@selvajs/supabase-provider 0.14.4-beta.0 → 0.15.0-beta.2

package/src/data/SupabaseProjectStore.ts

@@ -1,431 +0,0 @@
-import type {
-	IProjectStore,
-	IEventSink,
-	Project,
-	ProjectMember,
-	ProjectRole,
-	RequestContext,
-	ListOptions,
-	Page
-} from '@selvajs/platform';
-import { ProviderError, actorFrom, NoopEventSink } from '@selvajs/platform';
-import type { ClientBundle } from './client.js';
-import { mapPostgrestError } from './errors.js';
-import { nextCursorFromRange, orderColumn, toRange } from './pagination.js';
-import { stampSoftDelete, stampUpdate } from './rowStamp.js';
-
-/** Explicit column list for `projects` — every field `rowToProject` consumes. */
-const PROJECT_COLUMNS =
-	'id, org_id, name, slug, description, visibility, owner_id, created_by, updated_by, auto_join_on_upload, created_at, updated_at, deleted_at';
-/** Explicit column list for `project_members` — every field `rowToProjectMember` consumes. */
-const PROJECT_MEMBER_COLUMNS =
-	'project_id, user_id, role, joined_at, updated_at, updated_by, deleted_at';
-
-/**
- * Project + project-membership store backed by Postgres. Visibility semantics
- * (public / org / private) are enforced by the `visible_project()` helper in
- * RLS. Access predicates (canEdit / canManage / canView etc.) live as pure
- * functions in `@selvajs/platform/access`; the route layer composes them with
- * pre-loaded entities. See `packages/selva/src/lib/server/access.server.ts`.
- *
- * `createProject` atomically seeds the creator as the project `owner` in
- * `project_members` so subsequent user-scoped reads can see it.
- */
-export class SupabaseProjectStore implements IProjectStore {
-	private readonly events: IEventSink;
-
-	constructor(
-		private readonly clients: ClientBundle,
-		events: IEventSink = new NoopEventSink()
-	) {
-		this.events = events;
-	}
-
-	async listProjects(
-		ctx: RequestContext,
-		orgId: string,
-		opts?: ListOptions
-	): Promise<Page<Project>> {
-		const range = toRange(opts);
-		const direction = opts?.orderDir ?? 'desc';
-		const { data, error, count } = await this.clients
-			.forRequest(ctx)
-			.from('projects')
-			.select(PROJECT_COLUMNS, { count: 'exact' })
-			.eq('org_id', orgId)
-			.is('deleted_at', null)
-			.order(orderColumn(opts?.orderBy), { ascending: direction === 'asc' })
-			.range(range.from, range.to);
-		if (error) throw mapPostgrestError(error);
-		const items = (data ?? []).map(rowToProject);
-		return { items, nextCursor: nextCursorFromRange(range, items.length, count) };
-	}
-
-	async getProject(ctx: RequestContext, id: string): Promise<Project | null> {
-		const { data, error } = await this.clients
-			.forRequest(ctx)
-			.from('projects')
-			.select(PROJECT_COLUMNS)
-			.eq('id', id)
-			.is('deleted_at', null)
-			.maybeSingle();
-		if (error) throw mapPostgrestError(error);
-		return data ? rowToProject(data) : null;
-	}
-
-	async getProjectBySlug(
-		ctx: RequestContext,
-		orgId: string,
-		slug: string
-	): Promise<Project | null> {
-		const { data, error } = await this.clients
-			.forRequest(ctx)
-			.from('projects')
-			.select(PROJECT_COLUMNS)
-			.eq('org_id', orgId)
-			.eq('slug', slug)
-			.is('deleted_at', null)
-			.maybeSingle();
-		if (error) throw mapPostgrestError(error);
-		return data ? rowToProject(data) : null;
-	}
-
-	async createProject(ctx: RequestContext, project: Project): Promise<void> {
-		const client = this.clients.forRequest(ctx);
-		const { error } = await client.from('projects').insert(projectToRow(project));
-		if (error) throw mapPostgrestError(error);
-
-		// Seed owner membership so user-scoped reads see the project post-create.
-		// Upsert so a stale soft-deleted row from a prior project with the same id
-		// is reactivated rather than blocking creation.
-		const { error: memberError } = await client.from('project_members').upsert(
-			{
-				project_id: project.id,
-				user_id: project.ownerId,
-				role: 'owner',
-				joined_at: new Date().toISOString(),
-				deleted_at: null
-			},
-			{ onConflict: 'project_id,user_id' }
-		);
-		if (memberError) throw mapPostgrestError(memberError);
-		await this.events.emit({
-			type: 'project.created',
-			projectId: project.id,
-			orgId: project.orgId,
-			actorId: actorFrom(ctx)
-		});
-	}
-
-	async updateProject(
-		ctx: RequestContext,
-		id: string,
-		patch: Partial<
-			Pick<Project, 'name' | 'slug' | 'description' | 'visibility' | 'autoJoinOnUpload'>
-		>
-	): Promise<void> {
-		const row: Record<string, unknown> = {};
-		if (patch.name !== undefined) row.name = patch.name;
-		if (patch.slug !== undefined) row.slug = patch.slug;
-		if (patch.description !== undefined) row.description = patch.description;
-		if (patch.visibility !== undefined) row.visibility = patch.visibility;
-		if (patch.autoJoinOnUpload !== undefined) row.auto_join_on_upload = patch.autoJoinOnUpload;
-		if (Object.keys(row).length === 0) return;
-		Object.assign(row, stampUpdate(ctx));
-
-		const { data, error } = await this.clients
-			.forRequest(ctx)
-			.from('projects')
-			.update(row)
-			.eq('id', id)
-			.is('deleted_at', null)
-			.select('id');
-		if (error) throw mapPostgrestError(error);
-		if (!data || data.length === 0) throw new ProviderError(`Project '${id}' not found`, 404);
-	}
-
-	async deleteProject(ctx: RequestContext, id: string): Promise<void> {
-		// §9 soft-delete with cascade. Mirrors LocalProjectStore: project →
-		// project_members, definitions. FK CASCADE doesn't fire on soft-delete,
-		// so the cascade is in app code.
-		const client = this.clients.forRequest(ctx);
-		const stampRow = stampSoftDelete(ctx);
-
-		const { data, error } = await client
-			.from('projects')
-			.update(stampRow)
-			.eq('id', id)
-			.is('deleted_at', null)
-			.select('id');
-		if (error) throw mapPostgrestError(error);
-		if (!data || data.length === 0) throw new ProviderError(`Project '${id}' not found`, 404);
-
-		const { error: pmErr } = await client
-			.from('project_members')
-			.update(stampRow)
-			.eq('project_id', id)
-			.is('deleted_at', null);
-		if (pmErr) throw mapPostgrestError(pmErr);
-
-		// Cascade to definitions. `select('guid')` returns the tombstoned rows so
-		// we emit one `definition.deleted` per record — parity with the single
-		// `delete` path and with `SupabaseDefinitionStore.deleteByProject` /
-		// `LocalProjectStore.deleteProject`. (Kept inline rather than delegating to
-		// the definition store to avoid a cross-store constructor dependency; the
-		// behavior must stay identical to `deleteByProject`.)
-		const { data: deletedDefs, error: defErr } = await client
-			.from('definitions')
-			.update(stampRow)
-			.eq('project_id', id)
-			.is('deleted_at', null)
-			.select('guid');
-		if (defErr) throw mapPostgrestError(defErr);
-		for (const row of deletedDefs ?? []) {
-			await this.events.emit({
-				type: 'definition.deleted',
-				definitionId: row.guid,
-				actorId: actorFrom(ctx)
-			});
-		}
-
-		await this.events.emit({ type: 'project.deleted', projectId: id, actorId: actorFrom(ctx) });
-	}
-
-	async reactivateProject(
-		ctx: RequestContext,
-		orgId: string,
-		slug: string
-	): Promise<Project | null> {
-		const client = this.clients.forRequest(ctx);
-
-		// Clear the tombstone. The WHERE deleted_at IS NOT NULL ensures we never
-		// accidentally clobber a live row, and the unique constraint means there
-		// can be at most one tombstone per (org_id, slug) at any time.
-		const { data, error } = await client
-			.from('projects')
-			.update({ deleted_at: null })
-			.eq('org_id', orgId)
-			.eq('slug', slug)
-			.not('deleted_at', 'is', null)
-			.select(PROJECT_COLUMNS)
-			.maybeSingle();
-		if (error) throw mapPostgrestError(error);
-		if (!data) return null;
-
-		// Reactivate the owner's project_members row (deleteProject cascades to it).
-		const { error: pmErr } = await client
-			.from('project_members')
-			.update({ deleted_at: null })
-			.eq('project_id', data.id)
-			.eq('user_id', data.owner_id)
-			.not('deleted_at', 'is', null);
-		if (pmErr) throw mapPostgrestError(pmErr);
-
-		const project = rowToProject(data);
-		await this.events.emit({
-			type: 'project.created',
-			projectId: project.id,
-			orgId: project.orgId,
-			actorId: actorFrom(ctx)
-		});
-		return project;
-	}
-
-	// ============================================================================
-	// Project members
-	// ============================================================================
-	async listProjectMembers(
-		ctx: RequestContext,
-		projectId: string,
-		opts?: ListOptions
-	): Promise<Page<ProjectMember>> {
-		const range = toRange(opts);
-		const { data, error, count } = await this.clients
-			.forRequest(ctx)
-			.from('project_members')
-			.select(PROJECT_MEMBER_COLUMNS, { count: 'exact' })
-			.eq('project_id', projectId)
-			.is('deleted_at', null)
-			.order('joined_at', { ascending: (opts?.orderDir ?? 'desc') === 'asc' })
-			.range(range.from, range.to);
-		if (error) throw mapPostgrestError(error);
-		const items = (data ?? []).map(rowToProjectMember);
-		return { items, nextCursor: nextCursorFromRange(range, items.length, count) };
-	}
-
-	async getProjectMember(
-		ctx: RequestContext,
-		projectId: string,
-		userId: string
-	): Promise<ProjectMember | null> {
-		const { data, error } = await this.clients
-			.forRequest(ctx)
-			.from('project_members')
-			.select(PROJECT_MEMBER_COLUMNS)
-			.eq('project_id', projectId)
-			.eq('user_id', userId)
-			.is('deleted_at', null)
-			.maybeSingle();
-		if (error) throw mapPostgrestError(error);
-		return data ? rowToProjectMember(data) : null;
-	}
-
-	async addProjectMember(ctx: RequestContext, member: ProjectMember): Promise<void> {
-		// Upsert reactivates a prior soft-deleted row instead of throwing
-		// duplicate-key. Mirrors LocalProjectStore.addProjectMember.
-		const row: Record<string, unknown> = {
-			...projectMemberToRow(member),
-			deleted_at: null,
-			...stampUpdate(ctx)
-		};
-		const { error } = await this.clients
-			.forRequest(ctx)
-			.from('project_members')
-			.upsert(row, { onConflict: 'project_id,user_id' });
-		if (error) throw mapPostgrestError(error);
-		await this.events.emit({
-			type: 'project_member.added',
-			projectId: member.projectId,
-			userId: member.userId,
-			actorId: actorFrom(ctx)
-		});
-	}
-
-	async updateProjectMemberRole(
-		ctx: RequestContext,
-		projectId: string,
-		userId: string,
-		role: ProjectRole
-	): Promise<void> {
-		const row: Record<string, unknown> = { role, ...stampUpdate(ctx) };
-		const { data, error } = await this.clients
-			.forRequest(ctx)
-			.from('project_members')
-			.update(row)
-			.eq('project_id', projectId)
-			.eq('user_id', userId)
-			.is('deleted_at', null)
-			.select('user_id');
-		if (error) throw mapPostgrestError(error);
-		if (!data || data.length === 0)
-			throw new ProviderError(`Project member '${userId}' not found`, 404);
-		await this.events.emit({
-			type: 'project_member.role_changed',
-			projectId,
-			userId,
-			role,
-			actorId: actorFrom(ctx)
-		});
-	}
-
-	async removeProjectMember(ctx: RequestContext, projectId: string, userId: string): Promise<void> {
-		const { error } = await this.clients
-			.forRequest(ctx)
-			.from('project_members')
-			.update(stampSoftDelete(ctx))
-			.eq('project_id', projectId)
-			.eq('user_id', userId)
-			.is('deleted_at', null);
-		if (error) throw mapPostgrestError(error);
-		await this.events.emit({
-			type: 'project_member.removed',
-			projectId,
-			userId,
-			actorId: actorFrom(ctx)
-		});
-	}
-}
-
-// ============================================================================
-// Row ↔ domain mappers
-// ============================================================================
-//
-// Audit columns (`created_by` / `updated_by`) FK to `auth.users(id)` with
-// `ON DELETE SET NULL`; they can legitimately become NULL when the user is
-// deleted (spec §8). Mappers fall back to `owner_id` so the domain type
-// stays non-nullable. Also true for ProjectMember audit columns below.
-// that haven't applied the latest migration — the mapper falls back to
-// owner_id / user_id / joined_at in those cases.
-
-interface ProjectRow {
-	id: string;
-	org_id: string;
-	name: string;
-	slug: string;
-	description: string | null;
-	visibility: Project['visibility'];
-	owner_id: string;
-	created_by?: string | null;
-	updated_by?: string | null;
-	auto_join_on_upload?: boolean | null;
-	created_at: string;
-	updated_at: string;
-	deleted_at?: string | null;
-}
-
-interface ProjectMemberRow {
-	project_id: string;
-	user_id: string;
-	role: ProjectRole;
-	joined_at: string;
-	updated_at?: string | null;
-	updated_by?: string | null;
-	deleted_at?: string | null;
-}
-
-function rowToProject(row: ProjectRow): Project {
-	return {
-		id: row.id,
-		orgId: row.org_id,
-		name: row.name,
-		slug: row.slug,
-		description: row.description ?? undefined,
-		visibility: row.visibility,
-		ownerId: row.owner_id,
-		createdBy: row.created_by ?? row.owner_id,
-		updatedBy: row.updated_by ?? row.owner_id,
-		autoJoinOnUpload: row.auto_join_on_upload ?? false,
-		createdAt: row.created_at,
-		updatedAt: row.updated_at,
-		deletedAt: row.deleted_at ?? null
-	};
-}
-
-function projectToRow(p: Project): ProjectRow {
-	return {
-		id: p.id,
-		org_id: p.orgId,
-		name: p.name,
-		slug: p.slug,
-		description: p.description ?? null,
-		visibility: p.visibility,
-		owner_id: p.ownerId,
-		created_by: p.createdBy,
-		updated_by: p.updatedBy,
-		auto_join_on_upload: p.autoJoinOnUpload,
-		created_at: p.createdAt,
-		updated_at: p.updatedAt,
-		deleted_at: p.deletedAt ?? null
-	};
-}
-
-function rowToProjectMember(row: ProjectMemberRow): ProjectMember {
-	return {
-		projectId: row.project_id,
-		userId: row.user_id,
-		role: row.role,
-		joinedAt: row.joined_at,
-		updatedAt: row.updated_at ?? row.joined_at,
-		updatedBy: row.updated_by ?? row.user_id,
-		deletedAt: row.deleted_at ?? null
-	};
-}
-
-function projectMemberToRow(m: ProjectMember): ProjectMemberRow {
-	return {
-		project_id: m.projectId,
-		user_id: m.userId,
-		role: m.role,
-		joined_at: m.joinedAt
-	};
-}

package/src/data/SupabaseShareLinkStore.ts

@@ -1,176 +0,0 @@
-import type {
-	IShareLinkStore,
-	IEventSink,
-	ShareLink,
-	RequestContext,
-	ListOptions,
-	Page
-} from '@selvajs/platform';
-import { actorFrom, NoopEventSink } from '@selvajs/platform';
-import type { ClientBundle } from './client.js';
-import { mapPostgrestError } from './errors.js';
-import { nextCursorFromRange, toRange } from './pagination.js';
-
-/** Explicit column list for `share_links` — every field `rowToLink` consumes. */
-const SHARE_LINK_COLUMNS =
-	'id, definition_guid, channel, token_hash, name, created_by, created_at, expires_at, revoked_at, allow_solve, max_solves, solve_count';
-
-/**
- * Spec §7 — share-link store backed by Postgres.
- *
- * Token resolution (`getByTokenHash`) and atomic increment use the
- * SECURITY DEFINER `try_increment_share_link_solve_count` RPC + service-
- * role client to bypass RLS — the token IS the credential, not the
- * authenticated user identity.
- *
- * `tryIncrementSolveCount` returns a single number on success or null when
- * the cap is hit. The RPC enforces "increment iff under cap and live" in
- * one statement, so even concurrent solves can't overshoot the cap.
- */
-export class SupabaseShareLinkStore implements IShareLinkStore {
-	private readonly events: IEventSink;
-
-	constructor(
-		private readonly clients: ClientBundle,
-		events: IEventSink = new NoopEventSink()
-	) {
-		this.events = events;
-	}
-
-	async create(ctx: RequestContext, link: ShareLink): Promise<void> {
-		const { error } = await this.clients
-			.forRequest(ctx)
-			.from('share_links')
-			.insert(linkToRow(link));
-		if (error) throw mapPostgrestError(error);
-		await this.events.emit({
-			type: 'share_link.minted',
-			linkId: link.id,
-			definitionId: link.definitionId,
-			actorId: actorFrom(ctx)
-		});
-	}
-
-	async listByDefinition(
-		ctx: RequestContext,
-		definitionId: string,
-		opts?: ListOptions
-	): Promise<Page<ShareLink>> {
-		const range = toRange(opts);
-		const { data, error, count } = await this.clients
-			.forRequest(ctx)
-			.from('share_links')
-			.select(SHARE_LINK_COLUMNS, { count: 'exact' })
-			.eq('definition_guid', definitionId)
-			.is('revoked_at', null)
-			.order('created_at', { ascending: false })
-			.range(range.from, range.to);
-		if (error) throw mapPostgrestError(error);
-		const items = (data ?? []).map(rowToLink);
-		return { items, nextCursor: nextCursorFromRange(range, items.length, count) };
-	}
-
-	async getById(ctx: RequestContext, id: string): Promise<ShareLink | null> {
-		const { data, error } = await this.clients
-			.forRequest(ctx)
-			.from('share_links')
-			.select(SHARE_LINK_COLUMNS)
-			.eq('id', id)
-			.maybeSingle();
-		if (error) throw mapPostgrestError(error);
-		return data ? rowToLink(data) : null;
-	}
-
-	async getByTokenHash(_ctx: RequestContext, tokenHash: string): Promise<ShareLink | null> {
-		// Service-role: token resolution must work for anonymous requests too.
-		// RLS would scope the query down to "links the current user can see"
-		// — exactly the wrong semantic for token-credentialed access.
-		const { data, error } = await this.clients.serviceClient
-			.from('share_links')
-			.select(`${SHARE_LINK_COLUMNS}, definitions!inner(deleted_at)`)
-			.eq('token_hash', tokenHash)
-			.is('revoked_at', null)
-			.is('definitions.deleted_at', null)
-			.maybeSingle();
-		if (error) throw mapPostgrestError(error);
-		return data ? rowToLink(data) : null;
-	}
-
-	async revoke(ctx: RequestContext, id: string): Promise<void> {
-		// Idempotent: succeeds whether or not the row exists / is already
-		// revoked. The `is null` predicate on revoked_at means a re-revoke
-		// is a no-op (no row updated).
-		const { error } = await this.clients
-			.forRequest(ctx)
-			.from('share_links')
-			.update({ revoked_at: new Date().toISOString() })
-			.eq('id', id)
-			.is('revoked_at', null);
-		if (error) throw mapPostgrestError(error);
-		await this.events.emit({ type: 'share_link.revoked', linkId: id, actorId: actorFrom(ctx) });
-	}
-
-	async tryIncrementSolveCount(_ctx: RequestContext, id: string): Promise<number | null> {
-		// SECURITY DEFINER RPC — bypasses RLS. Atomic check-and-increment.
-		// Returns NULL when the link is missing/revoked/expired/capped; the
-		// row update is the only way to get a numeric return.
-		const { data, error } = await this.clients.serviceClient.rpc(
-			'try_increment_share_link_solve_count',
-			{ link_id: id }
-		);
-		if (error) throw mapPostgrestError(error);
-		return typeof data === 'number' ? data : null;
-	}
-}
-
-// ============================================================================
-// Row ↔ domain mappers
-// ============================================================================
-interface ShareLinkRow {
-	id: string;
-	definition_guid: string;
-	channel: 'live' | 'draft';
-	token_hash: string;
-	name: string | null;
-	created_by: string;
-	created_at: string;
-	expires_at: string | null;
-	revoked_at: string | null;
-	allow_solve: boolean;
-	max_solves: number | null;
-	solve_count: number;
-}
-
-function rowToLink(row: ShareLinkRow): ShareLink {
-	return {
-		id: row.id,
-		definitionId: row.definition_guid,
-		channel: row.channel,
-		tokenHash: row.token_hash,
-		name: row.name ?? undefined,
-		createdBy: row.created_by,
-		createdAt: row.created_at,
-		expiresAt: row.expires_at,
-		revokedAt: row.revoked_at,
-		allowSolve: row.allow_solve,
-		maxSolves: row.max_solves,
-		solveCount: row.solve_count
-	};
-}
-
-function linkToRow(l: ShareLink): Record<string, unknown> {
-	return {
-		id: l.id,
-		definition_guid: l.definitionId,
-		channel: l.channel,
-		token_hash: l.tokenHash,
-		name: l.name ?? null,
-		created_by: l.createdBy,
-		created_at: l.createdAt,
-		expires_at: l.expiresAt ?? null,
-		revoked_at: l.revokedAt ?? null,
-		allow_solve: l.allowSolve,
-		max_solves: l.maxSolves ?? null,
-		solve_count: l.solveCount
-	};
-}

package/src/data/SupabaseSolveMetricSink.ts

@@ -1,38 +0,0 @@
-import type { ISolveMetricSink, RequestContext, SolveMetric } from '@selvajs/platform';
-import type { ClientBundle } from './client.js';
-
-/**
- * Persists every solve's timing to `selva.solve_metrics`. Writes use the
- * service-role client so RLS does not gate the telemetry — the sink runs as a
- * system process attached to the compute route, not the requesting user.
- *
- * Per the `ISolveMetricSink` contract, `record` MUST NOT throw. It sits on the
- * hot path of every solve and the response has already been produced by the
- * time we're here, so a failed insert is logged and swallowed.
- */
-export class SupabaseSolveMetricSink implements ISolveMetricSink {
-	constructor(private readonly clients: ClientBundle) {}
-
-	async record(_ctx: RequestContext, metric: SolveMetric): Promise<void> {
-		try {
-			const { error } = await this.clients.serviceClient.from('solve_metrics').insert({
-				actor_id: _ctx.userId || 'system',
-				definition_url: metric.definitionUrl,
-				definition_id: metric.definitionId,
-				version_id: metric.versionId,
-				channel: metric.channel,
-				org_id: metric.orgId,
-				duration_ms: metric.durationMs,
-				ok: metric.ok,
-				failure_kind: metric.failureKind,
-				error_count: metric.errorCount,
-				warning_count: metric.warningCount
-			});
-			if (error) {
-				console.error('[SupabaseSolveMetricSink] insert failed:', error.message, { metric });
-			}
-		} catch (err) {
-			console.error('[SupabaseSolveMetricSink] unexpected error:', err, { metric });
-		}
-	}
-}

package/src/data/__tests__/compute-server-conformance.test.ts

@@ -1,46 +0,0 @@
-import { describe, beforeEach, it } from 'vitest';
-import { randomBytes } from 'node:crypto';
-import { runComputeServerStoreConformance } from '@selvajs/platform/testing';
-import { SupabaseComputeServerStore } from '../SupabaseComputeServerStore.js';
-import { readEnv, resetAllData, seedUser } from './test-helpers.js';
-
-const envCtx = readEnv();
-
-// A throwaway at-rest key so the store encrypts apiKeys during the suite. The
-// round-trip (encrypt on write, decrypt on read) must be transparent to the
-// conformance assertions, which compare plaintext apiKeys.
-const TEST_SECRET_KEY = randomBytes(32);
-
-if (!envCtx) {
-	describe.skip('SupabaseComputeServerStore (skipped: no live stack)', () => {
-		it('populate packages/providers/supabase/.env.test with Supabase creds to run these tests', () => {});
-	});
-} else {
-	describe('SupabaseComputeServerStore', () => {
-		beforeEach(async () => {
-			await resetAllData(envCtx);
-		});
-
-		runComputeServerStoreConformance({
-			name: 'SupabaseComputeServerStore',
-			createStore: () => new SupabaseComputeServerStore(envCtx.bundle, TEST_SECRET_KEY),
-			seedOrg: async (orgId) => {
-				// `compute_servers.owner_org_id` and `compute_server_org_defaults.org_id`
-				// FK to `orgs(id)`; the suite invents an `orgId` per org-scoped test,
-				// so we materialize the parent org here. Owner is a throwaway user
-				// (the org-scoped tests use SYSTEM_CONTEXT for writes anyway).
-				const { userId } = await seedUser(envCtx, '');
-				const now = new Date().toISOString();
-				const { error } = await envCtx.adminClient.from('orgs').insert({
-					id: orgId,
-					name: 'Compute Test Org',
-					slug: `compute-${orgId.slice(0, 8)}`,
-					owner_id: userId,
-					created_at: now,
-					updated_at: now
-				});
-				if (error) throw error;
-			}
-		});
-	});
-}