@selvajs/selva 4.14.1 → 4.14.2

package/build/server/chunks/entries/endpoints/api/v1/orgs/_orgId_/compute/_server.ts.js-B-eYQFrg.js

@@ -1,99 +0,0 @@
-import '../../../../../../../chunks/src.js-B12bUNyu.js';
-import { m as getComputeServerConfigStore, F as isOrgServer, E as isPlatformServer, C as serversVisibleTo, k as flag } from '../../../../../../../chunks/providers.server.js-n7DF9bkc.js';
-import { v as requireManageOrgCompute, t as requireActingOrg } from '../../../../../../../chunks/access.server.js-BUiuIuUH.js';
-import { a as apiError, A as ApiErrorCode } from '../../../../../../../chunks/api-errors.js-ZUI_rSV_.js';
-import { v as validateIncomingServers, s as storedKeysById, r as resolveApiKey, e as evictChangedServers } from '../../../../../../../chunks/serverConfigWrite.js-BVh1F9pd.js';
-import { a as apiRoute, h as shaped, p as parseBody, n as noContent } from '../../../../../../../chunks/http.js-DTur24v9.js';
-import { O as OrgComputeResponseSchema } from '../../../../../../../chunks/responses.js-C3TpfP9h.js';
-import { O as OrgComputePatchBodySchema } from '../../../../../../../chunks/bodies.js-C9rGU8lD.js';
-import 'zod';
-import '../../../../../../../chunks/shared-server.js-BZy9KN6u.js';
-import '../../../../../../../chunks/schema.js-BVfByvmD.js';
-import '../../../../../../../chunks/core-BQtRL5GE.js-B9MmO4om.js';
-import 'node:crypto';
-import 'node:url';
-import 'node:path';
-import 'node:fs';
-import 'node:fs/promises';
-import '@supabase/supabase-js';
-import '@sveltejs/kit';
-import '../../../../../../../chunks/engine.server.js-Ci7yj84d.js';
-import '../../../../../../../chunks/computeLimits.js-Bd0sEBc0.js';
-import 'node:dns/promises';
-import 'node:net';
-import 'node:zlib';
-import 'node:util';
-
-//#region src/routes/api/v1/orgs/[orgId]/compute/+server.ts
-/**
-* Per-org compute endpoint. Manages this org's own servers
-* (`scope: 'org'`) and the org's default selection
-* (`orgDefaults[orgId]`). Platform servers and the global default are
-* read-only here — they're managed by `manage_compute` via `/api/admin/compute`.
-*
-* Authorization: org `owner`/`admin` with `manage_org_compute`. The URL `orgId`
-* must equal the caller's `actingOrgId`. Gated by the platform flag
-* `ALLOW_ORG_COMPUTE_OVERRIDE`; when off, both methods 403.
-*/
-function requireFlag() {
-	if (!flag("ALLOW_ORG_COMPUTE_OVERRIDE")) apiError(403, ApiErrorCode.FORBIDDEN, "Per-org compute override is disabled on this instance (ALLOW_ORG_COMPUTE_OVERRIDE).");
-}
-var GET = apiRoute("Failed to load org compute config", async ({ params, locals }) => {
-	requireFlag();
-	requireManageOrgCompute(locals);
-	const { ctx, orgId } = requireActingOrg(locals, params.orgId);
-	const config = await getComputeServerConfigStore().getConfig(ctx, { scopeToOrgId: orgId });
-	const owned = config.servers.filter((s) => isOrgServer(s) && s.ownerOrgId === orgId).map((s) => ({
-		...s,
-		hasApiKey: !!s.hasApiKey
-	}));
-	const catalog = config.servers.map((s) => ({
-		id: s.id,
-		label: s.label,
-		serverUrl: s.serverUrl,
-		scope: s.scope,
-		source: isPlatformServer(s) ? "platform" : "org",
-		timeoutMs: s.timeoutMs,
-		retryCount: s.retryCount
-	}));
-	return shaped(OrgComputeResponseSchema, {
-		servers: owned,
-		defaultServerId: config.orgDefaults?.[orgId] ?? null,
-		globalDefaultServerId: config.defaultServerId ?? null,
-		catalog
-	});
-});
-var PATCH = apiRoute("Failed to save org compute config", async ({ params, request, locals }) => {
-	requireFlag();
-	requireManageOrgCompute(locals);
-	const { ctx, orgId } = requireActingOrg(locals, params.orgId);
-	const incoming = await parseBody(request, OrgComputePatchBodySchema);
-	validateIncomingServers(incoming.servers);
-	const provider = getComputeServerConfigStore();
-	const existing = await provider.getConfig(ctx, { includeApiKeys: true });
-	const storedKeys = storedKeysById(existing.servers.filter((s) => isOrgServer(s) && s.ownerOrgId === orgId));
-	const next = incoming.servers.map((s) => ({
-		id: s.id,
-		scope: "org",
-		ownerOrgId: orgId,
-		label: s.label,
-		serverUrl: s.serverUrl,
-		timeoutMs: s.timeoutMs,
-		retryCount: s.retryCount,
-		apiKey: resolveApiKey(s.apiKey, storedKeys.get(s.id))
-	}));
-	if (typeof incoming.defaultServerId === "string") {
-		const projected = {
-			servers: [...existing.servers.filter((s) => !(isOrgServer(s) && s.ownerOrgId === orgId)), ...next],
-			defaultServerId: existing.defaultServerId,
-			orgDefaults: existing.orgDefaults
-		};
-		if (!new Set(serversVisibleTo(projected, orgId).map((s) => s.id)).has(incoming.defaultServerId)) apiError(400, ApiErrorCode.VALIDATION_FAILED, "defaultServerId must reference a server visible to this organization");
-	}
-	await provider.saveOrgServers(ctx, orgId, next, incoming.defaultServerId);
-	evictChangedServers(existing.servers.filter((s) => isOrgServer(s) && s.ownerOrgId === orgId), next);
-	return noContent();
-});
-
-export { GET, PATCH };
-//# sourceMappingURL=_server.ts.js-B-eYQFrg.js.map

package/build/server/chunks/entries/endpoints/api/v1/orgs/_orgId_/compute/_server.ts.js-B-eYQFrg.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"_server.ts.js-B-eYQFrg.js","sources":["../../../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/v1/orgs/_orgId_/compute/_server.ts.js"],"sourcesContent":["import \"../../../../../../../chunks/src.js\";\nimport { H as serversVisibleTo, U as isOrgServer, W as isPlatformServer, a as getComputeServerConfigStore, t as flag } from \"../../../../../../../chunks/providers.server.js\";\nimport { S as requireManageOrgCompute, c as requireActingOrg } from \"../../../../../../../chunks/access.server.js\";\nimport { n as apiError, t as ApiErrorCode } from \"../../../../../../../chunks/api-errors.js\";\nimport { i as evictChangedServers, n as storedKeysById, r as validateIncomingServers, t as resolveApiKey } from \"../../../../../../../chunks/serverConfigWrite.js\";\nimport { a as noContent, d as shaped, o as parseBody, t as apiRoute } from \"../../../../../../../chunks/http.js\";\nimport \"../../../../../../../chunks/route.js\";\nimport { i as OrgComputeResponseSchema } from \"../../../../../../../chunks/responses.js\";\nimport { i as OrgComputePatchBodySchema } from \"../../../../../../../chunks/bodies.js\";\n//#region src/routes/api/v1/orgs/[orgId]/compute/+server.ts\n/**\n* Per-org compute endpoint. Manages this org's own servers\n* (`scope: 'org'`) and the org's default selection\n* (`orgDefaults[orgId]`). Platform servers and the global default are\n* read-only here — they're managed by `manage_compute` via `/api/admin/compute`.\n*\n* Authorization: org `owner`/`admin` with `manage_org_compute`. The URL `orgId`\n* must equal the caller's `actingOrgId`. Gated by the platform flag\n* `ALLOW_ORG_COMPUTE_OVERRIDE`; when off, both methods 403.\n*/\nfunction requireFlag() {\n\tif (!flag(\"ALLOW_ORG_COMPUTE_OVERRIDE\")) apiError(403, ApiErrorCode.FORBIDDEN, \"Per-org compute override is disabled on this instance (ALLOW_ORG_COMPUTE_OVERRIDE).\");\n}\nvar GET = apiRoute(\"Failed to load org compute config\", async ({ params, locals }) => {\n\trequireFlag();\n\trequireManageOrgCompute(locals);\n\tconst { ctx, orgId } = requireActingOrg(locals, params.orgId);\n\tconst config = await getComputeServerConfigStore().getConfig(ctx, { scopeToOrgId: orgId });\n\tconst owned = config.servers.filter((s) => isOrgServer(s) && s.ownerOrgId === orgId).map((s) => ({\n\t\t...s,\n\t\thasApiKey: !!s.hasApiKey\n\t}));\n\tconst catalog = config.servers.map((s) => ({\n\t\tid: s.id,\n\t\tlabel: s.label,\n\t\tserverUrl: s.serverUrl,\n\t\tscope: s.scope,\n\t\tsource: isPlatformServer(s) ? \"platform\" : \"org\",\n\t\ttimeoutMs: s.timeoutMs,\n\t\tretryCount: s.retryCount\n\t}));\n\treturn shaped(OrgComputeResponseSchema, {\n\t\tservers: owned,\n\t\tdefaultServerId: config.orgDefaults?.[orgId] ?? null,\n\t\tglobalDefaultServerId: config.defaultServerId ?? null,\n\t\tcatalog\n\t});\n});\nvar PATCH = apiRoute(\"Failed to save org compute config\", async ({ params, request, locals }) => {\n\trequireFlag();\n\trequireManageOrgCompute(locals);\n\tconst { ctx, orgId } = requireActingOrg(locals, params.orgId);\n\tconst incoming = await parseBody(request, OrgComputePatchBodySchema);\n\tvalidateIncomingServers(incoming.servers);\n\tconst provider = getComputeServerConfigStore();\n\tconst existing = await provider.getConfig(ctx, { includeApiKeys: true });\n\tconst storedKeys = storedKeysById(existing.servers.filter((s) => isOrgServer(s) && s.ownerOrgId === orgId));\n\tconst next = incoming.servers.map((s) => ({\n\t\tid: s.id,\n\t\tscope: \"org\",\n\t\townerOrgId: orgId,\n\t\tlabel: s.label,\n\t\tserverUrl: s.serverUrl,\n\t\ttimeoutMs: s.timeoutMs,\n\t\tretryCount: s.retryCount,\n\t\tapiKey: resolveApiKey(s.apiKey, storedKeys.get(s.id))\n\t}));\n\tif (typeof incoming.defaultServerId === \"string\") {\n\t\tconst projected = {\n\t\t\tservers: [...existing.servers.filter((s) => !(isOrgServer(s) && s.ownerOrgId === orgId)), ...next],\n\t\t\tdefaultServerId: existing.defaultServerId,\n\t\t\torgDefaults: existing.orgDefaults\n\t\t};\n\t\tif (!new Set(serversVisibleTo(projected, orgId).map((s) => s.id)).has(incoming.defaultServerId)) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"defaultServerId must reference a server visible to this organization\");\n\t}\n\tawait provider.saveOrgServers(ctx, orgId, next, incoming.defaultServerId);\n\tevictChangedServers(existing.servers.filter((s) => isOrgServer(s) && s.ownerOrgId === orgId), next);\n\treturn noContent();\n});\n//#endregion\nexport { GET, PATCH };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AASA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,WAAW,GAAG;AACvB,CAAC,IAAI,CAAC,IAAI,CAAC,4BAA4B,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,qFAAqF,CAAC;AACtK;AACG,IAAC,GAAG,GAAG,QAAQ,CAAC,mCAAmC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK;AACtF,CAAC,WAAW,EAAE;AACd,CAAC,uBAAuB,CAAC,MAAM,CAAC;AAChC,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC;AAC9D,CAAC,MAAM,MAAM,GAAG,MAAM,2BAA2B,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;AAC3F,CAAC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,KAAK,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM;AAClG,EAAE,GAAG,CAAC;AACN,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;AACjB,EAAE,CAAC,CAAC;AACJ,CAAC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM;AAC5C,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE;AACV,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK;AAChB,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS;AACxB,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK;AAChB,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC,GAAG,UAAU,GAAG,KAAK;AAClD,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS;AACxB,EAAE,UAAU,EAAE,CAAC,CAAC;AAChB,EAAE,CAAC,CAAC;AACJ,CAAC,OAAO,MAAM,CAAC,wBAAwB,EAAE;AACzC,EAAE,OAAO,EAAE,KAAK;AAChB,EAAE,eAAe,EAAE,MAAM,CAAC,WAAW,GAAG,KAAK,CAAC,IAAI,IAAI;AACtD,EAAE,qBAAqB,EAAE,MAAM,CAAC,eAAe,IAAI,IAAI;AACvD,EAAE;AACF,EAAE,CAAC;AACH,CAAC;AACE,IAAC,KAAK,GAAG,QAAQ,CAAC,mCAAmC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK;AACjG,CAAC,WAAW,EAAE;AACd,CAAC,uBAAuB,CAAC,MAAM,CAAC;AAChC,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC;AAC9D,CAAC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,yBAAyB,CAAC;AACrE,CAAC,uBAAuB,CAAC,QAAQ,CAAC,OAAO,CAAC;AAC1C,CAAC,MAAM,QAAQ,GAAG,2BAA2B,EAAE;AAC/C,CAAC,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;AACzE,CAAC,MAAM,UAAU,GAAG,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,KAAK,KAAK,CAAC,CAAC;AAC5G,CAAC,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM;AAC3C,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE;AACV,EAAE,KAAK,EAAE,KAAK;AACd,EAAE,UAAU,EAAE,KAAK;AACnB,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK;AAChB,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS;AACxB,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS;AACxB,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU;AAC1B,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;AACtD,EAAE,CAAC,CAAC;AACJ,CAAC,IAAI,OAAO,QAAQ,CAAC,eAAe,KAAK,QAAQ,EAAE;AACnD,EAAE,MAAM,SAAS,GAAG;AACpB,GAAG,OAAO,EAAE,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,KAAK,KAAK,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC;AACrG,GAAG,eAAe,EAAE,QAAQ,CAAC,eAAe;AAC5C,GAAG,WAAW,EAAE,QAAQ,CAAC;AACzB,GAAG;AACH,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC,gBAAgB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,sEAAsE,CAAC;AACxN,CAAC;AACD,CAAC,MAAM,QAAQ,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,eAAe,CAAC;AAC1E,CAAC,mBAAmB,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,KAAK,KAAK,CAAC,EAAE,IAAI,CAAC;AACpG,CAAC,OAAO,SAAS,EAAE;AACnB,CAAC;;;;"}

package/build/server/chunks/entries/endpoints/api/v1/orgs/_orgId_/invites/_id_/_server.ts.js-DTJx7f-N.js

@@ -1,31 +0,0 @@
-import { u as getInviteStore } from '../../../../../../../../chunks/providers.server.js-n7DF9bkc.js';
-import { u as requireManageOrgMembers, t as requireActingOrg } from '../../../../../../../../chunks/access.server.js-BUiuIuUH.js';
-import { a as apiError, A as ApiErrorCode } from '../../../../../../../../chunks/api-errors.js-ZUI_rSV_.js';
-import { a as apiRoute, r as requireParams, n as noContent } from '../../../../../../../../chunks/http.js-DTur24v9.js';
-import { f as findPendingInviteInOrg } from '../../../../../../../../chunks/lookup.server.js-h2M2kq1I.js';
-import '../../../../../../../../chunks/shared-server.js-BZy9KN6u.js';
-import '../../../../../../../../chunks/src.js-B12bUNyu.js';
-import 'zod';
-import '../../../../../../../../chunks/schema.js-BVfByvmD.js';
-import '../../../../../../../../chunks/core-BQtRL5GE.js-B9MmO4om.js';
-import 'node:crypto';
-import 'node:url';
-import 'node:path';
-import 'node:fs';
-import 'node:fs/promises';
-import '@supabase/supabase-js';
-import '@sveltejs/kit';
-
-//#region src/routes/api/v1/orgs/[orgId]/invites/[id]/+server.ts
-/** Revoke a pending invite. Consumed invites are preserved for audit. */
-var DELETE = apiRoute("Failed to revoke invite", async ({ params, locals }) => {
-	requireManageOrgMembers(locals);
-	const { ctx, orgId } = requireActingOrg(locals, params.orgId);
-	const { id } = requireParams(params, "id");
-	if (!await findPendingInviteInOrg(ctx, orgId, id)) apiError(404, ApiErrorCode.NOT_FOUND, "Invite not found");
-	await getInviteStore().revoke(ctx, id);
-	return noContent();
-});
-
-export { DELETE };
-//# sourceMappingURL=_server.ts.js-DTJx7f-N.js.map

package/build/server/chunks/entries/endpoints/api/v1/orgs/_orgId_/invites/_id_/_server.ts.js-DTJx7f-N.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"_server.ts.js-DTJx7f-N.js","sources":["../../../../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/v1/orgs/_orgId_/invites/_id_/_server.ts.js"],"sourcesContent":["import { d as getInviteStore } from \"../../../../../../../../chunks/providers.server.js\";\nimport { C as requireManageOrgMembers, c as requireActingOrg } from \"../../../../../../../../chunks/access.server.js\";\nimport { n as apiError, t as ApiErrorCode } from \"../../../../../../../../chunks/api-errors.js\";\nimport { a as noContent, l as requireParams, t as apiRoute } from \"../../../../../../../../chunks/http.js\";\nimport \"../../../../../../../../chunks/route.js\";\nimport { t as findPendingInviteInOrg } from \"../../../../../../../../chunks/lookup.server.js\";\n//#region src/routes/api/v1/orgs/[orgId]/invites/[id]/+server.ts\n/** Revoke a pending invite. Consumed invites are preserved for audit. */\nvar DELETE = apiRoute(\"Failed to revoke invite\", async ({ params, locals }) => {\n\trequireManageOrgMembers(locals);\n\tconst { ctx, orgId } = requireActingOrg(locals, params.orgId);\n\tconst { id } = requireParams(params, \"id\");\n\tif (!await findPendingInviteInOrg(ctx, orgId, id)) apiError(404, ApiErrorCode.NOT_FOUND, \"Invite not found\");\n\tawait getInviteStore().revoke(ctx, id);\n\treturn noContent();\n});\n//#endregion\nexport { DELETE };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAMA;AACA;AACG,IAAC,MAAM,GAAG,QAAQ,CAAC,yBAAyB,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK;AAC/E,CAAC,uBAAuB,CAAC,MAAM,CAAC;AAChC,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC;AAC9D,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC;AAC3C,CAAC,IAAI,CAAC,MAAM,sBAAsB,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,kBAAkB,CAAC;AAC7G,CAAC,MAAM,cAAc,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC;AACvC,CAAC,OAAO,SAAS,EAAE;AACnB,CAAC;;;;"}

package/build/server/chunks/entries/endpoints/api/v1/orgs/_orgId_/invites/_id_/resend/_server.ts.js-BUTT4IFr.js

@@ -1,76 +0,0 @@
-import { u as getInviteStore } from '../../../../../../../../../chunks/providers.server.js-n7DF9bkc.js';
-import { u as requireManageOrgMembers, t as requireActingOrg } from '../../../../../../../../../chunks/access.server.js-BUiuIuUH.js';
-import { a as apiError, A as ApiErrorCode } from '../../../../../../../../../chunks/api-errors.js-ZUI_rSV_.js';
-import { a as apiRoute, r as requireParams, h as shaped } from '../../../../../../../../../chunks/http.js-DTur24v9.js';
-import { a as CreatedInviteResponseSchema } from '../../../../../../../../../chunks/responses.js-C3TpfP9h.js';
-import { d as deliverInvite } from '../../../../../../../../../chunks/deliver.server.js-BnV24wUm.js';
-import { m as mintRawToken, h as hashToken } from '../../../../../../../../../chunks/token2.server.js-Y-zJuZS5.js';
-import { f as findPendingInviteInOrg } from '../../../../../../../../../chunks/lookup.server.js-h2M2kq1I.js';
-import { randomUUID } from 'node:crypto';
-import '../../../../../../../../../chunks/shared-server.js-BZy9KN6u.js';
-import '../../../../../../../../../chunks/src.js-B12bUNyu.js';
-import 'zod';
-import '../../../../../../../../../chunks/schema.js-BVfByvmD.js';
-import '../../../../../../../../../chunks/core-BQtRL5GE.js-B9MmO4om.js';
-import 'node:url';
-import 'node:path';
-import 'node:fs';
-import 'node:fs/promises';
-import '@supabase/supabase-js';
-import '@sveltejs/kit';
-import '../../../../../../../../../chunks/email.js-CfmiUBKY.js';
-import '../../../../../../../../../chunks/token-codec.js-CxK2DiO-.js';
-
-//#region src/routes/api/v1/orgs/[orgId]/invites/[id]/resend/+server.ts
-var INVITE_TTL_MS = 6048e5;
-/**
-* Re-send an invite: mint a replacement and revoke the original.
-*
-* A resend cannot reuse the original link. The raw token is never stored — only
-* its HMAC digest is — so there is nothing to re-read, and rather than weaken
-* that, this issues a fresh token and revokes the row it replaces. The old link
-* stops working the moment this returns, which is also what an admin wants
-* after mailing an invite to the wrong address.
-*
-* Grants are copied verbatim from the original. The role and permission gates
-* ran when it was minted; re-deriving them here would let a since-demoted admin
-* silently change what the invite carries.
-*/
-var POST = apiRoute("Failed to resend invite", async ({ params, locals, url }) => {
-	requireManageOrgMembers(locals);
-	const { ctx, orgId } = requireActingOrg(locals, params.orgId);
-	const { id } = requireParams(params, "id");
-	const existing = await findPendingInviteInOrg(ctx, orgId, id);
-	if (!existing) apiError(404, ApiErrorCode.NOT_FOUND, "Invite not found");
-	if (existing.acceptedAt) apiError(409, ApiErrorCode.CONFLICT, "This invite has already been accepted.");
-	const rawToken = mintRawToken();
-	const now = /* @__PURE__ */ new Date();
-	const replacement = {
-		...existing,
-		id: randomUUID(),
-		tokenHash: hashToken(rawToken),
-		createdAt: now.toISOString(),
-		expiresAt: new Date(now.getTime() + INVITE_TTL_MS).toISOString()
-	};
-	await getInviteStore().create(ctx, replacement);
-	await getInviteStore().revoke(ctx, existing.id);
-	const acceptUrl = `${url.origin}/accept-invite?token=${rawToken}`;
-	const delivery = await deliverInvite({
-		ctx,
-		log: locals.log,
-		invite: replacement,
-		acceptUrl,
-		actor: {
-			profile: locals.profile,
-			user: locals.user
-		}
-	});
-	return shaped(CreatedInviteResponseSchema, {
-		...replacement,
-		acceptUrl,
-		delivery
-	}, 201);
-});
-
-export { POST };
-//# sourceMappingURL=_server.ts.js-BUTT4IFr.js.map

package/build/server/chunks/entries/endpoints/api/v1/orgs/_orgId_/invites/_id_/resend/_server.ts.js-BUTT4IFr.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"_server.ts.js-BUTT4IFr.js","sources":["../../../../../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/v1/orgs/_orgId_/invites/_id_/resend/_server.ts.js"],"sourcesContent":["import { d as getInviteStore } from \"../../../../../../../../../chunks/providers.server.js\";\nimport { C as requireManageOrgMembers, c as requireActingOrg } from \"../../../../../../../../../chunks/access.server.js\";\nimport { n as apiError, t as ApiErrorCode } from \"../../../../../../../../../chunks/api-errors.js\";\nimport { d as shaped, l as requireParams, t as apiRoute } from \"../../../../../../../../../chunks/http.js\";\nimport \"../../../../../../../../../chunks/route.js\";\nimport { t as CreatedInviteResponseSchema } from \"../../../../../../../../../chunks/responses.js\";\nimport { t as deliverInvite } from \"../../../../../../../../../chunks/deliver.server.js\";\nimport { n as mintRawToken, t as hashToken } from \"../../../../../../../../../chunks/token2.server.js\";\nimport { t as findPendingInviteInOrg } from \"../../../../../../../../../chunks/lookup.server.js\";\nimport { randomUUID } from \"node:crypto\";\n//#region src/routes/api/v1/orgs/[orgId]/invites/[id]/resend/+server.ts\nvar INVITE_TTL_MS = 6048e5;\n/**\n* Re-send an invite: mint a replacement and revoke the original.\n*\n* A resend cannot reuse the original link. The raw token is never stored — only\n* its HMAC digest is — so there is nothing to re-read, and rather than weaken\n* that, this issues a fresh token and revokes the row it replaces. The old link\n* stops working the moment this returns, which is also what an admin wants\n* after mailing an invite to the wrong address.\n*\n* Grants are copied verbatim from the original. The role and permission gates\n* ran when it was minted; re-deriving them here would let a since-demoted admin\n* silently change what the invite carries.\n*/\nvar POST = apiRoute(\"Failed to resend invite\", async ({ params, locals, url }) => {\n\trequireManageOrgMembers(locals);\n\tconst { ctx, orgId } = requireActingOrg(locals, params.orgId);\n\tconst { id } = requireParams(params, \"id\");\n\tconst existing = await findPendingInviteInOrg(ctx, orgId, id);\n\tif (!existing) apiError(404, ApiErrorCode.NOT_FOUND, \"Invite not found\");\n\tif (existing.acceptedAt) apiError(409, ApiErrorCode.CONFLICT, \"This invite has already been accepted.\");\n\tconst rawToken = mintRawToken();\n\tconst now = /* @__PURE__ */ new Date();\n\tconst replacement = {\n\t\t...existing,\n\t\tid: randomUUID(),\n\t\ttokenHash: hashToken(rawToken),\n\t\tcreatedAt: now.toISOString(),\n\t\texpiresAt: new Date(now.getTime() + INVITE_TTL_MS).toISOString()\n\t};\n\tawait getInviteStore().create(ctx, replacement);\n\tawait getInviteStore().revoke(ctx, existing.id);\n\tconst acceptUrl = `${url.origin}/accept-invite?token=${rawToken}`;\n\tconst delivery = await deliverInvite({\n\t\tctx,\n\t\tlog: locals.log,\n\t\tinvite: replacement,\n\t\tacceptUrl,\n\t\tactor: {\n\t\t\tprofile: locals.profile,\n\t\t\tuser: locals.user\n\t\t}\n\t});\n\treturn shaped(CreatedInviteResponseSchema, {\n\t\t...replacement,\n\t\tacceptUrl,\n\t\tdelivery\n\t}, 201);\n});\n//#endregion\nexport { POST };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAUA;AACA,IAAI,aAAa,GAAG,MAAM;AAC1B;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,IAAI,GAAG,QAAQ,CAAC,yBAAyB,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK;AAClF,CAAC,uBAAuB,CAAC,MAAM,CAAC;AAChC,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC;AAC9D,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC;AAC3C,CAAC,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC;AAC9D,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,kBAAkB,CAAC;AACzE,CAAC,IAAI,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,wCAAwC,CAAC;AACxG,CAAC,MAAM,QAAQ,GAAG,YAAY,EAAE;AAChC,CAAC,MAAM,GAAG,mBAAmB,IAAI,IAAI,EAAE;AACvC,CAAC,MAAM,WAAW,GAAG;AACrB,EAAE,GAAG,QAAQ;AACb,EAAE,EAAE,EAAE,UAAU,EAAE;AAClB,EAAE,SAAS,EAAE,SAAS,CAAC,QAAQ,CAAC;AAChC,EAAE,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;AAC9B,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,aAAa,CAAC,CAAC,WAAW;AAChE,EAAE;AACF,CAAC,MAAM,cAAc,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC;AAChD,CAAC,MAAM,cAAc,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,CAAC;AAChD,CAAC,MAAM,SAAS,GAAG,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,qBAAqB,EAAE,QAAQ,CAAC,CAAC;AAClE,CAAC,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC;AACtC,EAAE,GAAG;AACL,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG;AACjB,EAAE,MAAM,EAAE,WAAW;AACrB,EAAE,SAAS;AACX,EAAE,KAAK,EAAE;AACT,GAAG,OAAO,EAAE,MAAM,CAAC,OAAO;AAC1B,GAAG,IAAI,EAAE,MAAM,CAAC;AAChB;AACA,EAAE,CAAC;AACH,CAAC,OAAO,MAAM,CAAC,2BAA2B,EAAE;AAC5C,EAAE,GAAG,WAAW;AAChB,EAAE,SAAS;AACX,EAAE;AACF,EAAE,EAAE,GAAG,CAAC;AACR,CAAC;;;;"}

package/build/server/chunks/entries/endpoints/api/v1/orgs/_orgId_/invites/_server.ts.js-DL4g83OR.js

@@ -1,91 +0,0 @@
-import { A as ALL_PLATFORM_PERMISSIONS, e as ALL_ORG_PERMISSIONS, M as MEMBER_ASSIGNABLE_PERMISSIONS, D as DEFAULT_ORG_PERMISSIONS } from '../../../../../../../chunks/src.js-B12bUNyu.js';
-import { u as getInviteStore } from '../../../../../../../chunks/providers.server.js-n7DF9bkc.js';
-import { u as requireManageOrgMembers, t as requireActingOrg, l as assertCanGrantPlatformPermissions, w as canActorChangeOrgRole } from '../../../../../../../chunks/access.server.js-BUiuIuUH.js';
-import { a as apiError, A as ApiErrorCode } from '../../../../../../../chunks/api-errors.js-ZUI_rSV_.js';
-import { a as apiRoute, s as shapedCollection, p as parseBody, h as shaped } from '../../../../../../../chunks/http.js-DTur24v9.js';
-import { a as parseListOptions } from '../../../../../../../chunks/pagination.server.js-CtQ_3Is9.js';
-import { I as InviteResponseSchema, a as CreatedInviteResponseSchema } from '../../../../../../../chunks/responses.js-C3TpfP9h.js';
-import { c as CreateInviteBodySchema } from '../../../../../../../chunks/bodies.js-C9rGU8lD.js';
-import { d as deliverInvite } from '../../../../../../../chunks/deliver.server.js-BnV24wUm.js';
-import { m as mintRawToken, h as hashToken } from '../../../../../../../chunks/token2.server.js-Y-zJuZS5.js';
-import { randomUUID } from 'node:crypto';
-import 'zod';
-import '../../../../../../../chunks/shared-server.js-BZy9KN6u.js';
-import '../../../../../../../chunks/schema.js-BVfByvmD.js';
-import '../../../../../../../chunks/core-BQtRL5GE.js-B9MmO4om.js';
-import 'node:url';
-import 'node:path';
-import 'node:fs';
-import 'node:fs/promises';
-import '@supabase/supabase-js';
-import '@sveltejs/kit';
-import '../../../../../../../chunks/email.js-CfmiUBKY.js';
-import '../../../../../../../chunks/token-codec.js-CxK2DiO-.js';
-
-//#region src/lib/server/permissions-scope.server.ts
-var PLATFORM_SET = new Set(ALL_PLATFORM_PERMISSIONS);
-var ORG_SET = new Set(ALL_ORG_PERMISSIONS);
-/** Split a flat array into platform + org scope buckets, dropping unknowns. */
-function splitFlatPermissions(flat) {
-	const platform = [];
-	const org = [];
-	for (const p of flat) if (PLATFORM_SET.has(p)) platform.push(p);
-	else if (ORG_SET.has(p)) org.push(p);
-	return {
-		platform,
-		org
-	};
-}
-//#endregion
-//#region src/routes/api/v1/orgs/[orgId]/invites/+server.ts
-var INVITE_TTL_MS = 6048e5;
-/** Pending and recently accepted invites for the acting org. */
-var GET = apiRoute("Failed to list invites", async ({ params, locals, url }) => {
-	requireManageOrgMembers(locals);
-	const { ctx, orgId } = requireActingOrg(locals, params.orgId);
-	return shapedCollection(InviteResponseSchema, await getInviteStore().listByOrg(ctx, orgId, parseListOptions(url)));
-});
-/** Create an invite and return the accept URL. */
-var POST = apiRoute("Failed to create invite", async ({ params, request, locals, url }) => {
-	requireManageOrgMembers(locals);
-	const { ctx, orgId } = requireActingOrg(locals, params.orgId);
-	const input = await parseBody(request, CreateInviteBodySchema);
-	const { platform: submittedPlatformPerms, org: submittedOrgPerms } = splitFlatPermissions(input.permissions);
-	assertCanGrantPlatformPermissions(ctx, submittedPlatformPerms);
-	if (!await canActorChangeOrgRole(ctx, orgId, input.orgRole)) apiError(403, ApiErrorCode.FORBIDDEN, "Only the org owner can invite someone as owner or admin.");
-	const orgPermissions = input.orgRole === "member" ? submittedOrgPerms.filter((p) => MEMBER_ASSIGNABLE_PERMISSIONS.includes(p)) : [...DEFAULT_ORG_PERMISSIONS[input.orgRole]];
-	const rawToken = mintRawToken();
-	const now = /* @__PURE__ */ new Date();
-	const invite = {
-		id: randomUUID(),
-		tokenHash: hashToken(rawToken),
-		email: input.email,
-		orgId,
-		orgRole: input.orgRole,
-		orgPermissions,
-		platformPermissions: submittedPlatformPerms,
-		invitedBy: locals.user.id,
-		createdAt: now.toISOString(),
-		expiresAt: new Date(now.getTime() + INVITE_TTL_MS).toISOString()
-	};
-	await getInviteStore().create(ctx, invite);
-	const acceptUrl = `${url.origin}/accept-invite?token=${rawToken}`;
-	const delivery = await deliverInvite({
-		ctx,
-		log: locals.log,
-		invite,
-		acceptUrl,
-		actor: {
-			profile: locals.profile,
-			user: locals.user
-		}
-	});
-	return shaped(CreatedInviteResponseSchema, {
-		...invite,
-		acceptUrl,
-		delivery
-	}, 201);
-});
-
-export { GET, POST };
-//# sourceMappingURL=_server.ts.js-DL4g83OR.js.map

package/build/server/chunks/entries/endpoints/api/v1/orgs/_orgId_/invites/_server.ts.js-DL4g83OR.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"_server.ts.js-DL4g83OR.js","sources":["../../../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/v1/orgs/_orgId_/invites/_server.ts.js"],"sourcesContent":["import { O as ALL_PLATFORM_PERMISSIONS, b as DEFAULT_ORG_PERMISSIONS, v as ALL_ORG_PERMISSIONS, x as MEMBER_ASSIGNABLE_PERMISSIONS } from \"../../../../../../../chunks/src.js\";\nimport { d as getInviteStore } from \"../../../../../../../chunks/providers.server.js\";\nimport { C as requireManageOrgMembers, c as requireActingOrg, n as assertCanGrantPlatformPermissions, o as canActorChangeOrgRole } from \"../../../../../../../chunks/access.server.js\";\nimport { n as apiError, t as ApiErrorCode } from \"../../../../../../../chunks/api-errors.js\";\nimport { d as shaped, f as shapedCollection, o as parseBody, t as apiRoute } from \"../../../../../../../chunks/http.js\";\nimport { n as parseListOptions } from \"../../../../../../../chunks/pagination.server.js\";\nimport \"../../../../../../../chunks/route.js\";\nimport { r as InviteResponseSchema, t as CreatedInviteResponseSchema } from \"../../../../../../../chunks/responses.js\";\nimport { n as CreateInviteBodySchema } from \"../../../../../../../chunks/bodies.js\";\nimport { t as deliverInvite } from \"../../../../../../../chunks/deliver.server.js\";\nimport { n as mintRawToken, t as hashToken } from \"../../../../../../../chunks/token2.server.js\";\nimport { randomUUID } from \"node:crypto\";\n//#region src/lib/server/permissions-scope.server.ts\nvar PLATFORM_SET = new Set(ALL_PLATFORM_PERMISSIONS);\nvar ORG_SET = new Set(ALL_ORG_PERMISSIONS);\n/** Split a flat array into platform + org scope buckets, dropping unknowns. */\nfunction splitFlatPermissions(flat) {\n\tconst platform = [];\n\tconst org = [];\n\tfor (const p of flat) if (PLATFORM_SET.has(p)) platform.push(p);\n\telse if (ORG_SET.has(p)) org.push(p);\n\treturn {\n\t\tplatform,\n\t\torg\n\t};\n}\n//#endregion\n//#region src/routes/api/v1/orgs/[orgId]/invites/+server.ts\nvar INVITE_TTL_MS = 6048e5;\n/** Pending and recently accepted invites for the acting org. */\nvar GET = apiRoute(\"Failed to list invites\", async ({ params, locals, url }) => {\n\trequireManageOrgMembers(locals);\n\tconst { ctx, orgId } = requireActingOrg(locals, params.orgId);\n\treturn shapedCollection(InviteResponseSchema, await getInviteStore().listByOrg(ctx, orgId, parseListOptions(url)));\n});\n/** Create an invite and return the accept URL. */\nvar POST = apiRoute(\"Failed to create invite\", async ({ params, request, locals, url }) => {\n\trequireManageOrgMembers(locals);\n\tconst { ctx, orgId } = requireActingOrg(locals, params.orgId);\n\tconst input = await parseBody(request, CreateInviteBodySchema);\n\tconst { platform: submittedPlatformPerms, org: submittedOrgPerms } = splitFlatPermissions(input.permissions);\n\tassertCanGrantPlatformPermissions(ctx, submittedPlatformPerms);\n\tif (!await canActorChangeOrgRole(ctx, orgId, input.orgRole)) apiError(403, ApiErrorCode.FORBIDDEN, \"Only the org owner can invite someone as owner or admin.\");\n\tconst orgPermissions = input.orgRole === \"member\" ? submittedOrgPerms.filter((p) => MEMBER_ASSIGNABLE_PERMISSIONS.includes(p)) : [...DEFAULT_ORG_PERMISSIONS[input.orgRole]];\n\tconst rawToken = mintRawToken();\n\tconst now = /* @__PURE__ */ new Date();\n\tconst invite = {\n\t\tid: randomUUID(),\n\t\ttokenHash: hashToken(rawToken),\n\t\temail: input.email,\n\t\torgId,\n\t\torgRole: input.orgRole,\n\t\torgPermissions,\n\t\tplatformPermissions: submittedPlatformPerms,\n\t\tinvitedBy: locals.user.id,\n\t\tcreatedAt: now.toISOString(),\n\t\texpiresAt: new Date(now.getTime() + INVITE_TTL_MS).toISOString()\n\t};\n\tawait getInviteStore().create(ctx, invite);\n\tconst acceptUrl = `${url.origin}/accept-invite?token=${rawToken}`;\n\tconst delivery = await deliverInvite({\n\t\tctx,\n\t\tlog: locals.log,\n\t\tinvite,\n\t\tacceptUrl,\n\t\tactor: {\n\t\t\tprofile: locals.profile,\n\t\t\tuser: locals.user\n\t\t}\n\t});\n\treturn shaped(CreatedInviteResponseSchema, {\n\t\t...invite,\n\t\tacceptUrl,\n\t\tdelivery\n\t}, 201);\n});\n//#endregion\nexport { GET, POST };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAYA;AACA,IAAI,YAAY,GAAG,IAAI,GAAG,CAAC,wBAAwB,CAAC;AACpD,IAAI,OAAO,GAAG,IAAI,GAAG,CAAC,mBAAmB,CAAC;AAC1C;AACA,SAAS,oBAAoB,CAAC,IAAI,EAAE;AACpC,CAAC,MAAM,QAAQ,GAAG,EAAE;AACpB,CAAC,MAAM,GAAG,GAAG,EAAE;AACf,CAAC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,IAAI,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AAChE,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AACrC,CAAC,OAAO;AACR,EAAE,QAAQ;AACV,EAAE;AACF,EAAE;AACF;AACA;AACA;AACA,IAAI,aAAa,GAAG,MAAM;AAC1B;AACG,IAAC,GAAG,GAAG,QAAQ,CAAC,wBAAwB,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK;AAChF,CAAC,uBAAuB,CAAC,MAAM,CAAC;AAChC,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC;AAC9D,CAAC,OAAO,gBAAgB,CAAC,oBAAoB,EAAE,MAAM,cAAc,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;AACnH,CAAC;AACD;AACG,IAAC,IAAI,GAAG,QAAQ,CAAC,yBAAyB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK;AAC3F,CAAC,uBAAuB,CAAC,MAAM,CAAC;AAChC,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC;AAC9D,CAAC,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,sBAAsB,CAAC;AAC/D,CAAC,MAAM,EAAE,QAAQ,EAAE,sBAAsB,EAAE,GAAG,EAAE,iBAAiB,EAAE,GAAG,oBAAoB,CAAC,KAAK,CAAC,WAAW,CAAC;AAC7G,CAAC,iCAAiC,CAAC,GAAG,EAAE,sBAAsB,CAAC;AAC/D,CAAC,IAAI,CAAC,MAAM,qBAAqB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,0DAA0D,CAAC;AAC/J,CAAC,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,KAAK,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,6BAA6B,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,uBAAuB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AAC7K,CAAC,MAAM,QAAQ,GAAG,YAAY,EAAE;AAChC,CAAC,MAAM,GAAG,mBAAmB,IAAI,IAAI,EAAE;AACvC,CAAC,MAAM,MAAM,GAAG;AAChB,EAAE,EAAE,EAAE,UAAU,EAAE;AAClB,EAAE,SAAS,EAAE,SAAS,CAAC,QAAQ,CAAC;AAChC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK;AACpB,EAAE,KAAK;AACP,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO;AACxB,EAAE,cAAc;AAChB,EAAE,mBAAmB,EAAE,sBAAsB;AAC7C,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;AAC3B,EAAE,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;AAC9B,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,aAAa,CAAC,CAAC,WAAW;AAChE,EAAE;AACF,CAAC,MAAM,cAAc,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC;AAC3C,CAAC,MAAM,SAAS,GAAG,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,qBAAqB,EAAE,QAAQ,CAAC,CAAC;AAClE,CAAC,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC;AACtC,EAAE,GAAG;AACL,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG;AACjB,EAAE,MAAM;AACR,EAAE,SAAS;AACX,EAAE,KAAK,EAAE;AACT,GAAG,OAAO,EAAE,MAAM,CAAC,OAAO;AAC1B,GAAG,IAAI,EAAE,MAAM,CAAC;AAChB;AACA,EAAE,CAAC;AACH,CAAC,OAAO,MAAM,CAAC,2BAA2B,EAAE;AAC5C,EAAE,GAAG,MAAM;AACX,EAAE,SAAS;AACX,EAAE;AACF,EAAE,EAAE,GAAG,CAAC;AACR,CAAC;;;;"}

package/build/server/chunks/entries/endpoints/api/v1/orgs/_orgId_/members/_server.ts.js-DlkUGz-2.js

@@ -1,31 +0,0 @@
-import { e as getOrganizationProvider } from '../../../../../../../chunks/providers.server.js-n7DF9bkc.js';
-import { t as requireActingOrg } from '../../../../../../../chunks/access.server.js-BUiuIuUH.js';
-import { a as apiRoute, d as collection } from '../../../../../../../chunks/http.js-DTur24v9.js';
-import { a as parseListOptions } from '../../../../../../../chunks/pagination.server.js-CtQ_3Is9.js';
-import '../../../../../../../chunks/shared-server.js-BZy9KN6u.js';
-import '../../../../../../../chunks/src.js-B12bUNyu.js';
-import 'zod';
-import '../../../../../../../chunks/schema.js-BVfByvmD.js';
-import '../../../../../../../chunks/core-BQtRL5GE.js-B9MmO4om.js';
-import 'node:crypto';
-import 'node:url';
-import 'node:path';
-import 'node:fs';
-import 'node:fs/promises';
-import '@supabase/supabase-js';
-import '../../../../../../../chunks/api-errors.js-ZUI_rSV_.js';
-import '@sveltejs/kit';
-
-//#region src/routes/api/v1/orgs/[orgId]/members/+server.ts
-/**
-* List the org's members. Any member of the acting org may read this — the
-* roster is what the team page renders, and `requireActingOrg` already confines
-* the read to the caller's own tenant.
-*/
-var GET = apiRoute("Failed to list organization members", async ({ params, locals, url }) => {
-	const { ctx, orgId } = requireActingOrg(locals, params.orgId);
-	return collection(await getOrganizationProvider().listOrgMembers(ctx, orgId, parseListOptions(url)));
-});
-
-export { GET };
-//# sourceMappingURL=_server.ts.js-DlkUGz-2.js.map

package/build/server/chunks/entries/endpoints/api/v1/orgs/_orgId_/members/_server.ts.js-DlkUGz-2.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"_server.ts.js-DlkUGz-2.js","sources":["../../../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/v1/orgs/_orgId_/members/_server.ts.js"],"sourcesContent":["import { m as getOrganizationProvider } from \"../../../../../../../chunks/providers.server.js\";\nimport { c as requireActingOrg } from \"../../../../../../../chunks/access.server.js\";\nimport { n as collection, t as apiRoute } from \"../../../../../../../chunks/http.js\";\nimport { n as parseListOptions } from \"../../../../../../../chunks/pagination.server.js\";\nimport \"../../../../../../../chunks/route.js\";\n//#region src/routes/api/v1/orgs/[orgId]/members/+server.ts\n/**\n* List the org's members. Any member of the acting org may read this — the\n* roster is what the team page renders, and `requireActingOrg` already confines\n* the read to the caller's own tenant.\n*/\nvar GET = apiRoute(\"Failed to list organization members\", async ({ params, locals, url }) => {\n\tconst { ctx, orgId } = requireActingOrg(locals, params.orgId);\n\treturn collection(await getOrganizationProvider().listOrgMembers(ctx, orgId, parseListOptions(url)));\n});\n//#endregion\nexport { GET };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAKA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,GAAG,GAAG,QAAQ,CAAC,qCAAqC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK;AAC7F,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC;AAC9D,CAAC,OAAO,UAAU,CAAC,MAAM,uBAAuB,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;AACrG,CAAC;;;;"}

package/build/server/chunks/entries/endpoints/api/v1/orgs/_orgId_/members/_userId_/_server.ts.js-D3JIdkt3.js

@@ -1,172 +0,0 @@
-import { M as MEMBER_ASSIGNABLE_PERMISSIONS, e as ALL_ORG_PERMISSIONS } from '../../../../../../../../chunks/src.js-B12bUNyu.js';
-import { e as getOrganizationProvider, j as getEventSink, t as actorFrom, g as getLogger, a as getAuthProvider, u as getInviteStore, f as getProjectProvider } from '../../../../../../../../chunks/providers.server.js-n7DF9bkc.js';
-import { u as requireManageOrgMembers, t as requireActingOrg, x as canChangeOrgRole } from '../../../../../../../../chunks/access.server.js-BUiuIuUH.js';
-import { a as apiError, A as ApiErrorCode } from '../../../../../../../../chunks/api-errors.js-ZUI_rSV_.js';
-import { a as apiRoute, r as requireParams, p as parseBody, n as noContent } from '../../../../../../../../chunks/http.js-DTur24v9.js';
-import { b as UpdateOrgMemberBodySchema } from '../../../../../../../../chunks/bodies.js-C9rGU8lD.js';
-import 'zod';
-import '../../../../../../../../chunks/shared-server.js-BZy9KN6u.js';
-import '../../../../../../../../chunks/schema.js-BVfByvmD.js';
-import '../../../../../../../../chunks/core-BQtRL5GE.js-B9MmO4om.js';
-import 'node:crypto';
-import 'node:url';
-import 'node:path';
-import 'node:fs';
-import 'node:fs/promises';
-import '@supabase/supabase-js';
-import '@sveltejs/kit';
-
-//#region src/routes/api/v1/orgs/[orgId]/members/[userId]/+server.ts
-/**
-* PATCH /api/orgs/[orgId]/members/[userId]
-*
-* Body accepts either or both:
-*   - `{ role: OrgRole }` — change the member's role. **Owner-only** per §3.
-*   - `{ permissions: OrgPermission[] }` — replace the member's grantable
-*     permissions. Owner/admin via `manage_org_members`. For `member`-role
-*     targets, only `MEMBER_ASSIGNABLE_PERMISSIONS` are accepted; promoting a
-*     member's permissions does NOT change their role (that's a separate
-*     branch, owner-only).
-*
-* Tenancy: the URL `orgId` must equal `ctx.actingOrgId`. Cross-org member
-* mutation is blocked even if the actor holds permissions in another org.
-*
-* Self-protection (sole-owner invariant, §10 spirit): the only owner of an
-* org cannot be demoted. Demoting yourself while you are the sole owner is
-* the most common way to discover this — handler returns 409.
-*/
-var ROSTER_PAGE_LIMIT = 200;
-var MAX_ROSTER_PAGES = 100;
-/**
-* Whether anyone other than `exceptUserId` still owns the org.
-*
-* Both branches below need this and both used to scan the roster themselves —
-* the sole-owner invariant is one rule, so it reads from one place.
-*
-* Pages rather than reading one 200-row window: a second owner sitting past the
-* first page read as "no other owner", so the invariant refused a demotion or
-* removal that was in fact safe. That failed closed, but it made the org
-* unadministrable exactly when it had grown enough to need administering.
-* Returns on the first owner found, so the common case is still one round-trip.
-*/
-async function hasAnotherOwner(ctx, orgId, exceptUserId) {
-	const orgs = getOrganizationProvider();
-	let cursor;
-	for (let page = 0; page < MAX_ROSTER_PAGES; page++) {
-		const result = await orgs.listOrgMembers(ctx, orgId, {
-			limit: ROSTER_PAGE_LIMIT,
-			cursor
-		});
-		if (result.items.some((m) => m.role === "owner" && m.userId !== exceptUserId && !m.deletedAt)) return true;
-		cursor = result.nextCursor;
-		if (!cursor) return false;
-	}
-	getLogger().warn("hasAnotherOwner hit the page cap — treating as sole owner", {
-		orgId,
-		pages: MAX_ROSTER_PAGES
-	});
-	return false;
-}
-/**
-* Projects in `orgId` where `userId` is the only live owner — the ones that
-* will have no owner once `removeOrgMember` cascades their membership rows.
-*
-* **Decided (2026-08-17): report, do not block.** §10 said removal should be
-* blocked until a new owner is assigned, and that rule is being retired rather
-* than implemented. Blocking puts an unbounded chore in front of offboarding —
-* the cost scales with how many projects the departing person owned, which is
-* backwards, because the most prolific people are the ones whose departure most
-* needs to be clean. An offboarding that fails halfway is worse than an
-* ownerless project: the person stays in the org while someone works through
-* the backlog. Reclaim (§5) already exists to adopt an ownerless project, so
-* the recovery path is built; what was missing was any signal that recovery was
-* needed. Hence the event.
-*
-* MUST be called before the removal — afterwards the rows it reads are gone.
-*/
-async function findProjectsLosingSoleOwner(ctx, orgId, userId) {
-	const projects = getProjectProvider();
-	const orgProjects = await projects.listProjects(ctx, orgId, { limit: ROSTER_PAGE_LIMIT });
-	return (await Promise.all(orgProjects.items.map(async (project) => {
-		const owners = (await projects.listProjectMembers(ctx, project.id, { limit: ROSTER_PAGE_LIMIT })).items.filter((m) => m.role === "owner" && !m.deletedAt);
-		return owners.length === 1 && owners[0].userId === userId ? project : null;
-	}))).filter((p) => p !== null);
-}
-var PATCH = apiRoute("Failed to update member", async ({ params, request, locals }) => {
-	const { userId } = requireParams(params, "orgId", "userId");
-	requireManageOrgMembers(locals);
-	const { ctx, orgId } = requireActingOrg(locals, params.orgId);
-	const patch = await parseBody(request, UpdateOrgMemberBodySchema);
-	const orgs = getOrganizationProvider();
-	const [actorMember, target] = await Promise.all([orgs.getOrgMember(ctx, orgId, ctx.userId), orgs.getOrgMember(ctx, orgId, userId)]);
-	if (!target) apiError(404, ApiErrorCode.NOT_FOUND, "Member not found in this organization.");
-	if (!actorMember) apiError(403, ApiErrorCode.FORBIDDEN, "You are not a member of this organization.");
-	if (patch.role !== void 0 && patch.role !== target.role) {
-		if (!canChangeOrgRole({
-			actorMember,
-			role: patch.role
-		}) || !canChangeOrgRole({
-			actorMember,
-			role: target.role
-		})) apiError(403, ApiErrorCode.FORBIDDEN, "Only the org owner can change roles.");
-		if (target.role === "owner" && patch.role !== "owner" && !await hasAnotherOwner(ctx, orgId, target.userId)) apiError(409, ApiErrorCode.CONFLICT, "Cannot demote the sole owner of this organization. Promote another member to owner first.");
-		await orgs.updateOrgMemberRole(ctx, orgId, userId, patch.role);
-	}
-	if (patch.permissions !== void 0) {
-		const effectiveRole = patch.role ?? target.role;
-		const valid = effectiveRole === "member" ? new Set(MEMBER_ASSIGNABLE_PERMISSIONS) : new Set(ALL_ORG_PERMISSIONS);
-		const invalid = patch.permissions.filter((p) => !valid.has(p));
-		if (invalid.length > 0) apiError(400, ApiErrorCode.VALIDATION_FAILED, `Permissions [${invalid.join(", ")}] cannot be assigned to a ${effectiveRole}.`);
-		await orgs.updateOrgMemberPermissions(ctx, orgId, userId, patch.permissions);
-	}
-	return noContent();
-});
-/**
-* Remove a member from the org. Owner/admin via `manage_org_members`, same
-* tenancy check as PATCH, and the same sole-owner invariant — removing the last
-* owner would leave the org unadministrable.
-*/
-var DELETE = apiRoute("Failed to remove member", async ({ params, locals }) => {
-	const { userId } = requireParams(params, "orgId", "userId");
-	requireManageOrgMembers(locals);
-	const { ctx, orgId } = requireActingOrg(locals, params.orgId);
-	const orgs = getOrganizationProvider();
-	const [actorMember, target] = await Promise.all([orgs.getOrgMember(ctx, orgId, ctx.userId), orgs.getOrgMember(ctx, orgId, userId)]);
-	if (!target) apiError(404, ApiErrorCode.NOT_FOUND, "Member not found in this organization.");
-	if (!canChangeOrgRole({
-		actorMember,
-		role: target.role
-	})) apiError(403, ApiErrorCode.FORBIDDEN, "Only the org owner can remove another owner.");
-	if (target.role === "owner" && !await hasAnotherOwner(ctx, orgId, target.userId)) apiError(409, ApiErrorCode.CONFLICT, "Cannot remove the sole owner of this organization. Promote another member to owner first.");
-	const orphaned = await findProjectsLosingSoleOwner(ctx, orgId, userId);
-	await orgs.removeOrgMember(ctx, orgId, userId);
-	if (orphaned.length > 0) {
-		await getEventSink().emit({
-			type: "org_member.removed_orphaning_projects",
-			orgId,
-			userId,
-			projectIds: orphaned.map((p) => p.id),
-			actorId: actorFrom(ctx)
-		});
-		getLogger().warn("Org member removal left projects without an owner", {
-			orgId,
-			userId,
-			actorId: ctx.userId,
-			projectCount: orphaned.length
-		});
-	}
-	const email = (await getAuthProvider().getUser(userId))?.email;
-	if (email) try {
-		await getInviteStore().revokePendingByEmail(ctx, orgId, email);
-	} catch (err) {
-		getLogger().error("Removed org member but failed to revoke their pending invites", {
-			orgId,
-			userId,
-			error: err instanceof Error ? err.message : String(err)
-		});
-	}
-	return noContent();
-});
-
-export { DELETE, PATCH };
-//# sourceMappingURL=_server.ts.js-D3JIdkt3.js.map

package/build/server/chunks/entries/endpoints/api/v1/orgs/_orgId_/members/_userId_/_server.ts.js-D3JIdkt3.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"_server.ts.js-D3JIdkt3.js","sources":["../../../../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/v1/orgs/_orgId_/members/_userId_/_server.ts.js"],"sourcesContent":["import { v as ALL_ORG_PERMISSIONS, x as MEMBER_ASSIGNABLE_PERMISSIONS } from \"../../../../../../../../chunks/src.js\";\nimport { L as actorFrom, _ as getProjectProvider, d as getInviteStore, f as getLogger, m as getOrganizationProvider, r as getAuthProvider, u as getEventSink } from \"../../../../../../../../chunks/providers.server.js\";\nimport { C as requireManageOrgMembers, E as canChangeOrgRole, c as requireActingOrg } from \"../../../../../../../../chunks/access.server.js\";\nimport { n as apiError, t as ApiErrorCode } from \"../../../../../../../../chunks/api-errors.js\";\nimport { a as noContent, l as requireParams, o as parseBody, t as apiRoute } from \"../../../../../../../../chunks/http.js\";\nimport \"../../../../../../../../chunks/route.js\";\nimport { o as UpdateOrgMemberBodySchema } from \"../../../../../../../../chunks/bodies.js\";\n//#region src/routes/api/v1/orgs/[orgId]/members/[userId]/+server.ts\n/**\n* PATCH /api/orgs/[orgId]/members/[userId]\n*\n* Body accepts either or both:\n*   - `{ role: OrgRole }` — change the member's role. **Owner-only** per §3.\n*   - `{ permissions: OrgPermission[] }` — replace the member's grantable\n*     permissions. Owner/admin via `manage_org_members`. For `member`-role\n*     targets, only `MEMBER_ASSIGNABLE_PERMISSIONS` are accepted; promoting a\n*     member's permissions does NOT change their role (that's a separate\n*     branch, owner-only).\n*\n* Tenancy: the URL `orgId` must equal `ctx.actingOrgId`. Cross-org member\n* mutation is blocked even if the actor holds permissions in another org.\n*\n* Self-protection (sole-owner invariant, §10 spirit): the only owner of an\n* org cannot be demoted. Demoting yourself while you are the sole owner is\n* the most common way to discover this — handler returns 409.\n*/\nvar ROSTER_PAGE_LIMIT = 200;\nvar MAX_ROSTER_PAGES = 100;\n/**\n* Whether anyone other than `exceptUserId` still owns the org.\n*\n* Both branches below need this and both used to scan the roster themselves —\n* the sole-owner invariant is one rule, so it reads from one place.\n*\n* Pages rather than reading one 200-row window: a second owner sitting past the\n* first page read as \"no other owner\", so the invariant refused a demotion or\n* removal that was in fact safe. That failed closed, but it made the org\n* unadministrable exactly when it had grown enough to need administering.\n* Returns on the first owner found, so the common case is still one round-trip.\n*/\nasync function hasAnotherOwner(ctx, orgId, exceptUserId) {\n\tconst orgs = getOrganizationProvider();\n\tlet cursor;\n\tfor (let page = 0; page < MAX_ROSTER_PAGES; page++) {\n\t\tconst result = await orgs.listOrgMembers(ctx, orgId, {\n\t\t\tlimit: ROSTER_PAGE_LIMIT,\n\t\t\tcursor\n\t\t});\n\t\tif (result.items.some((m) => m.role === \"owner\" && m.userId !== exceptUserId && !m.deletedAt)) return true;\n\t\tcursor = result.nextCursor;\n\t\tif (!cursor) return false;\n\t}\n\tgetLogger().warn(\"hasAnotherOwner hit the page cap — treating as sole owner\", {\n\t\torgId,\n\t\tpages: MAX_ROSTER_PAGES\n\t});\n\treturn false;\n}\n/**\n* Projects in `orgId` where `userId` is the only live owner — the ones that\n* will have no owner once `removeOrgMember` cascades their membership rows.\n*\n* **Decided (2026-08-17): report, do not block.** §10 said removal should be\n* blocked until a new owner is assigned, and that rule is being retired rather\n* than implemented. Blocking puts an unbounded chore in front of offboarding —\n* the cost scales with how many projects the departing person owned, which is\n* backwards, because the most prolific people are the ones whose departure most\n* needs to be clean. An offboarding that fails halfway is worse than an\n* ownerless project: the person stays in the org while someone works through\n* the backlog. Reclaim (§5) already exists to adopt an ownerless project, so\n* the recovery path is built; what was missing was any signal that recovery was\n* needed. Hence the event.\n*\n* MUST be called before the removal — afterwards the rows it reads are gone.\n*/\nasync function findProjectsLosingSoleOwner(ctx, orgId, userId) {\n\tconst projects = getProjectProvider();\n\tconst orgProjects = await projects.listProjects(ctx, orgId, { limit: ROSTER_PAGE_LIMIT });\n\treturn (await Promise.all(orgProjects.items.map(async (project) => {\n\t\tconst owners = (await projects.listProjectMembers(ctx, project.id, { limit: ROSTER_PAGE_LIMIT })).items.filter((m) => m.role === \"owner\" && !m.deletedAt);\n\t\treturn owners.length === 1 && owners[0].userId === userId ? project : null;\n\t}))).filter((p) => p !== null);\n}\nvar PATCH = apiRoute(\"Failed to update member\", async ({ params, request, locals }) => {\n\tconst { userId } = requireParams(params, \"orgId\", \"userId\");\n\trequireManageOrgMembers(locals);\n\tconst { ctx, orgId } = requireActingOrg(locals, params.orgId);\n\tconst patch = await parseBody(request, UpdateOrgMemberBodySchema);\n\tconst orgs = getOrganizationProvider();\n\tconst [actorMember, target] = await Promise.all([orgs.getOrgMember(ctx, orgId, ctx.userId), orgs.getOrgMember(ctx, orgId, userId)]);\n\tif (!target) apiError(404, ApiErrorCode.NOT_FOUND, \"Member not found in this organization.\");\n\tif (!actorMember) apiError(403, ApiErrorCode.FORBIDDEN, \"You are not a member of this organization.\");\n\tif (patch.role !== void 0 && patch.role !== target.role) {\n\t\tif (!canChangeOrgRole({\n\t\t\tactorMember,\n\t\t\trole: patch.role\n\t\t}) || !canChangeOrgRole({\n\t\t\tactorMember,\n\t\t\trole: target.role\n\t\t})) apiError(403, ApiErrorCode.FORBIDDEN, \"Only the org owner can change roles.\");\n\t\tif (target.role === \"owner\" && patch.role !== \"owner\" && !await hasAnotherOwner(ctx, orgId, target.userId)) apiError(409, ApiErrorCode.CONFLICT, \"Cannot demote the sole owner of this organization. Promote another member to owner first.\");\n\t\tawait orgs.updateOrgMemberRole(ctx, orgId, userId, patch.role);\n\t}\n\tif (patch.permissions !== void 0) {\n\t\tconst effectiveRole = patch.role ?? target.role;\n\t\tconst valid = effectiveRole === \"member\" ? new Set(MEMBER_ASSIGNABLE_PERMISSIONS) : new Set(ALL_ORG_PERMISSIONS);\n\t\tconst invalid = patch.permissions.filter((p) => !valid.has(p));\n\t\tif (invalid.length > 0) apiError(400, ApiErrorCode.VALIDATION_FAILED, `Permissions [${invalid.join(\", \")}] cannot be assigned to a ${effectiveRole}.`);\n\t\tawait orgs.updateOrgMemberPermissions(ctx, orgId, userId, patch.permissions);\n\t}\n\treturn noContent();\n});\n/**\n* Remove a member from the org. Owner/admin via `manage_org_members`, same\n* tenancy check as PATCH, and the same sole-owner invariant — removing the last\n* owner would leave the org unadministrable.\n*/\nvar DELETE = apiRoute(\"Failed to remove member\", async ({ params, locals }) => {\n\tconst { userId } = requireParams(params, \"orgId\", \"userId\");\n\trequireManageOrgMembers(locals);\n\tconst { ctx, orgId } = requireActingOrg(locals, params.orgId);\n\tconst orgs = getOrganizationProvider();\n\tconst [actorMember, target] = await Promise.all([orgs.getOrgMember(ctx, orgId, ctx.userId), orgs.getOrgMember(ctx, orgId, userId)]);\n\tif (!target) apiError(404, ApiErrorCode.NOT_FOUND, \"Member not found in this organization.\");\n\tif (!canChangeOrgRole({\n\t\tactorMember,\n\t\trole: target.role\n\t})) apiError(403, ApiErrorCode.FORBIDDEN, \"Only the org owner can remove another owner.\");\n\tif (target.role === \"owner\" && !await hasAnotherOwner(ctx, orgId, target.userId)) apiError(409, ApiErrorCode.CONFLICT, \"Cannot remove the sole owner of this organization. Promote another member to owner first.\");\n\tconst orphaned = await findProjectsLosingSoleOwner(ctx, orgId, userId);\n\tawait orgs.removeOrgMember(ctx, orgId, userId);\n\tif (orphaned.length > 0) {\n\t\tawait getEventSink().emit({\n\t\t\ttype: \"org_member.removed_orphaning_projects\",\n\t\t\torgId,\n\t\t\tuserId,\n\t\t\tprojectIds: orphaned.map((p) => p.id),\n\t\t\tactorId: actorFrom(ctx)\n\t\t});\n\t\tgetLogger().warn(\"Org member removal left projects without an owner\", {\n\t\t\torgId,\n\t\t\tuserId,\n\t\t\tactorId: ctx.userId,\n\t\t\tprojectCount: orphaned.length\n\t\t});\n\t}\n\tconst email = (await getAuthProvider().getUser(userId))?.email;\n\tif (email) try {\n\t\tawait getInviteStore().revokePendingByEmail(ctx, orgId, email);\n\t} catch (err) {\n\t\tgetLogger().error(\"Removed org member but failed to revoke their pending invites\", {\n\t\t\torgId,\n\t\t\tuserId,\n\t\t\terror: err instanceof Error ? err.message : String(err)\n\t\t});\n\t}\n\treturn noContent();\n});\n//#endregion\nexport { DELETE, PATCH };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAOA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,iBAAiB,GAAG,GAAG;AAC3B,IAAI,gBAAgB,GAAG,GAAG;AAC1B;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,eAAe,CAAC,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE;AACzD,CAAC,MAAM,IAAI,GAAG,uBAAuB,EAAE;AACvC,CAAC,IAAI,MAAM;AACX,CAAC,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,gBAAgB,EAAE,IAAI,EAAE,EAAE;AACrD,EAAE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,EAAE;AACvD,GAAG,KAAK,EAAE,iBAAiB;AAC3B,GAAG;AACH,GAAG,CAAC;AACJ,EAAE,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,MAAM,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,OAAO,IAAI;AAC5G,EAAE,MAAM,GAAG,MAAM,CAAC,UAAU;AAC5B,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,KAAK;AAC3B,CAAC;AACD,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,2DAA2D,EAAE;AAC/E,EAAE,KAAK;AACP,EAAE,KAAK,EAAE;AACT,EAAE,CAAC;AACH,CAAC,OAAO,KAAK;AACb;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,2BAA2B,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE;AAC/D,CAAC,MAAM,QAAQ,GAAG,kBAAkB,EAAE;AACtC,CAAC,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;AAC1F,CAAC,OAAO,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,OAAO,KAAK;AACpE,EAAE,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,kBAAkB,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3J,EAAE,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,GAAG,OAAO,GAAG,IAAI;AAC5E,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC;AAC/B;AACG,IAAC,KAAK,GAAG,QAAQ,CAAC,yBAAyB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK;AACvF,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC;AAC5D,CAAC,uBAAuB,CAAC,MAAM,CAAC;AAChC,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC;AAC9D,CAAC,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,yBAAyB,CAAC;AAClE,CAAC,MAAM,IAAI,GAAG,uBAAuB,EAAE;AACvC,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AACpI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,wCAAwC,CAAC;AAC7F,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,4CAA4C,CAAC;AACtG,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,EAAE;AAC1D,EAAE,IAAI,CAAC,gBAAgB,CAAC;AACxB,GAAG,WAAW;AACd,GAAG,IAAI,EAAE,KAAK,CAAC;AACf,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC;AAC1B,GAAG,WAAW;AACd,GAAG,IAAI,EAAE,MAAM,CAAC;AAChB,GAAG,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,sCAAsC,CAAC;AACnF,EAAE,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,MAAM,eAAe,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,2FAA2F,CAAC;AAC/O,EAAE,MAAM,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC;AAChE,CAAC;AACD,CAAC,IAAI,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,EAAE;AACnC,EAAE,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI;AACjD,EAAE,MAAM,KAAK,GAAG,aAAa,KAAK,QAAQ,GAAG,IAAI,GAAG,CAAC,6BAA6B,CAAC,GAAG,IAAI,GAAG,CAAC,mBAAmB,CAAC;AAClH,EAAE,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAChE,EAAE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,0BAA0B,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;AACxJ,EAAE,MAAM,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC;AAC9E,CAAC;AACD,CAAC,OAAO,SAAS,EAAE;AACnB,CAAC;AACD;AACA;AACA;AACA;AACA;AACG,IAAC,MAAM,GAAG,QAAQ,CAAC,yBAAyB,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK;AAC/E,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC;AAC5D,CAAC,uBAAuB,CAAC,MAAM,CAAC;AAChC,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC;AAC9D,CAAC,MAAM,IAAI,GAAG,uBAAuB,EAAE;AACvC,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AACpI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,wCAAwC,CAAC;AAC7F,CAAC,IAAI,CAAC,gBAAgB,CAAC;AACvB,EAAE,WAAW;AACb,EAAE,IAAI,EAAE,MAAM,CAAC;AACf,EAAE,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,8CAA8C,CAAC;AAC1F,CAAC,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,MAAM,eAAe,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,2FAA2F,CAAC;AACpN,CAAC,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC;AACvE,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC;AAC/C,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE;AAC1B,EAAE,MAAM,YAAY,EAAE,CAAC,IAAI,CAAC;AAC5B,GAAG,IAAI,EAAE,uCAAuC;AAChD,GAAG,KAAK;AACR,GAAG,MAAM;AACT,GAAG,UAAU,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;AACxC,GAAG,OAAO,EAAE,SAAS,CAAC,GAAG;AACzB,GAAG,CAAC;AACJ,EAAE,SAAS,EAAE,CAAC,IAAI,CAAC,mDAAmD,EAAE;AACxE,GAAG,KAAK;AACR,GAAG,MAAM;AACT,GAAG,OAAO,EAAE,GAAG,CAAC,MAAM;AACtB,GAAG,YAAY,EAAE,QAAQ,CAAC;AAC1B,GAAG,CAAC;AACJ,CAAC;AACD,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,eAAe,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,KAAK;AAC/D,CAAC,IAAI,KAAK,EAAE,IAAI;AAChB,EAAE,MAAM,cAAc,EAAE,CAAC,oBAAoB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC;AAChE,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,SAAS,EAAE,CAAC,KAAK,CAAC,+DAA+D,EAAE;AACrF,GAAG,KAAK;AACR,GAAG,MAAM;AACT,GAAG,KAAK,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG;AACzD,GAAG,CAAC;AACJ,CAAC;AACD,CAAC,OAAO,SAAS,EAAE;AACnB,CAAC;;;;"}