@selvajs/server 0.2.0-beta.1 → 0.2.0-beta.3

package/dist/index.js

@@ -9,10 +9,19 @@
  *
  * The full compute subsurface is also available at `@selvajs/server/compute`,
  * the definitions slice (DefinitionService, schema extraction/validation,
- * render loader) at `@selvajs/server/definitions`, and the provider wiring
- * (registry-driven `createSelvaProviders`) at `@selvajs/server/providers`.
+ * render loader) at `@selvajs/server/definitions`, the provider wiring
+ * (registry-driven `createSelvaProviders`) at `@selvajs/server/providers`,
+ * the HMAC token codec at `@selvajs/server/tokens`, error reporting at
+ * `@selvajs/server/errors`, HTTP hardening helpers at `@selvajs/server/http`,
+ * access-rule input assembly at `@selvajs/server/access`, and deployment/ops
+ * helpers at `@selvajs/server/ops`.
  */
 export * from './compute/index.js';
 export * from './definitions/index.js';
 export * from './providers/index.js';
+export * from './tokens/index.js';
+export * from './errors/index.js';
+export * from './http/index.js';
+export * from './access/index.js';
+export * from './ops/index.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC"}

package/dist/ops/__tests__/semver.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=semver.test.d.ts.map

package/dist/ops/__tests__/semver.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"semver.test.d.ts","sourceRoot":"","sources":["../../../src/ops/__tests__/semver.test.ts"],"names":[],"mappings":""}

package/dist/ops/__tests__/semver.test.js

@@ -0,0 +1,38 @@
+import { describe, it, expect } from 'vitest';
+import { isNewer } from '../semver.js';
+describe('isNewer', () => {
+    it('detects a newer patch / minor / major', () => {
+        expect(isNewer('4.3.2', '4.3.1')).toBe(true);
+        expect(isNewer('4.4.0', '4.3.9')).toBe(true);
+        expect(isNewer('5.0.0', '4.9.9')).toBe(true);
+    });
+    it('returns false for same or older versions', () => {
+        expect(isNewer('4.3.1', '4.3.1')).toBe(false);
+        expect(isNewer('4.3.0', '4.3.1')).toBe(false);
+        expect(isNewer('3.9.9', '4.0.0')).toBe(false);
+    });
+    it('ignores pre-release suffixes on the stable channel (only stable bumps surface)', () => {
+        expect(isNewer('4.3.2-beta.1', '4.3.1')).toBe(true);
+        expect(isNewer('4.3.1-beta.1', '4.3.1')).toBe(false);
+        // Explicit stable channel matches the default.
+        expect(isNewer('4.3.1-beta.1', '4.3.1', 'stable')).toBe(false);
+    });
+    it('orders pre-releases on the beta channel', () => {
+        // Successive betas of the same core.
+        expect(isNewer('4.6.0-beta.2', '4.6.0-beta.1', 'beta')).toBe(true);
+        expect(isNewer('4.6.0-beta.1', '4.6.0-beta.2', 'beta')).toBe(false);
+        // A newer core beta beats an older stable.
+        expect(isNewer('4.6.0-beta.1', '4.5.1', 'beta')).toBe(true);
+        // Stable of a core outranks any beta of the same core (promotion).
+        expect(isNewer('4.6.0', '4.6.0-beta.9', 'beta')).toBe(true);
+        expect(isNewer('4.6.0-beta.9', '4.6.0', 'beta')).toBe(false);
+        // Reverting to an OLDER stable is NOT "newer" — the channel switch, not
+        // isNewer, is what makes it actionable.
+        expect(isNewer('4.5.1', '4.6.0-beta.2', 'beta')).toBe(false);
+    });
+    it('falls back to a string compare when unparseable', () => {
+        expect(isNewer('weird', 'weird')).toBe(false);
+        expect(isNewer('a', 'b')).toBe(true);
+    });
+});
+//# sourceMappingURL=semver.test.js.map

package/dist/ops/__tests__/semver.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"semver.test.js","sourceRoot":"","sources":["../../../src/ops/__tests__/semver.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE;IACxB,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAChD,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QACnD,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gFAAgF,EAAE,GAAG,EAAE;QACzF,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrD,+CAA+C;QAC/C,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QAClD,qCAAqC;QACrC,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnE,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpE,2CAA2C;QAC3C,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5D,mEAAmE;QACnE,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5D,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7D,wEAAwE;QACxE,wCAAwC;QACxC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QAC1D,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/ops/index.d.ts

@@ -0,0 +1,2 @@
+export { parseSemver, isNewer, type ReleaseChannel } from './semver.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/ops/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/ops/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC"}

package/dist/ops/index.js

@@ -0,0 +1,3 @@
+// Deployment/ops helpers — channel-aware semver comparison.
+export { parseSemver, isNewer } from './semver.js';
+//# sourceMappingURL=index.js.map

package/dist/ops/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/ops/index.ts"],"names":[],"mappings":"AAAA,4DAA4D;AAE5D,OAAO,EAAE,WAAW,EAAE,OAAO,EAAuB,MAAM,aAAa,CAAC"}

package/dist/ops/semver.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Channel-aware semver comparison for update checks. Understands exactly the
+ * two-channel model Selva-engine deployments publish under: a stable line
+ * (`x.y.z`, npm `latest`) and a beta line (`x.y.z-beta.N`, npm `beta`).
+ * Deliberately not a general semver implementation — no build metadata, no
+ * arbitrary pre-release identifiers.
+ */
+/** Which published line a deployment tracks. */
+export type ReleaseChannel = 'stable' | 'beta';
+/**
+ * Parse `x.y.z` plus an optional `-beta.N` pre-release counter. The
+ * pre-release number is returned separately so beta-channel comparisons can
+ * order successive betas of the same x.y.z core. Returns null for anything
+ * that doesn't lead with a numeric core.
+ */
+export declare function parseSemver(v: string): {
+    core: [number, number, number];
+    beta: number | null;
+} | null;
+/**
+ * True when `latest` is strictly newer than `current` by semver.
+ *
+ * Stable channel (default): pre-release suffixes are ignored — only stable
+ * core bumps surface.
+ *
+ * Beta channel: pre-releases participate. A higher core wins; on an equal
+ * core, a higher `-beta.N` wins, and a stable (no suffix) outranks any -beta
+ * of the same core (4.6.0 > 4.6.0-beta.9). This lets an update UI show
+ * "beta.1 → beta.2" and "beta → stable promotion of the same line".
+ *
+ * Unparseable versions fall back to inequality: different strings count as
+ * "newer" so a weird published version still surfaces, identical ones don't.
+ */
+export declare function isNewer(latest: string, current: string, channel?: ReleaseChannel): boolean;
+//# sourceMappingURL=semver.d.ts.map

package/dist/ops/semver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"semver.d.ts","sourceRoot":"","sources":["../../src/ops/semver.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,gDAAgD;AAChD,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,MAAM,CAAC;AAE/C;;;;;GAKG;AACH,wBAAgB,WAAW,CAC1B,CAAC,EAAE,MAAM,GACP;IAAE,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,CAOhE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,OAAO,CACtB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,cAAyB,GAChC,OAAO,CAaT"}

package/dist/ops/semver.js

@@ -0,0 +1,55 @@
+/**
+ * Channel-aware semver comparison for update checks. Understands exactly the
+ * two-channel model Selva-engine deployments publish under: a stable line
+ * (`x.y.z`, npm `latest`) and a beta line (`x.y.z-beta.N`, npm `beta`).
+ * Deliberately not a general semver implementation — no build metadata, no
+ * arbitrary pre-release identifiers.
+ */
+/**
+ * Parse `x.y.z` plus an optional `-beta.N` pre-release counter. The
+ * pre-release number is returned separately so beta-channel comparisons can
+ * order successive betas of the same x.y.z core. Returns null for anything
+ * that doesn't lead with a numeric core.
+ */
+export function parseSemver(v) {
+    const m = /^(\d+)\.(\d+)\.(\d+)(?:-beta\.(\d+))?/.exec(v.trim());
+    if (!m)
+        return null;
+    return {
+        core: [Number(m[1]), Number(m[2]), Number(m[3])],
+        beta: m[4] != null ? Number(m[4]) : null
+    };
+}
+/**
+ * True when `latest` is strictly newer than `current` by semver.
+ *
+ * Stable channel (default): pre-release suffixes are ignored — only stable
+ * core bumps surface.
+ *
+ * Beta channel: pre-releases participate. A higher core wins; on an equal
+ * core, a higher `-beta.N` wins, and a stable (no suffix) outranks any -beta
+ * of the same core (4.6.0 > 4.6.0-beta.9). This lets an update UI show
+ * "beta.1 → beta.2" and "beta → stable promotion of the same line".
+ *
+ * Unparseable versions fall back to inequality: different strings count as
+ * "newer" so a weird published version still surfaces, identical ones don't.
+ */
+export function isNewer(latest, current, channel = 'stable') {
+    const a = parseSemver(latest);
+    const b = parseSemver(current);
+    if (!a || !b)
+        return latest !== current;
+    for (let i = 0; i < 3; i++) {
+        if (a.core[i] > b.core[i])
+            return true;
+        if (a.core[i] < b.core[i])
+            return false;
+    }
+    // Equal core. On the stable channel we don't compare pre-release tails.
+    if (channel !== 'beta')
+        return false;
+    // Stable (beta == null) ranks above any pre-release of the same core.
+    const rank = (beta) => (beta == null ? Infinity : beta);
+    return rank(a.beta) > rank(b.beta);
+}
+//# sourceMappingURL=semver.js.map

package/dist/ops/semver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"semver.js","sourceRoot":"","sources":["../../src/ops/semver.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAC1B,CAAS;IAET,MAAM,CAAC,GAAG,uCAAuC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACjE,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,OAAO;QACN,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChD,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI;KACxC,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,OAAO,CACtB,MAAc,EACd,OAAe,EACf,UAA0B,QAAQ;IAElC,MAAM,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAC9B,MAAM,CAAC,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAC/B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,MAAM,KAAK,OAAO,CAAC;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACvC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IACzC,CAAC;IACD,wEAAwE;IACxE,IAAI,OAAO,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACrC,sEAAsE;IACtE,MAAM,IAAI,GAAG,CAAC,IAAmB,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACvE,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACpC,CAAC"}

package/dist/tokens/__tests__/token-codec.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=token-codec.test.d.ts.map

package/dist/tokens/__tests__/token-codec.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-codec.test.d.ts","sourceRoot":"","sources":["../../../src/tokens/__tests__/token-codec.test.ts"],"names":[],"mappings":""}

package/dist/tokens/__tests__/token-codec.test.js

@@ -0,0 +1,50 @@
+import { describe, it, expect } from 'vitest';
+import { createTokenCodec, MIN_TOKEN_SECRET_LENGTH } from '../token-codec.js';
+const SECRET = 'unit-test-secret-that-is-long-enough-to-pass';
+describe('createTokenCodec', () => {
+    it('rejects a secret shorter than the minimum', () => {
+        expect(() => createTokenCodec({ prefix: 'share_', secret: 'short' })).toThrow(/at least 32 characters/);
+        expect(() => createTokenCodec({ prefix: 'share_', secret: 'x'.repeat(MIN_TOKEN_SECRET_LENGTH - 1) })).toThrow(/got 31/);
+    });
+    it('accepts a secret at exactly the minimum length', () => {
+        expect(() => createTokenCodec({ prefix: 'share_', secret: 'x'.repeat(MIN_TOKEN_SECRET_LENGTH) })).not.toThrow();
+    });
+    it('mints prefixed, unique, URL-safe tokens', () => {
+        const codec = createTokenCodec({ prefix: 'share_', secret: SECRET });
+        const a = codec.mintRawToken();
+        const b = codec.mintRawToken();
+        expect(a).toMatch(/^share_[A-Za-z0-9_-]{43}$/); // 32 bytes → 43 base64url chars
+        expect(a).not.toBe(b);
+    });
+    it('hashes deterministically, never echoing the raw token', () => {
+        const codec = createTokenCodec({ prefix: 'share_', secret: SECRET });
+        const raw = codec.mintRawToken();
+        const hash = codec.hashToken(raw);
+        expect(codec.hashToken(raw)).toBe(hash);
+        expect(hash).not.toContain(raw);
+        expect(hash).toMatch(/^[A-Za-z0-9_-]+$/); // base64url
+    });
+    it('produces different hashes under different secrets (rotation invalidates)', () => {
+        const a = createTokenCodec({ prefix: 'share_', secret: SECRET });
+        const b = createTokenCodec({ prefix: 'share_', secret: SECRET + '-rotated' });
+        const raw = a.mintRawToken();
+        expect(a.hashToken(raw)).not.toBe(b.hashToken(raw));
+    });
+    it('hashesEqual: equal, unequal, and length-mismatch inputs', () => {
+        const codec = createTokenCodec({ prefix: 'invite_', secret: SECRET });
+        const hash = codec.hashToken(codec.mintRawToken());
+        const other = codec.hashToken(codec.mintRawToken());
+        expect(codec.hashesEqual(hash, hash)).toBe(true);
+        expect(codec.hashesEqual(hash, other)).toBe(false);
+        expect(codec.hashesEqual(hash, hash.slice(0, -1))).toBe(false);
+    });
+    it('looksLikeToken recognizes only its own prefix', () => {
+        const share = createTokenCodec({ prefix: 'share_', secret: SECRET });
+        const invite = createTokenCodec({ prefix: 'invite_', secret: SECRET });
+        const raw = share.mintRawToken();
+        expect(share.looksLikeToken(raw)).toBe(true);
+        expect(invite.looksLikeToken(raw)).toBe(false);
+        expect(share.looksLikeToken('random-string')).toBe(false);
+    });
+});
+//# sourceMappingURL=token-codec.test.js.map

package/dist/tokens/__tests__/token-codec.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-codec.test.js","sourceRoot":"","sources":["../../../src/tokens/__tests__/token-codec.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAE9E,MAAM,MAAM,GAAG,8CAA8C,CAAC;AAE9D,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACpD,MAAM,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAC5E,wBAAwB,CACxB,CAAC;QACF,MAAM,CAAC,GAAG,EAAE,CACX,gBAAgB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,uBAAuB,GAAG,CAAC,CAAC,EAAE,CAAC,CACvF,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACzD,MAAM,CAAC,GAAG,EAAE,CACX,gBAAgB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,uBAAuB,CAAC,EAAE,CAAC,CACnF,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QAClD,MAAM,KAAK,GAAG,gBAAgB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACrE,MAAM,CAAC,GAAG,KAAK,CAAC,YAAY,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,KAAK,CAAC,YAAY,EAAE,CAAC;QAC/B,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC,CAAC,gCAAgC;QAChF,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAChE,MAAM,KAAK,GAAG,gBAAgB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACrE,MAAM,GAAG,GAAG,KAAK,CAAC,YAAY,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,YAAY;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QACnF,MAAM,CAAC,GAAG,gBAAgB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACjE,MAAM,CAAC,GAAG,gBAAgB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,EAAE,CAAC,CAAC;QAC9E,MAAM,GAAG,GAAG,CAAC,CAAC,YAAY,EAAE,CAAC;QAC7B,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QAClE,MAAM,KAAK,GAAG,gBAAgB,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACtE,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;QACpD,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnD,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACxD,MAAM,KAAK,GAAG,gBAAgB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACrE,MAAM,MAAM,GAAG,gBAAgB,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACvE,MAAM,GAAG,GAAG,KAAK,CAAC,YAAY,EAAE,CAAC;QACjC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/C,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/tokens/index.d.ts

@@ -0,0 +1,2 @@
+export { createTokenCodec, MIN_TOKEN_SECRET_LENGTH, type TokenCodec, type TokenCodecConfig } from './token-codec.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/tokens/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tokens/index.ts"],"names":[],"mappings":"AAEA,OAAO,EACN,gBAAgB,EAChB,uBAAuB,EACvB,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,MAAM,kBAAkB,CAAC"}

package/dist/tokens/index.js

@@ -0,0 +1,3 @@
+// HMAC token codec for capability-URL tokens (share links, invites, …).
+export { createTokenCodec, MIN_TOKEN_SECRET_LENGTH } from './token-codec.js';
+//# sourceMappingURL=index.js.map

package/dist/tokens/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/tokens/index.ts"],"names":[],"mappings":"AAAA,wEAAwE;AAExE,OAAO,EACN,gBAAgB,EAChB,uBAAuB,EAGvB,MAAM,kBAAkB,CAAC"}

package/dist/tokens/token-codec.d.ts

@@ -0,0 +1,54 @@
+/**
+ * HMAC token codec — the primitive behind capability-URL tokens (share links,
+ * invites, and anything shaped like them).
+ *
+ * ## Two-part design
+ *
+ * Each minted token involves TWO secrets:
+ *
+ *   1. **Per-token secret** — generated in `mintRawToken()` from 32 random
+ *      bytes, returned to the caller exactly once at mint time. Different
+ *      every token. This is what end-users carry in `?token=…`.
+ *
+ *   2. **Instance-wide HMAC secret** (`config.secret`) — used to hash tokens
+ *      for storage. The store sees only `HMAC-SHA256(secret, token)`. A
+ *      DB-only leak therefore can't be replayed: the attacker would need the
+ *      secret too, and it lives in env, not the database.
+ *
+ * ## Format
+ *   raw    = `<prefix><base64url(32 random bytes)>`
+ *   hash   = base64url( HMAC-SHA256(secret, raw) )
+ *
+ * The resolution path hashes the supplied token with the same secret and looks
+ * up by exact match against the stored hash.
+ *
+ * Rotating the secret invalidates every token minted under it — give each
+ * token family (each prefix) its own secret so they rotate independently.
+ */
+/**
+ * Minimum accepted secret length. Matches the "random ≥32-byte string"
+ * guidance everywhere these secrets are documented; enforced here so a
+ * short dev secret can't reach production silently (presence-only checks
+ * let a 4-char secret through).
+ */
+export declare const MIN_TOKEN_SECRET_LENGTH = 32;
+export interface TokenCodecConfig {
+    /** Token-family marker prepended to every raw token, e.g. `share_`. */
+    prefix: string;
+    /** Instance-wide HMAC secret. Must be at least 32 characters. */
+    secret: string;
+}
+export interface TokenCodec {
+    /** Mint: generate a fresh raw token. Show to the caller exactly once. */
+    mintRawToken(): string;
+    /** Hash a raw token to its store-side representation. */
+    hashToken(raw: string): string;
+    /** Constant-time equality for two stored hashes. */
+    hashesEqual(a: string, b: string): boolean;
+    /** Recognize this codec's token format on inbound requests. */
+    looksLikeToken(value: string): boolean;
+    /** The configured prefix, for callers that build URLs or error copy. */
+    readonly prefix: string;
+}
+export declare function createTokenCodec(config: TokenCodecConfig): TokenCodec;
+//# sourceMappingURL=token-codec.d.ts.map

package/dist/tokens/token-codec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-codec.d.ts","sourceRoot":"","sources":["../../src/tokens/token-codec.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAE1C,MAAM,WAAW,gBAAgB;IAChC,uEAAuE;IACvE,MAAM,EAAE,MAAM,CAAC;IACf,iEAAiE;IACjE,MAAM,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,UAAU;IAC1B,yEAAyE;IACzE,YAAY,IAAI,MAAM,CAAC;IACvB,yDAAyD;IACzD,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,oDAAoD;IACpD,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAC3C,+DAA+D;IAC/D,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IACvC,wEAAwE;IACxE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACxB;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,UAAU,CA2BrE"}

package/dist/tokens/token-codec.js

@@ -0,0 +1,62 @@
+import { randomBytes, createHmac, timingSafeEqual } from 'node:crypto';
+/**
+ * HMAC token codec — the primitive behind capability-URL tokens (share links,
+ * invites, and anything shaped like them).
+ *
+ * ## Two-part design
+ *
+ * Each minted token involves TWO secrets:
+ *
+ *   1. **Per-token secret** — generated in `mintRawToken()` from 32 random
+ *      bytes, returned to the caller exactly once at mint time. Different
+ *      every token. This is what end-users carry in `?token=…`.
+ *
+ *   2. **Instance-wide HMAC secret** (`config.secret`) — used to hash tokens
+ *      for storage. The store sees only `HMAC-SHA256(secret, token)`. A
+ *      DB-only leak therefore can't be replayed: the attacker would need the
+ *      secret too, and it lives in env, not the database.
+ *
+ * ## Format
+ *   raw    = `<prefix><base64url(32 random bytes)>`
+ *   hash   = base64url( HMAC-SHA256(secret, raw) )
+ *
+ * The resolution path hashes the supplied token with the same secret and looks
+ * up by exact match against the stored hash.
+ *
+ * Rotating the secret invalidates every token minted under it — give each
+ * token family (each prefix) its own secret so they rotate independently.
+ */
+/**
+ * Minimum accepted secret length. Matches the "random ≥32-byte string"
+ * guidance everywhere these secrets are documented; enforced here so a
+ * short dev secret can't reach production silently (presence-only checks
+ * let a 4-char secret through).
+ */
+export const MIN_TOKEN_SECRET_LENGTH = 32;
+export function createTokenCodec(config) {
+    const { prefix, secret } = config;
+    if (secret.length < MIN_TOKEN_SECRET_LENGTH) {
+        throw new Error(`Secret for "${prefix}" tokens must be at least ${MIN_TOKEN_SECRET_LENGTH} characters ` +
+            `(got ${secret.length}). Generate one with: openssl rand -base64 32`);
+    }
+    return {
+        prefix,
+        mintRawToken() {
+            return prefix + randomBytes(32).toString('base64url');
+        },
+        hashToken(raw) {
+            return createHmac('sha256', secret).update(raw).digest('base64url');
+        },
+        hashesEqual(a, b) {
+            const ab = Buffer.from(a);
+            const bb = Buffer.from(b);
+            if (ab.length !== bb.length)
+                return false;
+            return timingSafeEqual(ab, bb);
+        },
+        looksLikeToken(value) {
+            return value.startsWith(prefix);
+        }
+    };
+}
+//# sourceMappingURL=token-codec.js.map

package/dist/tokens/token-codec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-codec.js","sourceRoot":"","sources":["../../src/tokens/token-codec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEvE;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAsB1C,MAAM,UAAU,gBAAgB,CAAC,MAAwB;IACxD,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAClC,IAAI,MAAM,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACd,eAAe,MAAM,6BAA6B,uBAAuB,cAAc;YACtF,QAAQ,MAAM,CAAC,MAAM,+CAA+C,CACrE,CAAC;IACH,CAAC;IAED,OAAO;QACN,MAAM;QACN,YAAY;YACX,OAAO,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACvD,CAAC;QACD,SAAS,CAAC,GAAW;YACpB,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACrE,CAAC;QACD,WAAW,CAAC,CAAS,EAAE,CAAS;YAC/B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC1B,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC;YAC1C,OAAO,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAChC,CAAC;QACD,cAAc,CAAC,KAAa;YAC3B,OAAO,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC;KACD,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@selvajs/server",
-  "version": "0.2.0-beta.1",
+  "version": "0.2.0-beta.3",
   "description": "Transport-agnostic compute/solve/definitions server building blocks for apps built on the Selva engine (limits, rate limiting, SSRF guard, input transform, solve pipeline, definition service + render loader)",
   "license": "MIT",
   "publishConfig": {
@@ -34,6 +34,31 @@
       "source": "./src/providers/index.ts",
       "types": "./dist/providers/index.d.ts",
       "import": "./dist/providers/index.js"
+    },
+    "./tokens": {
+      "source": "./src/tokens/index.ts",
+      "types": "./dist/tokens/index.d.ts",
+      "import": "./dist/tokens/index.js"
+    },
+    "./errors": {
+      "source": "./src/errors/index.ts",
+      "types": "./dist/errors/index.d.ts",
+      "import": "./dist/errors/index.js"
+    },
+    "./http": {
+      "source": "./src/http/index.ts",
+      "types": "./dist/http/index.d.ts",
+      "import": "./dist/http/index.js"
+    },
+    "./access": {
+      "source": "./src/access/index.ts",
+      "types": "./dist/access/index.d.ts",
+      "import": "./dist/access/index.js"
+    },
+    "./ops": {
+      "source": "./src/ops/index.ts",
+      "types": "./dist/ops/index.d.ts",
+      "import": "./dist/ops/index.js"
     }
   },
   "files": [
@@ -41,10 +66,18 @@
     "src"
   ],
   "dependencies": {
-    "@selvajs/compute": "^3.1.0-beta.3",
+    "@selvajs/compute": "^3.1.0-beta.6",
     "@selvajs/platform": "0.14.3-beta.0",
     "@selvajs/schemas": "4.7.0-beta.0"
   },
+  "peerDependencies": {
+    "@sentry/node": ">=8"
+  },
+  "peerDependenciesMeta": {
+    "@sentry/node": {
+      "optional": true
+    }
+  },
   "devDependencies": {
     "@types/node": "^22.19.17",
     "typescript": "^5.9.3",

package/src/access/__tests__/project-access-input.test.ts

@@ -0,0 +1,175 @@
+import { describe, it, expect, vi } from 'vitest';
+import type {
+	Project,
+	ProjectAccessInput,
+	ProjectVisibility,
+	RequestContext
+} from '@selvajs/platform';
+import {
+	createProjectAccessInputBuilder,
+	type ProjectAccessFlags
+} from '../project-access-input.js';
+
+const CTX: RequestContext = {
+	userId: 'user-1',
+	actingOrgId: 'org-1',
+	platformPermissions: ['manage_compute'],
+	orgPermissions: ['manage_org_members']
+} as RequestContext;
+
+function project(visibility: ProjectVisibility): Project {
+	return {
+		id: 'proj-1',
+		orgId: 'org-1',
+		name: 'P',
+		slug: 'p',
+		visibility,
+		ownerId: 'user-9',
+		createdBy: 'user-9',
+		updatedBy: 'user-9',
+		autoJoinOnUpload: false,
+		createdAt: '2026-01-01T00:00:00Z',
+		updatedAt: '2026-01-01T00:00:00Z'
+	};
+}
+
+// Row identity is all the builder consumes — it passes rows through opaquely.
+const MEMBER = {
+	projectId: 'proj-1',
+	userId: 'user-1',
+	role: 'editor'
+} as unknown as NonNullable<ProjectAccessInput['member']>;
+const ORG_MEMBER = {
+	orgId: 'org-1',
+	userId: 'user-1',
+	role: 'member'
+} as unknown as NonNullable<ProjectAccessInput['orgMember']>;
+const GRANT = {
+	projectId: 'proj-1',
+	orgId: 'org-2',
+	canSolve: true
+} as unknown as ProjectAccessInput['platformGrants'][number];
+
+function makeDeps(flags: Partial<ProjectAccessFlags> = {}) {
+	return {
+		getProjectMember: vi.fn().mockResolvedValue(MEMBER),
+		getOrgMember: vi.fn().mockResolvedValue(ORG_MEMBER),
+		listPlatformGrants: vi.fn().mockResolvedValue([GRANT]),
+		flags: vi.fn().mockReturnValue({
+			allowCrossOrgPublic: false,
+			enablePlatformProjects: false,
+			...flags
+		})
+	};
+}
+
+describe('buildProjectAccessInput — per-visibility row fetching', () => {
+	it('private: fetches only the project member row', async () => {
+		const deps = makeDeps();
+		const builder = createProjectAccessInputBuilder(deps);
+		const input = await builder.buildProjectAccessInput(CTX, project('private'));
+
+		expect(input.member).toEqual(MEMBER);
+		expect(input.orgMember).toBeNull();
+		expect(input.platformGrants).toEqual([]);
+		expect(deps.getOrgMember).not.toHaveBeenCalled();
+		expect(deps.listPlatformGrants).not.toHaveBeenCalled();
+	});
+
+	it.each(['org', 'public'] as const)('%s: fetches project member + org member', async (vis) => {
+		const deps = makeDeps();
+		const builder = createProjectAccessInputBuilder(deps);
+		const input = await builder.buildProjectAccessInput(CTX, project(vis));
+
+		expect(input.member).toEqual(MEMBER);
+		expect(input.orgMember).toEqual(ORG_MEMBER);
+		expect(deps.getOrgMember).toHaveBeenCalledWith(CTX, 'org-1', 'user-1');
+	});
+
+	it('public + ALLOW_CROSS_ORG_PUBLIC: skips the org member row', async () => {
+		const deps = makeDeps({ allowCrossOrgPublic: true });
+		const builder = createProjectAccessInputBuilder(deps);
+		const input = await builder.buildProjectAccessInput(CTX, project('public'));
+
+		expect(input.member).toEqual(MEMBER);
+		expect(input.orgMember).toBeNull();
+		expect(deps.getOrgMember).not.toHaveBeenCalled();
+	});
+
+	it('org visibility still fetches the org row when cross-org public is on', async () => {
+		const deps = makeDeps({ allowCrossOrgPublic: true });
+		const builder = createProjectAccessInputBuilder(deps);
+		const input = await builder.buildProjectAccessInput(CTX, project('org'));
+		expect(input.orgMember).toEqual(ORG_MEMBER);
+	});
+
+	it('platform + flag on: fetches grants only', async () => {
+		const deps = makeDeps({ enablePlatformProjects: true });
+		const builder = createProjectAccessInputBuilder(deps);
+		const input = await builder.buildProjectAccessInput(CTX, project('platform'));
+
+		expect(input.platformGrants).toEqual([GRANT]);
+		expect(input.member).toBeNull();
+		expect(deps.getProjectMember).not.toHaveBeenCalled();
+		expect(deps.getOrgMember).not.toHaveBeenCalled();
+	});
+
+	it('platform + flag off: skips the grant lookup entirely (feature disabled stays cheap)', async () => {
+		const deps = makeDeps({ enablePlatformProjects: false });
+		const builder = createProjectAccessInputBuilder(deps);
+		const input = await builder.buildProjectAccessInput(CTX, project('platform'));
+
+		expect(input.platformGrants).toEqual([]);
+		expect(deps.listPlatformGrants).not.toHaveBeenCalled();
+	});
+
+	it('threads ctx fields and flags into the input, with overrides winning', async () => {
+		const deps = makeDeps({ allowCrossOrgPublic: true });
+		const builder = createProjectAccessInputBuilder(deps);
+		const input = await builder.buildProjectAccessInput(CTX, project('private'), {
+			member: null
+		});
+
+		expect(input.userId).toBe('user-1');
+		expect(input.actingOrgId).toBe('org-1');
+		expect(input.orgPermissions).toEqual(CTX.orgPermissions);
+		expect(input.platformPermissions).toEqual(CTX.platformPermissions);
+		expect(input.allowCrossOrgPublic).toBe(true);
+		expect(input.member).toBeNull(); // override beat the fetched row
+	});
+
+	it('reads flags per call, not at builder creation', async () => {
+		const deps = makeDeps();
+		const builder = createProjectAccessInputBuilder(deps);
+		await builder.buildProjectAccessInput(CTX, project('private'));
+		deps.flags.mockReturnValue({ allowCrossOrgPublic: true, enablePlatformProjects: true });
+		const input = await builder.buildProjectAccessInput(CTX, project('private'));
+		expect(input.enablePlatformProjects).toBe(true);
+	});
+});
+
+describe('projectAccessInputFromRows', () => {
+	it('assembles from caller rows with zero I/O', () => {
+		const deps = makeDeps();
+		const builder = createProjectAccessInputBuilder(deps);
+		const input = builder.projectAccessInputFromRows(CTX, project('org'), {
+			member: MEMBER,
+			orgMember: ORG_MEMBER
+		});
+
+		expect(input.member).toEqual(MEMBER);
+		expect(input.orgMember).toEqual(ORG_MEMBER);
+		expect(input.platformGrants).toEqual([]);
+		expect(deps.getProjectMember).not.toHaveBeenCalled();
+		expect(deps.getOrgMember).not.toHaveBeenCalled();
+		expect(deps.listPlatformGrants).not.toHaveBeenCalled();
+	});
+
+	it('defaults omitted rows to null/empty', () => {
+		const builder = createProjectAccessInputBuilder(makeDeps());
+		const input = builder.projectAccessInputFromRows(CTX, project('private'), {});
+		expect(input.member).toBeNull();
+		expect(input.orgMember).toBeNull();
+		expect(input.platformGrants).toEqual([]);
+	});
+});