@selvajs/supabase-provider 0.14.3 → 0.14.4-beta.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@selvajs/supabase-provider",
-  "version": "0.14.3",
+  "version": "0.14.4-beta.1",
   "description": "Supabase (Auth + Postgres + Storage) implementations of @selvajs/platform interfaces",
   "license": "MIT",
   "publishConfig": {
@@ -8,9 +8,12 @@
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/VektorNode/selva.git",
+    "url": "git+https://github.com/VektorNode/selva.git",
     "directory": "packages/providers/supabase"
   },
+  "engines": {
+    "node": ">=22.0.0"
+  },
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -19,51 +22,47 @@
   },
   "exports": {
     ".": {
-      "source": "./src/index.ts",
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js"
     },
     "./auth": {
-      "source": "./src/auth/index.ts",
       "types": "./dist/auth/index.d.ts",
       "import": "./dist/auth/index.js"
     },
     "./data": {
-      "source": "./src/data/index.ts",
       "types": "./dist/data/index.d.ts",
       "import": "./dist/data/index.js"
     },
     "./storage": {
-      "source": "./src/storage/index.ts",
       "types": "./dist/storage/index.d.ts",
       "import": "./dist/storage/index.js"
     },
     "./permissions": {
-      "source": "./src/permissions/index.ts",
       "types": "./dist/permissions/index.d.ts",
       "import": "./dist/permissions/index.js"
     },
     "./userProfile": {
-      "source": "./src/userProfile/index.ts",
       "types": "./dist/userProfile/index.d.ts",
       "import": "./dist/userProfile/index.js"
     }
   },
   "files": [
     "dist",
-    "src",
-    "supabase"
+    "supabase",
+    "!**/__tests__/**",
+    "!**/*.test.*",
+    "!**/*.spec.*"
   ],
   "dependencies": {
     "@supabase/supabase-js": "^2.104.1",
     "sharp": "^0.34.5",
-    "@selvajs/platform": "0.14.2"
+    "@selvajs/platform": "^0.15.0-beta.1"
   },
   "devDependencies": {
-    "@types/node": "^22.19.17",
+    "@types/node": "^22.20.1",
     "supabase": "^2.95.3",
-    "typescript": "^5.9.3",
-    "vitest": "^3.2.6"
+    "typescript": "^6.0.3",
+    "vitest": "^3.2.7"
   },
   "scripts": {
     "build": "tsc",

package/supabase/.branches/_current_branch

@@ -0,0 +1 @@
+main

package/supabase/.temp/cli-latest

@@ -0,0 +1 @@
+v2.102.0

package/supabase/migrations/20260711120000_selva_definition_schema_version.sql

@@ -0,0 +1,18 @@
+-- ============================================================================
+-- Expose the cached schema's format version as a queryable column (ADR 0005).
+--
+-- The stored `schema` blob is a disposable cache of the compute-extracted UI
+-- schema; its embedded `schemaVersion` says which schema format it was written
+-- in. A GENERATED column keeps that version queryable for ops ("how many
+-- versions are stale?") with zero write-path involvement — it can never drift
+-- from the blob, and rows whose schema is NULL (pre-caching uploads) yield
+-- NULL. The web render path re-extracts from compute on version mismatch; it
+-- reads the version from the blob itself, not from this column.
+-- ============================================================================
+
+alter table selva.definition_versions
+	add column if not exists schema_version text
+		generated always as (schema ->> 'schemaVersion') stored;
+
+comment on column selva.definition_versions.schema_version is
+	'Schema format version of the cached `schema` blob (generated from schema->>''schemaVersion''). NULL when no schema is cached. Ops/diagnostics only — the app reads the version from the blob.';

package/supabase/migrations/20260712120000_user_profiles_disabled_and_gin.sql

@@ -0,0 +1,95 @@
+-- ============================================================================
+-- user_profiles.disabled denormalization + platform_permissions GIN index
+--
+-- The instance-admin invariant queries ("is there an enabled instance_admin?",
+-- "how many enabled admins besides X?") previously selected candidate ids and
+-- then called the GoTrue admin API once per candidate just to read
+-- user_metadata.disabled — an N+1 on the bootstrap and admin-write paths.
+--
+-- auth.users.raw_user_meta_data->>'disabled' stays the source of truth (the
+-- auth provider keeps writing it via the admin API); user_profiles.disabled is
+-- a trigger-maintained read-model copy so the invariant collapses to a single
+-- indexed query. The GIN index serves the `platform_permissions @> ...`
+-- filters those queries already used.
+-- ============================================================================
+
+alter table selva.user_profiles
+	add column if not exists disabled boolean not null default false;
+
+-- Signup seed: carry disabled state for users created already-disabled (e.g.
+-- via the Supabase dashboard). Conflict semantics unchanged (do nothing) —
+-- a profile row can only pre-exist on re-fired triggers, where the update
+-- trigger below owns the sync.
+create or replace function selva.handle_new_auth_user()
+returns trigger
+language plpgsql
+security definer
+set search_path = public
+as $$
+begin
+	insert into selva.user_profiles (user_id, disabled)
+	values (new.id, coalesce((new.raw_user_meta_data ->> 'disabled')::boolean, false))
+	on conflict (user_id) do nothing;
+	return new;
+end;
+$$;
+
+-- Sync disable/enable flips. The original mirror trigger is INSERT-only, so
+-- without this the read-model copy would never see a later flip (which lands
+-- as an UPDATE of raw_user_meta_data through the GoTrue admin API).
+create or replace function selva.sync_auth_user_disabled()
+returns trigger
+language plpgsql
+security definer
+set search_path = public
+as $$
+begin
+	update selva.user_profiles
+	set disabled = coalesce((new.raw_user_meta_data ->> 'disabled')::boolean, false)
+	where user_id = new.id;
+	return new;
+end;
+$$;
+
+drop trigger if exists trg_auth_user_disabled_sync on auth.users;
+create trigger trg_auth_user_disabled_sync
+	after update of raw_user_meta_data on auth.users
+	for each row
+	when (
+		coalesce(old.raw_user_meta_data ->> 'disabled', 'false')
+		is distinct from coalesce(new.raw_user_meta_data ->> 'disabled', 'false')
+	)
+	execute function selva.sync_auth_user_disabled();
+
+-- Backfill existing rows from the source of truth.
+update selva.user_profiles p
+set disabled = coalesce((u.raw_user_meta_data ->> 'disabled')::boolean, false)
+from auth.users u
+where u.id = p.user_id
+	and p.disabled is distinct from coalesce((u.raw_user_meta_data ->> 'disabled')::boolean, false);
+
+-- The `platform_permissions @> '{instance_admin}'` filters in the permission
+-- store were sequential scans without this.
+create index if not exists idx_user_profiles_platform_permissions
+	on selva.user_profiles using gin (platform_permissions);
+
+-- Extend the self-update RLS policy: users must not be able to clear their own
+-- disabled flag (same freeze pattern as platform_permissions — only
+-- service-role writes and the sync trigger may change it).
+drop policy if exists "user_profiles: users can update own" on selva.user_profiles;
+
+create policy "user_profiles: users can update own"
+on selva.user_profiles for update
+to authenticated
+using (user_id = auth.uid())
+with check (
+	user_id = auth.uid()
+	-- Users cannot escalate their own platform permissions; only service-role
+	-- writes (which bypass RLS) may change that column.
+	and platform_permissions is not distinct from (
+		select platform_permissions from selva.user_profiles where user_id = auth.uid()
+	)
+	and disabled is not distinct from (
+		select disabled from selva.user_profiles where user_id = auth.uid()
+	)
+);

package/supabase/migrations/20260712123000_selva_migration_head_fn.sql

@@ -0,0 +1,38 @@
+-- ============================================================================
+-- selva.migration_head() — app↔DB schema handshake (audit O3)
+--
+-- The app has no way to see whether the operator applied this package's
+-- migrations: self-update only runs `npm install` + pm2 restart, and PostgREST
+-- does not expose `supabase_migrations`. This SECURITY DEFINER function makes
+-- the migration head queryable through the `selva` schema the app is pinned
+-- to. The app compares it against its compiled-in EXPECTED_MIGRATION_HEAD at
+-- boot and degrades /api/health on skew — which also makes the self-update
+-- runner's health probe auto-roll-back an update whose migrations weren't
+-- applied yet.
+--
+-- Bootstrapping is intentional: on a database that never applied THIS
+-- migration the RPC itself is missing, which the app reads as "schema behind".
+-- ============================================================================
+
+create or replace function selva.migration_head()
+returns text
+language plpgsql
+security definer
+set search_path = ''
+stable
+as $$
+begin
+	return coalesce(
+		(select max(version) from supabase_migrations.schema_migrations),
+		''
+	);
+exception
+	-- A project where the CLI never pushed migrations has no
+	-- supabase_migrations.schema_migrations table at all.
+	when undefined_table then
+		return '';
+end;
+$$;
+
+revoke all on function selva.migration_head() from public;
+grant execute on function selva.migration_head() to service_role;

package/supabase/migrations/20260713120000_selva_next_version_number.sql

@@ -0,0 +1,59 @@
+-- ============================================================================
+-- Monotonic per-definition version-number allocator (audit DC / caching Phase 1.5)
+-- ============================================================================
+--
+-- Root-cause fix for `fileKey` reuse: `uploadVersion` used to compute the next
+-- version number as max(existing)+1, so deleting the latest version freed its
+-- number and the next upload reused it — reusing the `fileKey`
+-- (`versions/v{N}.gh`) and letting a stale storage blob (or any layer keying on
+-- the key) serve the old version's bytes for new content.
+--
+-- The `next_version_number` counter lives on the definition row and only ever
+-- advances. `reserve_next_version_number` returns the current value and bumps it
+-- atomically, so concurrent uploads never collide and a deleted version's number
+-- is never handed out again.
+
+-- Column: defaults to 2 (v1 is created with the parent, so the next upload takes
+-- 2). Backfilled below for any pre-existing rows.
+alter table selva.definitions
+	add column if not exists next_version_number integer not null default 2;
+
+-- Backfill existing definitions to one past their highest live version number,
+-- so already-uploaded versions don't get their numbers reused. Idempotent: after
+-- the first run the counter is already >= this, and greatest() keeps it from
+-- ever moving backwards.
+update selva.definitions d
+set next_version_number = greatest(
+	d.next_version_number,
+	coalesce(
+		(select max(v.version_number) + 1
+		 from selva.definition_versions v
+		 where v.definition_guid = d.guid),
+		2
+	)
+);
+
+-- Atomic reserve-and-increment. Returns the reserved number (the value BEFORE
+-- the bump) and advances the counter. Never decrements. Raises if the row is
+-- missing or soft-deleted so the caller surfaces a 404 rather than silently
+-- minting a number for a dead definition.
+create or replace function selva.reserve_next_version_number(g uuid)
+returns integer
+language plpgsql security definer set search_path = public
+as $$
+declare
+	reserved integer;
+begin
+	update selva.definitions
+	set next_version_number = next_version_number + 1
+	where guid = g and deleted_at is null
+	returning next_version_number - 1 into reserved;
+
+	if reserved is null then
+		raise exception 'definition % not found', g using errcode = 'no_data_found';
+	end if;
+
+	return reserved;
+end;
+$$;
+grant execute on function selva.reserve_next_version_number(uuid) to authenticated, service_role;

package/supabase/migrations/20260713140000_selva_solve_cache_limit.sql

@@ -0,0 +1,15 @@
+-- ============================================================================
+-- Per-definition durable solve-cache quota (caching Phase 3 / R9)
+-- ============================================================================
+--
+-- `solve_cache_limit` is the definition's L2 solve-cache policy, one number:
+--   NULL → inherit the global default (SOLVE_CACHE_DEFAULT_MAX_ENTRIES)
+--   0    → caching off for this definition (non-determinism / wide-input escape hatch)
+--   N    → keep at most N cached solves for this definition
+--
+-- Nullable, no default: an absent value MEANS inherit, so existing rows need no
+-- backfill — they simply inherit the global default until an author sets a value.
+
+alter table selva.definitions
+	add column if not exists solve_cache_limit integer
+	check (solve_cache_limit is null or solve_cache_limit >= 0);

package/dist/auth/__tests__/conformance.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=conformance.test.d.ts.map

package/dist/auth/__tests__/conformance.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"conformance.test.d.ts","sourceRoot":"","sources":["../../../src/auth/__tests__/conformance.test.ts"],"names":[],"mappings":""}

package/dist/auth/__tests__/conformance.test.js

@@ -1,76 +0,0 @@
-import { describe, beforeEach, it } from 'vitest';
-import { runAuthProviderConformance, runEmailLinkAuthConformance } from '@selvajs/platform/testing';
-import { SupabaseAuthProvider } from '../SupabaseAuthProvider.js';
-import { readEnv, resetAllData } from '../../data/__tests__/test-helpers.js';
-const envCtx = readEnv();
-if (!envCtx) {
-    describe.skip('SupabaseAuthProvider (skipped: no live stack)', () => {
-        it('populate packages/providers/supabase/.env.test with Supabase creds to run these tests', () => { });
-    });
-}
-else {
-    const ctx = envCtx; // non-null in this branch
-    // The auth conformance suite expects `verifyLogin('', adminPassword)` to
-    // succeed. Supabase requires a non-empty email, so we seed a deterministic
-    // admin email and have the suite use that via the `adminEmail` option.
-    const ADMIN_EMAIL = 'admin@conformance.test';
-    const ADMIN_PASSWORD = 'conformance-admin-password-1234';
-    async function ensureAdmin() {
-        const { data: existing } = await ctx.adminClient.auth.admin.listUsers({ perPage: 1000 });
-        const match = existing.users.find((u) => u.email === ADMIN_EMAIL);
-        if (match)
-            return match.id;
-        const { data, error } = await ctx.adminClient.auth.admin.createUser({
-            email: ADMIN_EMAIL,
-            password: ADMIN_PASSWORD,
-            email_confirm: true
-        });
-        if (error)
-            throw error;
-        return data.user.id;
-    }
-    async function makeProvider() {
-        const provider = new SupabaseAuthProvider({
-            supabaseUrl: ctx.url,
-            anonKey: ctx.anonKey,
-            serviceRoleKey: ctx.serviceRoleKey
-        });
-        // Ensure the admin account exists + has instance_admin.
-        const id = await ensureAdmin();
-        const { error: upError } = await ctx.adminClient
-            .from('user_profiles')
-            .update({ platform_permissions: ['instance_admin'] })
-            .eq('user_id', id);
-        if (upError)
-            throw upError;
-        return { provider, adminPassword: ADMIN_PASSWORD };
-    }
-    describe('SupabaseAuthProvider', () => {
-        beforeEach(async () => {
-            await resetAllData(ctx);
-        });
-        runAuthProviderConformance({
-            name: 'SupabaseAuthProvider',
-            createProvider: async () => {
-                const { provider, adminPassword } = await makeProvider();
-                return { provider, adminPassword, adminEmail: ADMIN_EMAIL };
-            },
-            userManagement: true
-        });
-        runEmailLinkAuthConformance({
-            name: 'SupabaseEmailLinkAuth',
-            createAdapter: async () => {
-                const { provider } = await makeProvider();
-                return {
-                    adapter: provider.emailLink,
-                    // `validEmail` isn't used by the suite for live mail delivery;
-                    // it just needs to look like a real address. The malformed
-                    // case is what we actually assert on.
-                    validEmail: 'real-looking@conformance.test',
-                    invalidEmail: 'not-an-email-address'
-                };
-            }
-        });
-    });
-}
-//# sourceMappingURL=conformance.test.js.map

package/dist/auth/__tests__/conformance.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"conformance.test.js","sourceRoot":"","sources":["../../../src/auth/__tests__/conformance.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AACpG,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,sCAAsC,CAAC;AAE7E,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC;AAEzB,IAAI,CAAC,MAAM,EAAE,CAAC;IACb,QAAQ,CAAC,IAAI,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACnE,EAAE,CAAC,uFAAuF,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACvG,CAAC,CAAC,CAAC;AACJ,CAAC;KAAM,CAAC;IACP,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,0BAA0B;IAC9C,yEAAyE;IACzE,2EAA2E;IAC3E,uEAAuE;IACvE,MAAM,WAAW,GAAG,wBAAwB,CAAC;IAC7C,MAAM,cAAc,GAAG,iCAAiC,CAAC;IAEzD,KAAK,UAAU,WAAW;QACzB,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACzF,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC;QAClE,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;YACnE,KAAK,EAAE,WAAW;YAClB,QAAQ,EAAE,cAAc;YACxB,aAAa,EAAE,IAAI;SACnB,CAAC,CAAC;QACH,IAAI,KAAK;YAAE,MAAM,KAAK,CAAC;QACvB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACrB,CAAC;IAED,KAAK,UAAU,YAAY;QAC1B,MAAM,QAAQ,GAAG,IAAI,oBAAoB,CAAC;YACzC,WAAW,EAAE,GAAG,CAAC,GAAG;YACpB,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,cAAc,EAAE,GAAG,CAAC,cAAc;SAClC,CAAC,CAAC;QACH,wDAAwD;QACxD,MAAM,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;QAC/B,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,GAAG,CAAC,WAAW;aAC9C,IAAI,CAAC,eAAe,CAAC;aACrB,MAAM,CAAC,EAAE,oBAAoB,EAAE,CAAC,gBAAgB,CAAC,EAAE,CAAC;aACpD,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACpB,IAAI,OAAO;YAAE,MAAM,OAAO,CAAC;QAC3B,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,cAAc,EAAE,CAAC;IACpD,CAAC;IAED,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;QACrC,UAAU,CAAC,KAAK,IAAI,EAAE;YACrB,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC,CAAC,CAAC;QAEH,0BAA0B,CAAC;YAC1B,IAAI,EAAE,sBAAsB;YAC5B,cAAc,EAAE,KAAK,IAAI,EAAE;gBAC1B,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;gBACzD,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;YAC7D,CAAC;YACD,cAAc,EAAE,IAAI;SACpB,CAAC,CAAC;QAEH,2BAA2B,CAAC;YAC3B,IAAI,EAAE,uBAAuB;YAC7B,aAAa,EAAE,KAAK,IAAI,EAAE;gBACzB,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;gBAC1C,OAAO;oBACN,OAAO,EAAE,QAAQ,CAAC,SAAS;oBAC3B,+DAA+D;oBAC/D,2DAA2D;oBAC3D,sCAAsC;oBACtC,UAAU,EAAE,+BAA+B;oBAC3C,YAAY,EAAE,sBAAsB;iBACpC,CAAC;YACH,CAAC;SACD,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACJ,CAAC"}

package/dist/data/__tests__/compute-server-conformance.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=compute-server-conformance.test.d.ts.map

package/dist/data/__tests__/compute-server-conformance.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"compute-server-conformance.test.d.ts","sourceRoot":"","sources":["../../../src/data/__tests__/compute-server-conformance.test.ts"],"names":[],"mappings":""}

package/dist/data/__tests__/compute-server-conformance.test.js

@@ -1,40 +0,0 @@
-import { describe, beforeEach, it } from 'vitest';
-import { runComputeServerStoreConformance } from '@selvajs/platform/testing';
-import { SupabaseComputeServerStore } from '../SupabaseComputeServerStore.js';
-import { readEnv, resetAllData, seedUser } from './test-helpers.js';
-const envCtx = readEnv();
-if (!envCtx) {
-    describe.skip('SupabaseComputeServerStore (skipped: no live stack)', () => {
-        it('populate packages/providers/supabase/.env.test with Supabase creds to run these tests', () => { });
-    });
-}
-else {
-    describe('SupabaseComputeServerStore', () => {
-        beforeEach(async () => {
-            await resetAllData(envCtx);
-        });
-        runComputeServerStoreConformance({
-            name: 'SupabaseComputeServerStore',
-            createStore: () => new SupabaseComputeServerStore(envCtx.bundle),
-            seedOrg: async (orgId) => {
-                // `compute_servers.owner_org_id` and `compute_server_org_defaults.org_id`
-                // FK to `orgs(id)`; the suite invents an `orgId` per org-scoped test,
-                // so we materialize the parent org here. Owner is a throwaway user
-                // (the org-scoped tests use SYSTEM_CONTEXT for writes anyway).
-                const { userId } = await seedUser(envCtx, '');
-                const now = new Date().toISOString();
-                const { error } = await envCtx.adminClient.from('orgs').insert({
-                    id: orgId,
-                    name: 'Compute Test Org',
-                    slug: `compute-${orgId.slice(0, 8)}`,
-                    owner_id: userId,
-                    created_at: now,
-                    updated_at: now
-                });
-                if (error)
-                    throw error;
-            }
-        });
-    });
-}
-//# sourceMappingURL=compute-server-conformance.test.js.map

package/dist/data/__tests__/compute-server-conformance.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"compute-server-conformance.test.js","sourceRoot":"","sources":["../../../src/data/__tests__/compute-server-conformance.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAE,gCAAgC,EAAE,MAAM,2BAA2B,CAAC;AAC7E,OAAO,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AAC9E,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAEpE,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC;AAEzB,IAAI,CAAC,MAAM,EAAE,CAAC;IACb,QAAQ,CAAC,IAAI,CAAC,qDAAqD,EAAE,GAAG,EAAE;QACzE,EAAE,CAAC,uFAAuF,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACvG,CAAC,CAAC,CAAC;AACJ,CAAC;KAAM,CAAC;IACP,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;QAC3C,UAAU,CAAC,KAAK,IAAI,EAAE;YACrB,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;QAEH,gCAAgC,CAAC;YAChC,IAAI,EAAE,4BAA4B;YAClC,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,0BAA0B,CAAC,MAAM,CAAC,MAAM,CAAC;YAChE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;gBACxB,0EAA0E;gBAC1E,sEAAsE;gBACtE,mEAAmE;gBACnE,+DAA+D;gBAC/D,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBAC9C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;gBACrC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;oBAC9D,EAAE,EAAE,KAAK;oBACT,IAAI,EAAE,kBAAkB;oBACxB,IAAI,EAAE,WAAW,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;oBACpC,QAAQ,EAAE,MAAM;oBAChB,UAAU,EAAE,GAAG;oBACf,UAAU,EAAE,GAAG;iBACf,CAAC,CAAC;gBACH,IAAI,KAAK;oBAAE,MAAM,KAAK,CAAC;YACxB,CAAC;SACD,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACJ,CAAC"}

package/dist/data/__tests__/definition-conformance.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=definition-conformance.test.d.ts.map

package/dist/data/__tests__/definition-conformance.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"definition-conformance.test.d.ts","sourceRoot":"","sources":["../../../src/data/__tests__/definition-conformance.test.ts"],"names":[],"mappings":""}

package/dist/data/__tests__/definition-conformance.test.js

@@ -1,85 +0,0 @@
-import { describe, beforeEach, it } from 'vitest';
-import { runDefinitionStoreConformance } from '@selvajs/platform/testing';
-import { DEFAULT_ORG_PERMISSIONS } from '@selvajs/platform';
-import { SupabaseDefinitionStore } from '../SupabaseDefinitionStore.js';
-import { readEnv, resetAllData, seedUser } from './test-helpers.js';
-const envCtx = readEnv();
-if (!envCtx) {
-    describe.skip('SupabaseDefinitionStore (skipped: no live stack)', () => {
-        it('populate packages/providers/supabase/.env.test with Supabase creds to run these tests', () => { });
-    });
-}
-else {
-    describe('SupabaseDefinitionStore', () => {
-        beforeEach(async () => {
-            await resetAllData(envCtx);
-        });
-        runDefinitionStoreConformance({
-            name: 'SupabaseDefinitionStore',
-            createStore: () => new SupabaseDefinitionStore(envCtx.bundle),
-            createScope: async () => {
-                // Seed: 1 owner + 1 secondary user + 1 org + 2 projects. Definitions
-                // created in the suite FK to one of those two projects.
-                const { userId: ownerId, sessionToken: ownerSessionToken } = await seedUser(envCtx, '');
-                const { userId: secondaryUserId, sessionToken: secondaryUserSessionToken } = await seedUser(envCtx, '');
-                const orgId = crypto.randomUUID();
-                const projectId = crypto.randomUUID();
-                const secondaryProjectId = crypto.randomUUID();
-                const now = new Date().toISOString();
-                const admin = envCtx.adminClient;
-                const { error: orgError } = await admin.from('orgs').insert({
-                    id: orgId,
-                    name: 'Definition Test Org',
-                    slug: `def-test-${orgId.slice(0, 8)}`,
-                    owner_id: ownerId,
-                    created_at: now,
-                    updated_at: now
-                });
-                if (orgError)
-                    throw orgError;
-                const { error: memberError } = await admin.from('org_members').insert({
-                    org_id: orgId,
-                    user_id: ownerId,
-                    role: 'owner',
-                    permissions: [...DEFAULT_ORG_PERMISSIONS.owner],
-                    joined_at: now
-                });
-                if (memberError)
-                    throw memberError;
-                const { error: p1Error } = await admin.from('projects').insert([
-                    {
-                        id: projectId,
-                        org_id: orgId,
-                        name: 'Project A',
-                        slug: `proj-a-${projectId.slice(0, 8)}`,
-                        visibility: 'public',
-                        owner_id: ownerId,
-                        created_at: now,
-                        updated_at: now
-                    },
-                    {
-                        id: secondaryProjectId,
-                        org_id: orgId,
-                        name: 'Project B',
-                        slug: `proj-b-${secondaryProjectId.slice(0, 8)}`,
-                        visibility: 'public',
-                        owner_id: ownerId,
-                        created_at: now,
-                        updated_at: now
-                    }
-                ]);
-                if (p1Error)
-                    throw p1Error;
-                return {
-                    ownerId,
-                    ownerSessionToken,
-                    projectId,
-                    secondaryProjectId,
-                    secondaryUserId,
-                    secondaryUserSessionToken
-                };
-            }
-        });
-    });
-}
-//# sourceMappingURL=definition-conformance.test.js.map

package/dist/data/__tests__/definition-conformance.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"definition-conformance.test.js","sourceRoot":"","sources":["../../../src/data/__tests__/definition-conformance.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAE,6BAA6B,EAAE,MAAM,2BAA2B,CAAC;AAC1E,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAEpE,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC;AAEzB,IAAI,CAAC,MAAM,EAAE,CAAC;IACb,QAAQ,CAAC,IAAI,CAAC,kDAAkD,EAAE,GAAG,EAAE;QACtE,EAAE,CAAC,uFAAuF,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACvG,CAAC,CAAC,CAAC;AACJ,CAAC;KAAM,CAAC;IACP,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACxC,UAAU,CAAC,KAAK,IAAI,EAAE;YACrB,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;QAEH,6BAA6B,CAAC;YAC7B,IAAI,EAAE,yBAAyB;YAC/B,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,uBAAuB,CAAC,MAAM,CAAC,MAAM,CAAC;YAC7D,WAAW,EAAE,KAAK,IAAI,EAAE;gBACvB,qEAAqE;gBACrE,wDAAwD;gBACxD,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBACxF,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,YAAY,EAAE,yBAAyB,EAAE,GAAG,MAAM,QAAQ,CAC1F,MAAM,EACN,EAAE,CACF,CAAC;gBACF,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;gBAClC,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;gBACtC,MAAM,kBAAkB,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;gBAC/C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;gBACrC,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC;gBAEjC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;oBAC3D,EAAE,EAAE,KAAK;oBACT,IAAI,EAAE,qBAAqB;oBAC3B,IAAI,EAAE,YAAY,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;oBACrC,QAAQ,EAAE,OAAO;oBACjB,UAAU,EAAE,GAAG;oBACf,UAAU,EAAE,GAAG;iBACf,CAAC,CAAC;gBACH,IAAI,QAAQ;oBAAE,MAAM,QAAQ,CAAC;gBAC7B,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC;oBACrE,MAAM,EAAE,KAAK;oBACb,OAAO,EAAE,OAAO;oBAChB,IAAI,EAAE,OAAO;oBACb,WAAW,EAAE,CAAC,GAAG,uBAAuB,CAAC,KAAK,CAAC;oBAC/C,SAAS,EAAE,GAAG;iBACd,CAAC,CAAC;gBACH,IAAI,WAAW;oBAAE,MAAM,WAAW,CAAC;gBAEnC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;oBAC9D;wBACC,EAAE,EAAE,SAAS;wBACb,MAAM,EAAE,KAAK;wBACb,IAAI,EAAE,WAAW;wBACjB,IAAI,EAAE,UAAU,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;wBACvC,UAAU,EAAE,QAAQ;wBACpB,QAAQ,EAAE,OAAO;wBACjB,UAAU,EAAE,GAAG;wBACf,UAAU,EAAE,GAAG;qBACf;oBACD;wBACC,EAAE,EAAE,kBAAkB;wBACtB,MAAM,EAAE,KAAK;wBACb,IAAI,EAAE,WAAW;wBACjB,IAAI,EAAE,UAAU,kBAAkB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;wBAChD,UAAU,EAAE,QAAQ;wBACpB,QAAQ,EAAE,OAAO;wBACjB,UAAU,EAAE,GAAG;wBACf,UAAU,EAAE,GAAG;qBACf;iBACD,CAAC,CAAC;gBACH,IAAI,OAAO;oBAAE,MAAM,OAAO,CAAC;gBAE3B,OAAO;oBACN,OAAO;oBACP,iBAAiB;oBACjB,SAAS;oBACT,kBAAkB;oBAClB,eAAe;oBACf,yBAAyB;iBACzB,CAAC;YACH,CAAC;SACD,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACJ,CAAC"}

package/dist/data/__tests__/event-sink-conformance.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=event-sink-conformance.test.d.ts.map

package/dist/data/__tests__/event-sink-conformance.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"event-sink-conformance.test.d.ts","sourceRoot":"","sources":["../../../src/data/__tests__/event-sink-conformance.test.ts"],"names":[],"mappings":""}

package/dist/data/__tests__/event-sink-conformance.test.js

@@ -1,27 +0,0 @@
-import { describe, beforeEach, it } from 'vitest';
-import { runEventSinkConformance } from '@selvajs/platform/testing';
-import { SupabaseDataProvider } from '../SupabaseDataProvider.js';
-import { readEnv, resetAllData, seedUser } from './test-helpers.js';
-const envCtx = readEnv();
-if (!envCtx) {
-    describe.skip('SupabaseDataProvider event-sink (skipped: no live stack)', () => {
-        it('populate packages/providers/supabase/.env.test with Supabase creds to run these tests', () => { });
-    });
-}
-else {
-    describe('SupabaseDataProvider event-sink', () => {
-        beforeEach(async () => {
-            await resetAllData(envCtx);
-        });
-        runEventSinkConformance({
-            name: 'SupabaseDataProvider',
-            createProvider: (sink) => SupabaseDataProvider.create({
-                supabaseUrl: envCtx.url,
-                anonKey: envCtx.anonKey,
-                serviceRoleKey: envCtx.serviceRoleKey
-            }, sink),
-            createActorId: () => seedUser(envCtx, '')
-        });
-    });
-}
-//# sourceMappingURL=event-sink-conformance.test.js.map

package/dist/data/__tests__/event-sink-conformance.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"event-sink-conformance.test.js","sourceRoot":"","sources":["../../../src/data/__tests__/event-sink-conformance.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAE,uBAAuB,EAA2B,MAAM,2BAA2B,CAAC;AAC7F,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAEpE,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC;AAEzB,IAAI,CAAC,MAAM,EAAE,CAAC;IACb,QAAQ,CAAC,IAAI,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAC9E,EAAE,CAAC,uFAAuF,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACvG,CAAC,CAAC,CAAC;AACJ,CAAC;KAAM,CAAC;IACP,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;QAChD,UAAU,CAAC,KAAK,IAAI,EAAE;YACrB,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;QAEH,uBAAuB,CAAC;YACvB,IAAI,EAAE,sBAAsB;YAC5B,cAAc,EAAE,CAAC,IAAwB,EAAE,EAAE,CAC5C,oBAAoB,CAAC,MAAM,CAC1B;gBACC,WAAW,EAAE,MAAM,CAAC,GAAG;gBACvB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,cAAc,EAAE,MAAM,CAAC,cAAc;aACrC,EACD,IAAI,CACJ;YACF,aAAa,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;SACzC,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACJ,CAAC"}

package/dist/data/__tests__/invite-conformance.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=invite-conformance.test.d.ts.map

package/dist/data/__tests__/invite-conformance.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"invite-conformance.test.d.ts","sourceRoot":"","sources":["../../../src/data/__tests__/invite-conformance.test.ts"],"names":[],"mappings":""}