@selvajs/server 1.2.0 → 1.3.0

package/dist/access/guards.d.ts

@@ -0,0 +1,213 @@
+/**
+ * The permission guards every API handler runs before touching a store.
+ *
+ * These name no framework. A guard raises `ApiError`, which `runHandler` folds
+ * into the response envelope — so the same guard protects a SvelteKit route, a
+ * Next route handler, or a Hono route behind that host's own adapter.
+ *
+ * **Guards that redirect stay with the host.** A redirect is a browser-page
+ * concept, not an API one, and a framework implements it by throwing a value
+ * only that framework understands.
+ *
+ * A caller outside an API route — a page load, or a route that builds its own
+ * `Response` — has to convert the `ApiError` at its boundary, since a framework
+ * will not recognize it. Selva does that with `asHttpError` in
+ * `access.server.ts`; SvelteKit gives anything that is not its own `HttpError` a
+ * 500, so an unconverted guard denial reads as a crash.
+ *
+ * Providers arrive through {@link AccessDeps} rather than being resolved here.
+ * That is what keeps this module importable without booting an app: a guard
+ * that reached for a module global would drag the whole composition root — and
+ * its top-level `await createSelvaProviders()` — into every consumer.
+ */
+import type { AuthUser, DefinitionRecord, OrgPermission, OrgRole, PlatformPermission, Project, RequestContext, SelvaConfig } from '@selvajs/platform';
+import { type ProjectAccessInputBuilder } from './project-access-input.js';
+import type { SelvaDeps } from '../api/deps.js';
+export type AnyPermission = PlatformPermission | OrgPermission;
+/**
+ * What the permission-only guards read.
+ *
+ * `deps` is absent here on purpose: `requirePermission` and friends check
+ * `ctx.platformPermissions` and touch no store, so demanding providers from
+ * their callers — the ~20 admin routes and page loads that only ever ask "may
+ * this user do X?" — would be a cost with nothing behind it. The guards that do
+ * read stores take `HasDeps` instead, which requires them.
+ */
+export interface Locals {
+    user?: AuthUser;
+    ctx?: RequestContext;
+}
+/**
+ * What a store-reading guard takes: identity plus the providers to read with.
+ *
+ * `ApiRequest` satisfies this structurally, so a mounted handler passes itself.
+ * Everyone else passes `scoped(locals)`.
+ */
+type ScopedLocals = Locals & HasDeps;
+/**
+ * The stores a guard reads, injected rather than resolved.
+ *
+ * `ApiRequest` satisfies this structurally, so a mounted handler passes itself
+ * and the guard runs against that request's providers.
+ *
+ * **Required, not optional.** These guards used to fall back to a host's module
+ * globals when no `deps` arrived, which meant importing this file pulled in that
+ * host's composition root — in Selva a module running a top-level
+ * `await createSelvaProviders()`, so any handler importing a guard booted the
+ * whole provider stack. That is what kept these guards in the app; a caller with
+ * no `deps` in hand builds them with `accessDepsFromConfig`.
+ */
+export type AccessDeps = Pick<SelvaDeps, 'orgs' | 'projects' | 'definitionMeta' | 'platformProjectGrants' | 'flag'>;
+interface HasDeps {
+    deps: AccessDeps;
+}
+/**
+ * Derive the stores a guard needs from a resolved config.
+ *
+ * Pure — it reads the config it is handed and nothing else, which is what keeps
+ * this module free of any import that boots the app. Page loads pass
+ * `locals.providers`; `hooks.server.ts` sets it on every request.
+ */
+export declare function accessDepsFromConfig(config: SelvaConfig): AccessDeps;
+/** `locals` as a store-reading guard wants it. */
+export declare function scoped<L extends Locals & {
+    providers: SelvaConfig;
+}>(locals: L): L & {
+    deps: AccessDeps;
+};
+export declare function requireAuthed(locals: Locals): {
+    user: AuthUser;
+    ctx: RequestContext;
+};
+/** Throws 403 — use in API routes. */
+export declare function requirePermission(locals: Locals, permission: AnyPermission): AuthUser;
+export declare const requireManageInstanceUsers: (locals: Locals) => AuthUser;
+export declare const requireManageCompute: (locals: Locals) => AuthUser;
+export declare const requireManageOrgMembers: (locals: Locals) => AuthUser;
+export declare const requireManageOrgCompute: (locals: Locals) => AuthUser;
+export declare const requireInstanceAdmin: (locals: Locals) => AuthUser;
+/**
+ * Platform scope is not delegable: `manage_instance_users` runs the user-admin
+ * surface but must not be able to mint an `instance_admin`, or an org admin
+ * holding it self-elevates. Three routes write platform permissions — the two
+ * `/api/admin/users` handlers and the invite mint route — and each carried its
+ * own copy of this check.
+ *
+ * Pass `current` on an update. Revoking is a platform-scope change too, so a
+ * PATCH that drops `instance_admin` is refused for the same reason granting it
+ * is; without `current` the caller is creating (a user, an invite) and there is
+ * nothing to compare against.
+ *
+ * Requesting nothing on a create is always allowed — that is a
+ * `manage_instance_users` operation, not a platform-scope one.
+ */
+export declare function assertCanGrantPlatformPermissions(ctx: RequestContext, requested: readonly PlatformPermission[], current?: readonly PlatformPermission[]): void;
+/**
+ * Tenancy gate for `/api/v1/orgs/{orgId}/…`. The URL id is never trusted alone
+ * — the acting context decides which tenant a request applies to, so a
+ * mismatch is 403 rather than a silent read of the caller's own org.
+ */
+export declare function requireActingOrg(locals: Locals, orgId: string | undefined): {
+    ctx: RequestContext;
+    orgId: string;
+};
+/**
+ * Assemble a rule input from rows the caller already loaded.
+ *
+ * Unlike the other builders this one issues no reads — the caller batched them.
+ * It still needs `deps` for the flag lookups, which decide whether a
+ * cross-org-public or platform project is visible at all.
+ */
+export declare function projectAccessInputFromRowsWith(src: HasDeps, ...args: Parameters<ProjectAccessInputBuilder['projectAccessInputFromRows']>): import("@selvajs/platform").ProjectAccessInput;
+/**
+ * Gates creation of a *new* definition. Container projects require project
+ * owner/editor (canEdit). Commons projects (`autoJoinOnUpload=true`) accept
+ * any authenticated user — the handler stamps `ownerId = user.id` so the
+ * uploader becomes the owner.
+ */
+export declare function requireCanCreateDefinition(locals: ScopedLocals, projectId: string): Promise<{
+    user: AuthUser;
+    ctx: RequestContext;
+    project: Project;
+}>;
+/**
+ * Org-content gate — the caller must be a member of `orgId`. Used by the
+ * file-serving proxy for org-private assets (e.g. pricing sheets under
+ * `orgs/{id}/private/*`). Org membership is the only rule; runs through
+ * `contentCheck` (no `instance_admin` bypass) — platform staff use Reclaim
+ * if they need access without membership.
+ *
+ * Throws 401 unauthenticated, 403 when not a member.
+ */
+export declare function requireCanViewOrg(locals: ScopedLocals, orgId: string): Promise<AuthUser>;
+/**
+ * Project members must belong to the project's parent org. Enforced at the
+ * rule layer, not as a DB constraint, to leave room for cross-org guests
+ * later without a schema migration.
+ */
+export declare function requireTargetIsOrgMember(locals: ScopedLocals, orgId: string, targetUserId: string): Promise<void>;
+/**
+ * `canChangeOrgRole` with the actor's membership row loaded — whether the
+ * caller may grant or revoke org `owner`/`admin` standing (§3).
+ *
+ * Returns rather than throws: the three callers each phrase the refusal for
+ * what they were doing ("invite someone as owner", "change roles", "remove
+ * another owner") and raise it through `apiError`. What must not diverge is the
+ * decision, which is why that half lives in `rules.ts` and this loads its input.
+ */
+export declare function canActorChangeOrgRole(ctx: RequestContext, orgId: string, role: OrgRole, src: HasDeps): Promise<boolean>;
+/**
+ * `canReclaim` — org owner/admin escape hatch. Returns the project so the
+ * handler can use its `orgId` without re-fetching.
+ */
+export declare function requireCanReclaim(locals: ScopedLocals, projectId: string): Promise<{
+    user: AuthUser;
+    ctx: RequestContext;
+    project: Project;
+}>;
+/**
+ * `canCreateProject` — owner/admin always; member needs `manage_projects`.
+ * Tenancy is enforced via `actingOrgId`.
+ */
+export declare function requireCanCreateProject(locals: ScopedLocals, targetOrgId: string): Promise<{
+    user: AuthUser;
+    ctx: RequestContext;
+}>;
+/**
+ * Project-management gate (`canManage` — owner, or `instance_admin` via the
+ * bypass). Managing members is the same authority as managing the project, so
+ * both callers share this; `action` only shapes the 403 message.
+ */
+export declare function requireCanManage(locals: ScopedLocals, projectId: string, action?: 'project' | 'members'): Promise<AuthUser>;
+export declare function requireCanEditProjectSettings(locals: ScopedLocals, projectId: string): Promise<{
+    user: AuthUser;
+    ctx: RequestContext;
+    project: Project;
+}>;
+export declare function requireCanViewProject(locals: ScopedLocals, projectId: string): Promise<AuthUser>;
+/**
+ * Solve gating. Today `canSolve === canView` for non-platform projects, but
+ * the rule lives in its own function so future cost-gating (quotas, rate
+ * limits) lands without touching view semantics. `viewer` project role
+ * passes; platform projects narrow to grants with `canSolve=true`.
+ */
+export declare function requireCanSolve(locals: ScopedLocals, projectId: string, preloadedProject?: Project): Promise<{
+    user: AuthUser;
+    ctx: RequestContext;
+    project: Project;
+}>;
+/**
+ * Loads the record and gates editing. Returns the record AND the project it
+ * loads for the gate, so callers skip a re-fetch of either.
+ */
+export declare function requireEditableDefinition(locals: ScopedLocals, guid: string): Promise<{
+    record: DefinitionRecord;
+    ctx: RequestContext;
+    project: Project | null;
+}>;
+export declare function requireCanEditDefinition(locals: ScopedLocals, projectId: string, definitionGuid: string, preloaded?: {
+    project?: Project | null;
+    definition?: DefinitionRecord | null;
+}): Promise<AuthUser>;
+export {};
+//# sourceMappingURL=guards.d.ts.map

package/dist/access/guards.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guards.d.ts","sourceRoot":"","sources":["../../src/access/guards.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EACX,QAAQ,EACR,gBAAgB,EAEhB,aAAa,EACb,OAAO,EACP,kBAAkB,EAClB,OAAO,EACP,cAAc,EACd,WAAW,EACX,MAAM,mBAAmB,CAAC;AAc3B,OAAO,EAEN,KAAK,yBAAyB,EAC9B,MAAM,2BAA2B,CAAC;AAEnC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,MAAM,MAAM,aAAa,GAAG,kBAAkB,GAAG,aAAa,CAAC;AAE/D;;;;;;;;GAQG;AACH,MAAM,WAAW,MAAM;IACtB,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,GAAG,CAAC,EAAE,cAAc,CAAC;CACrB;AAED;;;;;GAKG;AACH,KAAK,YAAY,GAAG,MAAM,GAAG,OAAO,CAAC;AAErC;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,UAAU,GAAG,IAAI,CAC5B,SAAS,EACT,MAAM,GAAG,UAAU,GAAG,gBAAgB,GAAG,uBAAuB,GAAG,MAAM,CACzE,CAAC;AAEF,UAAU,OAAO;IAChB,IAAI,EAAE,UAAU,CAAC;CACjB;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,WAAW,GAAG,UAAU,CAQpE;AAED,kDAAkD;AAClD,wBAAgB,MAAM,CAAC,CAAC,SAAS,MAAM,GAAG;IAAE,SAAS,EAAE,WAAW,CAAA;CAAE,EACnE,MAAM,EAAE,CAAC,GACP,CAAC,GAAG;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,CAE1B;AAUD,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,GAAG,EAAE,cAAc,CAAA;CAAE,CAIrF;AAED,sCAAsC;AACtC,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,GAAG,QAAQ,CAMrF;AAMD,eAAO,MAAM,0BAA0B,GAAI,QAAQ,MAAM,aACN,CAAC;AACpD,eAAO,MAAM,oBAAoB,GAAI,QAAQ,MAAM,aAAgD,CAAC;AACpG,eAAO,MAAM,uBAAuB,GAAI,QAAQ,MAAM,aACN,CAAC;AACjD,eAAO,MAAM,uBAAuB,GAAI,QAAQ,MAAM,aACN,CAAC;AAEjD,eAAO,MAAM,oBAAoB,GAAI,QAAQ,MAAM,aAAgD,CAAC;AAEpG;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iCAAiC,CAChD,GAAG,EAAE,cAAc,EACnB,SAAS,EAAE,SAAS,kBAAkB,EAAE,EACxC,OAAO,CAAC,EAAE,SAAS,kBAAkB,EAAE,GACrC,IAAI,CAeN;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC/B,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GAAG,SAAS,GACvB;IAAE,GAAG,EAAE,cAAc,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CASxC;AAoED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAC7C,GAAG,EAAE,OAAO,EACZ,GAAG,IAAI,EAAE,UAAU,CAAC,yBAAyB,CAAC,4BAA4B,CAAC,CAAC,kDAG5E;AAED;;;;;GAKG;AACH,wBAAsB,0BAA0B,CAC/C,MAAM,EAAE,YAAY,EACpB,SAAS,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,GAAG,EAAE,cAAc,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAepE;AAED;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAS9F;AAED;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC7C,MAAM,EAAE,YAAY,EACpB,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC,CAUf;AAED;;;;;;;;GAQG;AACH,wBAAsB,qBAAqB,CAC1C,GAAG,EAAE,cAAc,EACnB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,OAAO,EACb,GAAG,EAAE,OAAO,GACV,OAAO,CAAC,OAAO,CAAC,CAIlB;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACtC,MAAM,EAAE,YAAY,EACpB,SAAS,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,GAAG,EAAE,cAAc,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CA6BpE;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAC5C,MAAM,EAAE,YAAY,EACpB,WAAW,EAAE,MAAM,GACjB,OAAO,CAAC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,GAAG,EAAE,cAAc,CAAA;CAAE,CAAC,CAkBlD;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACrC,MAAM,EAAE,YAAY,EACpB,SAAS,EAAE,MAAM,EACjB,MAAM,GAAE,SAAS,GAAG,SAAqB,GACvC,OAAO,CAAC,QAAQ,CAAC,CAgBnB;AAID,wBAAsB,6BAA6B,CAClD,MAAM,EAAE,YAAY,EACpB,SAAS,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,GAAG,EAAE,cAAc,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CASpE;AAED,wBAAsB,qBAAqB,CAC1C,MAAM,EAAE,YAAY,EACpB,SAAS,EAAE,MAAM,GACf,OAAO,CAAC,QAAQ,CAAC,CAQnB;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CACpC,MAAM,EAAE,YAAY,EACpB,SAAS,EAAE,MAAM,EAGjB,gBAAgB,CAAC,EAAE,OAAO,GACxB,OAAO,CAAC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,GAAG,EAAE,cAAc,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAQpE;AAiBD;;;GAGG;AACH,wBAAsB,yBAAyB,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM;;;;GAuBjF;AAED,wBAAsB,wBAAwB,CAC7C,MAAM,EAAE,YAAY,EACpB,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,MAAM,EAItB,SAAS,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IAAC,UAAU,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAA;CAAE,GAC5E,OAAO,CAAC,QAAQ,CAAC,CAyBnB"}

package/dist/access/guards.js

@@ -0,0 +1,417 @@
+/**
+ * The permission guards every API handler runs before touching a store.
+ *
+ * These name no framework. A guard raises `ApiError`, which `runHandler` folds
+ * into the response envelope — so the same guard protects a SvelteKit route, a
+ * Next route handler, or a Hono route behind that host's own adapter.
+ *
+ * **Guards that redirect stay with the host.** A redirect is a browser-page
+ * concept, not an API one, and a framework implements it by throwing a value
+ * only that framework understands.
+ *
+ * A caller outside an API route — a page load, or a route that builds its own
+ * `Response` — has to convert the `ApiError` at its boundary, since a framework
+ * will not recognize it. Selva does that with `asHttpError` in
+ * `access.server.ts`; SvelteKit gives anything that is not its own `HttpError` a
+ * 500, so an unconverted guard denial reads as a crash.
+ *
+ * Providers arrive through {@link AccessDeps} rather than being resolved here.
+ * That is what keeps this module importable without booting an app: a guard
+ * that reached for a module global would drag the whole composition root — and
+ * its top-level `await createSelvaProviders()` — into every consumer.
+ */
+import { isFlagEnabled, hasPermission, canReclaim, canCreateProject, canChangeOrgRole, canView, canSolve, canEdit, canManage, canEditProjectSettings, canEditDefinition } from '@selvajs/platform';
+import { createProjectAccessInputBuilder } from './project-access-input.js';
+import { apiError, ApiErrorCode } from '../api/errors.js';
+/**
+ * Derive the stores a guard needs from a resolved config.
+ *
+ * Pure — it reads the config it is handed and nothing else, which is what keeps
+ * this module free of any import that boots the app. Page loads pass
+ * `locals.providers`; `hooks.server.ts` sets it on every request.
+ */
+export function accessDepsFromConfig(config) {
+    return {
+        orgs: config.data.orgs,
+        projects: config.data.projects,
+        definitionMeta: config.data.definitions,
+        platformProjectGrants: config.data.platformProjectGrants,
+        flag: (name) => isFlagEnabled(config, name)
+    };
+}
+/** `locals` as a store-reading guard wants it. */
+export function scoped(locals) {
+    return { ...locals, deps: accessDepsFromConfig(locals.providers) };
+}
+// Accessors rather than `src.deps.orgs` inline: they keep the 17 call sites
+// below reading the same as before, and they are the single place that would
+// change if `AccessDeps` grew a store.
+const orgsOf = (src) => src.deps.orgs;
+const projectsOf = (src) => src.deps.projects;
+const definitionMetaOf = (src) => src.deps.definitionMeta;
+const flagOf = (src) => src.deps.flag;
+export function requireAuthed(locals) {
+    const { user, ctx } = locals;
+    if (!user || !ctx)
+        apiError(401, ApiErrorCode.UNAUTHORIZED, 'Unauthorized');
+    return { user, ctx };
+}
+/** Throws 403 — use in API routes. */
+export function requirePermission(locals, permission) {
+    const { user, ctx } = requireAuthed(locals);
+    if (!hasPermission(ctx, permission)) {
+        apiError(403, ApiErrorCode.FORBIDDEN, `You don't have permission to do this.`);
+    }
+    return user;
+}
+// Named aliases exist only for permissions with real call sites. Routes gating
+// on anything else call `requirePermission(locals, '…')` directly rather than
+// growing an alias per permission — `manage_definitions` and `manage_projects`
+// had wrappers that nothing ever called.
+export const requireManageInstanceUsers = (locals) => requirePermission(locals, 'manage_instance_users');
+export const requireManageCompute = (locals) => requirePermission(locals, 'manage_compute');
+export const requireManageOrgMembers = (locals) => requirePermission(locals, 'manage_org_members');
+export const requireManageOrgCompute = (locals) => requirePermission(locals, 'manage_org_compute');
+export const requireInstanceAdmin = (locals) => requirePermission(locals, 'instance_admin');
+/**
+ * Platform scope is not delegable: `manage_instance_users` runs the user-admin
+ * surface but must not be able to mint an `instance_admin`, or an org admin
+ * holding it self-elevates. Three routes write platform permissions — the two
+ * `/api/admin/users` handlers and the invite mint route — and each carried its
+ * own copy of this check.
+ *
+ * Pass `current` on an update. Revoking is a platform-scope change too, so a
+ * PATCH that drops `instance_admin` is refused for the same reason granting it
+ * is; without `current` the caller is creating (a user, an invite) and there is
+ * nothing to compare against.
+ *
+ * Requesting nothing on a create is always allowed — that is a
+ * `manage_instance_users` operation, not a platform-scope one.
+ */
+export function assertCanGrantPlatformPermissions(ctx, requested, current) {
+    const changed = current
+        ? requested.length !== current.length ||
+            requested.some((p) => !current.includes(p)) ||
+            current.some((p) => !requested.includes(p))
+        : requested.length > 0;
+    if (!changed)
+        return;
+    if (hasPermission(ctx, 'instance_admin'))
+        return;
+    apiError(403, ApiErrorCode.FORBIDDEN, current
+        ? 'Only a platform admin can change platform-scope permissions'
+        : 'Only a platform admin can grant platform-scope permissions');
+}
+/**
+ * Tenancy gate for `/api/v1/orgs/{orgId}/…`. The URL id is never trusted alone
+ * — the acting context decides which tenant a request applies to, so a
+ * mismatch is 403 rather than a silent read of the caller's own org.
+ */
+export function requireActingOrg(locals, orgId) {
+    const ctx = locals.ctx;
+    if (!ctx)
+        apiError(401, ApiErrorCode.UNAUTHORIZED, 'Unauthorized');
+    if (!orgId)
+        apiError(400, ApiErrorCode.VALIDATION_FAILED, 'Missing org ID');
+    if (!ctx.actingOrgId)
+        apiError(400, ApiErrorCode.VALIDATION_FAILED, 'No active organization');
+    if (ctx.actingOrgId !== orgId) {
+        apiError(403, ApiErrorCode.FORBIDDEN, 'Acting org does not match the target org.');
+    }
+    return { ctx, orgId };
+}
+/**
+ * Gate for pages reachable by any platform-class permission holder (the
+
+/**
+ * Management-scope bypass — used for org governance and project management
+ * actions (Reclaim, create project, delete project, manage members, edit
+ * settings). `instance_admin` bypasses these so platform staff can administer
+ * the instance without being a member of every org.
+ *
+ * NOT used for content access (view, solve, edit definitions):
+ * `instance_admin` follows the same `canView`/`canEdit` rules as any other
+ * user there, keeping blast radius small and forcing content escalation
+ * through Reclaim, which leaves an audit trail.
+ */
+async function managementBypassOrRun(ctx, check) {
+    if (hasPermission(ctx, 'instance_admin'))
+        return true;
+    return await check();
+}
+// Content-scope check — NO `instance_admin` bypass. `canView`, `canSolve`,
+// `canEdit`, and `canEditDefinition` run as-is regardless of platform role;
+// platform staff use Reclaim first if they need content access.
+async function contentCheck(check) {
+    return await check();
+}
+async function loadProjectOr404(ctx, projectId, src) {
+    const project = await projectsOf(src).getProject(ctx, projectId);
+    if (!project)
+        apiError(404, ApiErrorCode.NOT_FOUND, 'Project not found');
+    return project;
+}
+// Rule-input assembly (the "which rows does each visibility need" knowledge)
+// lives in `@selvajs/server/access`; this binding wires it to the provider set
+// the caller carries.
+function accessInputsFor(src) {
+    const readFlag = flagOf(src);
+    return createProjectAccessInputBuilder({
+        getProjectMember: (ctx, projectId, userId) => projectsOf(src).getProjectMember(ctx, projectId, userId),
+        getOrgMember: (ctx, orgId, userId) => orgsOf(src).getOrgMember(ctx, orgId, userId),
+        listPlatformGrants: (ctx, projectId) => src.deps.platformProjectGrants.listByProject(ctx, projectId),
+        flags: () => ({
+            allowCrossOrgPublic: readFlag('ALLOW_CROSS_ORG_PUBLIC'),
+            enablePlatformProjects: readFlag('ENABLE_PLATFORM_PROJECTS')
+        })
+    });
+}
+function buildProjectAccessInput(ctx, project, src, overrides) {
+    return accessInputsFor(src).buildProjectAccessInput(ctx, project, overrides);
+}
+/**
+ * Assemble a rule input from rows the caller already loaded.
+ *
+ * Unlike the other builders this one issues no reads — the caller batched them.
+ * It still needs `deps` for the flag lookups, which decide whether a
+ * cross-org-public or platform project is visible at all.
+ */
+export function projectAccessInputFromRowsWith(src, ...args) {
+    return accessInputsFor(src).projectAccessInputFromRows(...args);
+}
+/**
+ * Gates creation of a *new* definition. Container projects require project
+ * owner/editor (canEdit). Commons projects (`autoJoinOnUpload=true`) accept
+ * any authenticated user — the handler stamps `ownerId = user.id` so the
+ * uploader becomes the owner.
+ */
+export async function requireCanCreateDefinition(locals, projectId) {
+    const { user, ctx } = requireAuthed(locals);
+    const project = await loadProjectOr404(ctx, projectId, locals);
+    const allowed = await contentCheck(async () => {
+        if (project.autoJoinOnUpload)
+            return true;
+        return canEdit(await buildProjectAccessInput(ctx, project, locals));
+    });
+    if (!allowed) {
+        apiError(403, ApiErrorCode.FORBIDDEN, 'You do not have permission to upload definitions to this project.');
+    }
+    return { user, ctx, project };
+}
+/**
+ * Org-content gate — the caller must be a member of `orgId`. Used by the
+ * file-serving proxy for org-private assets (e.g. pricing sheets under
+ * `orgs/{id}/private/*`). Org membership is the only rule; runs through
+ * `contentCheck` (no `instance_admin` bypass) — platform staff use Reclaim
+ * if they need access without membership.
+ *
+ * Throws 401 unauthenticated, 403 when not a member.
+ */
+export async function requireCanViewOrg(locals, orgId) {
+    const { user, ctx } = requireAuthed(locals);
+    const allowed = await contentCheck(async () => {
+        const member = await orgsOf(locals).getOrgMember(ctx, orgId, ctx.userId);
+        return member !== null;
+    });
+    if (!allowed)
+        apiError(403, ApiErrorCode.FORBIDDEN, 'You do not have access to this organization.');
+    return user;
+}
+/**
+ * Project members must belong to the project's parent org. Enforced at the
+ * rule layer, not as a DB constraint, to leave room for cross-org guests
+ * later without a schema migration.
+ */
+export async function requireTargetIsOrgMember(locals, orgId, targetUserId) {
+    const { ctx } = requireAuthed(locals);
+    const member = await orgsOf(locals).getOrgMember(ctx, orgId, targetUserId);
+    if (!member) {
+        apiError(400, ApiErrorCode.VALIDATION_FAILED, 'User must be a member of this organization to be added to a project.');
+    }
+}
+/**
+ * `canChangeOrgRole` with the actor's membership row loaded — whether the
+ * caller may grant or revoke org `owner`/`admin` standing (§3).
+ *
+ * Returns rather than throws: the three callers each phrase the refusal for
+ * what they were doing ("invite someone as owner", "change roles", "remove
+ * another owner") and raise it through `apiError`. What must not diverge is the
+ * decision, which is why that half lives in `rules.ts` and this loads its input.
+ */
+export async function canActorChangeOrgRole(ctx, orgId, role, src) {
+    if (role === 'member')
+        return true;
+    const actorMember = await orgsOf(src).getOrgMember(ctx, orgId, ctx.userId);
+    return canChangeOrgRole({ actorMember, role });
+}
+/**
+ * `canReclaim` — org owner/admin escape hatch. Returns the project so the
+ * handler can use its `orgId` without re-fetching.
+ */
+export async function requireCanReclaim(locals, projectId) {
+    const { user, ctx } = requireAuthed(locals);
+    const project = await loadProjectOr404(ctx, projectId, locals);
+    // Ahead of the bypass, not inside the check: `instance_admin` short-circuits
+    // `managementBypassOrRun`, so `canReclaim`'s platform-project refusal (§4a)
+    // never ran for the one role that could reach it. Reclaim is content
+    // escalation wearing management clothing — the management bypass is not its
+    // to inherit.
+    if (project.visibility === 'platform') {
+        apiError(403, ApiErrorCode.FORBIDDEN, 'Platform projects cannot be reclaimed.');
+    }
+    const allowed = await managementBypassOrRun(ctx, async () => {
+        const orgMember = await orgsOf(locals).getOrgMember(ctx, project.orgId, ctx.userId);
+        return canReclaim({
+            project,
+            orgMember,
+            actingOrgId: ctx.actingOrgId ?? null
+        });
+    });
+    if (!allowed) {
+        apiError(403, ApiErrorCode.FORBIDDEN, 'Only org owners or admins of this project’s org can reclaim it.');
+    }
+    return { user, ctx, project };
+}
+/**
+ * `canCreateProject` — owner/admin always; member needs `manage_projects`.
+ * Tenancy is enforced via `actingOrgId`.
+ */
+export async function requireCanCreateProject(locals, targetOrgId) {
+    const { user, ctx } = requireAuthed(locals);
+    const allowed = await managementBypassOrRun(ctx, async () => {
+        const orgMember = await orgsOf(locals).getOrgMember(ctx, targetOrgId, ctx.userId);
+        return canCreateProject({
+            orgPermissions: ctx.orgPermissions,
+            orgMember,
+            actingOrgId: ctx.actingOrgId ?? null,
+            targetOrgId
+        });
+    });
+    if (!allowed)
+        apiError(403, ApiErrorCode.FORBIDDEN, 'You do not have permission to create projects in this org.');
+    return { user, ctx };
+}
+/**
+ * Project-management gate (`canManage` — owner, or `instance_admin` via the
+ * bypass). Managing members is the same authority as managing the project, so
+ * both callers share this; `action` only shapes the 403 message.
+ */
+export async function requireCanManage(locals, projectId, action = 'project') {
+    const { user, ctx } = requireAuthed(locals);
+    const allowed = await managementBypassOrRun(ctx, async () => {
+        const project = await loadProjectOr404(ctx, projectId, locals);
+        return canManage(await buildProjectAccessInput(ctx, project, locals));
+    });
+    if (!allowed) {
+        apiError(403, ApiErrorCode.FORBIDDEN, action === 'members'
+            ? 'Only project owners can manage members.'
+            : 'Only project owners can manage this project.');
+    }
+    return user;
+}
+// Owner-only gate for project settings, centralized so PATCH
+// /api/projects/[id] matches the rest of the access layer.
+export async function requireCanEditProjectSettings(locals, projectId) {
+    const { user, ctx } = requireAuthed(locals);
+    const project = await loadProjectOr404(ctx, projectId, locals);
+    const allowed = await managementBypassOrRun(ctx, async () => canEditProjectSettings(await buildProjectAccessInput(ctx, project, locals)));
+    if (!allowed)
+        apiError(403, ApiErrorCode.FORBIDDEN, 'Only project owners can edit project settings.');
+    return { user, ctx, project };
+}
+export async function requireCanViewProject(locals, projectId) {
+    const { user, ctx } = requireAuthed(locals);
+    const allowed = await contentCheck(async () => {
+        const project = await loadProjectOr404(ctx, projectId, locals);
+        return canView(await buildProjectAccessInput(ctx, project, locals));
+    });
+    if (!allowed)
+        apiError(403, ApiErrorCode.FORBIDDEN, 'You do not have access to this project.');
+    return user;
+}
+/**
+ * Solve gating. Today `canSolve === canView` for non-platform projects, but
+ * the rule lives in its own function so future cost-gating (quotas, rate
+ * limits) lands without touching view semantics. `viewer` project role
+ * passes; platform projects narrow to grants with `canSolve=true`.
+ */
+export async function requireCanSolve(locals, projectId, 
+// Callers that already loaded the project (e.g. the solve endpoint, which
+// reads orgId/pin off it) pass it to skip a redundant `getProject` here.
+preloadedProject) {
+    const { user, ctx } = requireAuthed(locals);
+    const project = preloadedProject ?? (await loadProjectOr404(ctx, projectId, locals));
+    const allowed = await contentCheck(async () => canSolve(await buildProjectAccessInput(ctx, project, locals)));
+    if (!allowed)
+        apiError(403, ApiErrorCode.FORBIDDEN, 'You do not have access to this project.');
+    return { user, ctx, project };
+}
+/**
+ * Org membership for the commons branch of `canEditDefinition`, or `null` when
+ * that branch cannot fire. Skipping the round-trip on container projects keeps
+ * the common edit path at the same two reads it had before commons gained the
+ * membership test.
+ */
+async function loadCommonsOrgMember(ctx, project, src) {
+    if (!project?.autoJoinOnUpload)
+        return null;
+    return await orgsOf(src).getOrgMember(ctx, project.orgId, ctx.userId);
+}
+/**
+ * Loads the record and gates editing. Returns the record AND the project it
+ * loads for the gate, so callers skip a re-fetch of either.
+ */
+export async function requireEditableDefinition(locals, guid) {
+    const { ctx } = requireAuthed(locals);
+    const record = await definitionMetaOf(locals).get(ctx, guid);
+    if (!record)
+        apiError(404, ApiErrorCode.NOT_FOUND, 'Definition not found');
+    // Load project + member once up front; `project` is returned for reuse.
+    const [project, member] = await Promise.all([
+        projectsOf(locals).getProject(ctx, record.projectId),
+        projectsOf(locals).getProjectMember(ctx, record.projectId, ctx.userId)
+    ]);
+    const allowed = await contentCheck(async () => canEditDefinition({
+        project,
+        definition: record,
+        member,
+        orgMember: await loadCommonsOrgMember(ctx, project, locals),
+        userId: ctx.userId,
+        platformPermissions: ctx.platformPermissions,
+        enablePlatformProjects: flagOf(locals)('ENABLE_PLATFORM_PROJECTS')
+    }));
+    if (!allowed)
+        apiError(403, ApiErrorCode.FORBIDDEN, 'You do not have permission to edit this definition.');
+    return { record, ctx, project };
+}
+export async function requireCanEditDefinition(locals, projectId, definitionGuid, 
+// Callers that already loaded the project and/or definition (e.g. the solve
+// endpoint) pass them to skip the redundant fetches inside the gate. The
+// member row still loads here (the caller doesn't have it).
+preloaded) {
+    const { user, ctx } = requireAuthed(locals);
+    const allowed = await contentCheck(async () => {
+        const [project, definition, member] = await Promise.all([
+            preloaded?.project !== undefined
+                ? Promise.resolve(preloaded.project)
+                : projectsOf(locals).getProject(ctx, projectId),
+            preloaded?.definition !== undefined
+                ? Promise.resolve(preloaded.definition)
+                : definitionMetaOf(locals).get(ctx, definitionGuid),
+            projectsOf(locals).getProjectMember(ctx, projectId, ctx.userId)
+        ]);
+        return canEditDefinition({
+            project,
+            definition,
+            member,
+            orgMember: await loadCommonsOrgMember(ctx, project, locals),
+            userId: ctx.userId,
+            platformPermissions: ctx.platformPermissions,
+            enablePlatformProjects: flagOf(locals)('ENABLE_PLATFORM_PROJECTS')
+        });
+    });
+    if (!allowed)
+        apiError(403, ApiErrorCode.FORBIDDEN, 'You do not have permission to edit this definition.');
+    return user;
+}
+//# sourceMappingURL=guards.js.map

package/dist/access/guards.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guards.js","sourceRoot":"","sources":["../../src/access/guards.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAaH,OAAO,EACN,aAAa,EACb,aAAa,EACb,UAAU,EACV,gBAAgB,EAChB,gBAAgB,EAChB,OAAO,EACP,QAAQ,EACR,OAAO,EACP,SAAS,EACT,sBAAsB,EACtB,iBAAiB,EACjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACN,+BAA+B,EAE/B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAiD1D;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAmB;IACvD,OAAO;QACN,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;QACtB,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ;QAC9B,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW;QACvC,qBAAqB,EAAE,MAAM,CAAC,IAAI,CAAC,qBAAqB;QACxD,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC;KAC3C,CAAC;AACH,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,MAAM,CACrB,MAAS;IAET,OAAO,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,oBAAoB,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;AACpE,CAAC;AAED,4EAA4E;AAC5E,6EAA6E;AAC7E,uCAAuC;AACvC,MAAM,MAAM,GAAG,CAAC,GAAY,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;AAC/C,MAAM,UAAU,GAAG,CAAC,GAAY,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC;AACvD,MAAM,gBAAgB,GAAG,CAAC,GAAY,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC;AACnE,MAAM,MAAM,GAAG,CAAC,GAAY,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;AAE/C,MAAM,UAAU,aAAa,CAAC,MAAc;IAC3C,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;IAC7B,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG;QAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IAC5E,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AACtB,CAAC;AAED,sCAAsC;AACtC,MAAM,UAAU,iBAAiB,CAAC,MAAc,EAAE,UAAyB;IAC1E,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,CAAC;QACrC,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,uCAAuC,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,+EAA+E;AAC/E,8EAA8E;AAC9E,+EAA+E;AAC/E,yCAAyC;AACzC,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,MAAc,EAAE,EAAE,CAC5D,iBAAiB,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;AACpD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,iBAAiB,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;AACpG,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,MAAc,EAAE,EAAE,CACzD,iBAAiB,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;AACjD,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,MAAc,EAAE,EAAE,CACzD,iBAAiB,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;AAEjD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,iBAAiB,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;AAEpG;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iCAAiC,CAChD,GAAmB,EACnB,SAAwC,EACxC,OAAuC;IAEvC,MAAM,OAAO,GAAG,OAAO;QACtB,CAAC,CAAC,SAAS,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;YACpC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC3C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC5C,CAAC,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC;IACxB,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,IAAI,aAAa,CAAC,GAAG,EAAE,gBAAgB,CAAC;QAAE,OAAO;IACjD,QAAQ,CACP,GAAG,EACH,YAAY,CAAC,SAAS,EACtB,OAAO;QACN,CAAC,CAAC,6DAA6D;QAC/D,CAAC,CAAC,4DAA4D,CAC/D,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC/B,MAAc,EACd,KAAyB;IAEzB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;IACvB,IAAI,CAAC,GAAG;QAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IACnE,IAAI,CAAC,KAAK;QAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,CAAC;IAC5E,IAAI,CAAC,GAAG,CAAC,WAAW;QAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,wBAAwB,CAAC,CAAC;IAC9F,IAAI,GAAG,CAAC,WAAW,KAAK,KAAK,EAAE,CAAC;QAC/B,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,2CAA2C,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;AACvB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,qBAAqB,CACnC,GAAmB,EACnB,KAA6B;IAE7B,IAAI,aAAa,CAAC,GAAG,EAAE,gBAAgB,CAAC;QAAE,OAAO,IAAI,CAAC;IACtD,OAAO,MAAM,KAAK,EAAE,CAAC;AACtB,CAAC;AAED,2EAA2E;AAC3E,4EAA4E;AAC5E,gEAAgE;AAChE,KAAK,UAAU,YAAY,CAAC,KAA6B;IACxD,OAAO,MAAM,KAAK,EAAE,CAAC;AACtB,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC9B,GAAmB,EACnB,SAAiB,EACjB,GAAY;IAEZ,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACjE,IAAI,CAAC,OAAO;QAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACzE,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,6EAA6E;AAC7E,+EAA+E;AAC/E,sBAAsB;AACtB,SAAS,eAAe,CAAC,GAAY;IACpC,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7B,OAAO,+BAA+B,CAAC;QACtC,gBAAgB,EAAE,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAC5C,UAAU,CAAC,GAAG,CAAC,CAAC,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC;QACzD,YAAY,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC;QAClF,kBAAkB,EAAE,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,CACtC,GAAG,CAAC,IAAI,CAAC,qBAAqB,CAAC,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC;QAC7D,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YACb,mBAAmB,EAAE,QAAQ,CAAC,wBAAwB,CAAC;YACvD,sBAAsB,EAAE,QAAQ,CAAC,0BAA0B,CAAC;SAC5D,CAAC;KACF,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAC/B,GAAmB,EACnB,OAAgB,EAChB,GAAY,EACZ,SAA+E;IAE/E,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC,uBAAuB,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,8BAA8B,CAC7C,GAAY,EACZ,GAAG,IAAyE;IAE5E,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC,0BAA0B,CAAC,GAAG,IAAI,CAAC,CAAC;AACjE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC/C,MAAoB,EACpB,SAAiB;IAEjB,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,KAAK,IAAI,EAAE;QAC7C,IAAI,OAAO,CAAC,gBAAgB;YAAE,OAAO,IAAI,CAAC;QAC1C,OAAO,OAAO,CAAC,MAAM,uBAAuB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,QAAQ,CACP,GAAG,EACH,YAAY,CAAC,SAAS,EACtB,mEAAmE,CACnE,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MAAoB,EAAE,KAAa;IAC1E,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,KAAK,IAAI,EAAE;QAC7C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACzE,OAAO,MAAM,KAAK,IAAI,CAAC;IACxB,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,OAAO;QACX,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,8CAA8C,CAAC,CAAC;IACvF,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC7C,MAAoB,EACpB,KAAa,EACb,YAAoB;IAEpB,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;IAC3E,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,QAAQ,CACP,GAAG,EACH,YAAY,CAAC,iBAAiB,EAC9B,sEAAsE,CACtE,CAAC;IACH,CAAC;AACF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAC1C,GAAmB,EACnB,KAAa,EACb,IAAa,EACb,GAAY;IAEZ,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3E,OAAO,gBAAgB,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;AAChD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACtC,MAAoB,EACpB,SAAiB;IAEjB,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IAE/D,6EAA6E;IAC7E,4EAA4E;IAC5E,qEAAqE;IACrE,4EAA4E;IAC5E,cAAc;IACd,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;QACvC,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,wCAAwC,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACpF,OAAO,UAAU,CAAC;YACjB,OAAO;YACP,SAAS;YACT,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;SACpC,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,QAAQ,CACP,GAAG,EACH,YAAY,CAAC,SAAS,EACtB,iEAAiE,CACjE,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC5C,MAAoB,EACpB,WAAmB;IAEnB,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QAClF,OAAO,gBAAgB,CAAC;YACvB,cAAc,EAAE,GAAG,CAAC,cAAc;YAClC,SAAS;YACT,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;YACpC,WAAW;SACX,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,OAAO;QACX,QAAQ,CACP,GAAG,EACH,YAAY,CAAC,SAAS,EACtB,4DAA4D,CAC5D,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACrC,MAAoB,EACpB,SAAiB,EACjB,SAAgC,SAAS;IAEzC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QAC/D,OAAO,SAAS,CAAC,MAAM,uBAAuB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,QAAQ,CACP,GAAG,EACH,YAAY,CAAC,SAAS,EACtB,MAAM,KAAK,SAAS;YACnB,CAAC,CAAC,yCAAyC;YAC3C,CAAC,CAAC,8CAA8C,CACjD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,6DAA6D;AAC7D,2DAA2D;AAC3D,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAClD,MAAoB,EACpB,SAAiB;IAEjB,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE,CAC3D,sBAAsB,CAAC,MAAM,uBAAuB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAC3E,CAAC;IACF,IAAI,CAAC,OAAO;QACX,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,gDAAgD,CAAC,CAAC;IACzF,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAC1C,MAAoB,EACpB,SAAiB;IAEjB,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,KAAK,IAAI,EAAE;QAC7C,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QAC/D,OAAO,OAAO,CAAC,MAAM,uBAAuB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,OAAO;QAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,yCAAyC,CAAC,CAAC;IAC/F,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACpC,MAAoB,EACpB,SAAiB;AACjB,0EAA0E;AAC1E,yEAAyE;AACzE,gBAA0B;IAE1B,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,gBAAgB,IAAI,CAAC,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;IACrF,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,KAAK,IAAI,EAAE,CAC7C,QAAQ,CAAC,MAAM,uBAAuB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAC7D,CAAC;IACF,IAAI,CAAC,OAAO;QAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,yCAAyC,CAAC,CAAC;IAC/F,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,oBAAoB,CAClC,GAAmB,EACnB,OAAuB,EACvB,GAAY;IAEZ,IAAI,CAAC,OAAO,EAAE,gBAAgB;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;AACvE,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,MAAoB,EAAE,IAAY;IACjF,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC7D,IAAI,CAAC,MAAM;QAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;IAC3E,wEAAwE;IACxE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC3C,UAAU,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC;QACpD,UAAU,CAAC,MAAM,CAAC,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC;KACtE,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,KAAK,IAAI,EAAE,CAC7C,iBAAiB,CAAC;QACjB,OAAO;QACP,UAAU,EAAE,MAAM;QAClB,MAAM;QACN,SAAS,EAAE,MAAM,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC;QAC3D,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;QAC5C,sBAAsB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,0BAA0B,CAAC;KAClE,CAAC,CACF,CAAC;IACF,IAAI,CAAC,OAAO;QACX,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,qDAAqD,CAAC,CAAC;IAC9F,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC7C,MAAoB,EACpB,SAAiB,EACjB,cAAsB;AACtB,4EAA4E;AAC5E,yEAAyE;AACzE,4DAA4D;AAC5D,SAA8E;IAE9E,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,KAAK,IAAI,EAAE;QAC7C,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACvD,SAAS,EAAE,OAAO,KAAK,SAAS;gBAC/B,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC;gBACpC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC;YAChD,SAAS,EAAE,UAAU,KAAK,SAAS;gBAClC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC;gBACvC,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC;YACpD,UAAU,CAAC,MAAM,CAAC,CAAC,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC;SAC/D,CAAC,CAAC;QACH,OAAO,iBAAiB,CAAC;YACxB,OAAO;YACP,UAAU;YACV,MAAM;YACN,SAAS,EAAE,MAAM,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC;YAC3D,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;YAC5C,sBAAsB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,0BAA0B,CAAC;SAClE,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,OAAO;QACX,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,qDAAqD,CAAC,CAAC;IAC9F,OAAO,IAAI,CAAC;AACb,CAAC"}

package/dist/access/index.d.ts

@@ -1,2 +1,4 @@
 export { createProjectAccessInputBuilder, type ProjectAccessFlags, type ProjectAccessInputBuilder, type ProjectAccessInputDeps } from './project-access-input.js';
+export * from './guards.js';
+export { splitFlatPermissions, type SplitPermissions } from './permissions-scope.js';
 //# sourceMappingURL=index.d.ts.map