@braidhq/server 0.0.1 → 0.2.0

package/dist/infrastructure/workspace/WorkspaceRegistryFile.d.ts

@@ -0,0 +1,42 @@
+import type { AbsolutePath, UserId, WorkspaceMember, WorkspaceRole } from '@braidhq/schema';
+/**
+ * Persists the list of registered workspace rootPaths to a JSON file.
+ * Default location is `${BRAID_HOME}/workspaces.json`, set by the caller.
+ * Acts as the source of truth across server restarts,
+ * the in-memory `FsWorkspaceRepository` cache rebuilds from it on cold start.
+ */
+export declare class WorkspaceRegistryFile {
+    private readonly filePath;
+    constructor(filePath: string);
+    list(): Promise<AbsolutePath[]>;
+    add(rootPath: AbsolutePath, initialOwner?: WorkspaceMember): Promise<void>;
+    remove(rootPath: AbsolutePath): Promise<void>;
+    listMembers(rootPath: AbsolutePath): Promise<WorkspaceMember[]>;
+    /**
+     * All entries with their members in one read. An admin view can then,
+     * invert to a user-to-workspaces map, with no N+1 reads of the file.
+     */
+    listAllWithMembers(): Promise<ReadonlyArray<{
+        rootPath: AbsolutePath;
+        members: readonly WorkspaceMember[];
+    }>>;
+    getMember(rootPath: AbsolutePath, userId: UserId): Promise<WorkspaceMember | undefined>;
+    addMember(rootPath: AbsolutePath, member: WorkspaceMember): Promise<void>;
+    updateMember(rootPath: AbsolutePath, userId: UserId, patch: {
+        role?: WorkspaceRole;
+        skillOverrides?: WorkspaceMember['skillOverrides'];
+    }): Promise<WorkspaceMember>;
+    removeMember(rootPath: AbsolutePath, userId: UserId): Promise<void>;
+    /**
+     * In one atomic write, demote the current owner to maintainer,
+     * and promote `newOwnerId` to owner.
+     * If the target is not yet a maintainer here, this throws.
+     * We never auto-add the target,
+     * so the caller must add them first when that is needed.
+     */
+    transferOwnership(rootPath: AbsolutePath, newOwnerId: UserId): Promise<void>;
+    private requireEntry;
+    private read;
+    private write;
+}
+//# sourceMappingURL=WorkspaceRegistryFile.d.ts.map

package/dist/infrastructure/workspace/WorkspaceRegistryFile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"WorkspaceRegistryFile.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/workspace/WorkspaceRegistryFile.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AA2B3F;;;;;GAKG;AACH,qBAAa,qBAAqB;IACpB,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,MAAM;IAEvC,IAAI,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;IAK/B,GAAG,CAAC,QAAQ,EAAE,YAAY,EAAE,YAAY,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IAW1E,MAAM,CAAC,QAAQ,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ7C,WAAW,CAAC,QAAQ,EAAE,YAAY,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IAKrE;;;OAGG;IACG,kBAAkB,IAAI,OAAO,CAAC,aAAa,CAAC;QAAE,QAAQ,EAAE,YAAY,CAAC;QAAC,OAAO,EAAE,SAAS,eAAe,EAAE,CAAA;KAAE,CAAC,CAAC;IAK7G,SAAS,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC;IAKvF,SAAS,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IAazE,YAAY,CAChB,QAAQ,EAAE,YAAY,EACtB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE;QAAE,IAAI,CAAC,EAAE,aAAa,CAAC;QAAC,cAAc,CAAC,EAAE,eAAe,CAAC,gBAAgB,CAAC,CAAA;KAAE,GAClF,OAAO,CAAC,eAAe,CAAC;IAoBrB,YAAY,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAczE;;;;;;OAMG;IACG,iBAAiB,CAAC,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAiBpE,YAAY;YAQZ,IAAI;YAgBJ,KAAK;CAIpB"}

package/dist/infrastructure/workspace/WorkspaceRegistryFile.js

@@ -0,0 +1,160 @@
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { dirname } from 'node:path';
+import { NotFoundError, ValidationError } from '@braidhq/core';
+import { AbsolutePath as AbsolutePathSchema, WorkspaceMember as WorkspaceMemberSchema, } from '@braidhq/schema';
+import { z } from 'zod';
+// The registry stores a per-workspace `members[]` list alongside `rootPath`.
+// Old shapes carrying only `rootPath` are accepted by `.default([])`,
+// then lazily upgraded on the next write.
+// `ensureWorkspaceOwners` in `composeFsApp` seeds the default owner,
+// so the single-tenant install keeps working without any manual migration.
+const RegistryEntry = z.object({
+    rootPath: AbsolutePathSchema,
+    members: z.array(WorkspaceMemberSchema).default([]),
+});
+const RegistryContent = z.object({
+    workspaces: z.array(RegistryEntry).default([]),
+});
+/**
+ * Persists the list of registered workspace rootPaths to a JSON file.
+ * Default location is `${BRAID_HOME}/workspaces.json`, set by the caller.
+ * Acts as the source of truth across server restarts,
+ * the in-memory `FsWorkspaceRepository` cache rebuilds from it on cold start.
+ */
+export class WorkspaceRegistryFile {
+    filePath;
+    constructor(filePath) {
+        this.filePath = filePath;
+    }
+    async list() {
+        const content = await this.read();
+        return content.workspaces.map(entry => entry.rootPath);
+    }
+    async add(rootPath, initialOwner) {
+        const content = await this.read();
+        if (content.workspaces.some(entry => entry.rootPath === rootPath))
+            return;
+        content.workspaces.push({
+            rootPath,
+            members: initialOwner ? [initialOwner] : [],
+        });
+        await this.write(content);
+    }
+    async remove(rootPath) {
+        const content = await this.read();
+        const filtered = content.workspaces.filter(entry => entry.rootPath !== rootPath);
+        if (filtered.length === content.workspaces.length)
+            return;
+        await this.write({ workspaces: filtered });
+    }
+    async listMembers(rootPath) {
+        const entry = await this.requireEntry(rootPath);
+        return entry.members;
+    }
+    /**
+     * All entries with their members in one read. An admin view can then,
+     * invert to a user-to-workspaces map, with no N+1 reads of the file.
+     */
+    async listAllWithMembers() {
+        const content = await this.read();
+        return content.workspaces.map(e => ({ rootPath: e.rootPath, members: e.members }));
+    }
+    async getMember(rootPath, userId) {
+        const entry = await this.requireEntry(rootPath);
+        return entry.members.find(m => m.userId === userId);
+    }
+    async addMember(rootPath, member) {
+        const content = await this.read();
+        const entry = content.workspaces.find(e => e.rootPath === rootPath);
+        if (!entry)
+            throw new NotFoundError(`Workspace at "${rootPath}" not registered`);
+        if (entry.members.some(m => m.userId === member.userId))
+            throw new ValidationError(`User "${member.userId}" is already a member of this workspace`);
+        if (member.role === 'owner' && entry.members.some(m => m.role === 'owner'))
+            throw new ValidationError(`Workspace already has an owner; use transferOwnership instead`);
+        entry.members.push(member);
+        await this.write(content);
+    }
+    async updateMember(rootPath, userId, patch) {
+        const content = await this.read();
+        const entry = content.workspaces.find(e => e.rootPath === rootPath);
+        if (!entry)
+            throw new NotFoundError(`Workspace at "${rootPath}" not registered`);
+        const idx = entry.members.findIndex(m => m.userId === userId);
+        if (idx < 0)
+            throw new NotFoundError(`User "${userId}" is not a member of this workspace`);
+        if (patch.role === 'owner' && entry.members.some(m => m.role === 'owner' && m.userId !== userId))
+            throw new ValidationError(`Workspace already has an owner; use transferOwnership to swap`);
+        const next = { ...entry.members[idx] };
+        if (patch.role !== undefined)
+            next.role = patch.role;
+        if (patch.skillOverrides !== undefined)
+            next.skillOverrides = patch.skillOverrides;
+        entry.members[idx] = next;
+        await this.write(content);
+        return next;
+    }
+    async removeMember(rootPath, userId) {
+        const content = await this.read();
+        const entry = content.workspaces.find(e => e.rootPath === rootPath);
+        if (!entry)
+            return;
+        const target = entry.members.find(m => m.userId === userId);
+        if (!target)
+            return;
+        if (target.role === 'owner')
+            throw new ValidationError(`Cannot remove the workspace owner; transfer ownership first`);
+        entry.members = entry.members.filter(m => m.userId !== userId);
+        await this.write(content);
+    }
+    /**
+     * In one atomic write, demote the current owner to maintainer,
+     * and promote `newOwnerId` to owner.
+     * If the target is not yet a maintainer here, this throws.
+     * We never auto-add the target,
+     * so the caller must add them first when that is needed.
+     */
+    async transferOwnership(rootPath, newOwnerId) {
+        const content = await this.read();
+        const entry = content.workspaces.find(e => e.rootPath === rootPath);
+        if (!entry)
+            throw new NotFoundError(`Workspace at "${rootPath}" not registered`);
+        const currentOwner = entry.members.find(m => m.role === 'owner');
+        const target = entry.members.find(m => m.userId === newOwnerId);
+        if (!target)
+            throw new NotFoundError(`User "${newOwnerId}" is not a member of this workspace`);
+        if (target.userId === currentOwner?.userId)
+            return;
+        if (currentOwner)
+            currentOwner.role = 'maintainer';
+        target.role = 'owner';
+        await this.write(content);
+    }
+    async requireEntry(rootPath) {
+        const content = await this.read();
+        const entry = content.workspaces.find(e => e.rootPath === rootPath);
+        if (!entry)
+            throw new NotFoundError(`Workspace at "${rootPath}" not registered`);
+        return entry;
+    }
+    async read() {
+        try {
+            const raw = await readFile(this.filePath, 'utf-8');
+            const parsed = RegistryContent.safeParse(JSON.parse(raw));
+            if (!parsed.success) {
+                throw new ValidationError(`Invalid workspace registry at "${this.filePath}": ${parsed.error.message}`);
+            }
+            return parsed.data;
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return { workspaces: [] };
+            throw error;
+        }
+    }
+    async write(content) {
+        await mkdir(dirname(this.filePath), { recursive: true });
+        await writeFile(this.filePath, `${JSON.stringify(content, null, 2)}\n`, 'utf-8');
+    }
+}
+//# sourceMappingURL=WorkspaceRegistryFile.js.map

package/dist/infrastructure/workspace/WorkspaceRegistryFile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"WorkspaceRegistryFile.js","sourceRoot":"","sources":["../../../src/infrastructure/workspace/WorkspaceRegistryFile.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAC9D,OAAO,EACL,YAAY,IAAI,kBAAkB,EAClC,eAAe,IAAI,qBAAqB,GACzC,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,6EAA6E;AAC7E,sEAAsE;AACtE,0CAA0C;AAC1C,qEAAqE;AACrE,2EAA2E;AAC3E,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,QAAQ,EAAE,kBAAkB;IAC5B,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACpD,CAAC,CAAA;AAEF,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC/C,CAAC,CAAA;AAKF;;;;;GAKG;AACH,MAAM,OAAO,qBAAqB;IACH;IAA7B,YAA6B,QAAgB;QAAhB,aAAQ,GAAR,QAAQ,CAAQ;IAAG,CAAC;IAEjD,KAAK,CAAC,IAAI;QACR,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;QACjC,OAAO,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IACxD,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,QAAsB,EAAE,YAA8B;QAC9D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;QACjC,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC;YAC/D,OAAM;QACR,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;YACtB,QAAQ;YACR,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE;SAC5C,CAAC,CAAA;QACF,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAC3B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAAsB;QACjC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;QACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAA;QAChF,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,MAAM;YAC/C,OAAM;QACR,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC5C,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,QAAsB;QACtC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAA;QAC/C,OAAO,KAAK,CAAC,OAAO,CAAA;IACtB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,kBAAkB;QACtB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;QACjC,OAAO,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;IACpF,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,QAAsB,EAAE,MAAc;QACpD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAA;QAC/C,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAA;IACrD,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,QAAsB,EAAE,MAAuB;QAC7D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;QACjC,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAA;QACnE,IAAI,CAAC,KAAK;YACR,MAAM,IAAI,aAAa,CAAC,iBAAiB,QAAQ,kBAAkB,CAAC,CAAA;QACtE,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC;YACrD,MAAM,IAAI,eAAe,CAAC,SAAS,MAAM,CAAC,MAAM,yCAAyC,CAAC,CAAA;QAC5F,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC;YACxE,MAAM,IAAI,eAAe,CAAC,+DAA+D,CAAC,CAAA;QAC5F,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC1B,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAC3B,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,QAAsB,EACtB,MAAc,EACd,KAAmF;QAEnF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;QACjC,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAA;QACnE,IAAI,CAAC,KAAK;YACR,MAAM,IAAI,aAAa,CAAC,iBAAiB,QAAQ,kBAAkB,CAAC,CAAA;QACtE,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAA;QAC7D,IAAI,GAAG,GAAG,CAAC;YACT,MAAM,IAAI,aAAa,CAAC,SAAS,MAAM,qCAAqC,CAAC,CAAA;QAC/E,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC;YAC9F,MAAM,IAAI,eAAe,CAAC,+DAA+D,CAAC,CAAA;QAC5F,MAAM,IAAI,GAAoB,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAE,EAAE,CAAA;QACxD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;YAC1B,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAA;QACxB,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS;YACpC,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,CAAA;QAC5C,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAA;QACzB,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACzB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,QAAsB,EAAE,MAAc;QACvD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;QACjC,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAA;QACnE,IAAI,CAAC,KAAK;YACR,OAAM;QACR,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAA;QAC3D,IAAI,CAAC,MAAM;YACT,OAAM;QACR,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO;YACzB,MAAM,IAAI,eAAe,CAAC,6DAA6D,CAAC,CAAA;QAC1F,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAA;QAC9D,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAC3B,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,iBAAiB,CAAC,QAAsB,EAAE,UAAkB;QAChE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;QACjC,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAA;QACnE,IAAI,CAAC,KAAK;YACR,MAAM,IAAI,aAAa,CAAC,iBAAiB,QAAQ,kBAAkB,CAAC,CAAA;QACtE,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAA;QAChE,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAA;QAC/D,IAAI,CAAC,MAAM;YACT,MAAM,IAAI,aAAa,CAAC,SAAS,UAAU,qCAAqC,CAAC,CAAA;QACnF,IAAI,MAAM,CAAC,MAAM,KAAK,YAAY,EAAE,MAAM;YACxC,OAAM;QACR,IAAI,YAAY;YACd,YAAY,CAAC,IAAI,GAAG,YAAY,CAAA;QAClC,MAAM,CAAC,IAAI,GAAG,OAAO,CAAA;QACrB,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAC3B,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,QAAsB;QAC/C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;QACjC,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAA;QACnE,IAAI,CAAC,KAAK;YACR,MAAM,IAAI,aAAa,CAAC,iBAAiB,QAAQ,kBAAkB,CAAC,CAAA;QACtE,OAAO,KAAK,CAAA;IACd,CAAC;IAEO,KAAK,CAAC,IAAI;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;YAClD,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;YACzD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,MAAM,IAAI,eAAe,CAAC,kCAAkC,IAAI,CAAC,QAAQ,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;YACxG,CAAC;YACD,OAAO,MAAM,CAAC,IAAI,CAAA;QACpB,CAAC;QACD,OAAO,KAAK,EAAE,CAAC;YACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBACpD,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,CAAA;YAC3B,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,OAAwB;QAC1C,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACxD,MAAM,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IAClF,CAAC;CACF"}

package/dist/infrastructure/workspace/productManifestWriter.d.ts

@@ -0,0 +1,24 @@
+import type { ProductManifest, ProductManifestCreate } from '@braidhq/schema';
+/**
+ * Take a user-provided `ProductManifestCreate` and fill in the structure,
+ * such as the storage block, so the result is a complete `ProductManifest`,
+ * that Zod will accept.
+ * Throws if the user's own input is inconsistent.
+ */
+export declare function fillManifestDefaults(draft: ProductManifestCreate): ProductManifest;
+/**
+ * Render a `ProductManifest` as YAML-frontmatter markdown,
+ * then write it to `<workspaceRoot>/PRODUCT.md`.
+ * A missing parent directory is created first,
+ * and an existing PRODUCT.md is overwritten.
+ */
+export declare function writeProductManifest(workspaceRoot: string, manifest: ProductManifest, bodyTitle?: string): Promise<string>;
+/**
+ * Replace the YAML frontmatter of an existing PRODUCT.md,
+ * preserving the markdown body underneath.
+ * Workspace mutation endpoints call this,
+ * so user prose below the frontmatter survives an update.
+ * The file must exist, otherwise this throws.
+ */
+export declare function updateProductManifest(workspaceRoot: string, manifest: ProductManifest): Promise<string>;
+//# sourceMappingURL=productManifestWriter.d.ts.map

package/dist/infrastructure/workspace/productManifestWriter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"productManifestWriter.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/workspace/productManifestWriter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,eAAe,EACf,qBAAqB,EAGtB,MAAM,iBAAiB,CAAA;AAcxB;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,qBAAqB,GAAG,eAAe,CAWlF;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAShI;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CAAC,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAQ7G"}

package/dist/infrastructure/{fs → workspace}/productManifestWriter.js

@@ -2,30 +2,17 @@ import { mkdir, readFile, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { OntologyId, ProductManifest as ProductManifestSchema } from '@braidhq/schema';
 import { stringify as stringifyYaml } from 'yaml';
-import { parseMarkdownFrontmatter } from './frontmatter.js';
+import { parseMarkdownFrontmatter } from '../_shared/frontmatter.js';
 const FRONTMATTER_DELIMITER = '---';
-const DEFAULT_AGENT_BINDING = {
-    id: 'claude-default',
-    kind: 'claude-code',
-    model: 'opus',
-    effort: 'high',
-    extraArgs: [],
-    env: {},
-};
-const DEFAULT_AGENTS = {
-    default: 'claude-default',
-    tasks: {},
-};
 const DEFAULT_STORAGE = {
     kind: 'kuzu',
     config: {},
 };
-const DEFAULT_CHANNELS = [];
 /**
- * Take a user-provided `ProductManifestDraft` and fill in the structural
- * blocks (agent / storage / channels) so the result is a valid, complete
- * `ProductManifest` Zod will accept. Throws if the user's input itself is
- * inconsistent.
+ * Take a user-provided `ProductManifestCreate` and fill in the structure,
+ * such as the storage block, so the result is a complete `ProductManifest`,
+ * that Zod will accept.
+ * Throws if the user's own input is inconsistent.
  */
 export function fillManifestDefaults(draft) {
     const manifest = {
@@ -35,17 +22,15 @@ export function fillManifestDefaults(draft) {
         ontologyId: draft.ontologyId ?? OntologyId.parse('ddd'),
         sources: draft.sources,
         mcpServers: draft.mcpServers,
-        agents: draft.agents ?? DEFAULT_AGENTS,
-        agentBindings: draft.agentBindings ?? [DEFAULT_AGENT_BINDING],
         storage: draft.storage ?? DEFAULT_STORAGE,
-        channels: draft.channels ?? [...DEFAULT_CHANNELS],
     };
     return ProductManifestSchema.parse(manifest);
 }
 /**
- * Render a `ProductManifest` as YAML-frontmatter markdown and write it
- * to `<workspaceRoot>/PRODUCT.md`. The parent directory is created if
- * missing; an existing PRODUCT.md is overwritten.
+ * Render a `ProductManifest` as YAML-frontmatter markdown,
+ * then write it to `<workspaceRoot>/PRODUCT.md`.
+ * A missing parent directory is created first,
+ * and an existing PRODUCT.md is overwritten.
  */
 export async function writeProductManifest(workspaceRoot, manifest, bodyTitle) {
     await mkdir(workspaceRoot, { recursive: true });
@@ -58,10 +43,11 @@ export async function writeProductManifest(workspaceRoot, manifest, bodyTitle) {
     return path;
 }
 /**
- * Replace the YAML frontmatter of an existing PRODUCT.md while preserving the
- * markdown body underneath. Used by workspace mutation endpoints so user-written
- * prose (e.g. project notes added below the frontmatter) survives a manifest
- * update. The file must exist; throws otherwise.
+ * Replace the YAML frontmatter of an existing PRODUCT.md,
+ * preserving the markdown body underneath.
+ * Workspace mutation endpoints call this,
+ * so user prose below the frontmatter survives an update.
+ * The file must exist, otherwise this throws.
  */
 export async function updateProductManifest(workspaceRoot, manifest) {
     const path = join(workspaceRoot, 'PRODUCT.md');

package/dist/infrastructure/workspace/productManifestWriter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"productManifestWriter.js","sourceRoot":"","sources":["../../../src/infrastructure/workspace/productManifestWriter.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAC7D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,UAAU,EAAE,eAAe,IAAI,qBAAqB,EAAE,MAAM,iBAAiB,CAAA;AACtF,OAAO,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,MAAM,CAAA;AACjD,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAA;AAEpE,MAAM,qBAAqB,GAAG,KAAK,CAAA;AAEnC,MAAM,eAAe,GAAsB;IACzC,IAAI,EAAE,MAAqB;IAC3B,MAAM,EAAE,EAAE;CACX,CAAA;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAA4B;IAC/D,MAAM,QAAQ,GAAG;QACf,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,OAAO;QACjC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC;QACvD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,eAAe;KAC1C,CAAA;IACD,OAAO,qBAAqB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;AAC9C,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,aAAqB,EAAE,QAAyB,EAAE,SAAkB;IAC7G,MAAM,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC/C,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAA;IACzE,MAAM,OAAO,GAAG,SAAS,IAAI,QAAQ,CAAC,IAAI,CAAA;IAC1C,MAAM,IAAI,GAAG,OAAO,OAAO,IAAI,CAAA;IAC/B,MAAM,OAAO,GAAG,GAAG,qBAAqB,KAAK,IAAI,KAAK,qBAAqB,KAAK,IAAI,EAAE,CAAA;IACtF,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,CAAA;IAC9C,MAAM,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;IACvC,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,aAAqB,EAAE,QAAyB;IAC1F,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,CAAA;IAC9C,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IAC9C,MAAM,EAAE,IAAI,EAAE,GAAG,wBAAwB,CAAU,QAAQ,CAAC,CAAA;IAC5D,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAA;IACzE,MAAM,OAAO,GAAG,GAAG,qBAAqB,KAAK,IAAI,KAAK,qBAAqB,KAAK,IAAI,EAAE,CAAA;IACtF,MAAM,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;IACvC,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/middleware/auth.d.ts

@@ -0,0 +1,39 @@
+import type { UserId as UserIdType } from '@braidhq/schema';
+import type { Context, MiddlewareHandler } from 'hono';
+import type { SessionStore } from '../infrastructure/auth/SessionStore.js';
+declare module 'hono' {
+    interface ContextVariableMap {
+        userId: UserIdType;
+    }
+}
+export interface AuthMiddlewareOptions {
+    readonly sessionStore?: SessionStore;
+    readonly requireAuth: boolean;
+    readonly defaultPrincipal: UserIdType | null;
+}
+/**
+ * Pull a Bearer token off the request,
+ * returning `undefined` when the header is missing or malformed.
+ * Route handlers use this to forward the caller's identity,
+ * reaching spawned skill subprocesses without reparsing.
+ */
+export declare function extractBearerToken(context: {
+    req: {
+        header: (name: string) => string | undefined;
+    };
+}): string | undefined;
+/**
+ * Establish the caller's identity, and gate when auth is enforced.
+ * The single place a request's `userId` is resolved.
+ *
+ * Under local trust, identity comes from `X-Braid-User`, else the default
+ * principal, on every path so public routes like `/auth/whoami` see the caller.
+ * Nothing is rejected.
+ *
+ * When auth is enforced, identity comes only from a valid Bearer session, and a
+ * missing or invalid token on a non-public route is a 401. The header is never
+ * read here, so it cannot impersonate an authenticated caller.
+ */
+export declare function authMiddleware(options: AuthMiddlewareOptions): MiddlewareHandler;
+export declare function getUserId(context: Context): UserIdType;
+//# sourceMappingURL=auth.d.ts.map

package/dist/middleware/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC3D,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAA;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAA;AAI1E,OAAO,QAAQ,MAAM,CAAC;IACpB,UAAU,kBAAkB;QAC1B,MAAM,EAAE,UAAU,CAAA;KACnB;CACF;AAoBD,MAAM,WAAW,qBAAqB;IAEpC,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAA;IAEpC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;IAE7B,QAAQ,CAAC,gBAAgB,EAAE,UAAU,GAAG,IAAI,CAAA;CAC7C;AAWD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE;IAAE,GAAG,EAAE;QAAE,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAA;KAAE,CAAA;CAAE,GAAG,MAAM,GAAG,SAAS,CAMzH;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,qBAAqB,GAAG,iBAAiB,CAkChF;AAED,wBAAgB,SAAS,CAAC,OAAO,EAAE,OAAO,GAAG,UAAU,CAEtD"}

package/dist/middleware/auth.js

@@ -0,0 +1,87 @@
+import { UnauthorizedError } from '@braidhq/core';
+import { UserId } from '@braidhq/schema';
+// Routes the auth middleware never gates,
+// since bootstrapping the login flow needs anonymous access.
+// `/openapi.json` follows the convention that OpenAPI reads publicly,
+// honored by Swagger UI, codegen, and MCP gateways.
+// It documents shape and not data, so exposing it to anonymous callers is safe.
+const PUBLIC_EXACT_PATHS = new Set(['/openapi.json']);
+// Each `/webhooks/<provider>/` prefix is anonymous,
+// because the provider authenticates via a per-source HMAC,
+// checked inside the handler rather than via a Bearer token.
+// Listing providers one by one, rather than the broad `/webhooks/`,
+// keeps a future admin or metrics webhook from inheriting the bypass.
+const PUBLIC_PATH_PREFIXES = ['/auth/', '/health', '/webhooks/github/'];
+// Header naming the caller under local trust, a dev and multi-persona convenience.
+// Read only when auth is not enforced, never on an authenticated deployment,
+// so it can never impersonate a caller behind real auth.
+const USER_HEADER = 'X-Braid-User';
+// EventSource (browser SSE) cannot send custom Authorization headers,
+// so live-update endpoints also accept a `token` query parameter,
+// treated as a Bearer token.
+// Limited to paths ending in `/events`,
+// so the lenient path never applies to mutating routes.
+function isSseEventsPath(path) {
+    return path.endsWith('/events');
+}
+/**
+ * Pull a Bearer token off the request,
+ * returning `undefined` when the header is missing or malformed.
+ * Route handlers use this to forward the caller's identity,
+ * reaching spawned skill subprocesses without reparsing.
+ */
+export function extractBearerToken(context) {
+    const header = context.req.header('Authorization');
+    if (!header || !header.startsWith('Bearer '))
+        return undefined;
+    const token = header.slice('Bearer '.length).trim();
+    return token.length > 0 ? token : undefined;
+}
+/**
+ * Establish the caller's identity, and gate when auth is enforced.
+ * The single place a request's `userId` is resolved.
+ *
+ * Under local trust, identity comes from `X-Braid-User`, else the default
+ * principal, on every path so public routes like `/auth/whoami` see the caller.
+ * Nothing is rejected.
+ *
+ * When auth is enforced, identity comes only from a valid Bearer session, and a
+ * missing or invalid token on a non-public route is a 401. The header is never
+ * read here, so it cannot impersonate an authenticated caller.
+ */
+export function authMiddleware(options) {
+    return async (context, next) => {
+        const path = context.req.path;
+        if (!options.requireAuth) {
+            const header = context.req.header(USER_HEADER);
+            const fromHeader = header && header.length > 0 ? UserId.parse(header) : null;
+            const resolved = fromHeader ?? options.defaultPrincipal;
+            if (resolved)
+                context.set('userId', resolved);
+            await next();
+            return undefined;
+        }
+        // Public routes bootstrap the login flow, so pass them through ungated,
+        // and without reading the header, they must never carry a caller.
+        if (PUBLIC_EXACT_PATHS.has(path) || PUBLIC_PATH_PREFIXES.some(prefix => path.startsWith(prefix))) {
+            await next();
+            return undefined;
+        }
+        let token = extractBearerToken(context);
+        if (!token && isSseEventsPath(path))
+            token = context.req.query('token') || undefined;
+        if (!token)
+            throw new UnauthorizedError('Missing or invalid Authorization header. Sign in to continue.');
+        // The composition root always wires sessionStore alongside requireAuth.
+        const session = await options.sessionStore.resolve(token);
+        if (!session)
+            throw new UnauthorizedError('Session expired or revoked. Sign in again.');
+        context.set('userId', session.userId);
+        await next();
+        return undefined;
+    };
+}
+export function getUserId(context) {
+    return context.get('userId');
+}
+//# sourceMappingURL=auth.js.map

package/dist/middleware/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAQxC,0CAA0C;AAC1C,6DAA6D;AAC7D,sEAAsE;AACtE,oDAAoD;AACpD,gFAAgF;AAChF,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,CAAC,CAAC,CAAA;AACrD,oDAAoD;AACpD,4DAA4D;AAC5D,6DAA6D;AAC7D,oEAAoE;AACpE,sEAAsE;AACtE,MAAM,oBAAoB,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAA;AAEvE,mFAAmF;AACnF,6EAA6E;AAC7E,yDAAyD;AACzD,MAAM,WAAW,GAAG,cAAc,CAAA;AAWlC,sEAAsE;AACtE,kEAAkE;AAClE,6BAA6B;AAC7B,wCAAwC;AACxC,wDAAwD;AACxD,SAAS,eAAe,CAAC,IAAY;IACnC,OAAO,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;AACjC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAkE;IACnG,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAA;IAClD,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC;QAC1C,OAAO,SAAS,CAAA;IAClB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAA;IACnD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;AAC7C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,cAAc,CAAC,OAA8B;IAC3D,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAA;QAE7B,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;YAC9C,MAAM,UAAU,GAAG,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;YAC5E,MAAM,QAAQ,GAAG,UAAU,IAAI,OAAO,CAAC,gBAAgB,CAAA;YACvD,IAAI,QAAQ;gBACV,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;YACjC,MAAM,IAAI,EAAE,CAAA;YACZ,OAAO,SAAS,CAAA;QAClB,CAAC;QAED,wEAAwE;QACxE,kEAAkE;QAClE,IAAI,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YACjG,MAAM,IAAI,EAAE,CAAA;YACZ,OAAO,SAAS,CAAA;QAClB,CAAC;QAED,IAAI,KAAK,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAA;QACvC,IAAI,CAAC,KAAK,IAAI,eAAe,CAAC,IAAI,CAAC;YACjC,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,SAAS,CAAA;QACjD,IAAI,CAAC,KAAK;YACR,MAAM,IAAI,iBAAiB,CAAC,+DAA+D,CAAC,CAAA;QAC9F,wEAAwE;QACxE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,YAAa,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QAC1D,IAAI,CAAC,OAAO;YACV,MAAM,IAAI,iBAAiB,CAAC,4CAA4C,CAAC,CAAA;QAC3E,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAA;QACrC,MAAM,IAAI,EAAE,CAAA;QACZ,OAAO,SAAS,CAAA;IAClB,CAAC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,OAAgB;IACxC,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;AAC9B,CAAC"}

package/dist/middleware/cors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../../src/middleware/cors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAA;AAQ7C,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAC5C;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,GAAE,WAAgB,GAAG,iBAAiB,CAkB3E"}
+{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../../src/middleware/cors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAA;AAW7C,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAC5C;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,GAAE,WAAgB,GAAG,iBAAiB,CAkB3E"}

package/dist/middleware/cors.js

@@ -1,6 +1,9 @@
+// Vite dev (5173) and preview (4173) ports, on both loopback hostnames,
+// which browsers treat as distinct origins.
 const DEFAULT_DEV_ORIGINS = [
-    'http://localhost:5173',
     'http://localhost:4173',
+    'http://localhost:5173',
+    'http://127.0.0.1:4173',
     'http://127.0.0.1:5173',
 ];
 /**
@@ -19,7 +22,7 @@ export function corsMiddleware(options = {}) {
         }
         if (context.req.method === 'OPTIONS') {
             context.header('Access-Control-Allow-Methods', 'GET, POST, PUT, PATCH, DELETE, OPTIONS');
-            context.header('Access-Control-Allow-Headers', 'Content-Type, Authorization');
+            context.header('Access-Control-Allow-Headers', 'Content-Type, Authorization, X-Braid-User');
             context.header('Access-Control-Max-Age', '86400');
             return context.body(null, 204);
         }

package/dist/middleware/cors.js.map

@@ -1 +1 @@
-{"version":3,"file":"cors.js","sourceRoot":"","sources":["../../src/middleware/cors.ts"],"names":[],"mappings":"AAEA,MAAM,mBAAmB,GAAG;IAC1B,uBAAuB;IACvB,uBAAuB;IACvB,uBAAuB;CACxB,CAAA;AAMD;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,UAAuB,EAAE;IACtD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,mBAAmB,CAAC,CAAA;IACtE,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;QAC3C,IAAI,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAClC,OAAO,CAAC,MAAM,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAA;YACrD,OAAO,CAAC,MAAM,CAAC,kCAAkC,EAAE,MAAM,CAAC,CAAA;YAC1D,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QAClC,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO,CAAC,MAAM,CAAC,8BAA8B,EAAE,wCAAwC,CAAC,CAAA;YACxF,OAAO,CAAC,MAAM,CAAC,8BAA8B,EAAE,6BAA6B,CAAC,CAAA;YAC7E,OAAO,CAAC,MAAM,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAA;YACjD,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;QAChC,CAAC;QACD,MAAM,IAAI,EAAE,CAAA;QACZ,OAAO,SAAS,CAAA;IAClB,CAAC,CAAA;AACH,CAAC"}
+{"version":3,"file":"cors.js","sourceRoot":"","sources":["../../src/middleware/cors.ts"],"names":[],"mappings":"AAEA,wEAAwE;AACxE,4CAA4C;AAC5C,MAAM,mBAAmB,GAAG;IAC1B,uBAAuB;IACvB,uBAAuB;IACvB,uBAAuB;IACvB,uBAAuB;CACxB,CAAA;AAMD;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,UAAuB,EAAE;IACtD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,mBAAmB,CAAC,CAAA;IACtE,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;QAC3C,IAAI,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAClC,OAAO,CAAC,MAAM,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAA;YACrD,OAAO,CAAC,MAAM,CAAC,kCAAkC,EAAE,MAAM,CAAC,CAAA;YAC1D,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QAClC,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO,CAAC,MAAM,CAAC,8BAA8B,EAAE,wCAAwC,CAAC,CAAA;YACxF,OAAO,CAAC,MAAM,CAAC,8BAA8B,EAAE,2CAA2C,CAAC,CAAA;YAC3F,OAAO,CAAC,MAAM,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAA;YACjD,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;QAChC,CAAC;QACD,MAAM,IAAI,EAAE,CAAA;QACZ,OAAO,SAAS,CAAA;IAClB,CAAC,CAAA;AACH,CAAC"}

package/dist/middleware/error.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../../src/middleware/error.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,MAAM,CAAA;AA+CxC,eAAO,MAAM,YAAY,EAAE,YAkB1B,CAAA"}
+{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../../src/middleware/error.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,MAAM,CAAA;AA4CxC,eAAO,MAAM,YAAY,EAAE,YAkB1B,CAAA"}

package/dist/middleware/error.js

@@ -1,20 +1,22 @@
-import { BraidError, ConflictError, NotFoundError, ValidationError, } from '@braidhq/core';
+import { BraidError, ValidationError } from '@braidhq/core';
 import { ZodError } from 'zod';
 const PROBLEM_BASE_URL = 'https://braid.dev/errors';
-function statusFor(error) {
-    if (error instanceof ValidationError)
-        return 400;
-    if (error instanceof NotFoundError)
-        return 404;
-    if (error instanceof ConflictError)
-        return 409;
-    return 500;
-}
+// The HTTP status per error code, keyed by the closed BraidErrorCode enum,
+// so a new code fails to compile until it is mapped here.
+const STATUS_BY_CODE = {
+    'BRAID-VALIDATION': 400,
+    'BRAID-UNAUTHORIZED': 401,
+    'BRAID-NOT-FOUND': 404,
+    'BRAID-CONFLICT': 409,
+    'BRAID-FORBIDDEN': 403,
+    'BRAID-UNAVAILABLE': 503,
+    'BRAID-INTERNAL': 500,
+};
 function problemFromBraidError(error) {
     const problem = {
         type: `${PROBLEM_BASE_URL}/${error.code.toLowerCase()}`,
         title: error.name,
-        status: statusFor(error),
+        status: STATUS_BY_CODE[error.code],
         code: error.code,
         detail: error.message,
     };
@@ -24,10 +26,10 @@ function problemFromBraidError(error) {
 }
 function problemFromZodError(error) {
     return {
-        type: `${PROBLEM_BASE_URL}/braid-val`,
+        type: `${PROBLEM_BASE_URL}/braid-validation`,
         title: 'ValidationError',
         status: 400,
-        code: 'BRAID-VAL',
+        code: 'BRAID-VALIDATION',
         detail: error.issues.map(issue => `${issue.path.join('.')}: ${issue.message}`).join('; '),
     };
 }

package/dist/middleware/error.js.map

@@ -1 +1 @@
-{"version":3,"file":"error.js","sourceRoot":"","sources":["../../src/middleware/error.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,UAAU,EACV,aAAa,EACb,aAAa,EACb,eAAe,GAChB,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAA;AAE9B,MAAM,gBAAgB,GAAG,0BAA0B,CAAA;AAEnD,SAAS,SAAS,CAAC,KAAiB;IAClC,IAAI,KAAK,YAAY,eAAe;QAClC,OAAO,GAAG,CAAA;IACZ,IAAI,KAAK,YAAY,aAAa;QAChC,OAAO,GAAG,CAAA;IACZ,IAAI,KAAK,YAAY,aAAa;QAChC,OAAO,GAAG,CAAA;IACZ,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAiB;IAC9C,MAAM,OAAO,GAAqB;QAChC,IAAI,EAAE,GAAG,gBAAgB,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,EAA8B;QACnF,KAAK,EAAE,KAAK,CAAC,IAAI;QACjB,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC;QACxB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM,EAAE,KAAK,CAAC,OAAO;KACtB,CAAA;IACD,IAAI,KAAK,YAAY,eAAe,IAAI,KAAK,CAAC,MAAM;QAClD,OAAO,CAAC,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAA;IACpC,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAe;IAC1C,OAAO;QACL,IAAI,EAAE,GAAG,gBAAgB,YAAwC;QACjE,KAAK,EAAE,iBAAiB;QACxB,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,WAAW;QACjB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;KAC1F,CAAA;AACH,CAAC;AAED,MAAM,oBAAoB,GAAG,EAAE,cAAc,EAAE,0BAA0B,EAAW,CAAA;AAEpF,MAAM,CAAC,MAAM,YAAY,GAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IAC3D,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAA;QAC5C,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,MAA8B,EAAE,oBAAoB,CAAC,CAAA;IAC5F,CAAC;IAED,IAAI,KAAK,YAAY,QAAQ,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAA;QAC1C,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,MAA8B,EAAE,oBAAoB,CAAC,CAAA;IAC5F,CAAC;IAED,OAAO,OAAO,CAAC,IAAI,CAAC;QAClB,IAAI,EAAE,GAAG,gBAAgB,WAAW;QACpC,KAAK,EAAE,eAAe;QACtB,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,gBAAgB;QACtB,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;KACjE,EAAE,GAAG,EAAE,oBAAoB,CAAC,CAAA;AAC/B,CAAC,CAAA"}
+{"version":3,"file":"error.js","sourceRoot":"","sources":["../../src/middleware/error.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAC3D,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAA;AAE9B,MAAM,gBAAgB,GAAG,0BAA0B,CAAA;AAEnD,2EAA2E;AAC3E,0DAA0D;AAC1D,MAAM,cAAc,GAAmC;IACrD,kBAAkB,EAAE,GAAG;IACvB,oBAAoB,EAAE,GAAG;IACzB,iBAAiB,EAAE,GAAG;IACtB,gBAAgB,EAAE,GAAG;IACrB,iBAAiB,EAAE,GAAG;IACtB,mBAAmB,EAAE,GAAG;IACxB,gBAAgB,EAAE,GAAG;CACtB,CAAA;AAED,SAAS,qBAAqB,CAAC,KAAiB;IAC9C,MAAM,OAAO,GAAqB;QAChC,IAAI,EAAE,GAAG,gBAAgB,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,EAA8B;QACnF,KAAK,EAAE,KAAK,CAAC,IAAI;QACjB,MAAM,EAAE,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC;QAClC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM,EAAE,KAAK,CAAC,OAAO;KACtB,CAAA;IACD,IAAI,KAAK,YAAY,eAAe,IAAI,KAAK,CAAC,MAAM;QAClD,OAAO,CAAC,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAA;IACpC,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAe;IAC1C,OAAO;QACL,IAAI,EAAE,GAAG,gBAAgB,mBAA+C;QACxE,KAAK,EAAE,iBAAiB;QACxB,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,kBAAkB;QACxB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;KAC1F,CAAA;AACH,CAAC;AAED,MAAM,oBAAoB,GAAG,EAAE,cAAc,EAAE,0BAA0B,EAAW,CAAA;AAEpF,MAAM,CAAC,MAAM,YAAY,GAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IAC3D,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAA;QAC5C,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,MAA8B,EAAE,oBAAoB,CAAC,CAAA;IAC5F,CAAC;IAED,IAAI,KAAK,YAAY,QAAQ,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAA;QAC1C,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,MAA8B,EAAE,oBAAoB,CAAC,CAAA;IAC5F,CAAC;IAED,OAAO,OAAO,CAAC,IAAI,CAAC;QAClB,IAAI,EAAE,GAAG,gBAAgB,WAAW;QACpC,KAAK,EAAE,eAAe;QACtB,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,gBAAgB;QACtB,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;KACjE,EAAE,GAAG,EAAE,oBAAoB,CAAC,CAAA;AAC/B,CAAC,CAAA"}

package/dist/middleware/workspaceAccess.d.ts

@@ -0,0 +1,51 @@
+import type { WorkspaceService } from '@braidhq/core';
+import type { Context, MiddlewareHandler } from 'hono';
+import type { UserRegistryFile } from '../infrastructure/users/UserRegistryFile.js';
+import type { WorkspaceRegistryFile } from '../infrastructure/workspace/WorkspaceRegistryFile.js';
+import type { Capability, ViewerContext } from '../policy/index.js';
+/**
+ * Server-scope capability guard for actions without a workspace context,
+ * such as workspace creation.
+ * Builds a viewer with an absent member,
+ * so non-admin users resolve to a null effectiveRole,
+ * and fail every check by construction.
+ *
+ * Skips the gate when userRegistry is absent,
+ * so in-memory test compositions stay open.
+ * Production deployments always pass it.
+ */
+export declare function requireServerCapability(capability: Capability, userRegistry: UserRegistryFile | undefined): MiddlewareHandler;
+declare module 'hono' {
+    interface ContextVariableMap {
+        viewerContext: ViewerContext;
+    }
+}
+export interface WorkspaceAccessOptions {
+    readonly registry: WorkspaceRegistryFile;
+    readonly workspaceService: WorkspaceService;
+    readonly userRegistry: UserRegistryFile;
+}
+/**
+ * Resolves the caller's ViewerContext for this workspace,
+ * and stashes it on the Hono context for every downstream layer to read.
+ * Composes after `workspaceIdMiddleware` and `authMiddleware`.
+ * Outsiders get 403 here, meaning no member row and not a server admin.
+ *
+ * The actual policy decisions live in `policy/`.
+ * This middleware only builds the viewer,
+ * and rejects unauthenticated outsiders.
+ */
+export declare function workspaceAccessMiddleware(options: WorkspaceAccessOptions): MiddlewareHandler;
+export declare function getViewerContext(context: Context): ViewerContext | undefined;
+/**
+ * Mutation guard.
+ * Returns 403 when the viewer cannot perform the given capability.
+ * Optional `buildResource` lets a capability such as `skill.run`
+ * attach per-request data the check needs.
+ *
+ * Compositions that don't mount `workspaceAccessMiddleware`,
+ * such as in-memory tests or the headless server, skip the gate.
+ * Production deployments always mount it, so the gate is real.
+ */
+export declare function requirePermission(capability: Capability, buildResource?: (context: Context) => Promise<ViewerContext['resource']>): MiddlewareHandler;
+//# sourceMappingURL=workspaceAccess.d.ts.map

package/dist/middleware/workspaceAccess.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspaceAccess.d.ts","sourceRoot":"","sources":["../../src/middleware/workspaceAccess.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AACrD,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAA;AACtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6CAA6C,CAAA;AACnF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,sDAAsD,CAAA;AACjG,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAMnE;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,UAAU,EACtB,YAAY,EAAE,gBAAgB,GAAG,SAAS,GACzC,iBAAiB,CAgBnB;AAED,OAAO,QAAQ,MAAM,CAAC;IACpB,UAAU,kBAAkB;QAC1B,aAAa,EAAE,aAAa,CAAA;KAC7B;CACF;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAA;IACxC,QAAQ,CAAC,gBAAgB,EAAE,gBAAgB,CAAA;IAC3C,QAAQ,CAAC,YAAY,EAAE,gBAAgB,CAAA;CACxC;AAED;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,sBAAsB,GAAG,iBAAiB,CAgB5F;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,aAAa,GAAG,SAAS,CAE5E;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,UAAU,EACtB,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,GACvE,iBAAiB,CAcnB"}