@selvajs/supabase-provider 0.14.4-beta.0 → 0.15.0-beta.2

package/supabase/migrations/20260712120000_user_profiles_disabled_and_gin.sql

@@ -0,0 +1,95 @@
+-- ============================================================================
+-- user_profiles.disabled denormalization + platform_permissions GIN index
+--
+-- The instance-admin invariant queries ("is there an enabled instance_admin?",
+-- "how many enabled admins besides X?") previously selected candidate ids and
+-- then called the GoTrue admin API once per candidate just to read
+-- user_metadata.disabled — an N+1 on the bootstrap and admin-write paths.
+--
+-- auth.users.raw_user_meta_data->>'disabled' stays the source of truth (the
+-- auth provider keeps writing it via the admin API); user_profiles.disabled is
+-- a trigger-maintained read-model copy so the invariant collapses to a single
+-- indexed query. The GIN index serves the `platform_permissions @> ...`
+-- filters those queries already used.
+-- ============================================================================
+
+alter table selva.user_profiles
+	add column if not exists disabled boolean not null default false;
+
+-- Signup seed: carry disabled state for users created already-disabled (e.g.
+-- via the Supabase dashboard). Conflict semantics unchanged (do nothing) —
+-- a profile row can only pre-exist on re-fired triggers, where the update
+-- trigger below owns the sync.
+create or replace function selva.handle_new_auth_user()
+returns trigger
+language plpgsql
+security definer
+set search_path = public
+as $$
+begin
+	insert into selva.user_profiles (user_id, disabled)
+	values (new.id, coalesce((new.raw_user_meta_data ->> 'disabled')::boolean, false))
+	on conflict (user_id) do nothing;
+	return new;
+end;
+$$;
+
+-- Sync disable/enable flips. The original mirror trigger is INSERT-only, so
+-- without this the read-model copy would never see a later flip (which lands
+-- as an UPDATE of raw_user_meta_data through the GoTrue admin API).
+create or replace function selva.sync_auth_user_disabled()
+returns trigger
+language plpgsql
+security definer
+set search_path = public
+as $$
+begin
+	update selva.user_profiles
+	set disabled = coalesce((new.raw_user_meta_data ->> 'disabled')::boolean, false)
+	where user_id = new.id;
+	return new;
+end;
+$$;
+
+drop trigger if exists trg_auth_user_disabled_sync on auth.users;
+create trigger trg_auth_user_disabled_sync
+	after update of raw_user_meta_data on auth.users
+	for each row
+	when (
+		coalesce(old.raw_user_meta_data ->> 'disabled', 'false')
+		is distinct from coalesce(new.raw_user_meta_data ->> 'disabled', 'false')
+	)
+	execute function selva.sync_auth_user_disabled();
+
+-- Backfill existing rows from the source of truth.
+update selva.user_profiles p
+set disabled = coalesce((u.raw_user_meta_data ->> 'disabled')::boolean, false)
+from auth.users u
+where u.id = p.user_id
+	and p.disabled is distinct from coalesce((u.raw_user_meta_data ->> 'disabled')::boolean, false);
+
+-- The `platform_permissions @> '{instance_admin}'` filters in the permission
+-- store were sequential scans without this.
+create index if not exists idx_user_profiles_platform_permissions
+	on selva.user_profiles using gin (platform_permissions);
+
+-- Extend the self-update RLS policy: users must not be able to clear their own
+-- disabled flag (same freeze pattern as platform_permissions — only
+-- service-role writes and the sync trigger may change it).
+drop policy if exists "user_profiles: users can update own" on selva.user_profiles;
+
+create policy "user_profiles: users can update own"
+on selva.user_profiles for update
+to authenticated
+using (user_id = auth.uid())
+with check (
+	user_id = auth.uid()
+	-- Users cannot escalate their own platform permissions; only service-role
+	-- writes (which bypass RLS) may change that column.
+	and platform_permissions is not distinct from (
+		select platform_permissions from selva.user_profiles where user_id = auth.uid()
+	)
+	and disabled is not distinct from (
+		select disabled from selva.user_profiles where user_id = auth.uid()
+	)
+);

package/supabase/migrations/20260712123000_selva_migration_head_fn.sql

@@ -0,0 +1,38 @@
+-- ============================================================================
+-- selva.migration_head() — app↔DB schema handshake (audit O3)
+--
+-- The app has no way to see whether the operator applied this package's
+-- migrations: self-update only runs `npm install` + pm2 restart, and PostgREST
+-- does not expose `supabase_migrations`. This SECURITY DEFINER function makes
+-- the migration head queryable through the `selva` schema the app is pinned
+-- to. The app compares it against its compiled-in EXPECTED_MIGRATION_HEAD at
+-- boot and degrades /api/health on skew — which also makes the self-update
+-- runner's health probe auto-roll-back an update whose migrations weren't
+-- applied yet.
+--
+-- Bootstrapping is intentional: on a database that never applied THIS
+-- migration the RPC itself is missing, which the app reads as "schema behind".
+-- ============================================================================
+
+create or replace function selva.migration_head()
+returns text
+language plpgsql
+security definer
+set search_path = ''
+stable
+as $$
+begin
+	return coalesce(
+		(select max(version) from supabase_migrations.schema_migrations),
+		''
+	);
+exception
+	-- A project where the CLI never pushed migrations has no
+	-- supabase_migrations.schema_migrations table at all.
+	when undefined_table then
+		return '';
+end;
+$$;
+
+revoke all on function selva.migration_head() from public;
+grant execute on function selva.migration_head() to service_role;

package/supabase/migrations/20260713120000_selva_next_version_number.sql

@@ -0,0 +1,59 @@
+-- ============================================================================
+-- Monotonic per-definition version-number allocator (audit DC / caching Phase 1.5)
+-- ============================================================================
+--
+-- Root-cause fix for `fileKey` reuse: `uploadVersion` used to compute the next
+-- version number as max(existing)+1, so deleting the latest version freed its
+-- number and the next upload reused it — reusing the `fileKey`
+-- (`versions/v{N}.gh`) and letting a stale storage blob (or any layer keying on
+-- the key) serve the old version's bytes for new content.
+--
+-- The `next_version_number` counter lives on the definition row and only ever
+-- advances. `reserve_next_version_number` returns the current value and bumps it
+-- atomically, so concurrent uploads never collide and a deleted version's number
+-- is never handed out again.
+
+-- Column: defaults to 2 (v1 is created with the parent, so the next upload takes
+-- 2). Backfilled below for any pre-existing rows.
+alter table selva.definitions
+	add column if not exists next_version_number integer not null default 2;
+
+-- Backfill existing definitions to one past their highest live version number,
+-- so already-uploaded versions don't get their numbers reused. Idempotent: after
+-- the first run the counter is already >= this, and greatest() keeps it from
+-- ever moving backwards.
+update selva.definitions d
+set next_version_number = greatest(
+	d.next_version_number,
+	coalesce(
+		(select max(v.version_number) + 1
+		 from selva.definition_versions v
+		 where v.definition_guid = d.guid),
+		2
+	)
+);
+
+-- Atomic reserve-and-increment. Returns the reserved number (the value BEFORE
+-- the bump) and advances the counter. Never decrements. Raises if the row is
+-- missing or soft-deleted so the caller surfaces a 404 rather than silently
+-- minting a number for a dead definition.
+create or replace function selva.reserve_next_version_number(g uuid)
+returns integer
+language plpgsql security definer set search_path = public
+as $$
+declare
+	reserved integer;
+begin
+	update selva.definitions
+	set next_version_number = next_version_number + 1
+	where guid = g and deleted_at is null
+	returning next_version_number - 1 into reserved;
+
+	if reserved is null then
+		raise exception 'definition % not found', g using errcode = 'no_data_found';
+	end if;
+
+	return reserved;
+end;
+$$;
+grant execute on function selva.reserve_next_version_number(uuid) to authenticated, service_role;

package/supabase/migrations/20260713140000_selva_solve_cache_limit.sql

@@ -0,0 +1,15 @@
+-- ============================================================================
+-- Per-definition durable solve-cache quota (caching Phase 3 / R9)
+-- ============================================================================
+--
+-- `solve_cache_limit` is the definition's L2 solve-cache policy, one number:
+--   NULL → inherit the global default (SOLVE_CACHE_DEFAULT_MAX_ENTRIES)
+--   0    → caching off for this definition (non-determinism / wide-input escape hatch)
+--   N    → keep at most N cached solves for this definition
+--
+-- Nullable, no default: an absent value MEANS inherit, so existing rows need no
+-- backfill — they simply inherit the global default until an author sets a value.
+
+alter table selva.definitions
+	add column if not exists solve_cache_limit integer
+	check (solve_cache_limit is null or solve_cache_limit >= 0);

package/supabase/migrations/20260716120000_definition_status_and_audit_version.sql

@@ -0,0 +1,36 @@
+-- ============================================================================
+-- Definition-status enum cleanup (audit D2) + audit-event versioning (audit D3)
+-- ============================================================================
+
+-- D2. The definition-status CHECK admitted five values, but only four are real:
+--   pending   — metadata-first create window (DefinitionService.create writes it,
+--               a partial reclaim index tracks it). REAL — kept.
+--   draft     — work in progress.                                     REAL — kept.
+--   published — live.                                                 REAL — kept.
+--   archived  — retired but preserved.                                REAL — kept.
+--   review    — never written or read anywhere in the codebase.       DEAD — dropped.
+-- Dropping `review` while the table holds no such rows is a zero-row change; do
+-- it now, while it is a one-line CHECK swap rather than a data migration later.
+-- (Postgres has no "alter check" — drop the old constraint and add the new one.
+-- The constraint name is the Postgres-generated default `definitions_status_check`.)
+
+alter table selva.definitions
+	drop constraint if exists definitions_status_check;
+
+alter table selva.definitions
+	add constraint definitions_status_check
+	check (status in ('pending', 'draft', 'published', 'archived'));
+
+-- D3. `audit_events` is append-only forever: every row written before a version
+-- marker exists is a row whose payload shape must be inferred later. Add an
+-- explicit `event_version` column now so the `data` envelope carries its schema
+-- version out of band. Existing rows are the v1 shape by definition, so default
+-- + backfill to 1; NOT NULL once populated.
+
+alter table selva.audit_events
+	add column if not exists event_version integer not null default 1;
+
+comment on column selva.audit_events.event_version is
+	'Schema version of the `data` payload (the DomainEvent envelope). Bump when '
+	'the persisted shape changes so readers can dispatch on version instead of '
+	'inferring it. v1 = the initial DomainEvent union.';

package/supabase/migrations/20260716130000_erase_user_audit_email.sql

@@ -0,0 +1,36 @@
+-- ============================================================================
+-- User-erasure helper: redact an email out of invite.created audit payloads
+-- (audit P1)
+-- ============================================================================
+--
+-- `invite.created` domain events embed the invitee's email in the audit
+-- payload (`data->>'email'`). Those rows are authored by the INVITER, so on the
+-- invitee's erasure the row must survive (it records the inviter's action) but
+-- the invitee's email must be scrubbed. This function redacts the `email` key
+-- in place for every matching row, in one statement.
+--
+-- SECURITY DEFINER so `onUserDeleted` can call it through the service-role
+-- client without granting the caller direct UPDATE on audit_events. Scoped to
+-- `type = 'invite.created'` — the only event shape that carries an email.
+
+create or replace function selva.redact_audit_event_email(p_email text)
+returns integer
+language plpgsql
+security definer
+set search_path = selva, pg_temp
+as $$
+declare
+	affected integer;
+begin
+	update selva.audit_events
+	set data = jsonb_set(data, '{email}', '"[erased]"'::jsonb)
+	where type = 'invite.created'
+	  and data->>'email' = p_email;
+	get diagnostics affected = row_count;
+	return affected;
+end;
+$$;
+
+comment on function selva.redact_audit_event_email(text) is
+	'Redacts an invitee email out of invite.created audit payloads on user '
+	'erasure (audit P1). Returns the number of rows redacted.';

package/supabase/migrations/20260717120000_compute_server_has_api_key.sql

@@ -0,0 +1,20 @@
+-- ============================================================================
+-- selva.compute_servers.has_api_key — key presence without reading the key (audit 4b)
+-- ============================================================================
+--
+-- Every solve resolves one compute server, but the store's only read was
+-- `getConfig`, which selected `api_key` for EVERY row and decrypted each one on
+-- the way out — N decrypts of secrets the solve path throws away, to use one.
+--
+-- The keys could not simply be dropped from the projection because the admin and
+-- org compute pages render a "key is set" state, which was derived as `!!apiKey`
+-- and so needed the plaintext. This generated column answers that question from
+-- the ciphertext's presence alone, so the default projection can omit `api_key`
+-- entirely: no secret leaves the database to decide whether a badge renders.
+--
+-- STORED (not a view or an expression index) because it is read on the same
+-- projection as every other column and costs a byte per row.
+
+alter table selva.compute_servers
+	add column if not exists has_api_key boolean
+	generated always as (api_key is not null and api_key <> '') stored;

package/dist/auth/__tests__/conformance.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=conformance.test.d.ts.map

package/dist/auth/__tests__/conformance.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"conformance.test.d.ts","sourceRoot":"","sources":["../../../src/auth/__tests__/conformance.test.ts"],"names":[],"mappings":""}

package/dist/auth/__tests__/conformance.test.js

@@ -1,76 +0,0 @@
-import { describe, beforeEach, it } from 'vitest';
-import { runAuthProviderConformance, runEmailLinkAuthConformance } from '@selvajs/platform/testing';
-import { SupabaseAuthProvider } from '../SupabaseAuthProvider.js';
-import { readEnv, resetAllData } from '../../data/__tests__/test-helpers.js';
-const envCtx = readEnv();
-if (!envCtx) {
-    describe.skip('SupabaseAuthProvider (skipped: no live stack)', () => {
-        it('populate packages/providers/supabase/.env.test with Supabase creds to run these tests', () => { });
-    });
-}
-else {
-    const ctx = envCtx; // non-null in this branch
-    // The auth conformance suite expects `verifyLogin('', adminPassword)` to
-    // succeed. Supabase requires a non-empty email, so we seed a deterministic
-    // admin email and have the suite use that via the `adminEmail` option.
-    const ADMIN_EMAIL = 'admin@conformance.test';
-    const ADMIN_PASSWORD = 'conformance-admin-password-1234';
-    async function ensureAdmin() {
-        const { data: existing } = await ctx.adminClient.auth.admin.listUsers({ perPage: 1000 });
-        const match = existing.users.find((u) => u.email === ADMIN_EMAIL);
-        if (match)
-            return match.id;
-        const { data, error } = await ctx.adminClient.auth.admin.createUser({
-            email: ADMIN_EMAIL,
-            password: ADMIN_PASSWORD,
-            email_confirm: true
-        });
-        if (error)
-            throw error;
-        return data.user.id;
-    }
-    async function makeProvider() {
-        const provider = new SupabaseAuthProvider({
-            supabaseUrl: ctx.url,
-            anonKey: ctx.anonKey,
-            serviceRoleKey: ctx.serviceRoleKey
-        });
-        // Ensure the admin account exists + has instance_admin.
-        const id = await ensureAdmin();
-        const { error: upError } = await ctx.adminClient
-            .from('user_profiles')
-            .update({ platform_permissions: ['instance_admin'] })
-            .eq('user_id', id);
-        if (upError)
-            throw upError;
-        return { provider, adminPassword: ADMIN_PASSWORD };
-    }
-    describe('SupabaseAuthProvider', () => {
-        beforeEach(async () => {
-            await resetAllData(ctx);
-        });
-        runAuthProviderConformance({
-            name: 'SupabaseAuthProvider',
-            createProvider: async () => {
-                const { provider, adminPassword } = await makeProvider();
-                return { provider, adminPassword, adminEmail: ADMIN_EMAIL };
-            },
-            userManagement: true
-        });
-        runEmailLinkAuthConformance({
-            name: 'SupabaseEmailLinkAuth',
-            createAdapter: async () => {
-                const { provider } = await makeProvider();
-                return {
-                    adapter: provider.emailLink,
-                    // `validEmail` isn't used by the suite for live mail delivery;
-                    // it just needs to look like a real address. The malformed
-                    // case is what we actually assert on.
-                    validEmail: 'real-looking@conformance.test',
-                    invalidEmail: 'not-an-email-address'
-                };
-            }
-        });
-    });
-}
-//# sourceMappingURL=conformance.test.js.map

package/dist/auth/__tests__/conformance.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"conformance.test.js","sourceRoot":"","sources":["../../../src/auth/__tests__/conformance.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AACpG,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,sCAAsC,CAAC;AAE7E,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC;AAEzB,IAAI,CAAC,MAAM,EAAE,CAAC;IACb,QAAQ,CAAC,IAAI,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACnE,EAAE,CAAC,uFAAuF,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACvG,CAAC,CAAC,CAAC;AACJ,CAAC;KAAM,CAAC;IACP,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,0BAA0B;IAC9C,yEAAyE;IACzE,2EAA2E;IAC3E,uEAAuE;IACvE,MAAM,WAAW,GAAG,wBAAwB,CAAC;IAC7C,MAAM,cAAc,GAAG,iCAAiC,CAAC;IAEzD,KAAK,UAAU,WAAW;QACzB,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACzF,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC;QAClE,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;YACnE,KAAK,EAAE,WAAW;YAClB,QAAQ,EAAE,cAAc;YACxB,aAAa,EAAE,IAAI;SACnB,CAAC,CAAC;QACH,IAAI,KAAK;YAAE,MAAM,KAAK,CAAC;QACvB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACrB,CAAC;IAED,KAAK,UAAU,YAAY;QAC1B,MAAM,QAAQ,GAAG,IAAI,oBAAoB,CAAC;YACzC,WAAW,EAAE,GAAG,CAAC,GAAG;YACpB,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,cAAc,EAAE,GAAG,CAAC,cAAc;SAClC,CAAC,CAAC;QACH,wDAAwD;QACxD,MAAM,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;QAC/B,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,GAAG,CAAC,WAAW;aAC9C,IAAI,CAAC,eAAe,CAAC;aACrB,MAAM,CAAC,EAAE,oBAAoB,EAAE,CAAC,gBAAgB,CAAC,EAAE,CAAC;aACpD,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACpB,IAAI,OAAO;YAAE,MAAM,OAAO,CAAC;QAC3B,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,cAAc,EAAE,CAAC;IACpD,CAAC;IAED,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;QACrC,UAAU,CAAC,KAAK,IAAI,EAAE;YACrB,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC,CAAC,CAAC;QAEH,0BAA0B,CAAC;YAC1B,IAAI,EAAE,sBAAsB;YAC5B,cAAc,EAAE,KAAK,IAAI,EAAE;gBAC1B,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;gBACzD,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;YAC7D,CAAC;YACD,cAAc,EAAE,IAAI;SACpB,CAAC,CAAC;QAEH,2BAA2B,CAAC;YAC3B,IAAI,EAAE,uBAAuB;YAC7B,aAAa,EAAE,KAAK,IAAI,EAAE;gBACzB,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;gBAC1C,OAAO;oBACN,OAAO,EAAE,QAAQ,CAAC,SAAS;oBAC3B,+DAA+D;oBAC/D,2DAA2D;oBAC3D,sCAAsC;oBACtC,UAAU,EAAE,+BAA+B;oBAC3C,YAAY,EAAE,sBAAsB;iBACpC,CAAC;YACH,CAAC;SACD,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACJ,CAAC"}

package/dist/auth/__tests__/token-verification.test.d.ts

@@ -1,13 +0,0 @@
-/**
- * CI-runnable (no live stack) tests for §1b hybrid token verification. Stubs
- * the internal anon client's `getClaims` (local JWT verify) and `getUser`
- * (network GoTrue verify) so we can assert the network-call behavior directly.
- *
- * Contract:
- *  - hybrid (default): verify locally via getClaims on every request; hit
- *    getUser at most once per `revalidateMs` per session; a getUser rejection
- *    during that recheck (sign-out / disabled) denies immediately.
- *  - strict: getUser on every request.
- */
-export {};
-//# sourceMappingURL=token-verification.test.d.ts.map

package/dist/auth/__tests__/token-verification.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"token-verification.test.d.ts","sourceRoot":"","sources":["../../../src/auth/__tests__/token-verification.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG"}

package/dist/auth/__tests__/token-verification.test.js

@@ -1,135 +0,0 @@
-/**
- * CI-runnable (no live stack) tests for §1b hybrid token verification. Stubs
- * the internal anon client's `getClaims` (local JWT verify) and `getUser`
- * (network GoTrue verify) so we can assert the network-call behavior directly.
- *
- * Contract:
- *  - hybrid (default): verify locally via getClaims on every request; hit
- *    getUser at most once per `revalidateMs` per session; a getUser rejection
- *    during that recheck (sign-out / disabled) denies immediately.
- *  - strict: getUser on every request.
- */
-import { describe, it, expect, vi, beforeEach } from 'vitest';
-import { SupabaseAuthProvider } from '../SupabaseAuthProvider.js';
-const URL = 'https://example.supabase.co';
-const ANON = 'anon-key';
-const SERVICE = 'service-key';
-/** Reach into the provider's private anon client and replace its auth surface. */
-function stubAnonAuth(provider) {
-    const stub = { getClaims: vi.fn(), getUser: vi.fn() };
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    provider.anon.auth.getClaims = stub.getClaims;
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    provider.anon.auth.getUser = stub.getUser;
-    return stub;
-}
-function okClaims(overrides = {}) {
-    return {
-        data: {
-            claims: {
-                sub: 'user-1',
-                session_id: 'sess-1',
-                email: 'u@example.com',
-                exp: Math.floor(Date.now() / 1000) + 3600,
-                ...overrides
-            },
-            header: {},
-            signature: new Uint8Array()
-        },
-        error: null
-    };
-}
-function okUser() {
-    return {
-        data: { user: { id: 'user-1', email: 'u@example.com', user_metadata: {} } },
-        error: null
-    };
-}
-describe('SupabaseAuthProvider — hybrid token verification', () => {
-    beforeEach(() => vi.restoreAllMocks());
-    it('verifies locally via getClaims and rechecks getUser once per window', async () => {
-        const provider = new SupabaseAuthProvider({
-            supabaseUrl: URL,
-            anonKey: ANON,
-            serviceRoleKey: SERVICE,
-            revalidateMs: 60_000
-        });
-        const stub = stubAnonAuth(provider);
-        stub.getClaims.mockResolvedValue(okClaims());
-        stub.getUser.mockResolvedValue(okUser());
-        // First call: local verify + one recheck (never seen this session).
-        const a = await provider.verifyToken('tok');
-        expect(a?.id).toBe('user-1');
-        expect(stub.getClaims).toHaveBeenCalledTimes(1);
-        expect(stub.getUser).toHaveBeenCalledTimes(1);
-        // Subsequent calls within the window: local only, NO more getUser.
-        await provider.verifyToken('tok');
-        await provider.verifyToken('tok');
-        expect(stub.getClaims).toHaveBeenCalledTimes(3);
-        expect(stub.getUser).toHaveBeenCalledTimes(1); // still just the first
-    });
-    it('denies immediately when the periodic getUser recheck rejects (signed out / revoked)', async () => {
-        const provider = new SupabaseAuthProvider({
-            supabaseUrl: URL,
-            anonKey: ANON,
-            serviceRoleKey: SERVICE
-        });
-        const stub = stubAnonAuth(provider);
-        stub.getClaims.mockResolvedValue(okClaims());
-        stub.getUser.mockResolvedValue({ data: { user: null }, error: { message: 'signed out' } });
-        const result = await provider.verifyToken('tok');
-        expect(result).toBeNull();
-    });
-    it('denies when the claims already mark the user disabled (no getUser needed)', async () => {
-        const provider = new SupabaseAuthProvider({
-            supabaseUrl: URL,
-            anonKey: ANON,
-            serviceRoleKey: SERVICE
-        });
-        const stub = stubAnonAuth(provider);
-        stub.getClaims.mockResolvedValue(okClaims({ user_metadata: { disabled: true } }));
-        const result = await provider.verifyToken('tok');
-        expect(result).toBeNull();
-        expect(stub.getUser).not.toHaveBeenCalled();
-    });
-    it('denies when getClaims fails (bad signature / expired)', async () => {
-        const provider = new SupabaseAuthProvider({
-            supabaseUrl: URL,
-            anonKey: ANON,
-            serviceRoleKey: SERVICE
-        });
-        const stub = stubAnonAuth(provider);
-        stub.getClaims.mockResolvedValue({ data: null, error: { message: 'invalid JWT' } });
-        expect(await provider.verifyToken('tok')).toBeNull();
-        expect(stub.getUser).not.toHaveBeenCalled();
-    });
-    it('returns null for an empty token without any network call', async () => {
-        const provider = new SupabaseAuthProvider({
-            supabaseUrl: URL,
-            anonKey: ANON,
-            serviceRoleKey: SERVICE
-        });
-        const stub = stubAnonAuth(provider);
-        expect(await provider.verifyToken('')).toBeNull();
-        expect(stub.getClaims).not.toHaveBeenCalled();
-        expect(stub.getUser).not.toHaveBeenCalled();
-    });
-});
-describe('SupabaseAuthProvider — strict token verification', () => {
-    beforeEach(() => vi.restoreAllMocks());
-    it('calls getUser on every request and never getClaims', async () => {
-        const provider = new SupabaseAuthProvider({
-            supabaseUrl: URL,
-            anonKey: ANON,
-            serviceRoleKey: SERVICE,
-            tokenVerification: 'strict'
-        });
-        const stub = stubAnonAuth(provider);
-        stub.getUser.mockResolvedValue(okUser());
-        await provider.verifyToken('tok');
-        await provider.verifyToken('tok');
-        expect(stub.getUser).toHaveBeenCalledTimes(2);
-        expect(stub.getClaims).not.toHaveBeenCalled();
-    });
-});
-//# sourceMappingURL=token-verification.test.js.map

package/dist/auth/__tests__/token-verification.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"token-verification.test.js","sourceRoot":"","sources":["../../../src/auth/__tests__/token-verification.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAElE,MAAM,GAAG,GAAG,6BAA6B,CAAC;AAC1C,MAAM,IAAI,GAAG,UAAU,CAAC;AACxB,MAAM,OAAO,GAAG,aAAa,CAAC;AAO9B,kFAAkF;AAClF,SAAS,YAAY,CAAC,QAA8B;IACnD,MAAM,IAAI,GAAa,EAAE,SAAS,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC;IAChE,8DAA8D;IAC7D,QAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IACvD,8DAA8D;IAC7D,QAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IACnD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,QAAQ,CAAC,YAAqC,EAAE;IACxD,OAAO;QACN,IAAI,EAAE;YACL,MAAM,EAAE;gBACP,GAAG,EAAE,QAAQ;gBACb,UAAU,EAAE,QAAQ;gBACpB,KAAK,EAAE,eAAe;gBACtB,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI;gBACzC,GAAG,SAAS;aACZ;YACD,MAAM,EAAE,EAAE;YACV,SAAS,EAAE,IAAI,UAAU,EAAE;SAC3B;QACD,KAAK,EAAE,IAAI;KACX,CAAC;AACH,CAAC;AAED,SAAS,MAAM;IACd,OAAO;QACN,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,EAAE,EAAE,EAAE;QAC3E,KAAK,EAAE,IAAI;KACX,CAAC;AACH,CAAC;AAED,QAAQ,CAAC,kDAAkD,EAAE,GAAG,EAAE;IACjE,UAAU,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;IAEvC,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACpF,MAAM,QAAQ,GAAG,IAAI,oBAAoB,CAAC;YACzC,WAAW,EAAE,GAAG;YAChB,OAAO,EAAE,IAAI;YACb,cAAc,EAAE,OAAO;YACvB,YAAY,EAAE,MAAM;SACpB,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC,CAAC;QAEzC,oEAAoE;QACpE,MAAM,CAAC,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAChD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAE9C,mEAAmE;QACnE,MAAM,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAChD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,uBAAuB;IACvE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qFAAqF,EAAE,KAAK,IAAI,EAAE;QACpG,MAAM,QAAQ,GAAG,IAAI,oBAAoB,CAAC;YACzC,WAAW,EAAE,GAAG;YAChB,OAAO,EAAE,IAAI;YACb,cAAc,EAAE,OAAO;SACvB,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;QAE3F,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QAC1F,MAAM,QAAQ,GAAG,IAAI,oBAAoB,CAAC;YACzC,WAAW,EAAE,GAAG;YAChB,OAAO,EAAE,IAAI;YACb,cAAc,EAAE,OAAO;SACvB,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;QAElF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC1B,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,QAAQ,GAAG,IAAI,oBAAoB,CAAC;YACzC,WAAW,EAAE,GAAG;YAChB,OAAO,EAAE,IAAI;YACb,cAAc,EAAE,OAAO;SACvB,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;QAEpF,MAAM,CAAC,MAAM,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,QAAQ,GAAG,IAAI,oBAAoB,CAAC;YACzC,WAAW,EAAE,GAAG;YAChB,OAAO,EAAE,IAAI;YACb,cAAc,EAAE,OAAO;SACvB,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACpC,MAAM,CAAC,MAAM,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC7C,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,kDAAkD,EAAE,GAAG,EAAE;IACjE,UAAU,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;IAEvC,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QACnE,MAAM,QAAQ,GAAG,IAAI,oBAAoB,CAAC;YACzC,WAAW,EAAE,GAAG;YAChB,OAAO,EAAE,IAAI;YACb,cAAc,EAAE,OAAO;YACvB,iBAAiB,EAAE,QAAQ;SAC3B,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC,CAAC;QAEzC,MAAM,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC/C,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/data/__tests__/compute-server-conformance.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=compute-server-conformance.test.d.ts.map

package/dist/data/__tests__/compute-server-conformance.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"compute-server-conformance.test.d.ts","sourceRoot":"","sources":["../../../src/data/__tests__/compute-server-conformance.test.ts"],"names":[],"mappings":""}

package/dist/data/__tests__/compute-server-conformance.test.js

@@ -1,45 +0,0 @@
-import { describe, beforeEach, it } from 'vitest';
-import { randomBytes } from 'node:crypto';
-import { runComputeServerStoreConformance } from '@selvajs/platform/testing';
-import { SupabaseComputeServerStore } from '../SupabaseComputeServerStore.js';
-import { readEnv, resetAllData, seedUser } from './test-helpers.js';
-const envCtx = readEnv();
-// A throwaway at-rest key so the store encrypts apiKeys during the suite. The
-// round-trip (encrypt on write, decrypt on read) must be transparent to the
-// conformance assertions, which compare plaintext apiKeys.
-const TEST_SECRET_KEY = randomBytes(32);
-if (!envCtx) {
-    describe.skip('SupabaseComputeServerStore (skipped: no live stack)', () => {
-        it('populate packages/providers/supabase/.env.test with Supabase creds to run these tests', () => { });
-    });
-}
-else {
-    describe('SupabaseComputeServerStore', () => {
-        beforeEach(async () => {
-            await resetAllData(envCtx);
-        });
-        runComputeServerStoreConformance({
-            name: 'SupabaseComputeServerStore',
-            createStore: () => new SupabaseComputeServerStore(envCtx.bundle, TEST_SECRET_KEY),
-            seedOrg: async (orgId) => {
-                // `compute_servers.owner_org_id` and `compute_server_org_defaults.org_id`
-                // FK to `orgs(id)`; the suite invents an `orgId` per org-scoped test,
-                // so we materialize the parent org here. Owner is a throwaway user
-                // (the org-scoped tests use SYSTEM_CONTEXT for writes anyway).
-                const { userId } = await seedUser(envCtx, '');
-                const now = new Date().toISOString();
-                const { error } = await envCtx.adminClient.from('orgs').insert({
-                    id: orgId,
-                    name: 'Compute Test Org',
-                    slug: `compute-${orgId.slice(0, 8)}`,
-                    owner_id: userId,
-                    created_at: now,
-                    updated_at: now
-                });
-                if (error)
-                    throw error;
-            }
-        });
-    });
-}
-//# sourceMappingURL=compute-server-conformance.test.js.map

package/dist/data/__tests__/compute-server-conformance.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"compute-server-conformance.test.js","sourceRoot":"","sources":["../../../src/data/__tests__/compute-server-conformance.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,gCAAgC,EAAE,MAAM,2BAA2B,CAAC;AAC7E,OAAO,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AAC9E,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAEpE,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC;AAEzB,8EAA8E;AAC9E,4EAA4E;AAC5E,2DAA2D;AAC3D,MAAM,eAAe,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;AAExC,IAAI,CAAC,MAAM,EAAE,CAAC;IACb,QAAQ,CAAC,IAAI,CAAC,qDAAqD,EAAE,GAAG,EAAE;QACzE,EAAE,CAAC,uFAAuF,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACvG,CAAC,CAAC,CAAC;AACJ,CAAC;KAAM,CAAC;IACP,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;QAC3C,UAAU,CAAC,KAAK,IAAI,EAAE;YACrB,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;QAEH,gCAAgC,CAAC;YAChC,IAAI,EAAE,4BAA4B;YAClC,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,0BAA0B,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC;YACjF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;gBACxB,0EAA0E;gBAC1E,sEAAsE;gBACtE,mEAAmE;gBACnE,+DAA+D;gBAC/D,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBAC9C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;gBACrC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;oBAC9D,EAAE,EAAE,KAAK;oBACT,IAAI,EAAE,kBAAkB;oBACxB,IAAI,EAAE,WAAW,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;oBACpC,QAAQ,EAAE,MAAM;oBAChB,UAAU,EAAE,GAAG;oBACf,UAAU,EAAE,GAAG;iBACf,CAAC,CAAC;gBACH,IAAI,KAAK;oBAAE,MAAM,KAAK,CAAC;YACxB,CAAC;SACD,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACJ,CAAC"}

package/dist/data/__tests__/compute-server-encryption.test.d.ts

@@ -1,12 +0,0 @@
-/**
- * CI-runnable (no live stack) unit tests for at-rest encryption of
- * `compute_servers.api_key`. Uses a minimal fake of the Supabase query builder
- * that records `insert` payloads and serves canned `select` rows, so we can
- * assert the exact bytes that would reach the DB without a real Postgres.
- *
- * The security property under test: a plaintext apiKey handed to the store is
- * NEVER written verbatim — the DB only ever sees an `enc:v1:` envelope — and it
- * round-trips back to plaintext on read.
- */
-export {};
-//# sourceMappingURL=compute-server-encryption.test.d.ts.map

package/dist/data/__tests__/compute-server-encryption.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"compute-server-encryption.test.d.ts","sourceRoot":"","sources":["../../../src/data/__tests__/compute-server-encryption.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG"}