@selvajs/server 1.2.0 → 1.3.0

package/dist/handlers/definitionVersions.js

@@ -0,0 +1,93 @@
+/**
+ * Version handlers: list, upload, read, delete, and a version's cached schema.
+ *
+ * Reads resolve through `getVisibleDefinition` / `loadVisibleVersion`, which
+ * return `null` rather than throwing, so an invisible definition answers 404.
+ * A 403 anywhere here would confirm a guid exists across a tenant boundary.
+ */
+import { apiError, ApiErrorCode, collection, created, formText, noContent, parseListOptions, parseParam, requireCaller, requireUpload } from '../api/index.js';
+import { GuidSchema } from '@selvajs/platform/definitions';
+import { requireEditableDefinition } from '../access/index.js';
+import { GH_EXTENSIONS } from '@selvajs/platform';
+import { resolveServerForOrg } from '../compute/index.js';
+import { fetchSchemaFromCompute, getVisibleDefinition, loadVisibleVersion } from '../definitions/index.js';
+import { definitionService } from './services.js';
+export const listVersions = async (req) => {
+    const guid = parseParam(req.params.guid, GuidSchema, 'GUID');
+    const { ctx } = requireCaller(req);
+    // Resolve through `getVisibleDefinition` like the sibling routes, which
+    // answers 404 for a guid the caller cannot see. A 403 here would confirm
+    // the definition exists and turn this into a cross-tenant existence oracle.
+    const def = await getVisibleDefinition(ctx, guid, req.deps);
+    if (!def)
+        apiError(404, ApiErrorCode.NOT_FOUND, 'Definition not found');
+    return collection(await req.deps.definitionMeta.listVersions(ctx, guid, parseListOptions(req.url)));
+};
+/** Upload a new version. Advances `draft`; `live` is unchanged until publish. */
+export const uploadVersion = async (req) => {
+    const guid = parseParam(req.params.guid, GuidSchema, 'GUID');
+    const form = await req.request.formData();
+    const { file, extension } = requireUpload(form, 'file', {
+        maxBytes: req.deps.uploadLimits.maxDefinitionFileSize,
+        extensions: GH_EXTENSIONS,
+        label: 'Grasshopper (.gh or .ghx) file'
+    });
+    const changeNote = formText(form, 'changeNote', { maxLength: 1000 });
+    const { ctx, record, project } = await requireEditableDefinition(req, guid);
+    const data = new Uint8Array(await file.arrayBuffer());
+    // Validate-and-cache gate: extract the schema from compute BEFORE any
+    // write, so a failure rejects the upload with nothing persisted.
+    // `project` comes from the guard — no re-fetch.
+    const server = await resolveServerForOrg(ctx, project?.orgId ?? null, req.deps.computeServer, {
+        definitionPin: record.computeServerId ?? null
+    });
+    const schema = await fetchSchemaFromCompute(data, server);
+    const version = await definitionService(req.deps).uploadVersion(ctx, guid, data, extension.slice(1), file.name, schema, changeNote);
+    return created({ version });
+};
+/**
+ * Version metadata. `schema` is excluded and served by the `/schema`
+ * sub-resource, so a version read never carries a several-hundred-KB blob.
+ */
+export const getVersion = async (req) => {
+    const guid = parseParam(req.params.guid, GuidSchema, 'GUID');
+    const versionId = parseParam(req.params.versionId, GuidSchema, 'version ID');
+    const { ctx } = requireCaller(req);
+    const version = await loadVisibleVersion(ctx, guid, versionId, req.deps);
+    if (!version)
+        apiError(404, ApiErrorCode.NOT_FOUND, 'Version not found');
+    const { schema: _schema, ...rest } = version;
+    return { body: rest };
+};
+/**
+ * Delete an old version. The store throws 409 if the version is currently
+ * referenced by `liveVersionId` or `draftVersionId` — repoint first.
+ */
+export const deleteVersion = async (req) => {
+    const guid = parseParam(req.params.guid, GuidSchema, 'GUID');
+    const versionId = parseParam(req.params.versionId, GuidSchema, 'version ID');
+    const { ctx } = await requireEditableDefinition(req, guid);
+    await definitionService(req.deps).deleteVersion(ctx, guid, versionId);
+    return noContent();
+};
+/**
+ * The UI schema cached on this version at upload. Reads what is stored — no
+ * Rhino.Compute round-trip, unlike the pre-upload `POST /api/v1/compute/schema`.
+ *
+ * Schemas belong to a version, so this is the canonical location;
+ * `/definitions/{guid}/schema` is an alias for the live one.
+ */
+export const getVersionSchema = async (req) => {
+    const guid = parseParam(req.params.guid, GuidSchema, 'GUID');
+    const versionId = parseParam(req.params.versionId, GuidSchema, 'version ID');
+    const { ctx } = requireCaller(req);
+    const version = await loadVisibleVersion(ctx, guid, versionId, req.deps);
+    if (!version)
+        apiError(404, ApiErrorCode.NOT_FOUND, 'Version not found');
+    // A pre-caching version can still lack a schema (lazy backfill bridge) —
+    // that is a missing sub-resource, not an error.
+    if (!version.schema)
+        apiError(404, ApiErrorCode.NOT_FOUND, 'No schema cached for this version');
+    return { body: version.schema };
+};
+//# sourceMappingURL=definitionVersions.js.map

package/dist/handlers/definitionVersions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"definitionVersions.js","sourceRoot":"","sources":["../../src/handlers/definitionVersions.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACN,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,OAAO,EACP,QAAQ,EACR,SAAS,EACT,gBAAgB,EAChB,UAAU,EACV,aAAa,EACb,aAAa,EACb,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAC3D,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EACN,sBAAsB,EACtB,oBAAoB,EACpB,kBAAkB,EAClB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAElD,MAAM,CAAC,MAAM,YAAY,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACrD,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IAC7D,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAEnC,wEAAwE;IACxE,yEAAyE;IACzE,4EAA4E;IAC5E,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5D,IAAI,CAAC,GAAG;QAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;IAExE,OAAO,UAAU,CAChB,MAAM,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAChF,CAAC;AACH,CAAC,CAAC;AAEF,iFAAiF;AACjF,MAAM,CAAC,MAAM,aAAa,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACtD,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IAE7D,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;IAC1C,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE;QACvD,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,qBAAqB;QACrD,UAAU,EAAE,aAAa;QACzB,KAAK,EAAE,gCAAgC;KACvC,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,EAAE,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAErE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC5E,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAEtD,sEAAsE;IACtE,iEAAiE;IACjE,gDAAgD;IAChD,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,IAAI,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE;QAC7F,aAAa,EAAE,MAAM,CAAC,eAAe,IAAI,IAAI;KAC7C,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAE1D,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,aAAa,CAC9D,GAAG,EACH,IAAI,EACJ,IAAI,EACJ,SAAS,CAAC,KAAK,CAAC,CAAC,CAAiB,EAClC,IAAI,CAAC,IAAI,EACT,MAAM,EACN,UAAU,CACV,CAAC;IACF,OAAO,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;AAC7B,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,UAAU,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACnD,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;IAC7E,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAEnC,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IACzE,IAAI,CAAC,OAAO;QAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACzE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;IAC7C,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACvB,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACtD,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;IAE7E,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC3D,MAAM,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IACtE,OAAO,SAAS,EAAE,CAAC;AACpB,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACzD,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;IAC7E,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAEnC,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IACzE,IAAI,CAAC,OAAO;QAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACzE,yEAAyE;IACzE,gDAAgD;IAChD,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,mCAAmC,CAAC,CAAC;IAChG,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;AACjC,CAAC,CAAC"}

package/dist/handlers/definitions.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Definition handlers: the collection, one definition's detail and metadata,
+ * its live schema, cover image, and the publish channel.
+ *
+ * Solve and the two compute routes stay unwrapped deliberately — they stream
+ * and mark their own metrics, which the `ApiResponse` envelope does not model.
+ */
+import type { ApiHandler } from '../api/index.js';
+/**
+ * Definitions the caller can view. Visibility is resolved into the query via
+ * `projectIds`, so `limit`/`nextCursor` describe the filtered set.
+ */
+export declare const listDefinitions: ApiHandler;
+/** Create a definition — metadata and the Grasshopper file in one request. */
+export declare const createDefinition: ApiHandler;
+/** The record plus its live and draft version summaries. */
+export declare const getDefinition: ApiHandler;
+/** Soft-delete the definition; versions and blobs are wiped with it. */
+export declare const deleteDefinition: ApiHandler;
+/** Metadata only. New versions POST to `/versions`. */
+export declare const updateDefinition: ApiHandler;
+/**
+ * Convenience alias for the live version's schema — the call a client makes
+ * before solving. The canonical location is `/versions/{versionId}/schema`;
+ * this resolves the `live` pointer for you.
+ */
+export declare const getDefinitionSchema: ApiHandler;
+/**
+ * Advance the live channel. Body `{ versionId? }` targets a specific version
+ * (rollback or forward-roll); omit it to promote the current draft.
+ */
+export declare const publishDefinition: ApiHandler;
+/** Upload a cover image. */
+export declare const uploadDefinitionImage: ApiHandler;
+//# sourceMappingURL=definitions.d.ts.map

package/dist/handlers/definitions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"definitions.d.ts","sourceRoot":"","sources":["../../src/handlers/definitions.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAiBH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAuBlD;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,UAsB7B,CAAC;AAWF,8EAA8E;AAC9E,eAAO,MAAM,gBAAgB,EAAE,UA0F9B,CAAC;AAaF,4DAA4D;AAC5D,eAAO,MAAM,aAAa,EAAE,UAoB3B,CAAC;AAEF,wEAAwE;AACxE,eAAO,MAAM,gBAAgB,EAAE,UAM9B,CAAC;AAEF,uDAAuD;AACvD,eAAO,MAAM,gBAAgB,EAAE,UAO9B,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,EAAE,UAejC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,iBAAiB,EAAE,UAM/B,CAAC;AAEF,4BAA4B;AAC5B,eAAO,MAAM,qBAAqB,EAAE,UAanC,CAAC"}

package/dist/handlers/definitions.js

@@ -0,0 +1,207 @@
+/**
+ * Definition handlers: the collection, one definition's detail and metadata,
+ * its live schema, cover image, and the publish channel.
+ *
+ * Solve and the two compute routes stay unwrapped deliberately — they stream
+ * and mark their own metrics, which the `ApiResponse` envelope does not model.
+ */
+import { randomUUID } from 'node:crypto';
+import { apiError, ApiErrorCode, collection, created, formText, noContent, parseBody, parseDefinitionListOptions, parseParam, requireCaller, requireUpload, throwZodError } from '../api/index.js';
+import { toDefinitionListItem } from '@selvajs/platform';
+import { CreateDefinitionInputSchema, GuidSchema, PublishVersionInputSchema, UpdateMetadataInputSchema } from '@selvajs/platform/definitions';
+import { requireCanCreateDefinition, requireEditableDefinition } from '../access/index.js';
+import { GH_EXTENSIONS } from '@selvajs/platform';
+import { resolveServerForOrg } from '../compute/index.js';
+import { fetchSchemaFromCompute, getVisibleDefinition, listVisibleDefinitions, loadVisibleVersion, resolveAccessibleProjects } from '../definitions/index.js';
+import { definitionService } from './services.js';
+const LISTABLE_STATUSES = ['draft', 'published', 'archived'];
+/**
+ * Definitions the caller can view. Visibility is resolved into the query via
+ * `projectIds`, so `limit`/`nextCursor` describe the filtered set.
+ */
+export const listDefinitions = async (req) => {
+    const { ctx } = requireCaller(req);
+    const statusParam = req.url.searchParams.get('status');
+    if (statusParam && !LISTABLE_STATUSES.includes(statusParam)) {
+        apiError(400, ApiErrorCode.VALIDATION_FAILED, `status must be one of: ${LISTABLE_STATUSES.join(', ')}`);
+    }
+    const page = await listVisibleDefinitions(ctx, {
+        ...parseDefinitionListOptions(req.url),
+        projectId: req.url.searchParams.get('projectId') ?? undefined,
+        statuses: statusParam ? [statusParam] : undefined
+    }, req.deps);
+    return collection({ items: page.items.map(toDefinitionListItem), nextCursor: page.nextCursor });
+};
+function parseTags(raw) {
+    if (!raw)
+        return undefined;
+    const tags = raw
+        .split(',')
+        .map((t) => t.trim())
+        .filter(Boolean);
+    return tags.length ? tags : undefined;
+}
+/** Create a definition — metadata and the Grasshopper file in one request. */
+export const createDefinition = async (req) => {
+    const { ctx, user } = requireCaller(req);
+    const form = await req.request.formData();
+    const { file, extension } = requireUpload(form, 'file', {
+        maxBytes: req.deps.uploadLimits.maxDefinitionFileSize,
+        extensions: GH_EXTENSIONS,
+        label: 'Grasshopper (.gh or .ghx) file'
+    });
+    const imageFile = form.get('image');
+    const maxImageBytes = req.deps.uploadLimits.maxImageFileSize;
+    if (imageFile instanceof File && imageFile.size > maxImageBytes) {
+        apiError(400, ApiErrorCode.VALIDATION_FAILED, `Image too large. Max size: ${maxImageBytes / (1024 * 1024)} MB`);
+    }
+    let projectId = formText(form, 'projectId');
+    if (!projectId) {
+        // The fallback picks a project on the caller's behalf, so it must pick
+        // from what the caller can already see. `listProjects` ignores its ctx on
+        // the local provider, which would let the pick land on a `private`
+        // project the caller is not a member of — and on an `autoJoinOnUpload`
+        // project `requireCanCreateDefinition` then allows the write, so the
+        // upload succeeds into a project the caller never named.
+        if (!ctx.actingOrgId)
+            apiError(400, ApiErrorCode.VALIDATION_FAILED, 'No active organization');
+        const { projects } = await resolveAccessibleProjects(ctx, req.deps);
+        const fallback = projects.find((p) => p.orgId === ctx.actingOrgId);
+        if (!fallback) {
+            apiError(400, ApiErrorCode.VALIDATION_FAILED, 'No accessible project — pass projectId.');
+        }
+        projectId = fallback.id;
+    }
+    const { project } = await requireCanCreateDefinition(req, projectId);
+    // Not `parseBody` — the fields arrive as multipart, not JSON, so they are
+    // assembled here and validated by the same schema.
+    const parsed = CreateDefinitionInputSchema.safeParse({
+        displayName: formText(form, 'displayName'),
+        description: formText(form, 'description'),
+        category: formText(form, 'category'),
+        coverImage: formText(form, 'coverImage'),
+        tags: parseTags(formText(form, 'tags')),
+        projectId,
+        computeServerId: formText(form, 'computeServerId')
+    });
+    if (!parsed.success)
+        throwZodError(parsed.error);
+    const guid = randomUUID();
+    const fileData = new Uint8Array(await file.arrayBuffer());
+    // Validate-and-cache gate: extract the schema from compute BEFORE any
+    // write, so compute being down or the file having no Schema output rejects
+    // the upload with nothing persisted.
+    const server = await resolveServerForOrg(ctx, project.orgId, req.deps.computeServer, {
+        definitionPin: parsed.data.computeServerId ?? null
+    });
+    const schema = await fetchSchemaFromCompute(fileData, server);
+    const service = definitionService(req.deps);
+    const { record, version } = await service.create(ctx, {
+        guid,
+        projectId: parsed.data.projectId,
+        ownerId: user.id,
+        fileExt: extension.slice(1),
+        originalFilename: file.name,
+        computeServerId: parsed.data.computeServerId,
+        displayName: parsed.data.displayName.trim(),
+        description: parsed.data.description,
+        category: parsed.data.category,
+        tags: parsed.data.tags,
+        coverImage: parsed.data.coverImage
+    }, fileData, schema);
+    let coverImage = record.coverImage;
+    if (imageFile instanceof File && imageFile.size > 0) {
+        const imageData = new Uint8Array(await imageFile.arrayBuffer());
+        coverImage = await service.saveCoverImage(ctx, guid, imageData);
+    }
+    return created({ guid, version, coverImage });
+};
+/** `schema` is a large blob, served on demand by `/versions/{versionId}/schema`. */
+function versionSummary(v) {
+    return {
+        id: v.id,
+        versionNumber: v.versionNumber,
+        uploadedAt: v.uploadedAt,
+        uploadedBy: v.uploadedBy,
+        changeNote: v.changeNote
+    };
+}
+/** The record plus its live and draft version summaries. */
+export const getDefinition = async (req) => {
+    const guid = parseParam(req.params.guid, GuidSchema, 'GUID');
+    const { ctx } = requireCaller(req);
+    const record = await getVisibleDefinition(ctx, guid, req.deps);
+    if (!record)
+        apiError(404, ApiErrorCode.NOT_FOUND, 'Definition not found');
+    const meta = req.deps.definitionMeta;
+    const [liveVersion, draftVersion] = await Promise.all([
+        record.liveVersionId ? meta.getVersion(ctx, record.liveVersionId) : null,
+        record.draftVersionId ? meta.getVersion(ctx, record.draftVersionId) : null
+    ]);
+    return {
+        body: {
+            ...record,
+            liveVersion: liveVersion ? versionSummary(liveVersion) : null,
+            draftVersion: draftVersion ? versionSummary(draftVersion) : null
+        }
+    };
+};
+/** Soft-delete the definition; versions and blobs are wiped with it. */
+export const deleteDefinition = async (req) => {
+    const guid = parseParam(req.params.guid, GuidSchema, 'GUID');
+    const { ctx } = await requireEditableDefinition(req, guid);
+    await definitionService(req.deps).delete(ctx, guid);
+    return noContent();
+};
+/** Metadata only. New versions POST to `/versions`. */
+export const updateDefinition = async (req) => {
+    const guid = parseParam(req.params.guid, GuidSchema, 'GUID');
+    const { ctx } = await requireEditableDefinition(req, guid);
+    const patch = await parseBody(req.request, UpdateMetadataInputSchema);
+    await definitionService(req.deps).updateMeta(ctx, guid, patch);
+    return noContent();
+};
+/**
+ * Convenience alias for the live version's schema — the call a client makes
+ * before solving. The canonical location is `/versions/{versionId}/schema`;
+ * this resolves the `live` pointer for you.
+ */
+export const getDefinitionSchema = async (req) => {
+    const guid = parseParam(req.params.guid, GuidSchema, 'GUID');
+    const { ctx } = requireCaller(req);
+    const record = await getVisibleDefinition(ctx, guid, req.deps);
+    if (!record)
+        apiError(404, ApiErrorCode.NOT_FOUND, 'Definition not found');
+    if (!record.liveVersionId) {
+        apiError(404, ApiErrorCode.NOT_FOUND, 'This definition has no published version');
+    }
+    const version = await loadVisibleVersion(ctx, guid, record.liveVersionId, req.deps);
+    if (!version?.schema) {
+        apiError(404, ApiErrorCode.NOT_FOUND, 'No schema cached for the live version');
+    }
+    return { body: version.schema };
+};
+/**
+ * Advance the live channel. Body `{ versionId? }` targets a specific version
+ * (rollback or forward-roll); omit it to promote the current draft.
+ */
+export const publishDefinition = async (req) => {
+    const guid = parseParam(req.params.guid, GuidSchema, 'GUID');
+    const { versionId } = await parseBody(req.request, PublishVersionInputSchema, { missingAs: {} });
+    const { ctx } = await requireEditableDefinition(req, guid);
+    return { body: { version: await definitionService(req.deps).publish(ctx, guid, versionId) } };
+};
+/** Upload a cover image. */
+export const uploadDefinitionImage = async (req) => {
+    const guid = parseParam(req.params.guid, GuidSchema, 'GUID');
+    const { ctx } = await requireEditableDefinition(req, guid);
+    const { file } = requireUpload(await req.request.formData(), 'image', {
+        maxBytes: req.deps.uploadLimits.maxImageFileSize,
+        label: 'Image'
+    });
+    const data = new Uint8Array(await file.arrayBuffer());
+    return {
+        body: { coverImage: await definitionService(req.deps).saveCoverImage(ctx, guid, data) }
+    };
+};
+//# sourceMappingURL=definitions.js.map

package/dist/handlers/definitions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"definitions.js","sourceRoot":"","sources":["../../src/handlers/definitions.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACN,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,OAAO,EACP,QAAQ,EACR,SAAS,EACT,SAAS,EACT,0BAA0B,EAC1B,UAAU,EACV,aAAa,EACb,aAAa,EACb,aAAa,EACb,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,oBAAoB,EAAyB,MAAM,mBAAmB,CAAC;AAChF,OAAO,EACN,2BAA2B,EAC3B,UAAU,EACV,yBAAyB,EACzB,yBAAyB,EACzB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAC3F,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EACN,sBAAsB,EACtB,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,EAClB,yBAAyB,EACzB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAElD,MAAM,iBAAiB,GAAuB,CAAC,OAAO,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;AAEjF;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACxD,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAEnC,MAAM,WAAW,GAAG,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACvD,IAAI,WAAW,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,WAA+B,CAAC,EAAE,CAAC;QACjF,QAAQ,CACP,GAAG,EACH,YAAY,CAAC,iBAAiB,EAC9B,0BAA0B,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACxD,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,sBAAsB,CACxC,GAAG,EACH;QACC,GAAG,0BAA0B,CAAC,GAAG,CAAC,GAAG,CAAC;QACtC,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,SAAS;QAC7D,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,WAA+B,CAAC,CAAC,CAAC,CAAC,SAAS;KACrE,EACD,GAAG,CAAC,IAAI,CACR,CAAC;IACF,OAAO,UAAU,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;AACjG,CAAC,CAAC;AAEF,SAAS,SAAS,CAAC,GAAuB;IACzC,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,IAAI,GAAG,GAAG;SACd,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IAClB,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACvC,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,MAAM,gBAAgB,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACzD,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;IAE1C,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE;QACvD,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,qBAAqB;QACrD,UAAU,EAAE,aAAa;QACzB,KAAK,EAAE,gCAAgC;KACvC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,aAAa,GAAG,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC;IAC7D,IAAI,SAAS,YAAY,IAAI,IAAI,SAAS,CAAC,IAAI,GAAG,aAAa,EAAE,CAAC;QACjE,QAAQ,CACP,GAAG,EACH,YAAY,CAAC,iBAAiB,EAC9B,8BAA8B,aAAa,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAChE,CAAC;IACH,CAAC;IAED,IAAI,SAAS,GAAG,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC5C,IAAI,CAAC,SAAS,EAAE,CAAC;QAChB,uEAAuE;QACvE,0EAA0E;QAC1E,mEAAmE;QACnE,uEAAuE;QACvE,qEAAqE;QACrE,yDAAyD;QACzD,IAAI,CAAC,GAAG,CAAC,WAAW;YAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,wBAAwB,CAAC,CAAC;QAC9F,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACpE,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,GAAG,CAAC,WAAW,CAAC,CAAC;QACnE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,yCAAyC,CAAC,CAAC;QAC1F,CAAC;QACD,SAAS,GAAG,QAAQ,CAAC,EAAE,CAAC;IACzB,CAAC;IAED,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,0BAA0B,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAErE,0EAA0E;IAC1E,mDAAmD;IACnD,MAAM,MAAM,GAAG,2BAA2B,CAAC,SAAS,CAAC;QACpD,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;QAC1C,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;QAC1C,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;QACpC,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;QACxC,IAAI,EAAE,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACvC,SAAS;QACT,eAAe,EAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;KAClD,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAEjD,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;IAC1B,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAE1D,sEAAsE;IACtE,2EAA2E;IAC3E,qCAAqC;IACrC,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE;QACpF,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe,IAAI,IAAI;KAClD,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAE9D,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,OAAO,CAAC,MAAM,CAC/C,GAAG,EACH;QACC,IAAI;QACJ,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS;QAChC,OAAO,EAAE,IAAI,CAAC,EAAE;QAChB,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAiB;QAC3C,gBAAgB,EAAE,IAAI,CAAC,IAAI;QAC3B,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe;QAC5C,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE;QAC3C,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW;QACpC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ;QAC9B,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;QACtB,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU;KAClC,EACD,QAAQ,EACR,MAAM,CACN,CAAC;IAEF,IAAI,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;IACnC,IAAI,SAAS,YAAY,IAAI,IAAI,SAAS,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACrD,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,MAAM,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;QAChE,UAAU,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IACjE,CAAC;IAED,OAAO,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;AAC/C,CAAC,CAAC;AAEF,oFAAoF;AACpF,SAAS,cAAc,CAAC,CAAoB;IAC3C,OAAO;QACN,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,aAAa,EAAE,CAAC,CAAC,aAAa;QAC9B,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,UAAU,EAAE,CAAC,CAAC,UAAU;KACxB,CAAC;AACH,CAAC;AAED,4DAA4D;AAC5D,MAAM,CAAC,MAAM,aAAa,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACtD,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IAC7D,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAEnC,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/D,IAAI,CAAC,MAAM;QAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;IAE3E,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC;IACrC,MAAM,CAAC,WAAW,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACrD,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI;QACxE,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI;KAC1E,CAAC,CAAC;IAEH,OAAO;QACN,IAAI,EAAE;YACL,GAAG,MAAM;YACT,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI;YAC7D,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI;SAChE;KACD,CAAC;AACH,CAAC,CAAC;AAEF,wEAAwE;AACxE,MAAM,CAAC,MAAM,gBAAgB,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACzD,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IAC7D,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAE3D,MAAM,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACpD,OAAO,SAAS,EAAE,CAAC;AACpB,CAAC,CAAC;AAEF,uDAAuD;AACvD,MAAM,CAAC,MAAM,gBAAgB,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACzD,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IAC7D,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,yBAAyB,CAAC,CAAC;IAEtE,MAAM,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/D,OAAO,SAAS,EAAE,CAAC;AACpB,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IAC5D,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IAC7D,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAEnC,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/D,IAAI,CAAC,MAAM;QAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;IAC3E,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QAC3B,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,0CAA0C,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IACpF,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;QACtB,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,uCAAuC,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;AACjC,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IAC1D,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IAC7D,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,yBAAyB,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;IAEjG,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC3D,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC;AAC/F,CAAC,CAAC;AAEF,4BAA4B;AAC5B,MAAM,CAAC,MAAM,qBAAqB,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IAC9D,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IAC7D,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAE3D,MAAM,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE;QACrE,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,gBAAgB;QAChD,KAAK,EAAE,OAAO;KACd,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACtD,OAAO;QACN,IAAI,EAAE,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE;KACvF,CAAC;AACH,CAAC,CAAC"}

package/dist/handlers/index.d.ts

@@ -0,0 +1,27 @@
+/**
+ * The API handlers themselves — the business logic behind each endpoint.
+ *
+ * A handler is `(req: ApiRequest) => Promise<ApiResponse | Response>` and names
+ * no web framework: it reads params and body off `req`, reaches stores through
+ * `req.deps`, and fails by throwing `ApiError`. A host binds one to a route by
+ * building an `ApiRequest` and calling `runHandler` — see `api/README.md`.
+ *
+ * Handlers live here rather than in a host app so a second host implements the
+ * same API by mounting these, not by reimplementing them and re-deriving the
+ * gates, invariants, and status codes each one enforces.
+ */
+export { definitionService, orgAssetService, tokenCodec } from './services.js';
+export { getMe } from './me.js';
+export { starDefinition, unstarDefinition } from './me.starred.js';
+export { getOrg, listOrgMembers } from './orgs.js';
+export { updateOrgMember, removeOrgMember } from './orgMembers.js';
+export { reclaimProject } from './reclaim.js';
+export { uploadOrgAsset, removeOrgAsset } from './orgAssets.js';
+export { listShareLinks, createShareLink, revokeShareLink } from './shareLinks.js';
+export { listDefinitions, createDefinition, getDefinition, deleteDefinition, updateDefinition, getDefinitionSchema, publishDefinition, uploadDefinitionImage } from './definitions.js';
+export { listVersions, uploadVersion, getVersion, deleteVersion, getVersionSchema } from './definitionVersions.js';
+export { listProjects, createProject, getProject, updateProject, deleteProject } from './projects.js';
+export { listProjectMembers, addProjectMember, updateProjectMemberRole, removeProjectMember } from './projectMembers.js';
+export { getOrgCompute, updateOrgCompute } from './orgCompute.js';
+export { listInvites, createInvite, revokeInvite, resendInvite } from './invites.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/handlers/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/handlers/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE/E,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACnF,OAAO,EACN,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,EACjB,qBAAqB,EACrB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACN,YAAY,EACZ,aAAa,EACb,UAAU,EACV,aAAa,EACb,gBAAgB,EAChB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACN,YAAY,EACZ,aAAa,EACb,UAAU,EACV,aAAa,EACb,aAAa,EACb,MAAM,eAAe,CAAC;AACvB,OAAO,EACN,kBAAkB,EAClB,gBAAgB,EAChB,uBAAuB,EACvB,mBAAmB,EACnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAClE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC"}

package/dist/handlers/index.js

@@ -0,0 +1,29 @@
+/**
+ * The API handlers themselves — the business logic behind each endpoint.
+ *
+ * A handler is `(req: ApiRequest) => Promise<ApiResponse | Response>` and names
+ * no web framework: it reads params and body off `req`, reaches stores through
+ * `req.deps`, and fails by throwing `ApiError`. A host binds one to a route by
+ * building an `ApiRequest` and calling `runHandler` — see `api/README.md`.
+ *
+ * Handlers live here rather than in a host app so a second host implements the
+ * same API by mounting these, not by reimplementing them and re-deriving the
+ * gates, invariants, and status codes each one enforces.
+ */
+// Accessors for the host-composed services on `SelvaDeps`. Exported because a
+// host's own handlers reach the same services through the same named failure.
+export { definitionService, orgAssetService, tokenCodec } from './services.js';
+export { getMe } from './me.js';
+export { starDefinition, unstarDefinition } from './me.starred.js';
+export { getOrg, listOrgMembers } from './orgs.js';
+export { updateOrgMember, removeOrgMember } from './orgMembers.js';
+export { reclaimProject } from './reclaim.js';
+export { uploadOrgAsset, removeOrgAsset } from './orgAssets.js';
+export { listShareLinks, createShareLink, revokeShareLink } from './shareLinks.js';
+export { listDefinitions, createDefinition, getDefinition, deleteDefinition, updateDefinition, getDefinitionSchema, publishDefinition, uploadDefinitionImage } from './definitions.js';
+export { listVersions, uploadVersion, getVersion, deleteVersion, getVersionSchema } from './definitionVersions.js';
+export { listProjects, createProject, getProject, updateProject, deleteProject } from './projects.js';
+export { listProjectMembers, addProjectMember, updateProjectMemberRole, removeProjectMember } from './projectMembers.js';
+export { getOrgCompute, updateOrgCompute } from './orgCompute.js';
+export { listInvites, createInvite, revokeInvite, resendInvite } from './invites.js';
+//# sourceMappingURL=index.js.map

package/dist/handlers/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/handlers/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,8EAA8E;AAC9E,8EAA8E;AAC9E,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE/E,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACnF,OAAO,EACN,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,EACjB,qBAAqB,EACrB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACN,YAAY,EACZ,aAAa,EACb,UAAU,EACV,aAAa,EACb,gBAAgB,EAChB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACN,YAAY,EACZ,aAAa,EACb,UAAU,EACV,aAAa,EACb,aAAa,EACb,MAAM,eAAe,CAAC;AACvB,OAAO,EACN,kBAAkB,EAClB,gBAAgB,EAChB,uBAAuB,EACvB,mBAAmB,EACnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAClE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC"}

package/dist/handlers/invite-lookup.d.ts

@@ -0,0 +1,11 @@
+import type { IDataProvider, Invite, RequestContext } from '@selvajs/platform';
+/**
+ * Find an invite by id, confirming it belongs to `orgId`.
+ *
+ * `manage_org_members` is org-scoped, so a permitted caller must not reach an
+ * invite in another org. Neither store scopes `revoke()` by acting org, so
+ * every route that mutates an invite by id has to establish ownership first —
+ * hence one shared paged scan rather than a copy per route.
+ */
+export declare function findPendingInviteInOrg(ctx: RequestContext, orgId: string, id: string, store: IDataProvider['invites']): Promise<Invite | null>;
+//# sourceMappingURL=invite-lookup.d.ts.map

package/dist/handlers/invite-lookup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invite-lookup.d.ts","sourceRoot":"","sources":["../../src/handlers/invite-lookup.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAE/E;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAC3C,GAAG,EAAE,cAAc,EACnB,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,aAAa,CAAC,SAAS,CAAC,GAC7B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CASxB"}

package/dist/handlers/invite-lookup.js

@@ -0,0 +1,20 @@
+/**
+ * Find an invite by id, confirming it belongs to `orgId`.
+ *
+ * `manage_org_members` is org-scoped, so a permitted caller must not reach an
+ * invite in another org. Neither store scopes `revoke()` by acting org, so
+ * every route that mutates an invite by id has to establish ownership first —
+ * hence one shared paged scan rather than a copy per route.
+ */
+export async function findPendingInviteInOrg(ctx, orgId, id, store) {
+    let cursor;
+    do {
+        const page = await store.listByOrg(ctx, orgId, { limit: 200, cursor });
+        const match = page.items.find((i) => i.id === id);
+        if (match)
+            return match;
+        cursor = page.nextCursor ?? undefined;
+    } while (cursor);
+    return null;
+}
+//# sourceMappingURL=invite-lookup.js.map

package/dist/handlers/invite-lookup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invite-lookup.js","sourceRoot":"","sources":["../../src/handlers/invite-lookup.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC3C,GAAmB,EACnB,KAAa,EACb,EAAU,EACV,KAA+B;IAE/B,IAAI,MAA0B,CAAC;IAC/B,GAAG,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QACvE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAClD,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;QACxB,MAAM,GAAG,IAAI,CAAC,UAAU,IAAI,SAAS,CAAC;IACvC,CAAC,QAAQ,MAAM,EAAE;IACjB,OAAO,IAAI,CAAC;AACb,CAAC"}

package/dist/handlers/invites.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Org invites: list, mint, revoke, resend.
+ *
+ * **The raw token exists only in the response.** The store sees an HMAC digest,
+ * so a leak of the `invites` table cannot be replayed without the instance
+ * secret — and `tokenHash` is dropped by the response schema, which is why
+ * every response here goes through `shaped`/`shapedCollection` rather than
+ * `{ body }`.
+ */
+import type { ApiHandler } from '../api/index.js';
+/** Pending and recently accepted invites for the acting org. */
+export declare const listInvites: ApiHandler;
+/** Create an invite and return the accept URL. */
+export declare const createInvite: ApiHandler;
+/** Revoke a pending invite. Consumed invites are preserved for audit. */
+export declare const revokeInvite: ApiHandler;
+/**
+ * Re-send an invite: mint a replacement and revoke the original.
+ *
+ * A resend cannot reuse the original link. The raw token is never stored — only
+ * its HMAC digest is — so there is nothing to re-read, and rather than weaken
+ * that, this issues a fresh token and revokes the row it replaces. The old link
+ * stops working the moment this returns, which is also what an admin wants
+ * after mailing an invite to the wrong address.
+ *
+ * Grants are copied verbatim from the original. The role and permission gates
+ * ran when it was minted; re-deriving them here would let a since-demoted admin
+ * silently change what the invite carries.
+ */
+export declare const resendInvite: ApiHandler;
+//# sourceMappingURL=invites.d.ts.map

package/dist/handlers/invites.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invites.d.ts","sourceRoot":"","sources":["../../src/handlers/invites.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAiBH,OAAO,KAAK,EAAE,UAAU,EAAc,MAAM,iBAAiB,CAAC;AA+C9D,gEAAgE;AAChE,eAAO,MAAM,WAAW,EAAE,UASzB,CAAC;AAEF,kDAAkD;AAClD,eAAO,MAAM,YAAY,EAAE,UA2D1B,CAAC;AAEF,yEAAyE;AACzE,eAAO,MAAM,YAAY,EAAE,UAU1B,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,YAAY,EAAE,UA+B1B,CAAC"}