@selvajs/server 1.1.0 → 1.3.0

package/dist/compute/idempotency-http.js

@@ -0,0 +1,51 @@
+/**
+ * The HTTP layer over {@link createIdempotencyStore}: how a replayed response
+ * is keyed, snapshotted, and identified on the wire.
+ *
+ * The store itself is generic over `T` and knows nothing about requests. This
+ * is the part two hosts must agree on to implement the same `Idempotency-Key`
+ * contract, and the part each would otherwise reinvent:
+ *
+ *   - **The key namespaces by caller.** `Idempotency-Key` is client-chosen, so
+ *     two tenants can pick the same string. Without the caller in the key one
+ *     would replay the other's result — that is the whole security property
+ *     here, and a host that got it wrong would leak across tenants with
+ *     nothing failing at build time.
+ *   - **The response round-trips through a snapshot.** A `Response` body reads
+ *     exactly once, so storing the object itself replays an empty body.
+ *   - **A replay says so**, via `Idempotency-Replayed`. A client that cannot
+ *     tell a replay from a fresh run cannot tell a successful retry from a
+ *     second execution.
+ *
+ * How long a response stays replayable is *not* here: that trades a client's
+ * retry window against serving a stale result after the underlying resource
+ * moves, and only the host knows its own deadlines.
+ */
+/** Header stamped on a replayed response, so a client can distinguish one. */
+export const IDEMPOTENCY_REPLAYED_HEADER = 'Idempotency-Replayed';
+/**
+ * Namespace a client-chosen key by its caller.
+ *
+ * `callerId` should be the narrowest identity available — a token id rather
+ * than a user id where the host issues per-token credentials, so two tokens
+ * held by one user do not share replays.
+ */
+export function idempotencyKey(callerId, clientKey) {
+    return `${callerId} ${clientKey}`;
+}
+/** Flatten a response so it can be replayed. Consumes the body. */
+export async function toStoredResponse(res) {
+    return {
+        status: res.status,
+        headers: [...res.headers.entries()],
+        body: await res.arrayBuffer()
+    };
+}
+/** Rebuild a live `Response` from a snapshot, marking it when it is a replay. */
+export function fromStoredResponse(stored, replayed) {
+    const headers = new Headers(stored.headers);
+    if (replayed)
+        headers.set(IDEMPOTENCY_REPLAYED_HEADER, 'true');
+    return new Response(stored.body, { status: stored.status, headers });
+}
+//# sourceMappingURL=idempotency-http.js.map

package/dist/compute/idempotency-http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"idempotency-http.js","sourceRoot":"","sources":["../../src/compute/idempotency-http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,8EAA8E;AAC9E,MAAM,CAAC,MAAM,2BAA2B,GAAG,sBAAsB,CAAC;AAYlE;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,SAAiB;IACjE,OAAO,GAAG,QAAQ,IAAI,SAAS,EAAE,CAAC;AACnC,CAAC;AAED,mEAAmE;AACnE,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAa;IACnD,OAAO;QACN,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,OAAO,EAAE,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACnC,IAAI,EAAE,MAAM,GAAG,CAAC,WAAW,EAAE;KAC7B,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,kBAAkB,CAAC,MAAsB,EAAE,QAAiB;IAC3E,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,QAAQ;QAAE,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,MAAM,CAAC,CAAC;IAC/D,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;AACtE,CAAC"}

package/dist/compute/index.d.ts

@@ -3,4 +3,9 @@ export { createComputeRateLimiter, DEFAULT_MAX_KEYS, type ComputeRateLimiter, ty
 export { createIdempotencyStore, DEFAULT_IDEMPOTENCY_MAX_KEYS, type IdempotencyStore, type IdempotencyStoreConfig, type IdempotencyOutcome } from './idempotency.js';
 export { isSafeRemoteDefinitionUrl, assertSafeRemoteDefinitionUrl, isLinkLocalUrl } from './safe-url.js';
 export { createRemoteDefinitionFetcher, readBodyWithCap, type RemoteDefinitionFetcher, type RemoteDefinitionConfig } from './remote-definition.js';
+export { resolveServerForOrg } from './resolve-server.js';
+export { ComputeServerUnconfiguredError } from './errors.js';
+export { evictChangedServers, type ServerConnection } from './evict-changed-servers.js';
+export { validateIncomingServers, resolveApiKey, storedKeysById, type IncomingServerBase } from './server-config-write.js';
+export { idempotencyKey, toStoredResponse, fromStoredResponse, IDEMPOTENCY_REPLAYED_HEADER, type StoredResponse } from './idempotency-http.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/compute/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/compute/index.ts"],"names":[],"mappings":"AAWA,OAAO,EACN,oBAAoB,EACpB,eAAe,EACf,kBAAkB,EAClB,QAAQ,EACR,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,MAAM,aAAa,CAAC;AAErB,OAAO,EACN,wBAAwB,EACxB,gBAAgB,EAChB,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,eAAe,EACpB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACN,sBAAsB,EACtB,4BAA4B,EAC5B,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACN,yBAAyB,EACzB,6BAA6B,EAC7B,cAAc,EACd,MAAM,eAAe,CAAC;AAEvB,OAAO,EACN,6BAA6B,EAC7B,eAAe,EACf,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/compute/index.ts"],"names":[],"mappings":"AAWA,OAAO,EACN,oBAAoB,EACpB,eAAe,EACf,kBAAkB,EAClB,QAAQ,EACR,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,MAAM,aAAa,CAAC;AAErB,OAAO,EACN,wBAAwB,EACxB,gBAAgB,EAChB,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,eAAe,EACpB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACN,sBAAsB,EACtB,4BAA4B,EAC5B,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACN,yBAAyB,EACzB,6BAA6B,EAC7B,cAAc,EACd,MAAM,eAAe,CAAC;AAEvB,OAAO,EACN,6BAA6B,EAC7B,eAAe,EACf,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,8BAA8B,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,KAAK,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACxF,OAAO,EACN,uBAAuB,EACvB,aAAa,EACb,cAAc,EACd,KAAK,kBAAkB,EACvB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACN,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,2BAA2B,EAC3B,KAAK,cAAc,EACnB,MAAM,uBAAuB,CAAC"}

package/dist/compute/index.js

@@ -13,4 +13,9 @@ export { createComputeRateLimiter, DEFAULT_MAX_KEYS } from './rate-limit.js';
 export { createIdempotencyStore, DEFAULT_IDEMPOTENCY_MAX_KEYS } from './idempotency.js';
 export { isSafeRemoteDefinitionUrl, assertSafeRemoteDefinitionUrl, isLinkLocalUrl } from './safe-url.js';
 export { createRemoteDefinitionFetcher, readBodyWithCap } from './remote-definition.js';
+export { resolveServerForOrg } from './resolve-server.js';
+export { ComputeServerUnconfiguredError } from './errors.js';
+export { evictChangedServers } from './evict-changed-servers.js';
+export { validateIncomingServers, resolveApiKey, storedKeysById } from './server-config-write.js';
+export { idempotencyKey, toStoredResponse, fromStoredResponse, IDEMPOTENCY_REPLAYED_HEADER } from './idempotency-http.js';
 //# sourceMappingURL=index.js.map

package/dist/compute/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/compute/index.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,EAAE;AACF,kGAAkG;AAClG,mGAAmG;AACnG,oBAAoB;AACpB,EAAE;AACF,6FAA6F;AAC7F,6FAA6F;AAC7F,8FAA8F;AAC9F,qCAAqC;AAErC,OAAO,EACN,oBAAoB,EACpB,eAAe,EACf,kBAAkB,EAClB,QAAQ,EAGR,MAAM,aAAa,CAAC;AAErB,OAAO,EACN,wBAAwB,EACxB,gBAAgB,EAIhB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACN,sBAAsB,EACtB,4BAA4B,EAI5B,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACN,yBAAyB,EACzB,6BAA6B,EAC7B,cAAc,EACd,MAAM,eAAe,CAAC;AAEvB,OAAO,EACN,6BAA6B,EAC7B,eAAe,EAGf,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/compute/index.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,EAAE;AACF,kGAAkG;AAClG,mGAAmG;AACnG,oBAAoB;AACpB,EAAE;AACF,6FAA6F;AAC7F,6FAA6F;AAC7F,8FAA8F;AAC9F,qCAAqC;AAErC,OAAO,EACN,oBAAoB,EACpB,eAAe,EACf,kBAAkB,EAClB,QAAQ,EAGR,MAAM,aAAa,CAAC;AAErB,OAAO,EACN,wBAAwB,EACxB,gBAAgB,EAIhB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACN,sBAAsB,EACtB,4BAA4B,EAI5B,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACN,yBAAyB,EACzB,6BAA6B,EAC7B,cAAc,EACd,MAAM,eAAe,CAAC;AAEvB,OAAO,EACN,6BAA6B,EAC7B,eAAe,EAGf,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,8BAA8B,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAyB,MAAM,4BAA4B,CAAC;AACxF,OAAO,EACN,uBAAuB,EACvB,aAAa,EACb,cAAc,EAEd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACN,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,2BAA2B,EAE3B,MAAM,uBAAuB,CAAC"}

package/dist/compute/resolve-server.d.ts

@@ -0,0 +1,25 @@
+import { type ComputeServerConfig, type IDataProvider, type RequestContext } from '@selvajs/platform';
+import { ComputeServerUnconfiguredError } from './errors.js';
+export { ComputeServerUnconfiguredError };
+/** The one store this module reads — `SelvaDeps['computeServer']`. */
+type ComputeServerStore = IDataProvider['computeServer'];
+/**
+ * Pick the right Rhino.Compute server for an (org, definition) pair.
+ *
+ * Resolution order, narrowest wins:
+ *   1. `definitionPin` if it points at a server visible to `orgId`.
+ *   2. `orgDefaults[orgId]` if set and visible.
+ *   3. Global `defaultServerId`.
+ *
+ * The store returns the full config; the visibility predicate runs in the pure
+ * helper so callers don't reimplement it. Re-throws the pure helper's "nothing
+ * visible" failure as a typed `ComputeServerUnconfiguredError`.
+ *
+ * Reads a key-free config and fetches the `apiKey` only for the server that
+ * actually wins, instead of decrypting every configured server's key to use
+ * exactly one of them.
+ */
+export declare function resolveServerForOrg(ctx: RequestContext, orgId: string | null | undefined, store: ComputeServerStore, opts?: {
+    definitionPin?: string | null;
+}): Promise<ComputeServerConfig>;
+//# sourceMappingURL=resolve-server.d.ts.map

package/dist/compute/resolve-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-server.d.ts","sourceRoot":"","sources":["../../src/compute/resolve-server.ts"],"names":[],"mappings":"AAAA,OAAO,EAEN,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,8BAA8B,EAAE,MAAM,aAAa,CAAC;AAI7D,OAAO,EAAE,8BAA8B,EAAE,CAAC;AAE1C,sEAAsE;AACtE,KAAK,kBAAkB,GAAG,aAAa,CAAC,eAAe,CAAC,CAAC;AAEzD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,mBAAmB,CACxC,GAAG,EAAE,cAAc,EACnB,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,KAAK,EAAE,kBAAkB,EACzB,IAAI,GAAE;IAAE,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAO,GAC1C,OAAO,CAAC,mBAAmB,CAAC,CAU9B"}

package/dist/compute/resolve-server.js

@@ -0,0 +1,35 @@
+import { resolveServerForOrg as resolvePure } from '@selvajs/platform';
+import { ComputeServerUnconfiguredError } from './errors.js';
+// Re-exported so the throw site and the class still read as one unit. Error
+// mappers should import from `./errors.js` directly.
+export { ComputeServerUnconfiguredError };
+/**
+ * Pick the right Rhino.Compute server for an (org, definition) pair.
+ *
+ * Resolution order, narrowest wins:
+ *   1. `definitionPin` if it points at a server visible to `orgId`.
+ *   2. `orgDefaults[orgId]` if set and visible.
+ *   3. Global `defaultServerId`.
+ *
+ * The store returns the full config; the visibility predicate runs in the pure
+ * helper so callers don't reimplement it. Re-throws the pure helper's "nothing
+ * visible" failure as a typed `ComputeServerUnconfiguredError`.
+ *
+ * Reads a key-free config and fetches the `apiKey` only for the server that
+ * actually wins, instead of decrypting every configured server's key to use
+ * exactly one of them.
+ */
+export async function resolveServerForOrg(ctx, orgId, store, opts = {}) {
+    const config = await store.getConfig(ctx);
+    let server;
+    try {
+        server = resolvePure(config, orgId, { definitionPin: opts.definitionPin });
+    }
+    catch (err) {
+        throw new ComputeServerUnconfiguredError(err instanceof Error ? err.message : undefined);
+    }
+    if (!server.hasApiKey)
+        return server;
+    return { ...server, apiKey: await store.getServerApiKey(ctx, server.id) };
+}
+//# sourceMappingURL=resolve-server.js.map

package/dist/compute/resolve-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-server.js","sourceRoot":"","sources":["../../src/compute/resolve-server.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,mBAAmB,IAAI,WAAW,EAIlC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,8BAA8B,EAAE,MAAM,aAAa,CAAC;AAE7D,4EAA4E;AAC5E,qDAAqD;AACrD,OAAO,EAAE,8BAA8B,EAAE,CAAC;AAK1C;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,GAAmB,EACnB,KAAgC,EAChC,KAAyB,EACzB,OAA0C,EAAE;IAE5C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,MAA2B,CAAC;IAChC,IAAI,CAAC;QACJ,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;IAC5E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,IAAI,8BAA8B,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS;QAAE,OAAO,MAAM,CAAC;IACrC,OAAO,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,CAAC,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;AAC3E,CAAC"}

package/dist/compute/server-config-write.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Shared write-path rules for compute server config.
+ *
+ * Two routes accept a server set: `/api/admin/compute` (platform scope,
+ * `manage_compute`) and `/api/v1/orgs/{orgId}/compute` (org scope,
+ * `manage_org_compute`). They differ in who may call them, what extra fields
+ * they carry (`sharedWith` vs `ownerOrgId`), and how they validate the default
+ * selection — but the field validation and the apiKey merge below must behave
+ * identically in both, so they live here rather than in either handler.
+ *
+ * The apiKey merge is why this file exists: if the two copies disagree, a
+ * stored credential silently gets cleared or leaked, and nothing fails at
+ * build time.
+ */
+/** The fields every incoming server carries, whatever its scope. */
+export interface IncomingServerBase {
+    id: string;
+    label: string;
+    serverUrl: string;
+    /**
+     * `undefined` → preserve the stored key; `null` → clear it;
+     * non-empty string → replace it. See {@link resolveApiKey}.
+     */
+    apiKey?: string | null;
+    timeoutMs?: number;
+    retryCount?: number;
+}
+/**
+ * Validates the scope-independent fields of every submitted server. Throws the
+ * first failure as a 400; scope-specific fields (`sharedWith`, `ownerOrgId`)
+ * are the caller's business.
+ */
+export declare function validateIncomingServers(servers: readonly IncomingServerBase[]): void;
+/**
+ * The UI never receives stored keys — it sends back `hasApiKey` and omits the
+ * field for servers the operator didn't touch. So "omitted" cannot mean "clear":
+ * it has to preserve, or every save through the settings form would wipe the
+ * keys of every server the operator left alone. Clearing is explicit (`null`);
+ * an empty string is treated as "not provided" since that's what an untouched
+ * password input submits.
+ */
+export declare function resolveApiKey(submitted: string | null | undefined, storedKey: string | undefined): string | undefined;
+/**
+ * Builds the id → stored-key lookup the merge reads. The caller passes only the
+ * servers in its own scope, so one scope's write can never resolve a key from
+ * another's rows.
+ */
+export declare function storedKeysById(scopedServers: readonly {
+    id: string;
+    apiKey?: string;
+}[]): Map<string, string | undefined>;
+//# sourceMappingURL=server-config-write.d.ts.map

package/dist/compute/server-config-write.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-config-write.d.ts","sourceRoot":"","sources":["../../src/compute/server-config-write.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAqDH,oEAAoE;AACpE,MAAM,WAAW,kBAAkB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,SAAS,kBAAkB,EAAE,GAAG,IAAI,CAYpF;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAC5B,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACpC,SAAS,EAAE,MAAM,GAAG,SAAS,GAC3B,MAAM,GAAG,SAAS,CAGpB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC7B,aAAa,EAAE,SAAS;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,GACvD,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAEjC"}

package/dist/compute/server-config-write.js

@@ -0,0 +1,100 @@
+/**
+ * Shared write-path rules for compute server config.
+ *
+ * Two routes accept a server set: `/api/admin/compute` (platform scope,
+ * `manage_compute`) and `/api/v1/orgs/{orgId}/compute` (org scope,
+ * `manage_org_compute`). They differ in who may call them, what extra fields
+ * they carry (`sharedWith` vs `ownerOrgId`), and how they validate the default
+ * selection — but the field validation and the apiKey merge below must behave
+ * identically in both, so they live here rather than in either handler.
+ *
+ * The apiKey merge is why this file exists: if the two copies disagree, a
+ * stored credential silently gets cleared or leaked, and nothing fails at
+ * build time.
+ */
+import { isLinkLocalUrl } from './safe-url.js';
+import { apiError, ApiErrorCode } from '../api/errors.js';
+/**
+ * A stored `serverUrl` is fetched server-side on every status probe, every
+ * purge/shutdown action, and every solve, so an unfiltered one is an SSRF
+ * primitive handed to whoever holds `manage_compute`. Two rules:
+ *
+ *   - Scheme allowlist: `http`/`https`. `file:`, `gopher:` and friends are never
+ *     a Rhino.Compute endpoint.
+ *   - Link-local (`169.254.0.0/16`) is refused. That range carries the cloud
+ *     metadata service at `169.254.169.254`, which hands out the host's own IAM
+ *     credentials to anything running on the box.
+ *
+ * **Loopback and RFC1918 are deliberately allowed.** Running compute on
+ * `localhost:6500` or a LAN box is the ordinary self-hosted layout, not an
+ * attack — most deployments reach their compute server over exactly those
+ * addresses. Blocking them by default would break those instances on upgrade
+ * and push every operator toward an opt-out flag, and a guard that everyone
+ * disables protects nobody. So the check is narrowed to the range where no
+ * legitimate compute server ever lives.
+ *
+ * What this does not stop: a privileged admin pointing the app at an internal
+ * host to probe it. That is a real but much weaker concern than credential
+ * theft, it needs `manage_compute` already, and it is inseparable from the
+ * legitimate case. Revisit if `manage_org_compute` is ever delegated widely on
+ * a multi-tenant instance.
+ *
+ * `isLinkLocalUrl` is reused rather than hand-rolled because a string compare
+ * against `169.254.169.254` misses the encodings that reach the same address:
+ * `http://2852039166/`, `http://0xa9fea9fe/`, `http://0251.0376.0251.0376/`.
+ */
+function assertUsableServerUrl(serverUrl) {
+    let parsed;
+    try {
+        parsed = new URL(serverUrl);
+    }
+    catch {
+        apiError(400, ApiErrorCode.VALIDATION_FAILED, `Invalid serverUrl: ${serverUrl}`);
+    }
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+        apiError(400, ApiErrorCode.VALIDATION_FAILED, `serverUrl must use http or https: ${serverUrl}`);
+    }
+    if (isLinkLocalUrl(serverUrl)) {
+        apiError(400, ApiErrorCode.VALIDATION_FAILED, `serverUrl points at the link-local range, which carries the cloud metadata service: ${serverUrl}`);
+    }
+}
+/**
+ * Validates the scope-independent fields of every submitted server. Throws the
+ * first failure as a 400; scope-specific fields (`sharedWith`, `ownerOrgId`)
+ * are the caller's business.
+ */
+export function validateIncomingServers(servers) {
+    for (const s of servers) {
+        if (!s.id || typeof s.id !== 'string')
+            apiError(400, ApiErrorCode.VALIDATION_FAILED, 'Each server needs an id');
+        if (!s.label || typeof s.label !== 'string')
+            apiError(400, ApiErrorCode.VALIDATION_FAILED, 'Each server needs a label');
+        if (!s.serverUrl || typeof s.serverUrl !== 'string')
+            apiError(400, ApiErrorCode.VALIDATION_FAILED, 'Each server needs a serverUrl');
+        assertUsableServerUrl(s.serverUrl);
+        if (s.apiKey !== undefined && s.apiKey !== null && typeof s.apiKey !== 'string')
+            apiError(400, ApiErrorCode.VALIDATION_FAILED, 'apiKey must be a string, null, or omitted');
+    }
+}
+/**
+ * The UI never receives stored keys — it sends back `hasApiKey` and omits the
+ * field for servers the operator didn't touch. So "omitted" cannot mean "clear":
+ * it has to preserve, or every save through the settings form would wipe the
+ * keys of every server the operator left alone. Clearing is explicit (`null`);
+ * an empty string is treated as "not provided" since that's what an untouched
+ * password input submits.
+ */
+export function resolveApiKey(submitted, storedKey) {
+    if (submitted === null)
+        return undefined;
+    return submitted ? submitted : storedKey;
+}
+/**
+ * Builds the id → stored-key lookup the merge reads. The caller passes only the
+ * servers in its own scope, so one scope's write can never resolve a key from
+ * another's rows.
+ */
+export function storedKeysById(scopedServers) {
+    return new Map(scopedServers.map((s) => [s.id, s.apiKey]));
+}
+//# sourceMappingURL=server-config-write.js.map

package/dist/compute/server-config-write.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-config-write.js","sourceRoot":"","sources":["../../src/compute/server-config-write.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAE1D;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,SAAS,qBAAqB,CAAC,SAAiB;IAC/C,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACR,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,sBAAsB,SAAS,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,qCAAqC,SAAS,EAAE,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/B,QAAQ,CACP,GAAG,EACH,YAAY,CAAC,iBAAiB,EAC9B,uFAAuF,SAAS,EAAE,CAClG,CAAC;IACH,CAAC;AACF,CAAC;AAgBD;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAsC;IAC7E,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ;YACpC,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,yBAAyB,CAAC,CAAC;QAC1E,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;YAC1C,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,2BAA2B,CAAC,CAAC;QAC5E,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;YAClD,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,+BAA+B,CAAC,CAAC;QAChF,qBAAqB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACnC,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;YAC9E,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,2CAA2C,CAAC,CAAC;IAC7F,CAAC;AACF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAC5B,SAAoC,EACpC,SAA6B;IAE7B,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACzC,OAAO,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC7B,aAAyD;IAEzD,OAAO,IAAI,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAC5D,CAAC"}

package/dist/definitions/index.d.ts

@@ -2,4 +2,5 @@ export { DefinitionService, type CreateDefinitionRecord } from './definition-ser
 export { fetchSchemaFromCompute, postSchemaFormData, assertSupportedSchemaVersion, assertCamelCaseSchema, readSchemaResults, SchemaExtractionError } from './schema-extraction.js';
 export type { SchemaExtractionResult } from './schema-extraction.js';
 export { createDefinitionLoader, DefinitionLoadError, type DefinitionChannel, type DefinitionLoader, type DefinitionLoaderDeps, type DefinitionLoadErrorKind, type DefinitionLoadOptions, type LoadedDefinition } from './load-for-render.js';
+export { resolveAccessibleProjects, listVisibleDefinitions, getVisibleDefinition, loadVisibleVersion, type VisibilityDeps, type AccessibleProjectSet, type ListVisibleDefinitionsResult } from './visibility.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/definitions/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/definitions/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,KAAK,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAEzF,OAAO,EACN,sBAAsB,EACtB,kBAAkB,EAClB,4BAA4B,EAC5B,qBAAqB,EACrB,iBAAiB,EACjB,qBAAqB,EACrB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAErE,OAAO,EACN,sBAAsB,EACtB,mBAAmB,EACnB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/definitions/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,KAAK,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAEzF,OAAO,EACN,sBAAsB,EACtB,kBAAkB,EAClB,4BAA4B,EAC5B,qBAAqB,EACrB,iBAAiB,EACjB,qBAAqB,EACrB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAErE,OAAO,EACN,sBAAsB,EACtB,mBAAmB,EACnB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACN,yBAAyB,EACzB,sBAAsB,EACtB,oBAAoB,EACpB,kBAAkB,EAClB,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,KAAK,4BAA4B,EACjC,MAAM,iBAAiB,CAAC"}

package/dist/definitions/index.js

@@ -1,4 +1,5 @@
 export { DefinitionService } from './definition-service.js';
 export { fetchSchemaFromCompute, postSchemaFormData, assertSupportedSchemaVersion, assertCamelCaseSchema, readSchemaResults, SchemaExtractionError } from './schema-extraction.js';
 export { createDefinitionLoader, DefinitionLoadError } from './load-for-render.js';
+export { resolveAccessibleProjects, listVisibleDefinitions, getVisibleDefinition, loadVisibleVersion } from './visibility.js';
 //# sourceMappingURL=index.js.map

package/dist/definitions/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/definitions/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAA+B,MAAM,yBAAyB,CAAC;AAEzF,OAAO,EACN,sBAAsB,EACtB,kBAAkB,EAClB,4BAA4B,EAC5B,qBAAqB,EACrB,iBAAiB,EACjB,qBAAqB,EACrB,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EACN,sBAAsB,EACtB,mBAAmB,EAOnB,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/definitions/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAA+B,MAAM,yBAAyB,CAAC;AAEzF,OAAO,EACN,sBAAsB,EACtB,kBAAkB,EAClB,4BAA4B,EAC5B,qBAAqB,EACrB,iBAAiB,EACjB,qBAAqB,EACrB,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EACN,sBAAsB,EACtB,mBAAmB,EAOnB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACN,yBAAyB,EACzB,sBAAsB,EACtB,oBAAoB,EACpB,kBAAkB,EAIlB,MAAM,iBAAiB,CAAC"}

package/dist/definitions/visibility.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Visibility-filtered definition reads, shared by the library page load and
+ * `GET /api/v1/definitions`.
+ *
+ * **This is a tenancy boundary.** The project scan runs as `SYSTEM_CONTEXT` so
+ * cross-org `public` projects are reachable when `ALLOW_CROSS_ORG_PUBLIC` is on;
+ * `canView` over the fetched membership rows is the only thing keeping another
+ * org's projects out of the result. The definition list itself is then filtered
+ * *in the query* via `projectIds`, so the cursor is applied after visibility
+ * rather than over a page that gets thinned afterwards.
+ *
+ * Cost is constant in the number of orgs and projects: three bulk membership
+ * reads regardless of N. Anything added here must keep that property — a
+ * per-project `await` inside a loop reintroduces the N+1 this replaced.
+ */
+import type { DefinitionListOptions, DefinitionRecord, DefinitionVersion, OrgMember, Page, Project, ProjectMember, RequestContext } from '@selvajs/platform';
+import type { SelvaDeps } from '../api/deps.js';
+/**
+ * The stores this module reads. Required at every call site.
+ *
+ * These used to fall back to a host's composition root, which welded this
+ * tenancy boundary to one app's boot — anything importing it started the whole
+ * application. Handlers pass `req.deps`; page loads pass their own equivalent.
+ * That is what lets a second host on a different provider set reuse this
+ * boundary instead of rebuilding it.
+ */
+export type VisibilityDeps = Pick<SelvaDeps, 'orgs' | 'projects' | 'platformProjectGrants' | 'definitionMeta' | 'flag'>;
+/**
+ * The caller's accessible project set plus the membership rows it was derived
+ * from, so a caller needing a second rule (`canEdit` on the projects page)
+ * can evaluate it with no further I/O.
+ */
+export interface AccessibleProjectSet {
+    projects: Project[];
+    /** Every project the scan saw, keyed by id — for name lookups on rows. */
+    allById: Map<string, Project>;
+    /** The caller's project-membership row per scanned project (`null` = not a member). */
+    memberByProjectId: Map<string, ProjectMember | null>;
+    /** The caller's org-membership row per scanned org (`null` = not a member). */
+    orgMemberByOrgId: Map<string, OrgMember | null>;
+}
+/**
+ * Resolve the caller's accessible project set in a constant number of queries.
+ * Platform grants are fetched only for `platform`-visibility projects —
+ * `canView` short-circuits before reading them for every other visibility.
+ */
+export declare function resolveAccessibleProjects(ctx: RequestContext, deps: VisibilityDeps): Promise<AccessibleProjectSet>;
+export interface ListVisibleDefinitionsResult extends Page<DefinitionRecord> {
+    /** For resolving a definition's `projectId` to a name. */
+    projects: Project[];
+}
+/**
+ * `opts.projectId` narrows to one project; a caller who cannot view it gets an
+ * empty page rather than a 403, so this never reveals that a project exists.
+ */
+export declare function listVisibleDefinitions(ctx: RequestContext, opts: (DefinitionListOptions & {
+    projectId?: string;
+}) | undefined, deps: VisibilityDeps): Promise<ListVisibleDefinitionsResult>;
+/**
+ * One definition, or `null` when the caller cannot view its project.
+ *
+ * Returns `null` rather than throwing 403 so callers surface a 404: a public
+ * API that answers "forbidden" for a guid the caller cannot see turns
+ * `/definitions/{guid}` into a cross-tenant existence oracle.
+ */
+export declare function getVisibleDefinition(ctx: RequestContext, guid: string, deps: VisibilityDeps): Promise<DefinitionRecord | null>;
+/**
+ * One version of a definition the caller can view, including its cached
+ * `schema`. `null` when the definition is invisible, the version is missing, or
+ * the version belongs to a different definition — a caller must not be able to
+ * read an arbitrary version by pairing it with a guid they can see.
+ */
+export declare function loadVisibleVersion(ctx: RequestContext, guid: string, versionId: string, deps: VisibilityDeps): Promise<DefinitionVersion | null>;
+//# sourceMappingURL=visibility.d.ts.map

package/dist/definitions/visibility.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"visibility.d.ts","sourceRoot":"","sources":["../../src/definitions/visibility.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EACX,qBAAqB,EACrB,gBAAgB,EAChB,iBAAiB,EACjB,SAAS,EACT,IAAI,EAEJ,OAAO,EACP,aAAa,EACb,cAAc,EACd,MAAM,mBAAmB,CAAC;AAE3B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAKhD;;;;;;;;GAQG;AACH,MAAM,MAAM,cAAc,GAAG,IAAI,CAChC,SAAS,EACT,MAAM,GAAG,UAAU,GAAG,uBAAuB,GAAG,gBAAgB,GAAG,MAAM,CACzE,CAAC;AAEF;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACpC,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,0EAA0E;IAC1E,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,uFAAuF;IACvF,iBAAiB,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,CAAC,CAAC;IACrD,+EAA+E;IAC/E,gBAAgB,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC,CAAC;CAChD;AAED;;;;GAIG;AACH,wBAAsB,yBAAyB,CAC9C,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,cAAc,GAClB,OAAO,CAAC,oBAAoB,CAAC,CAyC/B;AAED,MAAM,WAAW,4BAA6B,SAAQ,IAAI,CAAC,gBAAgB,CAAC;IAC3E,0DAA0D;IAC1D,QAAQ,EAAE,OAAO,EAAE,CAAC;CACpB;AAED;;;GAGG;AACH,wBAAsB,sBAAsB,CAC3C,GAAG,EAAE,cAAc,EACnB,IAAI,GAAE,qBAAqB,GAAG;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,aAAK,EACzD,IAAI,EAAE,cAAc,GAClB,OAAO,CAAC,4BAA4B,CAAC,CAavC;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CACzC,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,cAAc,GAClB,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CA0BlC;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACvC,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,cAAc,GAClB,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAOnC"}

package/dist/definitions/visibility.js

@@ -0,0 +1,117 @@
+/**
+ * Visibility-filtered definition reads, shared by the library page load and
+ * `GET /api/v1/definitions`.
+ *
+ * **This is a tenancy boundary.** The project scan runs as `SYSTEM_CONTEXT` so
+ * cross-org `public` projects are reachable when `ALLOW_CROSS_ORG_PUBLIC` is on;
+ * `canView` over the fetched membership rows is the only thing keeping another
+ * org's projects out of the result. The definition list itself is then filtered
+ * *in the query* via `projectIds`, so the cursor is applied after visibility
+ * rather than over a page that gets thinned afterwards.
+ *
+ * Cost is constant in the number of orgs and projects: three bulk membership
+ * reads regardless of N. Anything added here must keep that property — a
+ * per-project `await` inside a loop reintroduces the N+1 this replaced.
+ */
+import { SYSTEM_CONTEXT, canView } from '@selvajs/platform';
+import { projectAccessInputFromRowsWith } from '../access/index.js';
+/** Upper bound on the org/project scan. Visibility needs the whole set. */
+const SCAN_LIMIT = 200;
+/**
+ * Resolve the caller's accessible project set in a constant number of queries.
+ * Platform grants are fetched only for `platform`-visibility projects —
+ * `canView` short-circuits before reading them for every other visibility.
+ */
+export async function resolveAccessibleProjects(ctx, deps) {
+    const orgs = deps.orgs;
+    const projectStore = deps.projects;
+    const grantStore = deps.platformProjectGrants;
+    const orgsPage = await orgs.listOrgs(SYSTEM_CONTEXT, { limit: SCAN_LIMIT });
+    const orgIds = orgsPage.items.map((o) => o.id);
+    const projectPages = await Promise.all(orgIds.map((orgId) => projectStore.listProjects(SYSTEM_CONTEXT, orgId, { limit: SCAN_LIMIT })));
+    const allProjects = projectPages.flatMap((p) => p.items);
+    const projectIds = allProjects.map((p) => p.id);
+    const platformProjectIds = allProjects
+        .filter((p) => p.visibility === 'platform')
+        .map((p) => p.id);
+    const [orgMemberByOrgId, memberByProjectId, grantsByProjectId] = await Promise.all([
+        orgs.getOrgMembersFor(SYSTEM_CONTEXT, orgIds, ctx.userId),
+        projectStore.getProjectMembersFor(SYSTEM_CONTEXT, projectIds, ctx.userId),
+        platformProjectIds.length
+            ? grantStore.listByProjects(SYSTEM_CONTEXT, platformProjectIds)
+            : Promise.resolve(new Map())
+    ]);
+    const projects = allProjects.filter((project) => canView(projectAccessInputFromRowsWith({ deps }, ctx, project, {
+        member: memberByProjectId.get(project.id) ?? null,
+        orgMember: orgMemberByOrgId.get(project.orgId) ?? null,
+        platformGrants: grantsByProjectId.get(project.id) ?? []
+    })));
+    return {
+        projects,
+        allById: new Map(allProjects.map((p) => [p.id, p])),
+        memberByProjectId,
+        orgMemberByOrgId
+    };
+}
+/**
+ * `opts.projectId` narrows to one project; a caller who cannot view it gets an
+ * empty page rather than a 403, so this never reveals that a project exists.
+ */
+export async function listVisibleDefinitions(ctx, opts = {}, deps) {
+    const { projectId, ...listOpts } = opts;
+    const { projects } = await resolveAccessibleProjects(ctx, deps);
+    const scoped = projectId ? projects.filter((p) => p.id === projectId) : projects;
+    // An empty id set matches nothing, which is what a caller with no visible
+    // projects should get — not an unfiltered listing.
+    const page = await deps.definitionMeta.list(ctx, {
+        ...listOpts,
+        projectIds: scoped.map((p) => p.id)
+    });
+    return { items: page.items, nextCursor: page.nextCursor, projects: scoped };
+}
+/**
+ * One definition, or `null` when the caller cannot view its project.
+ *
+ * Returns `null` rather than throwing 403 so callers surface a 404: a public
+ * API that answers "forbidden" for a guid the caller cannot see turns
+ * `/definitions/{guid}` into a cross-tenant existence oracle.
+ */
+export async function getVisibleDefinition(ctx, guid, deps) {
+    const meta = deps.definitionMeta;
+    const projectStore = deps.projects;
+    const record = await meta.get(ctx, guid);
+    if (!record)
+        return null;
+    const project = await projectStore.getProject(SYSTEM_CONTEXT, record.projectId);
+    if (!project)
+        return null;
+    const [orgMembers, projectMembers, grants] = await Promise.all([
+        deps.orgs.getOrgMembersFor(SYSTEM_CONTEXT, [project.orgId], ctx.userId),
+        projectStore.getProjectMembersFor(SYSTEM_CONTEXT, [project.id], ctx.userId),
+        project.visibility === 'platform'
+            ? deps.platformProjectGrants.listByProject(SYSTEM_CONTEXT, project.id)
+            : Promise.resolve([])
+    ]);
+    const allowed = canView(projectAccessInputFromRowsWith({ deps }, ctx, project, {
+        member: projectMembers.get(project.id) ?? null,
+        orgMember: orgMembers.get(project.orgId) ?? null,
+        platformGrants: grants
+    }));
+    return allowed ? record : null;
+}
+/**
+ * One version of a definition the caller can view, including its cached
+ * `schema`. `null` when the definition is invisible, the version is missing, or
+ * the version belongs to a different definition — a caller must not be able to
+ * read an arbitrary version by pairing it with a guid they can see.
+ */
+export async function loadVisibleVersion(ctx, guid, versionId, deps) {
+    const record = await getVisibleDefinition(ctx, guid, deps);
+    if (!record)
+        return null;
+    const version = await deps.definitionMeta.getVersion(ctx, versionId);
+    if (!version || version.definitionId !== record.guid)
+        return null;
+    return version;
+}
+//# sourceMappingURL=visibility.js.map

package/dist/definitions/visibility.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"visibility.js","sourceRoot":"","sources":["../../src/definitions/visibility.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAY5D,OAAO,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AAGpE,2EAA2E;AAC3E,MAAM,UAAU,GAAG,GAAG,CAAC;AA+BvB;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC9C,GAAmB,EACnB,IAAoB;IAEpB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC;IACnC,MAAM,UAAU,GAAG,IAAI,CAAC,qBAAqB,CAAC;IAE9C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAE/C,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,GAAG,CACrC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,cAAc,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,CAC9F,CAAC;IACF,MAAM,WAAW,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACzD,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAChD,MAAM,kBAAkB,GAAG,WAAW;SACpC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,UAAU,CAAC;SAC1C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAEnB,MAAM,CAAC,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAClF,IAAI,CAAC,gBAAgB,CAAC,cAAc,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC;QACzD,YAAY,CAAC,oBAAoB,CAAC,cAAc,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC;QACzE,kBAAkB,CAAC,MAAM;YACxB,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,cAAc,EAAE,kBAAkB,CAAC;YAC/D,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,GAAG,EAAkC,CAAC;KAC7D,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAC/C,OAAO,CACN,8BAA8B,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE;QACtD,MAAM,EAAE,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,IAAI;QACjD,SAAS,EAAE,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI;QACtD,cAAc,EAAE,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE;KACvD,CAAC,CACF,CACD,CAAC;IAEF,OAAO;QACN,QAAQ;QACR,OAAO,EAAE,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QACnD,iBAAiB;QACjB,gBAAgB;KAChB,CAAC;AACH,CAAC;AAOD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC3C,GAAmB,EACnB,OAAuD,EAAE,EACzD,IAAoB;IAEpB,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE,GAAG,IAAI,CAAC;IACxC,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAEhE,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IACjF,0EAA0E;IAC1E,mDAAmD;IACnD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE;QAChD,GAAG,QAAQ;QACX,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnC,CAAC,CAAC;IAEH,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AAC7E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACzC,GAAmB,EACnB,IAAY,EACZ,IAAoB;IAEpB,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC;IACjC,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC;IAEnC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,cAAc,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IAChF,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,MAAM,CAAC,UAAU,EAAE,cAAc,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC9D,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,cAAc,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC;QACvE,YAAY,CAAC,oBAAoB,CAAC,cAAc,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC;QAC3E,OAAO,CAAC,UAAU,KAAK,UAAU;YAChC,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,aAAa,CAAC,cAAc,EAAE,OAAO,CAAC,EAAE,CAAC;YACtE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAA4B,CAAC;KAChD,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,OAAO,CACtB,8BAA8B,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE;QACtD,MAAM,EAAE,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,IAAI;QAC9C,SAAS,EAAE,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI;QAChD,cAAc,EAAE,MAAM;KACtB,CAAC,CACF,CAAC;IACF,OAAO,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAChC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACvC,GAAmB,EACnB,IAAY,EACZ,SAAiB,EACjB,IAAoB;IAEpB,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC3D,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACrE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,YAAY,KAAK,MAAM,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAClE,OAAO,OAAO,CAAC;AAChB,CAAC"}

package/dist/handlers/definitionVersions.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Version handlers: list, upload, read, delete, and a version's cached schema.
+ *
+ * Reads resolve through `getVisibleDefinition` / `loadVisibleVersion`, which
+ * return `null` rather than throwing, so an invisible definition answers 404.
+ * A 403 anywhere here would confirm a guid exists across a tenant boundary.
+ */
+import type { ApiHandler } from '../api/index.js';
+export declare const listVersions: ApiHandler;
+/** Upload a new version. Advances `draft`; `live` is unchanged until publish. */
+export declare const uploadVersion: ApiHandler;
+/**
+ * Version metadata. `schema` is excluded and served by the `/schema`
+ * sub-resource, so a version read never carries a several-hundred-KB blob.
+ */
+export declare const getVersion: ApiHandler;
+/**
+ * Delete an old version. The store throws 409 if the version is currently
+ * referenced by `liveVersionId` or `draftVersionId` — repoint first.
+ */
+export declare const deleteVersion: ApiHandler;
+/**
+ * The UI schema cached on this version at upload. Reads what is stored — no
+ * Rhino.Compute round-trip, unlike the pre-upload `POST /api/v1/compute/schema`.
+ *
+ * Schemas belong to a version, so this is the canonical location;
+ * `/definitions/{guid}/schema` is an alias for the live one.
+ */
+export declare const getVersionSchema: ApiHandler;
+//# sourceMappingURL=definitionVersions.d.ts.map

package/dist/handlers/definitionVersions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"definitionVersions.d.ts","sourceRoot":"","sources":["../../src/handlers/definitionVersions.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAcH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAYlD,eAAO,MAAM,YAAY,EAAE,UAa1B,CAAC;AAEF,iFAAiF;AACjF,eAAO,MAAM,aAAa,EAAE,UAgC3B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,UAAU,EAAE,UASxB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,aAAa,EAAE,UAO3B,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,EAAE,UAW9B,CAAC"}