@selvajs/server 1.2.0 → 1.3.0

package/dist/handlers/reclaim.js

@@ -0,0 +1,38 @@
+/**
+ * Org owner/admin escape hatch for a project they cannot otherwise reach.
+ *
+ * Adds the actor as a co-owner and does NOT demote the existing owner.
+ * Idempotent: reclaiming twice is a no-op, because `addProjectMember`
+ * reactivates a soft-deleted row in place.
+ */
+import { created, requireParams } from '../api/index.js';
+import { actorFrom } from '@selvajs/platform';
+import { requireCanReclaim } from '../access/index.js';
+export const reclaimProject = async (req) => {
+    const { id } = requireParams(req.params, 'id');
+    const { user, ctx, project } = await requireCanReclaim(req, id);
+    const now = new Date().toISOString();
+    const member = {
+        projectId: id,
+        userId: user.id,
+        role: 'owner',
+        joinedAt: now,
+        updatedAt: now,
+        updatedBy: ctx.userId || user.id,
+        deletedAt: null
+    };
+    await req.deps.projects.addProjectMember(ctx, member);
+    // `addProjectMember` emits `project_member.added`, which is byte-identical
+    // to an owner adding a teammate. The whole escape hatch rests on the audit
+    // trail, so the escalation needs its own event or the log cannot answer the
+    // only question an auditor has here.
+    await req.deps.events.emit({
+        type: 'project.reclaimed',
+        projectId: id,
+        orgId: project.orgId,
+        actorId: actorFrom(ctx),
+        priorVisibility: project.visibility
+    });
+    return created({ member });
+};
+//# sourceMappingURL=reclaim.js.map

package/dist/handlers/reclaim.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reclaim.js","sourceRoot":"","sources":["../../src/handlers/reclaim.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,OAAO,EAAE,aAAa,EAAmB,MAAM,iBAAiB,CAAC;AAC1E,OAAO,EAAE,SAAS,EAAsB,MAAM,mBAAmB,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAEvD,MAAM,CAAC,MAAM,cAAc,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACvD,MAAM,EAAE,EAAE,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC/C,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAEhE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,MAAM,GAAkB;QAC7B,SAAS,EAAE,EAAE;QACb,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,GAAG;QACb,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,EAAE;QAChC,SAAS,EAAE,IAAI;KACf,CAAC;IAEF,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAEtD,2EAA2E;IAC3E,2EAA2E;IAC3E,4EAA4E;IAC5E,qCAAqC;IACrC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;QAC1B,IAAI,EAAE,mBAAmB;QACzB,SAAS,EAAE,EAAE;QACb,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC;QACvB,eAAe,EAAE,OAAO,CAAC,UAAU;KACnC,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;AAC5B,CAAC,CAAC"}

package/dist/handlers/services.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Accessors for the host-composed services on `SelvaDeps`.
+ *
+ * `services` is host-supplied and optional by type, so every call site would
+ * otherwise repeat a presence check or reach for `!`. A host that mounts these
+ * handlers without wiring a service it needs gets a named error here rather
+ * than `Cannot read properties of undefined` from inside the service call.
+ */
+import type { SelvaDeps } from '../api/index.js';
+import type { TokenCodec } from '../tokens/index.js';
+import type { OrgAssetService } from '../organizations/index.js';
+export declare function definitionService(deps: SelvaDeps): import("../definitions/definition-service.js").DefinitionService;
+export declare function orgAssetService(deps: SelvaDeps): OrgAssetService;
+/**
+ * A token codec, or a named failure.
+ *
+ * Minting through an absent codec is the one failure mode worth being loud
+ * about: a handler that quietly skipped hashing would persist a row whose token
+ * can never be verified, and nothing downstream would report it.
+ */
+export declare function tokenCodec(deps: SelvaDeps, family: keyof SelvaDeps['tokens']): TokenCodec;
+//# sourceMappingURL=services.d.ts.map

package/dist/handlers/services.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"services.d.ts","sourceRoot":"","sources":["../../src/handlers/services.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAEjE,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,SAAS,oEAMhD;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,SAAS,GAAG,eAAe,CAMhE;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC,QAAQ,CAAC,GAAG,UAAU,CAMzF"}

package/dist/handlers/services.js

@@ -0,0 +1,37 @@
+/**
+ * Accessors for the host-composed services on `SelvaDeps`.
+ *
+ * `services` is host-supplied and optional by type, so every call site would
+ * otherwise repeat a presence check or reach for `!`. A host that mounts these
+ * handlers without wiring a service it needs gets a named error here rather
+ * than `Cannot read properties of undefined` from inside the service call.
+ */
+export function definitionService(deps) {
+    const service = deps.services.definitions;
+    if (!service) {
+        throw new Error('SelvaDeps.services.definitions is not wired — mount requires it.');
+    }
+    return service;
+}
+export function orgAssetService(deps) {
+    const service = deps.services.orgAssets;
+    if (!service) {
+        throw new Error('SelvaDeps.services.orgAssets is not wired — mount requires it.');
+    }
+    return service;
+}
+/**
+ * A token codec, or a named failure.
+ *
+ * Minting through an absent codec is the one failure mode worth being loud
+ * about: a handler that quietly skipped hashing would persist a row whose token
+ * can never be verified, and nothing downstream would report it.
+ */
+export function tokenCodec(deps, family) {
+    const codec = deps.tokens[family];
+    if (!codec) {
+        throw new Error(`SelvaDeps.tokens.${family} is not wired — mount requires it.`);
+    }
+    return codec;
+}
+//# sourceMappingURL=services.js.map

package/dist/handlers/services.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"services.js","sourceRoot":"","sources":["../../src/handlers/services.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,MAAM,UAAU,iBAAiB,CAAC,IAAe;IAChD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;IAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAe;IAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;IACxC,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,IAAe,EAAE,MAAiC;IAC5E,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,oBAAoB,MAAM,oCAAoC,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC"}

package/dist/handlers/shareLinks.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Share-link administration.
+ *
+ * Minting, listing and revoking are gated by `canEditDefinition` — the same
+ * authority that uploads versions and publishes. The raw token appears in the
+ * POST response and nowhere else; everything afterwards sees `hasToken: true`.
+ *
+ * **Responses go through `shaped`/`shapedCollection`, never `{ body }`.** A
+ * `ShareLink` carries `tokenHash`, and the response schema is what drops it —
+ * returning the record directly would put a credential hash on the wire with
+ * nothing failing at build time.
+ */
+import type { ApiHandler } from '../api/index.js';
+export declare const listShareLinks: ApiHandler;
+export declare const createShareLink: ApiHandler;
+/**
+ * Revoke a share link (soft-delete). Idempotent, gated by `canEditDefinition`.
+ *
+ * The link must belong to this definition, so one definition's editor cannot
+ * revoke another's link with a guessed or leaked linkId.
+ */
+export declare const revokeShareLink: ApiHandler;
+//# sourceMappingURL=shareLinks.d.ts.map

package/dist/handlers/shareLinks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shareLinks.d.ts","sourceRoot":"","sources":["../../src/handlers/shareLinks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAgBH,OAAO,KAAK,EAAE,UAAU,EAAc,MAAM,iBAAiB,CAAC;AAsB9D,eAAO,MAAM,cAAc,EAAE,UAU5B,CAAC;AAEF,eAAO,MAAM,eAAe,EAAE,UA8B7B,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,eAAe,EAAE,UAc7B,CAAC"}

package/dist/handlers/shareLinks.js

@@ -0,0 +1,85 @@
+/**
+ * Share-link administration.
+ *
+ * Minting, listing and revoking are gated by `canEditDefinition` — the same
+ * authority that uploads versions and publishes. The raw token appears in the
+ * POST response and nowhere else; everything afterwards sees `hasToken: true`.
+ *
+ * **Responses go through `shaped`/`shapedCollection`, never `{ body }`.** A
+ * `ShareLink` carries `tokenHash`, and the response schema is what drops it —
+ * returning the record directly would put a credential hash on the wire with
+ * nothing failing at build time.
+ */
+import { randomUUID } from 'node:crypto';
+import { apiError, ApiErrorCode, CreatedShareLinkResponseSchema, noContent, parseBody, parseListOptions, parseParam, requireCaller, shaped, shapedCollection, ShareLinkResponseSchema } from '../api/index.js';
+import { CreateShareLinkInputSchema, DEFAULT_SHARE_LINK_MAX_SOLVES } from '@selvajs/platform';
+import { GuidSchema } from '@selvajs/platform/definitions';
+import { requireEditableDefinition } from '../access/index.js';
+import { tokenCodec } from './services.js';
+function assertSharingEnabled(req) {
+    if (!req.deps.flag('ENABLE_SHARING')) {
+        apiError(404, ApiErrorCode.NOT_FOUND, 'Share links are disabled on this instance (ENABLE_SHARING).');
+    }
+}
+/** `tokenHash` is dropped by the response schema, not by this function. */
+function forClient(link) {
+    return { ...link, hasToken: true };
+}
+export const listShareLinks = async (req) => {
+    assertSharingEnabled(req);
+    const guid = parseParam(req.params.guid, GuidSchema, 'GUID');
+    const { ctx } = await requireEditableDefinition(req, guid);
+    const page = await req.deps.shareLinks.listByDefinition(ctx, guid, parseListOptions(req.url));
+    return shapedCollection(ShareLinkResponseSchema, {
+        items: page.items.map(forClient),
+        nextCursor: page.nextCursor
+    });
+};
+export const createShareLink = async (req) => {
+    assertSharingEnabled(req);
+    const guid = parseParam(req.params.guid, GuidSchema, 'GUID');
+    const { user } = requireCaller(req);
+    const { ctx } = await requireEditableDefinition(req, guid);
+    const input = await parseBody(req.request, CreateShareLinkInputSchema, { missingAs: {} });
+    const codec = tokenCodec(req.deps, 'shareLinks');
+    const raw = codec.mintRawToken();
+    const link = {
+        id: randomUUID(),
+        definitionId: guid,
+        channel: input.channel,
+        tokenHash: codec.hashToken(raw),
+        name: input.name,
+        createdBy: user.id,
+        createdAt: new Date().toISOString(),
+        expiresAt: input.expiresAt ?? null,
+        revokedAt: null,
+        allowSolve: input.allowSolve,
+        // The default applies only when the field is absent. An explicit `null`
+        // is a deliberate "uncap" choice and is preserved.
+        maxSolves: input.maxSolves === undefined ? DEFAULT_SHARE_LINK_MAX_SOLVES : input.maxSolves,
+        solveCount: 0
+    };
+    await req.deps.shareLinks.create(ctx, link);
+    // The token is returned once — a client that loses it must revoke and re-mint.
+    return shaped(CreatedShareLinkResponseSchema, { link: forClient(link), token: raw }, 201);
+};
+/**
+ * Revoke a share link (soft-delete). Idempotent, gated by `canEditDefinition`.
+ *
+ * The link must belong to this definition, so one definition's editor cannot
+ * revoke another's link with a guessed or leaked linkId.
+ */
+export const revokeShareLink = async (req) => {
+    assertSharingEnabled(req);
+    const guid = parseParam(req.params.guid, GuidSchema, 'GUID');
+    const linkId = parseParam(req.params.linkId, GuidSchema, 'link ID');
+    const { ctx } = await requireEditableDefinition(req, guid);
+    const existing = await req.deps.shareLinks.getById(ctx, linkId);
+    if (!existing || existing.definitionId !== guid) {
+        // 404 either way — never disclose that the id exists on another definition.
+        apiError(404, ApiErrorCode.NOT_FOUND, 'Share link not found.');
+    }
+    await req.deps.shareLinks.revoke(ctx, linkId);
+    return noContent();
+};
+//# sourceMappingURL=shareLinks.js.map

package/dist/handlers/shareLinks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shareLinks.js","sourceRoot":"","sources":["../../src/handlers/shareLinks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACN,QAAQ,EACR,YAAY,EACZ,8BAA8B,EAC9B,SAAS,EACT,SAAS,EACT,gBAAgB,EAChB,UAAU,EACV,aAAa,EACb,MAAM,EACN,gBAAgB,EAChB,uBAAuB,EACvB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,0BAA0B,EAAE,6BAA6B,EAAE,MAAM,mBAAmB,CAAC;AAE9F,OAAO,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAC3D,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE3C,SAAS,oBAAoB,CAAC,GAAe;IAC5C,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACtC,QAAQ,CACP,GAAG,EACH,YAAY,CAAC,SAAS,EACtB,6DAA6D,CAC7D,CAAC;IACH,CAAC;AACF,CAAC;AAED,2EAA2E;AAC3E,SAAS,SAAS,CAAC,IAAe;IACjC,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,IAAa,EAAE,CAAC;AAC7C,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACvD,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAC1B,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IAC7D,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAE3D,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,GAAG,EAAE,IAAI,EAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9F,OAAO,gBAAgB,CAAC,uBAAuB,EAAE;QAChD,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;QAChC,UAAU,EAAE,IAAI,CAAC,UAAU;KAC3B,CAAC,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACxD,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAC1B,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IAC7D,MAAM,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAE3D,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,0BAA0B,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;IAE1F,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,KAAK,CAAC,YAAY,EAAE,CAAC;IACjC,MAAM,IAAI,GAAc;QACvB,EAAE,EAAE,UAAU,EAAE;QAChB,YAAY,EAAE,IAAI;QAClB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC;QAC/B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,SAAS,EAAE,IAAI,CAAC,EAAE;QAClB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;QAClC,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,wEAAwE;QACxE,mDAAmD;QACnD,SAAS,EAAE,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS;QAC1F,UAAU,EAAE,CAAC;KACb,CAAC;IAEF,MAAM,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC5C,+EAA+E;IAC/E,OAAO,MAAM,CAAC,8BAA8B,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;AAC3F,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACxD,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAC1B,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IAEpE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAE3D,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAChE,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;QACjD,4EAA4E;QAC5E,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,uBAAuB,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC9C,OAAO,SAAS,EAAE,CAAC;AACpB,CAAC,CAAC"}

package/dist/http/index.d.ts

@@ -2,4 +2,5 @@ export { safeRedirectTarget } from './redirect.js';
 export { declaredBodySizeExceeds, type HeadersLike } from './body-size.js';
 export { applySecurityHeaders, type SecurityHeaderOptions } from './security-headers.js';
 export { createRouteClassifier, type RouteClassifier, type RouteClassifierConfig } from './route-classifier.js';
+export { createLoginRateLimiter, addressKeysCollapsed, type LoginRateLimiter, type LoginRateLimiterConfig } from './login-rate-limit.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/http/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/http/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,uBAAuB,EAAE,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAAE,KAAK,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AACzF,OAAO,EACN,qBAAqB,EACrB,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/http/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,uBAAuB,EAAE,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAAE,KAAK,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AACzF,OAAO,EACN,qBAAqB,EACrB,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACN,sBAAsB,EACtB,oBAAoB,EACpB,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,MAAM,uBAAuB,CAAC"}

package/dist/http/index.js

@@ -3,4 +3,5 @@ export { safeRedirectTarget } from './redirect.js';
 export { declaredBodySizeExceeds } from './body-size.js';
 export { applySecurityHeaders } from './security-headers.js';
 export { createRouteClassifier } from './route-classifier.js';
+export { createLoginRateLimiter, addressKeysCollapsed } from './login-rate-limit.js';
 //# sourceMappingURL=index.js.map

package/dist/http/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/http/index.ts"],"names":[],"mappings":"AAAA,uEAAuE;AAEvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,uBAAuB,EAAoB,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAA8B,MAAM,uBAAuB,CAAC;AACzF,OAAO,EACN,qBAAqB,EAGrB,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/http/index.ts"],"names":[],"mappings":"AAAA,uEAAuE;AAEvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,uBAAuB,EAAoB,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAA8B,MAAM,uBAAuB,CAAC;AACzF,OAAO,EACN,qBAAqB,EAGrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACN,sBAAsB,EACtB,oBAAoB,EAGpB,MAAM,uBAAuB,CAAC"}

package/dist/http/login-rate-limit.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Login rate limiting: two buckets per attempt, because neither dimension
+ * covers the other.
+ *
+ *   - **Per-address** bounds one client hammering the form. It is only
+ *     meaningful when the host resolves a real client address. Behind a reverse
+ *     proxy that is not configured to forward one, every request reports the
+ *     socket peer — `127.0.0.1` for all of them — which collapses the whole key
+ *     space into a single bucket: five failed logins from anywhere lock out the
+ *     entire instance, and only a success clears it, which nobody can now
+ *     reach. That failure is completely silent, hence
+ *     {@link addressKeysCollapsed}.
+ *   - **Per-account** bounds a targeted guessing attack, which address limiting
+ *     does not: an attacker spread across many source IPs contends with no
+ *     shared counter at all, leaving password-hash cost as the only real bound
+ *     on online guessing.
+ *
+ * An attempt must clear both and a failure charges both. A success clears the
+ * account bucket and the calling address's — a *different* address that failed
+ * against the same account keeps its own penalty.
+ *
+ * The flow counts failures rather than attempts: `check` gates without spending
+ * budget, `recordFailure` spends, and `clear` forgives. A successful login
+ * therefore costs nothing, so an ordinary user typing one wrong password never
+ * walks toward a lockout.
+ */
+import type { RateLimitResult } from '../compute/rate-limit.js';
+export interface LoginRateLimiterConfig {
+    /** Window for both buckets. Default 15 minutes. */
+    windowMs?: number;
+    /** Failed logins per address per window. Default 5. */
+    maxPerAddress?: number;
+    /**
+     * Failed logins per account per window. Default 20 — deliberately looser
+     * than the address cap, because this bucket is reachable by an attacker who
+     * wants to lock a known user out of their own account. It trades a little
+     * brute-force headroom for not being a cheap denial of service on a named
+     * victim.
+     */
+    maxPerAccount?: number;
+}
+export interface LoginRateLimiter {
+    /**
+     * Gate one attempt without spending budget.
+     *
+     * `email` may be absent — a password-only login against a provider with no
+     * user store has no account to key on — in which case only the address
+     * bucket applies.
+     */
+    check(address: string, email?: string): RateLimitResult;
+    /** Charge a failed attempt to both buckets. */
+    recordFailure(address: string, email?: string): void;
+    /** Forgive on success. */
+    clear(address: string, email?: string): void;
+    /** Drop all state. For tests. */
+    reset(): void;
+}
+export declare function createLoginRateLimiter(config?: LoginRateLimiterConfig): LoginRateLimiter;
+/**
+ * Whether per-address limiting has degenerated into one shared bucket.
+ *
+ * True when the host reports a loopback address for a request it did not
+ * originate — which means it sits behind a proxy and is reading the socket peer
+ * instead of a forwarded client address. The host decides what to do about it;
+ * warning once at startup is enough, and warning per request is not.
+ *
+ * `addressHeaderConfigured` is the host's answer to "am I reading a forwarded
+ * header at all", since which header and how many hops to trust are deployment
+ * config that no package can resolve for it.
+ */
+export declare function addressKeysCollapsed(address: string, addressHeaderConfigured: boolean): boolean;
+//# sourceMappingURL=login-rate-limit.d.ts.map

package/dist/http/login-rate-limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-rate-limit.d.ts","sourceRoot":"","sources":["../../src/http/login-rate-limit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAKhE,MAAM,WAAW,sBAAsB;IACtC,mDAAmD;IACnD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uDAAuD;IACvD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,gBAAgB;IAChC;;;;;;OAMG;IACH,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC;IACxD,+CAA+C;IAC/C,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrD,0BAA0B;IAC1B,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7C,iCAAiC;IACjC,KAAK,IAAI,IAAI,CAAC;CACd;AAOD,wBAAgB,sBAAsB,CAAC,MAAM,GAAE,sBAA2B,GAAG,gBAAgB,CA8B5F;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,uBAAuB,EAAE,OAAO,GAAG,OAAO,CAG/F"}

package/dist/http/login-rate-limit.js

@@ -0,0 +1,84 @@
+/**
+ * Login rate limiting: two buckets per attempt, because neither dimension
+ * covers the other.
+ *
+ *   - **Per-address** bounds one client hammering the form. It is only
+ *     meaningful when the host resolves a real client address. Behind a reverse
+ *     proxy that is not configured to forward one, every request reports the
+ *     socket peer — `127.0.0.1` for all of them — which collapses the whole key
+ *     space into a single bucket: five failed logins from anywhere lock out the
+ *     entire instance, and only a success clears it, which nobody can now
+ *     reach. That failure is completely silent, hence
+ *     {@link addressKeysCollapsed}.
+ *   - **Per-account** bounds a targeted guessing attack, which address limiting
+ *     does not: an attacker spread across many source IPs contends with no
+ *     shared counter at all, leaving password-hash cost as the only real bound
+ *     on online guessing.
+ *
+ * An attempt must clear both and a failure charges both. A success clears the
+ * account bucket and the calling address's — a *different* address that failed
+ * against the same account keeps its own penalty.
+ *
+ * The flow counts failures rather than attempts: `check` gates without spending
+ * budget, `recordFailure` spends, and `clear` forgives. A successful login
+ * therefore costs nothing, so an ordinary user typing one wrong password never
+ * walks toward a lockout.
+ */
+import { createComputeRateLimiter } from '../compute/rate-limit.js';
+/** Loopback in the three spellings a Node server actually reports. */
+const LOOPBACK = new Set(['127.0.0.1', '::1', '::ffff:127.0.0.1']);
+/** Normalized so case tricks (`Alice@` vs `alice@`) share one bucket. */
+function accountKey(email) {
+    return `account:${email.trim().toLowerCase()}`;
+}
+export function createLoginRateLimiter(config = {}) {
+    const windowMs = config.windowMs ?? 15 * 60 * 1000;
+    const byAddress = createComputeRateLimiter({
+        windowMs,
+        maxPerWindow: config.maxPerAddress ?? 5
+    });
+    const byAccount = createComputeRateLimiter({
+        windowMs,
+        maxPerWindow: config.maxPerAccount ?? 20
+    });
+    return {
+        check(address, email) {
+            const address_ = byAddress.peek(address);
+            if (!address_.allowed || !email)
+                return address_;
+            return byAccount.peek(accountKey(email));
+        },
+        recordFailure(address, email) {
+            byAddress.check(address);
+            if (email)
+                byAccount.check(accountKey(email));
+        },
+        clear(address, email) {
+            byAddress.clear(address);
+            if (email)
+                byAccount.clear(accountKey(email));
+        },
+        reset() {
+            byAddress.reset();
+            byAccount.reset();
+        }
+    };
+}
+/**
+ * Whether per-address limiting has degenerated into one shared bucket.
+ *
+ * True when the host reports a loopback address for a request it did not
+ * originate — which means it sits behind a proxy and is reading the socket peer
+ * instead of a forwarded client address. The host decides what to do about it;
+ * warning once at startup is enough, and warning per request is not.
+ *
+ * `addressHeaderConfigured` is the host's answer to "am I reading a forwarded
+ * header at all", since which header and how many hops to trust are deployment
+ * config that no package can resolve for it.
+ */
+export function addressKeysCollapsed(address, addressHeaderConfigured) {
+    if (addressHeaderConfigured)
+        return false;
+    return LOOPBACK.has(address);
+}
+//# sourceMappingURL=login-rate-limit.js.map

package/dist/http/login-rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-rate-limit.js","sourceRoot":"","sources":["../../src/http/login-rate-limit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAGpE,sEAAsE;AACtE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,kBAAkB,CAAC,CAAC,CAAC;AAkCnE,yEAAyE;AACzE,SAAS,UAAU,CAAC,KAAa;IAChC,OAAO,WAAW,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,SAAiC,EAAE;IACzE,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACnD,MAAM,SAAS,GAAG,wBAAwB,CAAC;QAC1C,QAAQ;QACR,YAAY,EAAE,MAAM,CAAC,aAAa,IAAI,CAAC;KACvC,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,wBAAwB,CAAC;QAC1C,QAAQ;QACR,YAAY,EAAE,MAAM,CAAC,aAAa,IAAI,EAAE;KACxC,CAAC,CAAC;IAEH,OAAO;QACN,KAAK,CAAC,OAAO,EAAE,KAAK;YACnB,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzC,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,KAAK;gBAAE,OAAO,QAAQ,CAAC;YACjD,OAAO,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1C,CAAC;QACD,aAAa,CAAC,OAAO,EAAE,KAAK;YAC3B,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACzB,IAAI,KAAK;gBAAE,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/C,CAAC;QACD,KAAK,CAAC,OAAO,EAAE,KAAK;YACnB,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACzB,IAAI,KAAK;gBAAE,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/C,CAAC;QACD,KAAK;YACJ,SAAS,CAAC,KAAK,EAAE,CAAC;YAClB,SAAS,CAAC,KAAK,EAAE,CAAC;QACnB,CAAC;KACD,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe,EAAE,uBAAgC;IACrF,IAAI,uBAAuB;QAAE,OAAO,KAAK,CAAC;IAC1C,OAAO,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC"}

package/dist/notifications/deliver-invite.d.ts

@@ -0,0 +1,27 @@
+import type { AuthUser, IDataProvider, ILogger, INotificationProvider, Invite, RequestContext, UserProfile } from '@selvajs/platform';
+export type InviteDelivery = 'sent' | 'not-configured' | 'failed';
+export interface DeliverInviteInput {
+    ctx: RequestContext;
+    log: ILogger;
+    invite: Invite;
+    acceptUrl: string;
+    /** The admin minting the invite — used only for the "X invited you" line. */
+    actor: {
+        profile?: UserProfile;
+        user?: AuthUser;
+    };
+    orgs: IDataProvider['orgs'];
+    notifications: INotificationProvider;
+    /** Falls back into the org-name slot when the org has no name of its own. */
+    fallbackOrgName: string;
+}
+/**
+ * Mail an invite's accept link, best-effort.
+ *
+ * Shared by the mint and resend routes so they cannot disagree about what the
+ * invitee receives. Swallows every failure: the invite row is already
+ * committed and the caller still holds `acceptUrl` to share by hand, so a dead
+ * SMTP host must not report a valid invite as a failure.
+ */
+export declare function deliverInvite(input: DeliverInviteInput): Promise<InviteDelivery>;
+//# sourceMappingURL=deliver-invite.d.ts.map

package/dist/notifications/deliver-invite.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deliver-invite.d.ts","sourceRoot":"","sources":["../../src/notifications/deliver-invite.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACX,QAAQ,EACR,aAAa,EACb,OAAO,EACP,qBAAqB,EACrB,MAAM,EACN,cAAc,EACd,WAAW,EACX,MAAM,mBAAmB,CAAC;AAG3B,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,gBAAgB,GAAG,QAAQ,CAAC;AAElE,MAAM,WAAW,kBAAkB;IAClC,GAAG,EAAE,cAAc,CAAC;IACpB,GAAG,EAAE,OAAO,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,KAAK,EAAE;QAAE,OAAO,CAAC,EAAE,WAAW,CAAC;QAAC,IAAI,CAAC,EAAE,QAAQ,CAAA;KAAE,CAAC;IAClD,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC5B,aAAa,EAAE,qBAAqB,CAAC;IACrC,6EAA6E;IAC7E,eAAe,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;GAOG;AACH,wBAAsB,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,cAAc,CAAC,CAuBtF"}

package/dist/notifications/deliver-invite.js

@@ -0,0 +1,32 @@
+import { renderInviteEmail } from '@selvajs/notifications';
+/**
+ * Mail an invite's accept link, best-effort.
+ *
+ * Shared by the mint and resend routes so they cannot disagree about what the
+ * invitee receives. Swallows every failure: the invite row is already
+ * committed and the caller still holds `acceptUrl` to share by hand, so a dead
+ * SMTP host must not report a valid invite as a failure.
+ */
+export async function deliverInvite(input) {
+    const { ctx, log, invite, acceptUrl, actor, orgs, notifications, fallbackOrgName } = input;
+    try {
+        const org = await orgs.getOrg(ctx, invite.orgId);
+        const { status } = await notifications.send(renderInviteEmail({
+            to: invite.email,
+            acceptUrl,
+            orgName: org?.name ?? fallbackOrgName,
+            invitedBy: actor.profile?.displayName || actor.user?.email,
+            expiresAt: invite.expiresAt
+        }), log);
+        return status;
+    }
+    catch (err) {
+        log.warn('Invite mail could not be prepared', {
+            component: 'Invites',
+            inviteId: invite.id,
+            reason: err instanceof Error ? err.message : String(err)
+        });
+        return 'failed';
+    }
+}
+//# sourceMappingURL=deliver-invite.js.map

package/dist/notifications/deliver-invite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deliver-invite.js","sourceRoot":"","sources":["../../src/notifications/deliver-invite.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAiB3D;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAyB;IAC5D,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,eAAe,EAAE,GAAG,KAAK,CAAC;IAC3F,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,IAAI,CAC1C,iBAAiB,CAAC;YACjB,EAAE,EAAE,MAAM,CAAC,KAAK;YAChB,SAAS;YACT,OAAO,EAAE,GAAG,EAAE,IAAI,IAAI,eAAe;YACrC,SAAS,EAAE,KAAK,CAAC,OAAO,EAAE,WAAW,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK;YAC1D,SAAS,EAAE,MAAM,CAAC,SAAS;SAC3B,CAAC,EACF,GAAG,CACH,CAAC;QACF,OAAO,MAAM,CAAC;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,GAAG,CAAC,IAAI,CAAC,mCAAmC,EAAE;YAC7C,SAAS,EAAE,SAAS;YACpB,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACxD,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IACjB,CAAC;AACF,CAAC"}

package/dist/notifications/index.d.ts

@@ -1,3 +1,4 @@
 export { SmtpNotificationProvider } from './smtp-provider.js';
 export { readSmtpConfig, type SmtpConfig, type SmtpEnv } from './smtp-config.js';
+export { deliverInvite, type DeliverInviteInput, type InviteDelivery } from './deliver-invite.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/notifications/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/notifications/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,KAAK,UAAU,EAAE,KAAK,OAAO,EAAE,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/notifications/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,KAAK,UAAU,EAAE,KAAK,OAAO,EAAE,MAAM,kBAAkB,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,KAAK,kBAAkB,EAAE,KAAK,cAAc,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/notifications/index.js

@@ -1,3 +1,4 @@
 export { SmtpNotificationProvider } from './smtp-provider.js';
 export { readSmtpConfig } from './smtp-config.js';
+export { deliverInvite } from './deliver-invite.js';
 //# sourceMappingURL=index.js.map

package/dist/notifications/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/notifications/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAiC,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/notifications/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAiC,MAAM,kBAAkB,CAAC;AACjF,OAAO,EAAE,aAAa,EAAgD,MAAM,qBAAqB,CAAC"}

package/dist/organizations/index.d.ts

@@ -0,0 +1,3 @@
+export { OrgAssetService } from './org-asset-service.js';
+export { listAllOrgMembers } from './list-all-members.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/organizations/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/organizations/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/organizations/index.js

@@ -0,0 +1,5 @@
+// Org-level domain services — writes that span more than one provider and so
+// belong to neither store alone.
+export { OrgAssetService } from './org-asset-service.js';
+export { listAllOrgMembers } from './list-all-members.js';
+//# sourceMappingURL=index.js.map

package/dist/organizations/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/organizations/index.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,iCAAiC;AAEjC,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/organizations/list-all-members.d.ts

@@ -0,0 +1,10 @@
+import type { ILogger, IOrgStore, OrgMember } from '@selvajs/platform';
+/**
+ * Drain every membership page for an org. The admin users pages merge
+ * per-user org permissions into these rows; a truncated list would render
+ * those users as permissionless, and the permission-toggle UI builds its
+ * PATCH payload from the displayed state — so truncation here could silently
+ * wipe a user's org permissions on the next edit.
+ */
+export declare function listAllOrgMembers(orgs: IOrgStore, orgId: string, log?: ILogger): Promise<OrgMember[]>;
+//# sourceMappingURL=list-all-members.d.ts.map

package/dist/organizations/list-all-members.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-all-members.d.ts","sourceRoot":"","sources":["../../src/organizations/list-all-members.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAQvE;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACtC,IAAI,EAAE,SAAS,EACf,KAAK,EAAE,MAAM,EACb,GAAG,CAAC,EAAE,OAAO,GACX,OAAO,CAAC,SAAS,EAAE,CAAC,CAqBtB"}

package/dist/organizations/list-all-members.js

@@ -0,0 +1,36 @@
+import { SYSTEM_CONTEXT } from '@selvajs/platform';
+const PAGE_LIMIT = 200;
+// Runaway guard against an adapter that returns a non-advancing cursor —
+// 100 pages = 20k members, far past any real org on this product.
+const MAX_PAGES = 100;
+/**
+ * Drain every membership page for an org. The admin users pages merge
+ * per-user org permissions into these rows; a truncated list would render
+ * those users as permissionless, and the permission-toggle UI builds its
+ * PATCH payload from the displayed state — so truncation here could silently
+ * wipe a user's org permissions on the next edit.
+ */
+export async function listAllOrgMembers(orgs, orgId, log) {
+    const members = [];
+    let cursor;
+    for (let page = 0; page < MAX_PAGES; page++) {
+        const result = await orgs.listOrgMembers(SYSTEM_CONTEXT, orgId, {
+            limit: PAGE_LIMIT,
+            cursor
+        });
+        members.push(...result.items);
+        cursor = result.nextCursor;
+        if (!cursor)
+            return members;
+    }
+    // Injected rather than resolved: hitting the cap is the one outcome a caller
+    // must be able to see, and a package that reached for a host's logger could
+    // not be used by a host that has a different one.
+    log?.warn('listAllOrgMembers hit the page cap — member list may be incomplete', {
+        component: 'admin',
+        orgId,
+        pages: MAX_PAGES
+    });
+    return members;
+}
+//# sourceMappingURL=list-all-members.js.map

package/dist/organizations/list-all-members.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-all-members.js","sourceRoot":"","sources":["../../src/organizations/list-all-members.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,MAAM,UAAU,GAAG,GAAG,CAAC;AACvB,yEAAyE;AACzE,kEAAkE;AAClE,MAAM,SAAS,GAAG,GAAG,CAAC;AAEtB;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACtC,IAAe,EACf,KAAa,EACb,GAAa;IAEb,MAAM,OAAO,GAAgB,EAAE,CAAC;IAChC,IAAI,MAA0B,CAAC;IAC/B,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,cAAc,EAAE,KAAK,EAAE;YAC/D,KAAK,EAAE,UAAU;YACjB,MAAM;SACN,CAAC,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC;QAC3B,IAAI,CAAC,MAAM;YAAE,OAAO,OAAO,CAAC;IAC7B,CAAC;IACD,6EAA6E;IAC7E,4EAA4E;IAC5E,kDAAkD;IAClD,GAAG,EAAE,IAAI,CAAC,oEAAoE,EAAE;QAC/E,SAAS,EAAE,OAAO;QAClB,KAAK;QACL,KAAK,EAAE,SAAS;KAChB,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AAChB,CAAC"}