@selvajs/server 1.2.0 → 1.3.0

package/dist/organizations/org-asset-service.d.ts

@@ -0,0 +1,39 @@
+import type { IOrgStore, IStorageProvider, OrgAssetKind, RequestContext } from '@selvajs/platform';
+/**
+ * Orchestrates org-asset writes that span IStorageProvider + IOrgStore — one
+ * service for every asset kind (logo, favicon, …).
+ *
+ * Every upload is rasterized to WebP by the shared transcoder inside
+ * `IStorageProvider.put`, so the stored blob is always
+ * `orgs/{id}/branding/{kind}.webp` (the `branding/` segment marks the public
+ * asset class — see `classifyAssetPath`). SVG inputs are flattened to a
+ * 1200px raster — no vector blob is persisted, which keeps the served bytes
+ * XSS-free without a sanitizer. Re-uploads overwrite in place. The org's
+ * `assets` map is the source of truth for which kinds exist and their public
+ * URLs; we read-merge-write it so concurrent edits to *different* kinds don't
+ * clobber each other within a kind.
+ *
+ * Re-uploads overwrite the same path, so the stored URL would be identical
+ * across replaces and a cached browser/CDN would keep serving the old bytes.
+ * The content-derived `?v=` token (`withCacheBust`) gives a *different* image a
+ * *different* URL, while an identical re-upload keeps its URL and stays cached.
+ */
+export declare class OrgAssetService {
+    private orgs;
+    private storage;
+    constructor(orgs: IOrgStore, storage: IStorageProvider);
+    /**
+     * Store `kind`'s blob and point the org's `assets[kind]` at its public URL.
+     * `contentType` must be the *original* upload type (e.g. `image/svg+xml`) so
+     * the transcoder recognizes the bytes as an image. Returns the public URL.
+     */
+    saveAsset(ctx: RequestContext, orgId: string, kind: OrgAssetKind, data: Uint8Array, contentType: string): Promise<string>;
+    /** Remove `kind`'s blob and drop it from the org's `assets` map. No-op-safe. */
+    removeAsset(ctx: RequestContext, orgId: string, kind: OrgAssetKind): Promise<void>;
+    /**
+     * Read the org's current `assets` and return a copy with `kind` set to `url`
+     * (or removed when `url` is undefined). Keeps the other kinds intact.
+     */
+    private mergedAssets;
+}
+//# sourceMappingURL=org-asset-service.d.ts.map

package/dist/organizations/org-asset-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-asset-service.d.ts","sourceRoot":"","sources":["../../src/organizations/org-asset-service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGnG;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,eAAe;IAE1B,OAAO,CAAC,IAAI;IACZ,OAAO,CAAC,OAAO;gBADP,IAAI,EAAE,SAAS,EACf,OAAO,EAAE,gBAAgB;IAGlC;;;;OAIG;IACG,SAAS,CACd,GAAG,EAAE,cAAc,EACnB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,YAAY,EAClB,IAAI,EAAE,UAAU,EAChB,WAAW,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC;IAelB,gFAAgF;IAC1E,WAAW,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAOxF;;;OAGG;YACW,YAAY;CAa1B"}

package/dist/organizations/org-asset-service.js

@@ -0,0 +1,71 @@
+import { createHash } from 'node:crypto';
+import { orgPaths, ProviderError, withCacheBust } from '@selvajs/platform';
+/**
+ * Orchestrates org-asset writes that span IStorageProvider + IOrgStore — one
+ * service for every asset kind (logo, favicon, …).
+ *
+ * Every upload is rasterized to WebP by the shared transcoder inside
+ * `IStorageProvider.put`, so the stored blob is always
+ * `orgs/{id}/branding/{kind}.webp` (the `branding/` segment marks the public
+ * asset class — see `classifyAssetPath`). SVG inputs are flattened to a
+ * 1200px raster — no vector blob is persisted, which keeps the served bytes
+ * XSS-free without a sanitizer. Re-uploads overwrite in place. The org's
+ * `assets` map is the source of truth for which kinds exist and their public
+ * URLs; we read-merge-write it so concurrent edits to *different* kinds don't
+ * clobber each other within a kind.
+ *
+ * Re-uploads overwrite the same path, so the stored URL would be identical
+ * across replaces and a cached browser/CDN would keep serving the old bytes.
+ * The content-derived `?v=` token (`withCacheBust`) gives a *different* image a
+ * *different* URL, while an identical re-upload keeps its URL and stays cached.
+ */
+export class OrgAssetService {
+    orgs;
+    storage;
+    constructor(orgs, storage) {
+        this.orgs = orgs;
+        this.storage = storage;
+    }
+    /**
+     * Store `kind`'s blob and point the org's `assets[kind]` at its public URL.
+     * `contentType` must be the *original* upload type (e.g. `image/svg+xml`) so
+     * the transcoder recognizes the bytes as an image. Returns the public URL.
+     */
+    async saveAsset(ctx, orgId, kind, data, contentType) {
+        const path = orgPaths.asset(orgId, kind);
+        await this.storage.put(path, data, contentType);
+        // Content-derived token, not a timestamp: an identical re-upload to the
+        // same path keeps the same URL and stays cached; a changed image gets a
+        // new URL and refetches immediately. 8 hex chars is enough to distinguish
+        // versions without bloating the URL.
+        const token = createHash('sha256').update(data).digest('hex').slice(0, 8);
+        const url = withCacheBust(this.storage.getPublicUrl(path), token);
+        await this.orgs.updateOrg(ctx, orgId, {
+            assets: await this.mergedAssets(ctx, orgId, kind, url)
+        });
+        return url;
+    }
+    /** Remove `kind`'s blob and drop it from the org's `assets` map. No-op-safe. */
+    async removeAsset(ctx, orgId, kind) {
+        await this.storage.delete(orgPaths.asset(orgId, kind));
+        await this.orgs.updateOrg(ctx, orgId, {
+            assets: await this.mergedAssets(ctx, orgId, kind, undefined)
+        });
+    }
+    /**
+     * Read the org's current `assets` and return a copy with `kind` set to `url`
+     * (or removed when `url` is undefined). Keeps the other kinds intact.
+     */
+    async mergedAssets(ctx, orgId, kind, url) {
+        const org = await this.orgs.getOrg(ctx, orgId);
+        if (!org)
+            throw new ProviderError(`Org '${orgId}' not found`, 404);
+        const next = { ...(org.assets ?? {}) };
+        if (url === undefined)
+            delete next[kind];
+        else
+            next[kind] = url;
+        return next;
+    }
+}
+//# sourceMappingURL=org-asset-service.js.map

package/dist/organizations/org-asset-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-asset-service.js","sourceRoot":"","sources":["../../src/organizations/org-asset-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAE3E;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,OAAO,eAAe;IAElB;IACA;IAFT,YACS,IAAe,EACf,OAAyB;QADzB,SAAI,GAAJ,IAAI,CAAW;QACf,YAAO,GAAP,OAAO,CAAkB;IAC/B,CAAC;IAEJ;;;;OAIG;IACH,KAAK,CAAC,SAAS,CACd,GAAmB,EACnB,KAAa,EACb,IAAkB,EAClB,IAAgB,EAChB,WAAmB;QAEnB,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACzC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;QAChD,wEAAwE;QACxE,wEAAwE;QACxE,0EAA0E;QAC1E,qCAAqC;QACrC,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1E,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;QAClE,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,EAAE;YACrC,MAAM,EAAE,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC;SACtD,CAAC,CAAC;QACH,OAAO,GAAG,CAAC;IACZ,CAAC;IAED,gFAAgF;IAChF,KAAK,CAAC,WAAW,CAAC,GAAmB,EAAE,KAAa,EAAE,IAAkB;QACvE,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QACvD,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,EAAE;YACrC,MAAM,EAAE,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC;SAC5D,CAAC,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,YAAY,CACzB,GAAmB,EACnB,KAAa,EACb,IAAkB,EAClB,GAAuB;QAEvB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC/C,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,aAAa,CAAC,QAAQ,KAAK,aAAa,EAAE,GAAG,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,EAA4B,CAAC;QACjE,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;;YACpC,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;QACtB,OAAO,IAAI,CAAC;IACb,CAAC;CACD"}

package/dist/projects/create-project.d.ts

@@ -0,0 +1,30 @@
+import type { Project, RequestContext } from '@selvajs/platform';
+/**
+ * Fields the caller decides. `slug`, `createdAt`, `updatedAt` and `deletedAt`
+ * are derived here so the two create routes cannot disagree about them.
+ */
+export type ProjectDraft = Omit<Project, 'slug' | 'createdAt' | 'updatedAt' | 'deletedAt'>;
+export interface CreateProjectOptions {
+    /** Context the store writes under — `SYSTEM_CONTEXT` for the admin route. */
+    writeCtx: RequestContext;
+    /** Slug stem when the name slugifies to nothing. */
+    fallbackSlug: string;
+    /** Spliced into the 409 on a duplicate name. */
+    conflictScope: string;
+}
+/**
+ * Create a project, retrying on slug collision.
+ *
+ * The retry is not a nicety: the caller may not be able to *see* a colliding
+ * project under RLS, so a pre-flight `getProjectBySlug` cannot decide it — the
+ * unique index is the only source of truth.
+ *
+ * `/api/v1/projects` and `/api/admin/projects` both create projects and both
+ * carried a copy of this loop. The copies had already drifted on three points
+ * (error re-throw, slug stem, flag validation), which is what makes this the
+ * one place in the access surface where duplication caused real divergence.
+ */
+export declare function createProjectWithUniqueSlug(store: {
+    createProject(ctx: RequestContext, project: Project): Promise<unknown>;
+}, draft: ProjectDraft, { writeCtx, fallbackSlug, conflictScope }: CreateProjectOptions): Promise<Project>;
+//# sourceMappingURL=create-project.d.ts.map

package/dist/projects/create-project.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-project.d.ts","sourceRoot":"","sources":["../../src/projects/create-project.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAyBjE;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,WAAW,GAAG,WAAW,GAAG,WAAW,CAAC,CAAC;AAE3F,MAAM,WAAW,oBAAoB;IACpC,6EAA6E;IAC7E,QAAQ,EAAE,cAAc,CAAC;IACzB,oDAAoD;IACpD,YAAY,EAAE,MAAM,CAAC;IACrB,gDAAgD;IAChD,aAAa,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,2BAA2B,CAChD,KAAK,EAAE;IACN,aAAa,CAAC,GAAG,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACvE,EACD,KAAK,EAAE,YAAY,EACnB,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAE,EAAE,oBAAoB,GAC7D,OAAO,CAAC,OAAO,CAAC,CAmClB"}

package/dist/projects/create-project.js

@@ -0,0 +1,56 @@
+import { ProviderError, slugify } from '@selvajs/platform';
+import { apiError, ApiErrorCode } from '../api/errors.js';
+const MAX_SLUG_ATTEMPTS = 25;
+// Both predicates match a Postgres constraint name inside an error message.
+// That is fragile enough that it must exist once: a renamed constraint breaks
+// silently — the retry loop stops retrying and a collision surfaces as a 500.
+function isSlugConflict(err) {
+    return (err instanceof ProviderError &&
+        err.statusCode === 409 &&
+        /projects_org_id_slug_key/.test(err.message));
+}
+function isNameConflict(err) {
+    return (err instanceof ProviderError &&
+        err.statusCode === 409 &&
+        /projects_org_name_unique/.test(err.message));
+}
+/**
+ * Create a project, retrying on slug collision.
+ *
+ * The retry is not a nicety: the caller may not be able to *see* a colliding
+ * project under RLS, so a pre-flight `getProjectBySlug` cannot decide it — the
+ * unique index is the only source of truth.
+ *
+ * `/api/v1/projects` and `/api/admin/projects` both create projects and both
+ * carried a copy of this loop. The copies had already drifted on three points
+ * (error re-throw, slug stem, flag validation), which is what makes this the
+ * one place in the access surface where duplication caused real divergence.
+ */
+export async function createProjectWithUniqueSlug(store, draft, { writeCtx, fallbackSlug, conflictScope }) {
+    const baseSlug = slugify(draft.name) || fallbackSlug;
+    const now = new Date().toISOString();
+    for (let attempt = 0; attempt < MAX_SLUG_ATTEMPTS; attempt++) {
+        const project = {
+            ...draft,
+            slug: attempt === 0 ? baseSlug : `${baseSlug}-${attempt + 1}`,
+            createdAt: now,
+            updatedAt: now,
+            deletedAt: null
+        };
+        try {
+            await store.createProject(writeCtx, project);
+            return project;
+        }
+        catch (err) {
+            if (isNameConflict(err)) {
+                apiError(409, ApiErrorCode.CONFLICT, `A project with that name already exists in ${conflictScope}.`);
+            }
+            // A slug clash is the one error worth another attempt; everything else
+            // leaves the loop for the route's error wrapper to map.
+            if (!isSlugConflict(err))
+                throw err;
+        }
+    }
+    apiError(409, ApiErrorCode.CONFLICT, 'Could not pick a unique project slug after several attempts.');
+}
+//# sourceMappingURL=create-project.js.map

package/dist/projects/create-project.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-project.js","sourceRoot":"","sources":["../../src/projects/create-project.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAE1D,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B,4EAA4E;AAC5E,8EAA8E;AAC9E,8EAA8E;AAC9E,SAAS,cAAc,CAAC,GAAY;IACnC,OAAO,CACN,GAAG,YAAY,aAAa;QAC5B,GAAG,CAAC,UAAU,KAAK,GAAG;QACtB,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAC5C,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,GAAY;IACnC,OAAO,CACN,GAAG,YAAY,aAAa;QAC5B,GAAG,CAAC,UAAU,KAAK,GAAG;QACtB,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAC5C,CAAC;AACH,CAAC;AAiBD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAChD,KAEC,EACD,KAAmB,EACnB,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAwB;IAE/D,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC;IACrD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAErC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,iBAAiB,EAAE,OAAO,EAAE,EAAE,CAAC;QAC9D,MAAM,OAAO,GAAY;YACxB,GAAG,KAAK;YACR,IAAI,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,IAAI,OAAO,GAAG,CAAC,EAAE;YAC7D,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,IAAI;SACf,CAAC;QAEF,IAAI,CAAC;YACJ,MAAM,KAAK,CAAC,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC7C,OAAO,OAAO,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzB,QAAQ,CACP,GAAG,EACH,YAAY,CAAC,QAAQ,EACrB,8CAA8C,aAAa,GAAG,CAC9D,CAAC;YACH,CAAC;YACD,uEAAuE;YACvE,wDAAwD;YACxD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC;gBAAE,MAAM,GAAG,CAAC;QACrC,CAAC;IACF,CAAC;IAED,QAAQ,CACP,GAAG,EACH,YAAY,CAAC,QAAQ,EACrB,8DAA8D,CAC9D,CAAC;AACH,CAAC"}

package/dist/projects/index.d.ts

@@ -0,0 +1,2 @@
+export { createProjectWithUniqueSlug, type ProjectDraft, type CreateProjectOptions } from './create-project.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/projects/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/projects/index.ts"],"names":[],"mappings":"AAEA,OAAO,EACN,2BAA2B,EAC3B,KAAK,YAAY,EACjB,KAAK,oBAAoB,EACzB,MAAM,qBAAqB,CAAC"}

package/dist/projects/index.js

@@ -0,0 +1,3 @@
+// Project writes whose rules two routes must agree on.
+export { createProjectWithUniqueSlug } from './create-project.js';
+//# sourceMappingURL=index.js.map

package/dist/projects/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/projects/index.ts"],"names":[],"mappings":"AAAA,uDAAuD;AAEvD,OAAO,EACN,2BAA2B,EAG3B,MAAM,qBAAqB,CAAC"}

package/dist/providers/auth-lookup.d.ts

@@ -0,0 +1,14 @@
+import type { AuthUser, IAuthProvider } from '@selvajs/platform';
+/**
+ * `IAuthProvider` has no by-email lookup and `listUsers` takes no filter, so
+ * this scans. Acceptable because the only caller is invite acceptance — once
+ * per invite, never on a hot path.
+ *
+ * A truncated scan would report an existing user as absent and send the flow
+ * down the create-account branch, where the provider rejects the duplicate. So
+ * exhausting the cursor matters: `null` must mean "not found", not "gave up".
+ * Returns `null` when the provider has no user store (`listUsers` → null) or
+ * when the cap is hit.
+ */
+export declare function findAuthUserByEmail(auth: IAuthProvider, email: string): Promise<AuthUser | null>;
+//# sourceMappingURL=auth-lookup.d.ts.map

package/dist/providers/auth-lookup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-lookup.d.ts","sourceRoot":"","sources":["../../src/providers/auth-lookup.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAOjE;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CACxC,IAAI,EAAE,aAAa,EACnB,KAAK,EAAE,MAAM,GACX,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAc1B"}

package/dist/providers/auth-lookup.js

@@ -0,0 +1,34 @@
+const PAGE_LIMIT = 200;
+// Runaway guard against an adapter returning a non-advancing cursor.
+// 100 pages = 20k users, far past any deployment this product targets.
+const MAX_PAGES = 100;
+/**
+ * `IAuthProvider` has no by-email lookup and `listUsers` takes no filter, so
+ * this scans. Acceptable because the only caller is invite acceptance — once
+ * per invite, never on a hot path.
+ *
+ * A truncated scan would report an existing user as absent and send the flow
+ * down the create-account branch, where the provider rejects the duplicate. So
+ * exhausting the cursor matters: `null` must mean "not found", not "gave up".
+ * Returns `null` when the provider has no user store (`listUsers` → null) or
+ * when the cap is hit.
+ */
+export async function findAuthUserByEmail(auth, email) {
+    const needle = email.trim().toLowerCase();
+    if (!needle)
+        return null;
+    let cursor;
+    for (let page = 0; page < MAX_PAGES; page++) {
+        const result = await auth.listUsers({ limit: PAGE_LIMIT, cursor });
+        if (!result)
+            return null;
+        const hit = result.items.find((u) => u.email?.trim().toLowerCase() === needle);
+        if (hit)
+            return hit;
+        cursor = result.nextCursor;
+        if (!cursor)
+            return null;
+    }
+    return null;
+}
+//# sourceMappingURL=auth-lookup.js.map

package/dist/providers/auth-lookup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-lookup.js","sourceRoot":"","sources":["../../src/providers/auth-lookup.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,GAAG,GAAG,CAAC;AACvB,qEAAqE;AACrE,uEAAuE;AACvE,MAAM,SAAS,GAAG,GAAG,CAAC;AAEtB;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,IAAmB,EACnB,KAAa;IAEb,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC1C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,IAAI,MAA0B,CAAC;IAC/B,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;QACnE,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC;QAC/E,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC;QACpB,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC;QAC3B,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;IAC1B,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC"}

package/dist/providers/index.d.ts

@@ -1,2 +1,3 @@
 export { createSelvaProviders, type CreateSelvaProvidersOptions, type ProviderFactory, type ProviderRegistry, type SelvaProviderRuntime } from './create-selva-providers.js';
+export { findAuthUserByEmail } from './auth-lookup.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/providers/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/providers/index.ts"],"names":[],"mappings":"AAGA,OAAO,EACN,oBAAoB,EACpB,KAAK,2BAA2B,EAChC,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,MAAM,6BAA6B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/providers/index.ts"],"names":[],"mappings":"AAGA,OAAO,EACN,oBAAoB,EACpB,KAAK,2BAA2B,EAChC,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/providers/index.js

@@ -1,4 +1,5 @@
 // Configurable provider wiring — env-driven selection over a caller-supplied
 // registry, with a `selva.config.js` override hook.
 export { createSelvaProviders } from './create-selva-providers.js';
+export { findAuthUserByEmail } from './auth-lookup.js';
 //# sourceMappingURL=index.js.map

package/dist/providers/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/providers/index.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,oDAAoD;AAEpD,OAAO,EACN,oBAAoB,EAKpB,MAAM,6BAA6B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/providers/index.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,oDAAoD;AAEpD,OAAO,EACN,oBAAoB,EAKpB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/testing/harness.d.ts

@@ -0,0 +1,168 @@
+/**
+ * A host-agnostic harness for testing API handlers.
+ *
+ * Handlers are transport-free, but the tests around them were not: they built
+ * a SvelteKit `RequestEvent` and imported the Selva app's fixtures, so a second
+ * host could run the handlers and inherit none of the tests proving they work.
+ * That is the duplication this removes — a host wires a `TestHarness` once and
+ * gets the shared suites.
+ *
+ * Two things stay injected because no interface supplies them:
+ *   - {@link SeedAuthAdapter}, since identity has no portable creation method.
+ *   - `mapError`, since folding a host's own domain errors into the envelope is
+ *     by definition host-specific. Omitting it is not neutral: a host whose
+ *     guards throw something `runHandler` does not recognize gets a 500 where
+ *     production returns 403, and every status assertion silently weakens.
+ */
+import { emptyProfile, type AuthUser, type DefinitionRecord, type DefinitionVersion, type ILogger, type OrgMember, type OrgPermission, type OrgRole, type Organization, type PlatformPermission, type Project, type ProjectMember, type ProjectRole, type ProjectVisibility, type RequestContext, type SelvaConfig, type ShareLink } from '@selvajs/platform';
+import type { ApiError, ApiHandler, SelvaDeps } from '../api/index.js';
+import type { SeedAuthAdapter } from './seed-adapter.js';
+export interface TestHarness {
+    config: SelvaConfig;
+    auth: SeedAuthAdapter;
+    /** Folds host domain errors into the envelope, exactly as the host's adapter does. */
+    mapError?: (err: unknown) => ApiError | undefined;
+    /** Overrides merged onto the deps `callHandler` builds — token codecs, services, upload caps. */
+    deps?: Partial<Pick<SelvaDeps, 'tokens' | 'uploadLimits' | 'services'>>;
+    log?: ILogger;
+}
+/**
+ * Swallows output unless `LOUD=1`.
+ *
+ * `runHandler` logs through `req.log` on the 500 path. Without a logger a test
+ * that trips an unexpected 500 dies inside the error handler itself, which
+ * hides the error that caused it.
+ */
+export declare const silentLog: ILogger;
+export interface SeededUser {
+    id: string;
+    email: string;
+}
+export declare function seedUser(h: TestHarness, email: string, platformPermissions?: PlatformPermission[]): Promise<SeededUser>;
+export declare function seedOrg(h: TestHarness, opts: {
+    name: string;
+    slug: string;
+    ownerId: string;
+}): Promise<Organization>;
+export declare function seedOrgMember(h: TestHarness, opts: {
+    orgId: string;
+    userId: string;
+    role: OrgRole;
+    permissions?: OrgPermission[];
+}): Promise<OrgMember>;
+export declare function seedProject(h: TestHarness, opts: {
+    orgId: string;
+    name: string;
+    slug: string;
+    ownerId: string;
+    visibility?: ProjectVisibility;
+    autoJoinOnUpload?: boolean;
+}): Promise<Project>;
+export declare function seedProjectMember(h: TestHarness, opts: {
+    projectId: string;
+    userId: string;
+    role: ProjectRole;
+}): Promise<ProjectMember>;
+/**
+ * Grant platform-wide permissions to a seeded user.
+ *
+ * Replaces the whole set rather than adding to it, matching
+ * `IPermissionStore.set` — a test that means to add has to pass the existing
+ * permissions back in.
+ */
+export declare function grantPlatformPermissions(h: TestHarness, userId: string, perms: PlatformPermission[]): Promise<void>;
+export interface SeededDefinition {
+    record: DefinitionRecord;
+    version: DefinitionVersion;
+}
+/**
+ * A definition with one version, written through the host's `DefinitionService`
+ * rather than straight into the store.
+ *
+ * Going through the service is what makes the fixture match production: it is
+ * what allocates the version, writes the blob, and moves the channel pointer,
+ * and a test that seeded the record alone would exercise a definition no solve
+ * path can load.
+ */
+export declare function seedDefinition(h: TestHarness, opts: {
+    projectId: string;
+    ownerId: string;
+    displayName?: string;
+    guid?: string;
+}): Promise<SeededDefinition>;
+export interface SeededShareLink {
+    link: ShareLink;
+    rawToken: string;
+}
+/**
+ * A share link plus the plaintext token behind it.
+ *
+ * Minted through the harness's own codec, so the stored hash verifies against
+ * the same secret a handler resolves from `deps.tokens.shareLinks` — a second
+ * codec would hash to something no handler could ever match.
+ */
+export declare function seedShareLink(h: TestHarness, opts: {
+    definitionId: string;
+    channel?: 'live' | 'draft';
+    createdBy: string;
+    allowSolve?: boolean;
+    maxSolves?: number | null;
+    expiresAt?: string | null;
+}): Promise<SeededShareLink>;
+/**
+ * The harness a `callHandler` call should build its deps from, carried on the
+ * locals rather than passed alongside them.
+ *
+ * A test already threads `locals` from `actAs` into every call; making the
+ * harness a second argument would mean passing the same two values everywhere
+ * and would let them disagree — locals from one stack, deps from another, which
+ * type-checks and silently tests nothing.
+ */
+declare const HARNESS: unique symbol;
+export interface ActingLocals {
+    user: AuthUser;
+    ctx: RequestContext;
+    profile: ReturnType<typeof emptyProfile>;
+    providers: SelvaConfig;
+    log: ILogger;
+    [HARNESS]?: TestHarness;
+}
+/**
+ * Build the per-request identity a handler sees.
+ *
+ * Mirrors what a host's auth hook produces: one membership lookup, plus the
+ * instance-admin fallback to the first listed org for an admin who belongs to
+ * none. Keeping this aligned with the host is the point of testing against real
+ * stores rather than mocks — a fixture that invented its own `ctx` would prove
+ * the handler works under scope no request ever has.
+ */
+export declare function actAs(h: TestHarness, userId: string): Promise<ActingLocals>;
+export declare function anon(h: TestHarness): {
+    providers: SelvaConfig;
+    [HARNESS]?: TestHarness;
+};
+export interface CallHandlerOpts {
+    locals: unknown;
+    params?: Record<string, string>;
+    url?: string;
+    body?: unknown;
+    headers?: Record<string, string>;
+}
+export interface CallResult {
+    status: number;
+    headers: Headers;
+    json?: unknown;
+    text?: string;
+    location?: string;
+}
+/**
+ * Invoke an `ApiHandler` with no host framework in the loop.
+ *
+ * Still goes through `runHandler`, because that is the contract: it is what
+ * turns a thrown `ApiError` — or a host error `mapError` recognizes — into a
+ * status. Calling the handler bare would make every failure an exception and
+ * every status assertion untestable.
+ */
+export declare function callHandler(handler: ApiHandler, opts: CallHandlerOpts): Promise<CallResult>;
+export {};
+//# sourceMappingURL=harness.d.ts.map

package/dist/testing/harness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"harness.d.ts","sourceRoot":"","sources":["../../src/testing/harness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAIN,YAAY,EACZ,KAAK,QAAQ,EACb,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,OAAO,EACZ,KAAK,SAAS,EACd,KAAK,aAAa,EAClB,KAAK,OAAO,EACZ,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,KAAK,OAAO,EACZ,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,MAAM,mBAAmB,CAAC;AAG3B,OAAO,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAc,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACnF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEzD,MAAM,WAAW,WAAW;IAC3B,MAAM,EAAE,WAAW,CAAC;IACpB,IAAI,EAAE,eAAe,CAAC;IACtB,sFAAsF;IACtF,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,QAAQ,GAAG,SAAS,CAAC;IAClD,iGAAiG;IACjG,IAAI,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,GAAG,cAAc,GAAG,UAAU,CAAC,CAAC,CAAC;IACxE,GAAG,CAAC,EAAE,OAAO,CAAC;CACd;AAED;;;;;;GAMG;AACH,eAAO,MAAM,SAAS,EAAE,OAQD,CAAC;AAMxB,MAAM,WAAW,UAAU;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;CACd;AAED,wBAAsB,QAAQ,CAC7B,CAAC,EAAE,WAAW,EACd,KAAK,EAAE,MAAM,EACb,mBAAmB,GAAE,kBAAkB,EAAO,GAC5C,OAAO,CAAC,UAAU,CAAC,CAarB;AAED,wBAAsB,OAAO,CAC5B,CAAC,EAAE,WAAW,EACd,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACnD,OAAO,CAAC,YAAY,CAAC,CAevB;AAED,wBAAsB,aAAa,CAClC,CAAC,EAAE,WAAW,EACd,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,aAAa,EAAE,CAAA;CAAE,GACnF,OAAO,CAAC,SAAS,CAAC,CAcpB;AAED,wBAAsB,WAAW,CAChC,CAAC,EAAE,WAAW,EACd,IAAI,EAAE;IACL,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC3B,GACC,OAAO,CAAC,OAAO,CAAC,CA2BlB;AAED,wBAAsB,iBAAiB,CACtC,CAAC,EAAE,WAAW,EACd,IAAI,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAC5D,OAAO,CAAC,aAAa,CAAC,CAaxB;AAED;;;;;;GAMG;AACH,wBAAsB,wBAAwB,CAC7C,CAAC,EAAE,WAAW,EACd,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,kBAAkB,EAAE,GACzB,OAAO,CAAC,IAAI,CAAC,CAEf;AAMD,MAAM,WAAW,gBAAgB;IAChC,MAAM,EAAE,gBAAgB,CAAC;IACzB,OAAO,EAAE,iBAAiB,CAAC;CAC3B;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CACnC,CAAC,EAAE,WAAW,EACd,IAAI,EAAE;IACL,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;CACd,GACC,OAAO,CAAC,gBAAgB,CAAC,CAwB3B;AAED,MAAM,WAAW,eAAe;IAC/B,IAAI,EAAE,SAAS,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAClC,CAAC,EAAE,WAAW,EACd,IAAI,EAAE;IACL,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,GACC,OAAO,CAAC,eAAe,CAAC,CA4B1B;AAMD;;;;;;;;GAQG;AACH,QAAA,MAAM,OAAO,eAAgD,CAAC;AAE9D,MAAM,WAAW,YAAY;IAC5B,IAAI,EAAE,QAAQ,CAAC;IACf,GAAG,EAAE,cAAc,CAAC;IACpB,OAAO,EAAE,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC;IACzC,SAAS,EAAE,WAAW,CAAC;IACvB,GAAG,EAAE,OAAO,CAAC;IACb,CAAC,OAAO,CAAC,CAAC,EAAE,WAAW,CAAC;CACxB;AAED;;;;;;;;GAQG;AACH,wBAAsB,KAAK,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAwBjF;AAED,wBAAgB,IAAI,CAAC,CAAC,EAAE,WAAW,GAAG;IAAE,SAAS,EAAE,WAAW,CAAC;IAAC,CAAC,OAAO,CAAC,CAAC,EAAE,WAAW,CAAA;CAAE,CAExF;AAMD,MAAM,WAAW,eAAe;IAC/B,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,UAAU;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;GAOG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC,CA2CjG"}