@selvajs/server 1.1.0 → 1.3.0

package/dist/handlers/orgMembers.js

@@ -0,0 +1,200 @@
+/**
+ * Org member role, permissions, and removal.
+ *
+ * Two gates run on every request: `requireManageOrgMembers` (owner+admin) and
+ * `requireActingOrg` (the URL `orgId` must equal `ctx.actingOrgId`, so
+ * cross-org member mutation is blocked even for an actor with permissions in
+ * another org).
+ *
+ * The sole-owner invariant applies to demotion and removal alike — an org with
+ * no owner is unadministrable, and removing an owner ends their role exactly as
+ * demoting them does.
+ */
+import { apiError, ApiErrorCode, noContent, parseBody, requireParams, UpdateOrgMemberBodySchema } from '../api/index.js';
+import { MEMBER_ASSIGNABLE_PERMISSIONS, ALL_ORG_PERMISSIONS, actorFrom, canChangeOrgRole } from '@selvajs/platform';
+import { requireManageOrgMembers, requireActingOrg } from '../access/index.js';
+const ROSTER_PAGE_LIMIT = 200;
+// Runaway guard against an adapter returning a non-advancing cursor. Matches
+// `listAllOrgMembers`; 100 pages is 20k members, past any real org here.
+const MAX_ROSTER_PAGES = 100;
+/**
+ * Whether anyone other than `exceptUserId` still owns the org.
+ *
+ * Both branches below need this and both used to scan the roster themselves —
+ * the sole-owner invariant is one rule, so it reads from one place.
+ *
+ * Pages rather than reading one 200-row window: a second owner sitting past the
+ * first page read as "no other owner", so the invariant refused a demotion or
+ * removal that was in fact safe. That failed closed, but it made the org
+ * unadministrable exactly when it had grown enough to need administering.
+ * Returns on the first owner found, so the common case is still one round-trip.
+ */
+async function hasAnotherOwner(req, ctx, orgId, exceptUserId) {
+    let cursor;
+    for (let page = 0; page < MAX_ROSTER_PAGES; page++) {
+        const result = await req.deps.orgs.listOrgMembers(ctx, orgId, {
+            limit: ROSTER_PAGE_LIMIT,
+            cursor
+        });
+        if (result.items.some((m) => m.role === 'owner' && m.userId !== exceptUserId && !m.deletedAt)) {
+            return true;
+        }
+        cursor = result.nextCursor;
+        if (!cursor)
+            return false;
+    }
+    // Cap hit without finding one: report "no other owner" so the caller refuses.
+    // Failing closed on an incomplete read is the safe direction for an invariant
+    // whose whole job is preventing an unadministrable org.
+    req.log.warn('hasAnotherOwner hit the page cap — treating as sole owner', {
+        orgId,
+        pages: MAX_ROSTER_PAGES
+    });
+    return false;
+}
+/**
+ * Projects in `orgId` where `userId` is the only live owner — the ones that
+ * will have no owner once `removeOrgMember` cascades their membership rows.
+ *
+ * **Report, do not block.** Blocking puts an unbounded chore in front of
+ * offboarding — the cost scales with how many projects the departing person
+ * owned, which is backwards, because the most prolific people are the ones
+ * whose departure most needs to be clean. An offboarding that fails halfway is
+ * worse than an ownerless project: the person stays in the org while someone
+ * works through the backlog. Reclaim already exists to adopt an ownerless
+ * project, so the recovery path is built; what was missing was any signal that
+ * recovery was needed. Hence the event.
+ *
+ * MUST be called before the removal — afterwards the rows it reads are gone.
+ */
+async function findProjectsLosingSoleOwner(req, ctx, orgId, userId) {
+    const projects = req.deps.projects;
+    const orgProjects = await projects.listProjects(ctx, orgId, { limit: ROSTER_PAGE_LIMIT });
+    const checks = await Promise.all(orgProjects.items.map(async (project) => {
+        const members = await projects.listProjectMembers(ctx, project.id, {
+            limit: ROSTER_PAGE_LIMIT
+        });
+        const owners = members.items.filter((m) => m.role === 'owner' && !m.deletedAt);
+        return owners.length === 1 && owners[0].userId === userId ? project : null;
+    }));
+    return checks.filter((p) => p !== null);
+}
+/**
+ * Body accepts either or both:
+ *   - `{ role: OrgRole }` — change the member's role. Owner-only.
+ *   - `{ permissions: OrgPermission[] }` — replace the member's grantable
+ *     permissions. Owner/admin via `manage_org_members`. For `member`-role
+ *     targets, only `MEMBER_ASSIGNABLE_PERMISSIONS` are accepted; promoting a
+ *     member's permissions does NOT change their role.
+ */
+export const updateOrgMember = async (req) => {
+    const { userId } = requireParams(req.params, 'orgId', 'userId');
+    // Owner+admin gate, covering permission edits. The role-change branch adds
+    // an owner-only gate below.
+    requireManageOrgMembers(req);
+    const { ctx, orgId } = requireActingOrg(req, req.params.orgId);
+    const patch = await parseBody(req.request, UpdateOrgMemberBodySchema);
+    const orgs = req.deps.orgs;
+    const [actorMember, target] = await Promise.all([
+        orgs.getOrgMember(ctx, orgId, ctx.userId),
+        orgs.getOrgMember(ctx, orgId, userId)
+    ]);
+    if (!target)
+        apiError(404, ApiErrorCode.NOT_FOUND, 'Member not found in this organization.');
+    if (!actorMember) {
+        apiError(403, ApiErrorCode.FORBIDDEN, 'You are not a member of this organization.');
+    }
+    if (patch.role !== undefined && patch.role !== target.role) {
+        // Gated on both the role being granted and the one being taken away —
+        // demoting an owner is an owner-only act even though `member` is not.
+        if (!canChangeOrgRole({ actorMember, role: patch.role }) ||
+            !canChangeOrgRole({ actorMember, role: target.role })) {
+            apiError(403, ApiErrorCode.FORBIDDEN, 'Only the org owner can change roles.');
+        }
+        if (target.role === 'owner' &&
+            patch.role !== 'owner' &&
+            !(await hasAnotherOwner(req, ctx, orgId, target.userId))) {
+            apiError(409, ApiErrorCode.CONFLICT, 'Cannot demote the sole owner of this organization. Promote another member to owner first.');
+        }
+        await orgs.updateOrgMemberRole(ctx, orgId, userId, patch.role);
+    }
+    if (patch.permissions !== undefined) {
+        // Validate against the role the member will have, not the one they had.
+        const effectiveRole = patch.role ?? target.role;
+        const valid = effectiveRole === 'member'
+            ? new Set(MEMBER_ASSIGNABLE_PERMISSIONS)
+            : new Set(ALL_ORG_PERMISSIONS);
+        const invalid = patch.permissions.filter((p) => !valid.has(p));
+        if (invalid.length > 0) {
+            apiError(400, ApiErrorCode.VALIDATION_FAILED, `Permissions [${invalid.join(', ')}] cannot be assigned to a ${effectiveRole}.`);
+        }
+        await orgs.updateOrgMemberPermissions(ctx, orgId, userId, patch.permissions);
+    }
+    return noContent();
+};
+/**
+ * Remove a member from the org. Owner/admin via `manage_org_members`, same
+ * tenancy check as PATCH, and the same sole-owner invariant — removing the last
+ * owner would leave the org unadministrable.
+ */
+export const removeOrgMember = async (req) => {
+    const { userId } = requireParams(req.params, 'orgId', 'userId');
+    requireManageOrgMembers(req);
+    const { ctx, orgId } = requireActingOrg(req, req.params.orgId);
+    const orgs = req.deps.orgs;
+    const [actorMember, target] = await Promise.all([
+        orgs.getOrgMember(ctx, orgId, ctx.userId),
+        orgs.getOrgMember(ctx, orgId, userId)
+    ]);
+    if (!target)
+        apiError(404, ApiErrorCode.NOT_FOUND, 'Member not found in this organization.');
+    // Same owner-only gate PATCH applies to demotion. Removing an owner ends
+    // their role just as demoting them does, so an admin got 403 on the demote
+    // and 204 on the remove — the harder-to-reverse of the two.
+    if (!canChangeOrgRole({ actorMember, role: target.role })) {
+        apiError(403, ApiErrorCode.FORBIDDEN, 'Only the org owner can remove another owner.');
+    }
+    if (target.role === 'owner' && !(await hasAnotherOwner(req, ctx, orgId, target.userId))) {
+        apiError(409, ApiErrorCode.CONFLICT, 'Cannot remove the sole owner of this organization. Promote another member to owner first.');
+    }
+    // Must run before the removal: the cascade soft-deletes the very rows this
+    // reads. Reported, not blocked — see the docblock on `findProjectsLosingSoleOwner`.
+    const orphaned = await findProjectsLosingSoleOwner(req, ctx, orgId, userId);
+    await orgs.removeOrgMember(ctx, orgId, userId);
+    if (orphaned.length > 0) {
+        await req.deps.events.emit({
+            type: 'org_member.removed_orphaning_projects',
+            orgId,
+            userId,
+            projectIds: orphaned.map((p) => p.id),
+            actorId: actorFrom(ctx)
+        });
+        req.log.warn('Org member removal left projects without an owner', {
+            orgId,
+            userId,
+            actorId: ctx.userId,
+            projectCount: orphaned.length
+        });
+    }
+    // `removeOrgMember` cascades `project_members` but not invites, so a
+    // dormant invite would let the removed user walk straight back in at
+    // their original role. Best-effort: the removal itself has committed, and
+    // failing the request now would report an offboarding that did happen as
+    // one that didn't. A failure here leaves a live re-entry path, so it is
+    // logged rather than swallowed.
+    const email = (await req.deps.auth.getUser(userId))?.email;
+    if (email) {
+        try {
+            await req.deps.invites.revokePendingByEmail(ctx, orgId, email);
+        }
+        catch (err) {
+            req.log.error('Removed org member but failed to revoke their pending invites', {
+                orgId,
+                userId,
+                error: err instanceof Error ? err.message : String(err)
+            });
+        }
+    }
+    return noContent();
+};
+//# sourceMappingURL=orgMembers.js.map

package/dist/handlers/orgMembers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"orgMembers.js","sourceRoot":"","sources":["../../src/handlers/orgMembers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACN,QAAQ,EACR,YAAY,EACZ,SAAS,EACT,SAAS,EACT,aAAa,EACb,yBAAyB,EACzB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACN,6BAA6B,EAC7B,mBAAmB,EACnB,SAAS,EACT,gBAAgB,EAKhB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAE/E,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,6EAA6E;AAC7E,yEAAyE;AACzE,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAE7B;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,eAAe,CAC7B,GAAe,EACf,GAAmB,EACnB,KAAa,EACb,YAAoB;IAEpB,IAAI,MAA0B,CAAC;IAC/B,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,gBAAgB,EAAE,IAAI,EAAE,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,EAAE;YAC7D,KAAK,EAAE,iBAAiB;YACxB,MAAM;SACN,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,MAAM,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;YAC/F,OAAO,IAAI,CAAC;QACb,CAAC;QACD,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC;QAC3B,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;IAC3B,CAAC;IACD,8EAA8E;IAC9E,8EAA8E;IAC9E,wDAAwD;IACxD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,2DAA2D,EAAE;QACzE,KAAK;QACL,KAAK,EAAE,gBAAgB;KACvB,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,KAAK,UAAU,2BAA2B,CACzC,GAAe,EACf,GAAmB,EACnB,KAAa,EACb,MAAc;IAEd,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC;IACnC,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAE1F,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QACvC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE;YAClE,KAAK,EAAE,iBAAiB;SACxB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC/E,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5E,CAAC,CAAC,CACF,CAAC;IAEF,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAgB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACxD,MAAM,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAEhE,2EAA2E;IAC3E,4BAA4B;IAC5B,uBAAuB,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAE/D,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,yBAAyB,CAAC,CAAC;IACtE,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;IAE3B,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC/C,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC;QACzC,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC;KACrC,CAAC,CAAC;IACH,IAAI,CAAC,MAAM;QAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,wCAAwC,CAAC,CAAC;IAC7F,IAAI,CAAC,WAAW,EAAE,CAAC;QAClB,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,4CAA4C,CAAC,CAAC;IACrF,CAAC;IAED,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5D,sEAAsE;QACtE,sEAAsE;QACtE,IACC,CAAC,gBAAgB,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;YACpD,CAAC,gBAAgB,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,EACpD,CAAC;YACF,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,sCAAsC,CAAC,CAAC;QAC/E,CAAC;QACD,IACC,MAAM,CAAC,IAAI,KAAK,OAAO;YACvB,KAAK,CAAC,IAAI,KAAK,OAAO;YACtB,CAAC,CAAC,MAAM,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EACvD,CAAC;YACF,QAAQ,CACP,GAAG,EACH,YAAY,CAAC,QAAQ,EACrB,2FAA2F,CAC3F,CAAC;QACH,CAAC;QACD,MAAM,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,IAAe,CAAC,CAAC;IAC3E,CAAC;IAED,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACrC,wEAAwE;QACxE,MAAM,aAAa,GAAY,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC;QACzD,MAAM,KAAK,GACV,aAAa,KAAK,QAAQ;YACzB,CAAC,CAAC,IAAI,GAAG,CAAgB,6BAA6B,CAAC;YACvD,CAAC,CAAC,IAAI,GAAG,CAAgB,mBAAmB,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,QAAQ,CACP,GAAG,EACH,YAAY,CAAC,iBAAiB,EAC9B,gBAAgB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,6BAA6B,aAAa,GAAG,CAC/E,CAAC;QACH,CAAC;QACD,MAAM,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IAC9E,CAAC;IAED,OAAO,SAAS,EAAE,CAAC;AACpB,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACxD,MAAM,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAChE,uBAAuB,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAE/D,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;IAC3B,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC/C,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC;QACzC,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC;KACrC,CAAC,CAAC;IACH,IAAI,CAAC,MAAM;QAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,wCAAwC,CAAC,CAAC;IAE7F,yEAAyE;IACzE,2EAA2E;IAC3E,4DAA4D;IAC5D,IAAI,CAAC,gBAAgB,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QAC3D,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,8CAA8C,CAAC,CAAC;IACvF,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,MAAM,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QACzF,QAAQ,CACP,GAAG,EACH,YAAY,CAAC,QAAQ,EACrB,2FAA2F,CAC3F,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,oFAAoF;IACpF,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAE5E,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAE/C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YAC1B,IAAI,EAAE,uCAAuC;YAC7C,KAAK;YACL,MAAM;YACN,UAAU,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC;SACvB,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,mDAAmD,EAAE;YACjE,KAAK;YACL,MAAM;YACN,OAAO,EAAE,GAAG,CAAC,MAAM;YACnB,YAAY,EAAE,QAAQ,CAAC,MAAM;SAC7B,CAAC,CAAC;IACJ,CAAC;IAED,qEAAqE;IACrE,qEAAqE;IACrE,0EAA0E;IAC1E,yEAAyE;IACzE,wEAAwE;IACxE,gCAAgC;IAChC,MAAM,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC;IAC3D,IAAI,KAAK,EAAE,CAAC;QACX,IAAI,CAAC;YACJ,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,+DAA+D,EAAE;gBAC9E,KAAK;gBACL,MAAM;gBACN,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACvD,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAED,OAAO,SAAS,EAAE,CAAC;AACpB,CAAC,CAAC"}

package/dist/handlers/orgs.d.ts

@@ -0,0 +1,16 @@
+/**
+ * The acting org's record and roster.
+ *
+ * `requireActingOrg` is the tenancy gate on both: the URL `orgId` must equal
+ * `ctx.actingOrgId`, so the URL alone never decides which tenant is read.
+ */
+import { type ApiHandler } from '../api/index.js';
+/** The acting org's record — name, slug, and branding asset URLs. */
+export declare const getOrg: ApiHandler;
+/**
+ * List the org's members. Any member of the acting org may read this — the
+ * roster is what the team page renders, and `requireActingOrg` already confines
+ * the read to the caller's own tenant.
+ */
+export declare const listOrgMembers: ApiHandler;
+//# sourceMappingURL=orgs.d.ts.map

package/dist/handlers/orgs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"orgs.d.ts","sourceRoot":"","sources":["../../src/handlers/orgs.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAKN,KAAK,UAAU,EACf,MAAM,iBAAiB,CAAC;AAGzB,qEAAqE;AACrE,eAAO,MAAM,MAAM,EAAE,UAMpB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,cAAc,EAAE,UAI5B,CAAC"}

package/dist/handlers/orgs.js

@@ -0,0 +1,26 @@
+/**
+ * The acting org's record and roster.
+ *
+ * `requireActingOrg` is the tenancy gate on both: the URL `orgId` must equal
+ * `ctx.actingOrgId`, so the URL alone never decides which tenant is read.
+ */
+import { apiError, ApiErrorCode, collection, parseListOptions } from '../api/index.js';
+import { requireActingOrg } from '../access/index.js';
+/** The acting org's record — name, slug, and branding asset URLs. */
+export const getOrg = async (req) => {
+    const { ctx, orgId } = requireActingOrg(req, req.params.orgId);
+    const org = await req.deps.orgs.getOrg(ctx, orgId);
+    if (!org)
+        apiError(404, ApiErrorCode.NOT_FOUND, 'Organization not found');
+    return { body: org };
+};
+/**
+ * List the org's members. Any member of the acting org may read this — the
+ * roster is what the team page renders, and `requireActingOrg` already confines
+ * the read to the caller's own tenant.
+ */
+export const listOrgMembers = async (req) => {
+    const { ctx, orgId } = requireActingOrg(req, req.params.orgId);
+    return collection(await req.deps.orgs.listOrgMembers(ctx, orgId, parseListOptions(req.url)));
+};
+//# sourceMappingURL=orgs.js.map

package/dist/handlers/orgs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"orgs.js","sourceRoot":"","sources":["../../src/handlers/orgs.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACN,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,gBAAgB,EAEhB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEtD,qEAAqE;AACrE,MAAM,CAAC,MAAM,MAAM,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IAC/C,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAE/D,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACnD,IAAI,CAAC,GAAG;QAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,wBAAwB,CAAC,CAAC;IAC1E,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AACtB,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACvD,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAE/D,OAAO,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC9F,CAAC,CAAC"}

package/dist/handlers/projectMembers.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Project membership: list, add, change role, remove.
+ *
+ * Every method here gates on `requireCanManage(req, id, 'members')`. The
+ * owner-count preconditions on PATCH and DELETE come from `checkOwnerRemoval`,
+ * a pure rules function, so demotion and removal cannot drift apart — a sole
+ * owner demoting themselves locks the project exactly as removing themselves
+ * would.
+ */
+import type { ApiHandler } from '../api/index.js';
+export declare const listProjectMembers: ApiHandler;
+export declare const addProjectMember: ApiHandler;
+export declare const updateProjectMemberRole: ApiHandler;
+export declare const removeProjectMember: ApiHandler;
+//# sourceMappingURL=projectMembers.d.ts.map

package/dist/handlers/projectMembers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"projectMembers.d.ts","sourceRoot":"","sources":["../../src/handlers/projectMembers.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAeH,OAAO,KAAK,EAAE,UAAU,EAAc,MAAM,iBAAiB,CAAC;AAI9D,eAAO,MAAM,kBAAkB,EAAE,UAMhC,CAAC;AAEF,eAAO,MAAM,gBAAgB,EAAE,UAwB9B,CAAC;AAuCF,eAAO,MAAM,uBAAuB,EAAE,UAmBrC,CAAC;AAEF,eAAO,MAAM,mBAAmB,EAAE,UAejC,CAAC"}

package/dist/handlers/projectMembers.js

@@ -0,0 +1,95 @@
+/**
+ * Project membership: list, add, change role, remove.
+ *
+ * Every method here gates on `requireCanManage(req, id, 'members')`. The
+ * owner-count preconditions on PATCH and DELETE come from `checkOwnerRemoval`,
+ * a pure rules function, so demotion and removal cannot drift apart — a sole
+ * owner demoting themselves locks the project exactly as removing themselves
+ * would.
+ */
+import { AddProjectMemberBodySchema, apiError, ApiErrorCode, collection, created, noContent, parseBody, parseListOptions, requireCaller, requireParams, UpdateProjectMemberBodySchema } from '../api/index.js';
+import { checkOwnerRemoval } from '@selvajs/platform';
+import { requireCanManage, requireTargetIsOrgMember } from '../access/index.js';
+export const listProjectMembers = async (req) => {
+    const { id } = requireParams(req.params, 'id');
+    const { ctx } = requireCaller(req);
+    await requireCanManage(req, id, 'members');
+    return collection(await req.deps.projects.listProjectMembers(ctx, id, parseListOptions(req.url)));
+};
+export const addProjectMember = async (req) => {
+    const { id } = requireParams(req.params, 'id');
+    const { ctx } = requireCaller(req);
+    await requireCanManage(req, id, 'members');
+    const input = await parseBody(req.request, AddProjectMemberBodySchema);
+    const project = await req.deps.projects.getProject(ctx, id);
+    if (!project)
+        apiError(404, ApiErrorCode.NOT_FOUND, 'Project not found');
+    await requireTargetIsOrgMember(req, project.orgId, input.userId);
+    const now = new Date().toISOString();
+    const member = {
+        projectId: id,
+        userId: input.userId,
+        role: input.role,
+        joinedAt: now,
+        updatedAt: now,
+        updatedBy: ctx.userId || input.userId,
+        deletedAt: null
+    };
+    await req.deps.projects.addProjectMember(ctx, member);
+    return created(member);
+};
+/**
+ * Guard the owner count before a demotion or removal goes through.
+ *
+ * `?confirm=true` is what distinguishes "I meant to do this" from a misclick;
+ * the sole-owner case has no confirmation, because there is no state the
+ * caller could confirm into that leaves the project manageable.
+ */
+async function assertOwnerRemovable(req, projectId, target, action) {
+    const { ctx } = requireCaller(req);
+    const page = await req.deps.projects.listProjectMembers(ctx, projectId, { limit: 200 });
+    const decision = checkOwnerRemoval({
+        target: { role: target.role },
+        allMembers: page.items.map((m) => ({ role: m.role })),
+        confirmed: req.url.searchParams.get('confirm') === 'true'
+    });
+    if (decision === 'sole_owner') {
+        apiError(409, ApiErrorCode.CONFLICT, `Cannot ${action} the sole owner of a project. Assign another owner first, or use reclaim to add a co-owner.`);
+    }
+    if (decision === 'needs_confirm') {
+        apiError(409, ApiErrorCode.CONFLICT, `${action === 'demote' ? 'Demoting' : 'Removing'} another project owner requires explicit confirmation. Retry with ?confirm=true.`);
+    }
+}
+export const updateProjectMemberRole = async (req) => {
+    const { id, userId } = requireParams(req.params, 'id', 'userId');
+    const { ctx } = requireCaller(req);
+    await requireCanManage(req, id, 'members');
+    const { role } = await parseBody(req.request, UpdateProjectMemberBodySchema);
+    // Demoting an owner reduces the owner count exactly like removing one, so
+    // it runs the same guard DELETE does. Without this a sole owner can PATCH
+    // themselves to `viewer` and lock the project — `canManage`,
+    // `canEditProjectSettings` and `canEdit` all go false at once.
+    if (role !== 'owner') {
+        const target = await req.deps.projects.getProjectMember(ctx, id, userId);
+        if (target?.role === 'owner') {
+            await assertOwnerRemovable(req, id, target, 'demote');
+        }
+    }
+    await req.deps.projects.updateProjectMemberRole(ctx, id, userId, role);
+    return noContent();
+};
+export const removeProjectMember = async (req) => {
+    const { id, userId } = requireParams(req.params, 'id', 'userId');
+    const { ctx } = requireCaller(req);
+    await requireCanManage(req, id, 'members');
+    const target = await req.deps.projects.getProjectMember(ctx, id, userId);
+    // Idempotent: already gone, or never there.
+    if (!target)
+        return noContent();
+    if (target.role === 'owner') {
+        await assertOwnerRemovable(req, id, target, 'remove');
+    }
+    await req.deps.projects.removeProjectMember(ctx, id, userId);
+    return noContent();
+};
+//# sourceMappingURL=projectMembers.js.map

package/dist/handlers/projectMembers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"projectMembers.js","sourceRoot":"","sources":["../../src/handlers/projectMembers.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACN,0BAA0B,EAC1B,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,OAAO,EACP,SAAS,EACT,SAAS,EACT,gBAAgB,EAChB,aAAa,EACb,aAAa,EACb,6BAA6B,EAC7B,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,iBAAiB,EAAwC,MAAM,mBAAmB,CAAC;AAC5F,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAEhF,MAAM,CAAC,MAAM,kBAAkB,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IAC3D,MAAM,EAAE,EAAE,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC/C,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,gBAAgB,CAAC,GAAG,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;IAE3C,OAAO,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,GAAG,EAAE,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACnG,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACzD,MAAM,EAAE,EAAE,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC/C,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,gBAAgB,CAAC,GAAG,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;IAE3C,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,0BAA0B,CAAC,CAAC;IAEvE,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC5D,IAAI,CAAC,OAAO;QAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACzE,MAAM,wBAAwB,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAEjE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,MAAM,GAAkB;QAC7B,SAAS,EAAE,EAAE;QACb,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ,EAAE,GAAG;QACb,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM;QACrC,SAAS,EAAE,IAAI;KACf,CAAC;IAEF,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACtD,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC;AACxB,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,KAAK,UAAU,oBAAoB,CAClC,GAAe,EACf,SAAiB,EACjB,MAA6B,EAC7B,MAA2B;IAE3B,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IACxF,MAAM,QAAQ,GAAG,iBAAiB,CAAC;QAClC,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;QAC7B,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACrD,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,MAAM;KACzD,CAAC,CAAC;IAEH,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC/B,QAAQ,CACP,GAAG,EACH,YAAY,CAAC,QAAQ,EACrB,UAAU,MAAM,6FAA6F,CAC7G,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,KAAK,eAAe,EAAE,CAAC;QAClC,QAAQ,CACP,GAAG,EACH,YAAY,CAAC,QAAQ,EACrB,GAAG,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,kFAAkF,CAClI,CAAC;IACH,CAAC;AACF,CAAC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IAChE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IACjE,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,gBAAgB,CAAC,GAAG,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;IAC3C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,6BAA6B,CAAC,CAAC;IAE7E,0EAA0E;IAC1E,0EAA0E;IAC1E,6DAA6D;IAC7D,+DAA+D;IAC/D,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QACzE,IAAI,MAAM,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;YAC9B,MAAM,oBAAoB,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QACvD,CAAC;IACF,CAAC;IAED,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,uBAAuB,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IACvE,OAAO,SAAS,EAAE,CAAC;AACpB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IAC5D,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IACjE,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,gBAAgB,CAAC,GAAG,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;IAE3C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;IACzE,4CAA4C;IAC5C,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,EAAE,CAAC;IAEhC,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC7B,MAAM,oBAAoB,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;IAC7D,OAAO,SAAS,EAAE,CAAC;AACpB,CAAC,CAAC"}

package/dist/handlers/projects.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Project handlers: the collection, and a single project's detail and settings.
+ *
+ * `listProjects` was authored against `resolveAccessibleProjects`, not lifted
+ * from the pre-v1 handler: that one listed every project in the acting org with
+ * no `canView` filter and had no UI caller, so it carried no evidence of being
+ * correct. The rest are lifted, logic intact, with reads moved onto `req.deps`.
+ */
+import { type ApiHandler } from '../api/index.js';
+export declare const listProjects: ApiHandler;
+export declare const createProject: ApiHandler;
+/**
+ * Project detail plus the caller's effective capabilities on it.
+ *
+ * A project the caller cannot view returns 404, not 403 — `403` would confirm
+ * the id exists to anyone probing.
+ */
+export declare const getProject: ApiHandler;
+export declare const updateProject: ApiHandler;
+export declare const deleteProject: ApiHandler;
+//# sourceMappingURL=projects.d.ts.map

package/dist/handlers/projects.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"projects.d.ts","sourceRoot":"","sources":["../../src/handlers/projects.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAYN,KAAK,UAAU,EACf,MAAM,iBAAiB,CAAC;AAsBzB,eAAO,MAAM,YAAY,EAAE,UAkB1B,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,UAiD3B,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,UAAU,EAAE,UAiCxB,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,UAuE3B,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,UAO3B,CAAC"}

package/dist/handlers/projects.js

@@ -0,0 +1,164 @@
+/**
+ * Project handlers: the collection, and a single project's detail and settings.
+ *
+ * `listProjects` was authored against `resolveAccessibleProjects`, not lifted
+ * from the pre-v1 handler: that one listed every project in the acting org with
+ * no `canView` filter and had no UI caller, so it carried no evidence of being
+ * correct. The rest are lifted, logic intact, with reads moved onto `req.deps`.
+ */
+import { randomUUID } from 'node:crypto';
+import { apiError, ApiErrorCode, collection, created, noContent, parseBody, parseListOptions, requireCaller, requireParams, CreateProjectBodySchema, UpdateProjectBodySchema } from '../api/index.js';
+import { canChangeVisibilityToPublic, canEdit, canSolve, canView, hasPermission, slugify, SYSTEM_CONTEXT, validateProjectFlags, withAdminBypass } from '@selvajs/platform';
+import { resolveAccessibleProjects } from '../definitions/index.js';
+import { projectAccessInputFromRowsWith, requireCanCreateProject, requireCanEditProjectSettings, requireCanManage } from '../access/index.js';
+import { createProjectWithUniqueSlug } from '../projects/index.js';
+export const listProjects = async (req) => {
+    const { ctx } = requireCaller(req);
+    const { projects } = await resolveAccessibleProjects(ctx, req.deps);
+    const { limit, cursor } = parseListOptions(req.url);
+    // The accessible set is resolved in-process rather than by the store, so the
+    // cursor is an index into it. Opaque to callers either way.
+    const start = cursor ? Number(cursor) : 0;
+    if (!Number.isInteger(start) || start < 0) {
+        apiError(400, ApiErrorCode.VALIDATION_FAILED, 'Invalid cursor');
+    }
+    const items = projects.slice(start, start + (limit ?? projects.length));
+    const nextIndex = start + items.length;
+    return collection({
+        items,
+        nextCursor: nextIndex < projects.length ? String(nextIndex) : undefined
+    });
+};
+export const createProject = async (req) => {
+    const { ctx, user } = requireCaller(req);
+    if (!ctx.actingOrgId)
+        apiError(400, ApiErrorCode.VALIDATION_FAILED, 'No active organization');
+    // Throws SvelteKit's `error()`; the host binding folds that into the
+    // envelope. Guards stay shared with the page loads that need them.
+    await requireCanCreateProject(req, ctx.actingOrgId);
+    const input = await parseBody(req.request, CreateProjectBodySchema);
+    // Same gate as PATCH: a `platform` project belongs to no org, so creating
+    // one here would put it beyond its own org's reach — and beyond anyone's
+    // with ENABLE_PLATFORM_PROJECTS off. Platform projects are created
+    // through /api/admin/projects.
+    if (input.visibility === 'platform' && !hasPermission(ctx, 'instance_admin')) {
+        apiError(403, ApiErrorCode.FORBIDDEN, 'Only a platform admin can create a project with platform visibility.');
+    }
+    const autoJoinOnUpload = input.autoJoinOnUpload ?? false;
+    // Same call PATCH makes, rather than a second hand-rolled copy of the
+    // flag/visibility invariant.
+    const flagIssues = validateProjectFlags({ visibility: input.visibility, autoJoinOnUpload });
+    if (flagIssues.length > 0) {
+        apiError(400, ApiErrorCode.VALIDATION_FAILED, flagIssues.map((i) => `${i.path}: ${i.message}`).join('; '));
+    }
+    const project = await createProjectWithUniqueSlug(req.deps.projects, {
+        id: randomUUID(),
+        orgId: ctx.actingOrgId,
+        name: input.name,
+        description: input.description,
+        visibility: input.visibility,
+        ownerId: user.id,
+        createdBy: user.id,
+        updatedBy: user.id,
+        autoJoinOnUpload
+    }, { writeCtx: ctx, fallbackSlug: 'project', conflictScope: 'this organization' });
+    return created(project);
+};
+/**
+ * Project detail plus the caller's effective capabilities on it.
+ *
+ * A project the caller cannot view returns 404, not 403 — `403` would confirm
+ * the id exists to anyone probing.
+ */
+export const getProject = async (req) => {
+    const { id } = requireParams(req.params, 'id');
+    const { ctx } = requireCaller(req);
+    // Read as SYSTEM to decide visibility here rather than let the store decide:
+    // the 404-not-403 rule above needs the row before it can hide it.
+    const project = await req.deps.projects.getProject(SYSTEM_CONTEXT, id);
+    if (!project)
+        apiError(404, ApiErrorCode.NOT_FOUND, 'Project not found');
+    const [orgMembers, projectMembers, grants] = await Promise.all([
+        req.deps.orgs.getOrgMembersFor(SYSTEM_CONTEXT, [project.orgId], ctx.userId),
+        req.deps.projects.getProjectMembersFor(SYSTEM_CONTEXT, [project.id], ctx.userId),
+        project.visibility === 'platform'
+            ? req.deps.platformProjectGrants.listByProject(SYSTEM_CONTEXT, project.id)
+            : Promise.resolve([])
+    ]);
+    const member = projectMembers.get(project.id) ?? null;
+    const input = projectAccessInputFromRowsWith(req, ctx, project, {
+        member,
+        orgMember: orgMembers.get(project.orgId) ?? null,
+        platformGrants: grants
+    });
+    if (!canView(input))
+        apiError(404, ApiErrorCode.NOT_FOUND, 'Project not found');
+    return {
+        body: {
+            ...project,
+            role: member?.role ?? null,
+            canEdit: canEdit(input),
+            canSolve: canSolve(input)
+        }
+    };
+};
+export const updateProject = async (req) => {
+    const { id } = requireParams(req.params, 'id');
+    // `requireCanEditProjectSettings` is owner-only at the project level — that
+    // IS the gate for editing settings. The platform-scope `manage_projects`
+    // check that used to live here was redundant for org owners/admins (they
+    // always carry it via DEFAULT_ORG_PERMISSIONS) and a regression for plain
+    // org members who happened to own a project — they'd hit 403 on their own
+    // project's settings.
+    const { ctx, project: existing } = await requireCanEditProjectSettings(req, id);
+    const input = await parseBody(req.request, UpdateProjectBodySchema);
+    // `platform` takes a project out of its org entirely: no org member can
+    // see it, `canReclaim` returns false forever, and with
+    // ENABLE_PLATFORM_PROJECTS off (the default) every rule denies everyone,
+    // including admins. Escalating into it must be instance-admin only.
+    if (input.visibility === 'platform' && existing.visibility !== 'platform') {
+        if (!hasPermission(ctx, 'instance_admin')) {
+            apiError(403, ApiErrorCode.FORBIDDEN, 'Only a platform admin can give a project platform visibility.');
+        }
+    }
+    // Flipping *to* public is a disclosure action — a stricter gate than a
+    // normal edit.
+    if (input.visibility === 'public' && existing.visibility !== 'public') {
+        const orgMember = await req.deps.orgs.getOrgMember(ctx, existing.orgId, ctx.userId);
+        const passes = withAdminBypass(ctx.platformPermissions, () => canChangeVisibilityToPublic({ orgMember }));
+        if (!passes) {
+            apiError(403, ApiErrorCode.FORBIDDEN, 'Only org owners or admins can make a project public.');
+        }
+    }
+    // The flag/visibility invariant runs on the merged post-patch shape, so a
+    // partial update is validated against what the project will become.
+    const flagIssues = validateProjectFlags({
+        visibility: input.visibility ?? existing.visibility,
+        autoJoinOnUpload: input.autoJoinOnUpload ?? existing.autoJoinOnUpload
+    });
+    if (flagIssues.length > 0) {
+        apiError(400, ApiErrorCode.VALIDATION_FAILED, flagIssues.map((i) => `${i.path}: ${i.message}`).join('; '));
+    }
+    const patch = {};
+    // A renamed project gets a re-derived slug; the two must not drift apart.
+    if (input.name !== undefined) {
+        patch.name = input.name;
+        patch.slug = slugify(input.name);
+    }
+    if (input.description !== undefined)
+        patch.description = input.description ?? undefined;
+    if (input.visibility !== undefined)
+        patch.visibility = input.visibility;
+    if (input.autoJoinOnUpload !== undefined)
+        patch.autoJoinOnUpload = input.autoJoinOnUpload;
+    await req.deps.projects.updateProject(ctx, id, patch);
+    return noContent();
+};
+export const deleteProject = async (req) => {
+    const { id } = requireParams(req.params, 'id');
+    const { ctx } = requireCaller(req);
+    await requireCanManage(req, id);
+    await req.deps.projects.deleteProject(ctx, id);
+    return noContent();
+};
+//# sourceMappingURL=projects.js.map

package/dist/handlers/projects.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"projects.js","sourceRoot":"","sources":["../../src/handlers/projects.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACN,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,OAAO,EACP,SAAS,EACT,SAAS,EACT,gBAAgB,EAChB,aAAa,EACb,aAAa,EACb,uBAAuB,EACvB,uBAAuB,EAEvB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACN,2BAA2B,EAC3B,OAAO,EACP,QAAQ,EACR,OAAO,EACP,aAAa,EACb,OAAO,EACP,cAAc,EACd,oBAAoB,EACpB,eAAe,EAEf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EACN,8BAA8B,EAC9B,uBAAuB,EACvB,6BAA6B,EAC7B,gBAAgB,EAChB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AAEnE,MAAM,CAAC,MAAM,YAAY,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACrD,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAEnC,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IACpE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACpD,6EAA6E;IAC7E,4DAA4D;IAC5D,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QAC3C,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,KAAK,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACxE,MAAM,SAAS,GAAG,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC;IACvC,OAAO,UAAU,CAAC;QACjB,KAAK;QACL,UAAU,EAAE,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS;KACvE,CAAC,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACtD,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,CAAC,GAAG,CAAC,WAAW;QAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,wBAAwB,CAAC,CAAC;IAC9F,qEAAqE;IACrE,mEAAmE;IACnE,MAAM,uBAAuB,CAAC,GAAG,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;IAEpD,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,uBAAuB,CAAC,CAAC;IAEpE,0EAA0E;IAC1E,yEAAyE;IACzE,mEAAmE;IACnE,+BAA+B;IAC/B,IAAI,KAAK,CAAC,UAAU,KAAK,UAAU,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,gBAAgB,CAAC,EAAE,CAAC;QAC9E,QAAQ,CACP,GAAG,EACH,YAAY,CAAC,SAAS,EACtB,sEAAsE,CACtE,CAAC;IACH,CAAC;IAED,MAAM,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,IAAI,KAAK,CAAC;IACzD,sEAAsE;IACtE,6BAA6B;IAC7B,MAAM,UAAU,GAAG,oBAAoB,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC5F,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,QAAQ,CACP,GAAG,EACH,YAAY,CAAC,iBAAiB,EAC9B,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAC3D,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,2BAA2B,CAChD,GAAG,CAAC,IAAI,CAAC,QAAQ,EACjB;QACC,EAAE,EAAE,UAAU,EAAE;QAChB,KAAK,EAAE,GAAG,CAAC,WAAW;QACtB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,OAAO,EAAE,IAAI,CAAC,EAAE;QAChB,SAAS,EAAE,IAAI,CAAC,EAAE;QAClB,SAAS,EAAE,IAAI,CAAC,EAAE;QAClB,gBAAgB;KAChB,EACD,EAAE,QAAQ,EAAE,GAAG,EAAE,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,mBAAmB,EAAE,CAC9E,CAAC;IACF,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;AACzB,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,UAAU,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACnD,MAAM,EAAE,EAAE,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC/C,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAEnC,6EAA6E;IAC7E,kEAAkE;IAClE,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IACvE,IAAI,CAAC,OAAO;QAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IAEzE,MAAM,CAAC,UAAU,EAAE,cAAc,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC9D,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,cAAc,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC;QAC3E,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,cAAc,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC;QAChF,OAAO,CAAC,UAAU,KAAK,UAAU;YAChC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,qBAAqB,CAAC,aAAa,CAAC,cAAc,EAAE,OAAO,CAAC,EAAE,CAAC;YAC1E,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;KACtB,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC;IACtD,MAAM,KAAK,GAAG,8BAA8B,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE;QAC/D,MAAM;QACN,SAAS,EAAE,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI;QAChD,cAAc,EAAE,MAAM;KACtB,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IAEhF,OAAO;QACN,IAAI,EAAE;YACL,GAAG,OAAO;YACV,IAAI,EAAE,MAAM,EAAE,IAAI,IAAI,IAAI;YAC1B,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC;YACvB,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC;SACzB;KACD,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACtD,MAAM,EAAE,EAAE,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAE/C,4EAA4E;IAC5E,yEAAyE;IACzE,yEAAyE;IACzE,0EAA0E;IAC1E,0EAA0E;IAC1E,sBAAsB;IACtB,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,6BAA6B,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAEhF,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,uBAAuB,CAAC,CAAC;IAEpE,wEAAwE;IACxE,uDAAuD;IACvD,yEAAyE;IACzE,oEAAoE;IACpE,IAAI,KAAK,CAAC,UAAU,KAAK,UAAU,IAAI,QAAQ,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;QAC3E,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,gBAAgB,CAAC,EAAE,CAAC;YAC3C,QAAQ,CACP,GAAG,EACH,YAAY,CAAC,SAAS,EACtB,+DAA+D,CAC/D,CAAC;QACH,CAAC;IACF,CAAC;IAED,uEAAuE;IACvE,eAAe;IACf,IAAI,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,QAAQ,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QACvE,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACpF,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAC5D,2BAA2B,CAAC,EAAE,SAAS,EAAE,CAAC,CAC1C,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,sDAAsD,CAAC,CAAC;QAC/F,CAAC;IACF,CAAC;IAED,0EAA0E;IAC1E,oEAAoE;IACpE,MAAM,UAAU,GAAG,oBAAoB,CAAC;QACvC,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,QAAQ,CAAC,UAAU;QACnD,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,IAAI,QAAQ,CAAC,gBAAgB;KACrE,CAAC,CAAC;IACH,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,QAAQ,CACP,GAAG,EACH,YAAY,CAAC,iBAAiB,EAC9B,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAC3D,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAMP,EAAE,CAAC;IACP,0EAA0E;IAC1E,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;QACxB,KAAK,CAAC,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS;QAAE,KAAK,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,SAAS,CAAC;IACxF,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;QAAE,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;IACxE,IAAI,KAAK,CAAC,gBAAgB,KAAK,SAAS;QAAE,KAAK,CAAC,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,CAAC;IAE1F,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,GAAG,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;IACtD,OAAO,SAAS,EAAE,CAAC;AACpB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACtD,MAAM,EAAE,EAAE,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC/C,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,gBAAgB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAEhC,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC/C,OAAO,SAAS,EAAE,CAAC;AACpB,CAAC,CAAC"}

package/dist/handlers/reclaim.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Org owner/admin escape hatch for a project they cannot otherwise reach.
+ *
+ * Adds the actor as a co-owner and does NOT demote the existing owner.
+ * Idempotent: reclaiming twice is a no-op, because `addProjectMember`
+ * reactivates a soft-deleted row in place.
+ */
+import { type ApiHandler } from '../api/index.js';
+export declare const reclaimProject: ApiHandler;
+//# sourceMappingURL=reclaim.d.ts.map

package/dist/handlers/reclaim.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reclaim.d.ts","sourceRoot":"","sources":["../../src/handlers/reclaim.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAA0B,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAI1E,eAAO,MAAM,cAAc,EAAE,UA8B5B,CAAC"}