@selvajs/server 1.2.0 → 1.3.0

package/dist/handlers/invites.js

@@ -0,0 +1,148 @@
+/**
+ * Org invites: list, mint, revoke, resend.
+ *
+ * **The raw token exists only in the response.** The store sees an HMAC digest,
+ * so a leak of the `invites` table cannot be replayed without the instance
+ * secret — and `tokenHash` is dropped by the response schema, which is why
+ * every response here goes through `shaped`/`shapedCollection` rather than
+ * `{ body }`.
+ */
+import { randomUUID } from 'node:crypto';
+import { apiError, ApiErrorCode, CreatedInviteResponseSchema, CreateInviteBodySchema, InviteResponseSchema, noContent, parseBody, parseListOptions, requireCaller, requireParams, shaped, shapedCollection } from '../api/index.js';
+import { DEFAULT_ORG_PERMISSIONS, MEMBER_ASSIGNABLE_PERMISSIONS } from '@selvajs/platform';
+import { assertCanGrantPlatformPermissions, canActorChangeOrgRole, requireManageOrgMembers, requireActingOrg, splitFlatPermissions } from '../access/index.js';
+import { deliverInvite } from '../notifications/index.js';
+import { tokenCodec } from './services.js';
+import { findPendingInviteInOrg } from './invite-lookup.js';
+const INVITE_TTL_MS = 7 * 24 * 60 * 60 * 1000; // 7 days
+/**
+ * Mail the accept link, or report why not.
+ *
+ * Mint and resend must send the identical message, so the deps threading lives
+ * here rather than at each call site. `not-configured` when the host wired no
+ * notification provider: the invite row is already committed and the caller
+ * still holds `acceptUrl`, so an instance without mail is a working instance,
+ * not a failed write.
+ */
+async function mailInvite(req, invite, acceptUrl) {
+    const notifications = req.deps.notifications;
+    if (!notifications)
+        return 'not-configured';
+    return deliverInvite({
+        ctx: req.ctx,
+        log: req.log,
+        invite,
+        acceptUrl,
+        actor: { profile: req.profile, user: req.user },
+        orgs: req.deps.orgs,
+        notifications,
+        fallbackOrgName: req.deps.instanceName
+    });
+}
+/** Pending and recently accepted invites for the acting org. */
+export const listInvites = async (req) => {
+    requireManageOrgMembers(req);
+    const { ctx, orgId } = requireActingOrg(req, req.params.orgId);
+    // `tokenHash` is the server-side lookup key; the response schema drops it.
+    return shapedCollection(InviteResponseSchema, await req.deps.invites.listByOrg(ctx, orgId, parseListOptions(req.url)));
+};
+/** Create an invite and return the accept URL. */
+export const createInvite = async (req) => {
+    requireManageOrgMembers(req);
+    const { ctx, orgId } = requireActingOrg(req, req.params.orgId);
+    const { user } = requireCaller(req);
+    const input = await parseBody(req.request, CreateInviteBodySchema);
+    const { platform: submittedPlatformPerms, org: submittedOrgPerms } = splitFlatPermissions(input.permissions);
+    // An invite is a third write path into platform scope, so it shares the
+    // guard with both /api/admin/users handlers rather than restating it.
+    assertCanGrantPlatformPermissions(ctx, submittedPlatformPerms);
+    // An invite is a second door into `org_members`, so it carries the same
+    // owner-only role gate as PATCH /orgs/{orgId}/members/{userId}. Without
+    // it an admin mints themselves an `owner` invite, accepts it, and then
+    // passes the sole-owner check when removing the founder — `accept-invite`
+    // writes `invite.orgRole` verbatim and cannot re-verify the minter.
+    if (!(await canActorChangeOrgRole(ctx, orgId, input.orgRole, req))) {
+        apiError(403, ApiErrorCode.FORBIDDEN, 'Only the org owner can invite someone as owner or admin.');
+    }
+    // owner/admin always carry the full set — the checkbox array from the UI is
+    // ignored for those roles. `member` takes the caller's selection intersected
+    // with MEMBER_ASSIGNABLE_PERMISSIONS, so governance permissions
+    // (manage_org_members, manage_org_compute) cannot be granted to a member.
+    const orgPermissions = input.orgRole === 'member'
+        ? submittedOrgPerms.filter((p) => MEMBER_ASSIGNABLE_PERMISSIONS.includes(p))
+        : [...DEFAULT_ORG_PERMISSIONS[input.orgRole]];
+    const codec = tokenCodec(req.deps, 'invites');
+    const rawToken = codec.mintRawToken();
+    const now = new Date();
+    const invite = {
+        id: randomUUID(),
+        tokenHash: codec.hashToken(rawToken),
+        email: input.email,
+        orgId,
+        orgRole: input.orgRole,
+        orgPermissions,
+        platformPermissions: submittedPlatformPerms,
+        invitedBy: user.id,
+        createdAt: now.toISOString(),
+        expiresAt: new Date(now.getTime() + INVITE_TTL_MS).toISOString()
+    };
+    await req.deps.invites.create(ctx, invite);
+    // `acceptUrl` carries the raw token and exists only in this response — it
+    // is not a field of the stored invite.
+    const acceptUrl = `${req.url.origin}/accept-invite?token=${rawToken}`;
+    const delivery = await mailInvite(req, invite, acceptUrl);
+    return shaped(CreatedInviteResponseSchema, { ...invite, acceptUrl, delivery }, 201);
+};
+/** Revoke a pending invite. Consumed invites are preserved for audit. */
+export const revokeInvite = async (req) => {
+    requireManageOrgMembers(req);
+    const { ctx, orgId } = requireActingOrg(req, req.params.orgId);
+    const { id } = requireParams(req.params, 'id');
+    if (!(await findPendingInviteInOrg(ctx, orgId, id, req.deps.invites))) {
+        apiError(404, ApiErrorCode.NOT_FOUND, 'Invite not found');
+    }
+    await req.deps.invites.revoke(ctx, id);
+    return noContent();
+};
+/**
+ * Re-send an invite: mint a replacement and revoke the original.
+ *
+ * A resend cannot reuse the original link. The raw token is never stored — only
+ * its HMAC digest is — so there is nothing to re-read, and rather than weaken
+ * that, this issues a fresh token and revokes the row it replaces. The old link
+ * stops working the moment this returns, which is also what an admin wants
+ * after mailing an invite to the wrong address.
+ *
+ * Grants are copied verbatim from the original. The role and permission gates
+ * ran when it was minted; re-deriving them here would let a since-demoted admin
+ * silently change what the invite carries.
+ */
+export const resendInvite = async (req) => {
+    requireManageOrgMembers(req);
+    const { ctx, orgId } = requireActingOrg(req, req.params.orgId);
+    const { id } = requireParams(req.params, 'id');
+    const existing = await findPendingInviteInOrg(ctx, orgId, id, req.deps.invites);
+    if (!existing)
+        apiError(404, ApiErrorCode.NOT_FOUND, 'Invite not found');
+    if (existing.acceptedAt) {
+        apiError(409, ApiErrorCode.CONFLICT, 'This invite has already been accepted.');
+    }
+    const codec = tokenCodec(req.deps, 'invites');
+    const rawToken = codec.mintRawToken();
+    const now = new Date();
+    const replacement = {
+        ...existing,
+        id: randomUUID(),
+        tokenHash: codec.hashToken(rawToken),
+        createdAt: now.toISOString(),
+        expiresAt: new Date(now.getTime() + INVITE_TTL_MS).toISOString()
+    };
+    // Create before revoking: if the revoke fails the invitee holds a working
+    // link, whereas the reverse order can leave them with none at all.
+    await req.deps.invites.create(ctx, replacement);
+    await req.deps.invites.revoke(ctx, existing.id);
+    const acceptUrl = `${req.url.origin}/accept-invite?token=${rawToken}`;
+    const delivery = await mailInvite(req, replacement, acceptUrl);
+    return shaped(CreatedInviteResponseSchema, { ...replacement, acceptUrl, delivery }, 201);
+};
+//# sourceMappingURL=invites.js.map

package/dist/handlers/invites.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invites.js","sourceRoot":"","sources":["../../src/handlers/invites.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACN,QAAQ,EACR,YAAY,EACZ,2BAA2B,EAC3B,sBAAsB,EACtB,oBAAoB,EACpB,SAAS,EACT,SAAS,EACT,gBAAgB,EAChB,aAAa,EACb,aAAa,EACb,MAAM,EACN,gBAAgB,EAChB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACN,uBAAuB,EACvB,6BAA6B,EAE7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACN,iCAAiC,EACjC,qBAAqB,EACrB,uBAAuB,EACvB,gBAAgB,EAChB,oBAAoB,EACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAuB,MAAM,2BAA2B,CAAC;AAC/E,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAE5D,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,SAAS;AAExD;;;;;;;;GAQG;AACH,KAAK,UAAU,UAAU,CACxB,GAAe,EACf,MAAc,EACd,SAAiB;IAEjB,MAAM,aAAa,GAAG,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC;IAC7C,IAAI,CAAC,aAAa;QAAE,OAAO,gBAAgB,CAAC;IAC5C,OAAO,aAAa,CAAC;QACpB,GAAG,EAAE,GAAG,CAAC,GAAI;QACb,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,MAAM;QACN,SAAS;QACT,KAAK,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE;QAC/C,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI;QACnB,aAAa;QACb,eAAe,EAAE,GAAG,CAAC,IAAI,CAAC,YAAY;KACtC,CAAC,CAAC;AACJ,CAAC;AAED,gEAAgE;AAChE,MAAM,CAAC,MAAM,WAAW,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACpD,uBAAuB,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAE/D,2EAA2E;IAC3E,OAAO,gBAAgB,CACtB,oBAAoB,EACpB,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CACvE,CAAC;AACH,CAAC,CAAC;AAEF,kDAAkD;AAClD,MAAM,CAAC,MAAM,YAAY,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACrD,uBAAuB,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/D,MAAM,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAEpC,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;IACnE,MAAM,EAAE,QAAQ,EAAE,sBAAsB,EAAE,GAAG,EAAE,iBAAiB,EAAE,GAAG,oBAAoB,CACxF,KAAK,CAAC,WAAW,CACjB,CAAC;IAEF,wEAAwE;IACxE,sEAAsE;IACtE,iCAAiC,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;IAE/D,wEAAwE;IACxE,wEAAwE;IACxE,uEAAuE;IACvE,0EAA0E;IAC1E,oEAAoE;IACpE,IAAI,CAAC,CAAC,MAAM,qBAAqB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;QACpE,QAAQ,CACP,GAAG,EACH,YAAY,CAAC,SAAS,EACtB,0DAA0D,CAC1D,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,6EAA6E;IAC7E,gEAAgE;IAChE,0EAA0E;IAC1E,MAAM,cAAc,GACnB,KAAK,CAAC,OAAO,KAAK,QAAQ;QACzB,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,6BAA6B,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC5E,CAAC,CAAC,CAAC,GAAG,uBAAuB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAEhD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,KAAK,CAAC,YAAY,EAAE,CAAC;IACtC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,MAAM,GAAW;QACtB,EAAE,EAAE,UAAU,EAAE;QAChB,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC;QACpC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,KAAK;QACL,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc;QACd,mBAAmB,EAAE,sBAAsB;QAC3C,SAAS,EAAE,IAAI,CAAC,EAAE;QAClB,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;QAC5B,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,aAAa,CAAC,CAAC,WAAW,EAAE;KAChE,CAAC;IACF,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAE3C,0EAA0E;IAC1E,uCAAuC;IACvC,MAAM,SAAS,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,wBAAwB,QAAQ,EAAE,CAAC;IACtE,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IAE1D,OAAO,MAAM,CAAC,2BAA2B,EAAE,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC;AACrF,CAAC,CAAC;AAEF,yEAAyE;AACzE,MAAM,CAAC,MAAM,YAAY,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACrD,uBAAuB,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/D,MAAM,EAAE,EAAE,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAE/C,IAAI,CAAC,CAAC,MAAM,sBAAsB,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACvE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACvC,OAAO,SAAS,EAAE,CAAC;AACpB,CAAC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,YAAY,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACrD,uBAAuB,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/D,MAAM,EAAE,EAAE,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAE/C,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAChF,IAAI,CAAC,QAAQ;QAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;IACzE,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;QACzB,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,wCAAwC,CAAC,CAAC;IAChF,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,KAAK,CAAC,YAAY,EAAE,CAAC;IACtC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,WAAW,GAAW;QAC3B,GAAG,QAAQ;QACX,EAAE,EAAE,UAAU,EAAE;QAChB,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC;QACpC,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;QAC5B,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,aAAa,CAAC,CAAC,WAAW,EAAE;KAChE,CAAC;IAEF,0EAA0E;IAC1E,mEAAmE;IACnE,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAChD,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;IAEhD,MAAM,SAAS,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,wBAAwB,QAAQ,EAAE,CAAC;IACtE,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;IAE/D,OAAO,MAAM,CAAC,2BAA2B,EAAE,EAAE,GAAG,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC;AAC1F,CAAC,CAAC"}

package/dist/handlers/me.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Whoami. The first call a non-browser client makes, and the only way a token
+ * holder can see which org their credential resolved into — `actingOrgId` is
+ * derived per request from the caller's membership, not frozen at mint time.
+ */
+import { type ApiHandler } from '../api/index.js';
+export declare const getMe: ApiHandler;
+//# sourceMappingURL=me.d.ts.map

package/dist/handlers/me.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"me.d.ts","sourceRoot":"","sources":["../../src/handlers/me.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAiB,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAEjE,eAAO,MAAM,KAAK,EAAE,UAcnB,CAAC"}

package/dist/handlers/me.js

@@ -0,0 +1,21 @@
+/**
+ * Whoami. The first call a non-browser client makes, and the only way a token
+ * holder can see which org their credential resolved into — `actingOrgId` is
+ * derived per request from the caller's membership, not frozen at mint time.
+ */
+import { requireCaller } from '../api/index.js';
+export const getMe = async (req) => {
+    const { ctx, user } = requireCaller(req);
+    return {
+        body: {
+            userId: user.id,
+            email: user.email,
+            displayName: req.profile?.displayName,
+            actingOrgId: ctx.actingOrgId,
+            platformPermissions: ctx.platformPermissions,
+            orgPermissions: ctx.orgPermissions,
+            starredDefinitions: req.profile?.starredDefinitions ?? []
+        }
+    };
+};
+//# sourceMappingURL=me.js.map

package/dist/handlers/me.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"me.js","sourceRoot":"","sources":["../../src/handlers/me.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,aAAa,EAAmB,MAAM,iBAAiB,CAAC;AAEjE,MAAM,CAAC,MAAM,KAAK,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IAC9C,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAEzC,OAAO;QACN,IAAI,EAAE;YACL,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,WAAW,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW;YACrC,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;YAC5C,cAAc,EAAE,GAAG,CAAC,cAAc;YAClC,kBAAkB,EAAE,GAAG,CAAC,OAAO,EAAE,kBAAkB,IAAI,EAAE;SACzD;KACD,CAAC;AACH,CAAC,CAAC"}

package/dist/handlers/me.starred.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Starring a definition for the calling user. Both directions are idempotent.
+ *
+ * No visibility check: a star is a row on the caller's own profile, keyed by
+ * guid, and reveals nothing about whether that guid exists. The read paths that
+ * expand stars into definitions filter by visibility there.
+ */
+import { type ApiHandler } from '../api/index.js';
+export declare const starDefinition: ApiHandler;
+export declare const unstarDefinition: ApiHandler;
+//# sourceMappingURL=me.starred.d.ts.map

package/dist/handlers/me.starred.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"me.starred.d.ts","sourceRoot":"","sources":["../../src/handlers/me.starred.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAA2C,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE3F,eAAO,MAAM,cAAc,EAAE,UAM5B,CAAC;AAEF,eAAO,MAAM,gBAAgB,EAAE,UAM9B,CAAC"}

package/dist/handlers/me.starred.js

@@ -0,0 +1,21 @@
+/**
+ * Starring a definition for the calling user. Both directions are idempotent.
+ *
+ * No visibility check: a star is a row on the caller's own profile, keyed by
+ * guid, and reveals nothing about whether that guid exists. The read paths that
+ * expand stars into definitions filter by visibility there.
+ */
+import { noContent, requireCaller, requireParams } from '../api/index.js';
+export const starDefinition = async (req) => {
+    const { ctx, user } = requireCaller(req);
+    const { guid } = requireParams(req.params, 'guid');
+    await req.deps.userProfile.starDefinition(ctx, user.id, guid);
+    return noContent();
+};
+export const unstarDefinition = async (req) => {
+    const { ctx, user } = requireCaller(req);
+    const { guid } = requireParams(req.params, 'guid');
+    await req.deps.userProfile.unstarDefinition(ctx, user.id, guid);
+    return noContent();
+};
+//# sourceMappingURL=me.starred.js.map

package/dist/handlers/me.starred.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"me.starred.js","sourceRoot":"","sources":["../../src/handlers/me.starred.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,aAAa,EAAmB,MAAM,iBAAiB,CAAC;AAE3F,MAAM,CAAC,MAAM,cAAc,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACvD,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEnD,MAAM,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAC9D,OAAO,SAAS,EAAE,CAAC;AACpB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACzD,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEnD,MAAM,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAChE,OAAO,SAAS,EAAE,CAAC;AACpB,CAAC,CAAC"}

package/dist/handlers/orgAssets.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Org branding assets, generic over kind (`logo`, `favicon`, …). Gated on
+ * `manage_org_members` — org branding is an org-admin action.
+ *
+ * Raster images and SVG are both accepted. Every input is rasterized to WebP by
+ * the shared transcoder inside the storage provider, so SVG carries no XSS
+ * surface: no vector blob is ever stored or served. The allowlist below is the
+ * HTTP gate; the rasterization is the security control.
+ */
+import { type ApiHandler } from '../api/index.js';
+export declare const uploadOrgAsset: ApiHandler;
+export declare const removeOrgAsset: ApiHandler;
+//# sourceMappingURL=orgAssets.d.ts.map

package/dist/handlers/orgAssets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"orgAssets.d.ts","sourceRoot":"","sources":["../../src/handlers/orgAssets.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAoD,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAmBpG,eAAO,MAAM,cAAc,EAAE,UAqB5B,CAAC;AAEF,eAAO,MAAM,cAAc,EAAE,UAO5B,CAAC"}

package/dist/handlers/orgAssets.js

@@ -0,0 +1,54 @@
+/**
+ * Org branding assets, generic over kind (`logo`, `favicon`, …). Gated on
+ * `manage_org_members` — org branding is an org-admin action.
+ *
+ * Raster images and SVG are both accepted. Every input is rasterized to WebP by
+ * the shared transcoder inside the storage provider, so SVG carries no XSS
+ * surface: no vector blob is ever stored or served. The allowlist below is the
+ * HTTP gate; the rasterization is the security control.
+ */
+import { apiError, ApiErrorCode, noContent, requireUpload } from '../api/index.js';
+import { OrgAssetKindSchema } from '@selvajs/platform';
+import { requireManageOrgMembers, requireActingOrg } from '../access/index.js';
+import { orgAssetService } from './services.js';
+const ALLOWED_CONTENT_TYPES = new Set([
+    'image/png',
+    'image/jpeg',
+    'image/webp',
+    'image/gif',
+    'image/svg+xml'
+]);
+function parseKind(params) {
+    const kind = OrgAssetKindSchema.safeParse(params.kind);
+    if (!kind.success)
+        apiError(404, ApiErrorCode.NOT_FOUND, `Unknown asset kind '${params.kind}'`);
+    return kind.data;
+}
+export const uploadOrgAsset = async (req) => {
+    requireManageOrgMembers(req);
+    const kind = parseKind(req.params);
+    const { ctx, orgId } = requireActingOrg(req, req.params.orgId);
+    // The org must exist — keeps a leaked id from seeding orphan blobs.
+    const org = await req.deps.orgs.getOrg(ctx, orgId);
+    if (!org)
+        apiError(404, ApiErrorCode.NOT_FOUND, 'Organization not found');
+    const { file } = requireUpload(await req.request.formData(), 'image', {
+        maxBytes: req.deps.uploadLimits.maxImageFileSize,
+        contentTypes: {
+            allowed: ALLOWED_CONTENT_TYPES,
+            message: 'Unsupported image type. Allowed: PNG, JPG, WebP, GIF, SVG'
+        },
+        label: 'Image'
+    });
+    const bytes = new Uint8Array(await file.arrayBuffer());
+    const url = await orgAssetService(req.deps).saveAsset(ctx, orgId, kind, bytes, file.type);
+    return { body: { kind, url } };
+};
+export const removeOrgAsset = async (req) => {
+    requireManageOrgMembers(req);
+    const kind = parseKind(req.params);
+    const { ctx, orgId } = requireActingOrg(req, req.params.orgId);
+    await orgAssetService(req.deps).removeAsset(ctx, orgId, kind);
+    return noContent();
+};
+//# sourceMappingURL=orgAssets.js.map

package/dist/handlers/orgAssets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"orgAssets.js","sourceRoot":"","sources":["../../src/handlers/orgAssets.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,aAAa,EAAmB,MAAM,iBAAiB,CAAC;AACpG,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC/E,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACrC,WAAW;IACX,YAAY;IACZ,YAAY;IACZ,WAAW;IACX,eAAe;CACf,CAAC,CAAC;AAEH,SAAS,SAAS,CAAC,MAAyB;IAC3C,MAAM,IAAI,GAAG,kBAAkB,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACvD,IAAI,CAAC,IAAI,CAAC,OAAO;QAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,uBAAuB,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;IAChG,OAAO,IAAI,CAAC,IAAI,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACvD,uBAAuB,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAE/D,oEAAoE;IACpE,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACnD,IAAI,CAAC,GAAG;QAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,wBAAwB,CAAC,CAAC;IAE1E,MAAM,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE;QACrE,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,gBAAgB;QAChD,YAAY,EAAE;YACb,OAAO,EAAE,qBAAqB;YAC9B,OAAO,EAAE,2DAA2D;SACpE;QACD,KAAK,EAAE,OAAO;KACd,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1F,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC;AAChC,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACvD,uBAAuB,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAE/D,MAAM,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IAC9D,OAAO,SAAS,EAAE,CAAC;AACpB,CAAC,CAAC"}

package/dist/handlers/orgCompute.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Per-org compute config: this org's own servers (`scope: 'org'`) and its
+ * default selection (`orgDefaults[orgId]`). Platform servers and the global
+ * default are read-only here — `manage_compute` owns those via `/api/admin/compute`.
+ *
+ * Authorization: org `owner`/`admin` with `manage_org_compute`, plus the acting-org
+ * tenancy check. Gated by `ALLOW_ORG_COMPUTE_OVERRIDE`; when off, both methods 403.
+ *
+ * **`apiKey` merge semantics are the trap here.** Omitted preserves the stored
+ * key, `null` clears it, a string replaces it — and `/api/admin/compute` must
+ * agree, which is why the merge lives in `@selvajs/server/compute`, not inline.
+ */
+import type { ApiHandler } from '../api/index.js';
+export declare const getOrgCompute: ApiHandler;
+export declare const updateOrgCompute: ApiHandler;
+//# sourceMappingURL=orgCompute.d.ts.map

package/dist/handlers/orgCompute.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"orgCompute.d.ts","sourceRoot":"","sources":["../../src/handlers/orgCompute.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAWH,OAAO,KAAK,EAAE,UAAU,EAAc,MAAM,iBAAiB,CAAC;AA0B9D,eAAO,MAAM,aAAa,EAAE,UAiC3B,CAAC;AAEF,eAAO,MAAM,gBAAgB,EAAE,UA0D9B,CAAC"}

package/dist/handlers/orgCompute.js

@@ -0,0 +1,96 @@
+/**
+ * Per-org compute config: this org's own servers (`scope: 'org'`) and its
+ * default selection (`orgDefaults[orgId]`). Platform servers and the global
+ * default are read-only here — `manage_compute` owns those via `/api/admin/compute`.
+ *
+ * Authorization: org `owner`/`admin` with `manage_org_compute`, plus the acting-org
+ * tenancy check. Gated by `ALLOW_ORG_COMPUTE_OVERRIDE`; when off, both methods 403.
+ *
+ * **`apiKey` merge semantics are the trap here.** Omitted preserves the stored
+ * key, `null` clears it, a string replaces it — and `/api/admin/compute` must
+ * agree, which is why the merge lives in `@selvajs/server/compute`, not inline.
+ */
+import { apiError, ApiErrorCode, noContent, OrgComputePatchBodySchema, OrgComputeResponseSchema, parseBody, shaped } from '../api/index.js';
+import { isOrgServer, isPlatformServer, serversVisibleTo } from '@selvajs/platform';
+import { requireManageOrgCompute, requireActingOrg } from '../access/index.js';
+import { evictChangedServers, validateIncomingServers, resolveApiKey, storedKeysById } from '../compute/index.js';
+function requireFlag(req) {
+    if (!req.deps.flag('ALLOW_ORG_COMPUTE_OVERRIDE')) {
+        apiError(403, ApiErrorCode.FORBIDDEN, 'Per-org compute override is disabled on this instance (ALLOW_ORG_COMPUTE_OVERRIDE).');
+    }
+}
+export const getOrgCompute = async (req) => {
+    requireFlag(req);
+    requireManageOrgCompute(req);
+    const { ctx, orgId } = requireActingOrg(req, req.params.orgId);
+    // Scoped in the store, so `config.servers` holds only what this org may
+    // see and `defaultServerId` is blank unless it is one of them.
+    const config = await req.deps.computeServer.getConfig(ctx, { scopeToOrgId: orgId });
+    // Servers this org owns and may edit. `apiKey` is dropped by the response
+    // schema; `hasApiKey` is what a picker needs to render "key set".
+    const owned = config.servers
+        .filter((s) => isOrgServer(s) && s.ownerOrgId === orgId)
+        .map((s) => ({ ...s, hasApiKey: !!s.hasApiKey }));
+    // Platform and own servers visible to this org — the read-only catalog
+    // behind the "default selection" dropdown.
+    const catalog = config.servers.map((s) => ({
+        id: s.id,
+        label: s.label,
+        serverUrl: s.serverUrl,
+        scope: s.scope,
+        source: isPlatformServer(s) ? 'platform' : 'org',
+        timeoutMs: s.timeoutMs,
+        retryCount: s.retryCount
+    }));
+    return shaped(OrgComputeResponseSchema, {
+        servers: owned,
+        defaultServerId: config.orgDefaults?.[orgId] ?? null,
+        globalDefaultServerId: config.defaultServerId ?? null,
+        catalog
+    });
+};
+export const updateOrgCompute = async (req) => {
+    requireFlag(req);
+    requireManageOrgCompute(req);
+    const { ctx, orgId } = requireActingOrg(req, req.params.orgId);
+    const incoming = await parseBody(req.request, OrgComputePatchBodySchema);
+    // Cross-field rules the schema can't express (URL shape, duplicate ids).
+    validateIncomingServers(incoming.servers);
+    const provider = req.deps.computeServer;
+    // Every key is needed: an unchanged server keeps its stored key across the write.
+    const existing = await provider.getConfig(ctx, { includeApiKeys: true });
+    const storedKeys = storedKeysById(existing.servers.filter((s) => isOrgServer(s) && s.ownerOrgId === orgId));
+    const next = incoming.servers.map((s) => ({
+        id: s.id,
+        scope: 'org',
+        ownerOrgId: orgId,
+        label: s.label,
+        serverUrl: s.serverUrl,
+        timeoutMs: s.timeoutMs,
+        retryCount: s.retryCount,
+        apiKey: resolveApiKey(s.apiKey, storedKeys.get(s.id))
+    }));
+    // The requested org default must be visible to this org. The check runs
+    // against the projected post-save config so it sees both the new
+    // org-private rows and the existing platform ones.
+    if (typeof incoming.defaultServerId === 'string') {
+        const projected = {
+            servers: [
+                ...existing.servers.filter((s) => !(isOrgServer(s) && s.ownerOrgId === orgId)),
+                ...next
+            ],
+            defaultServerId: existing.defaultServerId,
+            orgDefaults: existing.orgDefaults
+        };
+        const visibleIds = new Set(serversVisibleTo(projected, orgId).map((s) => s.id));
+        if (!visibleIds.has(incoming.defaultServerId)) {
+            apiError(400, ApiErrorCode.VALIDATION_FAILED, 'defaultServerId must reference a server visible to this organization');
+        }
+    }
+    await provider.saveOrgServers(ctx, orgId, next, incoming.defaultServerId);
+    // Drop warm clients for servers whose URL or key rotated, or that were
+    // removed — keyed on `id`, they would not age out on their own.
+    evictChangedServers(existing.servers.filter((s) => isOrgServer(s) && s.ownerOrgId === orgId), next, req.deps.evictComputeClient);
+    return noContent();
+};
+//# sourceMappingURL=orgCompute.js.map

package/dist/handlers/orgCompute.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"orgCompute.js","sourceRoot":"","sources":["../../src/handlers/orgCompute.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACN,QAAQ,EACR,YAAY,EACZ,SAAS,EACT,yBAAyB,EACzB,wBAAwB,EACxB,SAAS,EACT,MAAM,EACN,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACN,WAAW,EACX,gBAAgB,EAChB,gBAAgB,EAEhB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC/E,OAAO,EACN,mBAAmB,EACnB,uBAAuB,EACvB,aAAa,EACb,cAAc,EAEd,MAAM,qBAAqB,CAAC;AAE7B,SAAS,WAAW,CAAC,GAAe;IACnC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,4BAA4B,CAAC,EAAE,CAAC;QAClD,QAAQ,CACP,GAAG,EACH,YAAY,CAAC,SAAS,EACtB,qFAAqF,CACrF,CAAC;IACH,CAAC;AACF,CAAC;AAED,MAAM,CAAC,MAAM,aAAa,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACtD,WAAW,CAAC,GAAG,CAAC,CAAC;IACjB,uBAAuB,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAE/D,wEAAwE;IACxE,+DAA+D;IAC/D,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;IAEpF,0EAA0E;IAC1E,kEAAkE;IAClE,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO;SAC1B,MAAM,CAAC,CAAC,CAAC,EAAyB,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,KAAK,KAAK,CAAC;SAC9E,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IAEnD,uEAAuE;IACvE,2CAA2C;IAC3C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1C,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,UAAoB,CAAC,CAAC,CAAE,KAAe;QACtE,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,UAAU,EAAE,CAAC,CAAC,UAAU;KACxB,CAAC,CAAC,CAAC;IAEJ,OAAO,MAAM,CAAC,wBAAwB,EAAE;QACvC,OAAO,EAAE,KAAK;QACd,eAAe,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,IAAI,IAAI;QACpD,qBAAqB,EAAE,MAAM,CAAC,eAAe,IAAI,IAAI;QACrD,OAAO;KACP,CAAC,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACzD,WAAW,CAAC,GAAG,CAAC,CAAC;IACjB,uBAAuB,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAE/D,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,yBAAyB,CAAC,CAAC;IACzE,yEAAyE;IACzE,uBAAuB,CAAC,QAAQ,CAAC,OAA+B,CAAC,CAAC;IAElE,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC;IACxC,kFAAkF;IAClF,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;IACzE,MAAM,UAAU,GAAG,cAAc,CAChC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAyB,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,KAAK,KAAK,CAAC,CAC/F,CAAC;IAEF,MAAM,IAAI,GAAuB,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7D,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,KAAK,EAAE,KAAK;QACZ,UAAU,EAAE,KAAK;QACjB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;KACrD,CAAC,CAAC,CAAC;IAEJ,wEAAwE;IACxE,iEAAiE;IACjE,mDAAmD;IACnD,IAAI,OAAO,QAAQ,CAAC,eAAe,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,SAAS,GAAG;YACjB,OAAO,EAAE;gBACR,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,KAAK,KAAK,CAAC,CAAC;gBAC9E,GAAG,IAAI;aACP;YACD,eAAe,EAAE,QAAQ,CAAC,eAAe;YACzC,WAAW,EAAE,QAAQ,CAAC,WAAW;SACjC,CAAC;QACF,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAChF,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YAC/C,QAAQ,CACP,GAAG,EACH,YAAY,CAAC,iBAAiB,EAC9B,sEAAsE,CACtE,CAAC;QACH,CAAC;IACF,CAAC;IAED,MAAM,QAAQ,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,eAAe,CAAC,CAAC;IAC1E,uEAAuE;IACvE,gEAAgE;IAChE,mBAAmB,CAClB,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,KAAK,KAAK,CAAC,EACxE,IAAI,EACJ,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAC3B,CAAC;IACF,OAAO,SAAS,EAAE,CAAC;AACpB,CAAC,CAAC"}

package/dist/handlers/orgMembers.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Org member role, permissions, and removal.
+ *
+ * Two gates run on every request: `requireManageOrgMembers` (owner+admin) and
+ * `requireActingOrg` (the URL `orgId` must equal `ctx.actingOrgId`, so
+ * cross-org member mutation is blocked even for an actor with permissions in
+ * another org).
+ *
+ * The sole-owner invariant applies to demotion and removal alike — an org with
+ * no owner is unadministrable, and removing an owner ends their role exactly as
+ * demoting them does.
+ */
+import type { ApiHandler } from '../api/index.js';
+/**
+ * Body accepts either or both:
+ *   - `{ role: OrgRole }` — change the member's role. Owner-only.
+ *   - `{ permissions: OrgPermission[] }` — replace the member's grantable
+ *     permissions. Owner/admin via `manage_org_members`. For `member`-role
+ *     targets, only `MEMBER_ASSIGNABLE_PERMISSIONS` are accepted; promoting a
+ *     member's permissions does NOT change their role.
+ */
+export declare const updateOrgMember: ApiHandler;
+/**
+ * Remove a member from the org. Owner/admin via `manage_org_members`, same
+ * tenancy check as PATCH, and the same sole-owner invariant — removing the last
+ * owner would leave the org unadministrable.
+ */
+export declare const removeOrgMember: ApiHandler;
+//# sourceMappingURL=orgMembers.d.ts.map

package/dist/handlers/orgMembers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"orgMembers.d.ts","sourceRoot":"","sources":["../../src/handlers/orgMembers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAUH,OAAO,KAAK,EAAE,UAAU,EAAc,MAAM,iBAAiB,CAAC;AA+F9D;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,EAAE,UA8D7B,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,eAAe,EAAE,UAqE7B,CAAC"}