@selvajs/selva 4.8.1 → 4.9.0

package/build/server/chunks/entries/endpoints/api/v1/orgs/_orgId_/compute/_server.ts.js-DPcRgBKA.js

@@ -0,0 +1,101 @@
+import '../../../../../../../chunks/src.js-BT_hYA9R.js';
+import { n as getComputeServerConfigStore, y as isOrgServer, m as isPlatformServer, k as flag } from '../../../../../../../chunks/providers.server.js-BpypQ-ag.js';
+import { s as serversVisibleTo } from '../../../../../../../chunks/utils2.js-BCcPTZc4.js';
+import { t as requireManageOrgCompute, q as requireActingOrg } from '../../../../../../../chunks/access.server.js-KIv3puod.js';
+import { a as apiError, A as ApiErrorCode } from '../../../../../../../chunks/api-errors.js-BtMe4WGg.js';
+import { v as validateIncomingServers, s as storedKeysById, r as resolveApiKey, e as evictChangedServers } from '../../../../../../../chunks/serverConfigWrite.js-B16P1-k3.js';
+import { a as apiRoute, g as shaped, e as parseBody, n as noContent } from '../../../../../../../chunks/route.js-DglhoMVE.js';
+import { O as OrgComputeResponseSchema } from '../../../../../../../chunks/responses.js-CfP2Jx_z.js';
+import { O as OrgComputePatchBodySchema } from '../../../../../../../chunks/bodies.js-CTiPErFv.js';
+import 'zod';
+import '../../../../../../../chunks/shared-server.js-D2MyEK0i.js';
+import '../../../../../../../chunks/limits.js-D4RlAe6O.js';
+import '../../../../../../../chunks/schema.js-BeFDxIuz.js';
+import '../../../../../../../chunks/core-BQtRL5GE.js-iCpLjXCp.js';
+import 'node:crypto';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import '@sveltejs/kit';
+import '../../../../../../../chunks/engine.server.js-DUbkj2fs.js';
+import '../../../../../../../chunks/computeLimits.js-DX7I53Ag.js';
+import 'node:dns/promises';
+import 'node:net';
+import 'node:zlib';
+import 'node:util';
+
+//#region src/routes/api/v1/orgs/[orgId]/compute/+server.ts
+/**
+* Per-org compute endpoint. Manages this org's own servers
+* (`scope: 'org'`) and the org's default selection
+* (`orgDefaults[orgId]`). Platform servers and the global default are
+* read-only here — they're managed by `manage_compute` via `/api/admin/compute`.
+*
+* Authorization: org `owner`/`admin` with `manage_org_compute`. The URL `orgId`
+* must equal the caller's `actingOrgId`. Gated by the platform flag
+* `ALLOW_ORG_COMPUTE_OVERRIDE`; when off, both methods 403.
+*/
+function requireFlag() {
+	if (!flag("ALLOW_ORG_COMPUTE_OVERRIDE")) apiError(403, ApiErrorCode.FORBIDDEN, "Per-org compute override is disabled on this instance (ALLOW_ORG_COMPUTE_OVERRIDE).");
+}
+var GET = apiRoute("Failed to load org compute config", async ({ params, locals }) => {
+	requireFlag();
+	requireManageOrgCompute(locals);
+	const { ctx, orgId } = requireActingOrg(locals, params.orgId);
+	const config = await getComputeServerConfigStore().getConfig(ctx);
+	const owned = config.servers.filter((s) => isOrgServer(s) && s.ownerOrgId === orgId).map((s) => ({
+		...s,
+		hasApiKey: !!s.hasApiKey
+	}));
+	const catalog = serversVisibleTo(config, orgId).map((s) => ({
+		id: s.id,
+		label: s.label,
+		serverUrl: s.serverUrl,
+		scope: s.scope,
+		source: isPlatformServer(s) ? "platform" : "org",
+		timeoutMs: s.timeoutMs,
+		retryCount: s.retryCount
+	}));
+	return shaped(OrgComputeResponseSchema, {
+		servers: owned,
+		defaultServerId: config.orgDefaults?.[orgId] ?? null,
+		globalDefaultServerId: config.defaultServerId ?? null,
+		catalog
+	});
+});
+var PATCH = apiRoute("Failed to save org compute config", async ({ params, request, locals }) => {
+	requireFlag();
+	requireManageOrgCompute(locals);
+	const { ctx, orgId } = requireActingOrg(locals, params.orgId);
+	const incoming = await parseBody(request, OrgComputePatchBodySchema);
+	validateIncomingServers(incoming.servers);
+	const provider = getComputeServerConfigStore();
+	const existing = await provider.getConfig(ctx, { includeApiKeys: true });
+	const storedKeys = storedKeysById(existing.servers.filter((s) => isOrgServer(s) && s.ownerOrgId === orgId));
+	const next = incoming.servers.map((s) => ({
+		id: s.id,
+		scope: "org",
+		ownerOrgId: orgId,
+		label: s.label,
+		serverUrl: s.serverUrl,
+		timeoutMs: s.timeoutMs,
+		retryCount: s.retryCount,
+		apiKey: resolveApiKey(s.apiKey, storedKeys.get(s.id))
+	}));
+	if (typeof incoming.defaultServerId === "string") {
+		const projected = {
+			servers: [...existing.servers.filter((s) => !(isOrgServer(s) && s.ownerOrgId === orgId)), ...next],
+			defaultServerId: existing.defaultServerId,
+			orgDefaults: existing.orgDefaults
+		};
+		if (!new Set(serversVisibleTo(projected, orgId).map((s) => s.id)).has(incoming.defaultServerId)) apiError(400, ApiErrorCode.VALIDATION_FAILED, "defaultServerId must reference a server visible to this organization");
+	}
+	await provider.saveOrgServers(ctx, orgId, next, incoming.defaultServerId);
+	evictChangedServers(existing.servers.filter((s) => isOrgServer(s) && s.ownerOrgId === orgId), next);
+	return noContent();
+});
+
+export { GET, PATCH };
+//# sourceMappingURL=_server.ts.js-DPcRgBKA.js.map

package/build/server/chunks/entries/endpoints/api/v1/orgs/_orgId_/compute/_server.ts.js-DPcRgBKA.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-DPcRgBKA.js","sources":["../../../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/v1/orgs/_orgId_/compute/_server.ts.js"],"sourcesContent":["import \"../../../../../../../chunks/src.js\";\nimport { I as isOrgServer, L as isPlatformServer, a as getComputeServerConfigStore, t as flag } from \"../../../../../../../chunks/providers.server.js\";\nimport { a as serversVisibleTo } from \"../../../../../../../chunks/utils2.js\";\nimport { o as requireActingOrg, x as requireManageOrgCompute } from \"../../../../../../../chunks/access.server.js\";\nimport { n as apiError, t as ApiErrorCode } from \"../../../../../../../chunks/api-errors.js\";\nimport { i as evictChangedServers, n as storedKeysById, r as validateIncomingServers, t as resolveApiKey } from \"../../../../../../../chunks/serverConfigWrite.js\";\nimport { a as noContent, d as shaped, o as parseBody, t as apiRoute } from \"../../../../../../../chunks/route.js\";\nimport { i as OrgComputeResponseSchema } from \"../../../../../../../chunks/responses.js\";\nimport { i as OrgComputePatchBodySchema } from \"../../../../../../../chunks/bodies.js\";\n//#region src/routes/api/v1/orgs/[orgId]/compute/+server.ts\n/**\n* Per-org compute endpoint. Manages this org's own servers\n* (`scope: 'org'`) and the org's default selection\n* (`orgDefaults[orgId]`). Platform servers and the global default are\n* read-only here — they're managed by `manage_compute` via `/api/admin/compute`.\n*\n* Authorization: org `owner`/`admin` with `manage_org_compute`. The URL `orgId`\n* must equal the caller's `actingOrgId`. Gated by the platform flag\n* `ALLOW_ORG_COMPUTE_OVERRIDE`; when off, both methods 403.\n*/\nfunction requireFlag() {\n\tif (!flag(\"ALLOW_ORG_COMPUTE_OVERRIDE\")) apiError(403, ApiErrorCode.FORBIDDEN, \"Per-org compute override is disabled on this instance (ALLOW_ORG_COMPUTE_OVERRIDE).\");\n}\nvar GET = apiRoute(\"Failed to load org compute config\", async ({ params, locals }) => {\n\trequireFlag();\n\trequireManageOrgCompute(locals);\n\tconst { ctx, orgId } = requireActingOrg(locals, params.orgId);\n\tconst config = await getComputeServerConfigStore().getConfig(ctx);\n\tconst owned = config.servers.filter((s) => isOrgServer(s) && s.ownerOrgId === orgId).map((s) => ({\n\t\t...s,\n\t\thasApiKey: !!s.hasApiKey\n\t}));\n\tconst catalog = serversVisibleTo(config, orgId).map((s) => ({\n\t\tid: s.id,\n\t\tlabel: s.label,\n\t\tserverUrl: s.serverUrl,\n\t\tscope: s.scope,\n\t\tsource: isPlatformServer(s) ? \"platform\" : \"org\",\n\t\ttimeoutMs: s.timeoutMs,\n\t\tretryCount: s.retryCount\n\t}));\n\treturn shaped(OrgComputeResponseSchema, {\n\t\tservers: owned,\n\t\tdefaultServerId: config.orgDefaults?.[orgId] ?? null,\n\t\tglobalDefaultServerId: config.defaultServerId ?? null,\n\t\tcatalog\n\t});\n});\nvar PATCH = apiRoute(\"Failed to save org compute config\", async ({ params, request, locals }) => {\n\trequireFlag();\n\trequireManageOrgCompute(locals);\n\tconst { ctx, orgId } = requireActingOrg(locals, params.orgId);\n\tconst incoming = await parseBody(request, OrgComputePatchBodySchema);\n\tvalidateIncomingServers(incoming.servers);\n\tconst provider = getComputeServerConfigStore();\n\tconst existing = await provider.getConfig(ctx, { includeApiKeys: true });\n\tconst storedKeys = storedKeysById(existing.servers.filter((s) => isOrgServer(s) && s.ownerOrgId === orgId));\n\tconst next = incoming.servers.map((s) => ({\n\t\tid: s.id,\n\t\tscope: \"org\",\n\t\townerOrgId: orgId,\n\t\tlabel: s.label,\n\t\tserverUrl: s.serverUrl,\n\t\ttimeoutMs: s.timeoutMs,\n\t\tretryCount: s.retryCount,\n\t\tapiKey: resolveApiKey(s.apiKey, storedKeys.get(s.id))\n\t}));\n\tif (typeof incoming.defaultServerId === \"string\") {\n\t\tconst projected = {\n\t\t\tservers: [...existing.servers.filter((s) => !(isOrgServer(s) && s.ownerOrgId === orgId)), ...next],\n\t\t\tdefaultServerId: existing.defaultServerId,\n\t\t\torgDefaults: existing.orgDefaults\n\t\t};\n\t\tif (!new Set(serversVisibleTo(projected, orgId).map((s) => s.id)).has(incoming.defaultServerId)) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"defaultServerId must reference a server visible to this organization\");\n\t}\n\tawait provider.saveOrgServers(ctx, orgId, next, incoming.defaultServerId);\n\tevictChangedServers(existing.servers.filter((s) => isOrgServer(s) && s.ownerOrgId === orgId), next);\n\treturn noContent();\n});\n//#endregion\nexport { GET, PATCH };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AASA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,WAAW,GAAG;AACvB,CAAC,IAAI,CAAC,IAAI,CAAC,4BAA4B,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,qFAAqF,CAAC;AACtK;AACG,IAAC,GAAG,GAAG,QAAQ,CAAC,mCAAmC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK;AACtF,CAAC,WAAW,EAAE;AACd,CAAC,uBAAuB,CAAC,MAAM,CAAC;AAChC,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC;AAC9D,CAAC,MAAM,MAAM,GAAG,MAAM,2BAA2B,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC;AAClE,CAAC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,KAAK,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM;AAClG,EAAE,GAAG,CAAC;AACN,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;AACjB,EAAE,CAAC,CAAC;AACJ,CAAC,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM;AAC7D,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE;AACV,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK;AAChB,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS;AACxB,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK;AAChB,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC,GAAG,UAAU,GAAG,KAAK;AAClD,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS;AACxB,EAAE,UAAU,EAAE,CAAC,CAAC;AAChB,EAAE,CAAC,CAAC;AACJ,CAAC,OAAO,MAAM,CAAC,wBAAwB,EAAE;AACzC,EAAE,OAAO,EAAE,KAAK;AAChB,EAAE,eAAe,EAAE,MAAM,CAAC,WAAW,GAAG,KAAK,CAAC,IAAI,IAAI;AACtD,EAAE,qBAAqB,EAAE,MAAM,CAAC,eAAe,IAAI,IAAI;AACvD,EAAE;AACF,EAAE,CAAC;AACH,CAAC;AACE,IAAC,KAAK,GAAG,QAAQ,CAAC,mCAAmC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK;AACjG,CAAC,WAAW,EAAE;AACd,CAAC,uBAAuB,CAAC,MAAM,CAAC;AAChC,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC;AAC9D,CAAC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,yBAAyB,CAAC;AACrE,CAAC,uBAAuB,CAAC,QAAQ,CAAC,OAAO,CAAC;AAC1C,CAAC,MAAM,QAAQ,GAAG,2BAA2B,EAAE;AAC/C,CAAC,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;AACzE,CAAC,MAAM,UAAU,GAAG,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,KAAK,KAAK,CAAC,CAAC;AAC5G,CAAC,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM;AAC3C,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE;AACV,EAAE,KAAK,EAAE,KAAK;AACd,EAAE,UAAU,EAAE,KAAK;AACnB,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK;AAChB,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS;AACxB,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS;AACxB,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU;AAC1B,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;AACtD,EAAE,CAAC,CAAC;AACJ,CAAC,IAAI,OAAO,QAAQ,CAAC,eAAe,KAAK,QAAQ,EAAE;AACnD,EAAE,MAAM,SAAS,GAAG;AACpB,GAAG,OAAO,EAAE,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,KAAK,KAAK,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC;AACrG,GAAG,eAAe,EAAE,QAAQ,CAAC,eAAe;AAC5C,GAAG,WAAW,EAAE,QAAQ,CAAC;AACzB,GAAG;AACH,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC,gBAAgB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,sEAAsE,CAAC;AACxN,CAAC;AACD,CAAC,MAAM,QAAQ,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,eAAe,CAAC;AAC1E,CAAC,mBAAmB,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,KAAK,KAAK,CAAC,EAAE,IAAI,CAAC;AACpG,CAAC,OAAO,SAAS,EAAE;AACnB,CAAC;;;;"}

package/build/server/chunks/entries/endpoints/api/v1/orgs/_orgId_/invites/_id_/_server.ts.js-240QOyTt.js

@@ -0,0 +1,46 @@
+import { t as getInviteStore } from '../../../../../../../../chunks/providers.server.js-BpypQ-ag.js';
+import { s as requireManageOrgMembers, q as requireActingOrg } from '../../../../../../../../chunks/access.server.js-KIv3puod.js';
+import { a as apiError, A as ApiErrorCode } from '../../../../../../../../chunks/api-errors.js-BtMe4WGg.js';
+import { a as apiRoute, h as requireParams, n as noContent } from '../../../../../../../../chunks/route.js-DglhoMVE.js';
+import '../../../../../../../../chunks/shared-server.js-D2MyEK0i.js';
+import '../../../../../../../../chunks/src.js-BT_hYA9R.js';
+import 'zod';
+import '../../../../../../../../chunks/limits.js-D4RlAe6O.js';
+import '../../../../../../../../chunks/schema.js-BeFDxIuz.js';
+import '../../../../../../../../chunks/core-BQtRL5GE.js-iCpLjXCp.js';
+import 'node:crypto';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import '@sveltejs/kit';
+import '../../../../../../../../chunks/utils2.js-BCcPTZc4.js';
+
+//#region src/routes/api/v1/orgs/[orgId]/invites/[id]/+server.ts
+/** Revoke a pending invite. Consumed invites are preserved for audit. */
+var DELETE = apiRoute("Failed to revoke invite", async ({ params, locals }) => {
+	requireManageOrgMembers(locals);
+	const { ctx, orgId } = requireActingOrg(locals, params.orgId);
+	const { id } = requireParams(params, "id");
+	const store = getInviteStore();
+	let cursor;
+	let found = false;
+	do {
+		const page = await store.listByOrg(ctx, orgId, {
+			limit: 200,
+			cursor
+		});
+		if (page.items.some((i) => i.id === id)) {
+			found = true;
+			break;
+		}
+		cursor = page.nextCursor ?? void 0;
+	} while (cursor);
+	if (!found) apiError(404, ApiErrorCode.NOT_FOUND, "Invite not found");
+	await store.revoke(ctx, id);
+	return noContent();
+});
+
+export { DELETE };
+//# sourceMappingURL=_server.ts.js-240QOyTt.js.map

package/build/server/chunks/entries/endpoints/api/v1/orgs/_orgId_/invites/_id_/_server.ts.js-240QOyTt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-240QOyTt.js","sources":["../../../../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/v1/orgs/_orgId_/invites/_id_/_server.ts.js"],"sourcesContent":["import { d as getInviteStore } from \"../../../../../../../../chunks/providers.server.js\";\nimport { S as requireManageOrgMembers, o as requireActingOrg } from \"../../../../../../../../chunks/access.server.js\";\nimport { n as apiError, t as ApiErrorCode } from \"../../../../../../../../chunks/api-errors.js\";\nimport { a as noContent, l as requireParams, t as apiRoute } from \"../../../../../../../../chunks/route.js\";\n//#region src/routes/api/v1/orgs/[orgId]/invites/[id]/+server.ts\n/** Revoke a pending invite. Consumed invites are preserved for audit. */\nvar DELETE = apiRoute(\"Failed to revoke invite\", async ({ params, locals }) => {\n\trequireManageOrgMembers(locals);\n\tconst { ctx, orgId } = requireActingOrg(locals, params.orgId);\n\tconst { id } = requireParams(params, \"id\");\n\tconst store = getInviteStore();\n\tlet cursor;\n\tlet found = false;\n\tdo {\n\t\tconst page = await store.listByOrg(ctx, orgId, {\n\t\t\tlimit: 200,\n\t\t\tcursor\n\t\t});\n\t\tif (page.items.some((i) => i.id === id)) {\n\t\t\tfound = true;\n\t\t\tbreak;\n\t\t}\n\t\tcursor = page.nextCursor ?? void 0;\n\t} while (cursor);\n\tif (!found) apiError(404, ApiErrorCode.NOT_FOUND, \"Invite not found\");\n\tawait store.revoke(ctx, id);\n\treturn noContent();\n});\n//#endregion\nexport { DELETE };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;AAIA;AACA;AACG,IAAC,MAAM,GAAG,QAAQ,CAAC,yBAAyB,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK;AAC/E,CAAC,uBAAuB,CAAC,MAAM,CAAC;AAChC,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC;AAC9D,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC;AAC3C,CAAC,MAAM,KAAK,GAAG,cAAc,EAAE;AAC/B,CAAC,IAAI,MAAM;AACX,CAAC,IAAI,KAAK,GAAG,KAAK;AAClB,CAAC,GAAG;AACJ,EAAE,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,EAAE;AACjD,GAAG,KAAK,EAAE,GAAG;AACb,GAAG;AACH,GAAG,CAAC;AACJ,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE;AAC3C,GAAG,KAAK,GAAG,IAAI;AACf,GAAG;AACH,EAAE;AACF,EAAE,MAAM,GAAG,IAAI,CAAC,UAAU,IAAI,KAAK,CAAC;AACpC,CAAC,CAAC,QAAQ,MAAM;AAChB,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,kBAAkB,CAAC;AACtE,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC;AAC5B,CAAC,OAAO,SAAS,EAAE;AACnB,CAAC;;;;"}

package/build/server/chunks/entries/endpoints/api/v1/orgs/_orgId_/invites/_server.ts.js-Dc6JZqNX.js

@@ -0,0 +1,62 @@
+import { M as MEMBER_ASSIGNABLE_PERMISSIONS, D as DEFAULT_ORG_PERMISSIONS } from '../../../../../../../chunks/src.js-BT_hYA9R.js';
+import { t as getInviteStore } from '../../../../../../../chunks/providers.server.js-BpypQ-ag.js';
+import { s as requireManageOrgMembers, q as requireActingOrg } from '../../../../../../../chunks/access.server.js-KIv3puod.js';
+import { s as splitFlatPermissions } from '../../../../../../../chunks/permissions-compat.server.js-DKkrat80.js';
+import { a as parseListOptions } from '../../../../../../../chunks/pagination.server.js-B3tH2LPH.js';
+import { a as apiRoute, s as shapedCollection, e as parseBody, g as shaped } from '../../../../../../../chunks/route.js-DglhoMVE.js';
+import { I as InviteResponseSchema, a as CreatedInviteResponseSchema } from '../../../../../../../chunks/responses.js-CfP2Jx_z.js';
+import { c as CreateInviteBodySchema } from '../../../../../../../chunks/bodies.js-CTiPErFv.js';
+import { m as mintRawToken, h as hashToken } from '../../../../../../../chunks/token2.server.js-BW8c2MSz.js';
+import { randomUUID } from 'node:crypto';
+import 'zod';
+import '../../../../../../../chunks/shared-server.js-D2MyEK0i.js';
+import '../../../../../../../chunks/limits.js-D4RlAe6O.js';
+import '../../../../../../../chunks/schema.js-BeFDxIuz.js';
+import '../../../../../../../chunks/core-BQtRL5GE.js-iCpLjXCp.js';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import '../../../../../../../chunks/api-errors.js-BtMe4WGg.js';
+import '../../../../../../../chunks/utils2.js-BCcPTZc4.js';
+import '@sveltejs/kit';
+import '../../../../../../../chunks/token-codec.js-CxK2DiO-.js';
+
+//#region src/routes/api/v1/orgs/[orgId]/invites/+server.ts
+var INVITE_TTL_MS = 6048e5;
+/** Pending and recently accepted invites for the acting org. */
+var GET = apiRoute("Failed to list invites", async ({ params, locals, url }) => {
+	requireManageOrgMembers(locals);
+	const { ctx, orgId } = requireActingOrg(locals, params.orgId);
+	return shapedCollection(InviteResponseSchema, await getInviteStore().listByOrg(ctx, orgId, parseListOptions(url)));
+});
+/** Create an invite and return the accept URL. */
+var POST = apiRoute("Failed to create invite", async ({ params, request, locals, url }) => {
+	requireManageOrgMembers(locals);
+	const { ctx, orgId } = requireActingOrg(locals, params.orgId);
+	const input = await parseBody(request, CreateInviteBodySchema);
+	const { org: submittedOrgPerms } = splitFlatPermissions(input.permissions);
+	const orgPermissions = input.orgRole === "member" ? submittedOrgPerms.filter((p) => MEMBER_ASSIGNABLE_PERMISSIONS.includes(p)) : [...DEFAULT_ORG_PERMISSIONS[input.orgRole]];
+	const rawToken = mintRawToken();
+	const now = /* @__PURE__ */ new Date();
+	const invite = {
+		id: randomUUID(),
+		tokenHash: hashToken(rawToken),
+		email: input.email,
+		orgId,
+		orgRole: input.orgRole,
+		orgPermissions,
+		invitedBy: locals.user.id,
+		createdAt: now.toISOString(),
+		expiresAt: new Date(now.getTime() + INVITE_TTL_MS).toISOString()
+	};
+	await getInviteStore().create(ctx, invite);
+	return shaped(CreatedInviteResponseSchema, {
+		...invite,
+		acceptUrl: `${url.origin}/accept-invite?token=${rawToken}`
+	}, 201);
+});
+
+export { GET, POST };
+//# sourceMappingURL=_server.ts.js-Dc6JZqNX.js.map

package/build/server/chunks/entries/endpoints/api/v1/orgs/_orgId_/invites/_server.ts.js-Dc6JZqNX.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-Dc6JZqNX.js","sources":["../../../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/v1/orgs/_orgId_/invites/_server.ts.js"],"sourcesContent":["import { v as DEFAULT_ORG_PERMISSIONS, y as MEMBER_ASSIGNABLE_PERMISSIONS } from \"../../../../../../../chunks/src.js\";\nimport { d as getInviteStore } from \"../../../../../../../chunks/providers.server.js\";\nimport { S as requireManageOrgMembers, o as requireActingOrg } from \"../../../../../../../chunks/access.server.js\";\nimport { n as splitFlatPermissions } from \"../../../../../../../chunks/permissions-compat.server.js\";\nimport { n as parseListOptions } from \"../../../../../../../chunks/pagination.server.js\";\nimport { d as shaped, f as shapedCollection, o as parseBody, t as apiRoute } from \"../../../../../../../chunks/route.js\";\nimport { r as InviteResponseSchema, t as CreatedInviteResponseSchema } from \"../../../../../../../chunks/responses.js\";\nimport { n as CreateInviteBodySchema } from \"../../../../../../../chunks/bodies.js\";\nimport { n as mintRawToken, t as hashToken } from \"../../../../../../../chunks/token2.server.js\";\nimport { randomUUID } from \"node:crypto\";\n//#region src/routes/api/v1/orgs/[orgId]/invites/+server.ts\nvar INVITE_TTL_MS = 6048e5;\n/** Pending and recently accepted invites for the acting org. */\nvar GET = apiRoute(\"Failed to list invites\", async ({ params, locals, url }) => {\n\trequireManageOrgMembers(locals);\n\tconst { ctx, orgId } = requireActingOrg(locals, params.orgId);\n\treturn shapedCollection(InviteResponseSchema, await getInviteStore().listByOrg(ctx, orgId, parseListOptions(url)));\n});\n/** Create an invite and return the accept URL. */\nvar POST = apiRoute(\"Failed to create invite\", async ({ params, request, locals, url }) => {\n\trequireManageOrgMembers(locals);\n\tconst { ctx, orgId } = requireActingOrg(locals, params.orgId);\n\tconst input = await parseBody(request, CreateInviteBodySchema);\n\tconst { org: submittedOrgPerms } = splitFlatPermissions(input.permissions);\n\tconst orgPermissions = input.orgRole === \"member\" ? submittedOrgPerms.filter((p) => MEMBER_ASSIGNABLE_PERMISSIONS.includes(p)) : [...DEFAULT_ORG_PERMISSIONS[input.orgRole]];\n\tconst rawToken = mintRawToken();\n\tconst now = /* @__PURE__ */ new Date();\n\tconst invite = {\n\t\tid: randomUUID(),\n\t\ttokenHash: hashToken(rawToken),\n\t\temail: input.email,\n\t\torgId,\n\t\torgRole: input.orgRole,\n\t\torgPermissions,\n\t\tinvitedBy: locals.user.id,\n\t\tcreatedAt: now.toISOString(),\n\t\texpiresAt: new Date(now.getTime() + INVITE_TTL_MS).toISOString()\n\t};\n\tawait getInviteStore().create(ctx, invite);\n\treturn shaped(CreatedInviteResponseSchema, {\n\t\t...invite,\n\t\tacceptUrl: `${url.origin}/accept-invite?token=${rawToken}`\n\t}, 201);\n});\n//#endregion\nexport { GET, POST };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAUA;AACA,IAAI,aAAa,GAAG,MAAM;AAC1B;AACG,IAAC,GAAG,GAAG,QAAQ,CAAC,wBAAwB,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK;AAChF,CAAC,uBAAuB,CAAC,MAAM,CAAC;AAChC,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC;AAC9D,CAAC,OAAO,gBAAgB,CAAC,oBAAoB,EAAE,MAAM,cAAc,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;AACnH,CAAC;AACD;AACG,IAAC,IAAI,GAAG,QAAQ,CAAC,yBAAyB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK;AAC3F,CAAC,uBAAuB,CAAC,MAAM,CAAC;AAChC,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC;AAC9D,CAAC,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,sBAAsB,CAAC;AAC/D,CAAC,MAAM,EAAE,GAAG,EAAE,iBAAiB,EAAE,GAAG,oBAAoB,CAAC,KAAK,CAAC,WAAW,CAAC;AAC3E,CAAC,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,KAAK,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,6BAA6B,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,uBAAuB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AAC7K,CAAC,MAAM,QAAQ,GAAG,YAAY,EAAE;AAChC,CAAC,MAAM,GAAG,mBAAmB,IAAI,IAAI,EAAE;AACvC,CAAC,MAAM,MAAM,GAAG;AAChB,EAAE,EAAE,EAAE,UAAU,EAAE;AAClB,EAAE,SAAS,EAAE,SAAS,CAAC,QAAQ,CAAC;AAChC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK;AACpB,EAAE,KAAK;AACP,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO;AACxB,EAAE,cAAc;AAChB,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;AAC3B,EAAE,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;AAC9B,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,aAAa,CAAC,CAAC,WAAW;AAChE,EAAE;AACF,CAAC,MAAM,cAAc,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC;AAC3C,CAAC,OAAO,MAAM,CAAC,2BAA2B,EAAE;AAC5C,EAAE,GAAG,MAAM;AACX,EAAE,SAAS,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,qBAAqB,EAAE,QAAQ,CAAC;AAC3D,EAAE,EAAE,GAAG,CAAC;AACR,CAAC;;;;"}

package/build/server/chunks/entries/endpoints/api/v1/orgs/_orgId_/members/_server.ts.js-DEXGMNhN.js

@@ -0,0 +1,33 @@
+import { e as getOrganizationProvider } from '../../../../../../../chunks/providers.server.js-BpypQ-ag.js';
+import { q as requireActingOrg } from '../../../../../../../chunks/access.server.js-KIv3puod.js';
+import { a as parseListOptions } from '../../../../../../../chunks/pagination.server.js-B3tH2LPH.js';
+import { a as apiRoute, c as collection } from '../../../../../../../chunks/route.js-DglhoMVE.js';
+import '../../../../../../../chunks/shared-server.js-D2MyEK0i.js';
+import '../../../../../../../chunks/src.js-BT_hYA9R.js';
+import 'zod';
+import '../../../../../../../chunks/limits.js-D4RlAe6O.js';
+import '../../../../../../../chunks/schema.js-BeFDxIuz.js';
+import '../../../../../../../chunks/core-BQtRL5GE.js-iCpLjXCp.js';
+import 'node:crypto';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import '../../../../../../../chunks/api-errors.js-BtMe4WGg.js';
+import '../../../../../../../chunks/utils2.js-BCcPTZc4.js';
+import '@sveltejs/kit';
+
+//#region src/routes/api/v1/orgs/[orgId]/members/+server.ts
+/**
+* List the org's members. Any member of the acting org may read this — the
+* roster is what the team page renders, and `requireActingOrg` already confines
+* the read to the caller's own tenant.
+*/
+var GET = apiRoute("Failed to list organization members", async ({ params, locals, url }) => {
+	const { ctx, orgId } = requireActingOrg(locals, params.orgId);
+	return collection(await getOrganizationProvider().listOrgMembers(ctx, orgId, parseListOptions(url)));
+});
+
+export { GET };
+//# sourceMappingURL=_server.ts.js-DEXGMNhN.js.map

package/build/server/chunks/entries/endpoints/api/v1/orgs/_orgId_/members/_server.ts.js-DEXGMNhN.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-DEXGMNhN.js","sources":["../../../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/v1/orgs/_orgId_/members/_server.ts.js"],"sourcesContent":["import { m as getOrganizationProvider } from \"../../../../../../../chunks/providers.server.js\";\nimport { o as requireActingOrg } from \"../../../../../../../chunks/access.server.js\";\nimport { n as parseListOptions } from \"../../../../../../../chunks/pagination.server.js\";\nimport { n as collection, t as apiRoute } from \"../../../../../../../chunks/route.js\";\n//#region src/routes/api/v1/orgs/[orgId]/members/+server.ts\n/**\n* List the org's members. Any member of the acting org may read this — the\n* roster is what the team page renders, and `requireActingOrg` already confines\n* the read to the caller's own tenant.\n*/\nvar GET = apiRoute(\"Failed to list organization members\", async ({ params, locals, url }) => {\n\tconst { ctx, orgId } = requireActingOrg(locals, params.orgId);\n\treturn collection(await getOrganizationProvider().listOrgMembers(ctx, orgId, parseListOptions(url)));\n});\n//#endregion\nexport { GET };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;AAIA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,GAAG,GAAG,QAAQ,CAAC,qCAAqC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK;AAC7F,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC;AAC9D,CAAC,OAAO,UAAU,CAAC,MAAM,uBAAuB,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;AACrG,CAAC;;;;"}

package/build/server/chunks/entries/endpoints/api/v1/orgs/_orgId_/members/_userId_/_server.ts.js-wXirb6Vd.js

@@ -0,0 +1,90 @@
+import { M as MEMBER_ASSIGNABLE_PERMISSIONS, a as ALL_ORG_PERMISSIONS } from '../../../../../../../../chunks/src.js-BT_hYA9R.js';
+import { e as getOrganizationProvider } from '../../../../../../../../chunks/providers.server.js-BpypQ-ag.js';
+import { s as requireManageOrgMembers, q as requireActingOrg } from '../../../../../../../../chunks/access.server.js-KIv3puod.js';
+import { a as apiError, A as ApiErrorCode } from '../../../../../../../../chunks/api-errors.js-BtMe4WGg.js';
+import { a as apiRoute, h as requireParams, e as parseBody, n as noContent } from '../../../../../../../../chunks/route.js-DglhoMVE.js';
+import { b as UpdateOrgMemberBodySchema } from '../../../../../../../../chunks/bodies.js-CTiPErFv.js';
+import 'zod';
+import '../../../../../../../../chunks/shared-server.js-D2MyEK0i.js';
+import '../../../../../../../../chunks/limits.js-D4RlAe6O.js';
+import '../../../../../../../../chunks/schema.js-BeFDxIuz.js';
+import '../../../../../../../../chunks/core-BQtRL5GE.js-iCpLjXCp.js';
+import 'node:crypto';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import '@sveltejs/kit';
+import '../../../../../../../../chunks/utils2.js-BCcPTZc4.js';
+
+//#region src/routes/api/v1/orgs/[orgId]/members/[userId]/+server.ts
+/**
+* PATCH /api/orgs/[orgId]/members/[userId]
+*
+* Body accepts either or both:
+*   - `{ role: OrgRole }` — change the member's role. **Owner-only** per §3.
+*   - `{ permissions: OrgPermission[] }` — replace the member's grantable
+*     permissions. Owner/admin via `manage_org_members`. For `member`-role
+*     targets, only `MEMBER_ASSIGNABLE_PERMISSIONS` are accepted; promoting a
+*     member's permissions does NOT change their role (that's a separate
+*     branch, owner-only).
+*
+* Tenancy: the URL `orgId` must equal `ctx.actingOrgId`. Cross-org member
+* mutation is blocked even if the actor holds permissions in another org.
+*
+* Self-protection (sole-owner invariant, §10 spirit): the only owner of an
+* org cannot be demoted. Demoting yourself while you are the sole owner is
+* the most common way to discover this — handler returns 409.
+*/
+/**
+* Whether anyone other than `exceptUserId` still owns the org.
+*
+* Both branches below need this and both used to scan the roster themselves —
+* the sole-owner invariant is one rule, so it reads from one place.
+*/
+async function hasAnotherOwner(ctx, orgId, exceptUserId) {
+	return (await getOrganizationProvider().listOrgMembers(ctx, orgId, { limit: 200 })).items.some((m) => m.role === "owner" && m.userId !== exceptUserId && !m.deletedAt);
+}
+var PATCH = apiRoute("Failed to update member", async ({ params, request, locals }) => {
+	const { userId } = requireParams(params, "orgId", "userId");
+	requireManageOrgMembers(locals);
+	const { ctx, orgId } = requireActingOrg(locals, params.orgId);
+	const patch = await parseBody(request, UpdateOrgMemberBodySchema);
+	const orgs = getOrganizationProvider();
+	const [actorMember, target] = await Promise.all([orgs.getOrgMember(ctx, orgId, ctx.userId), orgs.getOrgMember(ctx, orgId, userId)]);
+	if (!target) apiError(404, ApiErrorCode.NOT_FOUND, "Member not found in this organization.");
+	if (!actorMember) apiError(403, ApiErrorCode.FORBIDDEN, "You are not a member of this organization.");
+	if (patch.role !== void 0 && patch.role !== target.role) {
+		if (actorMember.role !== "owner") apiError(403, ApiErrorCode.FORBIDDEN, "Only the org owner can change roles.");
+		if (target.role === "owner" && patch.role !== "owner" && !await hasAnotherOwner(ctx, orgId, target.userId)) apiError(409, ApiErrorCode.CONFLICT, "Cannot demote the sole owner of this organization. Promote another member to owner first.");
+		await orgs.updateOrgMemberRole(ctx, orgId, userId, patch.role);
+	}
+	if (patch.permissions !== void 0) {
+		const effectiveRole = patch.role ?? target.role;
+		const valid = effectiveRole === "member" ? new Set(MEMBER_ASSIGNABLE_PERMISSIONS) : new Set(ALL_ORG_PERMISSIONS);
+		const invalid = patch.permissions.filter((p) => !valid.has(p));
+		if (invalid.length > 0) apiError(400, ApiErrorCode.VALIDATION_FAILED, `Permissions [${invalid.join(", ")}] cannot be assigned to a ${effectiveRole}.`);
+		await orgs.updateOrgMemberPermissions(ctx, orgId, userId, patch.permissions);
+	}
+	return noContent();
+});
+/**
+* Remove a member from the org. Owner/admin via `manage_org_members`, same
+* tenancy check as PATCH, and the same sole-owner invariant — removing the last
+* owner would leave the org unadministrable.
+*/
+var DELETE = apiRoute("Failed to remove member", async ({ params, locals }) => {
+	const { userId } = requireParams(params, "orgId", "userId");
+	requireManageOrgMembers(locals);
+	const { ctx, orgId } = requireActingOrg(locals, params.orgId);
+	const orgs = getOrganizationProvider();
+	const target = await orgs.getOrgMember(ctx, orgId, userId);
+	if (!target) apiError(404, ApiErrorCode.NOT_FOUND, "Member not found in this organization.");
+	if (target.role === "owner" && !await hasAnotherOwner(ctx, orgId, target.userId)) apiError(409, ApiErrorCode.CONFLICT, "Cannot remove the sole owner of this organization. Promote another member to owner first.");
+	await orgs.removeOrgMember(ctx, orgId, userId);
+	return noContent();
+});
+
+export { DELETE, PATCH };
+//# sourceMappingURL=_server.ts.js-wXirb6Vd.js.map

package/build/server/chunks/entries/endpoints/api/v1/orgs/_orgId_/members/_userId_/_server.ts.js-wXirb6Vd.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-wXirb6Vd.js","sources":["../../../../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/v1/orgs/_orgId_/members/_userId_/_server.ts.js"],"sourcesContent":["import { g as ALL_ORG_PERMISSIONS, y as MEMBER_ASSIGNABLE_PERMISSIONS } from \"../../../../../../../../chunks/src.js\";\nimport { m as getOrganizationProvider } from \"../../../../../../../../chunks/providers.server.js\";\nimport { S as requireManageOrgMembers, o as requireActingOrg } from \"../../../../../../../../chunks/access.server.js\";\nimport { n as apiError, t as ApiErrorCode } from \"../../../../../../../../chunks/api-errors.js\";\nimport { a as noContent, l as requireParams, o as parseBody, t as apiRoute } from \"../../../../../../../../chunks/route.js\";\nimport { o as UpdateOrgMemberBodySchema } from \"../../../../../../../../chunks/bodies.js\";\n//#region src/routes/api/v1/orgs/[orgId]/members/[userId]/+server.ts\n/**\n* PATCH /api/orgs/[orgId]/members/[userId]\n*\n* Body accepts either or both:\n*   - `{ role: OrgRole }` — change the member's role. **Owner-only** per §3.\n*   - `{ permissions: OrgPermission[] }` — replace the member's grantable\n*     permissions. Owner/admin via `manage_org_members`. For `member`-role\n*     targets, only `MEMBER_ASSIGNABLE_PERMISSIONS` are accepted; promoting a\n*     member's permissions does NOT change their role (that's a separate\n*     branch, owner-only).\n*\n* Tenancy: the URL `orgId` must equal `ctx.actingOrgId`. Cross-org member\n* mutation is blocked even if the actor holds permissions in another org.\n*\n* Self-protection (sole-owner invariant, §10 spirit): the only owner of an\n* org cannot be demoted. Demoting yourself while you are the sole owner is\n* the most common way to discover this — handler returns 409.\n*/\n/**\n* Whether anyone other than `exceptUserId` still owns the org.\n*\n* Both branches below need this and both used to scan the roster themselves —\n* the sole-owner invariant is one rule, so it reads from one place.\n*/\nasync function hasAnotherOwner(ctx, orgId, exceptUserId) {\n\treturn (await getOrganizationProvider().listOrgMembers(ctx, orgId, { limit: 200 })).items.some((m) => m.role === \"owner\" && m.userId !== exceptUserId && !m.deletedAt);\n}\nvar PATCH = apiRoute(\"Failed to update member\", async ({ params, request, locals }) => {\n\tconst { userId } = requireParams(params, \"orgId\", \"userId\");\n\trequireManageOrgMembers(locals);\n\tconst { ctx, orgId } = requireActingOrg(locals, params.orgId);\n\tconst patch = await parseBody(request, UpdateOrgMemberBodySchema);\n\tconst orgs = getOrganizationProvider();\n\tconst [actorMember, target] = await Promise.all([orgs.getOrgMember(ctx, orgId, ctx.userId), orgs.getOrgMember(ctx, orgId, userId)]);\n\tif (!target) apiError(404, ApiErrorCode.NOT_FOUND, \"Member not found in this organization.\");\n\tif (!actorMember) apiError(403, ApiErrorCode.FORBIDDEN, \"You are not a member of this organization.\");\n\tif (patch.role !== void 0 && patch.role !== target.role) {\n\t\tif (actorMember.role !== \"owner\") apiError(403, ApiErrorCode.FORBIDDEN, \"Only the org owner can change roles.\");\n\t\tif (target.role === \"owner\" && patch.role !== \"owner\" && !await hasAnotherOwner(ctx, orgId, target.userId)) apiError(409, ApiErrorCode.CONFLICT, \"Cannot demote the sole owner of this organization. Promote another member to owner first.\");\n\t\tawait orgs.updateOrgMemberRole(ctx, orgId, userId, patch.role);\n\t}\n\tif (patch.permissions !== void 0) {\n\t\tconst effectiveRole = patch.role ?? target.role;\n\t\tconst valid = effectiveRole === \"member\" ? new Set(MEMBER_ASSIGNABLE_PERMISSIONS) : new Set(ALL_ORG_PERMISSIONS);\n\t\tconst invalid = patch.permissions.filter((p) => !valid.has(p));\n\t\tif (invalid.length > 0) apiError(400, ApiErrorCode.VALIDATION_FAILED, `Permissions [${invalid.join(\", \")}] cannot be assigned to a ${effectiveRole}.`);\n\t\tawait orgs.updateOrgMemberPermissions(ctx, orgId, userId, patch.permissions);\n\t}\n\treturn noContent();\n});\n/**\n* Remove a member from the org. Owner/admin via `manage_org_members`, same\n* tenancy check as PATCH, and the same sole-owner invariant — removing the last\n* owner would leave the org unadministrable.\n*/\nvar DELETE = apiRoute(\"Failed to remove member\", async ({ params, locals }) => {\n\tconst { userId } = requireParams(params, \"orgId\", \"userId\");\n\trequireManageOrgMembers(locals);\n\tconst { ctx, orgId } = requireActingOrg(locals, params.orgId);\n\tconst orgs = getOrganizationProvider();\n\tconst target = await orgs.getOrgMember(ctx, orgId, userId);\n\tif (!target) apiError(404, ApiErrorCode.NOT_FOUND, \"Member not found in this organization.\");\n\tif (target.role === \"owner\" && !await hasAnotherOwner(ctx, orgId, target.userId)) apiError(409, ApiErrorCode.CONFLICT, \"Cannot remove the sole owner of this organization. Promote another member to owner first.\");\n\tawait orgs.removeOrgMember(ctx, orgId, userId);\n\treturn noContent();\n});\n//#endregion\nexport { DELETE, PATCH };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;AAMA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,eAAe,CAAC,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE;AACzD,CAAC,OAAO,CAAC,MAAM,uBAAuB,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,MAAM,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACvK;AACG,IAAC,KAAK,GAAG,QAAQ,CAAC,yBAAyB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK;AACvF,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC;AAC5D,CAAC,uBAAuB,CAAC,MAAM,CAAC;AAChC,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC;AAC9D,CAAC,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,yBAAyB,CAAC;AAClE,CAAC,MAAM,IAAI,GAAG,uBAAuB,EAAE;AACvC,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AACpI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,wCAAwC,CAAC;AAC7F,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,4CAA4C,CAAC;AACtG,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,EAAE;AAC1D,EAAE,IAAI,WAAW,CAAC,IAAI,KAAK,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,sCAAsC,CAAC;AACjH,EAAE,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,MAAM,eAAe,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,2FAA2F,CAAC;AAC/O,EAAE,MAAM,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC;AAChE,CAAC;AACD,CAAC,IAAI,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,EAAE;AACnC,EAAE,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI;AACjD,EAAE,MAAM,KAAK,GAAG,aAAa,KAAK,QAAQ,GAAG,IAAI,GAAG,CAAC,6BAA6B,CAAC,GAAG,IAAI,GAAG,CAAC,mBAAmB,CAAC;AAClH,EAAE,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAChE,EAAE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,0BAA0B,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;AACxJ,EAAE,MAAM,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC;AAC9E,CAAC;AACD,CAAC,OAAO,SAAS,EAAE;AACnB,CAAC;AACD;AACA;AACA;AACA;AACA;AACG,IAAC,MAAM,GAAG,QAAQ,CAAC,yBAAyB,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK;AAC/E,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC;AAC5D,CAAC,uBAAuB,CAAC,MAAM,CAAC;AAChC,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC;AAC9D,CAAC,MAAM,IAAI,GAAG,uBAAuB,EAAE;AACvC,CAAC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC;AAC3D,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,wCAAwC,CAAC;AAC7F,CAAC,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,MAAM,eAAe,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,2FAA2F,CAAC;AACpN,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC;AAC/C,CAAC,OAAO,SAAS,EAAE;AACnB,CAAC;;;;"}

package/build/server/chunks/entries/endpoints/api/v1/projects/_id_/_server.ts.js-DnzcWgv0.js

@@ -0,0 +1,84 @@
+import { S as SYSTEM_CONTEXT, v as validateProjectFlags, s as slugify } from '../../../../../../chunks/src.js-BT_hYA9R.js';
+import { f as getProjectProvider, e as getOrganizationProvider, q as getPlatformProjectGrantStore } from '../../../../../../chunks/providers.server.js-BpypQ-ag.js';
+import { p as projectAccessInputFromRows, e as canView, v as canSolve, g as canEdit, w as requireCanEditProjectSettings, x as withAdminBypass, y as canChangeVisibilityToPublic, z as requireCanManage } from '../../../../../../chunks/access.server.js-KIv3puod.js';
+import { a as apiError, A as ApiErrorCode } from '../../../../../../chunks/api-errors.js-BtMe4WGg.js';
+import { a as apiRoute, h as requireParams, r as requireCaller, e as parseBody, n as noContent } from '../../../../../../chunks/route.js-DglhoMVE.js';
+import { U as UpdateProjectBodySchema } from '../../../../../../chunks/bodies.js-CTiPErFv.js';
+import { json } from '@sveltejs/kit';
+import 'zod';
+import '../../../../../../chunks/shared-server.js-D2MyEK0i.js';
+import '../../../../../../chunks/limits.js-D4RlAe6O.js';
+import '../../../../../../chunks/schema.js-BeFDxIuz.js';
+import '../../../../../../chunks/core-BQtRL5GE.js-iCpLjXCp.js';
+import 'node:crypto';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import '../../../../../../chunks/utils2.js-BCcPTZc4.js';
+
+//#region src/routes/api/v1/projects/[id]/+server.ts
+/**
+* Project detail plus the caller's effective capabilities on it.
+*
+* A project the caller cannot view returns 404, not 403 — `403` would confirm
+* the id exists to anyone probing.
+*/
+var GET = apiRoute("Failed to load project", async ({ params, locals }) => {
+	const { id } = requireParams(params, "id");
+	const { ctx } = requireCaller(locals);
+	const project = await getProjectProvider().getProject(SYSTEM_CONTEXT, id);
+	if (!project) apiError(404, ApiErrorCode.NOT_FOUND, "Project not found");
+	const [orgMembers, projectMembers, grants] = await Promise.all([
+		getOrganizationProvider().getOrgMembersFor(SYSTEM_CONTEXT, [project.orgId], ctx.userId),
+		getProjectProvider().getProjectMembersFor(SYSTEM_CONTEXT, [project.id], ctx.userId),
+		project.visibility === "platform" ? getPlatformProjectGrantStore().listByProject(SYSTEM_CONTEXT, project.id) : Promise.resolve([])
+	]);
+	const member = projectMembers.get(project.id) ?? null;
+	const input = projectAccessInputFromRows(ctx, project, {
+		member,
+		orgMember: orgMembers.get(project.orgId) ?? null,
+		platformGrants: grants
+	});
+	if (!canView(input)) apiError(404, ApiErrorCode.NOT_FOUND, "Project not found");
+	return json({
+		...project,
+		role: member?.role ?? null,
+		canEdit: canEdit(input),
+		canSolve: canSolve(input)
+	});
+});
+var PATCH = apiRoute("Failed to update project", async ({ params, request, locals }) => {
+	const { id } = requireParams(params, "id");
+	const { ctx, project: existing } = await requireCanEditProjectSettings(locals, id);
+	const input = await parseBody(request, UpdateProjectBodySchema);
+	if (input.visibility === "public" && existing.visibility !== "public") {
+		const orgMember = await getOrganizationProvider().getOrgMember(ctx, existing.orgId, ctx.userId);
+		if (!withAdminBypass(ctx.platformPermissions, () => canChangeVisibilityToPublic({ orgMember }))) apiError(403, ApiErrorCode.FORBIDDEN, "Only org owners or admins can make a project public.");
+	}
+	const flagIssues = validateProjectFlags({
+		visibility: input.visibility ?? existing.visibility,
+		autoJoinOnUpload: input.autoJoinOnUpload ?? existing.autoJoinOnUpload
+	});
+	if (flagIssues.length > 0) apiError(400, ApiErrorCode.VALIDATION_FAILED, flagIssues.map((i) => `${i.path}: ${i.message}`).join("; "));
+	const patch = {};
+	if (input.name !== void 0) {
+		patch.name = input.name;
+		patch.slug = slugify(input.name);
+	}
+	if (input.description !== void 0) patch.description = input.description ?? void 0;
+	if (input.visibility !== void 0) patch.visibility = input.visibility;
+	if (input.autoJoinOnUpload !== void 0) patch.autoJoinOnUpload = input.autoJoinOnUpload;
+	await getProjectProvider().updateProject(ctx, id, patch);
+	return noContent();
+});
+var DELETE = apiRoute("Failed to delete project", async ({ params, locals }) => {
+	const { id } = requireParams(params, "id");
+	await requireCanManage(locals, id);
+	await getProjectProvider().deleteProject(locals.ctx, id);
+	return noContent();
+});
+
+export { DELETE, GET, PATCH };
+//# sourceMappingURL=_server.ts.js-DnzcWgv0.js.map

package/build/server/chunks/entries/endpoints/api/v1/projects/_id_/_server.ts.js-DnzcWgv0.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-DnzcWgv0.js","sources":["../../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/v1/projects/_id_/_server.ts.js"],"sourcesContent":["import { T as slugify, h as validateProjectFlags, t as SYSTEM_CONTEXT } from \"../../../../../../chunks/src.js\";\nimport { _ as getProjectProvider, g as getPlatformProjectGrantStore, m as getOrganizationProvider } from \"../../../../../../chunks/providers.server.js\";\nimport { A as withAdminBypass, D as canSolve, E as canEdit, O as canView, T as canChangeVisibilityToPublic, a as projectAccessInputFromRows, d as requireCanManage, u as requireCanEditProjectSettings } from \"../../../../../../chunks/access.server.js\";\nimport { n as apiError, t as ApiErrorCode } from \"../../../../../../chunks/api-errors.js\";\nimport { a as noContent, c as requireCaller, l as requireParams, o as parseBody, t as apiRoute } from \"../../../../../../chunks/route.js\";\nimport { s as UpdateProjectBodySchema } from \"../../../../../../chunks/bodies.js\";\nimport { json } from \"@sveltejs/kit\";\n//#region src/routes/api/v1/projects/[id]/+server.ts\n/**\n* Project detail plus the caller's effective capabilities on it.\n*\n* A project the caller cannot view returns 404, not 403 — `403` would confirm\n* the id exists to anyone probing.\n*/\nvar GET = apiRoute(\"Failed to load project\", async ({ params, locals }) => {\n\tconst { id } = requireParams(params, \"id\");\n\tconst { ctx } = requireCaller(locals);\n\tconst project = await getProjectProvider().getProject(SYSTEM_CONTEXT, id);\n\tif (!project) apiError(404, ApiErrorCode.NOT_FOUND, \"Project not found\");\n\tconst [orgMembers, projectMembers, grants] = await Promise.all([\n\t\tgetOrganizationProvider().getOrgMembersFor(SYSTEM_CONTEXT, [project.orgId], ctx.userId),\n\t\tgetProjectProvider().getProjectMembersFor(SYSTEM_CONTEXT, [project.id], ctx.userId),\n\t\tproject.visibility === \"platform\" ? getPlatformProjectGrantStore().listByProject(SYSTEM_CONTEXT, project.id) : Promise.resolve([])\n\t]);\n\tconst member = projectMembers.get(project.id) ?? null;\n\tconst input = projectAccessInputFromRows(ctx, project, {\n\t\tmember,\n\t\torgMember: orgMembers.get(project.orgId) ?? null,\n\t\tplatformGrants: grants\n\t});\n\tif (!canView(input)) apiError(404, ApiErrorCode.NOT_FOUND, \"Project not found\");\n\treturn json({\n\t\t...project,\n\t\trole: member?.role ?? null,\n\t\tcanEdit: canEdit(input),\n\t\tcanSolve: canSolve(input)\n\t});\n});\nvar PATCH = apiRoute(\"Failed to update project\", async ({ params, request, locals }) => {\n\tconst { id } = requireParams(params, \"id\");\n\tconst { ctx, project: existing } = await requireCanEditProjectSettings(locals, id);\n\tconst input = await parseBody(request, UpdateProjectBodySchema);\n\tif (input.visibility === \"public\" && existing.visibility !== \"public\") {\n\t\tconst orgMember = await getOrganizationProvider().getOrgMember(ctx, existing.orgId, ctx.userId);\n\t\tif (!withAdminBypass(ctx.platformPermissions, () => canChangeVisibilityToPublic({ orgMember }))) apiError(403, ApiErrorCode.FORBIDDEN, \"Only org owners or admins can make a project public.\");\n\t}\n\tconst flagIssues = validateProjectFlags({\n\t\tvisibility: input.visibility ?? existing.visibility,\n\t\tautoJoinOnUpload: input.autoJoinOnUpload ?? existing.autoJoinOnUpload\n\t});\n\tif (flagIssues.length > 0) apiError(400, ApiErrorCode.VALIDATION_FAILED, flagIssues.map((i) => `${i.path}: ${i.message}`).join(\"; \"));\n\tconst patch = {};\n\tif (input.name !== void 0) {\n\t\tpatch.name = input.name;\n\t\tpatch.slug = slugify(input.name);\n\t}\n\tif (input.description !== void 0) patch.description = input.description ?? void 0;\n\tif (input.visibility !== void 0) patch.visibility = input.visibility;\n\tif (input.autoJoinOnUpload !== void 0) patch.autoJoinOnUpload = input.autoJoinOnUpload;\n\tawait getProjectProvider().updateProject(ctx, id, patch);\n\treturn noContent();\n});\nvar DELETE = apiRoute(\"Failed to delete project\", async ({ params, locals }) => {\n\tconst { id } = requireParams(params, \"id\");\n\tawait requireCanManage(locals, id);\n\tawait getProjectProvider().deleteProject(locals.ctx, id);\n\treturn noContent();\n});\n//#endregion\nexport { DELETE, GET, PATCH };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;AAOA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,GAAG,GAAG,QAAQ,CAAC,wBAAwB,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK;AAC3E,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC;AAC3C,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AACtC,CAAC,MAAM,OAAO,GAAG,MAAM,kBAAkB,EAAE,CAAC,UAAU,CAAC,cAAc,EAAE,EAAE,CAAC;AAC1E,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,mBAAmB,CAAC;AACzE,CAAC,MAAM,CAAC,UAAU,EAAE,cAAc,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;AAChE,EAAE,uBAAuB,EAAE,CAAC,gBAAgB,CAAC,cAAc,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC;AACzF,EAAE,kBAAkB,EAAE,CAAC,oBAAoB,CAAC,cAAc,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC;AACrF,EAAE,OAAO,CAAC,UAAU,KAAK,UAAU,GAAG,4BAA4B,EAAE,CAAC,aAAa,CAAC,cAAc,EAAE,OAAO,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,EAAE;AACnI,EAAE,CAAC;AACH,CAAC,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,IAAI;AACtD,CAAC,MAAM,KAAK,GAAG,0BAA0B,CAAC,GAAG,EAAE,OAAO,EAAE;AACxD,EAAE,MAAM;AACR,EAAE,SAAS,EAAE,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI;AAClD,EAAE,cAAc,EAAE;AAClB,EAAE,CAAC;AACH,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,mBAAmB,CAAC;AAChF,CAAC,OAAO,IAAI,CAAC;AACb,EAAE,GAAG,OAAO;AACZ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,IAAI,IAAI;AAC5B,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC;AACzB,EAAE,QAAQ,EAAE,QAAQ,CAAC,KAAK;AAC1B,EAAE,CAAC;AACH,CAAC;AACE,IAAC,KAAK,GAAG,QAAQ,CAAC,0BAA0B,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK;AACxF,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC;AAC3C,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,6BAA6B,CAAC,MAAM,EAAE,EAAE,CAAC;AACnF,CAAC,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,uBAAuB,CAAC;AAChE,CAAC,IAAI,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,QAAQ,CAAC,UAAU,KAAK,QAAQ,EAAE;AACxE,EAAE,MAAM,SAAS,GAAG,MAAM,uBAAuB,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC;AACjG,EAAE,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,mBAAmB,EAAE,MAAM,2BAA2B,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,sDAAsD,CAAC;AAChM,CAAC;AACD,CAAC,MAAM,UAAU,GAAG,oBAAoB,CAAC;AACzC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,QAAQ,CAAC,UAAU;AACrD,EAAE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,IAAI,QAAQ,CAAC;AACvD,EAAE,CAAC;AACH,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACtI,CAAC,MAAM,KAAK,GAAG,EAAE;AACjB,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,EAAE;AAC5B,EAAE,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI;AACzB,EAAE,KAAK,CAAC,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;AAClC,CAAC;AACD,CAAC,IAAI,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,EAAE,KAAK,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC;AAClF,CAAC,IAAI,KAAK,CAAC,UAAU,KAAK,KAAK,CAAC,EAAE,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU;AACrE,CAAC,IAAI,KAAK,CAAC,gBAAgB,KAAK,KAAK,CAAC,EAAE,KAAK,CAAC,gBAAgB,GAAG,KAAK,CAAC,gBAAgB;AACvF,CAAC,MAAM,kBAAkB,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,EAAE,EAAE,KAAK,CAAC;AACzD,CAAC,OAAO,SAAS,EAAE;AACnB,CAAC;AACE,IAAC,MAAM,GAAG,QAAQ,CAAC,0BAA0B,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK;AAChF,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC;AAC3C,CAAC,MAAM,gBAAgB,CAAC,MAAM,EAAE,EAAE,CAAC;AACnC,CAAC,MAAM,kBAAkB,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC;AACzD,CAAC,OAAO,SAAS,EAAE;AACnB,CAAC;;;;"}

package/build/server/chunks/entries/endpoints/api/v1/projects/_id_/members/_server.ts.js-Crr-BCUw.js

@@ -0,0 +1,51 @@
+import { f as getProjectProvider } from '../../../../../../../chunks/providers.server.js-BpypQ-ag.js';
+import { A as requireCanManageMembers, B as requireTargetIsOrgMember } from '../../../../../../../chunks/access.server.js-KIv3puod.js';
+import { a as apiError, A as ApiErrorCode } from '../../../../../../../chunks/api-errors.js-BtMe4WGg.js';
+import { a as parseListOptions } from '../../../../../../../chunks/pagination.server.js-B3tH2LPH.js';
+import { a as apiRoute, h as requireParams, c as collection, e as parseBody, d as created } from '../../../../../../../chunks/route.js-DglhoMVE.js';
+import { A as AddProjectMemberBodySchema } from '../../../../../../../chunks/bodies.js-CTiPErFv.js';
+import '../../../../../../../chunks/shared-server.js-D2MyEK0i.js';
+import '../../../../../../../chunks/src.js-BT_hYA9R.js';
+import 'zod';
+import '../../../../../../../chunks/limits.js-D4RlAe6O.js';
+import '../../../../../../../chunks/schema.js-BeFDxIuz.js';
+import '../../../../../../../chunks/core-BQtRL5GE.js-iCpLjXCp.js';
+import 'node:crypto';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import '@sveltejs/kit';
+import '../../../../../../../chunks/utils2.js-BCcPTZc4.js';
+
+//#region src/routes/api/v1/projects/[id]/members/+server.ts
+var GET = apiRoute("Failed to load members", async ({ params, locals, url }) => {
+	const { id } = requireParams(params, "id");
+	await requireCanManageMembers(locals, id);
+	return collection(await getProjectProvider().listProjectMembers(locals.ctx, id, parseListOptions(url)));
+});
+var POST = apiRoute("Failed to add member", async ({ params, request, locals }) => {
+	const { id } = requireParams(params, "id");
+	await requireCanManageMembers(locals, id);
+	const ctx = locals.ctx;
+	const input = await parseBody(request, AddProjectMemberBodySchema);
+	const project = await getProjectProvider().getProject(ctx, id);
+	if (!project) apiError(404, ApiErrorCode.NOT_FOUND, "Project not found");
+	await requireTargetIsOrgMember(locals, project.orgId, input.userId);
+	const now = (/* @__PURE__ */ new Date()).toISOString();
+	const member = {
+		projectId: id,
+		userId: input.userId,
+		role: input.role,
+		joinedAt: now,
+		updatedAt: now,
+		updatedBy: ctx.userId || input.userId,
+		deletedAt: null
+	};
+	await getProjectProvider().addProjectMember(ctx, member);
+	return created(member);
+});
+
+export { GET, POST };
+//# sourceMappingURL=_server.ts.js-Crr-BCUw.js.map

package/build/server/chunks/entries/endpoints/api/v1/projects/_id_/members/_server.ts.js-Crr-BCUw.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-Crr-BCUw.js","sources":["../../../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/v1/projects/_id_/members/_server.ts.js"],"sourcesContent":["import { _ as getProjectProvider } from \"../../../../../../../chunks/providers.server.js\";\nimport { f as requireCanManageMembers, w as requireTargetIsOrgMember } from \"../../../../../../../chunks/access.server.js\";\nimport { n as apiError, t as ApiErrorCode } from \"../../../../../../../chunks/api-errors.js\";\nimport { n as parseListOptions } from \"../../../../../../../chunks/pagination.server.js\";\nimport { l as requireParams, n as collection, o as parseBody, r as created, t as apiRoute } from \"../../../../../../../chunks/route.js\";\nimport { t as AddProjectMemberBodySchema } from \"../../../../../../../chunks/bodies.js\";\n//#region src/routes/api/v1/projects/[id]/members/+server.ts\nvar GET = apiRoute(\"Failed to load members\", async ({ params, locals, url }) => {\n\tconst { id } = requireParams(params, \"id\");\n\tawait requireCanManageMembers(locals, id);\n\treturn collection(await getProjectProvider().listProjectMembers(locals.ctx, id, parseListOptions(url)));\n});\nvar POST = apiRoute(\"Failed to add member\", async ({ params, request, locals }) => {\n\tconst { id } = requireParams(params, \"id\");\n\tawait requireCanManageMembers(locals, id);\n\tconst ctx = locals.ctx;\n\tconst input = await parseBody(request, AddProjectMemberBodySchema);\n\tconst project = await getProjectProvider().getProject(ctx, id);\n\tif (!project) apiError(404, ApiErrorCode.NOT_FOUND, \"Project not found\");\n\tawait requireTargetIsOrgMember(locals, project.orgId, input.userId);\n\tconst now = (/* @__PURE__ */ new Date()).toISOString();\n\tconst member = {\n\t\tprojectId: id,\n\t\tuserId: input.userId,\n\t\trole: input.role,\n\t\tjoinedAt: now,\n\t\tupdatedAt: now,\n\t\tupdatedBy: ctx.userId || input.userId,\n\t\tdeletedAt: null\n\t};\n\tawait getProjectProvider().addProjectMember(ctx, member);\n\treturn created(member);\n});\n//#endregion\nexport { GET, POST };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;AAMA;AACG,IAAC,GAAG,GAAG,QAAQ,CAAC,wBAAwB,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK;AAChF,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC;AAC3C,CAAC,MAAM,uBAAuB,CAAC,MAAM,EAAE,EAAE,CAAC;AAC1C,CAAC,OAAO,UAAU,CAAC,MAAM,kBAAkB,EAAE,CAAC,kBAAkB,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;AACxG,CAAC;AACE,IAAC,IAAI,GAAG,QAAQ,CAAC,sBAAsB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK;AACnF,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC;AAC3C,CAAC,MAAM,uBAAuB,CAAC,MAAM,EAAE,EAAE,CAAC;AAC1C,CAAC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG;AACvB,CAAC,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,0BAA0B,CAAC;AACnE,CAAC,MAAM,OAAO,GAAG,MAAM,kBAAkB,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC;AAC/D,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,mBAAmB,CAAC;AACzE,CAAC,MAAM,wBAAwB,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC;AACpE,CAAC,MAAM,GAAG,GAAG,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE;AACvD,CAAC,MAAM,MAAM,GAAG;AAChB,EAAE,SAAS,EAAE,EAAE;AACf,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM;AACtB,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI;AAClB,EAAE,QAAQ,EAAE,GAAG;AACf,EAAE,SAAS,EAAE,GAAG;AAChB,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM;AACvC,EAAE,SAAS,EAAE;AACb,EAAE;AACF,CAAC,MAAM,kBAAkB,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC;AACzD,CAAC,OAAO,OAAO,CAAC,MAAM,CAAC;AACvB,CAAC;;;;"}