@selvajs/selva 4.20.0-beta.3 → 4.20.0-beta.5

package/build/server/chunks/chunks/handlers.js-BxdLV14n.js

@@ -0,0 +1,1482 @@
+import { h as hasPermission, m as toDefinitionListItem, C as CreateDefinitionInputSchema, G as GH_EXTENSIONS, U as UpdateMetadataInputSchema, p as GuidSchema, q as PublishVersionInputSchema, r as CreateShareLinkInputSchema, u as OrgAssetKindSchema, M as MEMBER_ASSIGNABLE_PERMISSIONS, D as DEFAULT_ORG_PERMISSIONS, a as ALL_ORG_PERMISSIONS, v as parseApiScope, w as describeApiScope, x as validateProjectFlags, S as SYSTEM_CONTEXT, o as outsideTokenOrg, k as slugify } from './src.js-qWxoV-ql.js';
+import './providers.server.js-DNVO4BPz.js';
+import { l as listVisibleDefinitions, d as resolveAccessibleProjects, g as getVisibleDefinition, e as loadVisibleVersion } from './definitions.js-niXE0HY4.js';
+import { D as DEFAULT_SHARE_LINK_MAX_SOLVES } from './types.js-B_zdqlv_.js';
+import { r as resolveServerForOrg, a as isOrgServer, i as isPlatformServer, v as validateIncomingServers, c as storedKeysById, e as resolveApiKey, b as serversVisibleTo } from './compute.js-CY-c-64z.js';
+import { g as requireCanCreateDefinition, h as requireEditableDefinition, i as requireActingOrg, j as requireManageOrgMembers, k as requireManageOrgCompute, l as splitFlatPermissions, m as assertCanGrantPlatformPermissions, n as canActorChangeOrgRole, o as canChangeOrgRole, q as requireCanViewProject, t as requireCanCreateProject, p as projectAccessInputFromRowsWith, c as canView, u as canSolve, f as canEdit, v as requireCanEditProjectSettings, w as withAdminBypass, x as requireCanManage, y as requireTargetIsOrgMember, z as checkOwnerRemoval, A as requireCanReclaim, B as canChangeVisibilityToPublic } from './access.js-DfErwlEj.js';
+import { a as apiError, A as ApiErrorCode, f as fetchSchemaFromCompute, d as actorOf, g as isApiError } from './schema-extraction.js-BPImouBL.js';
+import { s as scopeRefusalsToday, p as parseDefinitionListOptions, f as assertScope, g as parseListOptions, h as ShareLinkResponseSchema, i as CreatedShareLinkResponseSchema, j as OrgComputeResponseSchema, O as OrgComputePatchBodySchema, I as InviteResponseSchema, c as CreateInviteBodySchema, k as CreatedInviteResponseSchema, b as UpdateOrgMemberBodySchema, l as ApiTokenResponseSchema, d as CreateApiTokenBodySchema, m as CreatedApiTokenResponseSchema, C as CreateProjectBodySchema, U as UpdateProjectBodySchema, A as AddProjectMemberBodySchema, a as UpdateProjectMemberBodySchema } from './api.js-BuuiOavj.js';
+import { r as requireCaller, a as requireUpload, f as formText, t as throwZodError, p as parseParam, b as parseBody, c as requireParams } from './request.js-D-Gm-jQy.js';
+import { e as evictChangedServers } from './evict-changed-servers.js-whgDVM5R.js';
+import { c as createProjectWithUniqueSlug } from './projects.js-BxeFPAzk.js';
+import { c as canHoldApiTokens } from './api-token-holder.js-DD8t6go4.js';
+import { randomUUID } from 'node:crypto';
+
+//#region ../server/src/api/responses.ts
+/** A paginated collection. The one envelope every list endpoint returns. */
+function collection(page) {
+	return { body: {
+		items: page.items,
+		nextCursor: page.nextCursor
+	} };
+}
+/** A created resource. */
+function created(body) {
+	return {
+		status: 201,
+		body
+	};
+}
+/** A successful mutation with nothing to say. */
+function noContent() {
+	return { status: 204 };
+}
+//#endregion
+//#region ../server/src/api/shaped.ts
+/** Serialize a payload through an explicit response schema. */
+function shaped(schema, payload, status = 200) {
+	return {
+		status,
+		body: schema.parse(payload)
+	};
+}
+/** `shaped`, mapped over a page of records. */
+function shapedCollection(schema, page) {
+	return { body: {
+		items: page.items.map((item) => schema.parse(item)),
+		nextCursor: page.nextCursor
+	} };
+}
+//#endregion
+//#region ../notifications/src/html.ts
+/**
+* Escape text for interpolation into an HTML attribute or text node.
+*
+* One copy on purpose: per-template copies are how one of them ends up missing
+* a case. Every value a template interpolates goes through this, including
+* URLs — an `acceptUrl` carries a token, and a token can contain characters
+* that would otherwise close the `href` early.
+*/
+function escapeHtml(s) {
+	return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+//#endregion
+//#region ../notifications/src/layout.ts
+/**
+* The frame every Selva mail shares: card chrome, type stack, colours.
+* Templates supply a body; this supplies the look, so mail written by
+* different people at different times still reads as coming from one product.
+*
+* Deliberately plain — no images, no tracking pixel, no external stylesheet.
+* Inline styles with a table-free layout survive the common clients, and mail
+* clients that strip the styling still get readable, ordered content.
+*/
+function renderLayout({ heading, body, footer }) {
+	return `<!doctype html>
+<html>
+<body style="margin:0;padding:24px;background:#f6f7f9;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif;color:#1a1a1a;">
+	<div style="max-width:480px;margin:0 auto;background:#ffffff;border:1px solid #e4e6eb;border-radius:12px;padding:32px;">
+		<h1 style="margin:0 0 16px;font-size:20px;font-weight:600;">${escapeHtml(heading)}</h1>
+${body}${footer ? `
+		<hr style="border:none;border-top:1px solid #e4e6eb;margin:24px 0;" />
+		<p style="margin:0;font-size:12px;line-height:1.5;color:#8a8a8a;">
+			${footer}
+		</p>` : ""}
+	</div>
+</body>
+</html>`;
+}
+/** The primary action button. One definition so every mail's call to action matches. */
+function renderButton(href, label) {
+	return `<a href="${escapeHtml(href)}" style="display:inline-block;padding:11px 20px;background:#1a1a1a;color:#ffffff;text-decoration:none;border-radius:8px;font-size:15px;font-weight:500;">${escapeHtml(label)}</a>`;
+}
+/**
+* Fallback for clients that do not make the button clickable. Every mail whose
+* point is a link needs this: a button that does not render leaves the reader
+* with no way to continue.
+*/
+function renderUrlFallback(href) {
+	return `<p style="margin:24px 0 0;font-size:13px;line-height:1.5;color:#6b6b6b;">
+			Or paste this into your browser:<br />
+			<span style="word-break:break-all;color:#4a4a4a;">${escapeHtml(href)}</span>
+		</p>`;
+}
+//#endregion
+//#region ../notifications/src/templates/invite.ts
+function formatExpiry(iso) {
+	const d = new Date(iso);
+	return Number.isNaN(d.getTime()) ? "soon" : d.toLocaleDateString("en-US", {
+		year: "numeric",
+		month: "long",
+		day: "numeric"
+	});
+}
+/**
+* "An admin invited you to an org" — the mail carrying an invite's accept link.
+*
+* The text part must always carry the URL: a mail that degrades to plain text
+* is still the only way the invitee can accept.
+*/
+function renderInviteEmail(input) {
+	const { to, acceptUrl, orgName, invitedBy } = input;
+	const expiry = formatExpiry(input.expiresAt);
+	const inviter = invitedBy ? `${invitedBy} invited you` : "You have been invited";
+	return {
+		kind: "org.invite",
+		to,
+		subject: `${inviter} to join ${orgName} on Selva`,
+		text: [
+			`${inviter} to join ${orgName} on Selva.`,
+			"",
+			"Open this link to accept and set up your account:",
+			acceptUrl,
+			"",
+			`The link expires on ${expiry} and can only be used once.`,
+			"",
+			"If you weren't expecting this invitation, you can ignore this email."
+		].join("\n"),
+		html: renderLayout({
+			heading: `Join ${orgName} on Selva`,
+			body: `		<p style="margin:0 0 24px;font-size:15px;line-height:1.5;color:#4a4a4a;">
+			${escapeHtml(inviter)} to join <strong>${escapeHtml(orgName)}</strong>. Open the link below to accept and set up your account.
+		</p>
+		${renderButton(acceptUrl, "Accept invitation")}
+		${renderUrlFallback(acceptUrl)}`,
+			footer: `This link expires on ${escapeHtml(expiry)} and can only be used once.
+			If you weren't expecting this invitation, you can ignore this email.`
+		})
+	};
+}
+//#endregion
+//#region ../notifications/src/templates/api-token.ts
+function formatDate(iso) {
+	const d = new Date(iso);
+	return Number.isNaN(d.getTime()) ? iso : d.toLocaleDateString("en-US", {
+		year: "numeric",
+		month: "long",
+		day: "numeric"
+	});
+}
+/**
+* "A new API token was created on your account". The point is the case where
+* the owner didn't create it, so the revoke link leads.
+*/
+function renderApiTokenCreatedEmail(input) {
+	const { to, tokenName, orgName, scopes, manageUrl } = input;
+	const expiry = formatDate(input.expiresAt);
+	return {
+		kind: "api_token.created",
+		to,
+		subject: `New API token "${tokenName}" in ${orgName}`,
+		text: [
+			`A new API token named "${tokenName}" was created on your Selva account in ${orgName}.`,
+			"",
+			"It can:",
+			...scopes.map((s) => `- ${s}`),
+			"",
+			`It expires on ${expiry}.`,
+			"",
+			"If you didn't create it, revoke it now:",
+			manageUrl
+		].join("\n"),
+		html: renderLayout({
+			heading: "New API token",
+			body: `		<p style="margin:0 0 16px;font-size:15px;line-height:1.5;color:#4a4a4a;">
+			A new API token named <strong>${escapeHtml(tokenName)}</strong> was created on your account in <strong>${escapeHtml(orgName)}</strong>. It can:
+		</p>
+		<ul style="margin:0 0 24px;padding-left:20px;font-size:15px;line-height:1.5;color:#4a4a4a;">
+			${scopes.map((s) => `<li>${escapeHtml(s)}</li>`).join("")}
+		</ul>
+		${renderButton(manageUrl, "Review your tokens")}
+		${renderUrlFallback(manageUrl)}`,
+			footer: `It expires on ${escapeHtml(expiry)}. If you didn't create it, revoke it from the page above.`
+		})
+	};
+}
+//#endregion
+//#region ../server/src/notifications/deliver-invite.ts
+/**
+* Mail an invite's accept link, best-effort.
+*
+* Shared by the mint and resend routes so they cannot disagree about what the
+* invitee receives. Swallows every failure: the invite row is already
+* committed and the caller still holds `acceptUrl` to share by hand, so a dead
+* SMTP host must not report a valid invite as a failure.
+*/
+async function deliverInvite(input) {
+	const { ctx, log, invite, acceptUrl, actor, orgs, notifications, fallbackOrgName } = input;
+	try {
+		const org = await orgs.getOrg(ctx, invite.orgId);
+		const { status } = await notifications.send(renderInviteEmail({
+			to: invite.email,
+			acceptUrl,
+			orgName: org?.name ?? fallbackOrgName,
+			invitedBy: actor.profile?.displayName || actor.user?.email,
+			expiresAt: invite.expiresAt
+		}), log);
+		return status;
+	} catch (err) {
+		log.warn("Invite mail could not be prepared", {
+			component: "Invites",
+			inviteId: invite.id,
+			reason: err instanceof Error ? err.message : String(err)
+		});
+		return "failed";
+	}
+}
+//#endregion
+//#region ../server/src/handlers/services.ts
+function definitionService(deps) {
+	const service = deps.services.definitions;
+	if (!service) throw new Error("SelvaDeps.services.definitions is not wired — mount requires it.");
+	return service;
+}
+function orgAssetService(deps) {
+	const service = deps.services.orgAssets;
+	if (!service) throw new Error("SelvaDeps.services.orgAssets is not wired — mount requires it.");
+	return service;
+}
+/**
+* A token codec, or a named failure.
+*
+* Minting through an absent codec is the one failure mode worth being loud
+* about: a handler that quietly skipped hashing would persist a row whose token
+* can never be verified, and nothing downstream would report it.
+*/
+function tokenCodec(deps, family) {
+	const codec = deps.tokens[family];
+	if (!codec) throw new Error(`SelvaDeps.tokens.${family} is not wired — mount requires it.`);
+	return codec;
+}
+//#endregion
+//#region ../server/src/handlers/me.ts
+/**
+* Whoami. The first call a non-browser client makes, and the only way a token
+* holder can see which org their credential resolved into — `actingOrgId` is
+* derived per request from the caller's membership, not frozen at mint time.
+*/
+var getMe = async (req) => {
+	const { ctx, user } = requireCaller(req);
+	return { body: {
+		userId: user.id,
+		email: user.email,
+		displayName: req.profile?.displayName,
+		actingOrgId: ctx.actingOrgId,
+		platformPermissions: ctx.platformPermissions,
+		orgPermissions: ctx.orgPermissions,
+		starredDefinitions: req.profile?.starredDefinitions ?? []
+	} };
+};
+//#endregion
+//#region ../server/src/handlers/me.starred.ts
+/**
+* Starring a definition for the calling user. Both directions are idempotent.
+*
+* No visibility check: a star is a row on the caller's own profile, keyed by
+* guid, and reveals nothing about whether that guid exists. The read paths that
+* expand stars into definitions filter by visibility there.
+*/
+var starDefinition = async (req) => {
+	const { ctx, user } = requireCaller(req);
+	const { guid } = requireParams(req.params, "guid");
+	await req.deps.userProfile.starDefinition(ctx, user.id, guid);
+	return noContent();
+};
+var unstarDefinition = async (req) => {
+	const { ctx, user } = requireCaller(req);
+	const { guid } = requireParams(req.params, "guid");
+	await req.deps.userProfile.unstarDefinition(ctx, user.id, guid);
+	return noContent();
+};
+//#endregion
+//#region ../server/src/handlers/orgs.ts
+/**
+* The acting org's record and roster.
+*
+* `requireActingOrg` is the tenancy gate on both: the URL `orgId` must equal
+* `ctx.actingOrgId`, so the URL alone never decides which tenant is read.
+*/
+/** The acting org's record — name, slug, and branding asset URLs. */
+var getOrg = async (req) => {
+	const { ctx, orgId } = requireActingOrg(req, req.params.orgId);
+	const org = await req.deps.orgs.getOrg(ctx, orgId);
+	if (!org) apiError(404, ApiErrorCode.NOT_FOUND, "Organization not found");
+	return { body: org };
+};
+/**
+* List the org's members. Any member of the acting org may read this — the
+* roster is what the team page renders, and `requireActingOrg` already confines
+* the read to the caller's own tenant.
+*/
+var listOrgMembers = async (req) => {
+	const { ctx, orgId } = requireActingOrg(req, req.params.orgId);
+	return collection(await req.deps.orgs.listOrgMembers(ctx, orgId, parseListOptions(req.url)));
+};
+//#endregion
+//#region ../server/src/handlers/apiTokens.ts
+/**
+* API tokens: mint, list, revoke.
+*
+* **Session-only.** A key can't manage keys, so a leaked one can't mint more or
+* revoke the owner's others to cover its tracks.
+*
+* **The raw key exists only in the mint response.** The store holds its HMAC,
+* and every response goes through a schema that has no `tokenHash`.
+*/
+var DAY_MS = 864e5;
+function requireSessionInOrg(req) {
+	if (req.ctx?.apiScope) apiError(403, ApiErrorCode.FORBIDDEN, "API tokens can’t manage API tokens. Sign in to the web app to do this.");
+	return requireActingOrg(req, req.params.orgId);
+}
+function requireMayHoldApiTokens(req, ctx) {
+	if (!canHoldApiTokens(ctx, req.deps.tokens.mayHoldApiTokens)) apiError(403, ApiErrorCode.FORBIDDEN, "You can’t create API tokens in this org.");
+}
+function unavailable() {
+	apiError(503, ApiErrorCode.API_TOKENS_UNAVAILABLE, "API tokens are not available on this server.");
+}
+function storeOf(req) {
+	return req.deps.data.apiTokens ?? unavailable();
+}
+function codecOf(req) {
+	return req.deps.tokens.apiTokens ?? unavailable();
+}
+function toResponse(token) {
+	return {
+		...token,
+		refusedToday: scopeRefusalsToday(token.id)
+	};
+}
+/** Who sees every owner's keys in an org and may revoke any of them. */
+var canManageApiTokenRoster = (ctx) => hasPermission(ctx, "manage_org_members");
+/**
+* Keys in `orgId`, newest first, including revoked and expired ones: the
+* caller's own, or with `roster` everyone's. The list endpoint and a host's
+* token page both read through here, so they can't disagree on who sees what.
+*/
+async function listOrgApiTokens(store, ctx, orgId, { roster = false, ...opts } = {}) {
+	if (roster && !canManageApiTokenRoster(ctx)) apiError(403, ApiErrorCode.FORBIDDEN, "Only org admins can see everyone’s API tokens.");
+	const page = await store.listByOrg(ctx, orgId, {
+		...opts,
+		userId: roster ? void 0 : ctx.userId
+	});
+	return {
+		...page,
+		items: page.items.map(toResponse)
+	};
+}
+/**
+* Refuse scopes naming something outside this org or out of the creator's
+* sight. Not the security boundary: a key never exceeds its owner's live rights
+* anyway. This stops someone minting a key that can only ever be refused.
+*/
+async function assertScopesReachable(req, orgId, scopes) {
+	const refuse = (message) => apiError(400, ApiErrorCode.VALIDATION_FAILED, message, { scopes: message });
+	for (const value of scopes) {
+		const { resource } = parseApiScope(value) ?? refuse(`Unknown scope: ${value}`);
+		if (resource.kind === "all") continue;
+		if (resource.kind === "org") {
+			if (resource.id !== orgId) refuse("An org scope must name this org.");
+			continue;
+		}
+		let projectId = resource.id;
+		if (resource.kind === "definition") projectId = (await req.deps.definitionMeta.get(req.ctx, resource.id) ?? refuse(`No definition ${resource.id}.`)).projectId;
+		const project = await req.deps.projects.getProject(req.ctx, projectId);
+		if (!project || project.orgId !== orgId) refuse(`No ${resource.kind} ${resource.id} in this org.`);
+		try {
+			await requireCanViewProject(req, projectId);
+		} catch (err) {
+			if (isApiError(err)) refuse(`You can’t access ${resource.kind} ${resource.id}.`);
+			throw err;
+		}
+	}
+}
+/**
+* Tell the owner a key now exists on their account, best-effort. The case that
+* matters is the one where they didn't make it.
+*/
+async function mailTokenCreated(req, token) {
+	const notifications = req.deps.notifications;
+	const to = req.user?.email;
+	if (!notifications || !to) return;
+	try {
+		const org = await req.deps.orgs.getOrg(req.ctx, token.orgId);
+		await notifications.send(renderApiTokenCreatedEmail({
+			to,
+			tokenName: token.name,
+			orgName: org?.name ?? req.deps.instanceName,
+			scopes: token.scopes.map(describeApiScope),
+			expiresAt: token.expiresAt,
+			manageUrl: `${req.url.origin}${req.deps.apiTokenSettingsPath}`
+		}), req.log);
+	} catch (err) {
+		req.log.warn("API token mail could not be sent", {
+			component: "ApiTokens",
+			tokenId: token.id,
+			reason: err instanceof Error ? err.message : String(err)
+		});
+	}
+}
+/** The caller's own keys in this org. `?all=true` returns everyone's and needs `manage_org_members`. */
+var listApiTokens = async (req) => {
+	const { ctx, orgId } = requireSessionInOrg(req);
+	const page = await listOrgApiTokens(storeOf(req), ctx, orgId, {
+		...parseListOptions(req.url),
+		roster: req.url.searchParams.get("all") === "true"
+	});
+	return shapedCollection(ApiTokenResponseSchema, page);
+};
+/** Mint a token acting as the caller. The raw key is in this response and nowhere else. */
+var createApiToken = async (req) => {
+	const { ctx, orgId } = requireSessionInOrg(req);
+	requireMayHoldApiTokens(req, ctx);
+	const { user } = requireCaller(req);
+	const store = storeOf(req);
+	const codec = codecOf(req);
+	const delegated = req.deps.auth.delegatedSession;
+	if (delegated && !(await delegated.status()).ok) unavailable();
+	const input = await parseBody(req.request, CreateApiTokenBodySchema);
+	await assertScopesReachable(req, orgId, input.scopes);
+	const raw = codec.mintRawToken();
+	const now = /* @__PURE__ */ new Date();
+	const token = {
+		id: randomUUID(),
+		userId: user.id,
+		createdBy: user.id,
+		orgId,
+		name: input.name,
+		tokenHash: codec.hashToken(raw),
+		scopes: [...new Set(input.scopes)],
+		createdAt: now.toISOString(),
+		expiresAt: new Date(now.getTime() + input.expiresInDays * DAY_MS).toISOString(),
+		lastUsedAt: null,
+		revokedAt: null
+	};
+	await store.create(ctx, token);
+	await mailTokenCreated(req, token);
+	const { tokenHash: _hash, ...summary } = token;
+	return {
+		status: 201,
+		headers: { "Cache-Control": "no-store" },
+		body: CreatedApiTokenResponseSchema.parse({
+			token: toResponse(summary),
+			secret: raw
+		})
+	};
+};
+/**
+* Revoke a token: the owner's own, or anyone's in the org for
+* `manage_org_members`. Someone else's token reads as missing, not forbidden.
+*/
+var revokeApiToken = async (req) => {
+	const { ctx, orgId } = requireSessionInOrg(req);
+	const { tokenId } = requireParams(req.params, "tokenId");
+	const store = storeOf(req);
+	const token = await store.get(ctx, tokenId);
+	const own = token?.userId === ctx.userId;
+	if (!token || token.orgId !== orgId || !own && !canManageApiTokenRoster(ctx)) apiError(404, ApiErrorCode.NOT_FOUND, "API token not found");
+	await store.revoke(ctx, tokenId, own ? "owner" : "admin");
+	return noContent();
+};
+/**
+* Revoke every live key `userId` holds, in one org or (no `orgId`) all of
+* them. Call it when someone leaves an org or is disabled: the resolver already
+* refuses those keys, but without this they would work again the moment the
+* person is re-added or re-enabled.
+*
+* Best effort. The removal or disable has already committed, so a failure is
+* logged rather than thrown.
+*/
+async function revokeUserApiTokens(store, ctx, userId, opts, log) {
+	if (!store) return;
+	try {
+		await store.revokeAllForUser(ctx, userId, opts);
+	} catch (err) {
+		log.error("Failed to revoke API tokens", {
+			component: "ApiTokens",
+			userId,
+			orgId: opts.orgId,
+			reason: opts.reason,
+			err: err instanceof Error ? err.message : String(err)
+		});
+	}
+}
+//#endregion
+//#region ../server/src/handlers/orgMembers.ts
+/**
+* Org member role, permissions, and removal.
+*
+* Two gates run on every request: `requireManageOrgMembers` (owner+admin) and
+* `requireActingOrg` (the URL `orgId` must equal `ctx.actingOrgId`, so
+* cross-org member mutation is blocked even for an actor with permissions in
+* another org).
+*
+* The sole-owner invariant applies to demotion and removal alike — an org with
+* no owner is unadministrable, and removing an owner ends their role exactly as
+* demoting them does.
+*/
+var ROSTER_PAGE_LIMIT = 200;
+var MAX_ROSTER_PAGES = 100;
+/**
+* Whether anyone other than `exceptUserId` still owns the org.
+*
+* Both branches below need this and both used to scan the roster themselves —
+* the sole-owner invariant is one rule, so it reads from one place.
+*
+* Pages rather than reading one 200-row window: a second owner sitting past the
+* first page read as "no other owner", so the invariant refused a demotion or
+* removal that was in fact safe. That failed closed, but it made the org
+* unadministrable exactly when it had grown enough to need administering.
+* Returns on the first owner found, so the common case is still one round-trip.
+*/
+async function hasAnotherOwner(req, ctx, orgId, exceptUserId) {
+	let cursor;
+	for (let page = 0; page < MAX_ROSTER_PAGES; page++) {
+		const result = await req.deps.orgs.listOrgMembers(ctx, orgId, {
+			limit: ROSTER_PAGE_LIMIT,
+			cursor
+		});
+		if (result.items.some((m) => m.role === "owner" && m.userId !== exceptUserId && !m.deletedAt)) return true;
+		cursor = result.nextCursor;
+		if (!cursor) return false;
+	}
+	req.log.warn("hasAnotherOwner hit the page cap — treating as sole owner", {
+		orgId,
+		pages: MAX_ROSTER_PAGES
+	});
+	return false;
+}
+/**
+* Projects in `orgId` where `userId` is the only live owner — the ones that
+* will have no owner once `removeOrgMember` cascades their membership rows.
+*
+* **Report, do not block.** Blocking puts an unbounded chore in front of
+* offboarding — the cost scales with how many projects the departing person
+* owned, which is backwards, because the most prolific people are the ones
+* whose departure most needs to be clean. An offboarding that fails halfway is
+* worse than an ownerless project: the person stays in the org while someone
+* works through the backlog. Reclaim already exists to adopt an ownerless
+* project, so the recovery path is built; what was missing was any signal that
+* recovery was needed. Hence the event.
+*
+* MUST be called before the removal — afterwards the rows it reads are gone.
+*/
+async function findProjectsLosingSoleOwner(req, ctx, orgId, userId) {
+	const projects = req.deps.projects;
+	const orgProjects = await projects.listProjects(ctx, orgId, { limit: ROSTER_PAGE_LIMIT });
+	return (await Promise.all(orgProjects.items.map(async (project) => {
+		const owners = (await projects.listProjectMembers(ctx, project.id, { limit: ROSTER_PAGE_LIMIT })).items.filter((m) => m.role === "owner" && !m.deletedAt);
+		return owners.length === 1 && owners[0].userId === userId ? project : null;
+	}))).filter((p) => p !== null);
+}
+/**
+* Body accepts either or both:
+*   - `{ role: OrgRole }` — change the member's role. Owner-only.
+*   - `{ permissions: OrgPermission[] }` — replace the member's grantable
+*     permissions. Owner/admin via `manage_org_members`. For `member`-role
+*     targets, only `MEMBER_ASSIGNABLE_PERMISSIONS` are accepted; promoting a
+*     member's permissions does NOT change their role.
+*/
+var updateOrgMember = async (req) => {
+	const { userId } = requireParams(req.params, "orgId", "userId");
+	requireManageOrgMembers(req);
+	const { ctx, orgId } = requireActingOrg(req, req.params.orgId);
+	const patch = await parseBody(req.request, UpdateOrgMemberBodySchema);
+	const orgs = req.deps.orgs;
+	const [actorMember, target] = await Promise.all([orgs.getOrgMember(ctx, orgId, ctx.userId), orgs.getOrgMember(ctx, orgId, userId)]);
+	if (!target) apiError(404, ApiErrorCode.NOT_FOUND, "Member not found in this organization.");
+	if (!actorMember) apiError(403, ApiErrorCode.FORBIDDEN, "You are not a member of this organization.");
+	if (patch.role !== void 0 && patch.role !== target.role) {
+		if (!canChangeOrgRole({
+			actorMember,
+			role: patch.role
+		}) || !canChangeOrgRole({
+			actorMember,
+			role: target.role
+		})) apiError(403, ApiErrorCode.FORBIDDEN, "Only the org owner can change roles.");
+		if (target.role === "owner" && patch.role !== "owner" && !await hasAnotherOwner(req, ctx, orgId, target.userId)) apiError(409, ApiErrorCode.CONFLICT, "Cannot demote the sole owner of this organization. Promote another member to owner first.");
+		await orgs.updateOrgMemberRole(ctx, orgId, userId, patch.role);
+	}
+	if (patch.permissions !== void 0) {
+		const effectiveRole = patch.role ?? target.role;
+		const valid = effectiveRole === "member" ? new Set(MEMBER_ASSIGNABLE_PERMISSIONS) : new Set(ALL_ORG_PERMISSIONS);
+		const invalid = patch.permissions.filter((p) => !valid.has(p));
+		if (invalid.length > 0) apiError(400, ApiErrorCode.VALIDATION_FAILED, `Permissions [${invalid.join(", ")}] cannot be assigned to a ${effectiveRole}.`);
+		await orgs.updateOrgMemberPermissions(ctx, orgId, userId, patch.permissions);
+	}
+	return noContent();
+};
+/**
+* Remove a member from the org. Owner/admin via `manage_org_members`, same
+* tenancy check as PATCH, and the same sole-owner invariant — removing the last
+* owner would leave the org unadministrable.
+*/
+var removeOrgMember = async (req) => {
+	const { userId } = requireParams(req.params, "orgId", "userId");
+	requireManageOrgMembers(req);
+	const { ctx, orgId } = requireActingOrg(req, req.params.orgId);
+	const orgs = req.deps.orgs;
+	const [actorMember, target] = await Promise.all([orgs.getOrgMember(ctx, orgId, ctx.userId), orgs.getOrgMember(ctx, orgId, userId)]);
+	if (!target) apiError(404, ApiErrorCode.NOT_FOUND, "Member not found in this organization.");
+	if (!canChangeOrgRole({
+		actorMember,
+		role: target.role
+	})) apiError(403, ApiErrorCode.FORBIDDEN, "Only the org owner can remove another owner.");
+	if (target.role === "owner" && !await hasAnotherOwner(req, ctx, orgId, target.userId)) apiError(409, ApiErrorCode.CONFLICT, "Cannot remove the sole owner of this organization. Promote another member to owner first.");
+	const orphaned = await findProjectsLosingSoleOwner(req, ctx, orgId, userId);
+	await orgs.removeOrgMember(ctx, orgId, userId);
+	if (orphaned.length > 0) {
+		await req.deps.events.emit({
+			type: "org_member.removed_orphaning_projects",
+			orgId,
+			userId,
+			projectIds: orphaned.map((p) => p.id),
+			...actorOf(ctx)
+		});
+		req.log.warn("Org member removal left projects without an owner", {
+			orgId,
+			userId,
+			actorId: ctx.userId,
+			projectCount: orphaned.length
+		});
+	}
+	const email = (await req.deps.auth.getUser(userId))?.email;
+	if (email) try {
+		await req.deps.invites.revokePendingByEmail(ctx, orgId, email);
+	} catch (err) {
+		req.log.error("Removed org member but failed to revoke their pending invites", {
+			orgId,
+			userId,
+			error: err instanceof Error ? err.message : String(err)
+		});
+	}
+	await revokeUserApiTokens(req.deps.data.apiTokens, ctx, userId, {
+		orgId,
+		reason: "member_removed"
+	}, req.log);
+	return noContent();
+};
+//#endregion
+//#region ../server/src/handlers/reclaim.ts
+/**
+* Org owner/admin escape hatch for a project they cannot otherwise reach.
+*
+* Adds the actor as a co-owner and does NOT demote the existing owner.
+* Idempotent: reclaiming twice is a no-op, because `addProjectMember`
+* reactivates a soft-deleted row in place.
+*/
+var reclaimProject = async (req) => {
+	const { id } = requireParams(req.params, "id");
+	const { user, ctx, project } = await requireCanReclaim(req, id);
+	const now = (/* @__PURE__ */ new Date()).toISOString();
+	const member = {
+		projectId: id,
+		userId: user.id,
+		role: "owner",
+		joinedAt: now,
+		updatedAt: now,
+		updatedBy: ctx.userId || user.id,
+		deletedAt: null
+	};
+	await req.deps.projects.addProjectMember(ctx, member);
+	await req.deps.events.emit({
+		type: "project.reclaimed",
+		projectId: id,
+		orgId: project.orgId,
+		...actorOf(ctx),
+		priorVisibility: project.visibility
+	});
+	return created({ member });
+};
+//#endregion
+//#region ../server/src/handlers/orgAssets.ts
+/**
+* Org branding assets, generic over kind (`logo`, `favicon`, …). Gated on
+* `manage_org_members` — org branding is an org-admin action.
+*
+* Raster images and SVG are both accepted. Every input is rasterized to WebP by
+* the shared transcoder inside the storage provider, so SVG carries no XSS
+* surface: no vector blob is ever stored or served. The allowlist below is the
+* HTTP gate; the rasterization is the security control.
+*/
+var ALLOWED_CONTENT_TYPES = /* @__PURE__ */ new Set([
+	"image/png",
+	"image/jpeg",
+	"image/webp",
+	"image/gif",
+	"image/svg+xml"
+]);
+function parseKind(params) {
+	const kind = OrgAssetKindSchema.safeParse(params.kind);
+	if (!kind.success) apiError(404, ApiErrorCode.NOT_FOUND, `Unknown asset kind '${params.kind}'`);
+	return kind.data;
+}
+var uploadOrgAsset = async (req) => {
+	requireManageOrgMembers(req);
+	const kind = parseKind(req.params);
+	const { ctx, orgId } = requireActingOrg(req, req.params.orgId);
+	if (!await req.deps.orgs.getOrg(ctx, orgId)) apiError(404, ApiErrorCode.NOT_FOUND, "Organization not found");
+	const { file } = requireUpload(await req.request.formData(), "image", {
+		maxBytes: req.deps.uploadLimits.maxImageFileSize,
+		contentTypes: {
+			allowed: ALLOWED_CONTENT_TYPES,
+			message: "Unsupported image type. Allowed: PNG, JPG, WebP, GIF, SVG"
+		},
+		label: "Image"
+	});
+	const bytes = new Uint8Array(await file.arrayBuffer());
+	return { body: {
+		kind,
+		url: await orgAssetService(req.deps).saveAsset(ctx, orgId, kind, bytes, file.type)
+	} };
+};
+var removeOrgAsset = async (req) => {
+	requireManageOrgMembers(req);
+	const kind = parseKind(req.params);
+	const { ctx, orgId } = requireActingOrg(req, req.params.orgId);
+	await orgAssetService(req.deps).removeAsset(ctx, orgId, kind);
+	return noContent();
+};
+//#endregion
+//#region ../server/src/handlers/shareLinks.ts
+/**
+* Share-link administration.
+*
+* Minting, listing and revoking are gated by `canEditDefinition` — the same
+* authority that uploads versions and publishes. The raw token appears in the
+* POST response and nowhere else; everything afterwards sees `hasToken: true`.
+*
+* **Responses go through `shaped`/`shapedCollection`, never `{ body }`.** A
+* `ShareLink` carries `tokenHash`, and the response schema is what drops it —
+* returning the record directly would put a credential hash on the wire with
+* nothing failing at build time.
+*/
+function assertSharingEnabled(req) {
+	if (!req.deps.flag("ENABLE_SHARING")) apiError(404, ApiErrorCode.NOT_FOUND, "Share links are disabled on this instance (ENABLE_SHARING).");
+}
+/** `tokenHash` is dropped by the response schema, not by this function. */
+function forClient(link) {
+	return {
+		...link,
+		hasToken: true
+	};
+}
+var listShareLinks = async (req) => {
+	assertSharingEnabled(req);
+	const guid = parseParam(req.params.guid, GuidSchema, "GUID");
+	const { ctx } = await requireEditableDefinition(req, guid);
+	const page = await req.deps.shareLinks.listByDefinition(ctx, guid, parseListOptions(req.url));
+	return shapedCollection(ShareLinkResponseSchema, {
+		items: page.items.map(forClient),
+		nextCursor: page.nextCursor
+	});
+};
+var createShareLink = async (req) => {
+	assertSharingEnabled(req);
+	const guid = parseParam(req.params.guid, GuidSchema, "GUID");
+	const { user } = requireCaller(req);
+	const { ctx } = await requireEditableDefinition(req, guid);
+	const input = await parseBody(req.request, CreateShareLinkInputSchema, { missingAs: {} });
+	const codec = tokenCodec(req.deps, "shareLinks");
+	const raw = codec.mintRawToken();
+	const link = {
+		id: randomUUID(),
+		definitionId: guid,
+		channel: input.channel,
+		tokenHash: codec.hashToken(raw),
+		name: input.name,
+		createdBy: user.id,
+		createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+		expiresAt: input.expiresAt ?? null,
+		revokedAt: null,
+		allowSolve: input.allowSolve,
+		maxSolves: input.maxSolves === void 0 ? DEFAULT_SHARE_LINK_MAX_SOLVES : input.maxSolves,
+		solveCount: 0
+	};
+	await req.deps.shareLinks.create(ctx, link);
+	return shaped(CreatedShareLinkResponseSchema, {
+		link: forClient(link),
+		token: raw
+	}, 201);
+};
+/**
+* Revoke a share link (soft-delete). Idempotent, gated by `canEditDefinition`.
+*
+* The link must belong to this definition, so one definition's editor cannot
+* revoke another's link with a guessed or leaked linkId.
+*/
+var revokeShareLink = async (req) => {
+	assertSharingEnabled(req);
+	const guid = parseParam(req.params.guid, GuidSchema, "GUID");
+	const linkId = parseParam(req.params.linkId, GuidSchema, "link ID");
+	const { ctx } = await requireEditableDefinition(req, guid);
+	const existing = await req.deps.shareLinks.getById(ctx, linkId);
+	if (!existing || existing.definitionId !== guid) apiError(404, ApiErrorCode.NOT_FOUND, "Share link not found.");
+	await req.deps.shareLinks.revoke(ctx, linkId);
+	return noContent();
+};
+//#endregion
+//#region ../server/src/handlers/definitions.ts
+/**
+* Definition handlers: the collection, one definition's detail and metadata,
+* its live schema, cover image, and the publish channel.
+*
+* Solve and the two compute routes stay unwrapped deliberately — they stream
+* and mark their own metrics, which the `ApiResponse` envelope does not model.
+*/
+var LISTABLE_STATUSES = [
+	"draft",
+	"published",
+	"archived"
+];
+/**
+* Definitions the caller can view. Visibility is resolved into the query via
+* `projectIds`, so `limit`/`nextCursor` describe the filtered set.
+*/
+var listDefinitions = async (req) => {
+	const { ctx } = requireCaller(req);
+	const statusParam = req.url.searchParams.get("status");
+	if (statusParam && !LISTABLE_STATUSES.includes(statusParam)) apiError(400, ApiErrorCode.VALIDATION_FAILED, `status must be one of: ${LISTABLE_STATUSES.join(", ")}`);
+	const page = await listVisibleDefinitions(ctx, {
+		...parseDefinitionListOptions(req.url),
+		projectId: req.url.searchParams.get("projectId") ?? void 0,
+		statuses: statusParam ? [statusParam] : void 0
+	}, req.deps);
+	return collection({
+		items: page.items.map(toDefinitionListItem),
+		nextCursor: page.nextCursor
+	});
+};
+function parseTags(raw) {
+	if (!raw) return void 0;
+	const tags = raw.split(",").map((t) => t.trim()).filter(Boolean);
+	return tags.length ? tags : void 0;
+}
+/** Create a definition — metadata and the Grasshopper file in one request. */
+var createDefinition = async (req) => {
+	const { ctx, user } = requireCaller(req);
+	const form = await req.request.formData();
+	const { file, extension } = requireUpload(form, "file", {
+		maxBytes: req.deps.uploadLimits.maxDefinitionFileSize,
+		extensions: GH_EXTENSIONS,
+		label: "Grasshopper (.gh or .ghx) file"
+	});
+	const imageFile = form.get("image");
+	const maxImageBytes = req.deps.uploadLimits.maxImageFileSize;
+	if (imageFile instanceof File && imageFile.size > maxImageBytes) apiError(400, ApiErrorCode.VALIDATION_FAILED, `Image too large. Max size: ${maxImageBytes / 1048576} MB`);
+	let projectId = formText(form, "projectId");
+	if (!projectId) {
+		if (!ctx.actingOrgId) apiError(400, ApiErrorCode.VALIDATION_FAILED, "No active organization");
+		const { projects } = await resolveAccessibleProjects(ctx, req.deps);
+		const fallback = projects.find((p) => p.orgId === ctx.actingOrgId);
+		if (!fallback) apiError(400, ApiErrorCode.VALIDATION_FAILED, "No accessible project — pass projectId.");
+		projectId = fallback.id;
+	}
+	const { project } = await requireCanCreateDefinition(req, projectId);
+	const parsed = CreateDefinitionInputSchema.safeParse({
+		displayName: formText(form, "displayName"),
+		description: formText(form, "description"),
+		category: formText(form, "category"),
+		coverImage: formText(form, "coverImage"),
+		tags: parseTags(formText(form, "tags")),
+		projectId,
+		computeServerId: formText(form, "computeServerId")
+	});
+	if (!parsed.success) throwZodError(parsed.error);
+	const guid = randomUUID();
+	const fileData = new Uint8Array(await file.arrayBuffer());
+	const server = await resolveServerForOrg(ctx, project.orgId, req.deps.computeServer, { definitionPin: parsed.data.computeServerId ?? null });
+	const schema = await fetchSchemaFromCompute(fileData, server);
+	const service = definitionService(req.deps);
+	const { record, version } = await service.create(ctx, {
+		guid,
+		projectId: parsed.data.projectId,
+		ownerId: user.id,
+		fileExt: extension.slice(1),
+		originalFilename: file.name,
+		computeServerId: parsed.data.computeServerId,
+		displayName: parsed.data.displayName.trim(),
+		description: parsed.data.description,
+		category: parsed.data.category,
+		tags: parsed.data.tags,
+		coverImage: parsed.data.coverImage
+	}, fileData, schema);
+	let coverImage = record.coverImage;
+	if (imageFile instanceof File && imageFile.size > 0) {
+		const imageData = new Uint8Array(await imageFile.arrayBuffer());
+		coverImage = await service.saveCoverImage(ctx, guid, imageData);
+	}
+	return created({
+		guid,
+		version,
+		coverImage
+	});
+};
+/** `schema` is a large blob, served on demand by `/versions/{versionId}/schema`. */
+function versionSummary(v) {
+	return {
+		id: v.id,
+		versionNumber: v.versionNumber,
+		uploadedAt: v.uploadedAt,
+		uploadedBy: v.uploadedBy,
+		changeNote: v.changeNote
+	};
+}
+/** The record plus its live and draft version summaries. */
+var getDefinition = async (req) => {
+	const guid = parseParam(req.params.guid, GuidSchema, "GUID");
+	const { ctx } = requireCaller(req);
+	const record = await getVisibleDefinition(ctx, guid, req.deps);
+	if (!record) apiError(404, ApiErrorCode.NOT_FOUND, "Definition not found");
+	const meta = req.deps.definitionMeta;
+	const [liveVersion, draftVersion] = await Promise.all([record.liveVersionId ? meta.getVersion(ctx, record.liveVersionId) : null, record.draftVersionId ? meta.getVersion(ctx, record.draftVersionId) : null]);
+	return { body: {
+		...record,
+		liveVersion: liveVersion ? versionSummary(liveVersion) : null,
+		draftVersion: draftVersion ? versionSummary(draftVersion) : null
+	} };
+};
+/** Soft-delete the definition; versions and blobs are wiped with it. */
+var deleteDefinition = async (req) => {
+	const guid = parseParam(req.params.guid, GuidSchema, "GUID");
+	const { ctx } = await requireEditableDefinition(req, guid);
+	await definitionService(req.deps).delete(ctx, guid);
+	return noContent();
+};
+/** Metadata only. New versions POST to `/versions`. */
+var updateDefinition = async (req) => {
+	const guid = parseParam(req.params.guid, GuidSchema, "GUID");
+	const { ctx, record } = await requireEditableDefinition(req, guid);
+	const patch = await parseBody(req.request, UpdateMetadataInputSchema);
+	if (patch.projectId && patch.projectId !== record.projectId) {
+		assertScope(ctx, "write", { projectId: patch.projectId });
+		await requireCanCreateDefinition(req, patch.projectId);
+	}
+	await definitionService(req.deps).updateMeta(ctx, guid, patch);
+	return noContent();
+};
+/**
+* Convenience alias for the live version's schema — the call a client makes
+* before solving. The canonical location is `/versions/{versionId}/schema`;
+* this resolves the `live` pointer for you.
+*/
+var getDefinitionSchema = async (req) => {
+	const guid = parseParam(req.params.guid, GuidSchema, "GUID");
+	const { ctx } = requireCaller(req);
+	const record = await getVisibleDefinition(ctx, guid, req.deps);
+	if (!record) apiError(404, ApiErrorCode.NOT_FOUND, "Definition not found");
+	if (!record.liveVersionId) apiError(404, ApiErrorCode.NOT_FOUND, "This definition has no published version");
+	const version = await loadVisibleVersion(ctx, guid, record.liveVersionId, req.deps);
+	if (!version?.schema) apiError(404, ApiErrorCode.NOT_FOUND, "No schema cached for the live version");
+	return { body: version.schema };
+};
+/**
+* Advance the live channel. Body `{ versionId? }` targets a specific version
+* (rollback or forward-roll); omit it to promote the current draft.
+*/
+var publishDefinition = async (req) => {
+	const guid = parseParam(req.params.guid, GuidSchema, "GUID");
+	const { versionId } = await parseBody(req.request, PublishVersionInputSchema, { missingAs: {} });
+	const { ctx } = await requireEditableDefinition(req, guid);
+	return { body: { version: await definitionService(req.deps).publish(ctx, guid, versionId) } };
+};
+/** Upload a cover image. */
+var uploadDefinitionImage = async (req) => {
+	const guid = parseParam(req.params.guid, GuidSchema, "GUID");
+	const { ctx } = await requireEditableDefinition(req, guid);
+	const { file } = requireUpload(await req.request.formData(), "image", {
+		maxBytes: req.deps.uploadLimits.maxImageFileSize,
+		label: "Image"
+	});
+	const data = new Uint8Array(await file.arrayBuffer());
+	return { body: { coverImage: await definitionService(req.deps).saveCoverImage(ctx, guid, data) } };
+};
+//#endregion
+//#region ../server/src/handlers/definitionVersions.ts
+/**
+* Version handlers: list, upload, read, delete, and a version's cached schema.
+*
+* Reads resolve through `getVisibleDefinition` / `loadVisibleVersion`, which
+* return `null` rather than throwing, so an invisible definition answers 404.
+* A 403 anywhere here would confirm a guid exists across a tenant boundary.
+*/
+var listVersions = async (req) => {
+	const guid = parseParam(req.params.guid, GuidSchema, "GUID");
+	const { ctx } = requireCaller(req);
+	if (!await getVisibleDefinition(ctx, guid, req.deps)) apiError(404, ApiErrorCode.NOT_FOUND, "Definition not found");
+	return collection(await req.deps.definitionMeta.listVersions(ctx, guid, parseListOptions(req.url)));
+};
+/** Upload a new version. Advances `draft`; `live` is unchanged until publish. */
+var uploadVersion = async (req) => {
+	const guid = parseParam(req.params.guid, GuidSchema, "GUID");
+	const form = await req.request.formData();
+	const { file, extension } = requireUpload(form, "file", {
+		maxBytes: req.deps.uploadLimits.maxDefinitionFileSize,
+		extensions: GH_EXTENSIONS,
+		label: "Grasshopper (.gh or .ghx) file"
+	});
+	const changeNote = formText(form, "changeNote", { maxLength: 1e3 });
+	const { ctx, record, project } = await requireEditableDefinition(req, guid);
+	const data = new Uint8Array(await file.arrayBuffer());
+	const server = await resolveServerForOrg(ctx, project?.orgId ?? null, req.deps.computeServer, { definitionPin: record.computeServerId ?? null });
+	const schema = await fetchSchemaFromCompute(data, server);
+	return created({ version: await definitionService(req.deps).uploadVersion(ctx, guid, data, extension.slice(1), file.name, schema, changeNote) });
+};
+/**
+* Version metadata. `schema` is excluded and served by the `/schema`
+* sub-resource, so a version read never carries a several-hundred-KB blob.
+*/
+var getVersion = async (req) => {
+	const guid = parseParam(req.params.guid, GuidSchema, "GUID");
+	const versionId = parseParam(req.params.versionId, GuidSchema, "version ID");
+	const { ctx } = requireCaller(req);
+	const version = await loadVisibleVersion(ctx, guid, versionId, req.deps);
+	if (!version) apiError(404, ApiErrorCode.NOT_FOUND, "Version not found");
+	const { schema: _schema, ...rest } = version;
+	return { body: rest };
+};
+/**
+* Delete an old version. The store throws 409 if the version is currently
+* referenced by `liveVersionId` or `draftVersionId` — repoint first.
+*/
+var deleteVersion = async (req) => {
+	const guid = parseParam(req.params.guid, GuidSchema, "GUID");
+	const versionId = parseParam(req.params.versionId, GuidSchema, "version ID");
+	const { ctx } = await requireEditableDefinition(req, guid);
+	await definitionService(req.deps).deleteVersion(ctx, guid, versionId);
+	return noContent();
+};
+/**
+* The UI schema cached on this version at upload. Reads what is stored — no
+* Rhino.Compute round-trip, unlike the pre-upload `POST /api/v1/compute/schema`.
+*
+* Schemas belong to a version, so this is the canonical location;
+* `/definitions/{guid}/schema` is an alias for the live one.
+*/
+var getVersionSchema = async (req) => {
+	const guid = parseParam(req.params.guid, GuidSchema, "GUID");
+	const versionId = parseParam(req.params.versionId, GuidSchema, "version ID");
+	const { ctx } = requireCaller(req);
+	const version = await loadVisibleVersion(ctx, guid, versionId, req.deps);
+	if (!version) apiError(404, ApiErrorCode.NOT_FOUND, "Version not found");
+	if (!version.schema) apiError(404, ApiErrorCode.NOT_FOUND, "No schema cached for this version");
+	return { body: version.schema };
+};
+//#endregion
+//#region ../server/src/handlers/projects.ts
+/**
+* Project handlers: the collection, and a single project's detail and settings.
+*
+* `listProjects` was authored against `resolveAccessibleProjects`, not lifted
+* from the pre-v1 handler: that one listed every project in the acting org with
+* no `canView` filter and had no UI caller, so it carried no evidence of being
+* correct. The rest are lifted, logic intact, with reads moved onto `req.deps`.
+*/
+var listProjects = async (req) => {
+	const { ctx } = requireCaller(req);
+	const { projects } = await resolveAccessibleProjects(ctx, req.deps);
+	const { limit, cursor } = parseListOptions(req.url);
+	const start = cursor ? Number(cursor) : 0;
+	if (!Number.isInteger(start) || start < 0) apiError(400, ApiErrorCode.VALIDATION_FAILED, "Invalid cursor");
+	const items = projects.slice(start, start + (limit ?? projects.length));
+	const nextIndex = start + items.length;
+	return collection({
+		items,
+		nextCursor: nextIndex < projects.length ? String(nextIndex) : void 0
+	});
+};
+var createProject = async (req) => {
+	const { ctx, user } = requireCaller(req);
+	if (!ctx.actingOrgId) apiError(400, ApiErrorCode.VALIDATION_FAILED, "No active organization");
+	await requireCanCreateProject(req, ctx.actingOrgId);
+	const input = await parseBody(req.request, CreateProjectBodySchema);
+	if (input.visibility === "platform" && !hasPermission(ctx, "instance_admin")) apiError(403, ApiErrorCode.FORBIDDEN, "Only a platform admin can create a project with platform visibility.");
+	const autoJoinOnUpload = input.autoJoinOnUpload ?? false;
+	const flagIssues = validateProjectFlags({
+		visibility: input.visibility,
+		autoJoinOnUpload
+	});
+	if (flagIssues.length > 0) apiError(400, ApiErrorCode.VALIDATION_FAILED, flagIssues.map((i) => `${i.path}: ${i.message}`).join("; "));
+	return created(await createProjectWithUniqueSlug(req.deps.projects, {
+		id: randomUUID(),
+		orgId: ctx.actingOrgId,
+		name: input.name,
+		description: input.description,
+		visibility: input.visibility,
+		ownerId: user.id,
+		createdBy: user.id,
+		updatedBy: user.id,
+		autoJoinOnUpload
+	}, {
+		writeCtx: ctx,
+		fallbackSlug: "project",
+		conflictScope: "this organization"
+	}));
+};
+/**
+* Project detail plus the caller's effective capabilities on it.
+*
+* A project the caller cannot view returns 404, not 403 — `403` would confirm
+* the id exists to anyone probing.
+*/
+var getProject = async (req) => {
+	const { id } = requireParams(req.params, "id");
+	const { ctx } = requireCaller(req);
+	const project = await req.deps.projects.getProject(SYSTEM_CONTEXT, id);
+	if (!project || outsideTokenOrg(ctx, project.orgId)) apiError(404, ApiErrorCode.NOT_FOUND, "Project not found");
+	const [orgMembers, projectMembers, grants] = await Promise.all([
+		req.deps.orgs.getOrgMembersFor(SYSTEM_CONTEXT, [project.orgId], ctx.userId),
+		req.deps.projects.getProjectMembersFor(SYSTEM_CONTEXT, [project.id], ctx.userId),
+		project.visibility === "platform" ? req.deps.platformProjectGrants.listByProject(SYSTEM_CONTEXT, project.id) : Promise.resolve([])
+	]);
+	const member = projectMembers.get(project.id) ?? null;
+	const input = projectAccessInputFromRowsWith(req, ctx, project, {
+		member,
+		orgMember: orgMembers.get(project.orgId) ?? null,
+		platformGrants: grants
+	});
+	if (!canView(input)) apiError(404, ApiErrorCode.NOT_FOUND, "Project not found");
+	return { body: {
+		...project,
+		role: member?.role ?? null,
+		canEdit: canEdit(input),
+		canSolve: canSolve(input)
+	} };
+};
+var updateProject = async (req) => {
+	const { id } = requireParams(req.params, "id");
+	const { ctx, project: existing } = await requireCanEditProjectSettings(req, id);
+	const input = await parseBody(req.request, UpdateProjectBodySchema);
+	if (input.visibility === "platform" && existing.visibility !== "platform") {
+		if (!hasPermission(ctx, "instance_admin")) apiError(403, ApiErrorCode.FORBIDDEN, "Only a platform admin can give a project platform visibility.");
+	}
+	if (input.visibility === "public" && existing.visibility !== "public") {
+		const orgMember = await req.deps.orgs.getOrgMember(ctx, existing.orgId, ctx.userId);
+		if (!withAdminBypass(ctx.platformPermissions, () => canChangeVisibilityToPublic({ orgMember }))) apiError(403, ApiErrorCode.FORBIDDEN, "Only org owners or admins can make a project public.");
+	}
+	const flagIssues = validateProjectFlags({
+		visibility: input.visibility ?? existing.visibility,
+		autoJoinOnUpload: input.autoJoinOnUpload ?? existing.autoJoinOnUpload
+	});
+	if (flagIssues.length > 0) apiError(400, ApiErrorCode.VALIDATION_FAILED, flagIssues.map((i) => `${i.path}: ${i.message}`).join("; "));
+	const patch = {};
+	if (input.name !== void 0) {
+		patch.name = input.name;
+		patch.slug = slugify(input.name);
+	}
+	if (input.description !== void 0) patch.description = input.description ?? void 0;
+	if (input.visibility !== void 0) patch.visibility = input.visibility;
+	if (input.autoJoinOnUpload !== void 0) patch.autoJoinOnUpload = input.autoJoinOnUpload;
+	await req.deps.projects.updateProject(ctx, id, patch);
+	return noContent();
+};
+var deleteProject = async (req) => {
+	const { id } = requireParams(req.params, "id");
+	const { ctx } = requireCaller(req);
+	await requireCanManage(req, id);
+	await req.deps.projects.deleteProject(ctx, id);
+	return noContent();
+};
+//#endregion
+//#region ../server/src/handlers/projectMembers.ts
+/**
+* Project membership: list, add, change role, remove.
+*
+* Every method here gates on `requireCanManage(req, id, 'members')`. The
+* owner-count preconditions on PATCH and DELETE come from `checkOwnerRemoval`,
+* a pure rules function, so demotion and removal cannot drift apart — a sole
+* owner demoting themselves locks the project exactly as removing themselves
+* would.
+*/
+var listProjectMembers = async (req) => {
+	const { id } = requireParams(req.params, "id");
+	const { ctx } = requireCaller(req);
+	await requireCanManage(req, id, "members");
+	return collection(await req.deps.projects.listProjectMembers(ctx, id, parseListOptions(req.url)));
+};
+var addProjectMember = async (req) => {
+	const { id } = requireParams(req.params, "id");
+	const { ctx } = requireCaller(req);
+	await requireCanManage(req, id, "members");
+	const input = await parseBody(req.request, AddProjectMemberBodySchema);
+	const project = await req.deps.projects.getProject(ctx, id);
+	if (!project) apiError(404, ApiErrorCode.NOT_FOUND, "Project not found");
+	await requireTargetIsOrgMember(req, project.orgId, input.userId);
+	const now = (/* @__PURE__ */ new Date()).toISOString();
+	const member = {
+		projectId: id,
+		userId: input.userId,
+		role: input.role,
+		joinedAt: now,
+		updatedAt: now,
+		updatedBy: ctx.userId || input.userId,
+		deletedAt: null
+	};
+	await req.deps.projects.addProjectMember(ctx, member);
+	return created(member);
+};
+/**
+* Guard the owner count before a demotion or removal goes through.
+*
+* `?confirm=true` is what distinguishes "I meant to do this" from a misclick;
+* the sole-owner case has no confirmation, because there is no state the
+* caller could confirm into that leaves the project manageable.
+*/
+async function assertOwnerRemovable(req, projectId, target, action) {
+	const { ctx } = requireCaller(req);
+	const page = await req.deps.projects.listProjectMembers(ctx, projectId, { limit: 200 });
+	const decision = checkOwnerRemoval({
+		target: { role: target.role },
+		allMembers: page.items.map((m) => ({ role: m.role })),
+		confirmed: req.url.searchParams.get("confirm") === "true"
+	});
+	if (decision === "sole_owner") apiError(409, ApiErrorCode.CONFLICT, `Cannot ${action} the sole owner of a project. Assign another owner first, or use reclaim to add a co-owner.`);
+	if (decision === "needs_confirm") apiError(409, ApiErrorCode.CONFLICT, `${action === "demote" ? "Demoting" : "Removing"} another project owner requires explicit confirmation. Retry with ?confirm=true.`);
+}
+var updateProjectMemberRole = async (req) => {
+	const { id, userId } = requireParams(req.params, "id", "userId");
+	const { ctx } = requireCaller(req);
+	await requireCanManage(req, id, "members");
+	const { role } = await parseBody(req.request, UpdateProjectMemberBodySchema);
+	if (role !== "owner") {
+		const target = await req.deps.projects.getProjectMember(ctx, id, userId);
+		if (target?.role === "owner") await assertOwnerRemovable(req, id, target, "demote");
+	}
+	await req.deps.projects.updateProjectMemberRole(ctx, id, userId, role);
+	return noContent();
+};
+var removeProjectMember = async (req) => {
+	const { id, userId } = requireParams(req.params, "id", "userId");
+	const { ctx } = requireCaller(req);
+	await requireCanManage(req, id, "members");
+	const target = await req.deps.projects.getProjectMember(ctx, id, userId);
+	if (!target) return noContent();
+	if (target.role === "owner") await assertOwnerRemovable(req, id, target, "remove");
+	await req.deps.projects.removeProjectMember(ctx, id, userId);
+	return noContent();
+};
+//#endregion
+//#region ../server/src/handlers/orgCompute.ts
+/**
+* Per-org compute config: this org's own servers (`scope: 'org'`) and its
+* default selection (`orgDefaults[orgId]`). Platform servers and the global
+* default are read-only here — `manage_compute` owns those via `/api/admin/compute`.
+*
+* Authorization: org `owner`/`admin` with `manage_org_compute`, plus the acting-org
+* tenancy check. Gated by `ALLOW_ORG_COMPUTE_OVERRIDE`; when off, both methods 403.
+*
+* **`apiKey` merge semantics are the trap here.** Omitted preserves the stored
+* key, `null` clears it, a string replaces it — and `/api/admin/compute` must
+* agree, which is why the merge lives in `@selvajs/server/compute`, not inline.
+*/
+function requireFlag(req) {
+	if (!req.deps.flag("ALLOW_ORG_COMPUTE_OVERRIDE")) apiError(403, ApiErrorCode.FORBIDDEN, "Per-org compute override is disabled on this instance (ALLOW_ORG_COMPUTE_OVERRIDE).");
+}
+var getOrgCompute = async (req) => {
+	requireFlag(req);
+	requireManageOrgCompute(req);
+	const { ctx, orgId } = requireActingOrg(req, req.params.orgId);
+	const config = await req.deps.computeServer.getConfig(ctx, { scopeToOrgId: orgId });
+	const owned = config.servers.filter((s) => isOrgServer(s) && s.ownerOrgId === orgId).map((s) => ({
+		...s,
+		hasApiKey: !!s.hasApiKey
+	}));
+	const catalog = config.servers.map((s) => ({
+		id: s.id,
+		label: s.label,
+		serverUrl: s.serverUrl,
+		scope: s.scope,
+		source: isPlatformServer(s) ? "platform" : "org",
+		timeoutMs: s.timeoutMs,
+		retryCount: s.retryCount
+	}));
+	return shaped(OrgComputeResponseSchema, {
+		servers: owned,
+		defaultServerId: config.orgDefaults?.[orgId] ?? null,
+		globalDefaultServerId: config.defaultServerId ?? null,
+		catalog
+	});
+};
+var updateOrgCompute = async (req) => {
+	requireFlag(req);
+	requireManageOrgCompute(req);
+	const { ctx, orgId } = requireActingOrg(req, req.params.orgId);
+	const incoming = await parseBody(req.request, OrgComputePatchBodySchema);
+	validateIncomingServers(incoming.servers);
+	const provider = req.deps.computeServer;
+	const existing = await provider.getConfig(ctx, { includeApiKeys: true });
+	const storedKeys = storedKeysById(existing.servers.filter((s) => isOrgServer(s) && s.ownerOrgId === orgId));
+	const next = incoming.servers.map((s) => ({
+		id: s.id,
+		scope: "org",
+		ownerOrgId: orgId,
+		label: s.label,
+		serverUrl: s.serverUrl,
+		timeoutMs: s.timeoutMs,
+		retryCount: s.retryCount,
+		apiKey: resolveApiKey(s.apiKey, storedKeys.get(s.id))
+	}));
+	if (typeof incoming.defaultServerId === "string") {
+		const projected = {
+			servers: [...existing.servers.filter((s) => !(isOrgServer(s) && s.ownerOrgId === orgId)), ...next],
+			defaultServerId: existing.defaultServerId,
+			orgDefaults: existing.orgDefaults
+		};
+		if (!new Set(serversVisibleTo(projected, orgId).map((s) => s.id)).has(incoming.defaultServerId)) apiError(400, ApiErrorCode.VALIDATION_FAILED, "defaultServerId must reference a server visible to this organization");
+	}
+	await provider.saveOrgServers(ctx, orgId, next, incoming.defaultServerId);
+	evictChangedServers(existing.servers.filter((s) => isOrgServer(s) && s.ownerOrgId === orgId), next, req.deps.evictComputeClient);
+	return noContent();
+};
+//#endregion
+//#region ../server/src/handlers/invite-lookup.ts
+/**
+* Find an invite by id, confirming it belongs to `orgId`.
+*
+* `manage_org_members` is org-scoped, so a permitted caller must not reach an
+* invite in another org. Neither store scopes `revoke()` by acting org, so
+* every route that mutates an invite by id has to establish ownership first —
+* hence one shared paged scan rather than a copy per route.
+*/
+async function findPendingInviteInOrg(ctx, orgId, id, store) {
+	let cursor;
+	do {
+		const page = await store.listByOrg(ctx, orgId, {
+			limit: 200,
+			cursor
+		});
+		const match = page.items.find((i) => i.id === id);
+		if (match) return match;
+		cursor = page.nextCursor ?? void 0;
+	} while (cursor);
+	return null;
+}
+//#endregion
+//#region ../server/src/handlers/invites.ts
+/**
+* Org invites: list, mint, revoke, resend.
+*
+* **The raw token exists only in the response.** The store sees an HMAC digest,
+* so a leak of the `invites` table cannot be replayed without the instance
+* secret — and `tokenHash` is dropped by the response schema, which is why
+* every response here goes through `shaped`/`shapedCollection` rather than
+* `{ body }`.
+*/
+var INVITE_TTL_MS = 6048e5;
+/**
+* Mail the accept link, or report why not.
+*
+* Mint and resend must send the identical message, so the deps threading lives
+* here rather than at each call site. `not-configured` when the host wired no
+* notification provider: the invite row is already committed and the caller
+* still holds `acceptUrl`, so an instance without mail is a working instance,
+* not a failed write.
+*/
+async function mailInvite(req, invite, acceptUrl) {
+	const notifications = req.deps.notifications;
+	if (!notifications) return "not-configured";
+	return deliverInvite({
+		ctx: req.ctx,
+		log: req.log,
+		invite,
+		acceptUrl,
+		actor: {
+			profile: req.profile,
+			user: req.user
+		},
+		orgs: req.deps.orgs,
+		notifications,
+		fallbackOrgName: req.deps.instanceName
+	});
+}
+/** Pending and recently accepted invites for the acting org. */
+var listInvites = async (req) => {
+	requireManageOrgMembers(req);
+	const { ctx, orgId } = requireActingOrg(req, req.params.orgId);
+	return shapedCollection(InviteResponseSchema, await req.deps.invites.listByOrg(ctx, orgId, parseListOptions(req.url)));
+};
+/** Create an invite and return the accept URL. */
+var createInvite = async (req) => {
+	requireManageOrgMembers(req);
+	const { ctx, orgId } = requireActingOrg(req, req.params.orgId);
+	const { user } = requireCaller(req);
+	const input = await parseBody(req.request, CreateInviteBodySchema);
+	const { platform: submittedPlatformPerms, org: submittedOrgPerms } = splitFlatPermissions(input.permissions);
+	assertCanGrantPlatformPermissions(ctx, submittedPlatformPerms);
+	if (!await canActorChangeOrgRole(ctx, orgId, input.orgRole, req)) apiError(403, ApiErrorCode.FORBIDDEN, "Only the org owner can invite someone as owner or admin.");
+	const orgPermissions = input.orgRole === "member" ? submittedOrgPerms.filter((p) => MEMBER_ASSIGNABLE_PERMISSIONS.includes(p)) : [...DEFAULT_ORG_PERMISSIONS[input.orgRole]];
+	const codec = tokenCodec(req.deps, "invites");
+	const rawToken = codec.mintRawToken();
+	const now = /* @__PURE__ */ new Date();
+	const invite = {
+		id: randomUUID(),
+		tokenHash: codec.hashToken(rawToken),
+		email: input.email,
+		orgId,
+		orgRole: input.orgRole,
+		orgPermissions,
+		platformPermissions: submittedPlatformPerms,
+		invitedBy: user.id,
+		createdAt: now.toISOString(),
+		expiresAt: new Date(now.getTime() + INVITE_TTL_MS).toISOString()
+	};
+	await req.deps.invites.create(ctx, invite);
+	const acceptUrl = `${req.url.origin}/accept-invite?token=${rawToken}`;
+	const delivery = await mailInvite(req, invite, acceptUrl);
+	return shaped(CreatedInviteResponseSchema, {
+		...invite,
+		acceptUrl,
+		delivery
+	}, 201);
+};
+/** Revoke a pending invite. Consumed invites are preserved for audit. */
+var revokeInvite = async (req) => {
+	requireManageOrgMembers(req);
+	const { ctx, orgId } = requireActingOrg(req, req.params.orgId);
+	const { id } = requireParams(req.params, "id");
+	if (!await findPendingInviteInOrg(ctx, orgId, id, req.deps.invites)) apiError(404, ApiErrorCode.NOT_FOUND, "Invite not found");
+	await req.deps.invites.revoke(ctx, id);
+	return noContent();
+};
+/**
+* Re-send an invite: mint a replacement and revoke the original.
+*
+* A resend cannot reuse the original link. The raw token is never stored — only
+* its HMAC digest is — so there is nothing to re-read, and rather than weaken
+* that, this issues a fresh token and revokes the row it replaces. The old link
+* stops working the moment this returns, which is also what an admin wants
+* after mailing an invite to the wrong address.
+*
+* Grants are copied verbatim from the original. The role and permission gates
+* ran when it was minted; re-deriving them here would let a since-demoted admin
+* silently change what the invite carries.
+*/
+var resendInvite = async (req) => {
+	requireManageOrgMembers(req);
+	const { ctx, orgId } = requireActingOrg(req, req.params.orgId);
+	const { id } = requireParams(req.params, "id");
+	const existing = await findPendingInviteInOrg(ctx, orgId, id, req.deps.invites);
+	if (!existing) apiError(404, ApiErrorCode.NOT_FOUND, "Invite not found");
+	if (existing.acceptedAt) apiError(409, ApiErrorCode.CONFLICT, "This invite has already been accepted.");
+	const codec = tokenCodec(req.deps, "invites");
+	const rawToken = codec.mintRawToken();
+	const now = /* @__PURE__ */ new Date();
+	const replacement = {
+		...existing,
+		id: randomUUID(),
+		tokenHash: codec.hashToken(rawToken),
+		createdAt: now.toISOString(),
+		expiresAt: new Date(now.getTime() + INVITE_TTL_MS).toISOString()
+	};
+	await req.deps.invites.create(ctx, replacement);
+	await req.deps.invites.revoke(ctx, existing.id);
+	const acceptUrl = `${req.url.origin}/accept-invite?token=${rawToken}`;
+	const delivery = await mailInvite(req, replacement, acceptUrl);
+	return shaped(CreatedInviteResponseSchema, {
+		...replacement,
+		acceptUrl,
+		delivery
+	}, 201);
+};
+
+export { updateOrgCompute as A, listInvites as B, createInvite as C, revokeInvite as D, resendInvite as E, listOrgMembers as F, updateOrgMember as G, removeOrgMember as H, listApiTokens as I, createApiToken as J, revokeApiToken as K, listProjects as L, createProject as M, getProject as N, updateProject as O, deleteProject as P, listProjectMembers as Q, addProjectMember as R, updateProjectMemberRole as S, removeProjectMember as T, reclaimProject as U, listDefinitions as a, createDefinition as b, canManageApiTokenRoster as c, deleteDefinition as d, uploadDefinitionImage as e, getDefinitionSchema as f, getDefinition as g, listShareLinks as h, createShareLink as i, revokeShareLink as j, listVersions as k, listOrgApiTokens as l, uploadVersion as m, getVersion as n, deleteVersion as o, publishDefinition as p, getVersionSchema as q, revokeUserApiTokens as r, getMe as s, starDefinition as t, updateDefinition as u, unstarDefinition as v, getOrg as w, uploadOrgAsset as x, removeOrgAsset as y, getOrgCompute as z };
+//# sourceMappingURL=handlers.js-BxdLV14n.js.map