@selvajs/supabase-provider 0.11.0

package/dist/data/SupabaseInviteStore.js

@@ -0,0 +1,159 @@
+import { NoopEventSink, ProviderError, actorFrom } from '@selvajs/platform';
+import { nextCursorFromRange, toRange } from './pagination.js';
+/**
+ * Invite store. `getByTokenHash` routes through a SECURITY DEFINER RPC so
+ * unauthenticated / just-signed-up callers can validate and consume the
+ * invite without RLS blocking them. The raw token is hashed at the route
+ * layer (the selva app's `invites/token.server.ts`); the store sees only the
+ * HMAC digest. Other operations (create, list, revoke) go through the normal
+ * REST API with RLS enforcing `manage_org_members`.
+ */
+export class SupabaseInviteStore {
+    clients;
+    events;
+    constructor(clients, events = new NoopEventSink()) {
+        this.clients = clients;
+        this.events = events;
+    }
+    async create(ctx, invite) {
+        const { error } = await this.clients
+            .forRequest(ctx)
+            .from('invites')
+            .insert(inviteToRow(invite));
+        if (error)
+            throw mapError(error);
+        await this.events.emit({
+            type: 'invite.created',
+            inviteId: invite.id,
+            orgId: invite.orgId,
+            email: invite.email,
+            actorId: actorFrom(ctx)
+        });
+    }
+    async getByTokenHash(ctx, tokenHash) {
+        // Use the SECURITY DEFINER RPC so the token itself is the capability —
+        // unauthenticated callers visiting /accept-invite can resolve it. The
+        // caller has already hashed the raw URL token; the RPC just looks up
+        // the row by digest.
+        const { data, error } = await this.clients
+            .forRequest(ctx)
+            .rpc('get_invite_by_token_hash', { h: tokenHash });
+        if (error)
+            throw mapError(error);
+        // rpc returns the matching row (or null). PostgREST may wrap it in
+        // an array depending on the signature — normalize both shapes.
+        const row = Array.isArray(data) ? data[0] : data;
+        return row ? rowToInvite(row) : null;
+    }
+    async listByOrg(ctx, orgId, opts) {
+        const range = toRange(opts);
+        const { data, error, count } = await this.clients
+            .forRequest(ctx)
+            .from('invites')
+            .select('*', { count: 'exact' })
+            .eq('org_id', orgId)
+            .order('created_at', { ascending: (opts?.orderDir ?? 'desc') === 'asc' })
+            .range(range.from, range.to);
+        if (error)
+            throw mapError(error);
+        const items = (data ?? []).map(rowToInvite);
+        return { items, nextCursor: nextCursorFromRange(range, items.length, count) };
+    }
+    async markAccepted(ctx, id, userId) {
+        // Direct UPDATE — the caller is authenticated (they just signed up).
+        // `markAccepted` is idempotent so we don't error if no row matches.
+        const { data, error } = await this.clients
+            .forRequest(ctx)
+            .from('invites')
+            .update({ accepted_at: new Date().toISOString(), accepted_by_user_id: userId })
+            .eq('id', id)
+            .is('accepted_at', null)
+            .select('org_id');
+        if (error)
+            throw mapError(error);
+        const row = data?.[0];
+        if (!row)
+            return;
+        await this.events.emit({
+            type: 'invite.accepted',
+            inviteId: id,
+            orgId: row.org_id,
+            userId,
+            actorId: actorFrom(ctx)
+        });
+    }
+    async revoke(ctx, id) {
+        const { data, error } = await this.clients
+            .forRequest(ctx)
+            .from('invites')
+            .delete()
+            .eq('id', id)
+            .is('accepted_at', null)
+            .select('org_id');
+        if (error)
+            throw mapError(error);
+        const row = data?.[0];
+        if (!row)
+            return;
+        await this.events.emit({
+            type: 'invite.revoked',
+            inviteId: id,
+            orgId: row.org_id,
+            actorId: actorFrom(ctx)
+        });
+    }
+    async deleteByOrg(ctx, orgId) {
+        const { error } = await this.clients
+            .forRequest(ctx)
+            .from('invites')
+            .delete()
+            .eq('org_id', orgId);
+        if (error)
+            throw mapError(error);
+    }
+}
+function rowToInvite(row) {
+    return {
+        id: row.id,
+        tokenHash: row.token_hash,
+        email: row.email,
+        orgId: row.org_id,
+        orgRole: row.org_role,
+        orgPermissions: row.org_permissions,
+        invitedBy: row.invited_by,
+        createdAt: row.created_at,
+        expiresAt: row.expires_at,
+        acceptedAt: row.accepted_at ?? undefined,
+        acceptedByUserId: row.accepted_by_user_id ?? undefined
+    };
+}
+function inviteToRow(i) {
+    return {
+        id: i.id,
+        token_hash: i.tokenHash,
+        email: i.email,
+        org_id: i.orgId,
+        org_role: i.orgRole,
+        org_permissions: i.orgPermissions,
+        invited_by: i.invitedBy,
+        created_at: i.createdAt,
+        expires_at: i.expiresAt,
+        accepted_at: i.acceptedAt ?? null,
+        accepted_by_user_id: i.acceptedByUserId ?? null
+    };
+}
+function mapError(e) {
+    const pg = e;
+    if (pg?.code === '23505')
+        return new ProviderError(pg.message ?? 'Duplicate record', 409);
+    if (pg?.code === '23503')
+        return new ProviderError(pg.message ?? 'Foreign key violation', 409);
+    if (e instanceof Error)
+        return e;
+    if (e && typeof e === 'object') {
+        const obj = e;
+        return new Error(obj.code ? `[${obj.code}] ${obj.message ?? ''}` : (obj.message ?? String(e)));
+    }
+    return new Error(String(e));
+}
+//# sourceMappingURL=SupabaseInviteStore.js.map

package/dist/data/SupabaseInviteStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SupabaseInviteStore.js","sourceRoot":"","sources":["../../src/data/SupabaseInviteStore.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE5E,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAE/D;;;;;;;GAOG;AACH,MAAM,OAAO,mBAAmB;IAEb;IACA;IAFlB,YACkB,OAAqB,EACrB,SAAqB,IAAI,aAAa,EAAE;QADxC,YAAO,GAAP,OAAO,CAAc;QACrB,WAAM,GAAN,MAAM,CAAkC;IACvD,CAAC;IAEJ,KAAK,CAAC,MAAM,CAAC,GAAmB,EAAE,MAAc;QAC/C,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO;aAClC,UAAU,CAAC,GAAG,CAAC;aACf,IAAI,CAAC,SAAS,CAAC;aACf,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9B,IAAI,KAAK;YAAE,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YACtB,IAAI,EAAE,gBAAgB;YACtB,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC;SACvB,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,GAAmB,EAAE,SAAiB;QAC1D,uEAAuE;QACvE,sEAAsE;QACtE,qEAAqE;QACrE,qBAAqB;QACrB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO;aACxC,UAAU,CAAC,GAAG,CAAC;aACf,GAAG,CAAC,0BAA0B,EAAE,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;QACpD,IAAI,KAAK;YAAE,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;QACjC,mEAAmE;QACnE,+DAA+D;QAC/D,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACjD,OAAO,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,GAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,GAAmB,EAAE,KAAa,EAAE,IAAkB;QACrE,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO;aAC/C,UAAU,CAAC,GAAG,CAAC;aACf,IAAI,CAAC,SAAS,CAAC;aACf,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;aAC/B,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC;aACnB,KAAK,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,CAAC,IAAI,EAAE,QAAQ,IAAI,MAAM,CAAC,KAAK,KAAK,EAAE,CAAC;aACxE,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;QAC9B,IAAI,KAAK;YAAE,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,KAAK,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC5C,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,mBAAmB,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;IAC/E,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,GAAmB,EAAE,EAAU,EAAE,MAAc;QACjE,qEAAqE;QACrE,oEAAoE;QACpE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO;aACxC,UAAU,CAAC,GAAG,CAAC;aACf,IAAI,CAAC,SAAS,CAAC;aACf,MAAM,CAAC,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,mBAAmB,EAAE,MAAM,EAAE,CAAC;aAC9E,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;aACZ,EAAE,CAAC,aAAa,EAAE,IAAI,CAAC;aACvB,MAAM,CAAC,QAAQ,CAAC,CAAC;QACnB,IAAI,KAAK;YAAE,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,GAAG,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YACtB,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,EAAE;YACZ,KAAK,EAAG,GAA0B,CAAC,MAAM;YACzC,MAAM;YACN,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC;SACvB,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAmB,EAAE,EAAU;QAC3C,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO;aACxC,UAAU,CAAC,GAAG,CAAC;aACf,IAAI,CAAC,SAAS,CAAC;aACf,MAAM,EAAE;aACR,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;aACZ,EAAE,CAAC,aAAa,EAAE,IAAI,CAAC;aACvB,MAAM,CAAC,QAAQ,CAAC,CAAC;QACnB,IAAI,KAAK;YAAE,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,GAAG,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YACtB,IAAI,EAAE,gBAAgB;YACtB,QAAQ,EAAE,EAAE;YACZ,KAAK,EAAG,GAA0B,CAAC,MAAM;YACzC,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC;SACvB,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,GAAmB,EAAE,KAAa;QACnD,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO;aAClC,UAAU,CAAC,GAAG,CAAC;aACf,IAAI,CAAC,SAAS,CAAC;aACf,MAAM,EAAE;aACR,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACtB,IAAI,KAAK;YAAE,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;CACD;AAgBD,SAAS,WAAW,CAAC,GAAc;IAClC,OAAO;QACN,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,KAAK,EAAE,GAAG,CAAC,MAAM;QACjB,OAAO,EAAE,GAAG,CAAC,QAAQ;QACrB,cAAc,EAAE,GAAG,CAAC,eAA2C;QAC/D,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,UAAU,EAAE,GAAG,CAAC,WAAW,IAAI,SAAS;QACxC,gBAAgB,EAAE,GAAG,CAAC,mBAAmB,IAAI,SAAS;KACtD,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,CAAS;IAC7B,OAAO;QACN,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,UAAU,EAAE,CAAC,CAAC,SAAS;QACvB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,MAAM,EAAE,CAAC,CAAC,KAAK;QACf,QAAQ,EAAE,CAAC,CAAC,OAAO;QACnB,eAAe,EAAE,CAAC,CAAC,cAAc;QACjC,UAAU,EAAE,CAAC,CAAC,SAAS;QACvB,UAAU,EAAE,CAAC,CAAC,SAAS;QACvB,UAAU,EAAE,CAAC,CAAC,SAAS;QACvB,WAAW,EAAE,CAAC,CAAC,UAAU,IAAI,IAAI;QACjC,mBAAmB,EAAE,CAAC,CAAC,gBAAgB,IAAI,IAAI;KAC/C,CAAC;AACH,CAAC;AAOD,SAAS,QAAQ,CAAC,CAAU;IAC3B,MAAM,EAAE,GAAG,CAAmB,CAAC;IAC/B,IAAI,EAAE,EAAE,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,aAAa,CAAC,EAAE,CAAC,OAAO,IAAI,kBAAkB,EAAE,GAAG,CAAC,CAAC;IAC1F,IAAI,EAAE,EAAE,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,aAAa,CAAC,EAAE,CAAC,OAAO,IAAI,uBAAuB,EAAE,GAAG,CAAC,CAAC;IAC/F,IAAI,CAAC,YAAY,KAAK;QAAE,OAAO,CAAC,CAAC;IACjC,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,CAAwC,CAAC;QACrD,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7B,CAAC"}

package/dist/data/SupabaseOrgStore.d.ts

@@ -0,0 +1,33 @@
+import type { IOrgStore, IEventSink, Organization, OrgMember, OrgRole, OrgPermission, RequestContext, ListOptions, Page } from '@selvajs/platform';
+import type { ClientBundle } from './client.js';
+/**
+ * Org + org-membership store backed by Postgres. The queries rely on RLS
+ * for per-user visibility; the service-role client bypasses those policies
+ * for admin paths (setup, janitor, tests).
+ *
+ * `createOrg` atomically seeds the creator as `owner` with every
+ * `OrgPermission` — otherwise under user-scoped RLS the creator would
+ * immediately lose visibility of their own org.
+ */
+export declare class SupabaseOrgStore implements IOrgStore {
+    private readonly clients;
+    private readonly events;
+    constructor(clients: ClientBundle, events?: IEventSink);
+    listOrgs(ctx: RequestContext, opts?: ListOptions): Promise<Page<Organization>>;
+    getOrg(ctx: RequestContext, id: string): Promise<Organization | null>;
+    getOrgBySlug(ctx: RequestContext, slug: string): Promise<Organization | null>;
+    createOrg(ctx: RequestContext, org: Organization): Promise<void>;
+    updateOrg(ctx: RequestContext, id: string, patch: Partial<Pick<Organization, 'name' | 'slug'>>): Promise<void>;
+    deleteOrg(ctx: RequestContext, id: string): Promise<void>;
+    listOrgMembers(ctx: RequestContext, orgId: string, opts?: ListOptions): Promise<Page<OrgMember>>;
+    getOrgMember(ctx: RequestContext, orgId: string, userId: string): Promise<OrgMember | null>;
+    findUserMembership(ctx: RequestContext, userId: string): Promise<{
+        org: Organization;
+        member: OrgMember;
+    } | null>;
+    addOrgMember(ctx: RequestContext, member: OrgMember): Promise<void>;
+    updateOrgMemberRole(ctx: RequestContext, orgId: string, userId: string, role: OrgRole): Promise<void>;
+    updateOrgMemberPermissions(ctx: RequestContext, orgId: string, userId: string, permissions: readonly OrgPermission[]): Promise<void>;
+    removeOrgMember(ctx: RequestContext, orgId: string, userId: string): Promise<void>;
+}
+//# sourceMappingURL=SupabaseOrgStore.d.ts.map

package/dist/data/SupabaseOrgStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SupabaseOrgStore.d.ts","sourceRoot":"","sources":["../../src/data/SupabaseOrgStore.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACX,SAAS,EACT,UAAU,EACV,YAAY,EACZ,SAAS,EACT,OAAO,EACP,aAAa,EACb,cAAc,EACd,WAAW,EACX,IAAI,EACJ,MAAM,mBAAmB,CAAC;AAQ3B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAGhD;;;;;;;;GAQG;AACH,qBAAa,gBAAiB,YAAW,SAAS;IAIhD,OAAO,CAAC,QAAQ,CAAC,OAAO;IAHzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAa;gBAGlB,OAAO,EAAE,YAAY,EACtC,MAAM,GAAE,UAAgC;IAKnC,QAAQ,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAe9E,MAAM,CAAC,GAAG,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAYrE,YAAY,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAY7E,SAAS,CAAC,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAyBhE,SAAS,CACd,GAAG,EAAE,cAAc,EACnB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC,GACjD,OAAO,CAAC,IAAI,CAAC;IAsBV,SAAS,CAAC,GAAG,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAyFzD,cAAc,CACnB,GAAG,EAAE,cAAc,EACnB,KAAK,EAAE,MAAM,EACb,IAAI,CAAC,EAAE,WAAW,GAChB,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAerB,YAAY,CACjB,GAAG,EAAE,cAAc,EACnB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GACZ,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IAatB,kBAAkB,CACvB,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,MAAM,GACZ,OAAO,CAAC;QAAE,GAAG,EAAE,YAAY,CAAC;QAAC,MAAM,EAAE,SAAS,CAAA;KAAE,GAAG,IAAI,CAAC;IA8BrD,YAAY,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAqBnE,mBAAmB,CACxB,GAAG,EAAE,cAAc,EACnB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO,GACX,OAAO,CAAC,IAAI,CAAC;IA2BV,0BAA0B,CAC/B,GAAG,EAAE,cAAc,EACnB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,SAAS,aAAa,EAAE,GACnC,OAAO,CAAC,IAAI,CAAC;IA0BV,eAAe,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CA0CxF"}

package/dist/data/SupabaseOrgStore.js

@@ -0,0 +1,455 @@
+import { DEFAULT_ORG_PERMISSIONS, ProviderError, auditSoftDelete, actorFrom, NoopEventSink } from '@selvajs/platform';
+import { nextCursorFromRange, orderColumn, toRange } from './pagination.js';
+/**
+ * Org + org-membership store backed by Postgres. The queries rely on RLS
+ * for per-user visibility; the service-role client bypasses those policies
+ * for admin paths (setup, janitor, tests).
+ *
+ * `createOrg` atomically seeds the creator as `owner` with every
+ * `OrgPermission` — otherwise under user-scoped RLS the creator would
+ * immediately lose visibility of their own org.
+ */
+export class SupabaseOrgStore {
+    clients;
+    events;
+    constructor(clients, events = new NoopEventSink()) {
+        this.clients = clients;
+        this.events = events;
+    }
+    async listOrgs(ctx, opts) {
+        const range = toRange(opts);
+        const direction = opts?.orderDir ?? 'desc';
+        const { data, error, count } = await this.clients
+            .forRequest(ctx)
+            .from('orgs')
+            .select('*', { count: 'exact' })
+            .is('deleted_at', null)
+            .order(orderColumn(opts?.orderBy), { ascending: direction === 'asc' })
+            .range(range.from, range.to);
+        if (error)
+            throw mapError(error);
+        const items = (data ?? []).map(rowToOrg);
+        return { items, nextCursor: nextCursorFromRange(range, items.length, count) };
+    }
+    async getOrg(ctx, id) {
+        const { data, error } = await this.clients
+            .forRequest(ctx)
+            .from('orgs')
+            .select('*')
+            .eq('id', id)
+            .is('deleted_at', null)
+            .maybeSingle();
+        if (error)
+            throw mapError(error);
+        return data ? rowToOrg(data) : null;
+    }
+    async getOrgBySlug(ctx, slug) {
+        const { data, error } = await this.clients
+            .forRequest(ctx)
+            .from('orgs')
+            .select('*')
+            .eq('slug', slug)
+            .is('deleted_at', null)
+            .maybeSingle();
+        if (error)
+            throw mapError(error);
+        return data ? rowToOrg(data) : null;
+    }
+    async createOrg(ctx, org) {
+        const client = this.clients.forRequest(ctx);
+        const { error } = await client.from('orgs').insert(orgToRow(org));
+        if (error)
+            throw mapError(error);
+        // Seed owner membership so user-scoped queries can see the org post-create.
+        // Service-role bypasses RLS, but the same code path runs for user-scoped
+        // callers — the membership row is what makes them visible to themselves.
+        // Upsert so a stale soft-deleted row from a prior org with the same id
+        // is reactivated rather than blocking creation.
+        const { error: memberError } = await client.from('org_members').upsert({
+            org_id: org.id,
+            user_id: org.ownerId,
+            role: 'owner',
+            permissions: [...DEFAULT_ORG_PERMISSIONS.owner],
+            joined_at: new Date().toISOString(),
+            deleted_at: null
+        }, { onConflict: 'org_id,user_id' });
+        if (memberError)
+            throw mapError(memberError);
+        await this.events.emit({ type: 'org.created', orgId: org.id, actorId: actorFrom(ctx) });
+    }
+    async updateOrg(ctx, id, patch) {
+        const row = {};
+        if (patch.name !== undefined)
+            row.name = patch.name;
+        if (patch.slug !== undefined)
+            row.slug = patch.slug;
+        if (Object.keys(row).length === 0)
+            return;
+        // `updated_at` is set by the trg_orgs_updated_at trigger; `updated_by`
+        // is not, so stamp it here. ctx.userId can be empty in system contexts —
+        // the DB FK is `on delete set null` so passing empty would fail; let it
+        // fall back to whatever's already on the row by omitting in that case.
+        if (ctx.userId)
+            row.updated_by = ctx.userId;
+        const { error, data } = await this.clients
+            .forRequest(ctx)
+            .from('orgs')
+            .update(row)
+            .eq('id', id)
+            .is('deleted_at', null)
+            .select('id');
+        if (error)
+            throw mapError(error);
+        if (!data || data.length === 0)
+            throw new ProviderError(`Org '${id}' not found`, 404);
+    }
+    async deleteOrg(ctx, id) {
+        // §9 soft-delete with cascade. Mirrors LocalOrgStore: org → org_members,
+        // projects → project_members, definitions. Hard delete is reserved for
+        // the background janitor; user-facing deletes preserve the audit trail.
+        const client = this.clients.forRequest(ctx);
+        const stamp = auditSoftDelete(ctx, ctx.userId);
+        const stampRow = stampToRow(stamp);
+        // Org itself.
+        const { error: orgErr, data: orgData } = await client
+            .from('orgs')
+            .update(stampRow)
+            .eq('id', id)
+            .is('deleted_at', null)
+            .select('id');
+        if (orgErr)
+            throw mapError(orgErr);
+        if (!orgData || orgData.length === 0)
+            throw new ProviderError(`Org '${id}' not found`, 404);
+        // Cascade: org_members.
+        const { error: omErr } = await client
+            .from('org_members')
+            .update(stampRow)
+            .eq('org_id', id)
+            .is('deleted_at', null);
+        if (omErr)
+            throw mapError(omErr);
+        // Cascade: projects in this org. Fetch IDs first so we can cascade to
+        // project_members and definitions in app code (Postgres FK CASCADE only
+        // fires on hard DELETE, which we're not doing here).
+        const { data: orgProjects, error: projFetchErr } = await client
+            .from('projects')
+            .select('id')
+            .eq('org_id', id)
+            .is('deleted_at', null);
+        if (projFetchErr)
+            throw mapError(projFetchErr);
+        const projectIds = (orgProjects ?? []).map((p) => p.id);
+        const { error: projErr } = await client
+            .from('projects')
+            .update(stampRow)
+            .eq('org_id', id)
+            .is('deleted_at', null);
+        if (projErr)
+            throw mapError(projErr);
+        if (projectIds.length > 0) {
+            const { error: pmErr } = await client
+                .from('project_members')
+                .update(stampRow)
+                .in('project_id', projectIds)
+                .is('deleted_at', null);
+            if (pmErr)
+                throw mapError(pmErr);
+            const { error: defErr } = await client
+                .from('definitions')
+                .update(stampRow)
+                .in('project_id', projectIds)
+                .is('deleted_at', null);
+            if (defErr)
+                throw mapError(defErr);
+        }
+        // Hard-delete tables that have no `deleted_at` column. SQL CASCADE on
+        // the org FK only fires for hard org deletes; we soft-delete, so we
+        // clean these up here. Pending invites to a dead org are unredeemable;
+        // stale compute config is operational state with no audit need.
+        const { error: invErr } = await client.from('invites').delete().eq('org_id', id);
+        if (invErr)
+            throw mapError(invErr);
+        const { error: cdErr } = await client
+            .from('compute_server_org_defaults')
+            .delete()
+            .eq('org_id', id);
+        if (cdErr)
+            throw mapError(cdErr);
+        const { error: shErr } = await client.from('compute_server_shares').delete().eq('org_id', id);
+        if (shErr)
+            throw mapError(shErr);
+        const { error: csErr } = await client
+            .from('compute_servers')
+            .delete()
+            .eq('scope', 'org')
+            .eq('owner_org_id', id);
+        if (csErr)
+            throw mapError(csErr);
+        await this.events.emit({ type: 'org.deleted', orgId: id, actorId: actorFrom(ctx) });
+    }
+    // ============================================================================
+    // Org members
+    // ============================================================================
+    async listOrgMembers(ctx, orgId, opts) {
+        const range = toRange(opts);
+        const { data, error, count } = await this.clients
+            .forRequest(ctx)
+            .from('org_members')
+            .select('*', { count: 'exact' })
+            .eq('org_id', orgId)
+            .is('deleted_at', null)
+            .order('joined_at', { ascending: (opts?.orderDir ?? 'desc') === 'asc' })
+            .range(range.from, range.to);
+        if (error)
+            throw mapError(error);
+        const items = (data ?? []).map(rowToOrgMember);
+        return { items, nextCursor: nextCursorFromRange(range, items.length, count) };
+    }
+    async getOrgMember(ctx, orgId, userId) {
+        const { data, error } = await this.clients
+            .forRequest(ctx)
+            .from('org_members')
+            .select('*')
+            .eq('org_id', orgId)
+            .eq('user_id', userId)
+            .is('deleted_at', null)
+            .maybeSingle();
+        if (error)
+            throw mapError(error);
+        return data ? rowToOrgMember(data) : null;
+    }
+    async findUserMembership(ctx, userId) {
+        // One round-trip: join org_members → orgs and filter live rows on
+        // both sides. PostgREST `!inner` on the join keeps it a single SELECT,
+        // avoiding the listOrgs + getOrgMember-per-org N+1 the bootstrap path
+        // used to do. RLS still scopes by ctx; service-role sees all.
+        const { data, error } = await this.clients
+            .forRequest(ctx)
+            .from('org_members')
+            .select('*, org:orgs!inner(*)')
+            .eq('user_id', userId)
+            .is('deleted_at', null)
+            .is('org.deleted_at', null)
+            .order('joined_at', { ascending: true })
+            .limit(1)
+            .maybeSingle();
+        if (error)
+            throw mapError(error);
+        if (!data)
+            return null;
+        // PostgREST embeds the related row as `org` per the alias above. Strip
+        // it off the member row before mapping so OrgMember stays clean.
+        const row = data;
+        const orgRow = Array.isArray(row.org) ? row.org[0] : row.org;
+        if (!orgRow)
+            return null;
+        const { org: _omit, ...memberRow } = row;
+        return {
+            org: rowToOrg(orgRow),
+            member: rowToOrgMember(memberRow)
+        };
+    }
+    async addOrgMember(ctx, member) {
+        // Upsert so a prior soft-deleted row is reactivated rather than throwing
+        // a duplicate-key error. Mirrors LocalOrgStore.addOrgMember.
+        const row = {
+            ...memberToRow(member),
+            deleted_at: null
+        };
+        if (ctx.userId)
+            row.updated_by = ctx.userId;
+        const { error } = await this.clients
+            .forRequest(ctx)
+            .from('org_members')
+            .upsert(row, { onConflict: 'org_id,user_id' });
+        if (error)
+            throw mapError(error);
+        await this.events.emit({
+            type: 'org_member.added',
+            orgId: member.orgId,
+            userId: member.userId,
+            actorId: actorFrom(ctx)
+        });
+    }
+    async updateOrgMemberRole(ctx, orgId, userId, role) {
+        // Role change re-seeds default permissions. Matches LocalOrgStore.
+        const row = {
+            role,
+            permissions: [...DEFAULT_ORG_PERMISSIONS[role]]
+        };
+        if (ctx.userId)
+            row.updated_by = ctx.userId;
+        const { data, error } = await this.clients
+            .forRequest(ctx)
+            .from('org_members')
+            .update(row)
+            .eq('org_id', orgId)
+            .eq('user_id', userId)
+            .is('deleted_at', null)
+            .select('user_id');
+        if (error)
+            throw mapError(error);
+        if (!data || data.length === 0)
+            throw new ProviderError(`Org member '${userId}' not found`, 404);
+        await this.events.emit({
+            type: 'org_member.role_changed',
+            orgId,
+            userId,
+            role,
+            actorId: actorFrom(ctx)
+        });
+    }
+    async updateOrgMemberPermissions(ctx, orgId, userId, permissions) {
+        // Replace permissions only. Matches LocalOrgStore.updateOrgMemberPermissions —
+        // distinct from role change so callers can grant a finer-grained set without
+        // re-seeding defaults from the role.
+        const row = { permissions: [...permissions] };
+        if (ctx.userId)
+            row.updated_by = ctx.userId;
+        const { data, error } = await this.clients
+            .forRequest(ctx)
+            .from('org_members')
+            .update(row)
+            .eq('org_id', orgId)
+            .eq('user_id', userId)
+            .is('deleted_at', null)
+            .select('user_id');
+        if (error)
+            throw mapError(error);
+        if (!data || data.length === 0)
+            throw new ProviderError(`Org member '${userId}' not found`, 404);
+        await this.events.emit({
+            type: 'org_member.permissions_changed',
+            orgId,
+            userId,
+            permissions: [...permissions],
+            actorId: actorFrom(ctx)
+        });
+    }
+    async removeOrgMember(ctx, orgId, userId) {
+        // §9 cascade — losing org membership ends every project membership scoped
+        // to that tenant. Soft-delete the org_member row, then cascade-soft-delete
+        // the user's project_members for any project in this org. Run the project
+        // cascade BEFORE the org_member update so RLS policies that gate
+        // project_members on org_member existence still pass for the duration.
+        const client = this.clients.forRequest(ctx);
+        const stamp = auditSoftDelete(ctx, ctx.userId);
+        const stampRow = stampToRow(stamp);
+        const { data: orgProjects, error: projError } = await client
+            .from('projects')
+            .select('id')
+            .eq('org_id', orgId)
+            .is('deleted_at', null);
+        if (projError)
+            throw mapError(projError);
+        const projectIds = (orgProjects ?? []).map((p) => p.id);
+        if (projectIds.length > 0) {
+            const { error: pmError } = await client
+                .from('project_members')
+                .update(stampRow)
+                .in('project_id', projectIds)
+                .eq('user_id', userId)
+                .is('deleted_at', null);
+            if (pmError)
+                throw mapError(pmError);
+        }
+        const { error } = await client
+            .from('org_members')
+            .update(stampRow)
+            .eq('org_id', orgId)
+            .eq('user_id', userId)
+            .is('deleted_at', null);
+        if (error)
+            throw mapError(error);
+        await this.events.emit({
+            type: 'org_member.removed',
+            orgId,
+            userId,
+            actorId: actorFrom(ctx)
+        });
+    }
+}
+/**
+ * Build a row payload from an audit-soft-delete stamp. `updated_by` only
+ * goes into the row when ctx.userId is set — passing `''` would violate the
+ * `references auth.users(id)` FK on system contexts. The DB trigger sets
+ * `updated_at`, but for soft-delete we set it explicitly so it matches
+ * `deleted_at` (single timestamp for the deletion event).
+ */
+function stampToRow(stamp) {
+    const row = {
+        deleted_at: stamp.deletedAt,
+        updated_at: stamp.updatedAt
+    };
+    if (stamp.updatedBy)
+        row.updated_by = stamp.updatedBy;
+    return row;
+}
+function rowToOrg(row) {
+    return {
+        id: row.id,
+        name: row.name,
+        slug: row.slug,
+        ownerId: row.owner_id,
+        createdBy: row.created_by ?? row.owner_id,
+        updatedBy: row.updated_by ?? row.owner_id,
+        createdAt: row.created_at,
+        updatedAt: row.updated_at,
+        deletedAt: row.deleted_at ?? null
+    };
+}
+function orgToRow(org) {
+    return {
+        id: org.id,
+        name: org.name,
+        slug: org.slug,
+        owner_id: org.ownerId,
+        created_by: org.createdBy,
+        updated_by: org.updatedBy,
+        created_at: org.createdAt,
+        updated_at: org.updatedAt,
+        deleted_at: org.deletedAt ?? null
+    };
+}
+function rowToOrgMember(row) {
+    return {
+        orgId: row.org_id,
+        userId: row.user_id,
+        role: row.role,
+        permissions: (row.permissions ?? []),
+        joinedAt: row.joined_at,
+        updatedAt: row.updated_at ?? row.joined_at,
+        updatedBy: row.updated_by ?? row.user_id,
+        deletedAt: row.deleted_at ?? null
+    };
+}
+function memberToRow(m) {
+    return {
+        org_id: m.orgId,
+        user_id: m.userId,
+        role: m.role,
+        permissions: m.permissions ?? [],
+        joined_at: m.joinedAt
+    };
+}
+function mapError(e) {
+    const pg = e;
+    if (pg?.code === '23505') {
+        return new ProviderError(pg.message ?? 'Duplicate record', 409);
+    }
+    if (pg?.code === '23503') {
+        return new ProviderError(pg.message ?? 'Foreign key violation', 409);
+    }
+    if (e instanceof Error)
+        return e;
+    if (e && typeof e === 'object') {
+        const obj = e;
+        const msg = obj.message ?? obj.details ?? obj.hint ?? 'Unknown Postgres error';
+        const err = new Error(obj.code ? `[${obj.code}] ${msg}` : msg);
+        Object.assign(err, obj);
+        return err;
+    }
+    return new Error(String(e));
+}
+//# sourceMappingURL=SupabaseOrgStore.js.map