
+  highestVersionNumber(config, definitionId) {
+    let max = 0;
+    for (const v of Object.values(config.definitionVersions)) {
+      if (v.definitionId === definitionId && v.versionNumber > max) max = v.versionNumber;
+    }
+    return max;
+  }
   // ============================================================================
   // Versions (spec §6)
   // ============================================================================
@@ -2052,8 +2110,11 @@ class LocalDataProvider {
   userProfile;
   permissions;
   platformProjectGrants;
+  /** The sink the stores emit into (Noop unless injected) — per `IDataProvider.events`. */
+  events;
   userData;
   constructor(stores, userData) {
+    this.events = stores.events;
     this.orgs = stores.orgs;
     this.projects = stores.projects;
     this.definitions = stores.definitions;
@@ -2133,7 +2194,8 @@ class LocalDataProvider {
         shareLinks,
         userProfile: new LocalUserProfileProvider(userData),
         permissions: new LocalPlatformPermissionStore(userData),
-        platformProjectGrants
+        platformProjectGrants,
+        events
       },
       userData
     );
@@ -2253,6 +2315,9 @@ class SupabaseStorageProvider {
     const bucket = this.bucketFor(transcoded.path);
     const { error } = await this.client.storage.from(bucket).upload(transcoded.path, transcoded.data, {
       contentType: transcoded.contentType,
+      // Objects are content-addressed (GUID/hash prefixes) and effectively
+      // immutable, so let CDN/browser cache them for a year.
+      cacheControl: "31536000",
       upsert: true
     });
     if (error) throw error;
@@ -2807,7 +2872,7 @@ function projectMemberToRow(m) {
     joined_at: m.joinedAt
   };
 }
-const DEFINITION_COLUMNS = "guid, project_id, owner_id, created_by, updated_by, compute_server_id, display_name, description, category, tags, cover_image, status, run_count, live_version_id, draft_version_id, created_at, updated_at, deleted_at";
+const DEFINITION_COLUMNS = "guid, project_id, owner_id, created_by, updated_by, compute_server_id, solve_cache_limit, display_name, description, category, tags, cover_image, status, run_count, next_version_number, live_version_id, draft_version_id, created_at, updated_at, deleted_at";
 const DEFINITION_VERSION_COLUMNS = "id, definition_guid, version_number, file_ext, file_key, original_filename, uploaded_by, uploaded_at, change_note, schema, schema_extracted_at";
 class SupabaseDefinitionStore {
   constructor(clients, events = new NoopEventSink()) {
@@ -2901,6 +2966,14 @@ class SupabaseDefinitionStore {
     const { error } = await this.clients.forRequest(ctx).rpc("increment_run_count", { g: guid });
     if (error) throw mapPostgrestError(error);
   }
+  async reserveNextVersionNumber(ctx, guid) {
+    const { data, error } = await this.clients.forRequest(ctx).rpc("reserve_next_version_number", { g: guid });
+    if (error) throw mapPostgrestError(error);
+    if (typeof data !== "number") {
+      throw new ProviderError(`Definition '${guid}' not found`, 404);
+    }
+    return data;
+  }
   // ============================================================================
   // Versions (spec §6)
   // ============================================================================
@@ -2995,6 +3068,7 @@ function rowToRecord(row) {
     liveVersionId: row.live_version_id,
     draftVersionId: row.draft_version_id,
     computeServerId: row.compute_server_id ?? void 0,
+    solveCacheLimit: row.solve_cache_limit == null ? void 0 : typeof row.solve_cache_limit === "string" ? Number(row.solve_cache_limit) : row.solve_cache_limit,
     displayName: row.display_name,
     description: row.description ?? void 0,
     category: row.category ?? void 0,
@@ -3002,6 +3076,7 @@ function rowToRecord(row) {
     coverImage: row.cover_image ?? void 0,
     status: row.status,
     solveCount: typeof row.run_count === "string" ? Number(row.run_count) : row.run_count,
+    nextVersionNumber: typeof row.next_version_number === "string" ? Number(row.next_version_number) : row.next_version_number,
     createdAt: row.created_at,
     updatedAt: row.updated_at,
     deletedAt: row.deleted_at ?? null
@@ -3017,12 +3092,14 @@ function recordToRow(r) {
     live_version_id: r.liveVersionId,
     draft_version_id: r.draftVersionId,
     compute_server_id: r.computeServerId ?? null,
+    solve_cache_limit: r.solveCacheLimit ?? null,
     display_name: r.displayName,
     description: r.description ?? null,
     category: r.category ?? null,
     cover_image: r.coverImage ?? null,
     status: r.status,
     run_count: r.solveCount,
+    next_version_number: r.nextVersionNumber,
     created_at: r.createdAt,
     updated_at: r.updatedAt,
     deleted_at: r.deletedAt ?? null
@@ -3039,6 +3116,7 @@ function patchToRow(patch) {
   if (patch.coverImage !== void 0) row.cover_image = patch.coverImage;
   if (patch.projectId !== void 0) row.project_id = patch.projectId;
   if (patch.computeServerId !== void 0) row.compute_server_id = patch.computeServerId;
+  if (patch.solveCacheLimit !== void 0) row.solve_cache_limit = patch.solveCacheLimit;
   if (patch.status !== void 0) row.status = patch.status;
   if (patch.ownerId !== void 0) row.owner_id = patch.ownerId;
   return row;
@@ -3504,6 +3582,7 @@ function linkToRow(l) {
     solve_count: l.solveCount
   };
 }
+const EXPECTED_MIGRATION_HEAD = "20260713140000";
 const DEFAULT_SCHEMA = "selva";
 function buildClientBundle(opts) {
   const serviceBySchema = /* @__PURE__ */ new Map();
@@ -3804,34 +3883,22 @@ class SupabasePlatformPermissionStore {
     return "ok";
   }
   async hasInstanceAdmin(_ctx) {
-    const { data, error } = await this.client().from("user_profiles").select("user_id").contains("platform_permissions", ["instance_admin"]);
+    const { count, error } = await this.client().from("user_profiles").select("user_id", { count: "exact", head: true }).contains("platform_permissions", ["instance_admin"]).eq("disabled", false);
     if (error) throw mapError(error);
-    const candidates = (data ?? []).map((r) => r.user_id);
-    if (candidates.length === 0) return false;
-    for (const id of candidates) {
-      const { data: authData } = await this.clients.serviceClient.auth.admin.getUserById(id);
-      if (authData.user && authData.user.user_metadata?.disabled !== true) return true;
-    }
-    return false;
+    return (count ?? 0) > 0;
   }
   async countInstanceAdminsExcluding(_ctx, excludeUserId) {
     return this.countOtherEnabledAdmins(excludeUserId);
   }
   async countOtherEnabledAdmins(excludeUserId) {
-    const { data, error } = await this.client().from("user_profiles").select("user_id").contains("platform_permissions", ["instance_admin"]).neq("user_id", excludeUserId);
+    const { count, error } = await this.client().from("user_profiles").select("user_id", { count: "exact", head: true }).contains("platform_permissions", ["instance_admin"]).eq("disabled", false).neq("user_id", excludeUserId);
     if (error) throw mapError(error);
-    const candidates = (data ?? []).map((r) => r.user_id);
-    if (candidates.length === 0) return 0;
-    let count = 0;
-    for (const id of candidates) {
-      const { data: authData } = await this.clients.serviceClient.auth.admin.getUserById(id);
-      if (authData.user && authData.user.user_metadata?.disabled !== true) count += 1;
-    }
-    return count;
+    return count ?? 0;
   }
 }
+const VALID_PERMISSIONS = new Set(ALL_PLATFORM_PERMISSIONS);
 function filterValid(raw) {
-  return raw.filter((p) => PlatformPermissionSchema.safeParse(p).success);
+  return raw.filter((p) => VALID_PERMISSIONS.has(p));
 }
 function assertCanRead(ctx, userId) {
   if (ctx.system) return;
@@ -3874,6 +3941,7 @@ const notImplementedGrantStore = {
 class SupabaseDataProvider {
   constructor(clients, events, secretKey) {
     this.clients = clients;
+    this.events = events;
     this.solveMetrics = new SupabaseSolveMetricSink(clients);
     this.orgs = new SupabaseOrgStore(clients, events);
     this.projects = new SupabaseProjectStore(clients, events);
@@ -3897,6 +3965,8 @@ class SupabaseDataProvider {
   permissions;
   platformProjectGrants;
   auditQuery;
+  /** The sink every store emits into — exposed per `IDataProvider.events`. */
+  events;
   /**
    * Per-solve timing sink, built from the same client bundle. Exposed so the
    * app's provider wiring can hand it to `SelvaConfig.solveMetrics` without
@@ -3934,6 +4004,53 @@ class SupabaseDataProvider {
   getClientBundle() {
     return this.clients;
   }
+  /**
+   * App↔DB schema handshake (audit O3). Calls `selva.migration_head()` — a
+   * SECURITY DEFINER function shipped in this package's migrations — and
+   * compares it against the head this build expects. Three failure shapes:
+   * the RPC itself is missing (database never applied the handshake
+   * migration), the head is empty (no migrations pushed at all), or the head
+   * is lexicographically behind (operator updated the app but forgot
+   * `supabase db push`). Never throws; boot health consumes the report.
+   */
+  async verifySchemaVersion() {
+    const expected = EXPECTED_MIGRATION_HEAD;
+    const pushHint = "Apply the pending Supabase migrations: sync them into your project (see @selvajs/supabase-provider sync-migrations) and run `npx supabase db push`.";
+    try {
+      const { data, error } = await this.clients.serviceClient.rpc("migration_head");
+      if (error) {
+        return {
+          ok: false,
+          expected,
+          actual: null,
+          message: `selva.migration_head() is not available (${error.message ?? error.code ?? "unknown error"}) — the database schema is behind this app version. ${pushHint}`
+        };
+      }
+      const actual = typeof data === "string" ? data : "";
+      if (!actual) {
+        return {
+          ok: false,
+          expected,
+          actual: "",
+          message: `The database reports no applied migrations. ${pushHint}`
+        };
+      }
+      const ok = actual >= expected;
+      return {
+        ok,
+        expected,
+        actual,
+        message: ok ? void 0 : `Database migration head ${actual} is behind the app's expected ${expected}. ${pushHint}`
+      };
+    } catch (err) {
+      return {
+        ok: false,
+        expected,
+        actual: null,
+        message: `Schema handshake failed: ${err instanceof Error ? err.message : String(err)}`
+      };
+    }
+  }
   /**
    * No-op: `public.user_profiles` is auto-seeded by the `handle_new_auth_user`
    * trigger on every `auth.users` insert (see `0001_initial.sql`). The data
@@ -4161,13 +4278,8 @@ class SupabaseAuthProvider {
     return "ok";
   }
   async touchLastLogin(id) {
-    const { data, error } = await this.admin.from("user_profiles").select("last_login_at").eq("user_id", id).maybeSingle();
-    if (error) return;
-    if (data?.last_login_at) {
-      const prev = Date.parse(data.last_login_at);
-      if (Number.isFinite(prev) && Date.now() - prev < 6e4) return;
-    }
-    await this.admin.from("user_profiles").update({ last_login_at: (/* @__PURE__ */ new Date()).toISOString() }).eq("user_id", id);
+    const cutoff = new Date(Date.now() - 6e4).toISOString();
+    await this.admin.from("user_profiles").update({ last_login_at: (/* @__PURE__ */ new Date()).toISOString() }).eq("user_id", id).or(`last_login_at.is.null,last_login_at.lt.${cutoff}`);
   }
   // OAuth lives on `this.oauth` (typed `IOAuthAuth`); see `SupabaseOAuthAuth`
   // below. Mirrors the `passwordAuth` capability split.
@@ -4667,6 +4779,8 @@ class DefinitionService {
       computeServerId: input.computeServerId,
       status: "pending",
       solveCount: 0,
+      // v1 is created below with versionNumber 1, so the next upload reserves 2.
+      nextVersionNumber: 2,
       liveVersionId: null,
       draftVersionId: null,
       createdAt: now,
@@ -4704,8 +4818,7 @@ class DefinitionService {
   async uploadVersion(ctx, guid, file, ext, originalName, schema, changeNote) {
     const existing = await this.data.definitions.get(ctx, guid);
     if (!existing) throw new ProviderError(`Definition not found: ${guid}`, 404);
-    const versions = await this.data.definitions.listVersions(ctx, guid, { limit: 1 });
-    const next = (versions.items[0]?.versionNumber ?? 0) + 1;
+    const next = await this.data.definitions.reserveNextVersionNumber(ctx, guid);
     const versionId = randomUUID();
     const fileKey = definitionPaths.version(guid, next, ext);
     await this.storage.put(fileKey, file, "application/octet-stream");
@@ -4840,7 +4953,7 @@ class SentryErrorReporter {
       return new SentryErrorReporter(sentry);
     } catch (err) {
       console.error(
-        "[ErrorReporter] SENTRY_DSN is set but @sentry/node could not be loaded. Install it (`pnpm add @sentry/node`) or unset SENTRY_DSN. Falling back to no-op.",
+        "[ErrorReporter] A Sentry DSN is set but @sentry/node could not be loaded. Install it (`pnpm add @sentry/node`) or unset the DSN. Falling back to no-op.",
         err
       );
       return null;
@@ -4952,6 +5065,11 @@ function getSolveMetricSink() {
 function getAuditQuery() {
   return providers.data.auditQuery ?? null;
 }
+const noopEventSink = new NoopEventSink();
+function getEventSink() {
+  const p = resolveProviders();
+  return p.events ?? p.data.events ?? noopEventSink;
+}
 let _errorReporter = new NoopErrorReporter();
 function getErrorReporter() {
   return _errorReporter;
@@ -4981,5 +5099,5 @@ if (!globalThis[ERROR_HOOKS_FLAG]) {
   });
 }
 
-export { LocalComputeServerStore as L, MAX_PAGE_LIMIT as M, ProviderError as P, getPermissionStore as a, getTenancy as b, getDataProvider as c, getOrganizationProvider as d, getProjectProvider as e, getErrorReporter as f, getAuthProvider as g, flag as h, getBranding as i, isPlatformServer as j, getComputeServerConfigStore as k, getDefinitionMeta as l, getPlatformProjectGrantStore as m, getAuditQuery as n, getInviteStore as o, providers as p, getUserProfileStore as q, resolveComputeLimits as r, getStorageProvider as s, isOrgServer as t, getOrgAssetService as u, getSolveMetricSink as v, getDefinitionService as w, definitionPaths as x };
-//# sourceMappingURL=providers.server.js-D0hpk-aq.js.map
+export { LocalComputeServerStore as L, MAX_PAGE_LIMIT as M, ProviderError as P, getPermissionStore as a, getTenancy as b, getDataProvider as c, getOrganizationProvider as d, getProjectProvider as e, getErrorReporter as f, getAuthProvider as g, getEventSink as h, flag as i, getBranding as j, isPlatformServer as k, getComputeServerConfigStore as l, getDefinitionMeta as m, getPlatformProjectGrantStore as n, getAuditQuery as o, providers as p, getInviteStore as q, getUserProfileStore as r, resolveComputeLimits as s, getStorageProvider as t, isOrgServer as u, getOrgAssetService as v, actorFrom as w, getSolveMetricSink as x, getDefinitionService as y, definitionPaths as z };
+//# sourceMappingURL=providers.server.js-CIHOepKv.js.map