@selvajs/selva 4.20.0-beta.15 → 4.20.0-beta.16

package/build/server/chunks/chunks/handlers.js-Bal7QqCB.js

@@ -0,0 +1,1733 @@
+import { a as consentChoices, b as apiScopesFor } from './oauth.js-DS-eyMD8.js';
+import { f as apiError, e as ApiErrorCode, l as requireCanViewProject, g as isApiError, m as requireCanCreateDefinition, q as requireEditableDefinition, u as requireActingOrg, v as requireManageOrgMembers, w as requireManageOrgCompute, x as splitFlatPermissions, y as assertCanGrantPlatformPermissions, z as canActorChangeOrgRole, B as canChangeOrgRole, s as scopeAllows, c as canCreateDefinition, p as projectAccessInputFromRowsWith, C as requireCanCreateProject, o as outsideTokenOrg, a as canView, D as canSolve, E as canEdit, F as requireCanEditProjectSettings, G as withAdminBypass, H as requireCanManage, I as requireTargetIsOrgMember, J as checkOwnerRemoval, K as requireCanReclaim, L as canChangeVisibilityToPublic } from './access.js-BfMTTCTH.js';
+import { p as parseApiScope, d as describeApiScope, f as formatApiScope } from './types.js-g5F0W_ER.js';
+import { h as hasPermission, S as SYSTEM_CONTEXT } from './context.js-DgF3EFGQ.js';
+import { a as isOrgServer, i as isPlatformServer, c as serversVisibleTo } from './utils2.js-j8wahBau.js';
+import { D as DefinitionChannelSchema, t as toSourceDocumentId, C as CreateDefinitionInputSchema, U as UpdateMetadataInputSchema, G as GuidSchema, P as PublishVersionInputSchema, n as actorOf } from './providers.server.js-NBgteuX7.js';
+import { C as COVER_IMAGE_CONTENT_TYPES, t as toDefinitionListItem, G as GH_EXTENSIONS } from './types2.js-ZWmoZn1t.js';
+import { c as OrgAssetKindSchema, M as MEMBER_ASSIGNABLE_PERMISSIONS, D as DEFAULT_ORG_PERMISSIONS, s as slugify, A as ALL_ORG_PERMISSIONS } from './schemas.js-CEHDw4oF.js';
+import { r as requireCaller, s as scopeRefusalsToday, e as readForm, f as requireUpload, g as formText, t as throwZodError, p as parseParam, h as parseBody, i as assertScope, j as ShareLinkResponseSchema, k as CreatedShareLinkResponseSchema, l as requireParams, m as OrgComputeResponseSchema, O as OrgComputePatchBodySchema, I as InviteResponseSchema, c as CreateInviteBodySchema, n as CreatedInviteResponseSchema, b as UpdateOrgMemberBodySchema, o as ApiTokenResponseSchema, d as CreateApiTokenBodySchema, q as CreatedApiTokenResponseSchema, C as CreateProjectBodySchema, v as validateProjectFlags, U as UpdateProjectBodySchema, A as AddProjectMemberBodySchema, a as UpdateProjectMemberBodySchema } from './api.js-Chw-vSDJ.js';
+import { D as DEFAULT_SHARE_LINK_MAX_SOLVES } from './types4.js-C7gj_Qvn.js';
+import { f as fetchSchemaFromCompute } from './schema-extraction.js-CDuq9Z4H.js';
+import { r as resolveServerForOrg } from './resolve-server.js-DDfDV9cI.js';
+import { v as validateIncomingServers, a as assertStoredKeysReadable, s as storedKeysById, r as resolveApiKey, e as evictChangedServers } from './server-config-write.js-C5u4cxJl.js';
+import { l as listEditableDefinitionsByDocument, a as listVisibleDefinitions, r as resolveAccessibleProjects, b as loadVisibleDefinition, m as mayUploadToDefinition, g as getVisibleDefinition, d as loadVisibleVersion } from './visibility.js-D_48QE1C.js';
+import { c as canHoldApiTokens } from './tokens.js-CwDDHAj0.js';
+import { d as deleteProjectWithBlobs } from './delete-with-blobs.js-BZ_YRCWH.js';
+import { c as createProjectWithUniqueSlug } from './create-project.js-C4Bp9O0w.js';
+import { b as buildRequestContext } from './request-context.js-IxX3HuOZ.js';
+import { randomUUID } from 'node:crypto';
+import { z } from 'zod';
+
+// ../platform/src/shareLinks/schemas.ts
+/**
+* HTTP body for `POST /api/definitions/[guid]/share-links`. The route returns
+* the raw token exactly once.
+*/
+var CreateShareLinkInputSchema = z.object({
+	channel: DefinitionChannelSchema.default("live"),
+	name: z.string().max(128).optional(),
+	allowSolve: z.boolean().default(true),
+	/**
+	* Null is the minter's deliberate "uncap" choice. Omitted stays undefined here:
+	* the mint handler applies `DEFAULT_SHARE_LINK_MAX_SOLVES`.
+	*/
+	maxSolves: z.number().int().min(1).nullable().optional(),
+	expiresAt: z.iso.datetime().nullable().optional()
+});
+// ../server/src/api/responses.ts
+/** A paginated collection. The one envelope every list endpoint returns. */
+function collection(page) {
+	return { body: {
+		items: page.items,
+		nextCursor: page.nextCursor
+	} };
+}
+/** A created resource. */
+function created(body) {
+	return {
+		status: 201,
+		body
+	};
+}
+/** A successful mutation with nothing to say. */
+function noContent() {
+	return { status: 204 };
+}
+// ../server/src/api/shaped.ts
+/** Serialize a payload through an explicit response schema. */
+function shaped(schema, payload, status = 200) {
+	return {
+		status,
+		body: schema.parse(payload)
+	};
+}
+/** `shaped`, mapped over a page of records. */
+function shapedCollection(schema, page) {
+	return { body: {
+		items: page.items.map((item) => schema.parse(item)),
+		nextCursor: page.nextCursor
+	} };
+}
+// ../server/src/api/pagination.ts
+/**
+* Query-param parsing for the list pagination contract:
+* `?limit=&cursor=&orderBy=&orderDir=` → `{ items, nextCursor? }`.
+*
+* Every list endpoint parses these identically, so the clamping lives here
+* rather than inline per handler — a handler that clamps differently publishes
+* a different contract under the same documented one, and nothing fails at
+* build time.
+*/
+/**
+* An unparseable or out-of-range `limit` clamps rather than 400s: pagination
+* params are plumbing, and failing a read over one is hostile to clients
+* walking a cursor.
+*/
+function parseListOptions(url) {
+	const raw = Number(url.searchParams.get("limit") ?? 50);
+	const limit = Number.isFinite(raw) ? Math.min(Math.max(Math.trunc(raw), 1), 200) : 50;
+	const orderByRaw = url.searchParams.get("orderBy");
+	const orderBy = orderByRaw === "createdAt" || orderByRaw === "updatedAt" || orderByRaw === "name" ? orderByRaw : void 0;
+	return {
+		limit,
+		cursor: url.searchParams.get("cursor") ?? void 0,
+		orderBy,
+		orderDir: url.searchParams.get("orderDir") === "asc" ? "asc" : void 0
+	};
+}
+/** `parseListOptions` plus the definition-only `solveCount` ordering. */
+function parseDefinitionListOptions(url) {
+	const base = parseListOptions(url);
+	if (url.searchParams.get("orderBy") === "solveCount") return {
+		...base,
+		orderBy: "solveCount"
+	};
+	return base;
+}
+// ../server/src/organizations/user-memberships.ts
+var PAGE = 200;
+/**
+* Every org `userId` belongs to, with their membership row. Reads a page of
+* orgs and the user's rows in it at a time, so the cost grows with the number
+* of orgs, not with the number of members.
+*/
+async function listUserMemberships(orgs, userId) {
+	const out = [];
+	let cursor;
+	do {
+		const page = await orgs.listOrgs(SYSTEM_CONTEXT, {
+			limit: PAGE,
+			cursor
+		});
+		const members = await orgs.getOrgMembersFor(SYSTEM_CONTEXT, page.items.map((o) => o.id), userId);
+		for (const org of page.items) {
+			const member = members.get(org.id);
+			if (member) out.push({
+				org,
+				member
+			});
+		}
+		cursor = page.nextCursor;
+	} while (cursor);
+	return out;
+}
+// ../notifications/src/html.ts
+/**
+* Escape text for interpolation into an HTML attribute or text node.
+*
+* One copy on purpose: per-template copies are how one of them ends up missing
+* a case. Every value a template interpolates goes through this, including
+* URLs — an `acceptUrl` carries a token, and a token can contain characters
+* that would otherwise close the `href` early.
+*/
+function escapeHtml(s) {
+	return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+// ../notifications/src/layout.ts
+/**
+* The frame every Selva mail shares: card chrome, type stack, colours.
+* Templates supply a body; this supplies the look, so mail written by
+* different people at different times still reads as coming from one product.
+*
+* Deliberately plain — no images, no tracking pixel, no external stylesheet.
+* Inline styles with a table-free layout survive the common clients, and mail
+* clients that strip the styling still get readable, ordered content.
+*/
+function renderLayout({ heading, body, footer }) {
+	return `<!doctype html>
+<html>
+<body style="margin:0;padding:24px;background:#f6f7f9;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif;color:#1a1a1a;">
+	<div style="max-width:480px;margin:0 auto;background:#ffffff;border:1px solid #e4e6eb;border-radius:12px;padding:32px;">
+		<h1 style="margin:0 0 16px;font-size:20px;font-weight:600;">${escapeHtml(heading)}</h1>
+${body}${footer ? `
+		<hr style="border:none;border-top:1px solid #e4e6eb;margin:24px 0;" />
+		<p style="margin:0;font-size:12px;line-height:1.5;color:#8a8a8a;">
+			${footer}
+		</p>` : ""}
+	</div>
+</body>
+</html>`;
+}
+/** The primary action button. One definition so every mail's call to action matches. */
+function renderButton(href, label) {
+	return `<a href="${escapeHtml(href)}" style="display:inline-block;padding:11px 20px;background:#1a1a1a;color:#ffffff;text-decoration:none;border-radius:8px;font-size:15px;font-weight:500;">${escapeHtml(label)}</a>`;
+}
+/**
+* Fallback for clients that do not make the button clickable. Every mail whose
+* point is a link needs this: a button that does not render leaves the reader
+* with no way to continue.
+*/
+function renderUrlFallback(href) {
+	return `<p style="margin:24px 0 0;font-size:13px;line-height:1.5;color:#6b6b6b;">
+			Or paste this into your browser:<br />
+			<span style="word-break:break-all;color:#4a4a4a;">${escapeHtml(href)}</span>
+		</p>`;
+}
+// ../notifications/src/templates/invite.ts
+function formatExpiry(iso) {
+	const d = new Date(iso);
+	return Number.isNaN(d.getTime()) ? "soon" : d.toLocaleDateString("en-US", {
+		year: "numeric",
+		month: "long",
+		day: "numeric"
+	});
+}
+/**
+* "An admin invited you to an org" — the mail carrying an invite's accept link.
+*
+* The text part must always carry the URL: a mail that degrades to plain text
+* is still the only way the invitee can accept.
+*/
+function renderInviteEmail(input) {
+	const { to, acceptUrl, orgName, invitedBy } = input;
+	const expiry = formatExpiry(input.expiresAt);
+	const inviter = invitedBy ? `${invitedBy} invited you` : "You have been invited";
+	return {
+		kind: "org.invite",
+		to,
+		subject: `${inviter} to join ${orgName} on Selva`,
+		text: [
+			`${inviter} to join ${orgName} on Selva.`,
+			"",
+			"Open this link to accept and set up your account:",
+			acceptUrl,
+			"",
+			`The link expires on ${expiry} and can only be used once.`,
+			"",
+			"If you weren't expecting this invitation, you can ignore this email."
+		].join("\n"),
+		html: renderLayout({
+			heading: `Join ${orgName} on Selva`,
+			body: `		<p style="margin:0 0 24px;font-size:15px;line-height:1.5;color:#4a4a4a;">
+			${escapeHtml(inviter)} to join <strong>${escapeHtml(orgName)}</strong>. Open the link below to accept and set up your account.
+		</p>
+		${renderButton(acceptUrl, "Accept invitation")}
+		${renderUrlFallback(acceptUrl)}`,
+			footer: `This link expires on ${escapeHtml(expiry)} and can only be used once.
+			If you weren't expecting this invitation, you can ignore this email.`
+		})
+	};
+}
+// ../notifications/src/templates/api-token.ts
+function formatDate(iso) {
+	const d = new Date(iso);
+	return Number.isNaN(d.getTime()) ? iso : d.toLocaleDateString("en-US", {
+		year: "numeric",
+		month: "long",
+		day: "numeric"
+	});
+}
+/**
+* "A new API token was created on your account". The point is the case where
+* the owner didn't create it, so the revoke link leads.
+*/
+function renderApiTokenCreatedEmail(input) {
+	const { to, tokenName, orgName, scopes, manageUrl } = input;
+	const expiry = formatDate(input.expiresAt);
+	return {
+		kind: "api_token.created",
+		to,
+		subject: `New API token "${tokenName}" in ${orgName}`,
+		text: [
+			`A new API token named "${tokenName}" was created on your Selva account in ${orgName}.`,
+			"",
+			"It can:",
+			...scopes.map((s) => `- ${s}`),
+			"",
+			`It expires on ${expiry}.`,
+			"",
+			"If you didn't create it, revoke it now:",
+			manageUrl
+		].join("\n"),
+		html: renderLayout({
+			heading: "New API token",
+			body: `		<p style="margin:0 0 16px;font-size:15px;line-height:1.5;color:#4a4a4a;">
+			A new API token named <strong>${escapeHtml(tokenName)}</strong> was created on your account in <strong>${escapeHtml(orgName)}</strong>. It can:
+		</p>
+		<ul style="margin:0 0 24px;padding-left:20px;font-size:15px;line-height:1.5;color:#4a4a4a;">
+			${scopes.map((s) => `<li>${escapeHtml(s)}</li>`).join("")}
+		</ul>
+		${renderButton(manageUrl, "Review your tokens")}
+		${renderUrlFallback(manageUrl)}`,
+			footer: `It expires on ${escapeHtml(expiry)}. If you didn't create it, revoke it from the page above.`
+		})
+	};
+}
+// ../server/src/notifications/deliver-invite.ts
+/**
+* Mail an invite's accept link, best-effort.
+*
+* Shared by the mint and resend routes so they cannot disagree about what the
+* invitee receives. Swallows every failure: the invite row is already
+* committed and the caller still holds `acceptUrl` to share by hand, so a dead
+* SMTP host must not report a valid invite as a failure.
+*/
+async function deliverInvite(input) {
+	const { ctx, log, invite, acceptUrl, actor, orgs, notifications, fallbackOrgName } = input;
+	try {
+		const org = await orgs.getOrg(ctx, invite.orgId);
+		const { status } = await notifications.send(renderInviteEmail({
+			to: invite.email,
+			acceptUrl,
+			orgName: org?.name ?? fallbackOrgName,
+			invitedBy: actor.profile?.displayName || actor.user?.email,
+			expiresAt: invite.expiresAt
+		}), log);
+		return status;
+	} catch (err) {
+		log.warn("Invite mail could not be prepared", {
+			component: "Invites",
+			inviteId: invite.id,
+			reason: err instanceof Error ? err.message : String(err)
+		});
+		return "failed";
+	}
+}
+// ../server/src/handlers/services.ts
+function definitionService(deps) {
+	const service = deps.services.definitions;
+	if (!service) throw new Error("SelvaDeps.services.definitions is not wired — mount requires it.");
+	return service;
+}
+function orgAssetService(deps) {
+	const service = deps.services.orgAssets;
+	if (!service) throw new Error("SelvaDeps.services.orgAssets is not wired — mount requires it.");
+	return service;
+}
+/**
+* A token codec, or a named failure.
+*
+* Minting through an absent codec is the one failure mode worth being loud
+* about: a handler that quietly skipped hashing would persist a row whose token
+* can never be verified, and nothing downstream would report it.
+*/
+function tokenCodec(deps, family) {
+	const codec = deps.tokens[family];
+	if (!codec) throw new Error(`SelvaDeps.tokens.${family} is not wired — mount requires it.`);
+	return codec;
+}
+// ../server/src/handlers/me.ts
+/**
+* Whoami. The first call a non-browser client makes, and the only way a token
+* holder can see which org their credential resolved into — `actingOrgId` is
+* derived per request from the caller's membership, not frozen at mint time.
+*/
+var getMe = async (req) => {
+	const { ctx, user } = requireCaller(req);
+	return { body: {
+		userId: user.id,
+		email: user.email,
+		displayName: req.profile?.displayName,
+		actingOrgId: ctx.actingOrgId,
+		platformPermissions: ctx.platformPermissions,
+		orgPermissions: ctx.orgPermissions,
+		starredDefinitions: req.profile?.starredDefinitions ?? [],
+		...ctx.apiScope && { apiToken: {
+			id: ctx.apiScope.tokenId,
+			scopes: ctx.apiScope.scopes.map(formatApiScope),
+			expiresAt: ctx.apiScope.expiresAt
+		} }
+	} };
+};
+// ../server/src/handlers/me.starred.ts
+/**
+* Starring a definition for the calling user. Both directions are idempotent.
+*
+* No visibility check: a star is a row on the caller's own profile, keyed by
+* guid, and reveals nothing about whether that guid exists. The read paths that
+* expand stars into definitions filter by visibility there.
+*/
+var starDefinition = async (req) => {
+	const { ctx, user } = requireCaller(req);
+	const { guid } = requireParams(req.params, "guid");
+	await req.deps.userProfile.starDefinition(ctx, user.id, guid);
+	return noContent();
+};
+var unstarDefinition = async (req) => {
+	const { ctx, user } = requireCaller(req);
+	const { guid } = requireParams(req.params, "guid");
+	await req.deps.userProfile.unstarDefinition(ctx, user.id, guid);
+	return noContent();
+};
+// ../server/src/handlers/orgs.ts
+/**
+* The acting org's record and roster.
+*
+* `requireActingOrg` is the tenancy gate on both: the URL `orgId` must equal
+* `ctx.actingOrgId`, so the URL alone never decides which tenant is read.
+*/
+/** The acting org's record — name, slug, and branding asset URLs. */
+var getOrg = async (req) => {
+	const { ctx, orgId } = requireActingOrg(req, req.params.orgId);
+	const org = await req.deps.orgs.getOrg(ctx, orgId);
+	if (!org) apiError(404, ApiErrorCode.NOT_FOUND, "Organization not found");
+	return { body: org };
+};
+/**
+* List the org's members. Any member of the acting org may read this — the
+* roster is what the team page renders, and `requireActingOrg` already confines
+* the read to the caller's own tenant.
+*/
+var listOrgMembers = async (req) => {
+	const { ctx, orgId } = requireActingOrg(req, req.params.orgId);
+	return collection(await req.deps.orgs.listOrgMembers(ctx, orgId, parseListOptions(req.url)));
+};
+// ../server/src/handlers/apiTokens.ts
+/**
+* API tokens: mint, list, revoke.
+*
+* **Session-only.** A key can't manage keys, so a leaked one can't mint more or
+* revoke the owner's others to cover its tracks. The one exception is a key
+* revoking itself, which only ever takes access away.
+*
+* **The raw key exists only in the mint response.** The store holds its HMAC,
+* and every response goes through a schema that has no `tokenHash`.
+*/
+var DAY_MS = 864e5;
+function requireSessionInOrg(req) {
+	if (req.ctx?.apiScope) apiError(403, ApiErrorCode.FORBIDDEN, "API tokens can’t manage API tokens. Sign in to the web app to do this.");
+	return requireActingOrg(req, req.params.orgId);
+}
+/**
+* May `ctx` hold a key with `scopes`, by the host's policy or the default rule?
+* The one call every mint path makes, so a host's token page and its consent
+* screen can't disagree with the mint.
+*/
+function mayHoldApiTokens(deps, ctx, scopes) {
+	return canHoldApiTokens(ctx, scopes, {
+		policy: deps.tokens.mayHoldApiTokens,
+		deps
+	});
+}
+function unavailable() {
+	apiError(503, ApiErrorCode.API_TOKENS_UNAVAILABLE, "API tokens are not available on this server.");
+}
+function storeOf(req) {
+	return req.deps.data.apiTokens ?? unavailable();
+}
+function codecOf(req) {
+	return req.deps.tokens.apiTokens ?? unavailable();
+}
+function toResponse(token) {
+	return {
+		...token,
+		refusedToday: scopeRefusalsToday(token.id)
+	};
+}
+/** Who sees every owner's keys in an org and may revoke any of them. */
+var canManageApiTokenRoster = (ctx) => hasPermission(ctx, "manage_org_members");
+/**
+* Keys in `orgId`, newest first, including revoked and expired ones: the
+* caller's own, or with `roster` everyone's. The list endpoint and a host's
+* token page both read through here, so they can't disagree on who sees what.
+*/
+async function listOrgApiTokens(store, ctx, orgId, { roster = false, ...opts } = {}) {
+	if (roster && !canManageApiTokenRoster(ctx)) apiError(403, ApiErrorCode.FORBIDDEN, "Only org admins can see everyone’s API tokens.");
+	const page = await store.listByOrg(ctx, orgId, {
+		...opts,
+		userId: roster ? void 0 : ctx.userId
+	});
+	return {
+		...page,
+		items: page.items.map(toResponse)
+	};
+}
+/**
+* Refuse scopes naming something outside this org or out of the creator's
+* sight. Not the security boundary: a key never exceeds its owner's live rights
+* anyway. This stops someone minting a key that can only ever be refused.
+*/
+async function assertScopesReachable(req, orgId, scopes) {
+	const refuse = (message) => apiError(400, ApiErrorCode.VALIDATION_FAILED, message, { scopes: message });
+	for (const value of scopes) {
+		const { resource } = parseApiScope(value) ?? refuse(`Unknown scope: ${value}`);
+		if (resource.kind === "all") continue;
+		if (resource.kind === "org") {
+			if (resource.id !== orgId) refuse("An org scope must name this org.");
+			continue;
+		}
+		let projectId = resource.id;
+		if (resource.kind === "definition") projectId = (await req.deps.definitionMeta.get(req.ctx, resource.id) ?? refuse(`No definition ${resource.id}.`)).projectId;
+		const project = await req.deps.projects.getProject(req.ctx, projectId);
+		if (!project || project.orgId !== orgId) refuse(`No ${resource.kind} ${resource.id} in this org.`);
+		try {
+			await requireCanViewProject(req, projectId);
+		} catch (err) {
+			if (isApiError(err)) refuse(`You can’t access ${resource.kind} ${resource.id}.`);
+			throw err;
+		}
+	}
+}
+/**
+* Tell the owner a key now exists on their account, best-effort. The case that
+* matters is the one where they didn't make it.
+*/
+async function mailTokenCreated(req, token) {
+	const notifications = req.deps.notifications;
+	const to = req.user?.email;
+	if (!notifications || !to) return;
+	try {
+		const org = await req.deps.orgs.getOrg(req.ctx, token.orgId);
+		await notifications.send(renderApiTokenCreatedEmail({
+			to,
+			tokenName: token.name,
+			orgName: org?.name ?? req.deps.instanceName,
+			scopes: token.scopes.map(describeApiScope),
+			expiresAt: token.expiresAt,
+			manageUrl: `${req.url.origin}${req.deps.apiTokenSettingsPath}`
+		}), req.log);
+	} catch (err) {
+		req.log.warn("API token mail could not be sent", {
+			component: "ApiTokens",
+			tokenId: token.id,
+			reason: err instanceof Error ? err.message : String(err)
+		});
+	}
+}
+/** The caller's own keys in this org. `?all=true` returns everyone's and needs `manage_org_members`. */
+var listApiTokens = async (req) => {
+	const { ctx, orgId } = requireSessionInOrg(req);
+	const page = await listOrgApiTokens(storeOf(req), ctx, orgId, {
+		...parseListOptions(req.url),
+		roster: req.url.searchParams.get("all") === "true"
+	});
+	return shapedCollection(ApiTokenResponseSchema, page);
+};
+/**
+* Mint a token acting as the caller, in the caller's acting org. Every mint
+* goes through here, the token endpoint and an OAuth consent alike, so the
+* holder rule, the scope checks, the audit event and the owner's email always
+* apply. A consent screen passes a `req` whose `ctx` acts in the org the user
+* picked.
+*/
+async function mintApiToken(req, input) {
+	const { ctx, user } = requireCaller(req);
+	const orgId = ctx.actingOrgId;
+	if (ctx.apiScope || !orgId) apiError(403, ApiErrorCode.FORBIDDEN, "API tokens can only be created from a signed-in session.");
+	if (!await mayHoldApiTokens(req.deps, ctx, input.scopes)) apiError(403, ApiErrorCode.FORBIDDEN, "You can’t create API tokens with this access in this org.");
+	const store = storeOf(req);
+	const codec = codecOf(req);
+	const delegated = req.deps.auth.delegatedSession;
+	if (delegated && !(await delegated.status()).ok) unavailable();
+	await assertScopesReachable(req, orgId, input.scopes);
+	const raw = codec.mintRawToken();
+	const now = /* @__PURE__ */ new Date();
+	const token = {
+		id: randomUUID(),
+		userId: user.id,
+		createdBy: user.id,
+		orgId,
+		name: input.name,
+		tokenHash: codec.hashToken(raw),
+		scopes: [...new Set(input.scopes)],
+		createdAt: now.toISOString(),
+		expiresAt: new Date(now.getTime() + input.expiresInDays * DAY_MS).toISOString(),
+		lastUsedAt: null,
+		revokedAt: null
+	};
+	await store.create(ctx, token);
+	await mailTokenCreated(req, token);
+	const { tokenHash: _hash, ...summary } = token;
+	return {
+		token: toResponse(summary),
+		secret: raw
+	};
+}
+/** Mint a token acting as the caller. The raw key is in this response and nowhere else. */
+var createApiToken = async (req) => {
+	requireSessionInOrg(req);
+	const input = await parseBody(req.request, CreateApiTokenBodySchema);
+	return {
+		status: 201,
+		headers: { "Cache-Control": "no-store" },
+		body: CreatedApiTokenResponseSchema.parse(await mintApiToken(req, input))
+	};
+};
+/**
+* Revoke a token: the owner's own, or anyone's in the org for
+* `manage_org_members`. Someone else's token reads as missing, not forbidden.
+*/
+var revokeApiToken = async (req) => {
+	const { ctx, orgId } = requireSessionInOrg(req);
+	const { tokenId } = requireParams(req.params, "tokenId");
+	const store = storeOf(req);
+	const token = await store.get(ctx, tokenId);
+	const own = token?.userId === ctx.userId;
+	if (!token || token.orgId !== orgId || !own && !canManageApiTokenRoster(ctx)) apiError(404, ApiErrorCode.NOT_FOUND, "API token not found");
+	await store.revoke(ctx, tokenId, own ? "owner" : "admin");
+	return noContent();
+};
+/**
+* Revoke the key that sent this request, and nothing else. Any key may call it,
+* whatever its scopes, so a client signing out never needs more than it has.
+* A browser session gets 400: it has no key to revoke.
+*/
+var revokeOwnApiToken = async (req) => {
+	const { ctx } = requireCaller(req);
+	if (!ctx.apiScope) apiError(400, ApiErrorCode.VALIDATION_FAILED, "Only an API token can revoke itself. Revoke tokens from the web app instead.");
+	await storeOf(req).revoke(ctx, ctx.apiScope.tokenId, "owner");
+	return noContent();
+};
+/**
+* Revoke every live key `userId` holds, in one org or (no `orgId`) all of
+* them. Call it when someone leaves an org or is disabled: the resolver already
+* refuses those keys, but without this they would work again the moment the
+* person is re-added or re-enabled.
+*
+* Best effort. The removal or disable has already committed, so a failure is
+* logged rather than thrown.
+*/
+async function revokeUserApiTokens(store, ctx, userId, opts, log) {
+	if (!store) return;
+	try {
+		await store.revokeAllForUser({
+			...ctx,
+			system: true
+		}, userId, opts);
+	} catch (err) {
+		log.error("Failed to revoke API tokens", {
+			component: "ApiTokens",
+			userId,
+			orgId: opts.orgId,
+			reason: opts.reason,
+			err: err instanceof Error ? err.message : String(err)
+		});
+	}
+}
+// ../server/src/handlers/ownerChanges.ts
+var ownerChangeQueues = /* @__PURE__ */ new Map();
+/**
+* Runs one org's or project's member changes one at a time. The sole-owner check
+* reads, then writes: two owners acting on each other at once would each see the
+* other as the survivor and leave none. Per process only; replicas still need an
+* atomic store write to close it.
+*/
+function serializeOwnerChanges(id, run) {
+	const next = (ownerChangeQueues.get(id) ?? Promise.resolve()).catch(() => {}).then(run);
+	const tail = next.catch(() => {});
+	ownerChangeQueues.set(id, tail);
+	tail.then(() => {
+		if (ownerChangeQueues.get(id) === tail) ownerChangeQueues.delete(id);
+	});
+	return next;
+}
+// ../server/src/handlers/orgMembers.ts
+/**
+* Org member role, permissions, and removal.
+*
+* Two gates run on every request: `requireManageOrgMembers` (owner+admin) and
+* `requireActingOrg` (the URL `orgId` must equal `ctx.actingOrgId`, so
+* cross-org member mutation is blocked even for an actor with permissions in
+* another org).
+*
+* The sole-owner invariant applies to demotion and removal alike — an org with
+* no owner is unadministrable, and removing an owner ends their role exactly as
+* demoting them does.
+*/
+var ROSTER_PAGE_LIMIT = 200;
+var MAX_ROSTER_PAGES = 100;
+/**
+* Whether anyone other than `exceptUserId` still owns the org.
+*
+* Both branches below need this and both used to scan the roster themselves —
+* the sole-owner invariant is one rule, so it reads from one place.
+*
+* Pages rather than reading one 200-row window: a second owner sitting past the
+* first page read as "no other owner", so the invariant refused a demotion or
+* removal that was in fact safe. That failed closed, but it made the org
+* unadministrable exactly when it had grown enough to need administering.
+* Returns on the first owner found, so the common case is still one round-trip.
+*/
+async function hasAnotherOwner(req, ctx, orgId, exceptUserId) {
+	let cursor;
+	for (let page = 0; page < MAX_ROSTER_PAGES; page++) {
+		const result = await req.deps.orgs.listOrgMembers(ctx, orgId, {
+			limit: ROSTER_PAGE_LIMIT,
+			cursor
+		});
+		if (result.items.some((m) => m.role === "owner" && m.userId !== exceptUserId && !m.deletedAt)) return true;
+		cursor = result.nextCursor;
+		if (!cursor) return false;
+	}
+	req.log.warn("hasAnotherOwner hit the page cap — treating as sole owner", {
+		orgId,
+		pages: MAX_ROSTER_PAGES
+	});
+	return false;
+}
+/**
+* Projects in `orgId` where `userId` is the only live owner — the ones that
+* will have no owner once `removeOrgMember` cascades their membership rows.
+*
+* **Report, do not block.** Blocking puts an unbounded chore in front of
+* offboarding — the cost scales with how many projects the departing person
+* owned, which is backwards, because the most prolific people are the ones
+* whose departure most needs to be clean. An offboarding that fails halfway is
+* worse than an ownerless project: the person stays in the org while someone
+* works through the backlog. Reclaim already exists to adopt an ownerless
+* project, so the recovery path is built; what was missing was any signal that
+* recovery was needed. Hence the event.
+*
+* MUST be called before the removal — afterwards the rows it reads are gone.
+*/
+async function findProjectsLosingSoleOwner(req, orgId, userId) {
+	const projects = req.deps.projects;
+	const orgProjects = await projects.listProjects(SYSTEM_CONTEXT, orgId, { limit: ROSTER_PAGE_LIMIT });
+	return (await Promise.all(orgProjects.items.map(async (project) => {
+		const owners = (await projects.listProjectMembers(SYSTEM_CONTEXT, project.id, { limit: ROSTER_PAGE_LIMIT })).items.filter((m) => m.role === "owner" && !m.deletedAt);
+		return owners.length === 1 && owners[0].userId === userId ? project : null;
+	}))).filter((p) => p !== null);
+}
+/**
+* Body accepts either or both:
+*   - `{ role: OrgRole }` — change the member's role. Owner-only.
+*   - `{ permissions: OrgPermission[] }` — replace the member's grantable
+*     permissions. Owner/admin via `manage_org_members`. For `member`-role
+*     targets, only `MEMBER_ASSIGNABLE_PERMISSIONS` are accepted; promoting a
+*     member's permissions does NOT change their role.
+*/
+var updateOrgMember = async (req) => {
+	const { userId } = requireParams(req.params, "orgId", "userId");
+	requireManageOrgMembers(req);
+	const { ctx, orgId } = requireActingOrg(req, req.params.orgId);
+	const patch = await parseBody(req.request, UpdateOrgMemberBodySchema);
+	const orgs = req.deps.orgs;
+	return serializeOwnerChanges(orgId, async () => {
+		const [actorMember, target] = await Promise.all([orgs.getOrgMember(ctx, orgId, ctx.userId), orgs.getOrgMember(ctx, orgId, userId)]);
+		if (!target) apiError(404, ApiErrorCode.NOT_FOUND, "Member not found in this organization.");
+		if (!actorMember) apiError(403, ApiErrorCode.FORBIDDEN, "You are not a member of this organization.");
+		const roleChange = patch.role !== void 0 && patch.role !== target.role;
+		if (roleChange) {
+			if (!canChangeOrgRole({
+				actorMember,
+				role: patch.role
+			}) || !canChangeOrgRole({
+				actorMember,
+				role: target.role
+			})) apiError(403, ApiErrorCode.FORBIDDEN, "Only the org owner can change roles.");
+			if (target.role === "owner" && patch.role !== "owner" && !await hasAnotherOwner(req, ctx, orgId, target.userId)) apiError(409, ApiErrorCode.CONFLICT, "Cannot demote the sole owner of this organization. Promote another member to owner first.");
+		}
+		if (patch.permissions !== void 0) {
+			if (!canChangeOrgRole({
+				actorMember,
+				role: target.role
+			})) apiError(403, ApiErrorCode.FORBIDDEN, "Only the org owner can change an owner’s or admin’s permissions.");
+			const effectiveRole = patch.role ?? target.role;
+			const valid = effectiveRole === "member" ? new Set(MEMBER_ASSIGNABLE_PERMISSIONS) : new Set(ALL_ORG_PERMISSIONS);
+			const invalid = patch.permissions.filter((p) => !valid.has(p));
+			if (invalid.length > 0) apiError(400, ApiErrorCode.VALIDATION_FAILED, `Permissions [${invalid.join(", ")}] cannot be assigned to a ${effectiveRole}.`);
+		}
+		if (roleChange) await orgs.updateOrgMemberRole(ctx, orgId, userId, patch.role);
+		if (patch.permissions !== void 0) await orgs.updateOrgMemberPermissions(ctx, orgId, userId, patch.permissions);
+		return noContent();
+	});
+};
+/**
+* Remove a member from the org. Owner/admin via `manage_org_members`, same
+* tenancy check as PATCH, and the same sole-owner invariant — removing the last
+* owner would leave the org unadministrable.
+*/
+var removeOrgMember = async (req) => {
+	const { userId } = requireParams(req.params, "orgId", "userId");
+	requireManageOrgMembers(req);
+	const { ctx, orgId } = requireActingOrg(req, req.params.orgId);
+	const orgs = req.deps.orgs;
+	const orphaned = await serializeOwnerChanges(orgId, async () => {
+		const [actorMember, target] = await Promise.all([orgs.getOrgMember(ctx, orgId, ctx.userId), orgs.getOrgMember(ctx, orgId, userId)]);
+		if (!target) apiError(404, ApiErrorCode.NOT_FOUND, "Member not found in this organization.");
+		if (!canChangeOrgRole({
+			actorMember,
+			role: target.role
+		})) apiError(403, ApiErrorCode.FORBIDDEN, "Only the org owner can remove another owner.");
+		if (target.role === "owner" && !await hasAnotherOwner(req, ctx, orgId, target.userId)) apiError(409, ApiErrorCode.CONFLICT, "Cannot remove the sole owner of this organization. Promote another member to owner first.");
+		const losing = await findProjectsLosingSoleOwner(req, orgId, userId);
+		await orgs.removeOrgMember(ctx, orgId, userId);
+		return losing;
+	});
+	if (orphaned.length > 0) {
+		await req.deps.events.emit({
+			type: "org_member.removed_orphaning_projects",
+			orgId,
+			userId,
+			projectIds: orphaned.map((p) => p.id),
+			...actorOf(ctx)
+		});
+		req.log.warn("Org member removal left projects without an owner", {
+			orgId,
+			userId,
+			actorId: ctx.userId,
+			projectCount: orphaned.length
+		});
+	}
+	const email = (await req.deps.auth.getUser(userId))?.email;
+	if (email) try {
+		await req.deps.invites.revokePendingByEmail(ctx, orgId, email);
+	} catch (err) {
+		req.log.error("Removed org member but failed to revoke their pending invites", {
+			orgId,
+			userId,
+			error: err instanceof Error ? err.message : String(err)
+		});
+	}
+	await revokeUserApiTokens(req.deps.data.apiTokens, ctx, userId, {
+		orgId,
+		reason: "member_removed"
+	}, req.log);
+	return noContent();
+};
+// ../server/src/handlers/reclaim.ts
+/**
+* Org owner/admin escape hatch for a project they cannot otherwise reach.
+*
+* Adds the actor as a co-owner and does NOT demote the existing owner.
+* Idempotent: reclaiming twice is a no-op, because `addProjectMember`
+* reactivates a soft-deleted row in place.
+*/
+var reclaimProject = async (req) => {
+	const { id } = requireParams(req.params, "id");
+	const { user, ctx, project } = await requireCanReclaim(req, id);
+	const now = (/* @__PURE__ */ new Date()).toISOString();
+	const member = {
+		projectId: id,
+		userId: user.id,
+		role: "owner",
+		joinedAt: now,
+		updatedAt: now,
+		updatedBy: ctx.userId || user.id,
+		deletedAt: null
+	};
+	await req.deps.projects.addProjectMember(ctx, member);
+	await req.deps.events.emit({
+		type: "project.reclaimed",
+		projectId: id,
+		orgId: project.orgId,
+		...actorOf(ctx),
+		priorVisibility: project.visibility
+	});
+	return created({ member });
+};
+// ../server/src/handlers/orgAssets.ts
+/**
+* Org branding assets, generic over kind (`logo`, `favicon`, …). Gated on
+* `manage_org_members` — org branding is an org-admin action.
+*
+* Raster images and SVG are both accepted. Every input is rasterized to WebP by
+* the shared transcoder inside the storage provider, so SVG carries no XSS
+* surface: no vector blob is ever stored or served. The allowlist below is the
+* HTTP gate; the rasterization is the security control.
+*/
+var ALLOWED_CONTENT_TYPES = /* @__PURE__ */ new Set([
+	"image/png",
+	"image/jpeg",
+	"image/webp",
+	"image/gif",
+	"image/svg+xml"
+]);
+function parseKind(params) {
+	const kind = OrgAssetKindSchema.safeParse(params.kind);
+	if (!kind.success) apiError(404, ApiErrorCode.NOT_FOUND, `Unknown asset kind '${params.kind}'`);
+	return kind.data;
+}
+var uploadOrgAsset = async (req) => {
+	requireManageOrgMembers(req);
+	const kind = parseKind(req.params);
+	const { ctx, orgId } = requireActingOrg(req, req.params.orgId);
+	if (!await req.deps.orgs.getOrg(ctx, orgId)) apiError(404, ApiErrorCode.NOT_FOUND, "Organization not found");
+	const { file } = requireUpload(await readForm(req.request), "image", {
+		maxBytes: req.deps.uploadLimits.maxImageFileSize,
+		contentTypes: {
+			allowed: ALLOWED_CONTENT_TYPES,
+			message: "Unsupported image type. Allowed: PNG, JPG, WebP, GIF, SVG"
+		},
+		label: "Image"
+	});
+	const bytes = new Uint8Array(await file.arrayBuffer());
+	return { body: {
+		kind,
+		url: await orgAssetService(req.deps).saveAsset(ctx, orgId, kind, bytes, file.type)
+	} };
+};
+var removeOrgAsset = async (req) => {
+	requireManageOrgMembers(req);
+	const kind = parseKind(req.params);
+	const { ctx, orgId } = requireActingOrg(req, req.params.orgId);
+	await orgAssetService(req.deps).removeAsset(ctx, orgId, kind);
+	return noContent();
+};
+// ../server/src/handlers/shareLinks.ts
+/**
+* Share-link administration.
+*
+* Minting, listing and revoking are gated by `canEditDefinition` — the same
+* authority that uploads versions and publishes. The raw token appears in the
+* POST response and nowhere else; everything afterwards sees `hasToken: true`.
+*
+* **Responses go through `shaped`/`shapedCollection`, never `{ body }`.** A
+* `ShareLink` carries `tokenHash`, and the response schema is what drops it —
+* returning the record directly would put a credential hash on the wire with
+* nothing failing at build time.
+*/
+function assertSharingEnabled(req) {
+	if (!req.deps.flag("ENABLE_SHARING")) apiError(404, ApiErrorCode.NOT_FOUND, "Share links are disabled on this instance (ENABLE_SHARING).");
+}
+/** `tokenHash` is dropped by the response schema, not by this function. */
+function forClient(link) {
+	return {
+		...link,
+		hasToken: true
+	};
+}
+var listShareLinks = async (req) => {
+	assertSharingEnabled(req);
+	const guid = parseParam(req.params.guid, GuidSchema, "GUID");
+	const { ctx } = await requireEditableDefinition(req, guid);
+	const page = await req.deps.shareLinks.listByDefinition(ctx, guid, parseListOptions(req.url));
+	return shapedCollection(ShareLinkResponseSchema, {
+		items: page.items.map(forClient),
+		nextCursor: page.nextCursor
+	});
+};
+var createShareLink = async (req) => {
+	assertSharingEnabled(req);
+	const guid = parseParam(req.params.guid, GuidSchema, "GUID");
+	const { user } = requireCaller(req);
+	const { ctx } = await requireEditableDefinition(req, guid);
+	const input = await parseBody(req.request, CreateShareLinkInputSchema, { missingAs: {} });
+	const codec = tokenCodec(req.deps, "shareLinks");
+	const raw = codec.mintRawToken();
+	const link = {
+		id: randomUUID(),
+		definitionId: guid,
+		channel: input.channel,
+		tokenHash: codec.hashToken(raw),
+		name: input.name,
+		createdBy: user.id,
+		createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+		expiresAt: input.expiresAt ?? null,
+		revokedAt: null,
+		allowSolve: input.allowSolve,
+		maxSolves: input.maxSolves === void 0 ? DEFAULT_SHARE_LINK_MAX_SOLVES : input.maxSolves,
+		solveCount: 0
+	};
+	await req.deps.shareLinks.create(ctx, link);
+	return shaped(CreatedShareLinkResponseSchema, {
+		link: forClient(link),
+		token: raw
+	}, 201);
+};
+/**
+* Revoke a share link (soft-delete). Idempotent, gated by `canEditDefinition`.
+*
+* The link must belong to this definition, so one definition's editor cannot
+* revoke another's link with a guessed or leaked linkId.
+*/
+var revokeShareLink = async (req) => {
+	assertSharingEnabled(req);
+	const guid = parseParam(req.params.guid, GuidSchema, "GUID");
+	const linkId = parseParam(req.params.linkId, GuidSchema, "link ID");
+	const { ctx } = await requireEditableDefinition(req, guid);
+	const existing = await req.deps.shareLinks.getById(ctx, linkId);
+	if (!existing || existing.definitionId !== guid) apiError(404, ApiErrorCode.NOT_FOUND, "Share link not found.");
+	await req.deps.shareLinks.revoke(ctx, linkId);
+	return noContent();
+};
+// ../server/src/handlers/definitions.ts
+/**
+* Definition handlers: the collection, one definition's detail and metadata,
+* its live schema, cover image, and the publish channel.
+*
+* Solve and the two compute routes stay unwrapped deliberately — they stream
+* and mark their own metrics, which the `ApiResponse` envelope does not model.
+*/
+var LISTABLE_STATUSES = [
+	"draft",
+	"published",
+	"archived"
+];
+/**
+* Definitions the caller can view. Visibility is resolved into the query via
+* `projectIds`, so `limit`/`nextCursor` describe the filtered set.
+*
+* `?documentId=<guid>` narrows to definitions uploaded from that Grasshopper
+* document which the caller can upload a new version of.
+*/
+var listDefinitions = async (req) => {
+	const { ctx } = requireCaller(req);
+	const documentParam = req.url.searchParams.get("documentId");
+	const documentId = documentParam === null ? null : toSourceDocumentId(documentParam);
+	if (documentParam !== null && !documentId) apiError(400, ApiErrorCode.VALIDATION_FAILED, "documentId must be a GUID");
+	const statusParam = req.url.searchParams.get("status");
+	if (statusParam && !LISTABLE_STATUSES.includes(statusParam)) apiError(400, ApiErrorCode.VALIDATION_FAILED, `status must be one of: ${LISTABLE_STATUSES.join(", ")}`);
+	const opts = {
+		...parseDefinitionListOptions(req.url),
+		projectId: req.url.searchParams.get("projectId") ?? void 0,
+		statuses: statusParam ? [statusParam] : void 0
+	};
+	const page = documentId ? await listEditableDefinitionsByDocument(ctx, documentId, opts, req.deps) : await listVisibleDefinitions(ctx, opts, req.deps);
+	return collection({
+		items: page.items.map(toDefinitionListItem),
+		nextCursor: page.nextCursor
+	});
+};
+function parseTags(raw) {
+	if (!raw) return void 0;
+	const tags = raw.split(",").map((t) => t.trim()).filter(Boolean);
+	return tags.length ? tags : void 0;
+}
+var COVER_IMAGE_TYPES = {
+	allowed: new Set(Object.values(COVER_IMAGE_CONTENT_TYPES)),
+	message: "Unsupported image type. Allowed: PNG, JPEG, WebP, GIF"
+};
+function requireCoverImage(form, maxBytes) {
+	return requireUpload(form, "image", {
+		maxBytes,
+		contentTypes: COVER_IMAGE_TYPES,
+		label: "Image"
+	}).file;
+}
+/** Create a definition — metadata and the Grasshopper file in one request. */
+var createDefinition = async (req) => {
+	const { ctx, user } = requireCaller(req);
+	const form = await readForm(req.request);
+	const { file, extension } = requireUpload(form, "file", {
+		maxBytes: req.deps.uploadLimits.maxDefinitionFileSize,
+		extensions: GH_EXTENSIONS,
+		label: "Grasshopper (.gh or .ghx) file"
+	});
+	const imageField = form.get("image");
+	const imageFile = imageField instanceof File && imageField.size > 0 ? requireCoverImage(form, req.deps.uploadLimits.maxImageFileSize) : void 0;
+	let projectId = formText(form, "projectId");
+	if (!projectId) {
+		if (!ctx.actingOrgId) apiError(400, ApiErrorCode.VALIDATION_FAILED, "No active organization");
+		const { projects } = await resolveAccessibleProjects(ctx, req.deps);
+		const fallback = projects.find((p) => p.orgId === ctx.actingOrgId);
+		if (!fallback) apiError(400, ApiErrorCode.VALIDATION_FAILED, "No accessible project — pass projectId.");
+		projectId = fallback.id;
+	}
+	const { project } = await requireCanCreateDefinition(req, projectId);
+	const parsed = CreateDefinitionInputSchema.safeParse({
+		displayName: formText(form, "displayName"),
+		description: formText(form, "description"),
+		category: formText(form, "category"),
+		coverImage: formText(form, "coverImage"),
+		tags: parseTags(formText(form, "tags")),
+		projectId,
+		computeServerId: formText(form, "computeServerId")
+	});
+	if (!parsed.success) throwZodError(parsed.error);
+	const guid = randomUUID();
+	const fileData = new Uint8Array(await file.arrayBuffer());
+	const server = await resolveServerForOrg(ctx, project.orgId, req.deps.computeServer, { definitionPin: parsed.data.computeServerId ?? null });
+	const schema = await fetchSchemaFromCompute(fileData, server);
+	const service = definitionService(req.deps);
+	const { record, version } = await service.create(ctx, {
+		guid,
+		projectId: parsed.data.projectId,
+		ownerId: user.id,
+		fileExt: extension.slice(1),
+		originalFilename: file.name,
+		computeServerId: parsed.data.computeServerId,
+		displayName: parsed.data.displayName.trim(),
+		description: parsed.data.description,
+		category: parsed.data.category,
+		tags: parsed.data.tags,
+		coverImage: parsed.data.coverImage
+	}, fileData, schema);
+	let coverImage = record.coverImage;
+	if (imageFile) try {
+		coverImage = await service.saveCoverImage(ctx, guid, new Uint8Array(await imageFile.arrayBuffer()));
+	} catch (err) {
+		await service.delete(ctx, guid);
+		throw err;
+	}
+	return created({
+		guid,
+		version,
+		coverImage
+	});
+};
+/** `schema` is a large blob, served on demand by `/versions/{versionId}/schema`. */
+function versionSummary(v) {
+	return {
+		id: v.id,
+		versionNumber: v.versionNumber,
+		uploadedAt: v.uploadedAt,
+		uploadedBy: v.uploadedBy,
+		changeNote: v.changeNote
+	};
+}
+/**
+* The record plus its live and draft version summaries. `canEdit` says whether
+* the caller can upload a version and make one live, scope included for a key.
+*/
+var getDefinition = async (req) => {
+	const guid = parseParam(req.params.guid, GuidSchema, "GUID");
+	const { ctx } = requireCaller(req);
+	const visible = await loadVisibleDefinition(ctx, guid, req.deps);
+	if (!visible) apiError(404, ApiErrorCode.NOT_FOUND, "Definition not found");
+	const { record } = visible;
+	const meta = req.deps.definitionMeta;
+	const [liveVersion, draftVersion] = await Promise.all([record.liveVersionId ? meta.getVersion(ctx, record.liveVersionId) : null, record.draftVersionId ? meta.getVersion(ctx, record.draftVersionId) : null]);
+	return { body: {
+		...record,
+		sourceDocumentId: record.sourceDocumentId ?? null,
+		canEdit: mayUploadToDefinition(ctx, visible, req.deps),
+		liveVersion: liveVersion ? versionSummary(liveVersion) : null,
+		draftVersion: draftVersion ? versionSummary(draftVersion) : null
+	} };
+};
+/** Soft-delete the definition; versions and blobs are wiped with it. */
+var deleteDefinition = async (req) => {
+	const guid = parseParam(req.params.guid, GuidSchema, "GUID");
+	const { ctx } = await requireEditableDefinition(req, guid);
+	await definitionService(req.deps).delete(ctx, guid);
+	return noContent();
+};
+/** Metadata only. New versions POST to `/versions`. */
+var updateDefinition = async (req) => {
+	const guid = parseParam(req.params.guid, GuidSchema, "GUID");
+	const { ctx, record } = await requireEditableDefinition(req, guid);
+	const patch = await parseBody(req.request, UpdateMetadataInputSchema);
+	if (patch.projectId && patch.projectId !== record.projectId) {
+		assertScope(ctx, "write", { projectId: patch.projectId });
+		await requireCanCreateDefinition(req, patch.projectId);
+	}
+	await definitionService(req.deps).updateMeta(ctx, guid, patch);
+	return noContent();
+};
+/**
+* Convenience alias for the live version's schema — the call a client makes
+* before solving. The canonical location is `/versions/{versionId}/schema`;
+* this resolves the `live` pointer for you.
+*/
+var getDefinitionSchema = async (req) => {
+	const guid = parseParam(req.params.guid, GuidSchema, "GUID");
+	const { ctx } = requireCaller(req);
+	const record = await getVisibleDefinition(ctx, guid, req.deps);
+	if (!record) apiError(404, ApiErrorCode.NOT_FOUND, "Definition not found");
+	if (!record.liveVersionId) apiError(404, ApiErrorCode.NOT_FOUND, "This definition has no published version");
+	const version = await loadVisibleVersion(ctx, guid, record.liveVersionId, req.deps);
+	if (!version?.schema) apiError(404, ApiErrorCode.NOT_FOUND, "No schema cached for the live version");
+	return { body: version.schema };
+};
+/**
+* Advance the live channel. Body `{ versionId? }` targets a specific version
+* (rollback or forward-roll); omit it to promote the current draft.
+*/
+var publishDefinition = async (req) => {
+	const guid = parseParam(req.params.guid, GuidSchema, "GUID");
+	const { versionId } = await parseBody(req.request, PublishVersionInputSchema, { missingAs: {} });
+	const { ctx } = await requireEditableDefinition(req, guid);
+	return { body: { version: await definitionService(req.deps).publish(ctx, guid, versionId) } };
+};
+/** Upload a cover image. */
+var uploadDefinitionImage = async (req) => {
+	const guid = parseParam(req.params.guid, GuidSchema, "GUID");
+	const { ctx } = await requireEditableDefinition(req, guid);
+	const file = requireCoverImage(await readForm(req.request), req.deps.uploadLimits.maxImageFileSize);
+	const data = new Uint8Array(await file.arrayBuffer());
+	return { body: { coverImage: await definitionService(req.deps).saveCoverImage(ctx, guid, data) } };
+};
+// ../server/src/handlers/definitionVersions.ts
+/**
+* Version handlers: list, upload, read, delete, and a version's cached schema.
+*
+* Reads resolve through `getVisibleDefinition` / `loadVisibleVersion`, which
+* return `null` rather than throwing, so an invisible definition answers 404.
+* A 403 anywhere here would confirm a guid exists across a tenant boundary.
+*/
+var listVersions = async (req) => {
+	const guid = parseParam(req.params.guid, GuidSchema, "GUID");
+	const { ctx } = requireCaller(req);
+	if (!await getVisibleDefinition(ctx, guid, req.deps)) apiError(404, ApiErrorCode.NOT_FOUND, "Definition not found");
+	return collection(await req.deps.definitionMeta.listVersions(ctx, guid, parseListOptions(req.url)));
+};
+/** Upload a new version. Advances `draft`; `live` is unchanged until publish. */
+var uploadVersion = async (req) => {
+	const guid = parseParam(req.params.guid, GuidSchema, "GUID");
+	const form = await readForm(req.request);
+	const { file, extension } = requireUpload(form, "file", {
+		maxBytes: req.deps.uploadLimits.maxDefinitionFileSize,
+		extensions: GH_EXTENSIONS,
+		label: "Grasshopper (.gh or .ghx) file"
+	});
+	const changeNote = formText(form, "changeNote", { maxLength: 1e3 });
+	const { ctx, record, project } = await requireEditableDefinition(req, guid);
+	const data = new Uint8Array(await file.arrayBuffer());
+	const server = await resolveServerForOrg(ctx, project?.orgId ?? null, req.deps.computeServer, { definitionPin: record.computeServerId ?? null });
+	const schema = await fetchSchemaFromCompute(data, server);
+	return created({ version: await definitionService(req.deps).uploadVersion(ctx, guid, data, extension.slice(1), file.name, schema, changeNote) });
+};
+/**
+* Version metadata. `schema` is excluded and served by the `/schema`
+* sub-resource, so a version read never carries a several-hundred-KB blob.
+*/
+var getVersion = async (req) => {
+	const guid = parseParam(req.params.guid, GuidSchema, "GUID");
+	const versionId = parseParam(req.params.versionId, GuidSchema, "version ID");
+	const { ctx } = requireCaller(req);
+	const version = await loadVisibleVersion(ctx, guid, versionId, req.deps);
+	if (!version) apiError(404, ApiErrorCode.NOT_FOUND, "Version not found");
+	const { schema: _schema, ...rest } = version;
+	return { body: rest };
+};
+/**
+* Delete an old version. The store throws 409 if the version is currently
+* referenced by `liveVersionId` or `draftVersionId` — repoint first.
+*/
+var deleteVersion = async (req) => {
+	const guid = parseParam(req.params.guid, GuidSchema, "GUID");
+	const versionId = parseParam(req.params.versionId, GuidSchema, "version ID");
+	const { ctx } = await requireEditableDefinition(req, guid);
+	await definitionService(req.deps).deleteVersion(ctx, guid, versionId);
+	return noContent();
+};
+/**
+* The UI schema cached on this version at upload. Reads what is stored — no
+* Rhino.Compute round-trip, unlike the pre-upload `POST /api/v1/compute/schema`.
+*
+* Schemas belong to a version, so this is the canonical location;
+* `/definitions/{guid}/schema` is an alias for the live one.
+*/
+var getVersionSchema = async (req) => {
+	const guid = parseParam(req.params.guid, GuidSchema, "GUID");
+	const versionId = parseParam(req.params.versionId, GuidSchema, "version ID");
+	const { ctx } = requireCaller(req);
+	const version = await loadVisibleVersion(ctx, guid, versionId, req.deps);
+	if (!version) apiError(404, ApiErrorCode.NOT_FOUND, "Version not found");
+	if (!version.schema) apiError(404, ApiErrorCode.NOT_FOUND, "No schema cached for this version");
+	return { body: version.schema };
+};
+// ../server/src/handlers/projects.ts
+/**
+* Project handlers: the collection, and a single project's detail and settings.
+*
+* `listProjects` was authored against `resolveAccessibleProjects`, not lifted
+* from the pre-v1 handler: that one listed every project in the acting org with
+* no `canView` filter and had no UI caller, so it carried no evidence of being
+* correct. The rest are lifted, logic intact, with reads moved onto `req.deps`.
+*/
+/**
+* Projects the caller can view. `canCreateDefinitions` says whether
+* `POST /definitions` would take this project from this caller: the same rule
+* as the route, and for an API token its `upload` scope there.
+*/
+var listProjects = async (req) => {
+	const { ctx } = requireCaller(req);
+	const set = await resolveAccessibleProjects(ctx, req.deps);
+	const { projects } = set;
+	const { limit, cursor } = parseListOptions(req.url);
+	const start = cursor ? Number(cursor) : 0;
+	if (!Number.isInteger(start) || start < 0) apiError(400, ApiErrorCode.VALIDATION_FAILED, "Invalid cursor");
+	const items = projects.slice(start, start + (limit ?? projects.length));
+	const nextIndex = start + items.length;
+	const tokenMayUpload = scopeAllows(ctx, "upload");
+	return collection({
+		items: items.map((project) => ({
+			...project,
+			canCreateDefinitions: tokenMayUpload && canCreateDefinition(projectAccessInputFromRowsWith(req, ctx, project, {
+				member: set.memberByProjectId.get(project.id) ?? null,
+				orgMember: set.orgMemberByOrgId.get(project.orgId) ?? null,
+				platformGrants: set.grantsByProjectId.get(project.id) ?? []
+			}))
+		})),
+		nextCursor: nextIndex < projects.length ? String(nextIndex) : void 0
+	});
+};
+var createProject = async (req) => {
+	const { ctx, user } = requireCaller(req);
+	if (!ctx.actingOrgId) apiError(400, ApiErrorCode.VALIDATION_FAILED, "No active organization");
+	await requireCanCreateProject(req, ctx.actingOrgId);
+	const input = await parseBody(req.request, CreateProjectBodySchema);
+	if (input.visibility === "platform" && !hasPermission(ctx, "instance_admin")) apiError(403, ApiErrorCode.FORBIDDEN, "Only a platform admin can create a project with platform visibility.");
+	const autoJoinOnUpload = input.autoJoinOnUpload ?? false;
+	const flagIssues = validateProjectFlags({
+		visibility: input.visibility,
+		autoJoinOnUpload
+	});
+	if (flagIssues.length > 0) apiError(400, ApiErrorCode.VALIDATION_FAILED, flagIssues.map((i) => `${i.path}: ${i.message}`).join("; "));
+	return created(await createProjectWithUniqueSlug(req.deps.projects, {
+		id: randomUUID(),
+		orgId: ctx.actingOrgId,
+		name: input.name,
+		description: input.description,
+		visibility: input.visibility,
+		ownerId: user.id,
+		createdBy: user.id,
+		updatedBy: user.id,
+		autoJoinOnUpload
+	}, {
+		writeCtx: ctx,
+		fallbackSlug: "project",
+		conflictScope: "this organization"
+	}));
+};
+/**
+* Project detail plus the caller's effective capabilities on it.
+*
+* A project the caller cannot view returns 404, not 403 — `403` would confirm
+* the id exists to anyone probing.
+*/
+var getProject = async (req) => {
+	const { id } = requireParams(req.params, "id");
+	const { ctx } = requireCaller(req);
+	const project = await req.deps.projects.getProject(SYSTEM_CONTEXT, id);
+	if (!project || outsideTokenOrg(ctx, project.orgId)) apiError(404, ApiErrorCode.NOT_FOUND, "Project not found");
+	const [orgMembers, projectMembers, grants] = await Promise.all([
+		req.deps.orgs.getOrgMembersFor(SYSTEM_CONTEXT, [project.orgId], ctx.userId),
+		req.deps.projects.getProjectMembersFor(SYSTEM_CONTEXT, [project.id], ctx.userId),
+		project.visibility === "platform" ? req.deps.platformProjectGrants.listByProject(SYSTEM_CONTEXT, project.id) : Promise.resolve([])
+	]);
+	const member = projectMembers.get(project.id) ?? null;
+	const input = projectAccessInputFromRowsWith(req, ctx, project, {
+		member,
+		orgMember: orgMembers.get(project.orgId) ?? null,
+		platformGrants: grants
+	});
+	if (!canView(input)) apiError(404, ApiErrorCode.NOT_FOUND, "Project not found");
+	return { body: {
+		...project,
+		role: member?.role ?? null,
+		canEdit: canEdit(input),
+		canSolve: canSolve(input)
+	} };
+};
+var updateProject = async (req) => {
+	const { id } = requireParams(req.params, "id");
+	const { ctx, project: existing } = await requireCanEditProjectSettings(req, id);
+	const input = await parseBody(req.request, UpdateProjectBodySchema);
+	if (input.visibility === "platform" && existing.visibility !== "platform") {
+		if (!hasPermission(ctx, "instance_admin")) apiError(403, ApiErrorCode.FORBIDDEN, "Only a platform admin can give a project platform visibility.");
+	}
+	if (input.visibility === "public" && existing.visibility !== "public") {
+		const orgMember = await req.deps.orgs.getOrgMember(ctx, existing.orgId, ctx.userId);
+		if (!withAdminBypass(ctx.platformPermissions, () => canChangeVisibilityToPublic({ orgMember }))) apiError(403, ApiErrorCode.FORBIDDEN, "Only org owners or admins can make a project public.");
+	}
+	const flagIssues = validateProjectFlags({
+		visibility: input.visibility ?? existing.visibility,
+		autoJoinOnUpload: input.autoJoinOnUpload ?? existing.autoJoinOnUpload
+	});
+	if (flagIssues.length > 0) apiError(400, ApiErrorCode.VALIDATION_FAILED, flagIssues.map((i) => `${i.path}: ${i.message}`).join("; "));
+	const patch = {};
+	if (input.name !== void 0) {
+		patch.name = input.name;
+		const slug = slugify(input.name);
+		if (slug) patch.slug = slug;
+	}
+	if (input.description !== void 0) patch.description = input.description ?? void 0;
+	if (input.visibility !== void 0) patch.visibility = input.visibility;
+	if (input.autoJoinOnUpload !== void 0) patch.autoJoinOnUpload = input.autoJoinOnUpload;
+	await req.deps.projects.updateProject(ctx, id, patch);
+	return noContent();
+};
+var deleteProject = async (req) => {
+	const { id } = requireParams(req.params, "id");
+	const { ctx } = requireCaller(req);
+	await requireCanManage(req, id);
+	await deleteProjectWithBlobs({
+		projects: req.deps.projects,
+		definitions: req.deps.definitionMeta,
+		storage: req.deps.storage
+	}, ctx, id);
+	return noContent();
+};
+// ../server/src/handlers/projectMembers.ts
+/**
+* Project membership: list, add, change role, remove.
+*
+* Every method here gates on `requireCanManage(req, id, 'members')`. The
+* owner-count preconditions on PATCH and DELETE come from `checkOwnerRemoval`,
+* a pure rules function, so demotion and removal cannot drift apart — a sole
+* owner demoting themselves locks the project exactly as removing themselves
+* would.
+*/
+var listProjectMembers = async (req) => {
+	const { id } = requireParams(req.params, "id");
+	const { ctx } = requireCaller(req);
+	await requireCanManage(req, id, "members");
+	return collection(await req.deps.projects.listProjectMembers(ctx, id, parseListOptions(req.url)));
+};
+var addProjectMember = async (req) => {
+	const { id } = requireParams(req.params, "id");
+	const { ctx } = requireCaller(req);
+	await requireCanManage(req, id, "members");
+	const input = await parseBody(req.request, AddProjectMemberBodySchema);
+	const project = await req.deps.projects.getProject(ctx, id);
+	if (!project) apiError(404, ApiErrorCode.NOT_FOUND, "Project not found");
+	await requireTargetIsOrgMember(req, project.orgId, input.userId);
+	const now = (/* @__PURE__ */ new Date()).toISOString();
+	const member = {
+		projectId: id,
+		userId: input.userId,
+		role: input.role,
+		joinedAt: now,
+		updatedAt: now,
+		updatedBy: ctx.userId || input.userId,
+		deletedAt: null
+	};
+	await req.deps.projects.addProjectMember(ctx, member);
+	return created(member);
+};
+/**
+* Guard the owner count before a demotion or removal goes through.
+*
+* `?confirm=true` is what distinguishes "I meant to do this" from a misclick;
+* the sole-owner case has no confirmation, because there is no state the
+* caller could confirm into that leaves the project manageable.
+*/
+async function assertOwnerRemovable(req, projectId, target, action) {
+	const { ctx } = requireCaller(req);
+	const page = await req.deps.projects.listProjectMembers(ctx, projectId, { limit: 200 });
+	const decision = checkOwnerRemoval({
+		target: { role: target.role },
+		allMembers: page.items.map((m) => ({ role: m.role })),
+		confirmed: req.url.searchParams.get("confirm") === "true"
+	});
+	if (decision === "sole_owner") apiError(409, ApiErrorCode.CONFLICT, `Cannot ${action} the sole owner of a project. Assign another owner first, or use reclaim to add a co-owner.`);
+	if (decision === "needs_confirm") apiError(409, ApiErrorCode.CONFLICT, `${action === "demote" ? "Demoting" : "Removing"} another project owner requires explicit confirmation. Retry with ?confirm=true.`);
+}
+var updateProjectMemberRole = async (req) => {
+	const { id, userId } = requireParams(req.params, "id", "userId");
+	const { ctx } = requireCaller(req);
+	await requireCanManage(req, id, "members");
+	const { role } = await parseBody(req.request, UpdateProjectMemberBodySchema);
+	return serializeOwnerChanges(id, async () => {
+		if (role !== "owner") {
+			const target = await req.deps.projects.getProjectMember(ctx, id, userId);
+			if (target?.role === "owner") await assertOwnerRemovable(req, id, target, "demote");
+		}
+		await req.deps.projects.updateProjectMemberRole(ctx, id, userId, role);
+		return noContent();
+	});
+};
+var removeProjectMember = async (req) => {
+	const { id, userId } = requireParams(req.params, "id", "userId");
+	const { ctx } = requireCaller(req);
+	await requireCanManage(req, id, "members");
+	return serializeOwnerChanges(id, async () => {
+		const target = await req.deps.projects.getProjectMember(ctx, id, userId);
+		if (!target) return noContent();
+		if (target.role === "owner") await assertOwnerRemovable(req, id, target, "remove");
+		await req.deps.projects.removeProjectMember(ctx, id, userId);
+		return noContent();
+	});
+};
+// ../server/src/handlers/orgCompute.ts
+/**
+* Per-org compute config: this org's own servers (`scope: 'org'`) and its
+* default selection (`orgDefaults[orgId]`). Platform servers and the global
+* default are read-only here — `manage_compute` owns those via `/api/admin/compute`.
+*
+* Authorization: org `owner`/`admin` with `manage_org_compute`, plus the acting-org
+* tenancy check. Gated by `ALLOW_ORG_COMPUTE_OVERRIDE`; when off, both methods 403.
+*
+* **`apiKey` merge semantics are the trap here.** Omitted preserves the stored
+* key, `null` clears it, a string replaces it — and `/api/admin/compute` must
+* agree, which is why the merge lives in `@selvajs/server/compute`, not inline.
+*/
+function requireFlag(req) {
+	if (!req.deps.flag("ALLOW_ORG_COMPUTE_OVERRIDE")) apiError(403, ApiErrorCode.FORBIDDEN, "Per-org compute override is disabled on this instance (ALLOW_ORG_COMPUTE_OVERRIDE).");
+}
+var getOrgCompute = async (req) => {
+	requireFlag(req);
+	requireManageOrgCompute(req);
+	const { ctx, orgId } = requireActingOrg(req, req.params.orgId);
+	const config = await req.deps.computeServer.getConfig(ctx, { scopeToOrgId: orgId });
+	const owned = config.servers.filter((s) => isOrgServer(s) && s.ownerOrgId === orgId).map((s) => ({
+		...s,
+		hasApiKey: !!s.hasApiKey
+	}));
+	const catalog = config.servers.map((s) => ({
+		id: s.id,
+		label: s.label,
+		serverUrl: s.serverUrl,
+		scope: s.scope,
+		source: isPlatformServer(s) ? "platform" : "org",
+		timeoutMs: s.timeoutMs,
+		retryCount: s.retryCount
+	}));
+	return shaped(OrgComputeResponseSchema, {
+		servers: owned,
+		defaultServerId: config.orgDefaults?.[orgId] ?? null,
+		globalDefaultServerId: config.defaultServerId ?? null,
+		catalog
+	});
+};
+var updateOrgCompute = async (req) => {
+	requireFlag(req);
+	requireManageOrgCompute(req);
+	const { ctx, orgId } = requireActingOrg(req, req.params.orgId);
+	const incoming = await parseBody(req.request, OrgComputePatchBodySchema);
+	validateIncomingServers(incoming.servers);
+	const provider = req.deps.computeServer;
+	const existing = await provider.getConfig(ctx, { includeApiKeys: true });
+	const orgServers = existing.servers.filter((s) => isOrgServer(s) && s.ownerOrgId === orgId);
+	assertStoredKeysReadable(incoming.servers, orgServers);
+	const storedKeys = storedKeysById(orgServers);
+	const next = incoming.servers.map((s) => ({
+		id: s.id,
+		scope: "org",
+		ownerOrgId: orgId,
+		label: s.label,
+		serverUrl: s.serverUrl,
+		timeoutMs: s.timeoutMs,
+		retryCount: s.retryCount,
+		apiKey: resolveApiKey(s.apiKey, storedKeys.get(s.id))
+	}));
+	if (typeof incoming.defaultServerId === "string") {
+		const projected = {
+			servers: [...existing.servers.filter((s) => !(isOrgServer(s) && s.ownerOrgId === orgId)), ...next],
+			defaultServerId: existing.defaultServerId,
+			orgDefaults: existing.orgDefaults
+		};
+		if (!new Set(serversVisibleTo(projected, orgId).map((s) => s.id)).has(incoming.defaultServerId)) apiError(400, ApiErrorCode.VALIDATION_FAILED, "defaultServerId must reference a server visible to this organization");
+	}
+	await provider.saveOrgServers(ctx, orgId, next, incoming.defaultServerId);
+	evictChangedServers(existing.servers.filter((s) => isOrgServer(s) && s.ownerOrgId === orgId), next, req.deps.evictComputeClient);
+	return noContent();
+};
+// ../server/src/handlers/invite-lookup.ts
+/**
+* Find an invite by id, confirming it belongs to `orgId`.
+*
+* `manage_org_members` is org-scoped, so a permitted caller must not reach an
+* invite in another org. Neither store scopes `revoke()` by acting org, so
+* every route that mutates an invite by id has to establish ownership first —
+* hence one shared paged scan rather than a copy per route.
+*/
+async function findPendingInviteInOrg(ctx, orgId, id, store) {
+	let cursor;
+	do {
+		const page = await store.listByOrg(ctx, orgId, {
+			limit: 200,
+			cursor
+		});
+		const match = page.items.find((i) => i.id === id);
+		if (match) return match;
+		cursor = page.nextCursor ?? void 0;
+	} while (cursor);
+	return null;
+}
+// ../server/src/handlers/invites.ts
+/**
+* Org invites: list, mint, revoke, resend.
+*
+* **The raw token exists only in the response.** The store sees an HMAC digest,
+* so a leak of the `invites` table cannot be replayed without the instance
+* secret — and `tokenHash` is dropped by the response schema, which is why
+* every response here goes through `shaped`/`shapedCollection` rather than
+* `{ body }`.
+*/
+var INVITE_TTL_MS = 6048e5;
+/**
+* Mail the accept link, or report why not.
+*
+* Mint and resend must send the identical message, so the deps threading lives
+* here rather than at each call site. `not-configured` when the host wired no
+* notification provider: the invite row is already committed and the caller
+* still holds `acceptUrl`, so an instance without mail is a working instance,
+* not a failed write.
+*/
+async function mailInvite(req, invite, acceptUrl) {
+	const notifications = req.deps.notifications;
+	if (!notifications) return "not-configured";
+	return deliverInvite({
+		ctx: req.ctx,
+		log: req.log,
+		invite,
+		acceptUrl,
+		actor: {
+			profile: req.profile,
+			user: req.user
+		},
+		orgs: req.deps.orgs,
+		notifications,
+		fallbackOrgName: req.deps.instanceName
+	});
+}
+/** Pending and recently accepted invites for the acting org. */
+var listInvites = async (req) => {
+	requireManageOrgMembers(req);
+	const { ctx, orgId } = requireActingOrg(req, req.params.orgId);
+	return shapedCollection(InviteResponseSchema, await req.deps.invites.listByOrg(ctx, orgId, parseListOptions(req.url)));
+};
+function requireSession(req) {
+	if (req.ctx?.apiScope) apiError(403, ApiErrorCode.FORBIDDEN, "Invites are sent from the web app, not with an API key.");
+}
+/** Create an invite and return the accept URL. */
+var createInvite = async (req) => {
+	requireSession(req);
+	requireManageOrgMembers(req);
+	const { ctx, orgId } = requireActingOrg(req, req.params.orgId);
+	const { user } = requireCaller(req);
+	const input = await parseBody(req.request, CreateInviteBodySchema);
+	const { platform: submittedPlatformPerms, org: submittedOrgPerms } = splitFlatPermissions(input.permissions);
+	assertCanGrantPlatformPermissions(ctx, submittedPlatformPerms);
+	if (!await canActorChangeOrgRole(ctx, orgId, input.orgRole, req)) apiError(403, ApiErrorCode.FORBIDDEN, "Only the org owner can invite someone as owner or admin.");
+	const orgPermissions = input.orgRole === "member" ? submittedOrgPerms.filter((p) => MEMBER_ASSIGNABLE_PERMISSIONS.includes(p)) : [...DEFAULT_ORG_PERMISSIONS[input.orgRole]];
+	const codec = tokenCodec(req.deps, "invites");
+	const rawToken = codec.mintRawToken();
+	const now = /* @__PURE__ */ new Date();
+	const invite = {
+		id: randomUUID(),
+		tokenHash: codec.hashToken(rawToken),
+		email: input.email,
+		orgId,
+		orgRole: input.orgRole,
+		orgPermissions,
+		platformPermissions: submittedPlatformPerms,
+		invitedBy: user.id,
+		createdAt: now.toISOString(),
+		expiresAt: new Date(now.getTime() + INVITE_TTL_MS).toISOString()
+	};
+	await req.deps.invites.create(ctx, invite);
+	const acceptUrl = `${req.url.origin}/accept-invite?token=${rawToken}`;
+	const delivery = await mailInvite(req, invite, acceptUrl);
+	return shaped(CreatedInviteResponseSchema, {
+		...invite,
+		acceptUrl,
+		delivery
+	}, 201);
+};
+/** Revoke a pending invite. Consumed invites are preserved for audit. */
+var revokeInvite = async (req) => {
+	requireManageOrgMembers(req);
+	const { ctx, orgId } = requireActingOrg(req, req.params.orgId);
+	const { id } = requireParams(req.params, "id");
+	if (!await findPendingInviteInOrg(ctx, orgId, id, req.deps.invites)) apiError(404, ApiErrorCode.NOT_FOUND, "Invite not found");
+	await req.deps.invites.revoke(ctx, id);
+	return noContent();
+};
+/**
+* Re-send an invite: mint a replacement and revoke the original.
+*
+* A resend cannot reuse the original link. The raw token is never stored — only
+* its HMAC digest is — so there is nothing to re-read, and rather than weaken
+* that, this issues a fresh token and revokes the row it replaces. The old link
+* stops working the moment this returns, which is also what an admin wants
+* after mailing an invite to the wrong address.
+*
+* Grants are copied verbatim from the original: re-deriving them here would let
+* a since-demoted admin silently change what the invite carries. The resender
+* still passes the gates the original's minter did, because the response hands
+* them a working link: an admin resending an owner invite could accept it.
+*/
+var resendInvite = async (req) => {
+	requireSession(req);
+	requireManageOrgMembers(req);
+	const { ctx, orgId } = requireActingOrg(req, req.params.orgId);
+	const { id } = requireParams(req.params, "id");
+	const existing = await findPendingInviteInOrg(ctx, orgId, id, req.deps.invites);
+	if (!existing) apiError(404, ApiErrorCode.NOT_FOUND, "Invite not found");
+	if (existing.acceptedAt) apiError(409, ApiErrorCode.CONFLICT, "This invite has already been accepted.");
+	assertCanGrantPlatformPermissions(ctx, existing.platformPermissions ?? []);
+	if (!await canActorChangeOrgRole(ctx, orgId, existing.orgRole, req)) apiError(403, ApiErrorCode.FORBIDDEN, "Only the org owner can resend an invite for an owner or admin.");
+	const codec = tokenCodec(req.deps, "invites");
+	const rawToken = codec.mintRawToken();
+	const now = /* @__PURE__ */ new Date();
+	const replacement = {
+		...existing,
+		id: randomUUID(),
+		tokenHash: codec.hashToken(rawToken),
+		createdAt: now.toISOString(),
+		expiresAt: new Date(now.getTime() + INVITE_TTL_MS).toISOString()
+	};
+	await req.deps.invites.create(ctx, replacement);
+	await req.deps.invites.revoke(ctx, existing.id);
+	const acceptUrl = `${req.url.origin}/accept-invite?token=${rawToken}`;
+	const delivery = await mailInvite(req, replacement, acceptUrl);
+	return shaped(CreatedInviteResponseSchema, {
+		...replacement,
+		acceptUrl,
+		delivery
+	}, 201);
+};
+// ../server/src/handlers/oauthConsent.ts
+async function contextIn(req, member) {
+	const { ctx, user } = requireCaller(req);
+	if (ctx.apiScope) apiError(403, ApiErrorCode.FORBIDDEN, "Sign in to the web app to connect an app.");
+	return {
+		...await buildRequestContext({
+			user,
+			platformPermissions: ctx.platformPermissions,
+			membership: member,
+			pinOrg: true
+		}, { orgs: req.deps.orgs }),
+		adapterContext: ctx.adapterContext
+	};
+}
+/**
+* The orgs the signed-in user may grant a key with `scopes` in: their acting
+* org, when they may hold such a key there. At most one.
+*/
+async function consentOrgs(req, scopes) {
+	const { ctx } = requireCaller(req);
+	const memberships = (await listUserMemberships(req.deps.orgs, ctx.userId)).filter(({ org }) => org.id === ctx.actingOrgId);
+	const allowed = await Promise.all(memberships.map(async ({ member }) => mayHoldApiTokens(req.deps, await contextIn(req, member), scopes)));
+	return memberships.filter((_, i) => allowed[i]).map(({ org }) => ({
+		id: org.id,
+		name: org.name
+	}));
+}
+/**
+* What a consent page offers for a request's scopes, and what its approval
+* accepts. Null when the user may grant none of it anywhere.
+*/
+async function consentOffer(req, scopes) {
+	const offered = (await Promise.all(consentChoices(scopes).map(async (choice) => ({
+		choice,
+		orgs: await consentOrgs(req, apiScopesFor(choice.scopes))
+	})))).filter((l) => l.orgs.length > 0);
+	return offered.length ? { levels: offered } : null;
+}
+/**
+* Mint the key a consent grants, in `orgId`. Anything but the acting org is
+* refused here, whatever the form said.
+*/
+async function mintConsentToken(req, orgId, input) {
+	const { ctx } = requireCaller(req);
+	if (orgId !== ctx.actingOrgId) apiError(403, ApiErrorCode.FORBIDDEN, "Apps can only be connected to your current organization.");
+	const picked = (await listUserMemberships(req.deps.orgs, ctx.userId)).find(({ org }) => org.id === orgId);
+	if (!picked) apiError(403, ApiErrorCode.FORBIDDEN, "You aren’t a member of that organization.");
+	return mintApiToken({
+		...req,
+		ctx: await contextIn(req, picked.member)
+	}, input);
+}
+/**
+* Revoke a consent key whose code was never redeemed, so an abandoned sign-in
+* doesn't leave a live key nobody holds. A used key is kept: its code may have
+* been redeemed on another replica.
+*/
+async function revokeUnredeemedConsentToken(req, tokenId) {
+	const store = req.deps.data.apiTokens;
+	if (!store) return;
+	const { ctx } = requireCaller(req);
+	const token = await store.get(ctx, tokenId);
+	if (!token || token.revokedAt || token.lastUsedAt) return;
+	await store.revoke(ctx, tokenId, "owner");
+}
+
+export { revokeOwnApiToken as A, getOrg as B, uploadOrgAsset as C, removeOrgAsset as D, getOrgCompute as E, updateOrgCompute as F, listInvites as G, createInvite as H, revokeInvite as I, resendInvite as J, listOrgMembers as K, updateOrgMember as L, removeOrgMember as M, listApiTokens as N, createApiToken as O, revokeApiToken as P, listProjects as Q, createProject as R, getProject as S, updateProject as T, deleteProject as U, listProjectMembers as V, addProjectMember as W, updateProjectMemberRole as X, removeProjectMember as Y, reclaimProject as Z, mintConsentToken as a, canManageApiTokenRoster as b, consentOffer as c, revokeUserApiTokens as d, listDefinitions as e, createDefinition as f, getDefinition as g, deleteDefinition as h, uploadDefinitionImage as i, getDefinitionSchema as j, listShareLinks as k, listOrgApiTokens as l, mayHoldApiTokens as m, createShareLink as n, revokeShareLink as o, publishDefinition as p, listVersions as q, revokeUnredeemedConsentToken as r, uploadVersion as s, getVersion as t, updateDefinition as u, deleteVersion as v, getVersionSchema as w, getMe as x, starDefinition as y, unstarDefinition as z };
+//# sourceMappingURL=handlers.js-Bal7QqCB.js.map