@selvajs/supabase-provider 0.14.3 → 0.14.4-beta.0

package/dist/data/__tests__/compute-server-encryption.test.js

@@ -0,0 +1,143 @@
+/**
+ * CI-runnable (no live stack) unit tests for at-rest encryption of
+ * `compute_servers.api_key`. Uses a minimal fake of the Supabase query builder
+ * that records `insert` payloads and serves canned `select` rows, so we can
+ * assert the exact bytes that would reach the DB without a real Postgres.
+ *
+ * The security property under test: a plaintext apiKey handed to the store is
+ * NEVER written verbatim — the DB only ever sees an `enc:v1:` envelope — and it
+ * round-trips back to plaintext on read.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { randomBytes } from 'node:crypto';
+import { isEncryptedSecret, decryptSecret } from '@selvajs/platform/computeServer';
+import { SupabaseComputeServerStore } from '../SupabaseComputeServerStore.js';
+const SYSTEM_CTX = { userId: '', system: true };
+const KEY = randomBytes(32);
+/**
+ * Records every `insert` payload and returns canned rows for each table's
+ * `select`. Only the fragments the store actually chains are implemented; the
+ * builder is thenable so `await client.from(...).select(...)` resolves.
+ */
+function fakeBundle(selectRows = {}) {
+    const inserted = {};
+    function builder(table) {
+        const result = { data: selectRows[table] ?? [], error: null };
+        const chain = {
+            select: () => ({
+                ...chain,
+                eq: () => ({ ...chain, maybeSingle: async () => ({ data: null, error: null }) }),
+                then: (resolve) => resolve(result)
+            }),
+            insert: (rows) => {
+                inserted[table] = (inserted[table] ?? []).concat(rows);
+                return { error: null };
+            },
+            delete: () => ({ eq: () => ({ eq: () => ({ error: null }), error: null }) }),
+            update: () => ({ eq: () => ({ error: null }) }),
+            upsert: () => ({ error: null })
+        };
+        return chain;
+    }
+    const client = { from: (t) => builder(t) };
+    const bundle = {
+        serviceClient: client,
+        forRequest: () => client
+    };
+    return { bundle, inserted };
+}
+describe('SupabaseComputeServerStore — apiKey encryption at rest', () => {
+    beforeEach(() => vi.restoreAllMocks());
+    it('encrypts apiKey before insert — DB never sees plaintext', async () => {
+        const { bundle, inserted } = fakeBundle();
+        const store = new SupabaseComputeServerStore(bundle, KEY);
+        await store.savePlatformServers(SYSTEM_CTX, [
+            {
+                id: 's1',
+                label: 'prod',
+                serverUrl: 'https://compute.example.com',
+                apiKey: 'super-secret-key',
+                scope: 'platform',
+                sharedWith: 'all'
+            }
+        ], 's1');
+        const rows = inserted['compute_servers'];
+        expect(rows).toHaveLength(1);
+        expect(rows[0].api_key).not.toBe('super-secret-key');
+        expect(isEncryptedSecret(rows[0].api_key)).toBe(true);
+        // And it's genuinely our plaintext under the envelope.
+        expect(decryptSecret(rows[0].api_key, KEY)).toBe('super-secret-key');
+    });
+    it('decrypts apiKey on read — callers see plaintext', async () => {
+        // Seed the "DB" with an already-encrypted row.
+        const { encryptSecret } = await import('@selvajs/platform/computeServer');
+        const envelope = encryptSecret('round-trip-key', KEY);
+        const { bundle } = fakeBundle({
+            compute_servers: [
+                {
+                    id: 's1',
+                    scope: 'platform',
+                    owner_org_id: null,
+                    shared_with_all: true,
+                    label: 'prod',
+                    server_url: 'https://compute.example.com',
+                    api_key: envelope,
+                    timeout_ms: null,
+                    retry_count: null
+                }
+            ]
+        });
+        const store = new SupabaseComputeServerStore(bundle, KEY);
+        const config = await store.getConfig(SYSTEM_CTX);
+        expect(config.servers).toHaveLength(1);
+        expect(config.servers[0].apiKey).toBe('round-trip-key');
+    });
+    it('throws rather than persist plaintext when no key is configured', async () => {
+        const { bundle } = fakeBundle();
+        const store = new SupabaseComputeServerStore(bundle); // no key
+        await expect(store.savePlatformServers(SYSTEM_CTX, [
+            {
+                id: 's1',
+                label: 'prod',
+                serverUrl: 'https://compute.example.com',
+                apiKey: 'secret',
+                scope: 'platform',
+                sharedWith: 'all'
+            }
+        ], 's1')).rejects.toThrow(/SELVA_AT_REST_KEY/);
+    });
+    it('verifySecrets flags a plaintext row', async () => {
+        const { bundle } = fakeBundle({
+            compute_servers: [{ id: 's1', label: 'legacy', api_key: 'raw-plaintext' }]
+        });
+        const store = new SupabaseComputeServerStore(bundle, KEY);
+        const report = await store.verifySecrets();
+        expect(report.ok).toBe(false);
+        expect(report.plaintextFound).toBe(true);
+        expect(report.failures).toEqual([
+            { serverId: 's1', serverLabel: 'legacy', reason: 'plaintext_on_disk' }
+        ]);
+    });
+    it('verifySecrets reports key_mismatch when the at-rest key rotated', async () => {
+        const { encryptSecret } = await import('@selvajs/platform/computeServer');
+        const envelope = encryptSecret('secret', randomBytes(32)); // different key
+        const { bundle } = fakeBundle({
+            compute_servers: [{ id: 's1', label: 'prod', api_key: envelope }]
+        });
+        const store = new SupabaseComputeServerStore(bundle, KEY);
+        const report = await store.verifySecrets();
+        expect(report.ok).toBe(false);
+        expect(report.plaintextFound).toBe(false);
+        expect(report.failures[0]).toMatchObject({ serverId: 's1', reason: 'key_mismatch' });
+    });
+    it('verifySecrets returns ok when every apiKey decrypts', async () => {
+        const { encryptSecret } = await import('@selvajs/platform/computeServer');
+        const { bundle } = fakeBundle({
+            compute_servers: [{ id: 's1', label: 'prod', api_key: encryptSecret('k', KEY) }]
+        });
+        const store = new SupabaseComputeServerStore(bundle, KEY);
+        const report = await store.verifySecrets();
+        expect(report).toEqual({ ok: true, failures: [], plaintextFound: false });
+    });
+});
+//# sourceMappingURL=compute-server-encryption.test.js.map

package/dist/data/__tests__/compute-server-encryption.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compute-server-encryption.test.js","sourceRoot":"","sources":["../../../src/data/__tests__/compute-server-encryption.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAEnF,OAAO,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AAG9E,MAAM,UAAU,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAA+B,CAAC;AAC7E,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;AAE5B;;;;GAIG;AACH,SAAS,UAAU,CAAC,aAAwC,EAAE;IAC7D,MAAM,QAAQ,GAA8B,EAAE,CAAC;IAE/C,SAAS,OAAO,CAAC,KAAa;QAC7B,MAAM,MAAM,GAAG,EAAE,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC9D,MAAM,KAAK,GAA4B;YACtC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;gBACd,GAAG,KAAK;gBACR,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;gBAChF,IAAI,EAAE,CAAC,OAAgC,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;aAC3D,CAAC;YACF,MAAM,EAAE,CAAC,IAAa,EAAE,EAAE;gBACzB,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAiB,CAAC,CAAC;gBACpE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YACxB,CAAC;YACD,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAC5E,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAC/C,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;SAC/B,CAAC;QACF,OAAO,KAAK,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,EAAE,IAAI,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IACnD,MAAM,MAAM,GAAG;QACd,aAAa,EAAE,MAAM;QACrB,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM;KACG,CAAC;IAC7B,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC7B,CAAC;AAED,QAAQ,CAAC,wDAAwD,EAAE,GAAG,EAAE;IACvE,UAAU,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;IAEvC,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,UAAU,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,IAAI,0BAA0B,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAE1D,MAAM,KAAK,CAAC,mBAAmB,CAC9B,UAAU,EACV;YACC;gBACC,EAAE,EAAE,IAAI;gBACR,KAAK,EAAE,MAAM;gBACb,SAAS,EAAE,6BAA6B;gBACxC,MAAM,EAAE,kBAAkB;gBAC1B,KAAK,EAAE,UAAU;gBACjB,UAAU,EAAE,KAAK;aACjB;SACD,EACD,IAAI,CACJ,CAAC;QAEF,MAAM,IAAI,GAAG,QAAQ,CAAC,iBAAiB,CAA+B,CAAC;QACvE,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACrD,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtD,uDAAuD;QACvD,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAChE,+CAA+C;QAC/C,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,iCAAiC,CAAC,CAAC;QAC1E,MAAM,QAAQ,GAAG,aAAa,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;QACtD,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC;YAC7B,eAAe,EAAE;gBAChB;oBACC,EAAE,EAAE,IAAI;oBACR,KAAK,EAAE,UAAU;oBACjB,YAAY,EAAE,IAAI;oBAClB,eAAe,EAAE,IAAI;oBACrB,KAAK,EAAE,MAAM;oBACb,UAAU,EAAE,6BAA6B;oBACzC,OAAO,EAAE,QAAQ;oBACjB,UAAU,EAAE,IAAI;oBAChB,WAAW,EAAE,IAAI;iBACjB;aACD;SACD,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,0BAA0B,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAE1D,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACjD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACvC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,IAAI,0BAA0B,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QAE/D,MAAM,MAAM,CACX,KAAK,CAAC,mBAAmB,CACxB,UAAU,EACV;YACC;gBACC,EAAE,EAAE,IAAI;gBACR,KAAK,EAAE,MAAM;gBACb,SAAS,EAAE,6BAA6B;gBACxC,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,UAAU;gBACjB,UAAU,EAAE,KAAK;aACjB;SACD,EACD,IAAI,CACJ,CACD,CAAC,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC;YAC7B,eAAe,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;SAC1E,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,0BAA0B,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAE1D,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE,CAAC;QAC3C,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC;YAC/B,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,mBAAmB,EAAE;SACtE,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,iCAAiC,CAAC,CAAC;QAC1E,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,gBAAgB;QAC3E,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC;YAC7B,eAAe,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;SACjE,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,0BAA0B,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAE1D,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE,CAAC;QAC3C,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,iCAAiC,CAAC,CAAC;QAC1E,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC;YAC7B,eAAe,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;SAChF,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,0BAA0B,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAE1D,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE,CAAC;QAC3C,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/data/__tests__/share-link-concurrency.test.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Audit Q4/Q5 — the concurrent-solve guarantee for share-link caps.
+ *
+ * `tryIncrementSolveCount` is the load-bearing race-sensitive method: the
+ * `/api/compute` endpoint calls it BEFORE solving and turns a `null` return
+ * (cap hit) into HTTP 429. Under concurrent solves against one capped link, the
+ * cap must hold exactly — no overshoot, no lost update handing two solves the
+ * same slot. Supabase provides this via the SECURITY DEFINER
+ * `try_increment_share_link_solve_count` RPC, which does the check-and-increment
+ * in a single statement.
+ *
+ * This lives in the Supabase suite (not the shared conformance suite or the app
+ * route tests) because it is the ONLY backend that actually provides the
+ * guarantee: the local provider's whole-file read-modify-write is a documented
+ * dev-scale tradeoff and is not concurrency-safe. Skipped without a live stack,
+ * matching the other conformance tests here.
+ *
+ * Complements the sequential cap/count tests at
+ * `packages/selva/src/routes/api/compute/__tests__/solve-cap-and-count.test.ts`.
+ */
+export {};
+//# sourceMappingURL=share-link-concurrency.test.d.ts.map

package/dist/data/__tests__/share-link-concurrency.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"share-link-concurrency.test.d.ts","sourceRoot":"","sources":["../../../src/data/__tests__/share-link-concurrency.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG"}

package/dist/data/__tests__/share-link-concurrency.test.js

@@ -0,0 +1,115 @@
+/**
+ * Audit Q4/Q5 — the concurrent-solve guarantee for share-link caps.
+ *
+ * `tryIncrementSolveCount` is the load-bearing race-sensitive method: the
+ * `/api/compute` endpoint calls it BEFORE solving and turns a `null` return
+ * (cap hit) into HTTP 429. Under concurrent solves against one capped link, the
+ * cap must hold exactly — no overshoot, no lost update handing two solves the
+ * same slot. Supabase provides this via the SECURITY DEFINER
+ * `try_increment_share_link_solve_count` RPC, which does the check-and-increment
+ * in a single statement.
+ *
+ * This lives in the Supabase suite (not the shared conformance suite or the app
+ * route tests) because it is the ONLY backend that actually provides the
+ * guarantee: the local provider's whole-file read-modify-write is a documented
+ * dev-scale tradeoff and is not concurrency-safe. Skipped without a live stack,
+ * matching the other conformance tests here.
+ *
+ * Complements the sequential cap/count tests at
+ * `packages/selva/src/routes/api/compute/__tests__/solve-cap-and-count.test.ts`.
+ */
+import { describe, it, expect, beforeEach } from 'vitest';
+import { SupabaseShareLinkStore } from '../SupabaseShareLinkStore.js';
+import { readEnv, resetAllData, seedUser } from './test-helpers.js';
+const envCtx = readEnv();
+if (!envCtx) {
+    describe.skip('SupabaseShareLinkStore concurrency (skipped: no live stack)', () => {
+        it('populate packages/providers/supabase/.env.test with Supabase creds to run these tests', () => { });
+    });
+}
+else {
+    const ctx = { userId: '', system: true };
+    /** Seed org → project → definition → share link, all via service-role. */
+    async function seedCappedLink(maxSolves) {
+        const { userId: ownerId } = await seedUser(envCtx, '');
+        const admin = envCtx.adminClient;
+        const orgId = crypto.randomUUID();
+        const projectId = crypto.randomUUID();
+        const definitionId = crypto.randomUUID();
+        const linkId = crypto.randomUUID();
+        const now = new Date().toISOString();
+        const { error: orgErr } = await admin.from('orgs').insert({
+            id: orgId,
+            name: 'Concurrency Org',
+            slug: `conc-${orgId.slice(0, 8)}`,
+            owner_id: ownerId,
+            created_at: now,
+            updated_at: now
+        });
+        if (orgErr)
+            throw orgErr;
+        const { error: projErr } = await admin.from('projects').insert({
+            id: projectId,
+            org_id: orgId,
+            name: 'Project',
+            slug: `proj-${projectId.slice(0, 8)}`,
+            visibility: 'public',
+            owner_id: ownerId,
+            created_at: now,
+            updated_at: now
+        });
+        if (projErr)
+            throw projErr;
+        const { error: defErr } = await admin.from('definitions').insert({
+            guid: definitionId,
+            project_id: projectId,
+            owner_id: ownerId,
+            display_name: 'Def',
+            status: 'published',
+            created_at: now,
+            updated_at: now
+        });
+        if (defErr)
+            throw defErr;
+        const link = {
+            id: linkId,
+            definitionId,
+            channel: 'live',
+            tokenHash: crypto.randomUUID().replace(/-/g, ''),
+            createdBy: ownerId,
+            createdAt: now,
+            expiresAt: null,
+            revokedAt: null,
+            allowSolve: true,
+            maxSolves,
+            solveCount: 0
+        };
+        const store = new SupabaseShareLinkStore(envCtx.bundle);
+        await store.create(ctx, link);
+        return { linkId };
+    }
+    describe('SupabaseShareLinkStore — concurrent solve-cap enforcement', () => {
+        beforeEach(async () => {
+            await resetAllData(envCtx);
+        });
+        it('N concurrent solves against a cap-K link admit exactly K, refuse the rest', async () => {
+            const CAP = 5;
+            const ATTEMPTS = 25;
+            const { linkId } = await seedCappedLink(CAP);
+            const store = new SupabaseShareLinkStore(envCtx.bundle);
+            const outcomes = await Promise.all(Array.from({ length: ATTEMPTS }, () => store.tryIncrementSolveCount(ctx, linkId)));
+            const admitted = outcomes.filter((n) => n !== null);
+            const refused = outcomes.filter((n) => n === null);
+            // Exactly CAP admitted — the atomic RPC never lets a concurrent burst
+            // overshoot the cap.
+            expect(admitted).toHaveLength(CAP);
+            expect(refused).toHaveLength(ATTEMPTS - CAP);
+            // Each admitted solve got a distinct slot 1..CAP — no lost update.
+            expect([...admitted].sort((a, b) => a - b)).toEqual([1, 2, 3, 4, 5]);
+            // The persisted count settles at exactly the cap.
+            const finalLink = await store.getById(ctx, linkId);
+            expect(finalLink?.solveCount).toBe(CAP);
+        });
+    });
+}
+//# sourceMappingURL=share-link-concurrency.test.js.map

package/dist/data/__tests__/share-link-concurrency.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"share-link-concurrency.test.js","sourceRoot":"","sources":["../../../src/data/__tests__/share-link-concurrency.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAE1D,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAEpE,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC;AAEzB,IAAI,CAAC,MAAM,EAAE,CAAC;IACb,QAAQ,CAAC,IAAI,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACjF,EAAE,CAAC,uFAAuF,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACvG,CAAC,CAAC,CAAC;AACJ,CAAC;KAAM,CAAC;IACP,MAAM,GAAG,GAAmB,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAoB,CAAC;IAE3E,0EAA0E;IAC1E,KAAK,UAAU,cAAc,CAAC,SAAiB;QAC9C,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAO,EAAE,EAAE,CAAC,CAAC;QACxD,MAAM,KAAK,GAAG,MAAO,CAAC,WAAW,CAAC;QAClC,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QACtC,MAAM,YAAY,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAErC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;YACzD,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,iBAAiB;YACvB,IAAI,EAAE,QAAQ,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;YACjC,QAAQ,EAAE,OAAO;YACjB,UAAU,EAAE,GAAG;YACf,UAAU,EAAE,GAAG;SACf,CAAC,CAAC;QACH,IAAI,MAAM;YAAE,MAAM,MAAM,CAAC;QACzB,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;YAC9D,EAAE,EAAE,SAAS;YACb,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,QAAQ,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;YACrC,UAAU,EAAE,QAAQ;YACpB,QAAQ,EAAE,OAAO;YACjB,UAAU,EAAE,GAAG;YACf,UAAU,EAAE,GAAG;SACf,CAAC,CAAC;QACH,IAAI,OAAO;YAAE,MAAM,OAAO,CAAC;QAC3B,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC;YAChE,IAAI,EAAE,YAAY;YAClB,UAAU,EAAE,SAAS;YACrB,QAAQ,EAAE,OAAO;YACjB,YAAY,EAAE,KAAK;YACnB,MAAM,EAAE,WAAW;YACnB,UAAU,EAAE,GAAG;YACf,UAAU,EAAE,GAAG;SACf,CAAC,CAAC;QACH,IAAI,MAAM;YAAE,MAAM,MAAM,CAAC;QAEzB,MAAM,IAAI,GAAc;YACvB,EAAE,EAAE,MAAM;YACV,YAAY;YACZ,OAAO,EAAE,MAAM;YACf,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;YAChD,SAAS,EAAE,OAAO;YAClB,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,IAAI;YACf,UAAU,EAAE,IAAI;YAChB,SAAS;YACT,UAAU,EAAE,CAAC;SACb,CAAC;QACF,MAAM,KAAK,GAAG,IAAI,sBAAsB,CAAC,MAAO,CAAC,MAAM,CAAC,CAAC;QACzD,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC9B,OAAO,EAAE,MAAM,EAAE,CAAC;IACnB,CAAC;IAED,QAAQ,CAAC,2DAA2D,EAAE,GAAG,EAAE;QAC1E,UAAU,CAAC,KAAK,IAAI,EAAE;YACrB,MAAM,YAAY,CAAC,MAAO,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;YAC1F,MAAM,GAAG,GAAG,CAAC,CAAC;YACd,MAAM,QAAQ,GAAG,EAAE,CAAC;YACpB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;YAC7C,MAAM,KAAK,GAAG,IAAI,sBAAsB,CAAC,MAAO,CAAC,MAAM,CAAC,CAAC;YAEzD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CACjC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,sBAAsB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CACjF,CAAC;YAEF,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;YACjE,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;YACnD,sEAAsE;YACtE,qBAAqB;YACrB,MAAM,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;YACnC,MAAM,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,QAAQ,GAAG,GAAG,CAAC,CAAC;YAC7C,mEAAmE;YACnE,MAAM,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAErE,kDAAkD;YAClD,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACnD,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACJ,CAAC"}

package/dist/data/client.d.ts

@@ -8,6 +8,24 @@ import type { RequestContext } from '@selvajs/platform';
  * `SupabaseClient` (which is pinned to `'public'`).
  */
 export type SelvaSchemaClient = SupabaseClient<any, 'public', 'selva'>;
+/** Default schema every engine store targets. */
+export declare const DEFAULT_SCHEMA: "selva";
+/**
+ * A client pinned to a caller-chosen schema. When the schema is `'selva'` this
+ * is the narrow `SelvaSchemaClient`; for an app-owned schema (e.g. `'public'`)
+ * the schema generic is opaque — the store surface (`.from` / `.rpc`) is the
+ * same either way.
+ */
+export type SchemaClient = SupabaseClient<any, string, any>;
+export interface ForRequestOptions {
+    /**
+     * Postgres schema this client targets. Defaults to `'selva'` (the engine's
+     * tables). Pass `'public'` (or another app schema) to build stores on the
+     * consuming app's own tables while keeping the same fail-closed RLS
+     * dispatch as the engine stores.
+     */
+    schema?: string;
+}
 /**
  * Build a Supabase client for a given `RequestContext`.
  *
@@ -33,15 +51,20 @@ export type SelvaSchemaClient = SupabaseClient<any, 'public', 'selva'>;
  * fetch connection without leaking auth across requests.
  */
 export interface ClientBundle {
-    /** Long-lived service-role client. Bypasses RLS. */
+    /** Long-lived service-role client, pinned to the `'selva'` schema. Bypasses RLS. */
     serviceClient: SelvaSchemaClient;
     /**
-     * Produce (or reuse) a client scoped to this request's identity.
+     * Produce (or reuse) a client scoped to this request's identity, targeting
+     * `opts.schema` (default `'selva'`).
      *  - `ctx.system === true` → service-role (RLS bypassed).
      *  - `ctx.adapterContext.sessionToken` set → user-scoped (RLS active).
      *  - neither → anon client (RLS active, no `auth.uid()`).
+     *
+     * The schema pin and the RLS dispatch travel together: an app building
+     * stores on its own `'public'` tables gets the same fail-closed behavior as
+     * engine stores, just aimed at a different schema.
      */
-    forRequest(ctx: RequestContext): SelvaSchemaClient;
+    forRequest(ctx: RequestContext, opts?: ForRequestOptions): SchemaClient;
 }
 export interface BuildClientOptions {
     supabaseUrl: string;
@@ -49,4 +72,13 @@ export interface BuildClientOptions {
     serviceRoleKey: string;
 }
 export declare function buildClientBundle(opts: BuildClientOptions): ClientBundle;
+/**
+ * Build a `ClientBundle` straight from environment variables — the
+ * `SUPABASE_URL` / `SUPABASE_ANON_KEY` / `SUPABASE_SERVICE_ROLE_KEY` triple,
+ * nothing else. Deliberately does NOT require `SELVA_AT_REST_KEY`: that key
+ * only matters for compute-server secret encryption, which a consuming app
+ * building its own `'public'` stores never touches. `SupabaseDataProvider.fromEnv`
+ * layers the at-rest-key requirement on top of this.
+ */
+export declare function clientBundleFromEnv(env: Record<string, string | undefined>): ClientBundle;
 //# sourceMappingURL=client.d.ts.map

package/dist/data/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/data/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC1E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAExD;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GAAG,cAAc,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;AAEvE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,WAAW,YAAY;IAC5B,oDAAoD;IACpD,aAAa,EAAE,iBAAiB,CAAC;IACjC;;;;;OAKG;IACH,UAAU,CAAC,GAAG,EAAE,cAAc,GAAG,iBAAiB,CAAC;CACnD;AAED,MAAM,WAAW,kBAAkB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;CACvB;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,kBAAkB,GAAG,YAAY,CAqCxE"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/data/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC1E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAExD;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GAAG,cAAc,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;AAEvE,iDAAiD;AACjD,eAAO,MAAM,cAAc,EAAG,OAAgB,CAAC;AAE/C;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;AAE5D,MAAM,WAAW,iBAAiB;IACjC;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,WAAW,YAAY;IAC5B,oFAAoF;IACpF,aAAa,EAAE,iBAAiB,CAAC;IACjC;;;;;;;;;;OAUG;IACH,UAAU,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,CAAC,EAAE,iBAAiB,GAAG,YAAY,CAAC;CACxE;AAED,MAAM,WAAW,kBAAkB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;CACvB;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,kBAAkB,GAAG,YAAY,CAoExE;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,YAAY,CAQzF"}

package/dist/data/client.js

@@ -1,39 +1,90 @@
 import { createClient } from '@supabase/supabase-js';
+/** Default schema every engine store targets. */
+export const DEFAULT_SCHEMA = 'selva';
 export function buildClientBundle(opts) {
-    const serviceClient = createClient(opts.supabaseUrl, opts.serviceRoleKey, {
-        db: { schema: 'selva' },
-        auth: { persistSession: false, autoRefreshToken: false }
-    });
-    // Long-lived anon client — the fail-closed default for ctxes that aren't
-    // explicitly system and don't carry a session token.
-    const anonClient = createClient(opts.supabaseUrl, opts.anonKey, {
-        db: { schema: 'selva' },
-        auth: { persistSession: false, autoRefreshToken: false }
-    });
+    // Long-lived service-role + anon clients, one per schema. Both are stateless
+    // w.r.t. request identity, so a single instance is safe to share across all
+    // requests targeting the same schema.
+    const serviceBySchema = new Map();
+    const anonBySchema = new Map();
+    function serviceFor(schema) {
+        let client = serviceBySchema.get(schema);
+        if (!client) {
+            client = createClient(opts.supabaseUrl, opts.serviceRoleKey, {
+                db: { schema },
+                auth: { persistSession: false, autoRefreshToken: false }
+            });
+            serviceBySchema.set(schema, client);
+        }
+        return client;
+    }
+    function anonFor(schema) {
+        let client = anonBySchema.get(schema);
+        if (!client) {
+            client = createClient(opts.supabaseUrl, opts.anonKey, {
+                db: { schema },
+                auth: { persistSession: false, autoRefreshToken: false }
+            });
+            anonBySchema.set(schema, client);
+        }
+        return client;
+    }
+    // The `'selva'`-pinned service client is exposed directly on the bundle for
+    // engine code that reaches for RLS-bypassing reads without a request context.
+    const serviceClient = serviceFor(DEFAULT_SCHEMA);
+    // Per-request user-scoped clients, keyed first by context then by schema so
+    // a handler that touches both `'selva'` and an app schema reuses one client
+    // per (request, schema) without leaking auth across requests.
     const perRequestCache = new WeakMap();
     return {
         serviceClient,
-        forRequest(ctx) {
+        forRequest(ctx, forOpts) {
+            const schema = forOpts?.schema ?? DEFAULT_SCHEMA;
             if (ctx.system)
-                return serviceClient;
+                return serviceFor(schema);
             const token = extractSessionToken(ctx.adapterContext);
             if (!token)
-                return anonClient;
-            const cached = perRequestCache.get(ctx);
+                return anonFor(schema);
+            let bySchema = perRequestCache.get(ctx);
+            if (!bySchema) {
+                bySchema = new Map();
+                perRequestCache.set(ctx, bySchema);
+            }
+            const cached = bySchema.get(schema);
             if (cached)
                 return cached;
             const client = createClient(opts.supabaseUrl, opts.anonKey, {
-                db: { schema: 'selva' },
+                db: { schema },
                 auth: { persistSession: false, autoRefreshToken: false },
                 global: {
                     headers: { Authorization: `Bearer ${token}` }
                 }
             });
-            perRequestCache.set(ctx, client);
+            bySchema.set(schema, client);
             return client;
         }
     };
 }
+/**
+ * Build a `ClientBundle` straight from environment variables — the
+ * `SUPABASE_URL` / `SUPABASE_ANON_KEY` / `SUPABASE_SERVICE_ROLE_KEY` triple,
+ * nothing else. Deliberately does NOT require `SELVA_AT_REST_KEY`: that key
+ * only matters for compute-server secret encryption, which a consuming app
+ * building its own `'public'` stores never touches. `SupabaseDataProvider.fromEnv`
+ * layers the at-rest-key requirement on top of this.
+ */
+export function clientBundleFromEnv(env) {
+    const supabaseUrl = env.SUPABASE_URL;
+    const anonKey = env.SUPABASE_ANON_KEY;
+    const serviceRoleKey = env.SUPABASE_SERVICE_ROLE_KEY;
+    if (!supabaseUrl)
+        throw new Error('Missing required env var: SUPABASE_URL');
+    if (!anonKey)
+        throw new Error('Missing required env var: SUPABASE_ANON_KEY');
+    if (!serviceRoleKey)
+        throw new Error('Missing required env var: SUPABASE_SERVICE_ROLE_KEY');
+    return buildClientBundle({ supabaseUrl, anonKey, serviceRoleKey });
+}
 function extractSessionToken(adapterContext) {
     if (!adapterContext || typeof adapterContext !== 'object')
         return undefined;

package/dist/data/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/data/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAuB,MAAM,uBAAuB,CAAC;AAsD1E,MAAM,UAAU,iBAAiB,CAAC,IAAwB;IACzD,MAAM,aAAa,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,cAAc,EAAE;QACzE,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;QACvB,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE;KACxD,CAAC,CAAC;IAEH,yEAAyE;IACzE,qDAAqD;IACrD,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,EAAE;QAC/D,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;QACvB,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE;KACxD,CAAC,CAAC;IAEH,MAAM,eAAe,GAAG,IAAI,OAAO,EAAqC,CAAC;IAEzE,OAAO;QACN,aAAa;QACb,UAAU,CAAC,GAAmB;YAC7B,IAAI,GAAG,CAAC,MAAM;gBAAE,OAAO,aAAa,CAAC;YAErC,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YACtD,IAAI,CAAC,KAAK;gBAAE,OAAO,UAAU,CAAC;YAE9B,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;YAE1B,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,EAAE;gBAC3D,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;gBACvB,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE;gBACxD,MAAM,EAAE;oBACP,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;iBAC7C;aACD,CAAC,CAAC;YACH,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACjC,OAAO,MAAM,CAAC;QACf,CAAC;KACD,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,cAAuB;IACnD,IAAI,CAAC,cAAc,IAAI,OAAO,cAAc,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC5E,MAAM,KAAK,GAAI,cAA6C,CAAC,YAAY,CAAC;IAC1E,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1E,CAAC"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/data/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAuB,MAAM,uBAAuB,CAAC;AAY1E,iDAAiD;AACjD,MAAM,CAAC,MAAM,cAAc,GAAG,OAAgB,CAAC;AAmE/C,MAAM,UAAU,iBAAiB,CAAC,IAAwB;IACzD,6EAA6E;IAC7E,4EAA4E;IAC5E,sCAAsC;IACtC,MAAM,eAAe,GAAG,IAAI,GAAG,EAAwB,CAAC;IACxD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAwB,CAAC;IAErD,SAAS,UAAU,CAAC,MAAc;QACjC,IAAI,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,cAAc,EAAE;gBAC5D,EAAE,EAAE,EAAE,MAAM,EAAE;gBACd,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE;aACxD,CAAC,CAAC;YACH,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACrC,CAAC;QACD,OAAO,MAAM,CAAC;IACf,CAAC;IAED,SAAS,OAAO,CAAC,MAAc;QAC9B,IAAI,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,EAAE;gBACrD,EAAE,EAAE,EAAE,MAAM,EAAE;gBACd,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE;aACxD,CAAC,CAAC;YACH,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,MAAM,CAAC;IACf,CAAC;IAED,4EAA4E;IAC5E,8EAA8E;IAC9E,MAAM,aAAa,GAAG,UAAU,CAAC,cAAc,CAAsB,CAAC;IAEtE,4EAA4E;IAC5E,4EAA4E;IAC5E,8DAA8D;IAC9D,MAAM,eAAe,GAAG,IAAI,OAAO,EAA6C,CAAC;IAEjF,OAAO;QACN,aAAa;QACb,UAAU,CAAC,GAAmB,EAAE,OAA2B;YAC1D,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,cAAc,CAAC;YACjD,IAAI,GAAG,CAAC,MAAM;gBAAE,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;YAE1C,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YACtD,IAAI,CAAC,KAAK;gBAAE,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC;YAEnC,IAAI,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACf,QAAQ,GAAG,IAAI,GAAG,EAAE,CAAC;gBACrB,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YACpC,CAAC;YACD,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACpC,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;YAE1B,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,EAAE;gBAC3D,EAAE,EAAE,EAAE,MAAM,EAAE;gBACd,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE;gBACxD,MAAM,EAAE;oBACP,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;iBAC7C;aACD,CAAC,CAAC;YACH,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC7B,OAAO,MAAM,CAAC;QACf,CAAC;KACD,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAuC;IAC1E,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC;IACrC,MAAM,OAAO,GAAG,GAAG,CAAC,iBAAiB,CAAC;IACtC,MAAM,cAAc,GAAG,GAAG,CAAC,yBAAyB,CAAC;IACrD,IAAI,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5E,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAC7E,IAAI,CAAC,cAAc;QAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IAC5F,OAAO,iBAAiB,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,mBAAmB,CAAC,cAAuB;IACnD,IAAI,CAAC,cAAc,IAAI,OAAO,cAAc,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC5E,MAAM,KAAK,GAAI,cAA6C,CAAC,YAAY,CAAC;IAC1E,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1E,CAAC"}

package/dist/data/errors.d.ts

@@ -0,0 +1,2 @@
+export declare function mapPostgrestError(e: unknown): Error;
+//# sourceMappingURL=errors.d.ts.map

package/dist/data/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/data/errors.ts"],"names":[],"mappings":"AAyBA,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,OAAO,GAAG,KAAK,CAmBnD"}

package/dist/data/errors.js

@@ -0,0 +1,23 @@
+import { ProviderError } from '@selvajs/platform';
+export function mapPostgrestError(e) {
+    const pg = e;
+    switch (pg?.code) {
+        case 'PGRST116':
+            return new ProviderError(pg.message ?? 'Not found', 404);
+        case '23505':
+            return new ProviderError(pg.message ?? 'Duplicate record', 409);
+        case '23503':
+            return new ProviderError(pg.message ?? 'Foreign key violation', 409);
+    }
+    if (e instanceof Error)
+        return e;
+    if (e && typeof e === 'object') {
+        const obj = e;
+        const msg = obj.message ?? obj.details ?? obj.hint ?? 'Unknown Postgres error';
+        const err = new Error(obj.code ? `[${obj.code}] ${msg}` : msg);
+        Object.assign(err, obj);
+        return err;
+    }
+    return new Error(String(e));
+}
+//# sourceMappingURL=errors.js.map

package/dist/data/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/data/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAyBlD,MAAM,UAAU,iBAAiB,CAAC,CAAU;IAC3C,MAAM,EAAE,GAAG,CAAwB,CAAC;IACpC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;QAClB,KAAK,UAAU;YACd,OAAO,IAAI,aAAa,CAAC,EAAE,CAAC,OAAO,IAAI,WAAW,EAAE,GAAG,CAAC,CAAC;QAC1D,KAAK,OAAO;YACX,OAAO,IAAI,aAAa,CAAC,EAAE,CAAC,OAAO,IAAI,kBAAkB,EAAE,GAAG,CAAC,CAAC;QACjE,KAAK,OAAO;YACX,OAAO,IAAI,aAAa,CAAC,EAAE,CAAC,OAAO,IAAI,uBAAuB,EAAE,GAAG,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,CAAC,YAAY,KAAK;QAAE,OAAO,CAAC,CAAC;IACjC,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,CAAwB,CAAC;QACrC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,IAAI,IAAI,wBAAwB,CAAC;QAC/E,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC/D,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,OAAO,GAAG,CAAC;IACZ,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7B,CAAC"}

package/dist/data/index.d.ts

@@ -8,6 +8,11 @@ export { SupabaseDataProvider } from './SupabaseDataProvider.js';
 export { SupabaseEventSink } from './SupabaseEventSink.js';
 export { SupabaseSolveMetricSink } from './SupabaseSolveMetricSink.js';
 export { SupabaseAuditQuery } from './SupabaseAuditQuery.js';
-export { buildClientBundle } from './client.js';
-export type { ClientBundle, BuildClientOptions } from './client.js';
+export { buildClientBundle, clientBundleFromEnv, DEFAULT_SCHEMA } from './client.js';
+export type { ClientBundle, BuildClientOptions, ForRequestOptions, SchemaClient, SelvaSchemaClient } from './client.js';
+export { mapPostgrestError } from './errors.js';
+export { stampUpdate, stampSoftDelete } from './rowStamp.js';
+export { notDeleted } from './query.js';
+export { toRange, orderColumn, nextCursorFromRange, encodeCursor, decodeCursor } from './pagination.js';
+export type { RangeSpec } from './pagination.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/data/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/data/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,YAAY,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/data/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACrF,YAAY,EACX,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EACN,OAAO,EACP,WAAW,EACX,mBAAmB,EACnB,YAAY,EACZ,YAAY,EACZ,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/data/index.js

@@ -8,5 +8,9 @@ export { SupabaseDataProvider } from './SupabaseDataProvider.js';
 export { SupabaseEventSink } from './SupabaseEventSink.js';
 export { SupabaseSolveMetricSink } from './SupabaseSolveMetricSink.js';
 export { SupabaseAuditQuery } from './SupabaseAuditQuery.js';
-export { buildClientBundle } from './client.js';
+export { buildClientBundle, clientBundleFromEnv, DEFAULT_SCHEMA } from './client.js';
+export { mapPostgrestError } from './errors.js';
+export { stampUpdate, stampSoftDelete } from './rowStamp.js';
+export { notDeleted } from './query.js';
+export { toRange, orderColumn, nextCursorFromRange, encodeCursor, decodeCursor } from './pagination.js';
 //# sourceMappingURL=index.js.map

package/dist/data/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/data/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/data/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAQrF,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EACN,OAAO,EACP,WAAW,EACX,mBAAmB,EACnB,YAAY,EACZ,YAAY,EACZ,MAAM,iBAAiB,CAAC"}

package/dist/data/query.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Small query-builder helpers shared across Supabase stores.
+ */
+/**
+ * The slice of a PostgREST filter builder these helpers touch: an `.is()`
+ * method that returns the same builder for chaining. Generic over the builder
+ * type so the caller's concrete builder (and its row generic) flows through.
+ */
+interface DeletableQuery {
+    is(column: string, value: null): this;
+}
+/**
+ * Apply the soft-delete filter `deleted_at IS NULL`. The `.is('deleted_at', null)`
+ * idiom is repeated across every store that soft-deletes; this names it.
+ *
+ *   let q = notDeleted(client.from('projects').select(COLS));
+ */
+export declare function notDeleted<Q extends DeletableQuery>(query: Q): Q;
+export {};
+//# sourceMappingURL=query.d.ts.map

package/dist/data/query.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"query.d.ts","sourceRoot":"","sources":["../../src/data/query.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;;;GAIG;AACH,UAAU,cAAc;IACvB,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,GAAG,IAAI,CAAC;CACtC;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,CAAC,SAAS,cAAc,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CAEhE"}

package/dist/data/query.js

@@ -0,0 +1,13 @@
+/**
+ * Small query-builder helpers shared across Supabase stores.
+ */
+/**
+ * Apply the soft-delete filter `deleted_at IS NULL`. The `.is('deleted_at', null)`
+ * idiom is repeated across every store that soft-deletes; this names it.
+ *
+ *   let q = notDeleted(client.from('projects').select(COLS));
+ */
+export function notDeleted(query) {
+    return query.is('deleted_at', null);
+}
+//# sourceMappingURL=query.js.map

package/dist/data/query.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"query.js","sourceRoot":"","sources":["../../src/data/query.ts"],"names":[],"mappings":"AAAA;;GAEG;AAWH;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAA2B,KAAQ;IAC5D,OAAO,KAAK,CAAC,EAAE,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;AACrC,CAAC"}