@selvajs/server 1.1.0 → 1.3.0

package/dist/notifications/smtp-provider.js

@@ -0,0 +1,71 @@
+import { NoopLogger } from '@selvajs/platform';
+import { readSmtpConfig } from './smtp-config.js';
+/**
+ * SMTP transport. Any server works — a transactional provider, an internal
+ * relay, or a mailbox with an app password.
+ *
+ * Settings are read per send rather than cached, so a restart is the only
+ * thing needed to reconfigure and a rotated password takes effect without
+ * anyone remembering there is a cache.
+ */
+export class SmtpNotificationProvider {
+    env;
+    name = 'SMTP';
+    constructor(env) {
+        this.env = env;
+    }
+    async send(message, log = new NoopLogger()) {
+        let config;
+        try {
+            config = readSmtpConfig(this.env);
+        }
+        catch (err) {
+            log.error('SMTP is misconfigured', {
+                component: 'SmtpNotificationProvider',
+                error: err instanceof Error ? err.message : String(err)
+            });
+            return { status: 'failed', reason: 'misconfigured' };
+        }
+        if (!config)
+            return { status: 'not-configured' };
+        try {
+            // Lazy: an instance with no SMTP_HOST never pays to load nodemailer.
+            const { createTransport } = await import('nodemailer');
+            const transport = createTransport({
+                host: config.host,
+                port: config.port,
+                secure: config.secure,
+                auth: config.auth
+            });
+            await transport.sendMail({
+                from: config.from,
+                to: message.to,
+                subject: message.subject,
+                text: message.text,
+                html: message.html
+            });
+            return { status: 'sent' };
+        }
+        catch (err) {
+            const reason = err instanceof Error ? err.message : String(err);
+            // Recipient is personal data — logged at warn only, as the minimum
+            // needed to diagnose a bounce. Never the subject or body.
+            log.warn('Failed to send mail', {
+                component: 'SmtpNotificationProvider',
+                to: message.to,
+                kind: message.kind,
+                reason
+            });
+            return { status: 'failed', reason };
+        }
+    }
+    isConfigured() {
+        try {
+            return readSmtpConfig(this.env) !== null;
+        }
+        catch {
+            return false;
+        }
+    }
+}
+//# sourceMappingURL=smtp-provider.js.map

package/dist/notifications/smtp-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"smtp-provider.js","sourceRoot":"","sources":["../../src/notifications/smtp-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,UAAU,EAKV,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,cAAc,EAAgB,MAAM,kBAAkB,CAAC;AAEhE;;;;;;;GAOG;AACH,MAAM,OAAO,wBAAwB;IAGP;IAFpB,IAAI,GAAG,MAAM,CAAC;IAEvB,YAA6B,GAAY;QAAZ,QAAG,GAAH,GAAG,CAAS;IAAG,CAAC;IAE7C,KAAK,CAAC,IAAI,CAAC,OAAwB,EAAE,MAAe,IAAI,UAAU,EAAE;QACnE,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACJ,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,GAAG,CAAC,KAAK,CAAC,uBAAuB,EAAE;gBAClC,SAAS,EAAE,0BAA0B;gBACrC,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACvD,CAAC,CAAC;YACH,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QACtD,CAAC;QACD,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QAEjD,IAAI,CAAC;YACJ,qEAAqE;YACrE,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;YACvD,MAAM,SAAS,GAAG,eAAe,CAAC;gBACjC,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,IAAI,EAAE,MAAM,CAAC,IAAI;aACjB,CAAC,CAAC;YAEH,MAAM,SAAS,CAAC,QAAQ,CAAC;gBACxB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,IAAI,EAAE,OAAO,CAAC,IAAI;aAClB,CAAC,CAAC;YACH,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAChE,mEAAmE;YACnE,0DAA0D;YAC1D,GAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE;gBAC/B,SAAS,EAAE,0BAA0B;gBACrC,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM;aACN,CAAC,CAAC;YACH,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QACrC,CAAC;IACF,CAAC;IAED,YAAY;QACX,IAAI,CAAC;YACJ,OAAO,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,KAAK,CAAC;QACd,CAAC;IACF,CAAC;CACD"}

package/dist/ops/deploymentConfig.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Reverse-proxy and body-limit configuration rules, evaluated against a plain
+ * env bag. Pure predicates — no filesystem, no network, no process.
+ *
+ * These settings are read by adapter-node, not by Selva, so getting them wrong
+ * is invisible: nothing throws, nothing logs, and the deployment serves traffic
+ * while a whole class of requests fails. `selva doctor` reports them on the
+ * host; the admin health panel runs the same rules so an operator who never
+ * opens a shell still sees them.
+ *
+ * `packages/cli/src/checks/config.js` carries a duplicate of every rule here.
+ * Duplicated because the CLI is dependency-free by design — it scaffolds the
+ * deployment that installs this runtime, so it cannot import from it. A shared
+ * fixture table (`ops/__tests__/deployment-config-fixtures.js`) is asserted by
+ * both test suites, so a rule changed on one side fails CI on the other.
+ */
+/** Neutral severity. Callers map it onto their own presentation. */
+export type ConfigVerdict = 'ok' | 'warn' | 'fail';
+export interface ConfigFinding {
+    id: string;
+    label: string;
+    verdict: ConfigVerdict;
+    summary: string;
+    /** Concrete next step. Absent when the verdict is `ok`. */
+    remediation?: string;
+}
+/** Just the vars these rules read. Values are raw strings, as they come from `.env`. */
+export interface DeploymentEnv {
+    ORIGIN?: string;
+    ADDRESS_HEADER?: string;
+    XFF_DEPTH?: string;
+    BODY_SIZE_LIMIT?: string;
+    COMPUTE_REQUEST_MAX_BYTES?: string;
+    [key: string]: string | undefined;
+}
+/**
+ * Parse a `BODY_SIZE_LIMIT` the way adapter-node does, so this agrees with the
+ * thing that actually rejects the request.
+ *
+ * The quirk is load-bearing: adapter-node reads only the LAST character as the
+ * suffix, so `60mb` parses as the digits `60m` and happens to mean 60 MB, while
+ * `60xy` silently becomes NaN. Returns bytes, or null when the value is one
+ * adapter-node can't use.
+ */
+export declare function parseBodySizeLimit(raw: string | undefined | null): number | null;
+/**
+ * BODY_SIZE_LIMIT has to clear the compute request cap, or adapter-node's global
+ * backstop rejects the upload first — with a non-JSON body the app never sees
+ * and cannot log. Unset is the dangerous case, not a neutral one: adapter-node
+ * falls back to 512 KB, so every upload 413s on a deployment that looks fine.
+ */
+export declare function checkBodySizeLimit(env: DeploymentEnv): ConfigFinding;
+/**
+ * `ADDRESS_HEADER` / `XFF_DEPTH` are read by adapter-node, not by Selva, and
+ * unset they are invisible: nothing fails, nothing logs, and the deployment
+ * looks healthy.
+ *
+ * What actually happens is that `getClientAddress()` returns the socket peer,
+ * which behind a reverse proxy is the proxy — `127.0.0.1` for every request
+ * from every user. Login rate limiting keys on that, so the whole instance
+ * shares one bucket: five failed logins from anywhere return 429 to everyone,
+ * and only a *successful* login clears a bucket, which nobody can then reach.
+ *
+ * `ORIGIN` is the proxy tell. It is only needed when the app is served under a
+ * public URL it can't derive from its own socket, so its presence means a proxy
+ * is terminating requests. Without it we say nothing: on a directly-reachable
+ * app these settings are a footgun, since `X-Forwarded-For` is client-supplied
+ * and anyone could then pick their own rate-limit bucket.
+ */
+export declare function checkClientAddress(env: DeploymentEnv): ConfigFinding;
+/** Every deployment-config rule, in report order. */
+export declare function checkDeploymentConfig(env: DeploymentEnv): ConfigFinding[];
+//# sourceMappingURL=deploymentConfig.d.ts.map

package/dist/ops/deploymentConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploymentConfig.d.ts","sourceRoot":"","sources":["../../src/ops/deploymentConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,oEAAoE;AACpE,MAAM,MAAM,aAAa,GAAG,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;AAEnD,MAAM,WAAW,aAAa;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,aAAa,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wFAAwF;AACxF,MAAM,WAAW,aAAa;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,yBAAyB,CAAC,EAAE,MAAM,CAAC;IAKnC,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;CAClC;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAUhF;AAOD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,aAAa,GAAG,aAAa,CA0CpE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,aAAa,GAAG,aAAa,CAwDpE;AAED,qDAAqD;AACrD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,aAAa,GAAG,aAAa,EAAE,CAEzE"}

package/dist/ops/deploymentConfig.js

@@ -0,0 +1,154 @@
+/**
+ * Reverse-proxy and body-limit configuration rules, evaluated against a plain
+ * env bag. Pure predicates — no filesystem, no network, no process.
+ *
+ * These settings are read by adapter-node, not by Selva, so getting them wrong
+ * is invisible: nothing throws, nothing logs, and the deployment serves traffic
+ * while a whole class of requests fails. `selva doctor` reports them on the
+ * host; the admin health panel runs the same rules so an operator who never
+ * opens a shell still sees them.
+ *
+ * `packages/cli/src/checks/config.js` carries a duplicate of every rule here.
+ * Duplicated because the CLI is dependency-free by design — it scaffolds the
+ * deployment that installs this runtime, so it cannot import from it. A shared
+ * fixture table (`ops/__tests__/deployment-config-fixtures.js`) is asserted by
+ * both test suites, so a rule changed on one side fails CI on the other.
+ */
+/**
+ * Parse a `BODY_SIZE_LIMIT` the way adapter-node does, so this agrees with the
+ * thing that actually rejects the request.
+ *
+ * The quirk is load-bearing: adapter-node reads only the LAST character as the
+ * suffix, so `60mb` parses as the digits `60m` and happens to mean 60 MB, while
+ * `60xy` silently becomes NaN. Returns bytes, or null when the value is one
+ * adapter-node can't use.
+ */
+export function parseBodySizeLimit(raw) {
+    if (raw == null || raw === '')
+        return null;
+    const value = String(raw).trim();
+    if (value === '')
+        return null;
+    const units = { K: 1024, M: 1024 * 1024, G: 1024 * 1024 * 1024 };
+    const multiplier = units[value.at(-1).toUpperCase()] ?? 1;
+    const bytes = Number(multiplier !== 1 ? value.slice(0, -1) : value) * multiplier;
+    if (!Number.isFinite(bytes) || bytes <= 0)
+        return null;
+    return bytes;
+}
+/** The app's own default for COMPUTE_REQUEST_MAX_BYTES (compute/limits.ts). */
+const COMPUTE_REQUEST_DEFAULT_BYTES = 256 * 1024 * 1024;
+const asMb = (bytes) => `${Math.round(bytes / (1024 * 1024))} MB`;
+/**
+ * BODY_SIZE_LIMIT has to clear the compute request cap, or adapter-node's global
+ * backstop rejects the upload first — with a non-JSON body the app never sees
+ * and cannot log. Unset is the dangerous case, not a neutral one: adapter-node
+ * falls back to 512 KB, so every upload 413s on a deployment that looks fine.
+ */
+export function checkBodySizeLimit(env) {
+    const base = { id: 'body-size-limit', label: 'Upload size limit' };
+    const raw = env.BODY_SIZE_LIMIT;
+    const requestCap = Number(env.COMPUTE_REQUEST_MAX_BYTES) || COMPUTE_REQUEST_DEFAULT_BYTES;
+    if (raw == null || raw === '') {
+        return {
+            ...base,
+            verdict: 'fail',
+            summary: 'BODY_SIZE_LIMIT is unset — adapter-node falls back to 512 KB, so uploads over ' +
+                'that fail with an opaque 413 no app log records.',
+            remediation: `Set BODY_SIZE_LIMIT to at least ${asMb(requestCap)} (the compute request cap) and restart.`
+        };
+    }
+    const bytes = parseBodySizeLimit(raw);
+    if (bytes === null) {
+        return {
+            ...base,
+            verdict: 'fail',
+            summary: `BODY_SIZE_LIMIT="${raw}" — adapter-node cannot parse this and throws on boot.`,
+            remediation: 'Use a byte count or a single K/M/G suffix, e.g. "256M".'
+        };
+    }
+    if (bytes < requestCap) {
+        return {
+            ...base,
+            verdict: 'warn',
+            summary: `BODY_SIZE_LIMIT=${raw} (${asMb(bytes)}) is below COMPUTE_REQUEST_MAX_BYTES ` +
+                `(${asMb(requestCap)}) — the global cap rejects first, making the compute cap dead config.`,
+            remediation: `Raise BODY_SIZE_LIMIT to at least ${asMb(requestCap)} and restart.`
+        };
+    }
+    return {
+        ...base,
+        verdict: 'ok',
+        summary: `BODY_SIZE_LIMIT=${raw} clears the compute request cap.`
+    };
+}
+/**
+ * `ADDRESS_HEADER` / `XFF_DEPTH` are read by adapter-node, not by Selva, and
+ * unset they are invisible: nothing fails, nothing logs, and the deployment
+ * looks healthy.
+ *
+ * What actually happens is that `getClientAddress()` returns the socket peer,
+ * which behind a reverse proxy is the proxy — `127.0.0.1` for every request
+ * from every user. Login rate limiting keys on that, so the whole instance
+ * shares one bucket: five failed logins from anywhere return 429 to everyone,
+ * and only a *successful* login clears a bucket, which nobody can then reach.
+ *
+ * `ORIGIN` is the proxy tell. It is only needed when the app is served under a
+ * public URL it can't derive from its own socket, so its presence means a proxy
+ * is terminating requests. Without it we say nothing: on a directly-reachable
+ * app these settings are a footgun, since `X-Forwarded-For` is client-supplied
+ * and anyone could then pick their own rate-limit bucket.
+ */
+export function checkClientAddress(env) {
+    const base = { id: 'client-address', label: 'Client IP behind proxy' };
+    const header = env.ADDRESS_HEADER;
+    const depth = env.XFF_DEPTH;
+    if (!env.ORIGIN) {
+        return {
+            ...base,
+            verdict: 'ok',
+            summary: 'ADDRESS_HEADER is not needed — ORIGIN is unset, so no reverse proxy is in play.'
+        };
+    }
+    if (!header) {
+        return {
+            ...base,
+            verdict: 'fail',
+            summary: 'ADDRESS_HEADER is unset while ORIGIN is set — every request looks like it came from ' +
+                'the proxy, so all users share ONE login rate-limit bucket. Five failed logins from ' +
+                'anyone locks out the whole instance for 15 minutes.',
+            remediation: 'Set ADDRESS_HEADER=X-Forwarded-For and XFF_DEPTH=<number of proxies>, then restart. ' +
+                'To count your proxies, see docs/self-hosting/deployment/reverse-proxy.md.'
+        };
+    }
+    if (header.toLowerCase() === 'x-forwarded-for' && !depth) {
+        return {
+            ...base,
+            verdict: 'warn',
+            summary: `ADDRESS_HEADER=${header} but XFF_DEPTH is unset. X-Forwarded-For is a ` +
+                'client-appendable list, so a caller can prepend fake entries — adapter-node needs ' +
+                'the proxy count to know which entry is real.',
+            remediation: 'Set XFF_DEPTH=1 for a single reverse proxy, 2 if a CDN or load balancer sits in ' +
+                'front of it. Unsure? docs/self-hosting/deployment/reverse-proxy.md shows how to ' +
+                'read the header the app actually receives.'
+        };
+    }
+    if (depth !== undefined && !/^[1-9][0-9]*$/.test(depth)) {
+        return {
+            ...base,
+            verdict: 'fail',
+            summary: `XFF_DEPTH="${depth}" is not a positive integer.`,
+            remediation: 'It counts proxies from the outside in — use 1 for a single reverse proxy.'
+        };
+    }
+    return {
+        ...base,
+        verdict: 'ok',
+        summary: `ADDRESS_HEADER=${header}${depth ? ` (XFF_DEPTH=${depth})` : ''}.`
+    };
+}
+/** Every deployment-config rule, in report order. */
+export function checkDeploymentConfig(env) {
+    return [checkClientAddress(env), checkBodySizeLimit(env)];
+}
+//# sourceMappingURL=deploymentConfig.js.map

package/dist/ops/deploymentConfig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploymentConfig.js","sourceRoot":"","sources":["../../src/ops/deploymentConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AA4BH;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAA8B;IAChE,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAE9B,MAAM,KAAK,GAA2B,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,GAAG,IAAI,EAAE,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;IACzF,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,UAAU,CAAC;IACjF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,+EAA+E;AAC/E,MAAM,6BAA6B,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AAExD,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC;AAE1E;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAkB;IACpD,MAAM,IAAI,GAAG,EAAE,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;IACnE,MAAM,GAAG,GAAG,GAAG,CAAC,eAAe,CAAC;IAChC,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,yBAAyB,CAAC,IAAI,6BAA6B,CAAC;IAE1F,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QAC/B,OAAO;YACN,GAAG,IAAI;YACP,OAAO,EAAE,MAAM;YACf,OAAO,EACN,gFAAgF;gBAChF,kDAAkD;YACnD,WAAW,EAAE,mCAAmC,IAAI,CAAC,UAAU,CAAC,yCAAyC;SACzG,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO;YACN,GAAG,IAAI;YACP,OAAO,EAAE,MAAM;YACf,OAAO,EAAE,oBAAoB,GAAG,wDAAwD;YACxF,WAAW,EAAE,yDAAyD;SACtE,CAAC;IACH,CAAC;IAED,IAAI,KAAK,GAAG,UAAU,EAAE,CAAC;QACxB,OAAO;YACN,GAAG,IAAI;YACP,OAAO,EAAE,MAAM;YACf,OAAO,EACN,mBAAmB,GAAG,KAAK,IAAI,CAAC,KAAK,CAAC,uCAAuC;gBAC7E,IAAI,IAAI,CAAC,UAAU,CAAC,uEAAuE;YAC5F,WAAW,EAAE,qCAAqC,IAAI,CAAC,UAAU,CAAC,eAAe;SACjF,CAAC;IACH,CAAC;IAED,OAAO;QACN,GAAG,IAAI;QACP,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,mBAAmB,GAAG,kCAAkC;KACjE,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAkB;IACpD,MAAM,IAAI,GAAG,EAAE,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC;IACvE,MAAM,MAAM,GAAG,GAAG,CAAC,cAAc,CAAC;IAClC,MAAM,KAAK,GAAG,GAAG,CAAC,SAAS,CAAC;IAE5B,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;QACjB,OAAO;YACN,GAAG,IAAI;YACP,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,iFAAiF;SAC1F,CAAC;IACH,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,OAAO;YACN,GAAG,IAAI;YACP,OAAO,EAAE,MAAM;YACf,OAAO,EACN,sFAAsF;gBACtF,qFAAqF;gBACrF,qDAAqD;YACtD,WAAW,EACV,sFAAsF;gBACtF,2EAA2E;SAC5E,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,iBAAiB,IAAI,CAAC,KAAK,EAAE,CAAC;QAC1D,OAAO;YACN,GAAG,IAAI;YACP,OAAO,EAAE,MAAM;YACf,OAAO,EACN,kBAAkB,MAAM,gDAAgD;gBACxE,oFAAoF;gBACpF,8CAA8C;YAC/C,WAAW,EACV,kFAAkF;gBAClF,kFAAkF;gBAClF,4CAA4C;SAC7C,CAAC;IACH,CAAC;IAED,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,OAAO;YACN,GAAG,IAAI;YACP,OAAO,EAAE,MAAM;YACf,OAAO,EAAE,cAAc,KAAK,8BAA8B;YAC1D,WAAW,EAAE,2EAA2E;SACxF,CAAC;IACH,CAAC;IAED,OAAO;QACN,GAAG,IAAI;QACP,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,kBAAkB,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,eAAe,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG;KAC3E,CAAC;AACH,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,qBAAqB,CAAC,GAAkB;IACvD,OAAO,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC;AAC3D,CAAC"}

package/dist/ops/index.d.ts

@@ -1,2 +1,3 @@
 export { parseSemver, isNewer, compareCore, satisfiesRange, type ReleaseChannel } from './semver.js';
+export { checkClientAddress, checkBodySizeLimit, checkDeploymentConfig, parseBodySizeLimit, type ConfigFinding, type ConfigVerdict, type DeploymentEnv } from './deploymentConfig.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/ops/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/ops/index.ts"],"names":[],"mappings":"AAGA,OAAO,EACN,WAAW,EACX,OAAO,EACP,WAAW,EACX,cAAc,EACd,KAAK,cAAc,EACnB,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/ops/index.ts"],"names":[],"mappings":"AAGA,OAAO,EACN,WAAW,EACX,OAAO,EACP,WAAW,EACX,cAAc,EACd,KAAK,cAAc,EACnB,MAAM,aAAa,CAAC;AAErB,OAAO,EACN,kBAAkB,EAClB,kBAAkB,EAClB,qBAAqB,EACrB,kBAAkB,EAClB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,MAAM,uBAAuB,CAAC"}

package/dist/ops/index.js

@@ -1,4 +1,5 @@
-// Deployment/ops helpers — channel-aware semver comparison and engines.node
-// range checks.
+// Deployment/ops helpers — channel-aware semver comparison, engines.node range
+// checks, and the reverse-proxy/body-limit configuration rules.
 export { parseSemver, isNewer, compareCore, satisfiesRange } from './semver.js';
+export { checkClientAddress, checkBodySizeLimit, checkDeploymentConfig, parseBodySizeLimit } from './deploymentConfig.js';
 //# sourceMappingURL=index.js.map

package/dist/ops/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/ops/index.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,gBAAgB;AAEhB,OAAO,EACN,WAAW,EACX,OAAO,EACP,WAAW,EACX,cAAc,EAEd,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/ops/index.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,gEAAgE;AAEhE,OAAO,EACN,WAAW,EACX,OAAO,EACP,WAAW,EACX,cAAc,EAEd,MAAM,aAAa,CAAC;AAErB,OAAO,EACN,kBAAkB,EAClB,kBAAkB,EAClB,qBAAqB,EACrB,kBAAkB,EAIlB,MAAM,uBAAuB,CAAC"}

package/dist/organizations/index.d.ts

@@ -0,0 +1,3 @@
+export { OrgAssetService } from './org-asset-service.js';
+export { listAllOrgMembers } from './list-all-members.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/organizations/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/organizations/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/organizations/index.js

@@ -0,0 +1,5 @@
+// Org-level domain services — writes that span more than one provider and so
+// belong to neither store alone.
+export { OrgAssetService } from './org-asset-service.js';
+export { listAllOrgMembers } from './list-all-members.js';
+//# sourceMappingURL=index.js.map

package/dist/organizations/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/organizations/index.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,iCAAiC;AAEjC,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/organizations/list-all-members.d.ts

@@ -0,0 +1,10 @@
+import type { ILogger, IOrgStore, OrgMember } from '@selvajs/platform';
+/**
+ * Drain every membership page for an org. The admin users pages merge
+ * per-user org permissions into these rows; a truncated list would render
+ * those users as permissionless, and the permission-toggle UI builds its
+ * PATCH payload from the displayed state — so truncation here could silently
+ * wipe a user's org permissions on the next edit.
+ */
+export declare function listAllOrgMembers(orgs: IOrgStore, orgId: string, log?: ILogger): Promise<OrgMember[]>;
+//# sourceMappingURL=list-all-members.d.ts.map

package/dist/organizations/list-all-members.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-all-members.d.ts","sourceRoot":"","sources":["../../src/organizations/list-all-members.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAQvE;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACtC,IAAI,EAAE,SAAS,EACf,KAAK,EAAE,MAAM,EACb,GAAG,CAAC,EAAE,OAAO,GACX,OAAO,CAAC,SAAS,EAAE,CAAC,CAqBtB"}

package/dist/organizations/list-all-members.js

@@ -0,0 +1,36 @@
+import { SYSTEM_CONTEXT } from '@selvajs/platform';
+const PAGE_LIMIT = 200;
+// Runaway guard against an adapter that returns a non-advancing cursor —
+// 100 pages = 20k members, far past any real org on this product.
+const MAX_PAGES = 100;
+/**
+ * Drain every membership page for an org. The admin users pages merge
+ * per-user org permissions into these rows; a truncated list would render
+ * those users as permissionless, and the permission-toggle UI builds its
+ * PATCH payload from the displayed state — so truncation here could silently
+ * wipe a user's org permissions on the next edit.
+ */
+export async function listAllOrgMembers(orgs, orgId, log) {
+    const members = [];
+    let cursor;
+    for (let page = 0; page < MAX_PAGES; page++) {
+        const result = await orgs.listOrgMembers(SYSTEM_CONTEXT, orgId, {
+            limit: PAGE_LIMIT,
+            cursor
+        });
+        members.push(...result.items);
+        cursor = result.nextCursor;
+        if (!cursor)
+            return members;
+    }
+    // Injected rather than resolved: hitting the cap is the one outcome a caller
+    // must be able to see, and a package that reached for a host's logger could
+    // not be used by a host that has a different one.
+    log?.warn('listAllOrgMembers hit the page cap — member list may be incomplete', {
+        component: 'admin',
+        orgId,
+        pages: MAX_PAGES
+    });
+    return members;
+}
+//# sourceMappingURL=list-all-members.js.map

package/dist/organizations/list-all-members.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-all-members.js","sourceRoot":"","sources":["../../src/organizations/list-all-members.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,MAAM,UAAU,GAAG,GAAG,CAAC;AACvB,yEAAyE;AACzE,kEAAkE;AAClE,MAAM,SAAS,GAAG,GAAG,CAAC;AAEtB;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACtC,IAAe,EACf,KAAa,EACb,GAAa;IAEb,MAAM,OAAO,GAAgB,EAAE,CAAC;IAChC,IAAI,MAA0B,CAAC;IAC/B,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,cAAc,EAAE,KAAK,EAAE;YAC/D,KAAK,EAAE,UAAU;YACjB,MAAM;SACN,CAAC,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC;QAC3B,IAAI,CAAC,MAAM;YAAE,OAAO,OAAO,CAAC;IAC7B,CAAC;IACD,6EAA6E;IAC7E,4EAA4E;IAC5E,kDAAkD;IAClD,GAAG,EAAE,IAAI,CAAC,oEAAoE,EAAE;QAC/E,SAAS,EAAE,OAAO;QAClB,KAAK;QACL,KAAK,EAAE,SAAS;KAChB,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AAChB,CAAC"}

package/dist/organizations/org-asset-service.d.ts

@@ -0,0 +1,39 @@
+import type { IOrgStore, IStorageProvider, OrgAssetKind, RequestContext } from '@selvajs/platform';
+/**
+ * Orchestrates org-asset writes that span IStorageProvider + IOrgStore — one
+ * service for every asset kind (logo, favicon, …).
+ *
+ * Every upload is rasterized to WebP by the shared transcoder inside
+ * `IStorageProvider.put`, so the stored blob is always
+ * `orgs/{id}/branding/{kind}.webp` (the `branding/` segment marks the public
+ * asset class — see `classifyAssetPath`). SVG inputs are flattened to a
+ * 1200px raster — no vector blob is persisted, which keeps the served bytes
+ * XSS-free without a sanitizer. Re-uploads overwrite in place. The org's
+ * `assets` map is the source of truth for which kinds exist and their public
+ * URLs; we read-merge-write it so concurrent edits to *different* kinds don't
+ * clobber each other within a kind.
+ *
+ * Re-uploads overwrite the same path, so the stored URL would be identical
+ * across replaces and a cached browser/CDN would keep serving the old bytes.
+ * The content-derived `?v=` token (`withCacheBust`) gives a *different* image a
+ * *different* URL, while an identical re-upload keeps its URL and stays cached.
+ */
+export declare class OrgAssetService {
+    private orgs;
+    private storage;
+    constructor(orgs: IOrgStore, storage: IStorageProvider);
+    /**
+     * Store `kind`'s blob and point the org's `assets[kind]` at its public URL.
+     * `contentType` must be the *original* upload type (e.g. `image/svg+xml`) so
+     * the transcoder recognizes the bytes as an image. Returns the public URL.
+     */
+    saveAsset(ctx: RequestContext, orgId: string, kind: OrgAssetKind, data: Uint8Array, contentType: string): Promise<string>;
+    /** Remove `kind`'s blob and drop it from the org's `assets` map. No-op-safe. */
+    removeAsset(ctx: RequestContext, orgId: string, kind: OrgAssetKind): Promise<void>;
+    /**
+     * Read the org's current `assets` and return a copy with `kind` set to `url`
+     * (or removed when `url` is undefined). Keeps the other kinds intact.
+     */
+    private mergedAssets;
+}
+//# sourceMappingURL=org-asset-service.d.ts.map

package/dist/organizations/org-asset-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-asset-service.d.ts","sourceRoot":"","sources":["../../src/organizations/org-asset-service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGnG;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,eAAe;IAE1B,OAAO,CAAC,IAAI;IACZ,OAAO,CAAC,OAAO;gBADP,IAAI,EAAE,SAAS,EACf,OAAO,EAAE,gBAAgB;IAGlC;;;;OAIG;IACG,SAAS,CACd,GAAG,EAAE,cAAc,EACnB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,YAAY,EAClB,IAAI,EAAE,UAAU,EAChB,WAAW,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC;IAelB,gFAAgF;IAC1E,WAAW,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAOxF;;;OAGG;YACW,YAAY;CAa1B"}

package/dist/organizations/org-asset-service.js

@@ -0,0 +1,71 @@
+import { createHash } from 'node:crypto';
+import { orgPaths, ProviderError, withCacheBust } from '@selvajs/platform';
+/**
+ * Orchestrates org-asset writes that span IStorageProvider + IOrgStore — one
+ * service for every asset kind (logo, favicon, …).
+ *
+ * Every upload is rasterized to WebP by the shared transcoder inside
+ * `IStorageProvider.put`, so the stored blob is always
+ * `orgs/{id}/branding/{kind}.webp` (the `branding/` segment marks the public
+ * asset class — see `classifyAssetPath`). SVG inputs are flattened to a
+ * 1200px raster — no vector blob is persisted, which keeps the served bytes
+ * XSS-free without a sanitizer. Re-uploads overwrite in place. The org's
+ * `assets` map is the source of truth for which kinds exist and their public
+ * URLs; we read-merge-write it so concurrent edits to *different* kinds don't
+ * clobber each other within a kind.
+ *
+ * Re-uploads overwrite the same path, so the stored URL would be identical
+ * across replaces and a cached browser/CDN would keep serving the old bytes.
+ * The content-derived `?v=` token (`withCacheBust`) gives a *different* image a
+ * *different* URL, while an identical re-upload keeps its URL and stays cached.
+ */
+export class OrgAssetService {
+    orgs;
+    storage;
+    constructor(orgs, storage) {
+        this.orgs = orgs;
+        this.storage = storage;
+    }
+    /**
+     * Store `kind`'s blob and point the org's `assets[kind]` at its public URL.
+     * `contentType` must be the *original* upload type (e.g. `image/svg+xml`) so
+     * the transcoder recognizes the bytes as an image. Returns the public URL.
+     */
+    async saveAsset(ctx, orgId, kind, data, contentType) {
+        const path = orgPaths.asset(orgId, kind);
+        await this.storage.put(path, data, contentType);
+        // Content-derived token, not a timestamp: an identical re-upload to the
+        // same path keeps the same URL and stays cached; a changed image gets a
+        // new URL and refetches immediately. 8 hex chars is enough to distinguish
+        // versions without bloating the URL.
+        const token = createHash('sha256').update(data).digest('hex').slice(0, 8);
+        const url = withCacheBust(this.storage.getPublicUrl(path), token);
+        await this.orgs.updateOrg(ctx, orgId, {
+            assets: await this.mergedAssets(ctx, orgId, kind, url)
+        });
+        return url;
+    }
+    /** Remove `kind`'s blob and drop it from the org's `assets` map. No-op-safe. */
+    async removeAsset(ctx, orgId, kind) {
+        await this.storage.delete(orgPaths.asset(orgId, kind));
+        await this.orgs.updateOrg(ctx, orgId, {
+            assets: await this.mergedAssets(ctx, orgId, kind, undefined)
+        });
+    }
+    /**
+     * Read the org's current `assets` and return a copy with `kind` set to `url`
+     * (or removed when `url` is undefined). Keeps the other kinds intact.
+     */
+    async mergedAssets(ctx, orgId, kind, url) {
+        const org = await this.orgs.getOrg(ctx, orgId);
+        if (!org)
+            throw new ProviderError(`Org '${orgId}' not found`, 404);
+        const next = { ...(org.assets ?? {}) };
+        if (url === undefined)
+            delete next[kind];
+        else
+            next[kind] = url;
+        return next;
+    }
+}
+//# sourceMappingURL=org-asset-service.js.map

package/dist/organizations/org-asset-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-asset-service.js","sourceRoot":"","sources":["../../src/organizations/org-asset-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAE3E;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,OAAO,eAAe;IAElB;IACA;IAFT,YACS,IAAe,EACf,OAAyB;QADzB,SAAI,GAAJ,IAAI,CAAW;QACf,YAAO,GAAP,OAAO,CAAkB;IAC/B,CAAC;IAEJ;;;;OAIG;IACH,KAAK,CAAC,SAAS,CACd,GAAmB,EACnB,KAAa,EACb,IAAkB,EAClB,IAAgB,EAChB,WAAmB;QAEnB,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACzC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;QAChD,wEAAwE;QACxE,wEAAwE;QACxE,0EAA0E;QAC1E,qCAAqC;QACrC,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1E,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;QAClE,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,EAAE;YACrC,MAAM,EAAE,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC;SACtD,CAAC,CAAC;QACH,OAAO,GAAG,CAAC;IACZ,CAAC;IAED,gFAAgF;IAChF,KAAK,CAAC,WAAW,CAAC,GAAmB,EAAE,KAAa,EAAE,IAAkB;QACvE,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QACvD,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,EAAE;YACrC,MAAM,EAAE,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC;SAC5D,CAAC,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,YAAY,CACzB,GAAmB,EACnB,KAAa,EACb,IAAkB,EAClB,GAAuB;QAEvB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC/C,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,aAAa,CAAC,QAAQ,KAAK,aAAa,EAAE,GAAG,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,EAA4B,CAAC;QACjE,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;;YACpC,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;QACtB,OAAO,IAAI,CAAC;IACb,CAAC;CACD"}

package/dist/projects/create-project.d.ts

@@ -0,0 +1,30 @@
+import type { Project, RequestContext } from '@selvajs/platform';
+/**
+ * Fields the caller decides. `slug`, `createdAt`, `updatedAt` and `deletedAt`
+ * are derived here so the two create routes cannot disagree about them.
+ */
+export type ProjectDraft = Omit<Project, 'slug' | 'createdAt' | 'updatedAt' | 'deletedAt'>;
+export interface CreateProjectOptions {
+    /** Context the store writes under — `SYSTEM_CONTEXT` for the admin route. */
+    writeCtx: RequestContext;
+    /** Slug stem when the name slugifies to nothing. */
+    fallbackSlug: string;
+    /** Spliced into the 409 on a duplicate name. */
+    conflictScope: string;
+}
+/**
+ * Create a project, retrying on slug collision.
+ *
+ * The retry is not a nicety: the caller may not be able to *see* a colliding
+ * project under RLS, so a pre-flight `getProjectBySlug` cannot decide it — the
+ * unique index is the only source of truth.
+ *
+ * `/api/v1/projects` and `/api/admin/projects` both create projects and both
+ * carried a copy of this loop. The copies had already drifted on three points
+ * (error re-throw, slug stem, flag validation), which is what makes this the
+ * one place in the access surface where duplication caused real divergence.
+ */
+export declare function createProjectWithUniqueSlug(store: {
+    createProject(ctx: RequestContext, project: Project): Promise<unknown>;
+}, draft: ProjectDraft, { writeCtx, fallbackSlug, conflictScope }: CreateProjectOptions): Promise<Project>;
+//# sourceMappingURL=create-project.d.ts.map

package/dist/projects/create-project.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-project.d.ts","sourceRoot":"","sources":["../../src/projects/create-project.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAyBjE;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,WAAW,GAAG,WAAW,GAAG,WAAW,CAAC,CAAC;AAE3F,MAAM,WAAW,oBAAoB;IACpC,6EAA6E;IAC7E,QAAQ,EAAE,cAAc,CAAC;IACzB,oDAAoD;IACpD,YAAY,EAAE,MAAM,CAAC;IACrB,gDAAgD;IAChD,aAAa,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,2BAA2B,CAChD,KAAK,EAAE;IACN,aAAa,CAAC,GAAG,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACvE,EACD,KAAK,EAAE,YAAY,EACnB,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAE,EAAE,oBAAoB,GAC7D,OAAO,CAAC,OAAO,CAAC,CAmClB"}

package/dist/projects/create-project.js

@@ -0,0 +1,56 @@
+import { ProviderError, slugify } from '@selvajs/platform';
+import { apiError, ApiErrorCode } from '../api/errors.js';
+const MAX_SLUG_ATTEMPTS = 25;
+// Both predicates match a Postgres constraint name inside an error message.
+// That is fragile enough that it must exist once: a renamed constraint breaks
+// silently — the retry loop stops retrying and a collision surfaces as a 500.
+function isSlugConflict(err) {
+    return (err instanceof ProviderError &&
+        err.statusCode === 409 &&
+        /projects_org_id_slug_key/.test(err.message));
+}
+function isNameConflict(err) {
+    return (err instanceof ProviderError &&
+        err.statusCode === 409 &&
+        /projects_org_name_unique/.test(err.message));
+}
+/**
+ * Create a project, retrying on slug collision.
+ *
+ * The retry is not a nicety: the caller may not be able to *see* a colliding
+ * project under RLS, so a pre-flight `getProjectBySlug` cannot decide it — the
+ * unique index is the only source of truth.
+ *
+ * `/api/v1/projects` and `/api/admin/projects` both create projects and both
+ * carried a copy of this loop. The copies had already drifted on three points
+ * (error re-throw, slug stem, flag validation), which is what makes this the
+ * one place in the access surface where duplication caused real divergence.
+ */
+export async function createProjectWithUniqueSlug(store, draft, { writeCtx, fallbackSlug, conflictScope }) {
+    const baseSlug = slugify(draft.name) || fallbackSlug;
+    const now = new Date().toISOString();
+    for (let attempt = 0; attempt < MAX_SLUG_ATTEMPTS; attempt++) {
+        const project = {
+            ...draft,
+            slug: attempt === 0 ? baseSlug : `${baseSlug}-${attempt + 1}`,
+            createdAt: now,
+            updatedAt: now,
+            deletedAt: null
+        };
+        try {
+            await store.createProject(writeCtx, project);
+            return project;
+        }
+        catch (err) {
+            if (isNameConflict(err)) {
+                apiError(409, ApiErrorCode.CONFLICT, `A project with that name already exists in ${conflictScope}.`);
+            }
+            // A slug clash is the one error worth another attempt; everything else
+            // leaves the loop for the route's error wrapper to map.
+            if (!isSlugConflict(err))
+                throw err;
+        }
+    }
+    apiError(409, ApiErrorCode.CONFLICT, 'Could not pick a unique project slug after several attempts.');
+}
+//# sourceMappingURL=create-project.js.map

package/dist/projects/create-project.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-project.js","sourceRoot":"","sources":["../../src/projects/create-project.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAE1D,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B,4EAA4E;AAC5E,8EAA8E;AAC9E,8EAA8E;AAC9E,SAAS,cAAc,CAAC,GAAY;IACnC,OAAO,CACN,GAAG,YAAY,aAAa;QAC5B,GAAG,CAAC,UAAU,KAAK,GAAG;QACtB,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAC5C,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,GAAY;IACnC,OAAO,CACN,GAAG,YAAY,aAAa;QAC5B,GAAG,CAAC,UAAU,KAAK,GAAG;QACtB,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAC5C,CAAC;AACH,CAAC;AAiBD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAChD,KAEC,EACD,KAAmB,EACnB,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAwB;IAE/D,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC;IACrD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAErC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,iBAAiB,EAAE,OAAO,EAAE,EAAE,CAAC;QAC9D,MAAM,OAAO,GAAY;YACxB,GAAG,KAAK;YACR,IAAI,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,IAAI,OAAO,GAAG,CAAC,EAAE;YAC7D,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,IAAI;SACf,CAAC;QAEF,IAAI,CAAC;YACJ,MAAM,KAAK,CAAC,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC7C,OAAO,OAAO,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzB,QAAQ,CACP,GAAG,EACH,YAAY,CAAC,QAAQ,EACrB,8CAA8C,aAAa,GAAG,CAC9D,CAAC;YACH,CAAC;YACD,uEAAuE;YACvE,wDAAwD;YACxD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC;gBAAE,MAAM,GAAG,CAAC;QACrC,CAAC;IACF,CAAC;IAED,QAAQ,CACP,GAAG,EACH,YAAY,CAAC,QAAQ,EACrB,8DAA8D,CAC9D,CAAC;AACH,CAAC"}