@selvajs/platform 0.18.0 → 0.19.0

package/dist/access/index.d.ts

@@ -1,3 +1,3 @@
-export type { ProjectAccessInput, DefinitionAccessInput, VisibilityChangeInput, ReclaimAccessInput, CreateProjectAccessInput, OwnerRemovalInput, OwnerRemovalCheck } from './rules.js';
-export { canView, canSolve, canEdit, canManage, canEditProjectSettings, canChangeVisibilityToPublic, canEditDefinition, canReclaim, canCreateProject, checkOwnerRemoval, withAdminBypass } from './rules.js';
+export type { ProjectAccessInput, DefinitionAccessInput, VisibilityChangeInput, ReclaimAccessInput, CreateProjectAccessInput, OrgOwnerAuthorityInput, OwnerRemovalInput, OwnerRemovalCheck } from './rules.js';
+export { canView, canSolve, canEdit, canManage, canEditProjectSettings, canChangeVisibilityToPublic, canEditDefinition, canReclaim, canCreateProject, canChangeOrgRole, checkOwnerRemoval, withAdminBypass } from './rules.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/access/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/access/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACX,kBAAkB,EAClB,qBAAqB,EACrB,qBAAqB,EACrB,kBAAkB,EAClB,wBAAwB,EACxB,iBAAiB,EACjB,iBAAiB,EACjB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACN,OAAO,EACP,QAAQ,EACR,OAAO,EACP,SAAS,EACT,sBAAsB,EACtB,2BAA2B,EAC3B,iBAAiB,EACjB,UAAU,EACV,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/access/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACX,kBAAkB,EAClB,qBAAqB,EACrB,qBAAqB,EACrB,kBAAkB,EAClB,wBAAwB,EACxB,sBAAsB,EACtB,iBAAiB,EACjB,iBAAiB,EACjB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACN,OAAO,EACP,QAAQ,EACR,OAAO,EACP,SAAS,EACT,sBAAsB,EACtB,2BAA2B,EAC3B,iBAAiB,EACjB,UAAU,EACV,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,MAAM,YAAY,CAAC"}

package/dist/access/index.js

@@ -1,2 +1,2 @@
-export { canView, canSolve, canEdit, canManage, canEditProjectSettings, canChangeVisibilityToPublic, canEditDefinition, canReclaim, canCreateProject, checkOwnerRemoval, withAdminBypass } from './rules.js';
+export { canView, canSolve, canEdit, canManage, canEditProjectSettings, canChangeVisibilityToPublic, canEditDefinition, canReclaim, canCreateProject, canChangeOrgRole, checkOwnerRemoval, withAdminBypass } from './rules.js';
 //# sourceMappingURL=index.js.map

package/dist/access/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/access/index.ts"],"names":[],"mappings":"AAUA,OAAO,EACN,OAAO,EACP,QAAQ,EACR,OAAO,EACP,SAAS,EACT,sBAAsB,EACtB,2BAA2B,EAC3B,iBAAiB,EACjB,UAAU,EACV,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/access/index.ts"],"names":[],"mappings":"AAWA,OAAO,EACN,OAAO,EACP,QAAQ,EACR,OAAO,EACP,SAAS,EACT,sBAAsB,EACtB,2BAA2B,EAC3B,iBAAiB,EACjB,UAAU,EACV,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,MAAM,YAAY,CAAC"}

package/dist/access/rules.d.ts

@@ -1,5 +1,5 @@
 import type { PlatformPermission } from '../permissions/types.js';
-import type { OrgPermission } from '../organizations/schemas.js';
+import type { OrgPermission, OrgRole } from '../organizations/schemas.js';
 import type { Project, ProjectMember } from '../projects/types.js';
 import type { OrgMember } from '../organizations/types.js';
 import type { DefinitionRecord } from '../definitions/types.js';
@@ -67,6 +67,13 @@ export interface DefinitionAccessInput {
     project: Project | null;
     definition: DefinitionRecord | null;
     member: ProjectMember | null;
+    /**
+     * The actor's membership in the project's parent org, used only by the
+     * commons branch below. `null` means "not a member of this org" — which on a
+     * commons project is what separates a current contributor from a departed
+     * one.
+     */
+    orgMember: OrgMember | null;
     userId: string;
     platformPermissions: readonly PlatformPermission[];
     /**
@@ -79,7 +86,8 @@ export interface DefinitionAccessInput {
 /**
  * For platform projects: `instance_admin` only.
  * For all other projects: project editor/owner can always edit (moderation).
- * On commons projects (`autoJoinOnUpload=true`) the definition owner can edit their own.
+ * On commons projects (`autoJoinOnUpload=true`) the definition owner can edit
+ * their own, as long as they still belong to the project's org.
  */
 export declare function canEditDefinition(input: DefinitionAccessInput): boolean;
 export interface ReclaimAccessInput {
@@ -110,6 +118,27 @@ export interface CreateProjectAccessInput {
  * gated on `instance_admin` — this rule isn't consulted for them.
  */
 export declare function canCreateProject(input: CreateProjectAccessInput): boolean;
+export interface OrgOwnerAuthorityInput {
+    /** The acting user's own membership row, not the org's `ownerId` column. */
+    actorMember: OrgMember | null;
+    /** The role being granted, or the role the target already holds. */
+    role: OrgRole;
+}
+/**
+ * Whether the actor may hand out or take away org `owner`/`admin` standing (§3).
+ *
+ * Three routes decide this — inviting someone as owner/admin, changing an
+ * existing member's role, and removing an owner — and all three had written it
+ * out longhand. Two of them had drifted by the time the access audit found
+ * them: the invite route let an admin mint an `owner` invite for themselves,
+ * and DELETE let an admin remove an owner that PATCH would not let them demote.
+ * They are one rule, so they read it from one place.
+ *
+ * Reads the actor's **membership row**. `Organization.ownerId` is a separate
+ * field that can disagree with it — see the sole-`instance_admin` finding — and
+ * is not authority for this decision.
+ */
+export declare function canChangeOrgRole(input: OrgOwnerAuthorityInput): boolean;
 /**
  * Pre-flight check for project-owner removal, run after `canManage`.
  *

package/dist/access/rules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../../src/access/rules.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAezE,wBAAgB,eAAe,CAC9B,mBAAmB,EAAE,SAAS,kBAAkB,EAAE,EAClD,IAAI,EAAE,MAAM,OAAO,GACjB,OAAO,CAGT;AAED,MAAM,WAAW,kBAAkB;IAClC,cAAc,EAAE,SAAS,aAAa,EAAE,CAAC;IACzC,mBAAmB,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACnD,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,aAAa,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC;IAC5B;;;OAGG;IACH,mBAAmB,EAAE,OAAO,CAAC;IAC7B;;;;OAIG;IACH,sBAAsB,EAAE,OAAO,CAAC;IAChC,8EAA8E;IAC9E,cAAc,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAChD,mEAAmE;IACnE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,+DAA+D;IAC/D,MAAM,EAAE,MAAM,CAAC;CACf;AAED;;;;;;GAMG;AACH,wBAAgB,OAAO,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CA4B1D;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAuB3D;AAED;;;GAGG;AACH,wBAAgB,OAAO,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAO1D;AAED,uFAAuF;AACvF,wBAAgB,SAAS,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAM5D;AAED,uFAAuF;AACvF,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAMzE;AAED,MAAM,WAAW,qBAAqB;IACrC,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC;CAC5B;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAGjF;AAED,MAAM,WAAW,qBAAqB;IACrC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACpC,MAAM,EAAE,aAAa,GAAG,IAAI,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,mBAAmB,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACnD;;;;OAIG;IACH,sBAAsB,EAAE,OAAO,CAAC;CAChC;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAcvE;AAED,MAAM,WAAW,kBAAkB;IAClC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC;IAC5B,sDAAsD;IACtD,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAO7D;AAED,MAAM,WAAW,wBAAwB;IACxC,cAAc,EAAE,SAAS,aAAa,EAAE,CAAC;IACzC,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC;IAC5B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAOzE;AAED;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GAAG,IAAI,GAAG,YAAY,GAAG,eAAe,CAAC;AAEtE,MAAM,WAAW,iBAAiB;IACjC,MAAM,EAAE;QAAE,IAAI,EAAE,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAA;KAAE,CAAC;IAChD,UAAU,EAAE,SAAS;QAAE,IAAI,EAAE,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAA;KAAE,EAAE,CAAC;IAC/D,SAAS,EAAE,OAAO,CAAC;CACnB;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,iBAAiB,GAAG,iBAAiB,CAM7E"}
+{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../../src/access/rules.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAC;AAC1E,OAAO,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAezE,wBAAgB,eAAe,CAC9B,mBAAmB,EAAE,SAAS,kBAAkB,EAAE,EAClD,IAAI,EAAE,MAAM,OAAO,GACjB,OAAO,CAGT;AAED,MAAM,WAAW,kBAAkB;IAClC,cAAc,EAAE,SAAS,aAAa,EAAE,CAAC;IACzC,mBAAmB,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACnD,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,aAAa,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC;IAC5B;;;OAGG;IACH,mBAAmB,EAAE,OAAO,CAAC;IAC7B;;;;OAIG;IACH,sBAAsB,EAAE,OAAO,CAAC;IAChC,8EAA8E;IAC9E,cAAc,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAChD,mEAAmE;IACnE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,+DAA+D;IAC/D,MAAM,EAAE,MAAM,CAAC;CACf;AAED;;;;;;GAMG;AACH,wBAAgB,OAAO,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CA4B1D;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAuB3D;AAED;;;GAGG;AACH,wBAAgB,OAAO,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAO1D;AAED,uFAAuF;AACvF,wBAAgB,SAAS,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAM5D;AAED,uFAAuF;AACvF,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAMzE;AAED,MAAM,WAAW,qBAAqB;IACrC,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC;CAC5B;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAGjF;AAED,MAAM,WAAW,qBAAqB;IACrC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACpC,MAAM,EAAE,aAAa,GAAG,IAAI,CAAC;IAC7B;;;;;OAKG;IACH,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,mBAAmB,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACnD;;;;OAIG;IACH,sBAAsB,EAAE,OAAO,CAAC;CAChC;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CA2BvE;AAED,MAAM,WAAW,kBAAkB;IAClC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC;IAC5B,sDAAsD;IACtD,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAO7D;AAED,MAAM,WAAW,wBAAwB;IACxC,cAAc,EAAE,SAAS,aAAa,EAAE,CAAC;IACzC,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC;IAC5B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAOzE;AAED,MAAM,WAAW,sBAAsB;IACtC,4EAA4E;IAC5E,WAAW,EAAE,SAAS,GAAG,IAAI,CAAC;IAC9B,oEAAoE;IACpE,IAAI,EAAE,OAAO,CAAC;CACd;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAGvE;AAED;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GAAG,IAAI,GAAG,YAAY,GAAG,eAAe,CAAC;AAEtE,MAAM,WAAW,iBAAiB;IACjC,MAAM,EAAE;QAAE,IAAI,EAAE,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAA;KAAE,CAAC;IAChD,UAAU,EAAE,SAAS;QAAE,IAAI,EAAE,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAA;KAAE,EAAE,CAAC;IAC/D,SAAS,EAAE,OAAO,CAAC;CACnB;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,iBAAiB,GAAG,iBAAiB,CAM7E"}

package/dist/access/rules.js

@@ -106,10 +106,11 @@ export function canChangeVisibilityToPublic(input) {
 /**
  * For platform projects: `instance_admin` only.
  * For all other projects: project editor/owner can always edit (moderation).
- * On commons projects (`autoJoinOnUpload=true`) the definition owner can edit their own.
+ * On commons projects (`autoJoinOnUpload=true`) the definition owner can edit
+ * their own, as long as they still belong to the project's org.
  */
 export function canEditDefinition(input) {
-    const { project, definition, member, userId, platformPermissions, enablePlatformProjects } = input;
+    const { project, definition, member, orgMember, userId, platformPermissions, enablePlatformProjects } = input;
     if (!project || !definition)
         return false;
     if (project.visibility === 'platform') {
@@ -119,7 +120,12 @@ export function canEditDefinition(input) {
     }
     if (member?.role === 'owner' || member?.role === 'editor')
         return true;
-    if (project.autoJoinOnUpload && userId === definition.ownerId)
+    // Commons grants edit on top of belonging, not instead of it. `ownerId` is
+    // stamped at upload and never revisited, so without the org-membership test
+    // a departed uploader keeps edit/delete/share-link authority on everything
+    // they ever uploaded — and flipping `autoJoinOnUpload` on hands it back to
+    // them retroactively, with no action taken against them.
+    if (project.autoJoinOnUpload && userId === definition.ownerId && orgMember)
         return true;
     return false;
 }
@@ -159,6 +165,25 @@ export function canCreateProject(input) {
         return true;
     return false;
 }
+/**
+ * Whether the actor may hand out or take away org `owner`/`admin` standing (§3).
+ *
+ * Three routes decide this — inviting someone as owner/admin, changing an
+ * existing member's role, and removing an owner — and all three had written it
+ * out longhand. Two of them had drifted by the time the access audit found
+ * them: the invite route let an admin mint an `owner` invite for themselves,
+ * and DELETE let an admin remove an owner that PATCH would not let them demote.
+ * They are one rule, so they read it from one place.
+ *
+ * Reads the actor's **membership row**. `Organization.ownerId` is a separate
+ * field that can disagree with it — see the sole-`instance_admin` finding — and
+ * is not authority for this decision.
+ */
+export function canChangeOrgRole(input) {
+    if (input.role === 'member')
+        return true;
+    return input.actorMember?.role === 'owner';
+}
 export function checkOwnerRemoval(input) {
     if (input.target.role !== 'owner')
         return 'ok';

package/dist/access/rules.js.map

@@ -1 +1 @@
-{"version":3,"file":"rules.js","sourceRoot":"","sources":["../../src/access/rules.ts"],"names":[],"mappings":"AAOA;;;;;;;GAOG;AAEH,SAAS,eAAe,CAAC,mBAAkD;IAC1E,OAAO,mBAAmB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,eAAe,CAC9B,mBAAkD,EAClD,IAAmB;IAEnB,IAAI,eAAe,CAAC,mBAAmB,CAAC;QAAE,OAAO,IAAI,CAAC;IACtD,OAAO,IAAI,EAAE,CAAC;AACf,CAAC;AA2BD;;;;;;GAMG;AACH,MAAM,UAAU,OAAO,CAAC,KAAyB;IAChD,MAAM,EACL,OAAO,EACP,MAAM,EACN,SAAS,EACT,mBAAmB,EACnB,sBAAsB,EACtB,mBAAmB,EACnB,cAAc,EACd,WAAW,EACX,MAAM,EACN,GAAG,KAAK,CAAC;IACV,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAE3B,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;QACvC,IAAI,CAAC,sBAAsB;YAAE,OAAO,KAAK,CAAC;QAC1C,IAAI,eAAe,CAAC,mBAAmB,CAAC;YAAE,OAAO,IAAI,CAAC;QACtD,OAAO,cAAc,CAAC,IAAI,CACzB,CAAC,CAAC,EAAE,EAAE,CACL,CAAC,CAAC,CAAC,WAAW,KAAK,MAAM,IAAI,CAAC,CAAC,SAAS,KAAK,MAAM,CAAC;YACpD,CAAC,CAAC,CAAC,WAAW,KAAK,KAAK,IAAI,CAAC,CAAC,SAAS,KAAK,WAAW,CAAC,CACzD,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO,MAAM,KAAK,IAAI,CAAC;IAC7D,IAAI,OAAO,CAAC,UAAU,KAAK,KAAK;QAAE,OAAO,SAAS,KAAK,IAAI,CAAC;IAC5D,IAAI,OAAO,CAAC,UAAU,KAAK,QAAQ;QAAE,OAAO,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC;IAC5F,OAAO,KAAK,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAyB;IACjD,MAAM,EACL,OAAO,EACP,sBAAsB,EACtB,mBAAmB,EACnB,cAAc,EACd,WAAW,EACX,MAAM,EACN,GAAG,KAAK,CAAC;IACV,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAE3B,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;QACvC,IAAI,CAAC,sBAAsB;YAAE,OAAO,KAAK,CAAC;QAC1C,IAAI,eAAe,CAAC,mBAAmB,CAAC;YAAE,OAAO,IAAI,CAAC;QACtD,OAAO,cAAc,CAAC,IAAI,CACzB,CAAC,CAAC,EAAE,EAAE,CACL,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,CAAC,CAAC,WAAW,KAAK,MAAM,IAAI,CAAC,CAAC,SAAS,KAAK,MAAM,CAAC;gBACpD,CAAC,CAAC,CAAC,WAAW,KAAK,KAAK,IAAI,CAAC,CAAC,SAAS,KAAK,WAAW,CAAC,CAAC,CAC3D,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,OAAO,CAAC,KAAyB;IAChD,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,GAAG,KAAK,CAAC;IAC/E,IAAI,OAAO,EAAE,UAAU,KAAK,UAAU,EAAE,CAAC;QACxC,IAAI,CAAC,sBAAsB;YAAE,OAAO,KAAK,CAAC;QAC1C,OAAO,eAAe,CAAC,mBAAmB,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,MAAM,EAAE,IAAI,KAAK,OAAO,IAAI,MAAM,EAAE,IAAI,KAAK,QAAQ,CAAC;AAC9D,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,SAAS,CAAC,KAAyB;IAClD,IAAI,KAAK,CAAC,OAAO,EAAE,UAAU,KAAK,UAAU,EAAE,CAAC;QAC9C,IAAI,CAAC,KAAK,CAAC,sBAAsB;YAAE,OAAO,KAAK,CAAC;QAChD,OAAO,eAAe,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,OAAO,CAAC;AACvC,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,sBAAsB,CAAC,KAAyB;IAC/D,IAAI,KAAK,CAAC,OAAO,EAAE,UAAU,KAAK,UAAU,EAAE,CAAC;QAC9C,IAAI,CAAC,KAAK,CAAC,sBAAsB;YAAE,OAAO,KAAK,CAAC;QAChD,OAAO,eAAe,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,OAAO,CAAC;AACvC,CAAC;AAMD;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAAC,KAA4B;IACvE,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC;IACnC,OAAO,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,CAAC;AAC7C,CAAC;AAgBD;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAA4B;IAC7D,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,GACzF,KAAK,CAAC;IACP,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAE1C,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;QACvC,IAAI,CAAC,sBAAsB;YAAE,OAAO,KAAK,CAAC;QAC1C,OAAO,eAAe,CAAC,mBAAmB,CAAC,CAAC;IAC7C,CAAC;IAED,IAAI,MAAM,EAAE,IAAI,KAAK,OAAO,IAAI,MAAM,EAAE,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACvE,IAAI,OAAO,CAAC,gBAAgB,IAAI,MAAM,KAAK,UAAU,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE3E,OAAO,KAAK,CAAC;AACd,CAAC;AASD;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,KAAyB;IACnD,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC;IAClD,IAAI,CAAC,OAAO,IAAI,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,WAAW,KAAK,OAAO,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IAChD,MAAM,IAAI,GAAG,SAAS,EAAE,IAAI,CAAC;IAC7B,OAAO,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,CAAC;AAC7C,CAAC;AASD;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAA+B;IAC/D,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC;IACtE,IAAI,WAAW,KAAK,WAAW;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,IAAI,GAAG,SAAS,EAAE,IAAI,CAAC;IAC7B,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IACtD,IAAI,IAAI,KAAK,QAAQ,IAAI,cAAc,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QAAE,OAAO,IAAI,CAAC;IACjF,OAAO,KAAK,CAAC;AACd,CAAC;AAiBD,MAAM,UAAU,iBAAiB,CAAC,KAAwB;IACzD,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,MAAM,CAAC;IAC7E,IAAI,UAAU,IAAI,CAAC;QAAE,OAAO,YAAY,CAAC;IACzC,IAAI,CAAC,KAAK,CAAC,SAAS;QAAE,OAAO,eAAe,CAAC;IAC7C,OAAO,IAAI,CAAC;AACb,CAAC"}
+{"version":3,"file":"rules.js","sourceRoot":"","sources":["../../src/access/rules.ts"],"names":[],"mappings":"AAOA;;;;;;;GAOG;AAEH,SAAS,eAAe,CAAC,mBAAkD;IAC1E,OAAO,mBAAmB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,eAAe,CAC9B,mBAAkD,EAClD,IAAmB;IAEnB,IAAI,eAAe,CAAC,mBAAmB,CAAC;QAAE,OAAO,IAAI,CAAC;IACtD,OAAO,IAAI,EAAE,CAAC;AACf,CAAC;AA2BD;;;;;;GAMG;AACH,MAAM,UAAU,OAAO,CAAC,KAAyB;IAChD,MAAM,EACL,OAAO,EACP,MAAM,EACN,SAAS,EACT,mBAAmB,EACnB,sBAAsB,EACtB,mBAAmB,EACnB,cAAc,EACd,WAAW,EACX,MAAM,EACN,GAAG,KAAK,CAAC;IACV,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAE3B,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;QACvC,IAAI,CAAC,sBAAsB;YAAE,OAAO,KAAK,CAAC;QAC1C,IAAI,eAAe,CAAC,mBAAmB,CAAC;YAAE,OAAO,IAAI,CAAC;QACtD,OAAO,cAAc,CAAC,IAAI,CACzB,CAAC,CAAC,EAAE,EAAE,CACL,CAAC,CAAC,CAAC,WAAW,KAAK,MAAM,IAAI,CAAC,CAAC,SAAS,KAAK,MAAM,CAAC;YACpD,CAAC,CAAC,CAAC,WAAW,KAAK,KAAK,IAAI,CAAC,CAAC,SAAS,KAAK,WAAW,CAAC,CACzD,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO,MAAM,KAAK,IAAI,CAAC;IAC7D,IAAI,OAAO,CAAC,UAAU,KAAK,KAAK;QAAE,OAAO,SAAS,KAAK,IAAI,CAAC;IAC5D,IAAI,OAAO,CAAC,UAAU,KAAK,QAAQ;QAAE,OAAO,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC;IAC5F,OAAO,KAAK,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAyB;IACjD,MAAM,EACL,OAAO,EACP,sBAAsB,EACtB,mBAAmB,EACnB,cAAc,EACd,WAAW,EACX,MAAM,EACN,GAAG,KAAK,CAAC;IACV,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAE3B,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;QACvC,IAAI,CAAC,sBAAsB;YAAE,OAAO,KAAK,CAAC;QAC1C,IAAI,eAAe,CAAC,mBAAmB,CAAC;YAAE,OAAO,IAAI,CAAC;QACtD,OAAO,cAAc,CAAC,IAAI,CACzB,CAAC,CAAC,EAAE,EAAE,CACL,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,CAAC,CAAC,WAAW,KAAK,MAAM,IAAI,CAAC,CAAC,SAAS,KAAK,MAAM,CAAC;gBACpD,CAAC,CAAC,CAAC,WAAW,KAAK,KAAK,IAAI,CAAC,CAAC,SAAS,KAAK,WAAW,CAAC,CAAC,CAC3D,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,OAAO,CAAC,KAAyB;IAChD,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,GAAG,KAAK,CAAC;IAC/E,IAAI,OAAO,EAAE,UAAU,KAAK,UAAU,EAAE,CAAC;QACxC,IAAI,CAAC,sBAAsB;YAAE,OAAO,KAAK,CAAC;QAC1C,OAAO,eAAe,CAAC,mBAAmB,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,MAAM,EAAE,IAAI,KAAK,OAAO,IAAI,MAAM,EAAE,IAAI,KAAK,QAAQ,CAAC;AAC9D,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,SAAS,CAAC,KAAyB;IAClD,IAAI,KAAK,CAAC,OAAO,EAAE,UAAU,KAAK,UAAU,EAAE,CAAC;QAC9C,IAAI,CAAC,KAAK,CAAC,sBAAsB;YAAE,OAAO,KAAK,CAAC;QAChD,OAAO,eAAe,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,OAAO,CAAC;AACvC,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,sBAAsB,CAAC,KAAyB;IAC/D,IAAI,KAAK,CAAC,OAAO,EAAE,UAAU,KAAK,UAAU,EAAE,CAAC;QAC9C,IAAI,CAAC,KAAK,CAAC,sBAAsB;YAAE,OAAO,KAAK,CAAC;QAChD,OAAO,eAAe,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,OAAO,CAAC;AACvC,CAAC;AAMD;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAAC,KAA4B;IACvE,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC;IACnC,OAAO,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,CAAC;AAC7C,CAAC;AAuBD;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAA4B;IAC7D,MAAM,EACL,OAAO,EACP,UAAU,EACV,MAAM,EACN,SAAS,EACT,MAAM,EACN,mBAAmB,EACnB,sBAAsB,EACtB,GAAG,KAAK,CAAC;IACV,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAE1C,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;QACvC,IAAI,CAAC,sBAAsB;YAAE,OAAO,KAAK,CAAC;QAC1C,OAAO,eAAe,CAAC,mBAAmB,CAAC,CAAC;IAC7C,CAAC;IAED,IAAI,MAAM,EAAE,IAAI,KAAK,OAAO,IAAI,MAAM,EAAE,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAEvE,2EAA2E;IAC3E,4EAA4E;IAC5E,2EAA2E;IAC3E,2EAA2E;IAC3E,yDAAyD;IACzD,IAAI,OAAO,CAAC,gBAAgB,IAAI,MAAM,KAAK,UAAU,CAAC,OAAO,IAAI,SAAS;QAAE,OAAO,IAAI,CAAC;IAExF,OAAO,KAAK,CAAC;AACd,CAAC;AASD;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,KAAyB;IACnD,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC;IAClD,IAAI,CAAC,OAAO,IAAI,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,WAAW,KAAK,OAAO,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IAChD,MAAM,IAAI,GAAG,SAAS,EAAE,IAAI,CAAC;IAC7B,OAAO,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,CAAC;AAC7C,CAAC;AASD;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAA+B;IAC/D,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC;IACtE,IAAI,WAAW,KAAK,WAAW;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,IAAI,GAAG,SAAS,EAAE,IAAI,CAAC;IAC7B,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IACtD,IAAI,IAAI,KAAK,QAAQ,IAAI,cAAc,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QAAE,OAAO,IAAI,CAAC;IACjF,OAAO,KAAK,CAAC;AACd,CAAC;AASD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAA6B;IAC7D,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,OAAO,KAAK,CAAC,WAAW,EAAE,IAAI,KAAK,OAAO,CAAC;AAC5C,CAAC;AAiBD,MAAM,UAAU,iBAAiB,CAAC,KAAwB;IACzD,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,MAAM,CAAC;IAC7E,IAAI,UAAU,IAAI,CAAC;QAAE,OAAO,YAAY,CAAC;IACzC,IAAI,CAAC,KAAK,CAAC,SAAS;QAAE,OAAO,eAAe,CAAC;IAC7C,OAAO,IAAI,CAAC;AACb,CAAC"}

package/dist/computeServer/index.d.ts

@@ -4,5 +4,5 @@ export type { IComputeServerStore, GetConfigOptions } from './interface.js';
 export { isEncryptedSecret, encryptSecret, decryptSecret, decodeSecretKey } from './secrets.js';
 export type { SecretVerificationReport, SecretVerificationFailure, SecretVerificationFailureReason } from './secrets.js';
 export type { ResolveOptions } from './utils.js';
-export { serversVisibleTo, defaultServerIdFor, resolveServerForOrg, findServerById, platformServers, orgServersFor } from './utils.js';
+export { serversVisibleTo, defaultServerIdFor, resolveServerForOrg, findServerById, platformServers, orgServersFor, scopeConfigToOrg } from './utils.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/computeServer/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/computeServer/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACX,mBAAmB,EACnB,aAAa,EACb,qBAAqB,EACrB,gBAAgB,EAChB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC3D,YAAY,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAM5E,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAChG,YAAY,EACX,wBAAwB,EACxB,yBAAyB,EACzB,+BAA+B,EAC/B,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EACN,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,aAAa,EACb,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/computeServer/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACX,mBAAmB,EACnB,aAAa,EACb,qBAAqB,EACrB,gBAAgB,EAChB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC3D,YAAY,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAM5E,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAChG,YAAY,EACX,wBAAwB,EACxB,yBAAyB,EACzB,+BAA+B,EAC/B,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EACN,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,MAAM,YAAY,CAAC"}

package/dist/computeServer/index.js

@@ -5,5 +5,5 @@ export { isPlatformServer, isOrgServer } from './types.js';
 // `@selvajs/platform/computeServer` in server code. The report TYPES are erased
 // at build, so they also stay re-exported from the root barrel for convenience.
 export { isEncryptedSecret, encryptSecret, decryptSecret, decodeSecretKey } from './secrets.js';
-export { serversVisibleTo, defaultServerIdFor, resolveServerForOrg, findServerById, platformServers, orgServersFor } from './utils.js';
+export { serversVisibleTo, defaultServerIdFor, resolveServerForOrg, findServerById, platformServers, orgServersFor, scopeConfigToOrg } from './utils.js';
 //# sourceMappingURL=index.js.map

package/dist/computeServer/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/computeServer/index.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE3D,6EAA6E;AAC7E,4EAA4E;AAC5E,wEAAwE;AACxE,gFAAgF;AAChF,gFAAgF;AAChF,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAOhG,OAAO,EACN,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,aAAa,EACb,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/computeServer/index.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE3D,6EAA6E;AAC7E,4EAA4E;AAC5E,wEAAwE;AACxE,gFAAgF;AAChF,gFAAgF;AAChF,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAOhG,OAAO,EACN,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,MAAM,YAAY,CAAC"}

package/dist/computeServer/interface.d.ts

@@ -21,13 +21,26 @@ export interface GetConfigOptions {
      * `getServerApiKey` for just that one.
      */
     includeApiKeys?: boolean;
+    /**
+     * Narrow the result to what this org may see: `serversVisibleTo(orgId)`,
+     * `orgDefaults` reduced to this org's entry, and `defaultServerId` blanked
+     * when the global default is not among them.
+     *
+     * Org-facing surfaces must pass this. Without it the store hands back every
+     * platform server and every *other* org's private servers, leaving each
+     * caller to re-apply a filter it can silently forget — the global
+     * `defaultServerId` in particular passed straight through before this
+     * existed. Admin surfaces, boot health and the save-diff handlers omit it
+     * deliberately; they act instance-wide.
+     */
+    scopeToOrgId?: string;
 }
 export interface IComputeServerStore {
     /**
-     * Reads the full config. Callers apply the visibility predicate from
-     * `serversVisibleTo` themselves — the store does not pre-filter, since the
-     * same row set is needed at different scopes (admin manage vs. org manage
-     * vs. solve).
+     * Reads the config. Instance-wide by default — the same row set is needed at
+     * different scopes (admin manage vs. org manage vs. solve). Pass
+     * `scopeToOrgId` on any org-facing surface so the narrowing happens here
+     * rather than in each caller.
      *
      * Servers come back with `apiKey: undefined` unless `includeApiKeys` is
      * set, so a returned server says nothing about whether a key is *stored*

package/dist/computeServer/interface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"interface.d.ts","sourceRoot":"","sources":["../../src/computeServer/interface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,KAAK,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACrE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAE7D;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAChC;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IACnC;;;;;;;;;OASG;IACH,SAAS,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAEhF;;;;;;;;OAQG;IACH,eAAe,CAAC,GAAG,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAEpF,iIAAiI;IACjI,mBAAmB,CAClB,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,mBAAmB,EAAE,EAC9B,eAAe,EAAE,MAAM,GAAG,SAAS,GACjC,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB;;;;;;OAMG;IACH,cAAc,CACb,GAAG,EAAE,cAAc,EACnB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,mBAAmB,EAAE,EAC9B,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,GAC7B,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB;;;;OAIG;IACH,aAAa,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE1F;;;;;;OAMG;IACH,WAAW,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE/D;;;;;;OAMG;IACH,aAAa,CAAC,IAAI,OAAO,CAAC,wBAAwB,CAAC,CAAC;CACpD"}
+{"version":3,"file":"interface.d.ts","sourceRoot":"","sources":["../../src/computeServer/interface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,KAAK,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACrE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAE7D;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAChC;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IAEzB;;;;;;;;;;;OAWG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,mBAAmB;IACnC;;;;;;;;;OASG;IACH,SAAS,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAEhF;;;;;;;;OAQG;IACH,eAAe,CAAC,GAAG,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAEpF,iIAAiI;IACjI,mBAAmB,CAClB,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,mBAAmB,EAAE,EAC9B,eAAe,EAAE,MAAM,GAAG,SAAS,GACjC,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB;;;;;;OAMG;IACH,cAAc,CACb,GAAG,EAAE,cAAc,EACnB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,mBAAmB,EAAE,EAC9B,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,GAC7B,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB;;;;OAIG;IACH,aAAa,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE1F;;;;;;OAMG;IACH,WAAW,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE/D;;;;;;OAMG;IACH,aAAa,CAAC,IAAI,OAAO,CAAC,wBAAwB,CAAC,CAAC;CACpD"}

package/dist/computeServer/utils.d.ts

@@ -23,6 +23,16 @@ export interface ResolveOptions {
     definitionPin?: string | null;
 }
 export declare function resolveServerForOrg(config: ComputeConfig, orgId: string | null | undefined, opts?: ResolveOptions): ComputeServerConfig;
+/**
+ * The config as one org may see it: visible servers only, `orgDefaults` reduced
+ * to this org's own entry, and `defaultServerId` dropped when the global default
+ * is not visible here.
+ *
+ * Applied inside `getConfig` when `scopeToOrgId` is passed, so an org-facing
+ * caller cannot forget the filter and leak other orgs' server URLs or the
+ * instance's default choice.
+ */
+export declare function scopeConfigToOrg(config: ComputeConfig, orgId: string): ComputeConfig;
 /** Lookup by id, ignoring scope or visibility — for admin contexts that display a server outside the visibility filter. */
 export declare function findServerById(config: ComputeConfig, id: string): ComputeServerConfig | undefined;
 export declare function platformServers(config: ComputeConfig): import("./types.js").PlatformComputeServer[];

package/dist/computeServer/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/computeServer/utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAGN,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,MAAM,YAAY,CAAC;AAEpB;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC/B,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC9B,mBAAmB,EAAE,CAWvB;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CACjC,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC9B,MAAM,GAAG,SAAS,CAYpB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,cAAc;IAC9B,iEAAiE;IACjE,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,wBAAgB,mBAAmB,CAClC,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,IAAI,GAAE,cAAmB,GACvB,mBAAmB,CAoBrB;AAED,2HAA2H;AAC3H,wBAAgB,cAAc,CAAC,MAAM,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,GAAG,mBAAmB,GAAG,SAAS,CAEjG;AAMD,wBAAgB,eAAe,CAAC,MAAM,EAAE,aAAa,gDAEpD;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,yBAEjE"}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/computeServer/utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAGN,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,MAAM,YAAY,CAAC;AAEpB;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC/B,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC9B,mBAAmB,EAAE,CAWvB;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CACjC,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC9B,MAAM,GAAG,SAAS,CAYpB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,cAAc;IAC9B,iEAAiE;IACjE,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,wBAAgB,mBAAmB,CAClC,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,IAAI,GAAE,cAAmB,GACvB,mBAAmB,CAoBrB;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,GAAG,aAAa,CAapF;AAED,2HAA2H;AAC3H,wBAAgB,cAAc,CAAC,MAAM,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,GAAG,mBAAmB,GAAG,SAAS,CAEjG;AAMD,wBAAgB,eAAe,CAAC,MAAM,EAAE,aAAa,gDAEpD;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,yBAEjE"}

package/dist/computeServer/utils.js

@@ -56,6 +56,27 @@ export function resolveServerForOrg(config, orgId, opts = {}) {
     // Last resort: first visible server. Mainly hit in tests and initial setup before a default is chosen.
     return visible[0];
 }
+/**
+ * The config as one org may see it: visible servers only, `orgDefaults` reduced
+ * to this org's own entry, and `defaultServerId` dropped when the global default
+ * is not visible here.
+ *
+ * Applied inside `getConfig` when `scopeToOrgId` is passed, so an org-facing
+ * caller cannot forget the filter and leak other orgs' server URLs or the
+ * instance's default choice.
+ */
+export function scopeConfigToOrg(config, orgId) {
+    const servers = serversVisibleTo(config, orgId);
+    const visibleIds = new Set(servers.map((s) => s.id));
+    const orgDefault = config.orgDefaults?.[orgId];
+    return {
+        servers,
+        defaultServerId: config.defaultServerId && visibleIds.has(config.defaultServerId)
+            ? config.defaultServerId
+            : undefined,
+        orgDefaults: orgDefault ? { [orgId]: orgDefault } : {}
+    };
+}
 /** Lookup by id, ignoring scope or visibility — for admin contexts that display a server outside the visibility filter. */
 export function findServerById(config, id) {
     return config.servers.find((s) => s.id === id);

package/dist/computeServer/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../src/computeServer/utils.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,WAAW,EACX,gBAAgB,EAGhB,MAAM,YAAY,CAAC;AAEpB;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC/B,MAAqB,EACrB,KAAgC;IAEhC,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAClC,IAAI,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;YACzB,IAAI,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,eAAe;gBAAE,OAAO,IAAI,CAAC;YACjD,IAAI,CAAC,CAAC,UAAU,KAAK,KAAK;gBAAE,OAAO,IAAI,CAAC;YACxC,IAAI,KAAK,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACvD,OAAO,KAAK,CAAC;QACd,CAAC;QACD,+CAA+C;QAC/C,OAAO,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,UAAU,KAAK,KAAK,CAAC;IAC1C,CAAC,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CACjC,MAAqB,EACrB,KAAgC;IAEhC,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAErD,IAAI,KAAK,EAAE,CAAC;QACX,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,SAAS,IAAI,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IAC9D,CAAC;IACD,IAAI,MAAM,CAAC,eAAe,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC;QACtE,OAAO,MAAM,CAAC,eAAe,CAAC;IAC/B,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAeD,MAAM,UAAU,mBAAmB,CAClC,MAAqB,EACrB,KAAgC,EAChC,OAAuB,EAAE;IAEzB,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAChD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAC/E,CAAC;IAED,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,aAAa,CAAC,CAAC;QAChE,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,yFAAyF;IAC1F,CAAC;IAED,MAAM,SAAS,GAAG,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACpD,IAAI,SAAS,EAAE,CAAC;QACf,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC;QACtD,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IACzB,CAAC;IAED,uGAAuG;IACvG,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;AACnB,CAAC;AAED,2HAA2H;AAC3H,MAAM,UAAU,cAAc,CAAC,MAAqB,EAAE,EAAU;IAC/D,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AAChD,CAAC;AAED,+EAA+E;AAC/E,UAAU;AACV,+EAA+E;AAE/E,MAAM,UAAU,eAAe,CAAC,MAAqB;IACpD,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAqB,EAAE,KAAa;IACjE,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,KAAK,KAAK,CAAC,CAAC;AAC/E,CAAC"}
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../src/computeServer/utils.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,WAAW,EACX,gBAAgB,EAGhB,MAAM,YAAY,CAAC;AAEpB;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC/B,MAAqB,EACrB,KAAgC;IAEhC,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAClC,IAAI,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;YACzB,IAAI,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,eAAe;gBAAE,OAAO,IAAI,CAAC;YACjD,IAAI,CAAC,CAAC,UAAU,KAAK,KAAK;gBAAE,OAAO,IAAI,CAAC;YACxC,IAAI,KAAK,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACvD,OAAO,KAAK,CAAC;QACd,CAAC;QACD,+CAA+C;QAC/C,OAAO,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,UAAU,KAAK,KAAK,CAAC;IAC1C,CAAC,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CACjC,MAAqB,EACrB,KAAgC;IAEhC,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAErD,IAAI,KAAK,EAAE,CAAC;QACX,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,SAAS,IAAI,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IAC9D,CAAC;IACD,IAAI,MAAM,CAAC,eAAe,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC;QACtE,OAAO,MAAM,CAAC,eAAe,CAAC;IAC/B,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAeD,MAAM,UAAU,mBAAmB,CAClC,MAAqB,EACrB,KAAgC,EAChC,OAAuB,EAAE;IAEzB,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAChD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAC/E,CAAC;IAED,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,aAAa,CAAC,CAAC;QAChE,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,yFAAyF;IAC1F,CAAC;IAED,MAAM,SAAS,GAAG,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACpD,IAAI,SAAS,EAAE,CAAC;QACf,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC;QACtD,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IACzB,CAAC;IAED,uGAAuG;IACvG,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;AACnB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAqB,EAAE,KAAa;IACpE,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC;IAE/C,OAAO;QACN,OAAO;QACP,eAAe,EACd,MAAM,CAAC,eAAe,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC;YAC/D,CAAC,CAAC,MAAM,CAAC,eAAe;YACxB,CAAC,CAAC,SAAS;QACb,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE;KACtD,CAAC;AACH,CAAC;AAED,2HAA2H;AAC3H,MAAM,UAAU,cAAc,CAAC,MAAqB,EAAE,EAAU;IAC/D,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AAChD,CAAC;AAED,+EAA+E;AAC/E,UAAU;AACV,+EAA+E;AAE/E,MAAM,UAAU,eAAe,CAAC,MAAqB;IACpD,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAqB,EAAE,KAAa;IACjE,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,KAAK,KAAK,CAAC,CAAC;AAC/E,CAAC"}

package/dist/context.d.ts

@@ -21,6 +21,14 @@ export interface RequestContext {
     orgPermissions: OrgPermission[];
     /** Never derive from a user session. */
     system?: true;
+    /**
+     * Set when `system` was granted by a share-link token rather than by a
+     * trusted server flow. The token holder is anonymous, so `system` here means
+     * only "use the service-role client" (no user JWT exists to scope RLS) — it
+     * must never read as "authorized". `assertNotShareContext` is how a store
+     * guard refuses.
+     */
+    shareLinkId?: string;
     /** Opaque adapter payload — the Supabase adapter passes the user JWT through for RLS; local ignores it. */
     adapterContext?: unknown;
 }
@@ -32,6 +40,18 @@ export declare const SYSTEM_CONTEXT: RequestContext;
  * `actingOrgId` returns false unless `instance_admin` or `system`.
  */
 export declare function hasPermission(ctx: RequestContext, permission: PlatformPermission | OrgPermission): boolean;
+/**
+ * An anonymous share-link holder. `system` is true on these contexts for adapter
+ * dispatch only — a guard that treats `system` as "fully authorized" must
+ * exclude them first.
+ */
+export declare function isShareContext(ctx: RequestContext): boolean;
+/**
+ * Refuse a privileged operation to a share-link context. Call at the top of any
+ * guard whose first line is `if (ctx.system) return` — the token grants one
+ * definition on one channel, never instance authority.
+ */
+export declare function assertNotShareContext(ctx: RequestContext, what: string): void;
 /**
  * Returns the org the caller is acting as, or throws `ProviderError(403)`.
  * Centralizes this guard so every store that scopes rows to an acting org fails

package/dist/context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAEjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAIhE;;;;;;;;;;GAUG;AACH,MAAM,WAAW,cAAc;IAC9B,wCAAwC;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,kBAAkB,EAAE,CAAC;IAC1C,6CAA6C;IAC7C,cAAc,EAAE,aAAa,EAAE,CAAC;IAChC,wCAAwC;IACxC,MAAM,CAAC,EAAE,IAAI,CAAC;IACd,2GAA2G;IAC3G,cAAc,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,iGAAiG;AACjG,eAAO,MAAM,cAAc,EAAE,cAK5B,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,aAAa,CAC5B,GAAG,EAAE,cAAc,EACnB,UAAU,EAAE,kBAAkB,GAAG,aAAa,GAC5C,OAAO,CAOT;AAQD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,MAAM,CAK5D"}
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAEjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAIhE;;;;;;;;;;GAUG;AACH,MAAM,WAAW,cAAc;IAC9B,wCAAwC;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,kBAAkB,EAAE,CAAC;IAC1C,6CAA6C;IAC7C,cAAc,EAAE,aAAa,EAAE,CAAC;IAChC,wCAAwC;IACxC,MAAM,CAAC,EAAE,IAAI,CAAC;IACd;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2GAA2G;IAC3G,cAAc,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,iGAAiG;AACjG,eAAO,MAAM,cAAc,EAAE,cAK5B,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,aAAa,CAC5B,GAAG,EAAE,cAAc,EACnB,UAAU,EAAE,kBAAkB,GAAG,aAAa,GAC5C,OAAO,CAOT;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAE3D;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAI7E;AAQD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,MAAM,CAK5D"}

package/dist/context.js

@@ -23,6 +23,24 @@ export function hasPermission(ctx, permission) {
     }
     return ctx.orgPermissions.includes(permission);
 }
+/**
+ * An anonymous share-link holder. `system` is true on these contexts for adapter
+ * dispatch only — a guard that treats `system` as "fully authorized" must
+ * exclude them first.
+ */
+export function isShareContext(ctx) {
+    return ctx.shareLinkId !== undefined;
+}
+/**
+ * Refuse a privileged operation to a share-link context. Call at the top of any
+ * guard whose first line is `if (ctx.system) return` — the token grants one
+ * definition on one channel, never instance authority.
+ */
+export function assertNotShareContext(ctx, what) {
+    if (isShareContext(ctx)) {
+        throw new ProviderError(`Forbidden: a share link cannot ${what}`, 403);
+    }
+}
 const PLATFORM_PERMISSION_VALUES = new Set(ALL_PLATFORM_PERMISSIONS);
 function isPlatformPermission(p) {
     return PLATFORM_PERMISSION_VALUES.has(p);

package/dist/context.js.map

@@ -1 +1 @@
-{"version":3,"file":"context.js","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAElE,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AA2B5C,iGAAiG;AACjG,MAAM,CAAC,MAAM,cAAc,GAAmB;IAC7C,MAAM,EAAE,EAAE;IACV,mBAAmB,EAAE,CAAC,GAAG,wBAAwB,CAAC;IAClD,cAAc,EAAE,CAAC,GAAG,mBAAmB,CAAC;IACxC,MAAM,EAAE,IAAI;CACZ,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC5B,GAAmB,EACnB,UAA8C;IAE9C,IAAI,GAAG,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,GAAG,CAAC,mBAAmB,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAAE,OAAO,IAAI,CAAC;IACpE,IAAI,oBAAoB,CAAC,UAAU,CAAC,EAAE,CAAC;QACtC,OAAO,GAAG,CAAC,mBAAmB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,GAAG,CAAC,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAS,wBAAwB,CAAC,CAAC;AAE7E,SAAS,oBAAoB,CAAC,CAAS;IACtC,OAAO,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAmB;IACnD,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QACtB,MAAM,IAAI,aAAa,CAAC,mCAAmC,EAAE,GAAG,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,GAAG,CAAC,WAAW,CAAC;AACxB,CAAC"}
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAElE,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAmC5C,iGAAiG;AACjG,MAAM,CAAC,MAAM,cAAc,GAAmB;IAC7C,MAAM,EAAE,EAAE;IACV,mBAAmB,EAAE,CAAC,GAAG,wBAAwB,CAAC;IAClD,cAAc,EAAE,CAAC,GAAG,mBAAmB,CAAC;IACxC,MAAM,EAAE,IAAI;CACZ,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC5B,GAAmB,EACnB,UAA8C;IAE9C,IAAI,GAAG,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,GAAG,CAAC,mBAAmB,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAAE,OAAO,IAAI,CAAC;IACpE,IAAI,oBAAoB,CAAC,UAAU,CAAC,EAAE,CAAC;QACtC,OAAO,GAAG,CAAC,mBAAmB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,GAAG,CAAC,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,GAAmB;IACjD,OAAO,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC;AACtC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAmB,EAAE,IAAY;IACtE,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,aAAa,CAAC,kCAAkC,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;IACxE,CAAC;AACF,CAAC;AAED,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAS,wBAAwB,CAAC,CAAC;AAE7E,SAAS,oBAAoB,CAAC,CAAS;IACtC,OAAO,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAmB;IACnD,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QACtB,MAAM,IAAI,aAAa,CAAC,mCAAmC,EAAE,GAAG,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,GAAG,CAAC,WAAW,CAAC;AACxB,CAAC"}

package/dist/events/interface.d.ts

@@ -16,6 +16,12 @@ export type DomainEvent = {
     orgId: string;
     userId: string;
     actorId: string;
+} | {
+    type: 'org_member.removed_orphaning_projects';
+    orgId: string;
+    userId: string;
+    projectIds: readonly string[];
+    actorId: string;
 } | {
     type: 'org_member.role_changed';
     orgId: string;
@@ -42,6 +48,12 @@ export type DomainEvent = {
     projectId: string;
     userId: string;
     actorId: string;
+} | {
+    type: 'project.reclaimed';
+    projectId: string;
+    orgId: string;
+    actorId: string;
+    priorVisibility: string;
 } | {
     type: 'project_member.removed';
     projectId: string;
@@ -103,6 +115,24 @@ export type DomainEvent = {
     inviteId: string;
     orgId: string;
     actorId: string;
+} | {
+    type: 'user.created';
+    userId: string;
+    actorId: string;
+} | {
+    type: 'user.deleted';
+    userId: string;
+    actorId: string;
+} | {
+    type: 'user.disabled';
+    userId: string;
+    actorId: string;
+} | {
+    type: 'platform_permissions.changed';
+    userId: string;
+    /** Post-change set. The prior set is not recorded — read the preceding event of this type. */
+    permissions: readonly string[];
+    actorId: string;
 } | {
     type: 'system.update.started';
     channel: string;

package/dist/events/interface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"interface.d.ts","sourceRoot":"","sources":["../../src/events/interface.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,WAAW,GACpB;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACvD;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACvD;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC5E;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC9E;IACA,IAAI,EAAE,yBAAyB,CAAC;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACf,GACD;IACA,IAAI,EAAE,gCAAgC,CAAC;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,OAAO,EAAE,MAAM,CAAC;CACf,GACD;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC9E;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC/D;IAAE,IAAI,EAAE,sBAAsB,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACpF;IAAE,IAAI,EAAE,wBAAwB,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACtF;IACA,IAAI,EAAE,6BAA6B,CAAC;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACf,GACD;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACxF;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACrE;IAAE,IAAI,EAAE,sBAAsB,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC1F;IACA,IAAI,EAAE,4BAA4B,CAAC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;CACf,GACD;IAAE,IAAI,EAAE,4BAA4B,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC1E;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACpF;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC/D;IACA,IAAI,EAAE,gBAAgB,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,2GAA2G;IAC3G,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACf,GACD;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC7F;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAI5E;IAAE,IAAI,EAAE,uBAAuB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACzF;IACA,IAAI,EAAE,wBAAwB,CAAC;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACf,GACD;IACA,IAAI,EAAE,2BAA2B,CAAC;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACf,GACD;IACA,IAAI,EAAE,sBAAsB,CAAC;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACf,CAAC;AAEL,MAAM,MAAM,eAAe,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;AAElD;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC,MAAM,WAAW,UAAU;IAC1B;;;;;;;;;;;;;OAaG;IACH,IAAI,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxC;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,CAE3E;AAED,uEAAuE;AACvE,qBAAa,aAAc,YAAW,UAAU;IACzC,IAAI,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;CAC9C"}
+{"version":3,"file":"interface.d.ts","sourceRoot":"","sources":["../../src/events/interface.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,WAAW,GACpB;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACvD;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACvD;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC5E;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAI9E;IACA,IAAI,EAAE,uCAAuC,CAAC;IAC9C,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;CACf,GACD;IACA,IAAI,EAAE,yBAAyB,CAAC;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACf,GACD;IACA,IAAI,EAAE,gCAAgC,CAAC;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,OAAO,EAAE,MAAM,CAAC;CACf,GACD;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC9E;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC/D;IAAE,IAAI,EAAE,sBAAsB,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAKpF;IACA,IAAI,EAAE,mBAAmB,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE,MAAM,CAAC;CACvB,GACD;IAAE,IAAI,EAAE,wBAAwB,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACtF;IACA,IAAI,EAAE,6BAA6B,CAAC;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACf,GACD;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACxF;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACrE;IAAE,IAAI,EAAE,sBAAsB,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC1F;IACA,IAAI,EAAE,4BAA4B,CAAC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;CACf,GACD;IAAE,IAAI,EAAE,4BAA4B,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC1E;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACpF;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC/D;IACA,IAAI,EAAE,gBAAgB,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,2GAA2G;IAC3G,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACf,GACD;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC7F;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAI5E;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC1D;IACA,IAAI,EAAE,8BAA8B,CAAC;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,8FAA8F;IAC9F,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,OAAO,EAAE,MAAM,CAAC;CACf,GAID;IAAE,IAAI,EAAE,uBAAuB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACzF;IACA,IAAI,EAAE,wBAAwB,CAAC;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACf,GACD;IACA,IAAI,EAAE,2BAA2B,CAAC;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACf,GACD;IACA,IAAI,EAAE,sBAAsB,CAAC;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACf,CAAC;AAEL,MAAM,MAAM,eAAe,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;AAElD;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC,MAAM,WAAW,UAAU;IAC1B;;;;;;;;;;;;;OAaG;IACH,IAAI,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxC;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,CAE3E;AAED,uEAAuE;AACvE,qBAAa,aAAc,YAAW,UAAU;IACzC,IAAI,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;CAC9C"}

package/dist/events/interface.js.map

@@ -1 +1 @@
-{"version":3,"file":"interface.js","sourceRoot":"","sources":["../../src/events/interface.ts"],"names":[],"mappings":"AAgFA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAoBrC;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,GAAyC;IAClE,OAAO,GAAG,CAAC,MAAM,IAAI,QAAQ,CAAC;AAC/B,CAAC;AAED,uEAAuE;AACvE,MAAM,OAAO,aAAa;IACzB,KAAK,CAAC,IAAI,CAAC,MAAmB,IAAkB,CAAC;CACjD"}
+{"version":3,"file":"interface.js","sourceRoot":"","sources":["../../src/events/interface.ts"],"names":[],"mappings":"AAkHA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAoBrC;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,GAAyC;IAClE,OAAO,GAAG,CAAC,MAAM,IAAI,QAAQ,CAAC;AAC/B,CAAC;AAED,uEAAuE;AACvE,MAAM,OAAO,aAAa;IACzB,KAAK,CAAC,IAAI,CAAC,MAAmB,IAAkB,CAAC;CACjD"}

package/dist/index.d.ts

@@ -27,7 +27,7 @@ export { GH_EXTENSIONS, COVER_IMAGE_EXTENSIONS, ALLOWED_UPLOAD_EXTENSIONS, COVER
 export { definitionPaths } from './definitions/paths.js';
 export type { UpdateMetadataInput } from './definitions/schemas.js';
 export { DefinitionChannelSchema, PublishVersionInputSchema, CreateDefinitionInputSchema, UpdateMetadataInputSchema, GuidSchema, UUID_REGEX } from './definitions/schemas.js';
-export type { ShareLink } from './shareLinks/types.js';
+export type { OrgShareLink, ShareLink } from './shareLinks/types.js';
 export type { IShareLinkStore } from './shareLinks/interface.js';
 export { DEFAULT_SHARE_LINK_MAX_SOLVES } from './shareLinks/types.js';
 export type { CreateShareLinkInput } from './shareLinks/schemas.js';
@@ -45,9 +45,9 @@ export { isPlatformServer, isOrgServer } from './computeServer/types.js';
 export type { IComputeServerStore, GetConfigOptions } from './computeServer/interface.js';
 export type { SecretVerificationReport, SecretVerificationFailure, SecretVerificationFailureReason } from './computeServer/secrets.js';
 export type { ResolveOptions } from './computeServer/utils.js';
-export { serversVisibleTo, defaultServerIdFor, resolveServerForOrg, findServerById, platformServers, orgServersFor } from './computeServer/utils.js';
-export type { ProjectAccessInput, DefinitionAccessInput, VisibilityChangeInput, ReclaimAccessInput, CreateProjectAccessInput, OwnerRemovalInput, OwnerRemovalCheck } from './access/rules.js';
-export { canView, canSolve, canEdit, canManage, canEditProjectSettings, canChangeVisibilityToPublic, canEditDefinition, canReclaim, canCreateProject, checkOwnerRemoval, withAdminBypass } from './access/rules.js';
+export { serversVisibleTo, defaultServerIdFor, resolveServerForOrg, findServerById, platformServers, orgServersFor, scopeConfigToOrg } from './computeServer/utils.js';
+export type { ProjectAccessInput, DefinitionAccessInput, VisibilityChangeInput, ReclaimAccessInput, CreateProjectAccessInput, OrgOwnerAuthorityInput, OwnerRemovalInput, OwnerRemovalCheck } from './access/rules.js';
+export { canView, canSolve, canEdit, canManage, canEditProjectSettings, canChangeVisibilityToPublic, canEditDefinition, canReclaim, canCreateProject, canChangeOrgRole, checkOwnerRemoval, withAdminBypass } from './access/rules.js';
 export type { DomainEvent, DomainEventType, IEventSink } from './events/interface.js';
 export { actorFrom, NoopEventSink, AUDIT_EVENT_VERSION } from './events/interface.js';
 export type { AuditEventRow, AuditCursor, AuditQueryFilters, AuditQueryResult, IAuditQuery } from './events/audit.js';
@@ -64,7 +64,7 @@ export { NoopBindingResolver } from './bindings/interface.js';
 export type { AuditUpdate, AuditSoftDelete } from './utils/audit.js';
 export { auditUpdate, auditSoftDelete } from './utils/audit.js';
 export type { RequestContext } from './context.js';
-export { SYSTEM_CONTEXT, hasPermission, requireActingOrg } from './context.js';
+export { SYSTEM_CONTEXT, hasPermission, requireActingOrg, isShareContext, assertNotShareContext } from './context.js';
 export type { ListOptions, DefinitionListOptions, Page } from './pagination.js';
 export { DEFAULT_PAGE_LIMIT, MAX_PAGE_LIMIT } from './pagination.js';
 export type { TenancyMode, SelvaFlags, SelvaBranding, SelvaConfig, SelvaConfigFactory } from './config.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,YAAY,EAAE,QAAQ,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnF,YAAY,EACX,aAAa,EACb,UAAU,EACV,eAAe,EACf,aAAa,EACb,cAAc,EACd,UAAU,EACV,MAAM,qBAAqB,CAAC;AAK7B,YAAY,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAC5F,YAAY,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAG3E,YAAY,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AACpE,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAGtD,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACnF,YAAY,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,YAAY,EACX,OAAO,EACP,aAAa,EACb,YAAY,EACZ,cAAc,EACd,cAAc,EACd,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACN,aAAa,EACb,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,UAAU,EACV,OAAO,EACP,cAAc,EACd,eAAe,EACf,eAAe,EACf,mBAAmB,EACnB,uBAAuB,EACvB,4BAA4B,EAC5B,6BAA6B,EAC7B,MAAM,4BAA4B,CAAC;AAGpC,YAAY,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAG3D,YAAY,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAClE,YAAY,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,YAAY,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAC5E,OAAO,EACN,uBAAuB,EACvB,iBAAiB,EACjB,oBAAoB,EACpB,MAAM,uBAAuB,CAAC;AAG/B,YAAY,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AACpG,YAAY,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAClF,OAAO,EACN,0BAA0B,EAC1B,gCAAgC,EAChC,MAAM,+BAA+B,CAAC;AAGvC,YAAY,EACX,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,qBAAqB,EACrB,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,YAAY,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EACN,aAAa,EACb,sBAAsB,EACtB,yBAAyB,EACzB,yBAAyB,EACzB,oBAAoB,EACpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,EACN,uBAAuB,EACvB,yBAAyB,EACzB,2BAA2B,EAC3B,yBAAyB,EACzB,UAAU,EACV,UAAU,EACV,MAAM,0BAA0B,CAAC;AAKlC,YAAY,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvD,YAAY,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,6BAA6B,EAAE,MAAM,uBAAuB,CAAC;AACtE,YAAY,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AAKrE,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EACN,eAAe,EACf,kBAAkB,EAClB,aAAa,EACb,UAAU,EACV,sBAAsB,EACtB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAChG,YAAY,EACX,eAAe,EACf,UAAU,EACV,UAAU,EACV,UAAU,EACV,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAKvD,YAAY,EAAE,aAAa,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAClG,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAKtD,YAAY,EACX,mBAAmB,EACnB,aAAa,EACb,qBAAqB,EACrB,gBAAgB,EAChB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACzE,YAAY,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAK1F,YAAY,EACX,wBAAwB,EACxB,yBAAyB,EACzB,+BAA+B,EAC/B,MAAM,4BAA4B,CAAC;AACpC,YAAY,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EACN,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,aAAa,EACb,MAAM,0BAA0B,CAAC;AAKlC,YAAY,EACX,kBAAkB,EAClB,qBAAqB,EACrB,qBAAqB,EACrB,kBAAkB,EAClB,wBAAwB,EACxB,iBAAiB,EACjB,iBAAiB,EACjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACN,OAAO,EACP,QAAQ,EACR,OAAO,EACP,SAAS,EACT,sBAAsB,EACtB,2BAA2B,EAC3B,iBAAiB,EACjB,UAAU,EACV,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,MAAM,mBAAmB,CAAC;AAK3B,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACtF,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AACtF,YAAY,EACX,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,EACX,MAAM,mBAAmB,CAAC;AAK3B,YAAY,EAAE,gBAAgB,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC9F,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAK7D,YAAY,EACX,iBAAiB,EACjB,aAAa,EACb,oBAAoB,EACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAKjE,YAAY,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAK1D,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAKpD,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAK9D,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAKhE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAE/E,YAAY,EAAE,WAAW,EAAE,qBAAqB,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAChF,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAErE,YAAY,EACX,WAAW,EACX,UAAU,EACV,aAAa,EACb,WAAW,EACX,kBAAkB,EAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE1D,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,YAAY,EAAE,QAAQ,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnF,YAAY,EACX,aAAa,EACb,UAAU,EACV,eAAe,EACf,aAAa,EACb,cAAc,EACd,UAAU,EACV,MAAM,qBAAqB,CAAC;AAK7B,YAAY,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAC5F,YAAY,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAG3E,YAAY,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AACpE,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAGtD,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACnF,YAAY,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,YAAY,EACX,OAAO,EACP,aAAa,EACb,YAAY,EACZ,cAAc,EACd,cAAc,EACd,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACN,aAAa,EACb,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,UAAU,EACV,OAAO,EACP,cAAc,EACd,eAAe,EACf,eAAe,EACf,mBAAmB,EACnB,uBAAuB,EACvB,4BAA4B,EAC5B,6BAA6B,EAC7B,MAAM,4BAA4B,CAAC;AAGpC,YAAY,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAG3D,YAAY,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAClE,YAAY,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,YAAY,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAC5E,OAAO,EACN,uBAAuB,EACvB,iBAAiB,EACjB,oBAAoB,EACpB,MAAM,uBAAuB,CAAC;AAG/B,YAAY,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AACpG,YAAY,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAClF,OAAO,EACN,0BAA0B,EAC1B,gCAAgC,EAChC,MAAM,+BAA+B,CAAC;AAGvC,YAAY,EACX,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,qBAAqB,EACrB,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,YAAY,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EACN,aAAa,EACb,sBAAsB,EACtB,yBAAyB,EACzB,yBAAyB,EACzB,oBAAoB,EACpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,EACN,uBAAuB,EACvB,yBAAyB,EACzB,2BAA2B,EAC3B,yBAAyB,EACzB,UAAU,EACV,UAAU,EACV,MAAM,0BAA0B,CAAC;AAKlC,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACrE,YAAY,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,6BAA6B,EAAE,MAAM,uBAAuB,CAAC;AACtE,YAAY,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AAKrE,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EACN,eAAe,EACf,kBAAkB,EAClB,aAAa,EACb,UAAU,EACV,sBAAsB,EACtB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAChG,YAAY,EACX,eAAe,EACf,UAAU,EACV,UAAU,EACV,UAAU,EACV,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAKvD,YAAY,EAAE,aAAa,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAClG,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAKtD,YAAY,EACX,mBAAmB,EACnB,aAAa,EACb,qBAAqB,EACrB,gBAAgB,EAChB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACzE,YAAY,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAK1F,YAAY,EACX,wBAAwB,EACxB,yBAAyB,EACzB,+BAA+B,EAC/B,MAAM,4BAA4B,CAAC;AACpC,YAAY,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EACN,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,MAAM,0BAA0B,CAAC;AAKlC,YAAY,EACX,kBAAkB,EAClB,qBAAqB,EACrB,qBAAqB,EACrB,kBAAkB,EAClB,wBAAwB,EACxB,sBAAsB,EACtB,iBAAiB,EACjB,iBAAiB,EACjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACN,OAAO,EACP,QAAQ,EACR,OAAO,EACP,SAAS,EACT,sBAAsB,EACtB,2BAA2B,EAC3B,iBAAiB,EACjB,UAAU,EACV,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,MAAM,mBAAmB,CAAC;AAK3B,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACtF,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AACtF,YAAY,EACX,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,EACX,MAAM,mBAAmB,CAAC;AAK3B,YAAY,EAAE,gBAAgB,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC9F,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAK7D,YAAY,EACX,iBAAiB,EACjB,aAAa,EACb,oBAAoB,EACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAKjE,YAAY,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAK1D,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAKpD,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAK9D,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAKhE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EACN,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,qBAAqB,EACrB,MAAM,cAAc,CAAC;AAEtB,YAAY,EAAE,WAAW,EAAE,qBAAqB,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAChF,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAErE,YAAY,EACX,WAAW,EACX,UAAU,EACV,aAAa,EACb,WAAW,EACX,kBAAkB,EAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE1D,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -15,8 +15,8 @@ export { ASSET_CLASSES, classifyAssetPath, isPublicAssetPath } from './storage/a
 export { withCacheBust } from './storage/cacheBust.js';
 export { ERASED_ACTOR_ID } from './data/interface.js';
 export { isPlatformServer, isOrgServer } from './computeServer/types.js';
-export { serversVisibleTo, defaultServerIdFor, resolveServerForOrg, findServerById, platformServers, orgServersFor } from './computeServer/utils.js';
-export { canView, canSolve, canEdit, canManage, canEditProjectSettings, canChangeVisibilityToPublic, canEditDefinition, canReclaim, canCreateProject, checkOwnerRemoval, withAdminBypass } from './access/rules.js';
+export { serversVisibleTo, defaultServerIdFor, resolveServerForOrg, findServerById, platformServers, orgServersFor, scopeConfigToOrg } from './computeServer/utils.js';
+export { canView, canSolve, canEdit, canManage, canEditProjectSettings, canChangeVisibilityToPublic, canEditDefinition, canReclaim, canCreateProject, canChangeOrgRole, checkOwnerRemoval, withAdminBypass } from './access/rules.js';
 export { actorFrom, NoopEventSink, AUDIT_EVENT_VERSION } from './events/interface.js';
 export { NoopSolveMetricSink } from './metrics/interface.js';
 export { NoopSolveResultCache } from './solveCache/interface.js';
@@ -24,7 +24,7 @@ export { NoopErrorReporter } from './errors/interface.js';
 export { NoopLogger } from './logging/interface.js';
 export { NoopBindingResolver } from './bindings/interface.js';
 export { auditUpdate, auditSoftDelete } from './utils/audit.js';
-export { SYSTEM_CONTEXT, hasPermission, requireActingOrg } from './context.js';
+export { SYSTEM_CONTEXT, hasPermission, requireActingOrg, isShareContext, assertNotShareContext } from './context.js';
 export { DEFAULT_PAGE_LIMIT, MAX_PAGE_LIMIT } from './pagination.js';
 export { isFlagEnabled, defineConfig } from './config.js';
 export { ProviderError } from './errors.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAiB9F,OAAO,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAM5F,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAKtD,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAQpD,OAAO,EACN,aAAa,EACb,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,UAAU,EACV,OAAO,EACP,cAAc,EACd,eAAe,EACf,eAAe,EACf,mBAAmB,EACnB,uBAAuB,EACvB,4BAA4B,EAC5B,6BAA6B,EAC7B,MAAM,4BAA4B,CAAC;AAUpC,OAAO,EACN,uBAAuB,EACvB,iBAAiB,EACjB,oBAAoB,EACpB,MAAM,uBAAuB,CAAC;AAK/B,OAAO,EACN,0BAA0B,EAC1B,gCAAgC,EAChC,MAAM,+BAA+B,CAAC;AAcvC,OAAO,EACN,aAAa,EACb,sBAAsB,EACtB,yBAAyB,EACzB,yBAAyB,EACzB,oBAAoB,EACpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,EACN,uBAAuB,EACvB,yBAAyB,EACzB,2BAA2B,EAC3B,yBAAyB,EACzB,UAAU,EACV,UAAU,EACV,MAAM,0BAA0B,CAAC;AAOlC,OAAO,EAAE,6BAA6B,EAAE,MAAM,uBAAuB,CAAC;AAEtE,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AAMrE,OAAO,EACN,eAAe,EACf,kBAAkB,EAClB,aAAa,EACb,UAAU,EACV,sBAAsB,EACtB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAOhG,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAMvD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAWtD,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAYzE,OAAO,EACN,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,aAAa,EACb,MAAM,0BAA0B,CAAC;AAclC,OAAO,EACN,OAAO,EACP,QAAQ,EACR,OAAO,EACP,SAAS,EACT,sBAAsB,EACtB,2BAA2B,EAC3B,iBAAiB,EACjB,UAAU,EACV,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,MAAM,mBAAmB,CAAC;AAM3B,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAatF,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAU7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAMjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAM1D,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAMpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAM9D,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAMhE,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAG/E,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AASrE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE1D,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAiB9F,OAAO,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAM5F,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAKtD,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAQpD,OAAO,EACN,aAAa,EACb,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,UAAU,EACV,OAAO,EACP,cAAc,EACd,eAAe,EACf,eAAe,EACf,mBAAmB,EACnB,uBAAuB,EACvB,4BAA4B,EAC5B,6BAA6B,EAC7B,MAAM,4BAA4B,CAAC;AAUpC,OAAO,EACN,uBAAuB,EACvB,iBAAiB,EACjB,oBAAoB,EACpB,MAAM,uBAAuB,CAAC;AAK/B,OAAO,EACN,0BAA0B,EAC1B,gCAAgC,EAChC,MAAM,+BAA+B,CAAC;AAcvC,OAAO,EACN,aAAa,EACb,sBAAsB,EACtB,yBAAyB,EACzB,yBAAyB,EACzB,oBAAoB,EACpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,EACN,uBAAuB,EACvB,yBAAyB,EACzB,2BAA2B,EAC3B,yBAAyB,EACzB,UAAU,EACV,UAAU,EACV,MAAM,0BAA0B,CAAC;AAOlC,OAAO,EAAE,6BAA6B,EAAE,MAAM,uBAAuB,CAAC;AAEtE,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AAMrE,OAAO,EACN,eAAe,EACf,kBAAkB,EAClB,aAAa,EACb,UAAU,EACV,sBAAsB,EACtB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAOhG,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAMvD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAWtD,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAYzE,OAAO,EACN,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,MAAM,0BAA0B,CAAC;AAelC,OAAO,EACN,OAAO,EACP,QAAQ,EACR,OAAO,EACP,SAAS,EACT,sBAAsB,EACtB,2BAA2B,EAC3B,iBAAiB,EACjB,UAAU,EACV,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,MAAM,mBAAmB,CAAC;AAM3B,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAatF,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAU7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAMjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAM1D,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAMpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAM9D,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAMhE,OAAO,EACN,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,qBAAqB,EACrB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AASrE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE1D,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC"}

package/dist/invites/interface.d.ts

@@ -21,6 +21,21 @@ export interface IInviteStore {
     markAccepted(ctx: RequestContext, id: string, userId: string): Promise<void>;
     /** No-op if already consumed or missing. */
     revoke(ctx: RequestContext, id: string): Promise<void>;
+    /**
+     * Revoke every pending invite to `email` in this org, returning the ids
+     * revoked. Accepted invites are left alone — consuming one is history, not
+     * a live grant.
+     *
+     * Offboarding needs this: `removeOrgMember` cascades `project_members` but
+     * has never touched invites, so a dormant invite let a removed user walk
+     * back in at their original role for the rest of its TTL. Matching by email
+     * rather than user id is deliberate — an invite names an address, and the
+     * account it will create may not exist yet.
+     *
+     * One call rather than list-then-revoke-each: the loop would race a
+     * concurrent accept between the two round-trips.
+     */
+    revokePendingByEmail(ctx: RequestContext, orgId: string, email: string): Promise<string[]>;
     /** Called from the `deleteOrg` cascade — invites to a deleted org are unredeemable orphans otherwise. */
     deleteByOrg(ctx: RequestContext, orgId: string): Promise<void>;
 }

package/dist/invites/interface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"interface.d.ts","sourceRoot":"","sources":["../../src/invites/interface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC;;;;;;;GAOG;AACH,MAAM,WAAW,YAAY;IAC5B,MAAM,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE3D;;;OAGG;IACH,cAAc,CAAC,GAAG,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAE/E,SAAS,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAEzF,iCAAiC;IACjC,YAAY,CAAC,GAAG,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE7E,4CAA4C;IAC5C,MAAM,CAAC,GAAG,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvD,yGAAyG;IACzG,WAAW,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/D"}
+{"version":3,"file":"interface.d.ts","sourceRoot":"","sources":["../../src/invites/interface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC;;;;;;;GAOG;AACH,MAAM,WAAW,YAAY;IAC5B,MAAM,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE3D;;;OAGG;IACH,cAAc,CAAC,GAAG,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAE/E,SAAS,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAEzF,iCAAiC;IACjC,YAAY,CAAC,GAAG,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE7E,4CAA4C;IAC5C,MAAM,CAAC,GAAG,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvD;;;;;;;;;;;;;OAaG;IACH,oBAAoB,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAE3F,yGAAyG;IACzG,WAAW,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/D"}