@selvajs/server 1.2.0 → 1.3.1

package/dist/api/responses-schema.d.ts

@@ -0,0 +1,158 @@
+/**
+ * Response schemas for the v1 payloads that must not carry a stored secret.
+ *
+ * Three store types hold a credential next to fields a client legitimately
+ * reads: `ShareLink.tokenHash` and `Invite.tokenHash` are HMACs of a token,
+ * `ComputeServerCommon.apiKey` is a live Rhino.Compute key. Handlers used to
+ * strip them by destructuring — `const { tokenHash: _omit, ...rest } = invite`
+ * — which works until someone adds a field to the stored type or edits the line
+ * away. Nothing fails at build time; the credential just starts appearing in a
+ * response.
+ *
+ * Parsing through these schemas inverts the default: the response carries only
+ * what the schema names, so a new field on the stored type is invisible to
+ * clients until added here on purpose. Use them via `shaped`/`shapedCollection`
+ * in `./route.ts`.
+ *
+ * These describe **responses**, not stored records — where the two differ (an
+ * invite's one-time `acceptUrl`, a share link's `hasToken` sentinel) the
+ * response is the authority.
+ */
+import { z } from 'zod';
+export declare const ShareLinkResponseSchema: z.ZodObject<{
+    id: z.ZodString;
+    definitionId: z.ZodString;
+    channel: z.ZodEnum<{
+        draft: "draft";
+        live: "live";
+    }>;
+    name: z.ZodOptional<z.ZodString>;
+    createdBy: z.ZodString;
+    createdAt: z.ZodString;
+    expiresAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    revokedAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    allowSolve: z.ZodBoolean;
+    maxSolves: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    solveCount: z.ZodNumber;
+    hasToken: z.ZodLiteral<true>;
+}, z.core.$strip>;
+export type ShareLinkResponse = z.infer<typeof ShareLinkResponseSchema>;
+/** The mint response. `token` is the plaintext, returned exactly once. */
+export declare const CreatedShareLinkResponseSchema: z.ZodObject<{
+    link: z.ZodObject<{
+        id: z.ZodString;
+        definitionId: z.ZodString;
+        channel: z.ZodEnum<{
+            draft: "draft";
+            live: "live";
+        }>;
+        name: z.ZodOptional<z.ZodString>;
+        createdBy: z.ZodString;
+        createdAt: z.ZodString;
+        expiresAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        revokedAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        allowSolve: z.ZodBoolean;
+        maxSolves: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        solveCount: z.ZodNumber;
+        hasToken: z.ZodLiteral<true>;
+    }, z.core.$strip>;
+    token: z.ZodString;
+}, z.core.$strip>;
+export declare const InviteResponseSchema: z.ZodObject<{
+    id: z.ZodString;
+    email: z.ZodString;
+    orgId: z.ZodString;
+    orgRole: z.ZodString;
+    orgPermissions: z.ZodArray<z.ZodString>;
+    platformPermissions: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    invitedBy: z.ZodString;
+    createdAt: z.ZodString;
+    expiresAt: z.ZodString;
+    acceptedAt: z.ZodOptional<z.ZodString>;
+    acceptedByUserId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * The create response: the invite plus the link to send, built per request.
+ *
+ * `acceptUrl` is returned whatever `delivery` says — mail is best-effort, and
+ * manual sharing is the fallback when it is off or the send failed.
+ */
+export declare const CreatedInviteResponseSchema: z.ZodObject<{
+    id: z.ZodString;
+    email: z.ZodString;
+    orgId: z.ZodString;
+    orgRole: z.ZodString;
+    orgPermissions: z.ZodArray<z.ZodString>;
+    platformPermissions: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    invitedBy: z.ZodString;
+    createdAt: z.ZodString;
+    expiresAt: z.ZodString;
+    acceptedAt: z.ZodOptional<z.ZodString>;
+    acceptedByUserId: z.ZodOptional<z.ZodString>;
+    acceptUrl: z.ZodString;
+    delivery: z.ZodEnum<{
+        sent: "sent";
+        "not-configured": "not-configured";
+        failed: "failed";
+    }>;
+}, z.core.$strip>;
+/**
+ * An org-owned compute server. `apiKey` is replaced by `hasApiKey`, so a picker
+ * can render "key set" without any store decrypting a secret to throw away.
+ */
+export declare const OrgComputeServerResponseSchema: z.ZodObject<{
+    id: z.ZodString;
+    label: z.ZodString;
+    serverUrl: z.ZodString;
+    scope: z.ZodLiteral<"org">;
+    ownerOrgId: z.ZodString;
+    timeoutMs: z.ZodOptional<z.ZodNumber>;
+    retryCount: z.ZodOptional<z.ZodNumber>;
+    hasApiKey: z.ZodBoolean;
+}, z.core.$strip>;
+/** A server this org may select but not edit. Never carries a key either. */
+export declare const ComputeCatalogEntrySchema: z.ZodObject<{
+    id: z.ZodString;
+    label: z.ZodString;
+    serverUrl: z.ZodString;
+    scope: z.ZodEnum<{
+        org: "org";
+        platform: "platform";
+    }>;
+    source: z.ZodEnum<{
+        org: "org";
+        platform: "platform";
+    }>;
+    timeoutMs: z.ZodOptional<z.ZodNumber>;
+    retryCount: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+export declare const OrgComputeResponseSchema: z.ZodObject<{
+    servers: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        label: z.ZodString;
+        serverUrl: z.ZodString;
+        scope: z.ZodLiteral<"org">;
+        ownerOrgId: z.ZodString;
+        timeoutMs: z.ZodOptional<z.ZodNumber>;
+        retryCount: z.ZodOptional<z.ZodNumber>;
+        hasApiKey: z.ZodBoolean;
+    }, z.core.$strip>>;
+    defaultServerId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    globalDefaultServerId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    catalog: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        label: z.ZodString;
+        serverUrl: z.ZodString;
+        scope: z.ZodEnum<{
+            org: "org";
+            platform: "platform";
+        }>;
+        source: z.ZodEnum<{
+            org: "org";
+            platform: "platform";
+        }>;
+        timeoutMs: z.ZodOptional<z.ZodNumber>;
+        retryCount: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+//# sourceMappingURL=responses-schema.d.ts.map

package/dist/api/responses-schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"responses-schema.d.ts","sourceRoot":"","sources":["../../src/api/responses-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;iBAclC,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,0EAA0E;AAC1E,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;iBAGzC,CAAC;AAMH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;iBAY/B,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;iBAGtC,CAAC;AAMH;;;GAGG;AACH,eAAO,MAAM,8BAA8B;;;;;;;;;iBASzC,CAAC;AAEH,6EAA6E;AAC7E,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;iBAQpC,CAAC;AAEH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAKnC,CAAC"}

package/dist/api/responses-schema.js

@@ -0,0 +1,104 @@
+/**
+ * Response schemas for the v1 payloads that must not carry a stored secret.
+ *
+ * Three store types hold a credential next to fields a client legitimately
+ * reads: `ShareLink.tokenHash` and `Invite.tokenHash` are HMACs of a token,
+ * `ComputeServerCommon.apiKey` is a live Rhino.Compute key. Handlers used to
+ * strip them by destructuring — `const { tokenHash: _omit, ...rest } = invite`
+ * — which works until someone adds a field to the stored type or edits the line
+ * away. Nothing fails at build time; the credential just starts appearing in a
+ * response.
+ *
+ * Parsing through these schemas inverts the default: the response carries only
+ * what the schema names, so a new field on the stored type is invisible to
+ * clients until added here on purpose. Use them via `shaped`/`shapedCollection`
+ * in `./route.ts`.
+ *
+ * These describe **responses**, not stored records — where the two differ (an
+ * invite's one-time `acceptUrl`, a share link's `hasToken` sentinel) the
+ * response is the authority.
+ */
+import { z } from 'zod';
+// ============================================================================
+// Share links
+// ============================================================================
+export const ShareLinkResponseSchema = z.object({
+    id: z.string(),
+    definitionId: z.string(),
+    channel: z.enum(['live', 'draft']),
+    name: z.string().optional(),
+    createdBy: z.string(),
+    createdAt: z.string(),
+    expiresAt: z.string().nullish(),
+    revokedAt: z.string().nullish(),
+    allowSolve: z.boolean(),
+    maxSolves: z.number().nullish(),
+    solveCount: z.number(),
+    /** Sentinel replacing `tokenHash`: a token exists, its hash is not yours. */
+    hasToken: z.literal(true)
+});
+/** The mint response. `token` is the plaintext, returned exactly once. */
+export const CreatedShareLinkResponseSchema = z.object({
+    link: ShareLinkResponseSchema,
+    token: z.string()
+});
+// ============================================================================
+// Invites
+// ============================================================================
+export const InviteResponseSchema = z.object({
+    id: z.string(),
+    email: z.string(),
+    orgId: z.string(),
+    orgRole: z.string(),
+    orgPermissions: z.array(z.string()),
+    platformPermissions: z.array(z.string()).default([]),
+    invitedBy: z.string(),
+    createdAt: z.string(),
+    expiresAt: z.string(),
+    acceptedAt: z.string().optional(),
+    acceptedByUserId: z.string().optional()
+});
+/**
+ * The create response: the invite plus the link to send, built per request.
+ *
+ * `acceptUrl` is returned whatever `delivery` says — mail is best-effort, and
+ * manual sharing is the fallback when it is off or the send failed.
+ */
+export const CreatedInviteResponseSchema = InviteResponseSchema.extend({
+    acceptUrl: z.string(),
+    delivery: z.enum(['sent', 'not-configured', 'failed'])
+});
+// ============================================================================
+// Org compute
+// ============================================================================
+/**
+ * An org-owned compute server. `apiKey` is replaced by `hasApiKey`, so a picker
+ * can render "key set" without any store decrypting a secret to throw away.
+ */
+export const OrgComputeServerResponseSchema = z.object({
+    id: z.string(),
+    label: z.string(),
+    serverUrl: z.string(),
+    scope: z.literal('org'),
+    ownerOrgId: z.string(),
+    timeoutMs: z.number().optional(),
+    retryCount: z.number().optional(),
+    hasApiKey: z.boolean()
+});
+/** A server this org may select but not edit. Never carries a key either. */
+export const ComputeCatalogEntrySchema = z.object({
+    id: z.string(),
+    label: z.string(),
+    serverUrl: z.string(),
+    scope: z.enum(['platform', 'org']),
+    source: z.enum(['platform', 'org']),
+    timeoutMs: z.number().optional(),
+    retryCount: z.number().optional()
+});
+export const OrgComputeResponseSchema = z.object({
+    servers: z.array(OrgComputeServerResponseSchema),
+    defaultServerId: z.string().nullish(),
+    globalDefaultServerId: z.string().nullish(),
+    catalog: z.array(ComputeCatalogEntrySchema)
+});
+//# sourceMappingURL=responses-schema.js.map

package/dist/api/responses-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"responses-schema.js","sourceRoot":"","sources":["../../src/api/responses-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,+EAA+E;AAC/E,cAAc;AACd,+EAA+E;AAE/E,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;IAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;IAC/B,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;IACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;IAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,6EAA6E;IAC7E,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;CACzB,CAAC,CAAC;AAIH,0EAA0E;AAC1E,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,IAAI,EAAE,uBAAuB;IAC7B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;CACjB,CAAC,CAAC;AAEH,+EAA+E;AAC/E,UAAU;AACV,+EAA+E;AAE/E,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnC,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACpD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,oBAAoB,CAAC,MAAM,CAAC;IACtE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,gBAAgB,EAAE,QAAQ,CAAC,CAAC;CACtD,CAAC,CAAC;AAEH,+EAA+E;AAC/E,cAAc;AACd,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACvB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;CACtB,CAAC,CAAC;AAEH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAClC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,8BAA8B,CAAC;IAChD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;IACrC,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;IAC3C,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC;CAC3C,CAAC,CAAC"}

package/dist/api/responses.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Response shapes shared by every handler.
+ *
+ * The pagination envelope in particular: a resource-named key would force each
+ * client to write one unwrapper per endpoint instead of one pagination helper,
+ * so every list endpoint returns `{ items, nextCursor? }` through `collection`
+ * rather than assembling it by hand.
+ */
+import type { ApiResponse } from './types.js';
+/** A paginated collection. The one envelope every list endpoint returns. */
+export declare function collection<T>(page: {
+    items: T[];
+    nextCursor?: string;
+}): ApiResponse;
+/** A created resource. */
+export declare function created<T>(body: T): ApiResponse;
+/** A successful mutation with nothing to say. */
+export declare function noContent(): ApiResponse;
+//# sourceMappingURL=responses.d.ts.map

package/dist/api/responses.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"responses.d.ts","sourceRoot":"","sources":["../../src/api/responses.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,4EAA4E;AAC5E,wBAAgB,UAAU,CAAC,CAAC,EAAE,IAAI,EAAE;IAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,WAAW,CAEpF;AAED,0BAA0B;AAC1B,wBAAgB,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,WAAW,CAE/C;AAED,iDAAiD;AACjD,wBAAgB,SAAS,IAAI,WAAW,CAEvC"}

package/dist/api/responses.js

@@ -0,0 +1,21 @@
+/**
+ * Response shapes shared by every handler.
+ *
+ * The pagination envelope in particular: a resource-named key would force each
+ * client to write one unwrapper per endpoint instead of one pagination helper,
+ * so every list endpoint returns `{ items, nextCursor? }` through `collection`
+ * rather than assembling it by hand.
+ */
+/** A paginated collection. The one envelope every list endpoint returns. */
+export function collection(page) {
+    return { body: { items: page.items, nextCursor: page.nextCursor } };
+}
+/** A created resource. */
+export function created(body) {
+    return { status: 201, body };
+}
+/** A successful mutation with nothing to say. */
+export function noContent() {
+    return { status: 204 };
+}
+//# sourceMappingURL=responses.js.map

package/dist/api/responses.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"responses.js","sourceRoot":"","sources":["../../src/api/responses.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,4EAA4E;AAC5E,MAAM,UAAU,UAAU,CAAI,IAAyC;IACtE,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;AACrE,CAAC;AAED,0BAA0B;AAC1B,MAAM,UAAU,OAAO,CAAI,IAAO;IACjC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,SAAS;IACxB,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AACxB,CAAC"}

package/dist/api/shaped.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Serializing a response through an explicit schema.
+ *
+ * **This is what keeps a secret from reaching a client by accident.** Several
+ * responses are store records with a credential removed — `tokenHash` on a
+ * share link or invite, `apiKey` on an org compute server. Parsing through a
+ * schema means the response carries only what the schema names, so a new field
+ * on the stored type is invisible until someone adds it here deliberately.
+ *
+ * Returning the record directly would put a credential hash on the wire with
+ * nothing failing at build time, which is why these live beside the handler
+ * contract rather than in each host.
+ */
+import type { ZodType } from 'zod';
+import type { ApiResponse } from './types.js';
+/** Serialize a payload through an explicit response schema. */
+export declare function shaped<T>(schema: ZodType<T>, payload: unknown, status?: number): ApiResponse;
+/** `shaped`, mapped over a page of records. */
+export declare function shapedCollection<T>(schema: ZodType<T>, page: {
+    items: unknown[];
+    nextCursor?: string;
+}): ApiResponse;
+//# sourceMappingURL=shaped.d.ts.map

package/dist/api/shaped.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shaped.d.ts","sourceRoot":"","sources":["../../src/api/shaped.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,KAAK,CAAC;AACnC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,+DAA+D;AAC/D,wBAAgB,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,SAAM,GAAG,WAAW,CAIzF;AAED,+CAA+C;AAC/C,wBAAgB,gBAAgB,CAAC,CAAC,EACjC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAClB,IAAI,EAAE;IAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAC7C,WAAW,CAOb"}

package/dist/api/shaped.js

@@ -0,0 +1,29 @@
+/**
+ * Serializing a response through an explicit schema.
+ *
+ * **This is what keeps a secret from reaching a client by accident.** Several
+ * responses are store records with a credential removed — `tokenHash` on a
+ * share link or invite, `apiKey` on an org compute server. Parsing through a
+ * schema means the response carries only what the schema names, so a new field
+ * on the stored type is invisible until someone adds it here deliberately.
+ *
+ * Returning the record directly would put a credential hash on the wire with
+ * nothing failing at build time, which is why these live beside the handler
+ * contract rather than in each host.
+ */
+/** Serialize a payload through an explicit response schema. */
+export function shaped(schema, payload, status = 200) {
+    // A response failing its own schema is a bug in the handler, not bad caller
+    // input — let it surface as a 500 rather than ship a half-valid body.
+    return { status, body: schema.parse(payload) };
+}
+/** `shaped`, mapped over a page of records. */
+export function shapedCollection(schema, page) {
+    return {
+        body: {
+            items: page.items.map((item) => schema.parse(item)),
+            nextCursor: page.nextCursor
+        }
+    };
+}
+//# sourceMappingURL=shaped.js.map

package/dist/api/shaped.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shaped.js","sourceRoot":"","sources":["../../src/api/shaped.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,+DAA+D;AAC/D,MAAM,UAAU,MAAM,CAAI,MAAkB,EAAE,OAAgB,EAAE,MAAM,GAAG,GAAG;IAC3E,4EAA4E;IAC5E,sEAAsE;IACtE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;AAChD,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,gBAAgB,CAC/B,MAAkB,EAClB,IAA+C;IAE/C,OAAO;QACN,IAAI,EAAE;YACL,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACnD,UAAU,EAAE,IAAI,CAAC,UAAU;SAC3B;KACD,CAAC;AACH,CAAC"}

package/dist/api/types.d.ts

@@ -0,0 +1,41 @@
+/**
+ * The transport-free handler contract.
+ *
+ * A handler receives an `ApiRequest` and returns an `ApiResponse`. Neither type
+ * names a web framework, so the same handler mounts under SvelteKit, Next, Hono
+ * or an in-process call. What used to arrive as SvelteKit's `RequestEvent` is
+ * split into the four things handlers actually read — measured across the v1
+ * routes, that was `locals.ctx`, `locals.user`, `locals.log` and
+ * `locals.profile`, nothing else.
+ */
+import type { AuthUser, ILogger, RequestContext, UserProfile } from '@selvajs/platform';
+import type { SelvaDeps } from './deps.js';
+export interface ApiRequest {
+    /** Per-request identity + scope. Present only once authenticated. */
+    ctx?: RequestContext;
+    user?: AuthUser;
+    profile?: UserProfile;
+    /** Carries requestId/method/route. Prefer over a root logger. */
+    log: ILogger;
+    /** Path params, already extracted by the host router. */
+    params: Record<string, string | undefined>;
+    url: URL;
+    /** The raw request, for bodies and headers. */
+    request: Request;
+    /** Everything the handler talks to. Injected, never module-global. */
+    deps: SelvaDeps;
+}
+/**
+ * What a handler returns. `body` is serialized as JSON unless it is already a
+ * `Response` (binary endpoints — file downloads, mesh streams) or `undefined`
+ * (204). Keeping this a value rather than a `Response` is what lets a host
+ * choose its own serialization; a handler that built its own `Response` would
+ * force every host to accept web-standard `Response` semantics.
+ */
+export interface ApiResponse {
+    status?: number;
+    body?: unknown;
+    headers?: Record<string, string>;
+}
+export type ApiHandler = (req: ApiRequest) => Promise<ApiResponse | Response>;
+//# sourceMappingURL=types.d.ts.map

package/dist/api/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/api/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACxF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAE3C,MAAM,WAAW,UAAU;IAC1B,qEAAqE;IACrE,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,iEAAiE;IACjE,GAAG,EAAE,OAAO,CAAC;IACb,yDAAyD;IACzD,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC3C,GAAG,EAAE,GAAG,CAAC;IACT,+CAA+C;IAC/C,OAAO,EAAE,OAAO,CAAC;IACjB,sEAAsE;IACtE,IAAI,EAAE,SAAS,CAAC;CAChB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED,MAAM,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,UAAU,KAAK,OAAO,CAAC,WAAW,GAAG,QAAQ,CAAC,CAAC"}

package/dist/api/types.js

@@ -0,0 +1,12 @@
+/**
+ * The transport-free handler contract.
+ *
+ * A handler receives an `ApiRequest` and returns an `ApiResponse`. Neither type
+ * names a web framework, so the same handler mounts under SvelteKit, Next, Hono
+ * or an in-process call. What used to arrive as SvelteKit's `RequestEvent` is
+ * split into the four things handlers actually read — measured across the v1
+ * routes, that was `locals.ctx`, `locals.user`, `locals.log` and
+ * `locals.profile`, nothing else.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/api/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/api/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG"}

package/dist/compute/errors.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Compute error types, kept in a leaf module with no imports.
+ *
+ * Separate from the function that throws them on purpose: an error mapper needs
+ * nothing but the class to `instanceof` against, and importing it from beside
+ * the throw site drags that module's dependencies into every mapper. Anything
+ * an error mapper imports belongs here.
+ */
+/**
+ * Thrown when no compute server is configured or visible for the org — a
+ * misconfiguration an operator must fix in `/admin/compute`, not a bug. Routes
+ * map this to 503 instead of letting the pure helper's plain `Error` surface as
+ * a generic 500.
+ */
+export declare class ComputeServerUnconfiguredError extends Error {
+    constructor(message?: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/compute/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/compute/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;;GAKG;AACH,qBAAa,8BAA+B,SAAQ,KAAK;gBAEvD,OAAO,SAA6E;CAKrF"}

package/dist/compute/errors.js

@@ -0,0 +1,21 @@
+/**
+ * Compute error types, kept in a leaf module with no imports.
+ *
+ * Separate from the function that throws them on purpose: an error mapper needs
+ * nothing but the class to `instanceof` against, and importing it from beside
+ * the throw site drags that module's dependencies into every mapper. Anything
+ * an error mapper imports belongs here.
+ */
+/**
+ * Thrown when no compute server is configured or visible for the org — a
+ * misconfiguration an operator must fix in `/admin/compute`, not a bug. Routes
+ * map this to 503 instead of letting the pure helper's plain `Error` surface as
+ * a generic 500.
+ */
+export class ComputeServerUnconfiguredError extends Error {
+    constructor(message = 'No compute server configured. Ask an admin to add one in /admin/compute.') {
+        super(message);
+        this.name = 'ComputeServerUnconfiguredError';
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/compute/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/compute/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;;GAKG;AACH,MAAM,OAAO,8BAA+B,SAAQ,KAAK;IACxD,YACC,OAAO,GAAG,0EAA0E;QAEpF,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAC;IAC9C,CAAC;CACD"}

package/dist/compute/evict-changed-servers.d.ts

@@ -0,0 +1,22 @@
+/**
+ * A warm compute client caches on server `id`, so a rotated `serverUrl`/`apiKey`
+ * keeps the same cache key with stale connection details — it never ages out on
+ * its own. The config-write path has to evict explicitly.
+ *
+ * The eviction sink is a parameter rather than an import: which cache holds the
+ * warm clients is the host's decision, and importing one would drag a whole
+ * solve engine into every consumer that only wants the diff.
+ */
+/** The connection-identifying fields — a change in either makes the warm client stale. */
+export interface ServerConnection {
+    id: string;
+    serverUrl: string;
+    apiKey?: string;
+}
+/**
+ * Drop the warm client for every server that was removed or whose connection
+ * details changed. `prev` and `next` are the scoped server sets before and
+ * after the write; unchanged servers are left alone.
+ */
+export declare function evictChangedServers(prev: readonly ServerConnection[], next: readonly ServerConnection[], evict: (id: string) => void): void;
+//# sourceMappingURL=evict-changed-servers.d.ts.map

package/dist/compute/evict-changed-servers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evict-changed-servers.d.ts","sourceRoot":"","sources":["../../src/compute/evict-changed-servers.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,0FAA0F;AAC1F,MAAM,WAAW,gBAAgB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAClC,IAAI,EAAE,SAAS,gBAAgB,EAAE,EACjC,IAAI,EAAE,SAAS,gBAAgB,EAAE,EACjC,KAAK,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,GACzB,IAAI,CAgBN"}

package/dist/compute/evict-changed-servers.js

@@ -0,0 +1,31 @@
+/**
+ * A warm compute client caches on server `id`, so a rotated `serverUrl`/`apiKey`
+ * keeps the same cache key with stale connection details — it never ages out on
+ * its own. The config-write path has to evict explicitly.
+ *
+ * The eviction sink is a parameter rather than an import: which cache holds the
+ * warm clients is the host's decision, and importing one would drag a whole
+ * solve engine into every consumer that only wants the diff.
+ */
+/**
+ * Drop the warm client for every server that was removed or whose connection
+ * details changed. `prev` and `next` are the scoped server sets before and
+ * after the write; unchanged servers are left alone.
+ */
+export function evictChangedServers(prev, next, evict) {
+    const nextById = new Map(next.map((s) => [s.id, s]));
+    // Removed: no longer in `next`.
+    for (const before of prev) {
+        if (!nextById.has(before.id))
+            evict(before.id);
+    }
+    // Rotated: same id, different URL or key.
+    const prevById = new Map(prev.map((s) => [s.id, s]));
+    for (const after of next) {
+        const before = prevById.get(after.id);
+        if (before && (before.serverUrl !== after.serverUrl || before.apiKey !== after.apiKey)) {
+            evict(after.id);
+        }
+    }
+}
+//# sourceMappingURL=evict-changed-servers.js.map

package/dist/compute/evict-changed-servers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evict-changed-servers.js","sourceRoot":"","sources":["../../src/compute/evict-changed-servers.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AASH;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAClC,IAAiC,EACjC,IAAiC,EACjC,KAA2B;IAE3B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAErD,gCAAgC;IAChC,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,CAAC;QAC3B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,0CAA0C;IAC1C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YACxF,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;IACF,CAAC;AACF,CAAC"}

package/dist/compute/idempotency-http.d.ts

@@ -0,0 +1,47 @@
+/**
+ * The HTTP layer over {@link createIdempotencyStore}: how a replayed response
+ * is keyed, snapshotted, and identified on the wire.
+ *
+ * The store itself is generic over `T` and knows nothing about requests. This
+ * is the part two hosts must agree on to implement the same `Idempotency-Key`
+ * contract, and the part each would otherwise reinvent:
+ *
+ *   - **The key namespaces by caller.** `Idempotency-Key` is client-chosen, so
+ *     two tenants can pick the same string. Without the caller in the key one
+ *     would replay the other's result — that is the whole security property
+ *     here, and a host that got it wrong would leak across tenants with
+ *     nothing failing at build time.
+ *   - **The response round-trips through a snapshot.** A `Response` body reads
+ *     exactly once, so storing the object itself replays an empty body.
+ *   - **A replay says so**, via `Idempotency-Replayed`. A client that cannot
+ *     tell a replay from a fresh run cannot tell a successful retry from a
+ *     second execution.
+ *
+ * How long a response stays replayable is *not* here: that trades a client's
+ * retry window against serving a stale result after the underlying resource
+ * moves, and only the host knows its own deadlines.
+ */
+/** Header stamped on a replayed response, so a client can distinguish one. */
+export declare const IDEMPOTENCY_REPLAYED_HEADER = "Idempotency-Replayed";
+/**
+ * A response flattened into something storable. Kept instead of the `Response`
+ * because a body can only be read once.
+ */
+export interface StoredResponse {
+    status: number;
+    headers: [string, string][];
+    body: ArrayBuffer;
+}
+/**
+ * Namespace a client-chosen key by its caller.
+ *
+ * `callerId` should be the narrowest identity available — a token id rather
+ * than a user id where the host issues per-token credentials, so two tokens
+ * held by one user do not share replays.
+ */
+export declare function idempotencyKey(callerId: string, clientKey: string): string;
+/** Flatten a response so it can be replayed. Consumes the body. */
+export declare function toStoredResponse(res: Response): Promise<StoredResponse>;
+/** Rebuild a live `Response` from a snapshot, marking it when it is a replay. */
+export declare function fromStoredResponse(stored: StoredResponse, replayed: boolean): Response;
+//# sourceMappingURL=idempotency-http.d.ts.map

package/dist/compute/idempotency-http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"idempotency-http.d.ts","sourceRoot":"","sources":["../../src/compute/idempotency-http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,8EAA8E;AAC9E,eAAO,MAAM,2BAA2B,yBAAyB,CAAC;AAElE;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;IAC5B,IAAI,EAAE,WAAW,CAAC;CAClB;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAE1E;AAED,mEAAmE;AACnE,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,cAAc,CAAC,CAM7E;AAED,iFAAiF;AACjF,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,OAAO,GAAG,QAAQ,CAItF"}