@selvajs/server 1.5.0-beta.9 → 2.0.0-beta.16

package/dist/handlers/oauthConsent.d.ts

@@ -1,10 +1,10 @@
 /**
- * The server half of an OAuth consent screen: which access levels and orgs the
- * user may grant, and minting the key in the org they picked.
+ * The server half of an OAuth consent screen: which access levels the user may
+ * grant, and minting the key.
  *
- * A key is bound to one org at mint. The user's session acts in one org too,
- * but they may belong to several, so consent builds a context pinned to the
- * picked org rather than trusting the session's.
+ * A key is bound to one org at mint, and consent mints only in the session's
+ * acting org: the token page lists and revokes keys there alone, so a key
+ * minted elsewhere would be live with no way to see or revoke it.
  */
 import { type ApiRequest } from '../api/index.js';
 import { type ConsentChoice, type OAuthScope } from '../oauth/index.js';
@@ -14,24 +14,36 @@ export interface ConsentOrg {
     name: string;
 }
 /**
- * The orgs the signed-in user may grant a key with `scopes` in: those they
- * belong to and may hold such a key in.
+ * The orgs the signed-in user may grant a key with `scopes` in: their acting
+ * org, when they may hold such a key there. At most one.
  */
 export declare function consentOrgs(req: ApiRequest, scopes: readonly string[]): Promise<ConsentOrg[]>;
-export interface ConsentOffer {
-    /** Narrowest first. Only levels the user may hold in at least one of their orgs. */
-    choices: ConsentChoice[];
-    /** Where the widest choice, the one the page preselects, may be granted. */
+export interface ConsentLevel {
+    choice: ConsentChoice;
+    /** Where this level may be granted. Never empty. */
     orgs: ConsentOrg[];
 }
+export interface ConsentOffer {
+    /**
+     * Narrowest first. Only levels the user may hold in at least one of their
+     * orgs; each carries its own orgs, since a narrower level can reach more.
+     */
+    levels: ConsentLevel[];
+}
 /**
  * What a consent page offers for a request's scopes, and what its approval
  * accepts. Null when the user may grant none of it anywhere.
  */
 export declare function consentOffer(req: ApiRequest, scopes: readonly OAuthScope[]): Promise<ConsentOffer | null>;
 /**
- * Mint the key a consent grants, acting in `orgId`. An org the user doesn't
- * belong to is refused here, whatever the form said.
+ * Mint the key a consent grants, in `orgId`. Anything but the acting org is
+ * refused here, whatever the form said.
  */
 export declare function mintConsentToken(req: ApiRequest, orgId: string, input: MintApiTokenInput): Promise<MintedApiToken>;
+/**
+ * Revoke a consent key whose code was never redeemed, so an abandoned sign-in
+ * doesn't leave a live key nobody holds. A used key is kept: its code may have
+ * been redeemed on another replica.
+ */
+export declare function revokeUnredeemedConsentToken(req: ApiRequest, tokenId: string): Promise<void>;
 //# sourceMappingURL=oauthConsent.d.ts.map

package/dist/handlers/oauthConsent.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauthConsent.d.ts","sourceRoot":"","sources":["../../src/handlers/oauthConsent.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAyC,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAGzF,OAAO,EAGN,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAGN,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,MAAM,gBAAgB,CAAC;AAExB,MAAM,WAAW,UAAU;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACb;AAeD;;;GAGG;AACH,wBAAsB,WAAW,CAChC,GAAG,EAAE,UAAU,EACf,MAAM,EAAE,SAAS,MAAM,EAAE,GACvB,OAAO,CAAC,UAAU,EAAE,CAAC,CAWvB;AAED,MAAM,WAAW,YAAY;IAC5B,oFAAoF;IACpF,OAAO,EAAE,aAAa,EAAE,CAAC;IACzB,4EAA4E;IAC5E,IAAI,EAAE,UAAU,EAAE,CAAC;CACnB;AAED;;;GAGG;AACH,wBAAsB,YAAY,CACjC,GAAG,EAAE,UAAU,EACf,MAAM,EAAE,SAAS,UAAU,EAAE,GAC3B,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAU9B;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CACrC,GAAG,EAAE,UAAU,EACf,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,iBAAiB,GACtB,OAAO,CAAC,cAAc,CAAC,CASzB"}
+{"version":3,"file":"oauthConsent.d.ts","sourceRoot":"","sources":["../../src/handlers/oauthConsent.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAyC,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAGzF,OAAO,EAGN,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAGN,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,MAAM,gBAAgB,CAAC;AAExB,MAAM,WAAW,UAAU;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACb;AAeD;;;GAGG;AACH,wBAAsB,WAAW,CAChC,GAAG,EAAE,UAAU,EACf,MAAM,EAAE,SAAS,MAAM,EAAE,GACvB,OAAO,CAAC,UAAU,EAAE,CAAC,CAavB;AAED,MAAM,WAAW,YAAY;IAC5B,MAAM,EAAE,aAAa,CAAC;IACtB,oDAAoD;IACpD,IAAI,EAAE,UAAU,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC5B;;;OAGG;IACH,MAAM,EAAE,YAAY,EAAE,CAAC;CACvB;AAED;;;GAGG;AACH,wBAAsB,YAAY,CACjC,GAAG,EAAE,UAAU,EACf,MAAM,EAAE,SAAS,UAAU,EAAE,GAC3B,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAS9B;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CACrC,GAAG,EAAE,UAAU,EACf,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,iBAAiB,GACtB,OAAO,CAAC,cAAc,CAAC,CAgBzB;AAED;;;;GAIG;AACH,wBAAsB,4BAA4B,CACjD,GAAG,EAAE,UAAU,EACf,OAAO,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAOf"}

package/dist/handlers/oauthConsent.js

@@ -1,10 +1,10 @@
 /**
- * The server half of an OAuth consent screen: which access levels and orgs the
- * user may grant, and minting the key in the org they picked.
+ * The server half of an OAuth consent screen: which access levels the user may
+ * grant, and minting the key.
  *
- * A key is bound to one org at mint. The user's session acts in one org too,
- * but they may belong to several, so consent builds a context pinned to the
- * picked org rather than trusting the session's.
+ * A key is bound to one org at mint, and consent mints only in the session's
+ * acting org: the token page lists and revokes keys there alone, so a key
+ * minted elsewhere would be live with no way to see or revoke it.
  */
 import { apiError, ApiErrorCode, requireCaller } from '../api/index.js';
 import { buildRequestContext } from '../http/request-context.js';
@@ -21,12 +21,12 @@ async function contextIn(req, member) {
     return { ...pinned, adapterContext: ctx.adapterContext };
 }
 /**
- * The orgs the signed-in user may grant a key with `scopes` in: those they
- * belong to and may hold such a key in.
+ * The orgs the signed-in user may grant a key with `scopes` in: their acting
+ * org, when they may hold such a key there. At most one.
  */
 export async function consentOrgs(req, scopes) {
     const { ctx } = requireCaller(req);
-    const memberships = await listUserMemberships(req.deps.orgs, ctx.userId);
+    const memberships = (await listUserMemberships(req.deps.orgs, ctx.userId)).filter(({ org }) => org.id === ctx.actingOrgId);
     const allowed = await Promise.all(memberships.map(async ({ member }) => mayHoldApiTokens(req.deps, await contextIn(req, member), scopes)));
     return memberships
         .filter((_, i) => allowed[i])
@@ -42,16 +42,17 @@ export async function consentOffer(req, scopes) {
         orgs: await consentOrgs(req, apiScopesFor(choice.scopes))
     })));
     const offered = levels.filter((l) => l.orgs.length > 0);
-    if (!offered.length)
-        return null;
-    return { choices: offered.map((l) => l.choice), orgs: offered[offered.length - 1].orgs };
+    return offered.length ? { levels: offered } : null;
 }
 /**
- * Mint the key a consent grants, acting in `orgId`. An org the user doesn't
- * belong to is refused here, whatever the form said.
+ * Mint the key a consent grants, in `orgId`. Anything but the acting org is
+ * refused here, whatever the form said.
  */
 export async function mintConsentToken(req, orgId, input) {
     const { ctx } = requireCaller(req);
+    if (orgId !== ctx.actingOrgId) {
+        apiError(403, ApiErrorCode.FORBIDDEN, 'Apps can only be connected to your current organization.');
+    }
     // Matched against the user's own memberships, so the posted id never reaches a store query.
     const memberships = await listUserMemberships(req.deps.orgs, ctx.userId);
     const picked = memberships.find(({ org }) => org.id === orgId);
@@ -60,4 +61,19 @@ export async function mintConsentToken(req, orgId, input) {
     }
     return mintApiToken({ ...req, ctx: await contextIn(req, picked.member) }, input);
 }
+/**
+ * Revoke a consent key whose code was never redeemed, so an abandoned sign-in
+ * doesn't leave a live key nobody holds. A used key is kept: its code may have
+ * been redeemed on another replica.
+ */
+export async function revokeUnredeemedConsentToken(req, tokenId) {
+    const store = req.deps.data.apiTokens;
+    if (!store)
+        return;
+    const { ctx } = requireCaller(req);
+    const token = await store.get(ctx, tokenId);
+    if (!token || token.revokedAt || token.lastUsedAt)
+        return;
+    await store.revoke(ctx, tokenId, 'owner');
+}
 //# sourceMappingURL=oauthConsent.js.map

package/dist/handlers/oauthConsent.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauthConsent.js","sourceRoot":"","sources":["../../src/handlers/oauthConsent.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAmB,MAAM,iBAAiB,CAAC;AACzF,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAC3E,OAAO,EACN,YAAY,EACZ,cAAc,EAGd,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACN,gBAAgB,EAChB,YAAY,EAGZ,MAAM,gBAAgB,CAAC;AAOxB,KAAK,UAAU,SAAS,CAAC,GAAe,EAAE,MAAiB;IAC1D,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QAClB,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,2CAA2C,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,mBAAmB,CACvC,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,CAAC,mBAAmB,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EACxF,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CACvB,CAAC;IACF,yEAAyE;IACzE,OAAO,EAAE,GAAG,MAAM,EAAE,cAAc,EAAE,GAAG,CAAC,cAAc,EAAE,CAAC;AAC1D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAChC,GAAe,EACf,MAAyB;IAEzB,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,WAAW,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CACpC,gBAAgB,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAChE,CACD,CAAC;IACF,OAAO,WAAW;SAChB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;SAC5B,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AACtD,CAAC;AASD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CACjC,GAAe,EACf,MAA6B;IAE7B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,cAAc,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7C,MAAM;QACN,IAAI,EAAE,MAAM,WAAW,CAAC,GAAG,EAAE,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;KACzD,CAAC,CAAC,CACH,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACxD,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACjC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC;AAC3F,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACrC,GAAe,EACf,KAAa,EACb,KAAwB;IAExB,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACnC,4FAA4F;IAC5F,MAAM,WAAW,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACzE,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC;IAC/D,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,2CAA2C,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,YAAY,CAAC,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,MAAM,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;AAClF,CAAC"}
+{"version":3,"file":"oauthConsent.js","sourceRoot":"","sources":["../../src/handlers/oauthConsent.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAmB,MAAM,iBAAiB,CAAC;AACzF,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAC3E,OAAO,EACN,YAAY,EACZ,cAAc,EAGd,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACN,gBAAgB,EAChB,YAAY,EAGZ,MAAM,gBAAgB,CAAC;AAOxB,KAAK,UAAU,SAAS,CAAC,GAAe,EAAE,MAAiB;IAC1D,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QAClB,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,2CAA2C,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,mBAAmB,CACvC,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,CAAC,mBAAmB,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EACxF,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CACvB,CAAC;IACF,yEAAyE;IACzE,OAAO,EAAE,GAAG,MAAM,EAAE,cAAc,EAAE,GAAG,CAAC,cAAc,EAAE,CAAC;AAC1D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAChC,GAAe,EACf,MAAyB;IAEzB,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,WAAW,GAAG,CAAC,MAAM,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAChF,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,WAAW,CACvC,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CACpC,gBAAgB,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAChE,CACD,CAAC;IACF,OAAO,WAAW;SAChB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;SAC5B,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AACtD,CAAC;AAgBD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CACjC,GAAe,EACf,MAA6B;IAE7B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,cAAc,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7C,MAAM;QACN,IAAI,EAAE,MAAM,WAAW,CAAC,GAAG,EAAE,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;KACzD,CAAC,CAAC,CACH,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACxD,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACpD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACrC,GAAe,EACf,KAAa,EACb,KAAwB;IAExB,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,KAAK,KAAK,GAAG,CAAC,WAAW,EAAE,CAAC;QAC/B,QAAQ,CACP,GAAG,EACH,YAAY,CAAC,SAAS,EACtB,0DAA0D,CAC1D,CAAC;IACH,CAAC;IACD,4FAA4F;IAC5F,MAAM,WAAW,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACzE,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC;IAC/D,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,2CAA2C,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,YAAY,CAAC,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,MAAM,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;AAClF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CACjD,GAAe,EACf,OAAe;IAEf,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;IACtC,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC5C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,UAAU;QAAE,OAAO;IAC1D,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAC3C,CAAC"}

package/dist/handlers/orgAssets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"orgAssets.d.ts","sourceRoot":"","sources":["../../src/handlers/orgAssets.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAoD,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAmBpG,eAAO,MAAM,cAAc,EAAE,UAqB5B,CAAC;AAEF,eAAO,MAAM,cAAc,EAAE,UAO5B,CAAC"}
+{"version":3,"file":"orgAssets.d.ts","sourceRoot":"","sources":["../../src/handlers/orgAssets.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAMN,KAAK,UAAU,EACf,MAAM,iBAAiB,CAAC;AAmBzB,eAAO,MAAM,cAAc,EAAE,UAqB5B,CAAC;AAEF,eAAO,MAAM,cAAc,EAAE,UAO5B,CAAC"}

package/dist/handlers/orgAssets.js

@@ -7,7 +7,7 @@
  * surface: no vector blob is ever stored or served. The allowlist below is the
  * HTTP gate; the rasterization is the security control.
  */
-import { apiError, ApiErrorCode, noContent, requireUpload } from '../api/index.js';
+import { apiError, ApiErrorCode, noContent, readForm, requireUpload } from '../api/index.js';
 import { OrgAssetKindSchema } from '@selvajs/platform';
 import { requireManageOrgMembers, requireActingOrg } from '../access/index.js';
 import { orgAssetService } from './services.js';
@@ -32,7 +32,7 @@ export const uploadOrgAsset = async (req) => {
     const org = await req.deps.orgs.getOrg(ctx, orgId);
     if (!org)
         apiError(404, ApiErrorCode.NOT_FOUND, 'Organization not found');
-    const { file } = requireUpload(await req.request.formData(), 'image', {
+    const { file } = requireUpload(await readForm(req.request), 'image', {
         maxBytes: req.deps.uploadLimits.maxImageFileSize,
         contentTypes: {
             allowed: ALLOWED_CONTENT_TYPES,

package/dist/handlers/orgAssets.js.map

@@ -1 +1 @@
-{"version":3,"file":"orgAssets.js","sourceRoot":"","sources":["../../src/handlers/orgAssets.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,aAAa,EAAmB,MAAM,iBAAiB,CAAC;AACpG,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC/E,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACrC,WAAW;IACX,YAAY;IACZ,YAAY;IACZ,WAAW;IACX,eAAe;CACf,CAAC,CAAC;AAEH,SAAS,SAAS,CAAC,MAAyB;IAC3C,MAAM,IAAI,GAAG,kBAAkB,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACvD,IAAI,CAAC,IAAI,CAAC,OAAO;QAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,uBAAuB,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;IAChG,OAAO,IAAI,CAAC,IAAI,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACvD,uBAAuB,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAE/D,oEAAoE;IACpE,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACnD,IAAI,CAAC,GAAG;QAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,wBAAwB,CAAC,CAAC;IAE1E,MAAM,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE;QACrE,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,gBAAgB;QAChD,YAAY,EAAE;YACb,OAAO,EAAE,qBAAqB;YAC9B,OAAO,EAAE,2DAA2D;SACpE;QACD,KAAK,EAAE,OAAO;KACd,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1F,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC;AAChC,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACvD,uBAAuB,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAE/D,MAAM,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IAC9D,OAAO,SAAS,EAAE,CAAC;AACpB,CAAC,CAAC"}
+{"version":3,"file":"orgAssets.js","sourceRoot":"","sources":["../../src/handlers/orgAssets.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACN,QAAQ,EACR,YAAY,EACZ,SAAS,EACT,QAAQ,EACR,aAAa,EAEb,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC/E,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACrC,WAAW;IACX,YAAY;IACZ,YAAY;IACZ,WAAW;IACX,eAAe;CACf,CAAC,CAAC;AAEH,SAAS,SAAS,CAAC,MAAyB;IAC3C,MAAM,IAAI,GAAG,kBAAkB,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACvD,IAAI,CAAC,IAAI,CAAC,OAAO;QAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,uBAAuB,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;IAChG,OAAO,IAAI,CAAC,IAAI,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACvD,uBAAuB,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAE/D,oEAAoE;IACpE,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACnD,IAAI,CAAC,GAAG;QAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,wBAAwB,CAAC,CAAC;IAE1E,MAAM,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE;QACpE,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,gBAAgB;QAChD,YAAY,EAAE;YACb,OAAO,EAAE,qBAAqB;YAC9B,OAAO,EAAE,2DAA2D;SACpE;QACD,KAAK,EAAE,OAAO;KACd,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1F,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC;AAChC,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACvD,uBAAuB,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAE/D,MAAM,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IAC9D,OAAO,SAAS,EAAE,CAAC;AACpB,CAAC,CAAC"}

package/dist/handlers/orgCompute.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"orgCompute.d.ts","sourceRoot":"","sources":["../../src/handlers/orgCompute.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAWH,OAAO,KAAK,EAAE,UAAU,EAAc,MAAM,iBAAiB,CAAC;AA0B9D,eAAO,MAAM,aAAa,EAAE,UAiC3B,CAAC;AAEF,eAAO,MAAM,gBAAgB,EAAE,UA0D9B,CAAC"}
+{"version":3,"file":"orgCompute.d.ts","sourceRoot":"","sources":["../../src/handlers/orgCompute.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAWH,OAAO,KAAK,EAAE,UAAU,EAAc,MAAM,iBAAiB,CAAC;AA2B9D,eAAO,MAAM,aAAa,EAAE,UAiC3B,CAAC;AAEF,eAAO,MAAM,gBAAgB,EAAE,UA4D9B,CAAC"}

package/dist/handlers/orgCompute.js

@@ -13,7 +13,7 @@
 import { apiError, ApiErrorCode, noContent, OrgComputePatchBodySchema, OrgComputeResponseSchema, parseBody, shaped } from '../api/index.js';
 import { isOrgServer, isPlatformServer, serversVisibleTo } from '@selvajs/platform';
 import { requireManageOrgCompute, requireActingOrg } from '../access/index.js';
-import { evictChangedServers, validateIncomingServers, resolveApiKey, storedKeysById } from '../compute/index.js';
+import { assertStoredKeysReadable, evictChangedServers, validateIncomingServers, resolveApiKey, storedKeysById } from '../compute/index.js';
 function requireFlag(req) {
     if (!req.deps.flag('ALLOW_ORG_COMPUTE_OVERRIDE')) {
         apiError(403, ApiErrorCode.FORBIDDEN, 'Per-org compute override is disabled on this instance (ALLOW_ORG_COMPUTE_OVERRIDE).');
@@ -59,7 +59,9 @@ export const updateOrgCompute = async (req) => {
     const provider = req.deps.computeServer;
     // Every key is needed: an unchanged server keeps its stored key across the write.
     const existing = await provider.getConfig(ctx, { includeApiKeys: true });
-    const storedKeys = storedKeysById(existing.servers.filter((s) => isOrgServer(s) && s.ownerOrgId === orgId));
+    const orgServers = existing.servers.filter((s) => isOrgServer(s) && s.ownerOrgId === orgId);
+    assertStoredKeysReadable(incoming.servers, orgServers);
+    const storedKeys = storedKeysById(orgServers);
     const next = incoming.servers.map((s) => ({
         id: s.id,
         scope: 'org',

package/dist/handlers/orgCompute.js.map

@@ -1 +1 @@
-{"version":3,"file":"orgCompute.js","sourceRoot":"","sources":["../../src/handlers/orgCompute.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACN,QAAQ,EACR,YAAY,EACZ,SAAS,EACT,yBAAyB,EACzB,wBAAwB,EACxB,SAAS,EACT,MAAM,EACN,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACN,WAAW,EACX,gBAAgB,EAChB,gBAAgB,EAEhB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC/E,OAAO,EACN,mBAAmB,EACnB,uBAAuB,EACvB,aAAa,EACb,cAAc,EAEd,MAAM,qBAAqB,CAAC;AAE7B,SAAS,WAAW,CAAC,GAAe;IACnC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,4BAA4B,CAAC,EAAE,CAAC;QAClD,QAAQ,CACP,GAAG,EACH,YAAY,CAAC,SAAS,EACtB,qFAAqF,CACrF,CAAC;IACH,CAAC;AACF,CAAC;AAED,MAAM,CAAC,MAAM,aAAa,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACtD,WAAW,CAAC,GAAG,CAAC,CAAC;IACjB,uBAAuB,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAE/D,wEAAwE;IACxE,+DAA+D;IAC/D,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;IAEpF,0EAA0E;IAC1E,kEAAkE;IAClE,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO;SAC1B,MAAM,CAAC,CAAC,CAAC,EAAyB,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,KAAK,KAAK,CAAC;SAC9E,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IAEnD,uEAAuE;IACvE,2CAA2C;IAC3C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1C,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,UAAoB,CAAC,CAAC,CAAE,KAAe;QACtE,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,UAAU,EAAE,CAAC,CAAC,UAAU;KACxB,CAAC,CAAC,CAAC;IAEJ,OAAO,MAAM,CAAC,wBAAwB,EAAE;QACvC,OAAO,EAAE,KAAK;QACd,eAAe,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,IAAI,IAAI;QACpD,qBAAqB,EAAE,MAAM,CAAC,eAAe,IAAI,IAAI;QACrD,OAAO;KACP,CAAC,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACzD,WAAW,CAAC,GAAG,CAAC,CAAC;IACjB,uBAAuB,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAE/D,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,yBAAyB,CAAC,CAAC;IACzE,yEAAyE;IACzE,uBAAuB,CAAC,QAAQ,CAAC,OAA+B,CAAC,CAAC;IAElE,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC;IACxC,kFAAkF;IAClF,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;IACzE,MAAM,UAAU,GAAG,cAAc,CAChC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAyB,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,KAAK,KAAK,CAAC,CAC/F,CAAC;IAEF,MAAM,IAAI,GAAuB,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7D,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,KAAK,EAAE,KAAK;QACZ,UAAU,EAAE,KAAK;QACjB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;KACrD,CAAC,CAAC,CAAC;IAEJ,wEAAwE;IACxE,iEAAiE;IACjE,mDAAmD;IACnD,IAAI,OAAO,QAAQ,CAAC,eAAe,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,SAAS,GAAG;YACjB,OAAO,EAAE;gBACR,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,KAAK,KAAK,CAAC,CAAC;gBAC9E,GAAG,IAAI;aACP;YACD,eAAe,EAAE,QAAQ,CAAC,eAAe;YACzC,WAAW,EAAE,QAAQ,CAAC,WAAW;SACjC,CAAC;QACF,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAChF,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YAC/C,QAAQ,CACP,GAAG,EACH,YAAY,CAAC,iBAAiB,EAC9B,sEAAsE,CACtE,CAAC;QACH,CAAC;IACF,CAAC;IAED,MAAM,QAAQ,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,eAAe,CAAC,CAAC;IAC1E,uEAAuE;IACvE,gEAAgE;IAChE,mBAAmB,CAClB,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,KAAK,KAAK,CAAC,EACxE,IAAI,EACJ,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAC3B,CAAC;IACF,OAAO,SAAS,EAAE,CAAC;AACpB,CAAC,CAAC"}
+{"version":3,"file":"orgCompute.js","sourceRoot":"","sources":["../../src/handlers/orgCompute.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACN,QAAQ,EACR,YAAY,EACZ,SAAS,EACT,yBAAyB,EACzB,wBAAwB,EACxB,SAAS,EACT,MAAM,EACN,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACN,WAAW,EACX,gBAAgB,EAChB,gBAAgB,EAEhB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC/E,OAAO,EACN,wBAAwB,EACxB,mBAAmB,EACnB,uBAAuB,EACvB,aAAa,EACb,cAAc,EAEd,MAAM,qBAAqB,CAAC;AAE7B,SAAS,WAAW,CAAC,GAAe;IACnC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,4BAA4B,CAAC,EAAE,CAAC;QAClD,QAAQ,CACP,GAAG,EACH,YAAY,CAAC,SAAS,EACtB,qFAAqF,CACrF,CAAC;IACH,CAAC;AACF,CAAC;AAED,MAAM,CAAC,MAAM,aAAa,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACtD,WAAW,CAAC,GAAG,CAAC,CAAC;IACjB,uBAAuB,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAE/D,wEAAwE;IACxE,+DAA+D;IAC/D,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;IAEpF,0EAA0E;IAC1E,kEAAkE;IAClE,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO;SAC1B,MAAM,CAAC,CAAC,CAAC,EAAyB,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,KAAK,KAAK,CAAC;SAC9E,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IAEnD,uEAAuE;IACvE,2CAA2C;IAC3C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1C,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,UAAoB,CAAC,CAAC,CAAE,KAAe;QACtE,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,UAAU,EAAE,CAAC,CAAC,UAAU;KACxB,CAAC,CAAC,CAAC;IAEJ,OAAO,MAAM,CAAC,wBAAwB,EAAE;QACvC,OAAO,EAAE,KAAK;QACd,eAAe,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,IAAI,IAAI;QACpD,qBAAqB,EAAE,MAAM,CAAC,eAAe,IAAI,IAAI;QACrD,OAAO;KACP,CAAC,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACzD,WAAW,CAAC,GAAG,CAAC,CAAC;IACjB,uBAAuB,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAE/D,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,yBAAyB,CAAC,CAAC;IACzE,yEAAyE;IACzE,uBAAuB,CAAC,QAAQ,CAAC,OAA+B,CAAC,CAAC;IAElE,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC;IACxC,kFAAkF;IAClF,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;IACzE,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CACzC,CAAC,CAAC,EAAyB,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,KAAK,KAAK,CACtE,CAAC;IACF,wBAAwB,CAAC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;IAE9C,MAAM,IAAI,GAAuB,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7D,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,KAAK,EAAE,KAAK;QACZ,UAAU,EAAE,KAAK;QACjB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;KACrD,CAAC,CAAC,CAAC;IAEJ,wEAAwE;IACxE,iEAAiE;IACjE,mDAAmD;IACnD,IAAI,OAAO,QAAQ,CAAC,eAAe,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,SAAS,GAAG;YACjB,OAAO,EAAE;gBACR,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,KAAK,KAAK,CAAC,CAAC;gBAC9E,GAAG,IAAI;aACP;YACD,eAAe,EAAE,QAAQ,CAAC,eAAe;YACzC,WAAW,EAAE,QAAQ,CAAC,WAAW;SACjC,CAAC;QACF,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAChF,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YAC/C,QAAQ,CACP,GAAG,EACH,YAAY,CAAC,iBAAiB,EAC9B,sEAAsE,CACtE,CAAC;QACH,CAAC;IACF,CAAC;IAED,MAAM,QAAQ,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,eAAe,CAAC,CAAC;IAC1E,uEAAuE;IACvE,gEAAgE;IAChE,mBAAmB,CAClB,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,KAAK,KAAK,CAAC,EACxE,IAAI,EACJ,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAC3B,CAAC;IACF,OAAO,SAAS,EAAE,CAAC;AACpB,CAAC,CAAC"}

package/dist/handlers/orgMembers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"orgMembers.d.ts","sourceRoot":"","sources":["../../src/handlers/orgMembers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAUH,OAAO,KAAK,EAAE,UAAU,EAAc,MAAM,iBAAiB,CAAC;AAgG9D;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,EAAE,UA8D7B,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,eAAe,EAAE,UA6E7B,CAAC"}
+{"version":3,"file":"orgMembers.d.ts","sourceRoot":"","sources":["../../src/handlers/orgMembers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAUH,OAAO,KAAK,EAAE,UAAU,EAAc,MAAM,iBAAiB,CAAC;AAqG9D;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,EAAE,UA6E7B,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,eAAe,EAAE,UA+E7B,CAAC"}

package/dist/handlers/orgMembers.js

@@ -11,9 +11,10 @@
  * demoting them does.
  */
 import { apiError, ApiErrorCode, noContent, parseBody, requireParams, UpdateOrgMemberBodySchema } from '../api/index.js';
-import { MEMBER_ASSIGNABLE_PERMISSIONS, ALL_ORG_PERMISSIONS, actorOf, canChangeOrgRole } from '@selvajs/platform';
+import { MEMBER_ASSIGNABLE_PERMISSIONS, ALL_ORG_PERMISSIONS, actorOf, canChangeOrgRole, SYSTEM_CONTEXT } from '@selvajs/platform';
 import { requireManageOrgMembers, requireActingOrg } from '../access/index.js';
 import { revokeUserApiTokens } from './apiTokens.js';
+import { serializeOwnerChanges } from './ownerChanges.js';
 const ROSTER_PAGE_LIMIT = 200;
 // Runaway guard against an adapter returning a non-advancing cursor. Matches
 // `listAllOrgMembers`; 100 pages is 20k members, past any real org here.
@@ -68,11 +69,15 @@ async function hasAnotherOwner(req, ctx, orgId, exceptUserId) {
  *
  * MUST be called before the removal — afterwards the rows it reads are gone.
  */
-async function findProjectsLosingSoleOwner(req, ctx, orgId, userId) {
+async function findProjectsLosingSoleOwner(req, orgId, userId) {
+    // As system: RLS hides private projects from the acting admin, and those are the
+    // likeliest to lose their only owner.
     const projects = req.deps.projects;
-    const orgProjects = await projects.listProjects(ctx, orgId, { limit: ROSTER_PAGE_LIMIT });
+    const orgProjects = await projects.listProjects(SYSTEM_CONTEXT, orgId, {
+        limit: ROSTER_PAGE_LIMIT
+    });
     const checks = await Promise.all(orgProjects.items.map(async (project) => {
-        const members = await projects.listProjectMembers(ctx, project.id, {
+        const members = await projects.listProjectMembers(SYSTEM_CONTEXT, project.id, {
             limit: ROSTER_PAGE_LIMIT
         });
         const owners = members.items.filter((m) => m.role === 'owner' && !m.deletedAt);
@@ -96,42 +101,54 @@ export const updateOrgMember = async (req) => {
     const { ctx, orgId } = requireActingOrg(req, req.params.orgId);
     const patch = await parseBody(req.request, UpdateOrgMemberBodySchema);
     const orgs = req.deps.orgs;
-    const [actorMember, target] = await Promise.all([
-        orgs.getOrgMember(ctx, orgId, ctx.userId),
-        orgs.getOrgMember(ctx, orgId, userId)
-    ]);
-    if (!target)
-        apiError(404, ApiErrorCode.NOT_FOUND, 'Member not found in this organization.');
-    if (!actorMember) {
-        apiError(403, ApiErrorCode.FORBIDDEN, 'You are not a member of this organization.');
-    }
-    if (patch.role !== undefined && patch.role !== target.role) {
-        // Gated on both the role being granted and the one being taken away —
-        // demoting an owner is an owner-only act even though `member` is not.
-        if (!canChangeOrgRole({ actorMember, role: patch.role }) ||
-            !canChangeOrgRole({ actorMember, role: target.role })) {
-            apiError(403, ApiErrorCode.FORBIDDEN, 'Only the org owner can change roles.');
+    return serializeOwnerChanges(orgId, async () => {
+        const [actorMember, target] = await Promise.all([
+            orgs.getOrgMember(ctx, orgId, ctx.userId),
+            orgs.getOrgMember(ctx, orgId, userId)
+        ]);
+        if (!target)
+            apiError(404, ApiErrorCode.NOT_FOUND, 'Member not found in this organization.');
+        if (!actorMember) {
+            apiError(403, ApiErrorCode.FORBIDDEN, 'You are not a member of this organization.');
         }
-        if (target.role === 'owner' &&
-            patch.role !== 'owner' &&
-            !(await hasAnotherOwner(req, ctx, orgId, target.userId))) {
-            apiError(409, ApiErrorCode.CONFLICT, 'Cannot demote the sole owner of this organization. Promote another member to owner first.');
+        const roleChange = patch.role !== undefined && patch.role !== target.role;
+        if (roleChange) {
+            // Gated on both the role being granted and the one being taken away —
+            // demoting an owner is an owner-only act even though `member` is not.
+            if (!canChangeOrgRole({ actorMember, role: patch.role }) ||
+                !canChangeOrgRole({ actorMember, role: target.role })) {
+                apiError(403, ApiErrorCode.FORBIDDEN, 'Only the org owner can change roles.');
+            }
+            if (target.role === 'owner' &&
+                patch.role !== 'owner' &&
+                !(await hasAnotherOwner(req, ctx, orgId, target.userId))) {
+                apiError(409, ApiErrorCode.CONFLICT, 'Cannot demote the sole owner of this organization. Promote another member to owner first.');
+            }
         }
-        await orgs.updateOrgMemberRole(ctx, orgId, userId, patch.role);
-    }
-    if (patch.permissions !== undefined) {
-        // Validate against the role the member will have, not the one they had.
-        const effectiveRole = patch.role ?? target.role;
-        const valid = effectiveRole === 'member'
-            ? new Set(MEMBER_ASSIGNABLE_PERMISSIONS)
-            : new Set(ALL_ORG_PERMISSIONS);
-        const invalid = patch.permissions.filter((p) => !valid.has(p));
-        if (invalid.length > 0) {
-            apiError(400, ApiErrorCode.VALIDATION_FAILED, `Permissions [${invalid.join(', ')}] cannot be assigned to a ${effectiveRole}.`);
+        if (patch.permissions !== undefined) {
+            // Emptying an owner's or admin's set demotes them in all but name.
+            if (!canChangeOrgRole({ actorMember, role: target.role })) {
+                apiError(403, ApiErrorCode.FORBIDDEN, 'Only the org owner can change an owner’s or admin’s permissions.');
+            }
+            // Validate against the role the member will have, not the one they had.
+            const effectiveRole = patch.role ?? target.role;
+            const valid = effectiveRole === 'member'
+                ? new Set(MEMBER_ASSIGNABLE_PERMISSIONS)
+                : new Set(ALL_ORG_PERMISSIONS);
+            const invalid = patch.permissions.filter((p) => !valid.has(p));
+            if (invalid.length > 0) {
+                apiError(400, ApiErrorCode.VALIDATION_FAILED, `Permissions [${invalid.join(', ')}] cannot be assigned to a ${effectiveRole}.`);
+            }
         }
-        await orgs.updateOrgMemberPermissions(ctx, orgId, userId, patch.permissions);
-    }
-    return noContent();
+        // Writes only after every check, so a refused permission set can't leave a
+        // role change behind.
+        if (roleChange)
+            await orgs.updateOrgMemberRole(ctx, orgId, userId, patch.role);
+        if (patch.permissions !== undefined) {
+            await orgs.updateOrgMemberPermissions(ctx, orgId, userId, patch.permissions);
+        }
+        return noContent();
+    });
 };
 /**
  * Remove a member from the org. Owner/admin via `manage_org_members`, same
@@ -143,25 +160,28 @@ export const removeOrgMember = async (req) => {
     requireManageOrgMembers(req);
     const { ctx, orgId } = requireActingOrg(req, req.params.orgId);
     const orgs = req.deps.orgs;
-    const [actorMember, target] = await Promise.all([
-        orgs.getOrgMember(ctx, orgId, ctx.userId),
-        orgs.getOrgMember(ctx, orgId, userId)
-    ]);
-    if (!target)
-        apiError(404, ApiErrorCode.NOT_FOUND, 'Member not found in this organization.');
-    // Same owner-only gate PATCH applies to demotion. Removing an owner ends
-    // their role just as demoting them does, so an admin got 403 on the demote
-    // and 204 on the remove — the harder-to-reverse of the two.
-    if (!canChangeOrgRole({ actorMember, role: target.role })) {
-        apiError(403, ApiErrorCode.FORBIDDEN, 'Only the org owner can remove another owner.');
-    }
-    if (target.role === 'owner' && !(await hasAnotherOwner(req, ctx, orgId, target.userId))) {
-        apiError(409, ApiErrorCode.CONFLICT, 'Cannot remove the sole owner of this organization. Promote another member to owner first.');
-    }
-    // Must run before the removal: the cascade soft-deletes the very rows this
-    // reads. Reported, not blocked — see the docblock on `findProjectsLosingSoleOwner`.
-    const orphaned = await findProjectsLosingSoleOwner(req, ctx, orgId, userId);
-    await orgs.removeOrgMember(ctx, orgId, userId);
+    const orphaned = await serializeOwnerChanges(orgId, async () => {
+        const [actorMember, target] = await Promise.all([
+            orgs.getOrgMember(ctx, orgId, ctx.userId),
+            orgs.getOrgMember(ctx, orgId, userId)
+        ]);
+        if (!target)
+            apiError(404, ApiErrorCode.NOT_FOUND, 'Member not found in this organization.');
+        // Same owner-only gate PATCH applies to demotion. Removing an owner ends
+        // their role just as demoting them does, so an admin got 403 on the demote
+        // and 204 on the remove — the harder-to-reverse of the two.
+        if (!canChangeOrgRole({ actorMember, role: target.role })) {
+            apiError(403, ApiErrorCode.FORBIDDEN, 'Only the org owner can remove another owner.');
+        }
+        if (target.role === 'owner' && !(await hasAnotherOwner(req, ctx, orgId, target.userId))) {
+            apiError(409, ApiErrorCode.CONFLICT, 'Cannot remove the sole owner of this organization. Promote another member to owner first.');
+        }
+        // Must run before the removal: the cascade soft-deletes the very rows this
+        // reads. Reported, not blocked — see the docblock on `findProjectsLosingSoleOwner`.
+        const losing = await findProjectsLosingSoleOwner(req, orgId, userId);
+        await orgs.removeOrgMember(ctx, orgId, userId);
+        return losing;
+    });
     if (orphaned.length > 0) {
         await req.deps.events.emit({
             type: 'org_member.removed_orphaning_projects',

package/dist/handlers/orgMembers.js.map

@@ -1 +1 @@
-{"version":3,"file":"orgMembers.js","sourceRoot":"","sources":["../../src/handlers/orgMembers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACN,QAAQ,EACR,YAAY,EACZ,SAAS,EACT,SAAS,EACT,aAAa,EACb,yBAAyB,EACzB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACN,6BAA6B,EAC7B,mBAAmB,EACnB,OAAO,EACP,gBAAgB,EAKhB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAErD,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,6EAA6E;AAC7E,yEAAyE;AACzE,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAE7B;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,eAAe,CAC7B,GAAe,EACf,GAAmB,EACnB,KAAa,EACb,YAAoB;IAEpB,IAAI,MAA0B,CAAC;IAC/B,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,gBAAgB,EAAE,IAAI,EAAE,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,EAAE;YAC7D,KAAK,EAAE,iBAAiB;YACxB,MAAM;SACN,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,MAAM,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;YAC/F,OAAO,IAAI,CAAC;QACb,CAAC;QACD,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC;QAC3B,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;IAC3B,CAAC;IACD,8EAA8E;IAC9E,8EAA8E;IAC9E,wDAAwD;IACxD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,2DAA2D,EAAE;QACzE,KAAK;QACL,KAAK,EAAE,gBAAgB;KACvB,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,KAAK,UAAU,2BAA2B,CACzC,GAAe,EACf,GAAmB,EACnB,KAAa,EACb,MAAc;IAEd,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC;IACnC,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAE1F,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QACvC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE;YAClE,KAAK,EAAE,iBAAiB;SACxB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC/E,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5E,CAAC,CAAC,CACF,CAAC;IAEF,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAgB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACxD,MAAM,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAEhE,2EAA2E;IAC3E,4BAA4B;IAC5B,uBAAuB,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAE/D,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,yBAAyB,CAAC,CAAC;IACtE,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;IAE3B,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC/C,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC;QACzC,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC;KACrC,CAAC,CAAC;IACH,IAAI,CAAC,MAAM;QAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,wCAAwC,CAAC,CAAC;IAC7F,IAAI,CAAC,WAAW,EAAE,CAAC;QAClB,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,4CAA4C,CAAC,CAAC;IACrF,CAAC;IAED,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5D,sEAAsE;QACtE,sEAAsE;QACtE,IACC,CAAC,gBAAgB,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;YACpD,CAAC,gBAAgB,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,EACpD,CAAC;YACF,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,sCAAsC,CAAC,CAAC;QAC/E,CAAC;QACD,IACC,MAAM,CAAC,IAAI,KAAK,OAAO;YACvB,KAAK,CAAC,IAAI,KAAK,OAAO;YACtB,CAAC,CAAC,MAAM,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EACvD,CAAC;YACF,QAAQ,CACP,GAAG,EACH,YAAY,CAAC,QAAQ,EACrB,2FAA2F,CAC3F,CAAC;QACH,CAAC;QACD,MAAM,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,IAAe,CAAC,CAAC;IAC3E,CAAC;IAED,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACrC,wEAAwE;QACxE,MAAM,aAAa,GAAY,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC;QACzD,MAAM,KAAK,GACV,aAAa,KAAK,QAAQ;YACzB,CAAC,CAAC,IAAI,GAAG,CAAgB,6BAA6B,CAAC;YACvD,CAAC,CAAC,IAAI,GAAG,CAAgB,mBAAmB,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,QAAQ,CACP,GAAG,EACH,YAAY,CAAC,iBAAiB,EAC9B,gBAAgB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,6BAA6B,aAAa,GAAG,CAC/E,CAAC;QACH,CAAC;QACD,MAAM,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IAC9E,CAAC;IAED,OAAO,SAAS,EAAE,CAAC;AACpB,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACxD,MAAM,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAChE,uBAAuB,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAE/D,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;IAC3B,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC/C,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC;QACzC,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC;KACrC,CAAC,CAAC;IACH,IAAI,CAAC,MAAM;QAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,wCAAwC,CAAC,CAAC;IAE7F,yEAAyE;IACzE,2EAA2E;IAC3E,4DAA4D;IAC5D,IAAI,CAAC,gBAAgB,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QAC3D,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,8CAA8C,CAAC,CAAC;IACvF,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,MAAM,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QACzF,QAAQ,CACP,GAAG,EACH,YAAY,CAAC,QAAQ,EACrB,2FAA2F,CAC3F,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,oFAAoF;IACpF,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAE5E,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAE/C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YAC1B,IAAI,EAAE,uCAAuC;YAC7C,KAAK;YACL,MAAM;YACN,UAAU,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,GAAG,OAAO,CAAC,GAAG,CAAC;SACf,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,mDAAmD,EAAE;YACjE,KAAK;YACL,MAAM;YACN,OAAO,EAAE,GAAG,CAAC,MAAM;YACnB,YAAY,EAAE,QAAQ,CAAC,MAAM;SAC7B,CAAC,CAAC;IACJ,CAAC;IAED,qEAAqE;IACrE,qEAAqE;IACrE,0EAA0E;IAC1E,yEAAyE;IACzE,wEAAwE;IACxE,gCAAgC;IAChC,MAAM,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC;IAC3D,IAAI,KAAK,EAAE,CAAC;QACX,IAAI,CAAC;YACJ,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,+DAA+D,EAAE;gBAC9E,KAAK;gBACL,MAAM;gBACN,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACvD,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAED,MAAM,mBAAmB,CACxB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EACvB,GAAG,EACH,MAAM,EACN,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,EACnC,GAAG,CAAC,GAAG,CACP,CAAC;IAEF,OAAO,SAAS,EAAE,CAAC;AACpB,CAAC,CAAC"}
+{"version":3,"file":"orgMembers.js","sourceRoot":"","sources":["../../src/handlers/orgMembers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACN,QAAQ,EACR,YAAY,EACZ,SAAS,EACT,SAAS,EACT,aAAa,EACb,yBAAyB,EACzB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACN,6BAA6B,EAC7B,mBAAmB,EACnB,OAAO,EACP,gBAAgB,EAIhB,cAAc,EAEd,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,6EAA6E;AAC7E,yEAAyE;AACzE,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAE7B;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,eAAe,CAC7B,GAAe,EACf,GAAmB,EACnB,KAAa,EACb,YAAoB;IAEpB,IAAI,MAA0B,CAAC;IAC/B,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,gBAAgB,EAAE,IAAI,EAAE,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,EAAE;YAC7D,KAAK,EAAE,iBAAiB;YACxB,MAAM;SACN,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,MAAM,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;YAC/F,OAAO,IAAI,CAAC;QACb,CAAC;QACD,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC;QAC3B,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;IAC3B,CAAC;IACD,8EAA8E;IAC9E,8EAA8E;IAC9E,wDAAwD;IACxD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,2DAA2D,EAAE;QACzE,KAAK;QACL,KAAK,EAAE,gBAAgB;KACvB,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,KAAK,UAAU,2BAA2B,CACzC,GAAe,EACf,KAAa,EACb,MAAc;IAEd,iFAAiF;IACjF,sCAAsC;IACtC,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC;IACnC,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,cAAc,EAAE,KAAK,EAAE;QACtE,KAAK,EAAE,iBAAiB;KACxB,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QACvC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC,cAAc,EAAE,OAAO,CAAC,EAAE,EAAE;YAC7E,KAAK,EAAE,iBAAiB;SACxB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC/E,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5E,CAAC,CAAC,CACF,CAAC;IAEF,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAgB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACxD,MAAM,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAEhE,2EAA2E;IAC3E,4BAA4B;IAC5B,uBAAuB,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAE/D,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,yBAAyB,CAAC,CAAC;IACtE,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;IAE3B,OAAO,qBAAqB,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;QAC9C,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC/C,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC;YACzC,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC;SACrC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM;YAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,wCAAwC,CAAC,CAAC;QAC7F,IAAI,CAAC,WAAW,EAAE,CAAC;YAClB,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,4CAA4C,CAAC,CAAC;QACrF,CAAC;QAED,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC;QAC1E,IAAI,UAAU,EAAE,CAAC;YAChB,sEAAsE;YACtE,sEAAsE;YACtE,IACC,CAAC,gBAAgB,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,IAAK,EAAE,CAAC;gBACrD,CAAC,gBAAgB,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,EACpD,CAAC;gBACF,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,sCAAsC,CAAC,CAAC;YAC/E,CAAC;YACD,IACC,MAAM,CAAC,IAAI,KAAK,OAAO;gBACvB,KAAK,CAAC,IAAI,KAAK,OAAO;gBACtB,CAAC,CAAC,MAAM,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EACvD,CAAC;gBACF,QAAQ,CACP,GAAG,EACH,YAAY,CAAC,QAAQ,EACrB,2FAA2F,CAC3F,CAAC;YACH,CAAC;QACF,CAAC;QAED,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACrC,mEAAmE;YACnE,IAAI,CAAC,gBAAgB,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC3D,QAAQ,CACP,GAAG,EACH,YAAY,CAAC,SAAS,EACtB,kEAAkE,CAClE,CAAC;YACH,CAAC;YACD,wEAAwE;YACxE,MAAM,aAAa,GAAY,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC;YACzD,MAAM,KAAK,GACV,aAAa,KAAK,QAAQ;gBACzB,CAAC,CAAC,IAAI,GAAG,CAAgB,6BAA6B,CAAC;gBACvD,CAAC,CAAC,IAAI,GAAG,CAAgB,mBAAmB,CAAC,CAAC;YAChD,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,QAAQ,CACP,GAAG,EACH,YAAY,CAAC,iBAAiB,EAC9B,gBAAgB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,6BAA6B,aAAa,GAAG,CAC/E,CAAC;YACH,CAAC;QACF,CAAC;QAED,2EAA2E;QAC3E,sBAAsB;QACtB,IAAI,UAAU;YAAE,MAAM,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,IAAe,CAAC,CAAC;QAC1F,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACrC,MAAM,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QAC9E,CAAC;QACD,OAAO,SAAS,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACxD,MAAM,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAChE,uBAAuB,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAE/D,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;IAC3B,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC/C,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC;YACzC,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC;SACrC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM;YAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,wCAAwC,CAAC,CAAC;QAE7F,yEAAyE;QACzE,2EAA2E;QAC3E,4DAA4D;QAC5D,IAAI,CAAC,gBAAgB,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC3D,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,8CAA8C,CAAC,CAAC;QACvF,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,MAAM,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YACzF,QAAQ,CACP,GAAG,EACH,YAAY,CAAC,QAAQ,EACrB,2FAA2F,CAC3F,CAAC;QACH,CAAC;QAED,2EAA2E;QAC3E,oFAAoF;QACpF,MAAM,MAAM,GAAG,MAAM,2BAA2B,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QACrE,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAC/C,OAAO,MAAM,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YAC1B,IAAI,EAAE,uCAAuC;YAC7C,KAAK;YACL,MAAM;YACN,UAAU,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,GAAG,OAAO,CAAC,GAAG,CAAC;SACf,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,mDAAmD,EAAE;YACjE,KAAK;YACL,MAAM;YACN,OAAO,EAAE,GAAG,CAAC,MAAM;YACnB,YAAY,EAAE,QAAQ,CAAC,MAAM;SAC7B,CAAC,CAAC;IACJ,CAAC;IAED,qEAAqE;IACrE,qEAAqE;IACrE,0EAA0E;IAC1E,yEAAyE;IACzE,wEAAwE;IACxE,gCAAgC;IAChC,MAAM,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC;IAC3D,IAAI,KAAK,EAAE,CAAC;QACX,IAAI,CAAC;YACJ,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,+DAA+D,EAAE;gBAC9E,KAAK;gBACL,MAAM;gBACN,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACvD,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAED,MAAM,mBAAmB,CACxB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EACvB,GAAG,EACH,MAAM,EACN,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,EACnC,GAAG,CAAC,GAAG,CACP,CAAC;IAEF,OAAO,SAAS,EAAE,CAAC;AACpB,CAAC,CAAC"}

package/dist/handlers/ownerChanges.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Runs one org's or project's member changes one at a time. The sole-owner check
+ * reads, then writes: two owners acting on each other at once would each see the
+ * other as the survivor and leave none. Per process only; replicas still need an
+ * atomic store write to close it.
+ */
+export declare function serializeOwnerChanges<T>(id: string, run: () => Promise<T>): Promise<T>;
+//# sourceMappingURL=ownerChanges.d.ts.map

package/dist/handlers/ownerChanges.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ownerChanges.d.ts","sourceRoot":"","sources":["../../src/handlers/ownerChanges.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAStF"}

package/dist/handlers/ownerChanges.js

@@ -0,0 +1,19 @@
+const ownerChangeQueues = new Map();
+/**
+ * Runs one org's or project's member changes one at a time. The sole-owner check
+ * reads, then writes: two owners acting on each other at once would each see the
+ * other as the survivor and leave none. Per process only; replicas still need an
+ * atomic store write to close it.
+ */
+export function serializeOwnerChanges(id, run) {
+    const previous = ownerChangeQueues.get(id) ?? Promise.resolve();
+    const next = previous.catch(() => { }).then(run);
+    const tail = next.catch(() => { });
+    ownerChangeQueues.set(id, tail);
+    void tail.then(() => {
+        if (ownerChangeQueues.get(id) === tail)
+            ownerChangeQueues.delete(id);
+    });
+    return next;
+}
+//# sourceMappingURL=ownerChanges.js.map

package/dist/handlers/ownerChanges.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ownerChanges.js","sourceRoot":"","sources":["../../src/handlers/ownerChanges.ts"],"names":[],"mappings":"AAAA,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAA4B,CAAC;AAE9D;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAI,EAAU,EAAE,GAAqB;IACzE,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IAChE,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAClC,iBAAiB,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAChC,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;QACnB,IAAI,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,IAAI;YAAE,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACb,CAAC"}

package/dist/handlers/projectMembers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"projectMembers.d.ts","sourceRoot":"","sources":["../../src/handlers/projectMembers.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAeH,OAAO,KAAK,EAAE,UAAU,EAAc,MAAM,iBAAiB,CAAC;AAI9D,eAAO,MAAM,kBAAkB,EAAE,UAMhC,CAAC;AAEF,eAAO,MAAM,gBAAgB,EAAE,UAwB9B,CAAC;AAuCF,eAAO,MAAM,uBAAuB,EAAE,UAmBrC,CAAC;AAEF,eAAO,MAAM,mBAAmB,EAAE,UAejC,CAAC"}
+{"version":3,"file":"projectMembers.d.ts","sourceRoot":"","sources":["../../src/handlers/projectMembers.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAeH,OAAO,KAAK,EAAE,UAAU,EAAc,MAAM,iBAAiB,CAAC;AAK9D,eAAO,MAAM,kBAAkB,EAAE,UAMhC,CAAC;AAEF,eAAO,MAAM,gBAAgB,EAAE,UAwB9B,CAAC;AAuCF,eAAO,MAAM,uBAAuB,EAAE,UAqBrC,CAAC;AAEF,eAAO,MAAM,mBAAmB,EAAE,UAiBjC,CAAC"}

package/dist/handlers/projectMembers.js

@@ -10,6 +10,7 @@
 import { AddProjectMemberBodySchema, apiError, ApiErrorCode, collection, created, noContent, parseBody, parseListOptions, requireCaller, requireParams, UpdateProjectMemberBodySchema } from '../api/index.js';
 import { checkOwnerRemoval } from '@selvajs/platform';
 import { requireCanManage, requireTargetIsOrgMember } from '../access/index.js';
+import { serializeOwnerChanges } from './ownerChanges.js';
 export const listProjectMembers = async (req) => {
     const { id } = requireParams(req.params, 'id');
     const { ctx } = requireCaller(req);
@@ -69,27 +70,31 @@ export const updateProjectMemberRole = async (req) => {
     // it runs the same guard DELETE does. Without this a sole owner can PATCH
     // themselves to `viewer` and lock the project — `canManage`,
     // `canEditProjectSettings` and `canEdit` all go false at once.
-    if (role !== 'owner') {
-        const target = await req.deps.projects.getProjectMember(ctx, id, userId);
-        if (target?.role === 'owner') {
-            await assertOwnerRemovable(req, id, target, 'demote');
+    return serializeOwnerChanges(id, async () => {
+        if (role !== 'owner') {
+            const target = await req.deps.projects.getProjectMember(ctx, id, userId);
+            if (target?.role === 'owner') {
+                await assertOwnerRemovable(req, id, target, 'demote');
+            }
         }
-    }
-    await req.deps.projects.updateProjectMemberRole(ctx, id, userId, role);
-    return noContent();
+        await req.deps.projects.updateProjectMemberRole(ctx, id, userId, role);
+        return noContent();
+    });
 };
 export const removeProjectMember = async (req) => {
     const { id, userId } = requireParams(req.params, 'id', 'userId');
     const { ctx } = requireCaller(req);
     await requireCanManage(req, id, 'members');
-    const target = await req.deps.projects.getProjectMember(ctx, id, userId);
-    // Idempotent: already gone, or never there.
-    if (!target)
+    return serializeOwnerChanges(id, async () => {
+        const target = await req.deps.projects.getProjectMember(ctx, id, userId);
+        // Idempotent: already gone, or never there.
+        if (!target)
+            return noContent();
+        if (target.role === 'owner') {
+            await assertOwnerRemovable(req, id, target, 'remove');
+        }
+        await req.deps.projects.removeProjectMember(ctx, id, userId);
         return noContent();
-    if (target.role === 'owner') {
-        await assertOwnerRemovable(req, id, target, 'remove');
-    }
-    await req.deps.projects.removeProjectMember(ctx, id, userId);
-    return noContent();
+    });
 };
 //# sourceMappingURL=projectMembers.js.map

package/dist/handlers/projectMembers.js.map

@@ -1 +1 @@
-{"version":3,"file":"projectMembers.js","sourceRoot":"","sources":["../../src/handlers/projectMembers.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACN,0BAA0B,EAC1B,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,OAAO,EACP,SAAS,EACT,SAAS,EACT,gBAAgB,EAChB,aAAa,EACb,aAAa,EACb,6BAA6B,EAC7B,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,iBAAiB,EAAwC,MAAM,mBAAmB,CAAC;AAC5F,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAEhF,MAAM,CAAC,MAAM,kBAAkB,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IAC3D,MAAM,EAAE,EAAE,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC/C,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,gBAAgB,CAAC,GAAG,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;IAE3C,OAAO,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,GAAG,EAAE,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACnG,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACzD,MAAM,EAAE,EAAE,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC/C,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,gBAAgB,CAAC,GAAG,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;IAE3C,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,0BAA0B,CAAC,CAAC;IAEvE,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC5D,IAAI,CAAC,OAAO;QAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACzE,MAAM,wBAAwB,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAEjE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,MAAM,GAAkB;QAC7B,SAAS,EAAE,EAAE;QACb,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ,EAAE,GAAG;QACb,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM;QACrC,SAAS,EAAE,IAAI;KACf,CAAC;IAEF,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACtD,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC;AACxB,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,KAAK,UAAU,oBAAoB,CAClC,GAAe,EACf,SAAiB,EACjB,MAA6B,EAC7B,MAA2B;IAE3B,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IACxF,MAAM,QAAQ,GAAG,iBAAiB,CAAC;QAClC,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;QAC7B,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACrD,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,MAAM;KACzD,CAAC,CAAC;IAEH,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC/B,QAAQ,CACP,GAAG,EACH,YAAY,CAAC,QAAQ,EACrB,UAAU,MAAM,6FAA6F,CAC7G,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,KAAK,eAAe,EAAE,CAAC;QAClC,QAAQ,CACP,GAAG,EACH,YAAY,CAAC,QAAQ,EACrB,GAAG,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,kFAAkF,CAClI,CAAC;IACH,CAAC;AACF,CAAC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IAChE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IACjE,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,gBAAgB,CAAC,GAAG,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;IAC3C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,6BAA6B,CAAC,CAAC;IAE7E,0EAA0E;IAC1E,0EAA0E;IAC1E,6DAA6D;IAC7D,+DAA+D;IAC/D,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QACzE,IAAI,MAAM,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;YAC9B,MAAM,oBAAoB,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QACvD,CAAC;IACF,CAAC;IAED,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,uBAAuB,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IACvE,OAAO,SAAS,EAAE,CAAC;AACpB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IAC5D,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IACjE,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,gBAAgB,CAAC,GAAG,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;IAE3C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;IACzE,4CAA4C;IAC5C,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,EAAE,CAAC;IAEhC,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC7B,MAAM,oBAAoB,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;IAC7D,OAAO,SAAS,EAAE,CAAC;AACpB,CAAC,CAAC"}
+{"version":3,"file":"projectMembers.js","sourceRoot":"","sources":["../../src/handlers/projectMembers.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACN,0BAA0B,EAC1B,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,OAAO,EACP,SAAS,EACT,SAAS,EACT,gBAAgB,EAChB,aAAa,EACb,aAAa,EACb,6BAA6B,EAC7B,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,iBAAiB,EAAwC,MAAM,mBAAmB,CAAC;AAC5F,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAChF,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,MAAM,CAAC,MAAM,kBAAkB,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IAC3D,MAAM,EAAE,EAAE,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC/C,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,gBAAgB,CAAC,GAAG,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;IAE3C,OAAO,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,GAAG,EAAE,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACnG,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACzD,MAAM,EAAE,EAAE,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC/C,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,gBAAgB,CAAC,GAAG,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;IAE3C,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,0BAA0B,CAAC,CAAC;IAEvE,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC5D,IAAI,CAAC,OAAO;QAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACzE,MAAM,wBAAwB,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAEjE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,MAAM,GAAkB;QAC7B,SAAS,EAAE,EAAE;QACb,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ,EAAE,GAAG;QACb,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM;QACrC,SAAS,EAAE,IAAI;KACf,CAAC;IAEF,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACtD,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC;AACxB,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,KAAK,UAAU,oBAAoB,CAClC,GAAe,EACf,SAAiB,EACjB,MAA6B,EAC7B,MAA2B;IAE3B,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IACxF,MAAM,QAAQ,GAAG,iBAAiB,CAAC;QAClC,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;QAC7B,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACrD,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,MAAM;KACzD,CAAC,CAAC;IAEH,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC/B,QAAQ,CACP,GAAG,EACH,YAAY,CAAC,QAAQ,EACrB,UAAU,MAAM,6FAA6F,CAC7G,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,KAAK,eAAe,EAAE,CAAC;QAClC,QAAQ,CACP,GAAG,EACH,YAAY,CAAC,QAAQ,EACrB,GAAG,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,kFAAkF,CAClI,CAAC;IACH,CAAC;AACF,CAAC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IAChE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IACjE,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,gBAAgB,CAAC,GAAG,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;IAC3C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,6BAA6B,CAAC,CAAC;IAE7E,0EAA0E;IAC1E,0EAA0E;IAC1E,6DAA6D;IAC7D,+DAA+D;IAC/D,OAAO,qBAAqB,CAAC,EAAE,EAAE,KAAK,IAAI,EAAE;QAC3C,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACtB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;YACzE,IAAI,MAAM,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC9B,MAAM,oBAAoB,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YACvD,CAAC;QACF,CAAC;QAED,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,uBAAuB,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QACvE,OAAO,SAAS,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IAC5D,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IACjE,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,gBAAgB,CAAC,GAAG,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;IAE3C,OAAO,qBAAqB,CAAC,EAAE,EAAE,KAAK,IAAI,EAAE;QAC3C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QACzE,4CAA4C;QAC5C,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,EAAE,CAAC;QAEhC,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC7B,MAAM,oBAAoB,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QAC7D,OAAO,SAAS,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC"}

package/dist/handlers/projects.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"projects.d.ts","sourceRoot":"","sources":["../../src/handlers/projects.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAYN,KAAK,UAAU,EACf,MAAM,iBAAiB,CAAC;AAyBzB;;;;GAIG;AACH,eAAO,MAAM,YAAY,EAAE,UAgC1B,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,UAiD3B,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,UAAU,EAAE,UAmCxB,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,UAuE3B,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,UAO3B,CAAC"}
+{"version":3,"file":"projects.d.ts","sourceRoot":"","sources":["../../src/handlers/projects.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAYN,KAAK,UAAU,EACf,MAAM,iBAAiB,CAAC;AAyBzB;;;;GAIG;AACH,eAAO,MAAM,YAAY,EAAE,UAgC1B,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,UAiD3B,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,UAAU,EAAE,UAmCxB,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,UAyE3B,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,UAe3B,CAAC"}