@selvajs/supabase-provider 0.14.4-beta.0 → 0.14.4-beta.1

package/dist/auth/__tests__/token-verification.test.js

@@ -1,135 +0,0 @@
-/**
- * CI-runnable (no live stack) tests for §1b hybrid token verification. Stubs
- * the internal anon client's `getClaims` (local JWT verify) and `getUser`
- * (network GoTrue verify) so we can assert the network-call behavior directly.
- *
- * Contract:
- *  - hybrid (default): verify locally via getClaims on every request; hit
- *    getUser at most once per `revalidateMs` per session; a getUser rejection
- *    during that recheck (sign-out / disabled) denies immediately.
- *  - strict: getUser on every request.
- */
-import { describe, it, expect, vi, beforeEach } from 'vitest';
-import { SupabaseAuthProvider } from '../SupabaseAuthProvider.js';
-const URL = 'https://example.supabase.co';
-const ANON = 'anon-key';
-const SERVICE = 'service-key';
-/** Reach into the provider's private anon client and replace its auth surface. */
-function stubAnonAuth(provider) {
-    const stub = { getClaims: vi.fn(), getUser: vi.fn() };
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    provider.anon.auth.getClaims = stub.getClaims;
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    provider.anon.auth.getUser = stub.getUser;
-    return stub;
-}
-function okClaims(overrides = {}) {
-    return {
-        data: {
-            claims: {
-                sub: 'user-1',
-                session_id: 'sess-1',
-                email: 'u@example.com',
-                exp: Math.floor(Date.now() / 1000) + 3600,
-                ...overrides
-            },
-            header: {},
-            signature: new Uint8Array()
-        },
-        error: null
-    };
-}
-function okUser() {
-    return {
-        data: { user: { id: 'user-1', email: 'u@example.com', user_metadata: {} } },
-        error: null
-    };
-}
-describe('SupabaseAuthProvider — hybrid token verification', () => {
-    beforeEach(() => vi.restoreAllMocks());
-    it('verifies locally via getClaims and rechecks getUser once per window', async () => {
-        const provider = new SupabaseAuthProvider({
-            supabaseUrl: URL,
-            anonKey: ANON,
-            serviceRoleKey: SERVICE,
-            revalidateMs: 60_000
-        });
-        const stub = stubAnonAuth(provider);
-        stub.getClaims.mockResolvedValue(okClaims());
-        stub.getUser.mockResolvedValue(okUser());
-        // First call: local verify + one recheck (never seen this session).
-        const a = await provider.verifyToken('tok');
-        expect(a?.id).toBe('user-1');
-        expect(stub.getClaims).toHaveBeenCalledTimes(1);
-        expect(stub.getUser).toHaveBeenCalledTimes(1);
-        // Subsequent calls within the window: local only, NO more getUser.
-        await provider.verifyToken('tok');
-        await provider.verifyToken('tok');
-        expect(stub.getClaims).toHaveBeenCalledTimes(3);
-        expect(stub.getUser).toHaveBeenCalledTimes(1); // still just the first
-    });
-    it('denies immediately when the periodic getUser recheck rejects (signed out / revoked)', async () => {
-        const provider = new SupabaseAuthProvider({
-            supabaseUrl: URL,
-            anonKey: ANON,
-            serviceRoleKey: SERVICE
-        });
-        const stub = stubAnonAuth(provider);
-        stub.getClaims.mockResolvedValue(okClaims());
-        stub.getUser.mockResolvedValue({ data: { user: null }, error: { message: 'signed out' } });
-        const result = await provider.verifyToken('tok');
-        expect(result).toBeNull();
-    });
-    it('denies when the claims already mark the user disabled (no getUser needed)', async () => {
-        const provider = new SupabaseAuthProvider({
-            supabaseUrl: URL,
-            anonKey: ANON,
-            serviceRoleKey: SERVICE
-        });
-        const stub = stubAnonAuth(provider);
-        stub.getClaims.mockResolvedValue(okClaims({ user_metadata: { disabled: true } }));
-        const result = await provider.verifyToken('tok');
-        expect(result).toBeNull();
-        expect(stub.getUser).not.toHaveBeenCalled();
-    });
-    it('denies when getClaims fails (bad signature / expired)', async () => {
-        const provider = new SupabaseAuthProvider({
-            supabaseUrl: URL,
-            anonKey: ANON,
-            serviceRoleKey: SERVICE
-        });
-        const stub = stubAnonAuth(provider);
-        stub.getClaims.mockResolvedValue({ data: null, error: { message: 'invalid JWT' } });
-        expect(await provider.verifyToken('tok')).toBeNull();
-        expect(stub.getUser).not.toHaveBeenCalled();
-    });
-    it('returns null for an empty token without any network call', async () => {
-        const provider = new SupabaseAuthProvider({
-            supabaseUrl: URL,
-            anonKey: ANON,
-            serviceRoleKey: SERVICE
-        });
-        const stub = stubAnonAuth(provider);
-        expect(await provider.verifyToken('')).toBeNull();
-        expect(stub.getClaims).not.toHaveBeenCalled();
-        expect(stub.getUser).not.toHaveBeenCalled();
-    });
-});
-describe('SupabaseAuthProvider — strict token verification', () => {
-    beforeEach(() => vi.restoreAllMocks());
-    it('calls getUser on every request and never getClaims', async () => {
-        const provider = new SupabaseAuthProvider({
-            supabaseUrl: URL,
-            anonKey: ANON,
-            serviceRoleKey: SERVICE,
-            tokenVerification: 'strict'
-        });
-        const stub = stubAnonAuth(provider);
-        stub.getUser.mockResolvedValue(okUser());
-        await provider.verifyToken('tok');
-        await provider.verifyToken('tok');
-        expect(stub.getUser).toHaveBeenCalledTimes(2);
-        expect(stub.getClaims).not.toHaveBeenCalled();
-    });
-});
-//# sourceMappingURL=token-verification.test.js.map

package/dist/auth/__tests__/token-verification.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"token-verification.test.js","sourceRoot":"","sources":["../../../src/auth/__tests__/token-verification.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAElE,MAAM,GAAG,GAAG,6BAA6B,CAAC;AAC1C,MAAM,IAAI,GAAG,UAAU,CAAC;AACxB,MAAM,OAAO,GAAG,aAAa,CAAC;AAO9B,kFAAkF;AAClF,SAAS,YAAY,CAAC,QAA8B;IACnD,MAAM,IAAI,GAAa,EAAE,SAAS,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC;IAChE,8DAA8D;IAC7D,QAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IACvD,8DAA8D;IAC7D,QAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IACnD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,QAAQ,CAAC,YAAqC,EAAE;IACxD,OAAO;QACN,IAAI,EAAE;YACL,MAAM,EAAE;gBACP,GAAG,EAAE,QAAQ;gBACb,UAAU,EAAE,QAAQ;gBACpB,KAAK,EAAE,eAAe;gBACtB,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI;gBACzC,GAAG,SAAS;aACZ;YACD,MAAM,EAAE,EAAE;YACV,SAAS,EAAE,IAAI,UAAU,EAAE;SAC3B;QACD,KAAK,EAAE,IAAI;KACX,CAAC;AACH,CAAC;AAED,SAAS,MAAM;IACd,OAAO;QACN,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,EAAE,EAAE,EAAE;QAC3E,KAAK,EAAE,IAAI;KACX,CAAC;AACH,CAAC;AAED,QAAQ,CAAC,kDAAkD,EAAE,GAAG,EAAE;IACjE,UAAU,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;IAEvC,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACpF,MAAM,QAAQ,GAAG,IAAI,oBAAoB,CAAC;YACzC,WAAW,EAAE,GAAG;YAChB,OAAO,EAAE,IAAI;YACb,cAAc,EAAE,OAAO;YACvB,YAAY,EAAE,MAAM;SACpB,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC,CAAC;QAEzC,oEAAoE;QACpE,MAAM,CAAC,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAChD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAE9C,mEAAmE;QACnE,MAAM,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAChD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,uBAAuB;IACvE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qFAAqF,EAAE,KAAK,IAAI,EAAE;QACpG,MAAM,QAAQ,GAAG,IAAI,oBAAoB,CAAC;YACzC,WAAW,EAAE,GAAG;YAChB,OAAO,EAAE,IAAI;YACb,cAAc,EAAE,OAAO;SACvB,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;QAE3F,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QAC1F,MAAM,QAAQ,GAAG,IAAI,oBAAoB,CAAC;YACzC,WAAW,EAAE,GAAG;YAChB,OAAO,EAAE,IAAI;YACb,cAAc,EAAE,OAAO;SACvB,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;QAElF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC1B,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,QAAQ,GAAG,IAAI,oBAAoB,CAAC;YACzC,WAAW,EAAE,GAAG;YAChB,OAAO,EAAE,IAAI;YACb,cAAc,EAAE,OAAO;SACvB,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;QAEpF,MAAM,CAAC,MAAM,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,QAAQ,GAAG,IAAI,oBAAoB,CAAC;YACzC,WAAW,EAAE,GAAG;YAChB,OAAO,EAAE,IAAI;YACb,cAAc,EAAE,OAAO;SACvB,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACpC,MAAM,CAAC,MAAM,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC7C,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,kDAAkD,EAAE,GAAG,EAAE;IACjE,UAAU,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;IAEvC,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QACnE,MAAM,QAAQ,GAAG,IAAI,oBAAoB,CAAC;YACzC,WAAW,EAAE,GAAG;YAChB,OAAO,EAAE,IAAI;YACb,cAAc,EAAE,OAAO;YACvB,iBAAiB,EAAE,QAAQ;SAC3B,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC,CAAC;QAEzC,MAAM,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC/C,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/data/__tests__/compute-server-conformance.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=compute-server-conformance.test.d.ts.map

package/dist/data/__tests__/compute-server-conformance.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"compute-server-conformance.test.d.ts","sourceRoot":"","sources":["../../../src/data/__tests__/compute-server-conformance.test.ts"],"names":[],"mappings":""}

package/dist/data/__tests__/compute-server-conformance.test.js

@@ -1,45 +0,0 @@
-import { describe, beforeEach, it } from 'vitest';
-import { randomBytes } from 'node:crypto';
-import { runComputeServerStoreConformance } from '@selvajs/platform/testing';
-import { SupabaseComputeServerStore } from '../SupabaseComputeServerStore.js';
-import { readEnv, resetAllData, seedUser } from './test-helpers.js';
-const envCtx = readEnv();
-// A throwaway at-rest key so the store encrypts apiKeys during the suite. The
-// round-trip (encrypt on write, decrypt on read) must be transparent to the
-// conformance assertions, which compare plaintext apiKeys.
-const TEST_SECRET_KEY = randomBytes(32);
-if (!envCtx) {
-    describe.skip('SupabaseComputeServerStore (skipped: no live stack)', () => {
-        it('populate packages/providers/supabase/.env.test with Supabase creds to run these tests', () => { });
-    });
-}
-else {
-    describe('SupabaseComputeServerStore', () => {
-        beforeEach(async () => {
-            await resetAllData(envCtx);
-        });
-        runComputeServerStoreConformance({
-            name: 'SupabaseComputeServerStore',
-            createStore: () => new SupabaseComputeServerStore(envCtx.bundle, TEST_SECRET_KEY),
-            seedOrg: async (orgId) => {
-                // `compute_servers.owner_org_id` and `compute_server_org_defaults.org_id`
-                // FK to `orgs(id)`; the suite invents an `orgId` per org-scoped test,
-                // so we materialize the parent org here. Owner is a throwaway user
-                // (the org-scoped tests use SYSTEM_CONTEXT for writes anyway).
-                const { userId } = await seedUser(envCtx, '');
-                const now = new Date().toISOString();
-                const { error } = await envCtx.adminClient.from('orgs').insert({
-                    id: orgId,
-                    name: 'Compute Test Org',
-                    slug: `compute-${orgId.slice(0, 8)}`,
-                    owner_id: userId,
-                    created_at: now,
-                    updated_at: now
-                });
-                if (error)
-                    throw error;
-            }
-        });
-    });
-}
-//# sourceMappingURL=compute-server-conformance.test.js.map

package/dist/data/__tests__/compute-server-conformance.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"compute-server-conformance.test.js","sourceRoot":"","sources":["../../../src/data/__tests__/compute-server-conformance.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,gCAAgC,EAAE,MAAM,2BAA2B,CAAC;AAC7E,OAAO,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AAC9E,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAEpE,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC;AAEzB,8EAA8E;AAC9E,4EAA4E;AAC5E,2DAA2D;AAC3D,MAAM,eAAe,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;AAExC,IAAI,CAAC,MAAM,EAAE,CAAC;IACb,QAAQ,CAAC,IAAI,CAAC,qDAAqD,EAAE,GAAG,EAAE;QACzE,EAAE,CAAC,uFAAuF,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACvG,CAAC,CAAC,CAAC;AACJ,CAAC;KAAM,CAAC;IACP,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;QAC3C,UAAU,CAAC,KAAK,IAAI,EAAE;YACrB,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;QAEH,gCAAgC,CAAC;YAChC,IAAI,EAAE,4BAA4B;YAClC,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,0BAA0B,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC;YACjF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;gBACxB,0EAA0E;gBAC1E,sEAAsE;gBACtE,mEAAmE;gBACnE,+DAA+D;gBAC/D,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBAC9C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;gBACrC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;oBAC9D,EAAE,EAAE,KAAK;oBACT,IAAI,EAAE,kBAAkB;oBACxB,IAAI,EAAE,WAAW,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;oBACpC,QAAQ,EAAE,MAAM;oBAChB,UAAU,EAAE,GAAG;oBACf,UAAU,EAAE,GAAG;iBACf,CAAC,CAAC;gBACH,IAAI,KAAK;oBAAE,MAAM,KAAK,CAAC;YACxB,CAAC;SACD,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACJ,CAAC"}

package/dist/data/__tests__/compute-server-encryption.test.d.ts

@@ -1,12 +0,0 @@
-/**
- * CI-runnable (no live stack) unit tests for at-rest encryption of
- * `compute_servers.api_key`. Uses a minimal fake of the Supabase query builder
- * that records `insert` payloads and serves canned `select` rows, so we can
- * assert the exact bytes that would reach the DB without a real Postgres.
- *
- * The security property under test: a plaintext apiKey handed to the store is
- * NEVER written verbatim — the DB only ever sees an `enc:v1:` envelope — and it
- * round-trips back to plaintext on read.
- */
-export {};
-//# sourceMappingURL=compute-server-encryption.test.d.ts.map

package/dist/data/__tests__/compute-server-encryption.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"compute-server-encryption.test.d.ts","sourceRoot":"","sources":["../../../src/data/__tests__/compute-server-encryption.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG"}

package/dist/data/__tests__/compute-server-encryption.test.js

@@ -1,143 +0,0 @@
-/**
- * CI-runnable (no live stack) unit tests for at-rest encryption of
- * `compute_servers.api_key`. Uses a minimal fake of the Supabase query builder
- * that records `insert` payloads and serves canned `select` rows, so we can
- * assert the exact bytes that would reach the DB without a real Postgres.
- *
- * The security property under test: a plaintext apiKey handed to the store is
- * NEVER written verbatim — the DB only ever sees an `enc:v1:` envelope — and it
- * round-trips back to plaintext on read.
- */
-import { describe, it, expect, vi, beforeEach } from 'vitest';
-import { randomBytes } from 'node:crypto';
-import { isEncryptedSecret, decryptSecret } from '@selvajs/platform/computeServer';
-import { SupabaseComputeServerStore } from '../SupabaseComputeServerStore.js';
-const SYSTEM_CTX = { userId: '', system: true };
-const KEY = randomBytes(32);
-/**
- * Records every `insert` payload and returns canned rows for each table's
- * `select`. Only the fragments the store actually chains are implemented; the
- * builder is thenable so `await client.from(...).select(...)` resolves.
- */
-function fakeBundle(selectRows = {}) {
-    const inserted = {};
-    function builder(table) {
-        const result = { data: selectRows[table] ?? [], error: null };
-        const chain = {
-            select: () => ({
-                ...chain,
-                eq: () => ({ ...chain, maybeSingle: async () => ({ data: null, error: null }) }),
-                then: (resolve) => resolve(result)
-            }),
-            insert: (rows) => {
-                inserted[table] = (inserted[table] ?? []).concat(rows);
-                return { error: null };
-            },
-            delete: () => ({ eq: () => ({ eq: () => ({ error: null }), error: null }) }),
-            update: () => ({ eq: () => ({ error: null }) }),
-            upsert: () => ({ error: null })
-        };
-        return chain;
-    }
-    const client = { from: (t) => builder(t) };
-    const bundle = {
-        serviceClient: client,
-        forRequest: () => client
-    };
-    return { bundle, inserted };
-}
-describe('SupabaseComputeServerStore — apiKey encryption at rest', () => {
-    beforeEach(() => vi.restoreAllMocks());
-    it('encrypts apiKey before insert — DB never sees plaintext', async () => {
-        const { bundle, inserted } = fakeBundle();
-        const store = new SupabaseComputeServerStore(bundle, KEY);
-        await store.savePlatformServers(SYSTEM_CTX, [
-            {
-                id: 's1',
-                label: 'prod',
-                serverUrl: 'https://compute.example.com',
-                apiKey: 'super-secret-key',
-                scope: 'platform',
-                sharedWith: 'all'
-            }
-        ], 's1');
-        const rows = inserted['compute_servers'];
-        expect(rows).toHaveLength(1);
-        expect(rows[0].api_key).not.toBe('super-secret-key');
-        expect(isEncryptedSecret(rows[0].api_key)).toBe(true);
-        // And it's genuinely our plaintext under the envelope.
-        expect(decryptSecret(rows[0].api_key, KEY)).toBe('super-secret-key');
-    });
-    it('decrypts apiKey on read — callers see plaintext', async () => {
-        // Seed the "DB" with an already-encrypted row.
-        const { encryptSecret } = await import('@selvajs/platform/computeServer');
-        const envelope = encryptSecret('round-trip-key', KEY);
-        const { bundle } = fakeBundle({
-            compute_servers: [
-                {
-                    id: 's1',
-                    scope: 'platform',
-                    owner_org_id: null,
-                    shared_with_all: true,
-                    label: 'prod',
-                    server_url: 'https://compute.example.com',
-                    api_key: envelope,
-                    timeout_ms: null,
-                    retry_count: null
-                }
-            ]
-        });
-        const store = new SupabaseComputeServerStore(bundle, KEY);
-        const config = await store.getConfig(SYSTEM_CTX);
-        expect(config.servers).toHaveLength(1);
-        expect(config.servers[0].apiKey).toBe('round-trip-key');
-    });
-    it('throws rather than persist plaintext when no key is configured', async () => {
-        const { bundle } = fakeBundle();
-        const store = new SupabaseComputeServerStore(bundle); // no key
-        await expect(store.savePlatformServers(SYSTEM_CTX, [
-            {
-                id: 's1',
-                label: 'prod',
-                serverUrl: 'https://compute.example.com',
-                apiKey: 'secret',
-                scope: 'platform',
-                sharedWith: 'all'
-            }
-        ], 's1')).rejects.toThrow(/SELVA_AT_REST_KEY/);
-    });
-    it('verifySecrets flags a plaintext row', async () => {
-        const { bundle } = fakeBundle({
-            compute_servers: [{ id: 's1', label: 'legacy', api_key: 'raw-plaintext' }]
-        });
-        const store = new SupabaseComputeServerStore(bundle, KEY);
-        const report = await store.verifySecrets();
-        expect(report.ok).toBe(false);
-        expect(report.plaintextFound).toBe(true);
-        expect(report.failures).toEqual([
-            { serverId: 's1', serverLabel: 'legacy', reason: 'plaintext_on_disk' }
-        ]);
-    });
-    it('verifySecrets reports key_mismatch when the at-rest key rotated', async () => {
-        const { encryptSecret } = await import('@selvajs/platform/computeServer');
-        const envelope = encryptSecret('secret', randomBytes(32)); // different key
-        const { bundle } = fakeBundle({
-            compute_servers: [{ id: 's1', label: 'prod', api_key: envelope }]
-        });
-        const store = new SupabaseComputeServerStore(bundle, KEY);
-        const report = await store.verifySecrets();
-        expect(report.ok).toBe(false);
-        expect(report.plaintextFound).toBe(false);
-        expect(report.failures[0]).toMatchObject({ serverId: 's1', reason: 'key_mismatch' });
-    });
-    it('verifySecrets returns ok when every apiKey decrypts', async () => {
-        const { encryptSecret } = await import('@selvajs/platform/computeServer');
-        const { bundle } = fakeBundle({
-            compute_servers: [{ id: 's1', label: 'prod', api_key: encryptSecret('k', KEY) }]
-        });
-        const store = new SupabaseComputeServerStore(bundle, KEY);
-        const report = await store.verifySecrets();
-        expect(report).toEqual({ ok: true, failures: [], plaintextFound: false });
-    });
-});
-//# sourceMappingURL=compute-server-encryption.test.js.map

package/dist/data/__tests__/compute-server-encryption.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"compute-server-encryption.test.js","sourceRoot":"","sources":["../../../src/data/__tests__/compute-server-encryption.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAEnF,OAAO,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AAG9E,MAAM,UAAU,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAA+B,CAAC;AAC7E,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;AAE5B;;;;GAIG;AACH,SAAS,UAAU,CAAC,aAAwC,EAAE;IAC7D,MAAM,QAAQ,GAA8B,EAAE,CAAC;IAE/C,SAAS,OAAO,CAAC,KAAa;QAC7B,MAAM,MAAM,GAAG,EAAE,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC9D,MAAM,KAAK,GAA4B;YACtC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;gBACd,GAAG,KAAK;gBACR,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;gBAChF,IAAI,EAAE,CAAC,OAAgC,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;aAC3D,CAAC;YACF,MAAM,EAAE,CAAC,IAAa,EAAE,EAAE;gBACzB,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAiB,CAAC,CAAC;gBACpE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YACxB,CAAC;YACD,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAC5E,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAC/C,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;SAC/B,CAAC;QACF,OAAO,KAAK,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,EAAE,IAAI,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IACnD,MAAM,MAAM,GAAG;QACd,aAAa,EAAE,MAAM;QACrB,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM;KACG,CAAC;IAC7B,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC7B,CAAC;AAED,QAAQ,CAAC,wDAAwD,EAAE,GAAG,EAAE;IACvE,UAAU,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;IAEvC,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,UAAU,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,IAAI,0BAA0B,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAE1D,MAAM,KAAK,CAAC,mBAAmB,CAC9B,UAAU,EACV;YACC;gBACC,EAAE,EAAE,IAAI;gBACR,KAAK,EAAE,MAAM;gBACb,SAAS,EAAE,6BAA6B;gBACxC,MAAM,EAAE,kBAAkB;gBAC1B,KAAK,EAAE,UAAU;gBACjB,UAAU,EAAE,KAAK;aACjB;SACD,EACD,IAAI,CACJ,CAAC;QAEF,MAAM,IAAI,GAAG,QAAQ,CAAC,iBAAiB,CAA+B,CAAC;QACvE,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACrD,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtD,uDAAuD;QACvD,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAChE,+CAA+C;QAC/C,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,iCAAiC,CAAC,CAAC;QAC1E,MAAM,QAAQ,GAAG,aAAa,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;QACtD,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC;YAC7B,eAAe,EAAE;gBAChB;oBACC,EAAE,EAAE,IAAI;oBACR,KAAK,EAAE,UAAU;oBACjB,YAAY,EAAE,IAAI;oBAClB,eAAe,EAAE,IAAI;oBACrB,KAAK,EAAE,MAAM;oBACb,UAAU,EAAE,6BAA6B;oBACzC,OAAO,EAAE,QAAQ;oBACjB,UAAU,EAAE,IAAI;oBAChB,WAAW,EAAE,IAAI;iBACjB;aACD;SACD,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,0BAA0B,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAE1D,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACjD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACvC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,IAAI,0BAA0B,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QAE/D,MAAM,MAAM,CACX,KAAK,CAAC,mBAAmB,CACxB,UAAU,EACV;YACC;gBACC,EAAE,EAAE,IAAI;gBACR,KAAK,EAAE,MAAM;gBACb,SAAS,EAAE,6BAA6B;gBACxC,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,UAAU;gBACjB,UAAU,EAAE,KAAK;aACjB;SACD,EACD,IAAI,CACJ,CACD,CAAC,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC;YAC7B,eAAe,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;SAC1E,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,0BAA0B,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAE1D,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE,CAAC;QAC3C,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC;YAC/B,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,mBAAmB,EAAE;SACtE,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,iCAAiC,CAAC,CAAC;QAC1E,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,gBAAgB;QAC3E,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC;YAC7B,eAAe,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;SACjE,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,0BAA0B,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAE1D,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE,CAAC;QAC3C,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,iCAAiC,CAAC,CAAC;QAC1E,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC;YAC7B,eAAe,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;SAChF,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,0BAA0B,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAE1D,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE,CAAC;QAC3C,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/data/__tests__/definition-conformance.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=definition-conformance.test.d.ts.map

package/dist/data/__tests__/definition-conformance.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"definition-conformance.test.d.ts","sourceRoot":"","sources":["../../../src/data/__tests__/definition-conformance.test.ts"],"names":[],"mappings":""}

package/dist/data/__tests__/definition-conformance.test.js

@@ -1,85 +0,0 @@
-import { describe, beforeEach, it } from 'vitest';
-import { runDefinitionStoreConformance } from '@selvajs/platform/testing';
-import { DEFAULT_ORG_PERMISSIONS } from '@selvajs/platform';
-import { SupabaseDefinitionStore } from '../SupabaseDefinitionStore.js';
-import { readEnv, resetAllData, seedUser } from './test-helpers.js';
-const envCtx = readEnv();
-if (!envCtx) {
-    describe.skip('SupabaseDefinitionStore (skipped: no live stack)', () => {
-        it('populate packages/providers/supabase/.env.test with Supabase creds to run these tests', () => { });
-    });
-}
-else {
-    describe('SupabaseDefinitionStore', () => {
-        beforeEach(async () => {
-            await resetAllData(envCtx);
-        });
-        runDefinitionStoreConformance({
-            name: 'SupabaseDefinitionStore',
-            createStore: () => new SupabaseDefinitionStore(envCtx.bundle),
-            createScope: async () => {
-                // Seed: 1 owner + 1 secondary user + 1 org + 2 projects. Definitions
-                // created in the suite FK to one of those two projects.
-                const { userId: ownerId, sessionToken: ownerSessionToken } = await seedUser(envCtx, '');
-                const { userId: secondaryUserId, sessionToken: secondaryUserSessionToken } = await seedUser(envCtx, '');
-                const orgId = crypto.randomUUID();
-                const projectId = crypto.randomUUID();
-                const secondaryProjectId = crypto.randomUUID();
-                const now = new Date().toISOString();
-                const admin = envCtx.adminClient;
-                const { error: orgError } = await admin.from('orgs').insert({
-                    id: orgId,
-                    name: 'Definition Test Org',
-                    slug: `def-test-${orgId.slice(0, 8)}`,
-                    owner_id: ownerId,
-                    created_at: now,
-                    updated_at: now
-                });
-                if (orgError)
-                    throw orgError;
-                const { error: memberError } = await admin.from('org_members').insert({
-                    org_id: orgId,
-                    user_id: ownerId,
-                    role: 'owner',
-                    permissions: [...DEFAULT_ORG_PERMISSIONS.owner],
-                    joined_at: now
-                });
-                if (memberError)
-                    throw memberError;
-                const { error: p1Error } = await admin.from('projects').insert([
-                    {
-                        id: projectId,
-                        org_id: orgId,
-                        name: 'Project A',
-                        slug: `proj-a-${projectId.slice(0, 8)}`,
-                        visibility: 'public',
-                        owner_id: ownerId,
-                        created_at: now,
-                        updated_at: now
-                    },
-                    {
-                        id: secondaryProjectId,
-                        org_id: orgId,
-                        name: 'Project B',
-                        slug: `proj-b-${secondaryProjectId.slice(0, 8)}`,
-                        visibility: 'public',
-                        owner_id: ownerId,
-                        created_at: now,
-                        updated_at: now
-                    }
-                ]);
-                if (p1Error)
-                    throw p1Error;
-                return {
-                    ownerId,
-                    ownerSessionToken,
-                    projectId,
-                    secondaryProjectId,
-                    secondaryUserId,
-                    secondaryUserSessionToken
-                };
-            }
-        });
-    });
-}
-//# sourceMappingURL=definition-conformance.test.js.map

package/dist/data/__tests__/definition-conformance.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"definition-conformance.test.js","sourceRoot":"","sources":["../../../src/data/__tests__/definition-conformance.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAE,6BAA6B,EAAE,MAAM,2BAA2B,CAAC;AAC1E,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAEpE,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC;AAEzB,IAAI,CAAC,MAAM,EAAE,CAAC;IACb,QAAQ,CAAC,IAAI,CAAC,kDAAkD,EAAE,GAAG,EAAE;QACtE,EAAE,CAAC,uFAAuF,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACvG,CAAC,CAAC,CAAC;AACJ,CAAC;KAAM,CAAC;IACP,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACxC,UAAU,CAAC,KAAK,IAAI,EAAE;YACrB,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;QAEH,6BAA6B,CAAC;YAC7B,IAAI,EAAE,yBAAyB;YAC/B,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,uBAAuB,CAAC,MAAM,CAAC,MAAM,CAAC;YAC7D,WAAW,EAAE,KAAK,IAAI,EAAE;gBACvB,qEAAqE;gBACrE,wDAAwD;gBACxD,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBACxF,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,YAAY,EAAE,yBAAyB,EAAE,GAAG,MAAM,QAAQ,CAC1F,MAAM,EACN,EAAE,CACF,CAAC;gBACF,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;gBAClC,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;gBACtC,MAAM,kBAAkB,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;gBAC/C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;gBACrC,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC;gBAEjC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;oBAC3D,EAAE,EAAE,KAAK;oBACT,IAAI,EAAE,qBAAqB;oBAC3B,IAAI,EAAE,YAAY,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;oBACrC,QAAQ,EAAE,OAAO;oBACjB,UAAU,EAAE,GAAG;oBACf,UAAU,EAAE,GAAG;iBACf,CAAC,CAAC;gBACH,IAAI,QAAQ;oBAAE,MAAM,QAAQ,CAAC;gBAC7B,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC;oBACrE,MAAM,EAAE,KAAK;oBACb,OAAO,EAAE,OAAO;oBAChB,IAAI,EAAE,OAAO;oBACb,WAAW,EAAE,CAAC,GAAG,uBAAuB,CAAC,KAAK,CAAC;oBAC/C,SAAS,EAAE,GAAG;iBACd,CAAC,CAAC;gBACH,IAAI,WAAW;oBAAE,MAAM,WAAW,CAAC;gBAEnC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;oBAC9D;wBACC,EAAE,EAAE,SAAS;wBACb,MAAM,EAAE,KAAK;wBACb,IAAI,EAAE,WAAW;wBACjB,IAAI,EAAE,UAAU,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;wBACvC,UAAU,EAAE,QAAQ;wBACpB,QAAQ,EAAE,OAAO;wBACjB,UAAU,EAAE,GAAG;wBACf,UAAU,EAAE,GAAG;qBACf;oBACD;wBACC,EAAE,EAAE,kBAAkB;wBACtB,MAAM,EAAE,KAAK;wBACb,IAAI,EAAE,WAAW;wBACjB,IAAI,EAAE,UAAU,kBAAkB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;wBAChD,UAAU,EAAE,QAAQ;wBACpB,QAAQ,EAAE,OAAO;wBACjB,UAAU,EAAE,GAAG;wBACf,UAAU,EAAE,GAAG;qBACf;iBACD,CAAC,CAAC;gBACH,IAAI,OAAO;oBAAE,MAAM,OAAO,CAAC;gBAE3B,OAAO;oBACN,OAAO;oBACP,iBAAiB;oBACjB,SAAS;oBACT,kBAAkB;oBAClB,eAAe;oBACf,yBAAyB;iBACzB,CAAC;YACH,CAAC;SACD,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACJ,CAAC"}

package/dist/data/__tests__/event-sink-conformance.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=event-sink-conformance.test.d.ts.map

package/dist/data/__tests__/event-sink-conformance.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"event-sink-conformance.test.d.ts","sourceRoot":"","sources":["../../../src/data/__tests__/event-sink-conformance.test.ts"],"names":[],"mappings":""}

package/dist/data/__tests__/event-sink-conformance.test.js

@@ -1,27 +0,0 @@
-import { describe, beforeEach, it } from 'vitest';
-import { runEventSinkConformance } from '@selvajs/platform/testing';
-import { SupabaseDataProvider } from '../SupabaseDataProvider.js';
-import { readEnv, resetAllData, seedUser } from './test-helpers.js';
-const envCtx = readEnv();
-if (!envCtx) {
-    describe.skip('SupabaseDataProvider event-sink (skipped: no live stack)', () => {
-        it('populate packages/providers/supabase/.env.test with Supabase creds to run these tests', () => { });
-    });
-}
-else {
-    describe('SupabaseDataProvider event-sink', () => {
-        beforeEach(async () => {
-            await resetAllData(envCtx);
-        });
-        runEventSinkConformance({
-            name: 'SupabaseDataProvider',
-            createProvider: (sink) => SupabaseDataProvider.create({
-                supabaseUrl: envCtx.url,
-                anonKey: envCtx.anonKey,
-                serviceRoleKey: envCtx.serviceRoleKey
-            }, sink),
-            createActorId: () => seedUser(envCtx, '')
-        });
-    });
-}
-//# sourceMappingURL=event-sink-conformance.test.js.map

package/dist/data/__tests__/event-sink-conformance.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"event-sink-conformance.test.js","sourceRoot":"","sources":["../../../src/data/__tests__/event-sink-conformance.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAE,uBAAuB,EAA2B,MAAM,2BAA2B,CAAC;AAC7F,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAEpE,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC;AAEzB,IAAI,CAAC,MAAM,EAAE,CAAC;IACb,QAAQ,CAAC,IAAI,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAC9E,EAAE,CAAC,uFAAuF,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACvG,CAAC,CAAC,CAAC;AACJ,CAAC;KAAM,CAAC;IACP,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;QAChD,UAAU,CAAC,KAAK,IAAI,EAAE;YACrB,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;QAEH,uBAAuB,CAAC;YACvB,IAAI,EAAE,sBAAsB;YAC5B,cAAc,EAAE,CAAC,IAAwB,EAAE,EAAE,CAC5C,oBAAoB,CAAC,MAAM,CAC1B;gBACC,WAAW,EAAE,MAAM,CAAC,GAAG;gBACvB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,cAAc,EAAE,MAAM,CAAC,cAAc;aACrC,EACD,IAAI,CACJ;YACF,aAAa,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;SACzC,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACJ,CAAC"}

package/dist/data/__tests__/invite-conformance.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=invite-conformance.test.d.ts.map

package/dist/data/__tests__/invite-conformance.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"invite-conformance.test.d.ts","sourceRoot":"","sources":["../../../src/data/__tests__/invite-conformance.test.ts"],"names":[],"mappings":""}

package/dist/data/__tests__/invite-conformance.test.js

@@ -1,45 +0,0 @@
-import { describe, beforeEach, it } from 'vitest';
-import { runInviteStoreConformance } from '@selvajs/platform/testing';
-import { DEFAULT_ORG_PERMISSIONS } from '@selvajs/platform';
-import { SupabaseInviteStore } from '../SupabaseInviteStore.js';
-import { readEnv, resetAllData, seedUser } from './test-helpers.js';
-const envCtx = readEnv();
-if (!envCtx) {
-    describe.skip('SupabaseInviteStore (skipped: no live stack)', () => {
-        it('populate packages/providers/supabase/.env.test with Supabase creds to run these tests', () => { });
-    });
-}
-else {
-    describe('SupabaseInviteStore', () => {
-        beforeEach(async () => {
-            await resetAllData(envCtx);
-        });
-        runInviteStoreConformance({
-            name: 'SupabaseInviteStore',
-            createStore: () => new SupabaseInviteStore(envCtx.bundle),
-            createScope: async () => {
-                const { userId: adminId, sessionToken: adminSessionToken } = await seedUser(envCtx, '');
-                const orgId = crypto.randomUUID();
-                const now = new Date().toISOString();
-                await envCtx.adminClient.from('orgs').insert({
-                    id: orgId,
-                    name: 'Invite Test Org',
-                    slug: `invite-test-${orgId.slice(0, 8)}`,
-                    owner_id: adminId,
-                    created_at: now,
-                    updated_at: now
-                });
-                await envCtx.adminClient.from('org_members').insert({
-                    org_id: orgId,
-                    user_id: adminId,
-                    role: 'owner',
-                    permissions: [...DEFAULT_ORG_PERMISSIONS.owner],
-                    joined_at: now
-                });
-                return { adminId, adminSessionToken, orgId };
-            },
-            seedUser: (id) => seedUser(envCtx, id)
-        });
-    });
-}
-//# sourceMappingURL=invite-conformance.test.js.map

package/dist/data/__tests__/invite-conformance.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"invite-conformance.test.js","sourceRoot":"","sources":["../../../src/data/__tests__/invite-conformance.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAEpE,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC;AAEzB,IAAI,CAAC,MAAM,EAAE,CAAC;IACb,QAAQ,CAAC,IAAI,CAAC,8CAA8C,EAAE,GAAG,EAAE;QAClE,EAAE,CAAC,uFAAuF,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACvG,CAAC,CAAC,CAAC;AACJ,CAAC;KAAM,CAAC;IACP,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;QACpC,UAAU,CAAC,KAAK,IAAI,EAAE;YACrB,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;QAEH,yBAAyB,CAAC;YACzB,IAAI,EAAE,qBAAqB;YAC3B,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC;YACzD,WAAW,EAAE,KAAK,IAAI,EAAE;gBACvB,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBACxF,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;gBAClC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;gBACrC,MAAM,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;oBAC5C,EAAE,EAAE,KAAK;oBACT,IAAI,EAAE,iBAAiB;oBACvB,IAAI,EAAE,eAAe,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;oBACxC,QAAQ,EAAE,OAAO;oBACjB,UAAU,EAAE,GAAG;oBACf,UAAU,EAAE,GAAG;iBACf,CAAC,CAAC;gBACH,MAAM,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC;oBACnD,MAAM,EAAE,KAAK;oBACb,OAAO,EAAE,OAAO;oBAChB,IAAI,EAAE,OAAO;oBACb,WAAW,EAAE,CAAC,GAAG,uBAAuB,CAAC,KAAK,CAAC;oBAC/C,SAAS,EAAE,GAAG;iBACd,CAAC,CAAC;gBACH,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC;YAC9C,CAAC;YACD,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;SACtC,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACJ,CAAC"}

package/dist/data/__tests__/org-conformance.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=org-conformance.test.d.ts.map

package/dist/data/__tests__/org-conformance.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"org-conformance.test.d.ts","sourceRoot":"","sources":["../../../src/data/__tests__/org-conformance.test.ts"],"names":[],"mappings":""}

package/dist/data/__tests__/org-conformance.test.js

@@ -1,29 +0,0 @@
-import { describe, beforeEach, it } from 'vitest';
-import { runOrgStoreConformance } from '@selvajs/platform/testing';
-import { SupabaseOrgStore } from '../SupabaseOrgStore.js';
-import { SupabaseInviteStore } from '../SupabaseInviteStore.js';
-import { SupabaseComputeServerStore } from '../SupabaseComputeServerStore.js';
-import { readEnv, resetAllData, seedUser } from './test-helpers.js';
-const envCtx = readEnv();
-if (!envCtx) {
-    describe.skip('SupabaseOrgStore (skipped: no live stack)', () => {
-        it('populate packages/providers/supabase/.env.test with Supabase creds to run these tests', () => { });
-    });
-}
-else {
-    describe('SupabaseOrgStore', () => {
-        beforeEach(async () => {
-            await resetAllData(envCtx);
-        });
-        runOrgStoreConformance({
-            name: 'SupabaseOrgStore',
-            createStore: () => new SupabaseOrgStore(envCtx.bundle),
-            seedUser: (id) => seedUser(envCtx, id),
-            createCompanionStores: () => ({
-                invites: new SupabaseInviteStore(envCtx.bundle),
-                computeServer: new SupabaseComputeServerStore(envCtx.bundle)
-            })
-        });
-    });
-}
-//# sourceMappingURL=org-conformance.test.js.map

package/dist/data/__tests__/org-conformance.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"org-conformance.test.js","sourceRoot":"","sources":["../../../src/data/__tests__/org-conformance.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AAC9E,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAEpE,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC;AAEzB,IAAI,CAAC,MAAM,EAAE,CAAC;IACb,QAAQ,CAAC,IAAI,CAAC,2CAA2C,EAAE,GAAG,EAAE;QAC/D,EAAE,CAAC,uFAAuF,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACvG,CAAC,CAAC,CAAC;AACJ,CAAC;KAAM,CAAC;IACP,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;QACjC,UAAU,CAAC,KAAK,IAAI,EAAE;YACrB,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;QAEH,sBAAsB,CAAC;YACtB,IAAI,EAAE,kBAAkB;YACxB,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC;YACtD,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YACtC,qBAAqB,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC7B,OAAO,EAAE,IAAI,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC;gBAC/C,aAAa,EAAE,IAAI,0BAA0B,CAAC,MAAM,CAAC,MAAM,CAAC;aAC5D,CAAC;SACF,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACJ,CAAC"}

package/dist/data/__tests__/project-conformance.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=project-conformance.test.d.ts.map

package/dist/data/__tests__/project-conformance.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"project-conformance.test.d.ts","sourceRoot":"","sources":["../../../src/data/__tests__/project-conformance.test.ts"],"names":[],"mappings":""}