@cat-factory/server 0.127.1 → 0.129.0

package/dist/http/authGate.js

@@ -1,4 +1,6 @@
+import { ForbiddenError, workspaceRoleAtLeast } from '@cat-factory/kernel';
 import { requireAuth } from '../auth/middleware.js';
+import { loadWorkspaceAccess } from './workspaceAccess.js';
 // The runtime-neutral authentication + authorization gate, shared by every facade.
 // Each facade builds its own app (CORS, the per-request container, runtime-specific
 // controllers) and calls `mountAuthGate(app)` BEFORE `registerCoreControllers(app)` —
@@ -21,6 +23,22 @@ import { requireAuth } from '../auth/middleware.js';
 const PUBLIC_PREFIXES = ['/health', '/auth', '/v1', '/github', '/slack', '/internal', '/api'];
 /** The exact WebSocket-upgrade shape that self-authenticates via `?ticket=`. */
 const WS_EVENTS_PATH = /^\/workspaces\/[^/]+\/events$/;
+/**
+ * The one write that is read-equivalent AND required for the pure *viewing* experience, so it
+ * is allowlisted past the viewer floor: minting a read-only WebSocket stream ticket. A viewer
+ * may watch a board's live stream (the stream carries only read-tier data), so this POST is
+ * exempt from the "≥ member" floor.
+ *
+ * This is deliberately the ONLY exemption. Other non-GET routes that happen not to persist
+ * anything — the `detect` / `plan` / `search` / `test` / `validate` / `preflight` / `probe`
+ * endpoints that prefill a create/edit form or probe an integration connection — are NOT
+ * allowlisted: they belong to the `member`+ authoring / integration-setup surface, not to
+ * read-only viewing (a viewer never reaches them — the SPA gates those affordances by
+ * permission). Blocking them behind the floor is intended; do NOT widen this allowlist to
+ * "read-equivalent POST" as a class. If a genuinely viewing-required write is ever added,
+ * add its own exact-path regex here alongside this one.
+ */
+const WS_TICKET_MINT_PATH = /^\/workspaces\/[^/]+\/events\/ticket$/;
 /**
  * Mount the default-deny session gate and the per-workspace authorization check.
  *
@@ -64,18 +82,35 @@ export function mountAuthGate(app) {
             return next();
         const workspaceId = decodeURIComponent(match[1]);
         const container = c.get('container');
-        const accountId = await container.workspaceService.accountOf(workspaceId);
-        if (accountId === undefined)
-            return next(); // missing board → let the handler 404 normally
-        const notFound = () => c.json({ error: { code: 'not_found', message: 'Workspace not found' } }, 404);
-        if (accountId === null) {
-            // Legacy/unscoped board: only the user who personally owns it may access it.
-            const owner = await container.workspaceService.ownerOf(workspaceId);
-            return owner === user.id ? next() : notFound();
-        }
-        if (await container.accountService.isMember(accountId, user.id))
+        // Resolve the caller's effective workspace-RBAC role once (the single decision point).
+        // `null` ⇒ the board doesn't exist; pass through so the handler 404s as it always has.
+        const access = await loadWorkspaceAccess(container, workspaceId, user.id);
+        if (access === null)
             return next();
-        return notFound();
+        // Denied ⇒ the SAME 404 shape the pre-RBAC gate returned, so existence isn't leaked.
+        if (!access.allowed) {
+            return c.json({ error: { code: 'not_found', message: 'Workspace not found' } }, 404);
+        }
+        // Publish the resolved access for the controllers (`requirePermission`) + the snapshot
+        // attach; carrying `workspaceId` lets a helper assert it matches its route.
+        c.set('workspaceAccess', {
+            workspaceId,
+            role: access.role,
+            permissions: access.permissions,
+        });
+        // The viewer write floor: any state-changing method requires at least `member`. This
+        // covers the whole member tier (`board.write` + `runs.execute`) with ZERO per-controller
+        // code — a forgotten controller check fails safe. The sole read-equivalent write, the
+        // read-only stream ticket mint, is allowlisted; the admin-tier route groups add their own
+        // `requirePermission` on top (a later slice). Insufficiency ⇒ 403 (the caller already sees
+        // the board, so only capability — not existence — is revealed).
+        const method = c.req.method;
+        const isRead = method === 'GET' || method === 'HEAD';
+        const isTicketMint = method === 'POST' && WS_TICKET_MINT_PATH.test(c.req.path);
+        if (!isRead && !isTicketMint && !workspaceRoleAtLeast(access.role, 'member')) {
+            throw new ForbiddenError('This action requires at least member access to this workspace');
+        }
+        return next();
     });
 }
 //# sourceMappingURL=authGate.js.map

package/dist/http/authGate.js.map

@@ -1 +1 @@
-{"version":3,"file":"authGate.js","sourceRoot":"","sources":["../../src/http/authGate.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAGnD,mFAAmF;AACnF,oFAAoF;AACpF,sFAAsF;AACtF,kFAAkF;AAClF,sFAAsF;AACtF,8EAA8E;AAC9E,8DAA8D;AAE9D,oFAAoF;AACpF,sBAAsB;AACtB,0CAA0C;AAC1C,8EAA8E;AAC9E,mFAAmF;AACnF,sEAAsE;AACtE,8EAA8E;AAC9E,gFAAgF;AAChF,yFAAyF;AACzF,+EAA+E;AAC/E,0FAA0F;AAC1F,2EAA2E;AAC3E,MAAM,eAAe,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,CAAC,CAAA;AAE7F,gFAAgF;AAChF,MAAM,cAAc,GAAG,+BAA+B,CAAA;AAEtD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,aAAa,CAAmB,GAAY;IAC1D,MAAM,IAAI,GAAG,WAAW,EAAK,CAAA;IAC7B,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,EAAE,CAAA;QAC7C,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAA;QACvB,IACE,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK;YACtB,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,KAAK,WAAW;YACtD,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EACzB,CAAC;YACD,OAAO,IAAI,EAAE,CAAA;QACf,CAAC;QACD,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAAE,OAAO,IAAI,EAAE,CAAA;QACtF,OAAO,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;IACtB,CAAC,CAAC,CAAA;IAEF,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAC7B,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,EAAE,CAAA;QAC7C,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAC1B,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,EAAE,CAAA;QACxB,MAAM,KAAK,GAAG,kCAAkC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACjE,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,EAAE,CAAA;QACzB,MAAM,WAAW,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAA;QACjD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QACpC,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,gBAAgB,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;QACzE,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO,IAAI,EAAE,CAAA,CAAC,+CAA+C;QAE1F,MAAM,QAAQ,GAAG,GAAG,EAAE,CACpB,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,qBAAqB,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;QAE/E,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,6EAA6E;YAC7E,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,gBAAgB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;YACnE,OAAO,KAAK,KAAK,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAA;QAChD,CAAC;QACD,IAAI,MAAM,SAAS,CAAC,cAAc,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC;YAAE,OAAO,IAAI,EAAE,CAAA;QAC9E,OAAO,QAAQ,EAAE,CAAA;IACnB,CAAC,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"authGate.js","sourceRoot":"","sources":["../../src/http/authGate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAE1E,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAEnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAE1D,mFAAmF;AACnF,oFAAoF;AACpF,sFAAsF;AACtF,kFAAkF;AAClF,sFAAsF;AACtF,8EAA8E;AAC9E,8DAA8D;AAE9D,oFAAoF;AACpF,sBAAsB;AACtB,0CAA0C;AAC1C,8EAA8E;AAC9E,mFAAmF;AACnF,sEAAsE;AACtE,8EAA8E;AAC9E,gFAAgF;AAChF,yFAAyF;AACzF,+EAA+E;AAC/E,0FAA0F;AAC1F,2EAA2E;AAC3E,MAAM,eAAe,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,CAAC,CAAA;AAE7F,gFAAgF;AAChF,MAAM,cAAc,GAAG,+BAA+B,CAAA;AAEtD;;;;;;;;;;;;;;GAcG;AACH,MAAM,mBAAmB,GAAG,uCAAuC,CAAA;AAEnE;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,aAAa,CAAmB,GAAY;IAC1D,MAAM,IAAI,GAAG,WAAW,EAAK,CAAA;IAC7B,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,EAAE,CAAA;QAC7C,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAA;QACvB,IACE,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK;YACtB,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,KAAK,WAAW;YACtD,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EACzB,CAAC;YACD,OAAO,IAAI,EAAE,CAAA;QACf,CAAC;QACD,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAAE,OAAO,IAAI,EAAE,CAAA;QACtF,OAAO,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;IACtB,CAAC,CAAC,CAAA;IAEF,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAC7B,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,EAAE,CAAA;QAC7C,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAC1B,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,EAAE,CAAA;QACxB,MAAM,KAAK,GAAG,kCAAkC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACjE,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,EAAE,CAAA;QACzB,MAAM,WAAW,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAA;QACjD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QAEpC,uFAAuF;QACvF,uFAAuF;QACvF,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;QACzE,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,EAAE,CAAA;QAElC,qFAAqF;QACrF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,qBAAqB,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;QACtF,CAAC;QAED,uFAAuF;QACvF,4EAA4E;QAC5E,CAAC,CAAC,GAAG,CAAC,iBAAiB,EAAE;YACvB,WAAW;YACX,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,CAAC,CAAA;QAEF,qFAAqF;QACrF,yFAAyF;QACzF,sFAAsF;QACtF,0FAA0F;QAC1F,2FAA2F;QAC3F,gEAAgE;QAChE,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAA;QAC3B,MAAM,MAAM,GAAG,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,CAAA;QACpD,MAAM,YAAY,GAAG,MAAM,KAAK,MAAM,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAC9E,IAAI,CAAC,MAAM,IAAI,CAAC,YAAY,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC7E,MAAM,IAAI,cAAc,CAAC,+DAA+D,CAAC,CAAA;QAC3F,CAAC;QACD,OAAO,IAAI,EAAE,CAAA;IACf,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/http/env.d.ts

@@ -1,4 +1,4 @@
-import type { AgentRunRepository, ExecutionRepository, ResolveBinaryArtifactStore, ConsensusSessionRepository, ResolveRunRepoContext, UserRepoAccessRepository, VcsIdentityRegistry, VcsWebhookSink } from '@cat-factory/kernel';
+import type { AgentRunRepository, ExecutionRepository, ResolveBinaryArtifactStore, ConsensusSessionRepository, ResolveRunRepoContext, UserRepoAccessRepository, VcsIdentityRegistry, VcsWebhookSink, WorkspacePermission, WorkspaceRole } from '@cat-factory/kernel';
 import type { ApiKeyService, EnvironmentBackendRegistry, LocalModelEndpointService, LocalSettingsService, OpenRouterCatalogService, PersonalSubscriptionService, ProviderSubscriptionService, PublicApiKeyService, RunnerBackendRegistry, TestSecretsService, UserSecretService } from '@cat-factory/integrations';
 import type { Core } from '@cat-factory/orchestration';
 import type { AgentKindRegistry } from '@cat-factory/agents';
@@ -272,12 +272,26 @@ export interface MothershipConnector {
         message: string;
     }>;
 }
+/**
+ * The signed-in caller's resolved workspace-RBAC access to the `:workspaceId` on the
+ * route, set by the auth gate (`mountAuthGate`) after a successful resolution. Controllers
+ * CONSUME this (`requirePermission`) — they never re-derive membership. Carries the
+ * `workspaceId` so a helper can assert it matches the route it's called from. Absent when
+ * there's no signed-in user (dev-open) or the route carries no workspace segment.
+ */
+export interface WorkspaceAccessContext {
+    workspaceId: string;
+    role: WorkspaceRole;
+    permissions: ReadonlySet<WorkspacePermission>;
+}
 /** Hono generics shared by the cross-runtime controllers (Variables only — no Bindings). */
 export type AppEnv = {
     Variables: {
         container: ServerContainer;
         /** The authenticated user, set by `requireAuth` when auth is enabled. */
         user?: SessionPayload;
+        /** The caller's resolved workspace access, set by the gate — see {@link WorkspaceAccessContext}. */
+        workspaceAccess?: WorkspaceAccessContext;
     };
 };
 //# sourceMappingURL=env.d.ts.map

package/dist/http/env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/http/env.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,kBAAkB,EAClB,mBAAmB,EACnB,0BAA0B,EAC1B,0BAA0B,EAC1B,qBAAqB,EACrB,wBAAwB,EACxB,mBAAmB,EACnB,cAAc,EACf,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EACV,aAAa,EACb,0BAA0B,EAC1B,yBAAyB,EACzB,oBAAoB,EACpB,wBAAwB,EACxB,2BAA2B,EAC3B,2BAA2B,EAC3B,mBAAmB,EACnB,qBAAqB,EACrB,kBAAkB,EAClB,iBAAiB,EAClB,MAAM,2BAA2B,CAAA;AAClC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,4BAA4B,CAAA;AACtD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAA;AACnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAA;AAC5E,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AACrE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AACnD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAA;AACnE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAQhF,MAAM,WAAW,eAAgB,SAAQ,IAAI;IAC3C,MAAM,EAAE,SAAS,CAAA;IACjB,8EAA8E;IAC9E,kBAAkB,EAAE,kBAAkB,CAAA;IACtC;;;;OAIG;IACH,mBAAmB,EAAE,mBAAmB,CAAA;IACxC;;;;OAIG;IACH,0BAA0B,CAAC,EAAE,0BAA0B,CAAA;IACvD,mFAAmF;IACnF,QAAQ,EAAE,eAAe,CAAA;IACzB;;;;;;;OAOG;IACH,wBAAwB,CAAC,EAAE,iBAAiB,CAAA;IAC5C;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACvC;;;;;OAKG;IACH,0BAA0B,EAAE,0BAA0B,CAAA;IACtD,qBAAqB,EAAE,qBAAqB,CAAA;IAC5C;;;;;OAKG;IACH,iBAAiB,EAAE,iBAAiB,CAAA;IACpC;;;;;;OAMG;IACH,wBAAwB,EAAE,wBAAwB,CAAA;IAClD;;;;;;;OAOG;IACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAA;IACrC;;;OAGG;IACH,aAAa,CAAC,EAAE,2BAA2B,CAAA;IAC3C;;;;;OAKG;IACH,WAAW,CAAC,EAAE,kBAAkB,CAAA;IAChC;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,2BAA2B,CAAA;IACnD;;;;;OAKG;IACH,OAAO,CAAC,EAAE,aAAa,CAAA;IACvB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAA;IACnC;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAA;IACjC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;IAC5D;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,yBAAyB,CAAA;IAC/C;;;;OAIG;IACH,WAAW,CAAC,EAAE,iBAAiB,CAAA;IAC/B;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,wBAAwB,CAAA;IACzC;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,wBAAwB,CAAA;IAC5C;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE;QAAE,OAAO,EAAE,oBAAoB,CAAA;KAAE,CAAA;IACjD;;;;;;;OAOG;IACH,0BAA0B,CAAC,EAAE,0BAA0B,CAAA;IACvD;;;;;;;OAOG;IACH,+BAA+B,CAAC,EAAE,OAAO,CAAA;IACzC;;;;;;;;;OASG;IACH,oCAAoC,CAAC,EAAE,OAAO,CAAA;IAC9C;;;;;OAKG;IACH,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,mBAAmB,CAAA;IACjC;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,mBAAmB,CAAA;IAClC;;;;;;;OAOG;IACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAA;IACrC;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,mBAAmB,CAAA;CACxC;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,iBAAiB,CACf,cAAc,EAAE,MAAM,EACtB,IAAI,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAC1D,OAAO,CAAC,MAAM,CAAC,CAAA;CACnB;AAED,+FAA+F;AAC/F,MAAM,WAAW,mBAAmB;IAClC,OAAO,CACL,OAAO,EAAE,MAAM,GACd,OAAO,CACN;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,WAAW,CAAA;KAAE,GAClE;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CACjD,CAAA;CACF;AAED,4FAA4F;AAC5F,MAAM,MAAM,MAAM,GAAG;IACnB,SAAS,EAAE;QACT,SAAS,EAAE,eAAe,CAAA;QAC1B,yEAAyE;QACzE,IAAI,CAAC,EAAE,cAAc,CAAA;KACtB,CAAA;CACF,CAAA"}
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/http/env.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,kBAAkB,EAClB,mBAAmB,EACnB,0BAA0B,EAC1B,0BAA0B,EAC1B,qBAAqB,EACrB,wBAAwB,EACxB,mBAAmB,EACnB,cAAc,EACd,mBAAmB,EACnB,aAAa,EACd,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EACV,aAAa,EACb,0BAA0B,EAC1B,yBAAyB,EACzB,oBAAoB,EACpB,wBAAwB,EACxB,2BAA2B,EAC3B,2BAA2B,EAC3B,mBAAmB,EACnB,qBAAqB,EACrB,kBAAkB,EAClB,iBAAiB,EAClB,MAAM,2BAA2B,CAAA;AAClC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,4BAA4B,CAAA;AACtD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAA;AACnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAA;AAC5E,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AACrE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AACnD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAA;AACnE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAQhF,MAAM,WAAW,eAAgB,SAAQ,IAAI;IAC3C,MAAM,EAAE,SAAS,CAAA;IACjB,8EAA8E;IAC9E,kBAAkB,EAAE,kBAAkB,CAAA;IACtC;;;;OAIG;IACH,mBAAmB,EAAE,mBAAmB,CAAA;IACxC;;;;OAIG;IACH,0BAA0B,CAAC,EAAE,0BAA0B,CAAA;IACvD,mFAAmF;IACnF,QAAQ,EAAE,eAAe,CAAA;IACzB;;;;;;;OAOG;IACH,wBAAwB,CAAC,EAAE,iBAAiB,CAAA;IAC5C;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACvC;;;;;OAKG;IACH,0BAA0B,EAAE,0BAA0B,CAAA;IACtD,qBAAqB,EAAE,qBAAqB,CAAA;IAC5C;;;;;OAKG;IACH,iBAAiB,EAAE,iBAAiB,CAAA;IACpC;;;;;;OAMG;IACH,wBAAwB,EAAE,wBAAwB,CAAA;IAClD;;;;;;;OAOG;IACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAA;IACrC;;;OAGG;IACH,aAAa,CAAC,EAAE,2BAA2B,CAAA;IAC3C;;;;;OAKG;IACH,WAAW,CAAC,EAAE,kBAAkB,CAAA;IAChC;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,2BAA2B,CAAA;IACnD;;;;;OAKG;IACH,OAAO,CAAC,EAAE,aAAa,CAAA;IACvB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAA;IACnC;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAA;IACjC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;IAC5D;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,yBAAyB,CAAA;IAC/C;;;;OAIG;IACH,WAAW,CAAC,EAAE,iBAAiB,CAAA;IAC/B;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,wBAAwB,CAAA;IACzC;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,wBAAwB,CAAA;IAC5C;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE;QAAE,OAAO,EAAE,oBAAoB,CAAA;KAAE,CAAA;IACjD;;;;;;;OAOG;IACH,0BAA0B,CAAC,EAAE,0BAA0B,CAAA;IACvD;;;;;;;OAOG;IACH,+BAA+B,CAAC,EAAE,OAAO,CAAA;IACzC;;;;;;;;;OASG;IACH,oCAAoC,CAAC,EAAE,OAAO,CAAA;IAC9C;;;;;OAKG;IACH,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,mBAAmB,CAAA;IACjC;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,mBAAmB,CAAA;IAClC;;;;;;;OAOG;IACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAA;IACrC;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,mBAAmB,CAAA;CACxC;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,iBAAiB,CACf,cAAc,EAAE,MAAM,EACtB,IAAI,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAC1D,OAAO,CAAC,MAAM,CAAC,CAAA;CACnB;AAED,+FAA+F;AAC/F,MAAM,WAAW,mBAAmB;IAClC,OAAO,CACL,OAAO,EAAE,MAAM,GACd,OAAO,CACN;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,WAAW,CAAA;KAAE,GAClE;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CACjD,CAAA;CACF;AAED;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,MAAM,CAAA;IACnB,IAAI,EAAE,aAAa,CAAA;IACnB,WAAW,EAAE,WAAW,CAAC,mBAAmB,CAAC,CAAA;CAC9C;AAED,4FAA4F;AAC5F,MAAM,MAAM,MAAM,GAAG;IACnB,SAAS,EAAE;QACT,SAAS,EAAE,eAAe,CAAA;QAC1B,yEAAyE;QACzE,IAAI,CAAC,EAAE,cAAc,CAAA;QACrB,oGAAoG;QACpG,eAAe,CAAC,EAAE,sBAAsB,CAAA;KACzC,CAAA;CACF,CAAA"}

package/dist/http/workspaceAccess.d.ts

@@ -0,0 +1,9 @@
+import { type WorkspaceAccess } from '@cat-factory/kernel';
+import type { ServerContainer } from './env.js';
+/**
+ * Resolve a signed-in user's effective access to one board. Returns `null` when the board
+ * doesn't exist (the gate then lets the handler 404 on its own, preserving the pre-RBAC
+ * behaviour); otherwise a {@link WorkspaceAccess} decision (`allowed` grant or denial).
+ */
+export declare function loadWorkspaceAccess(container: ServerContainer, workspaceId: string, userId: string): Promise<WorkspaceAccess | null>;
+//# sourceMappingURL=workspaceAccess.d.ts.map

package/dist/http/workspaceAccess.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspaceAccess.d.ts","sourceRoot":"","sources":["../../src/http/workspaceAccess.ts"],"names":[],"mappings":"AAAA,OAAO,EAA0B,KAAK,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAClF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAc/C;;;;GAIG;AACH,wBAAsB,mBAAmB,CACvC,SAAS,EAAE,eAAe,EAC1B,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAoBjC"}

package/dist/http/workspaceAccess.js

@@ -0,0 +1,38 @@
+import { resolveWorkspaceAccess } from '@cat-factory/kernel';
+// ---------------------------------------------------------------------------
+// The single workspace-RBAC resolution point (workspace-rbac initiative). The auth gate
+// (`mountAuthGate`) calls this once per `/workspaces/:ws/*` request; controllers CONSUME
+// the resolved `workspaceAccess` off the context, they never re-derive membership.
+//
+// It performs the three reads `resolveWorkspaceAccess` needs — the board access row, the
+// caller's account roles, and their explicit member row — then hands them to the pure
+// kernel decision function. Legacy boards (`accountId === null`) are owner-only, so the
+// account/member reads are skipped there. The `workspaceAccess` AppCaches slice (a later
+// slice) wraps THIS load; today it reads straight through.
+// ---------------------------------------------------------------------------
+/**
+ * Resolve a signed-in user's effective access to one board. Returns `null` when the board
+ * doesn't exist (the gate then lets the handler 404 on its own, preserving the pre-RBAC
+ * behaviour); otherwise a {@link WorkspaceAccess} decision (`allowed` grant or denial).
+ */
+export async function loadWorkspaceAccess(container, workspaceId, userId) {
+    const accessRow = await container.workspaceService.accessRowOf(workspaceId);
+    if (!accessRow)
+        return null; // missing board → the gate passes through, the handler 404s
+    // Legacy / unscoped board: resolution is owner-only, so the account + member reads are
+    // pointless — pass empty grants and let rule 1 decide.
+    if (accessRow.accountId === null) {
+        return resolveWorkspaceAccess({
+            userId,
+            workspace: accessRow,
+            accountRoles: [],
+            memberRole: null,
+        });
+    }
+    const [accountRoles, memberRole] = await Promise.all([
+        container.accountService.rolesFor(accessRow.accountId, userId),
+        container.workspaceService.memberRoleOf(workspaceId, userId),
+    ]);
+    return resolveWorkspaceAccess({ userId, workspace: accessRow, accountRoles, memberRole });
+}
+//# sourceMappingURL=workspaceAccess.js.map

package/dist/http/workspaceAccess.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspaceAccess.js","sourceRoot":"","sources":["../../src/http/workspaceAccess.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAwB,MAAM,qBAAqB,CAAA;AAGlF,8EAA8E;AAC9E,wFAAwF;AACxF,yFAAyF;AACzF,mFAAmF;AACnF,EAAE;AACF,yFAAyF;AACzF,sFAAsF;AACtF,wFAAwF;AACxF,yFAAyF;AACzF,2DAA2D;AAC3D,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,SAA0B,EAC1B,WAAmB,EACnB,MAAc;IAEd,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,gBAAgB,CAAC,WAAW,CAAC,WAAW,CAAC,CAAA;IAC3E,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAA,CAAC,4DAA4D;IAExF,uFAAuF;IACvF,uDAAuD;IACvD,IAAI,SAAS,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QACjC,OAAO,sBAAsB,CAAC;YAC5B,MAAM;YACN,SAAS,EAAE,SAAS;YACpB,YAAY,EAAE,EAAE;YAChB,UAAU,EAAE,IAAI;SACjB,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACnD,SAAS,CAAC,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC;QAC9D,SAAS,CAAC,gBAAgB,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC;KAC7D,CAAC,CAAA;IACF,OAAO,sBAAsB,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAA;AAC3F,CAAC"}

package/dist/modules/observability/PlatformObservabilityController.d.ts

@@ -0,0 +1,13 @@
+import { Hono } from 'hono';
+import type { AppEnv } from '../../http/env.js';
+/**
+ * Platform-operator observability: `GET /accounts/:accountId/observability/platform` — the
+ * deployment-level aggregate health of an account's runs (outcomes, failure taxonomy,
+ * live/parked depth, duration + trend) over a time window. Admin-gated (cross-workspace
+ * operational data), and 503 when the platform-metrics rollup isn't wired (tests / no store).
+ *
+ * The dual of the per-run observability endpoints in ExecutionController: those answer
+ * "what did THIS run do"; this answers "how is the deployment doing".
+ */
+export declare function platformObservabilityController(): Hono<AppEnv>;
+//# sourceMappingURL=PlatformObservabilityController.d.ts.map

package/dist/modules/observability/PlatformObservabilityController.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PlatformObservabilityController.d.ts","sourceRoot":"","sources":["../../../src/modules/observability/PlatformObservabilityController.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAE3B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAc/C;;;;;;;;GAQG;AACH,wBAAgB,+BAA+B,IAAI,IAAI,CAAC,MAAM,CAAC,CAyB9D"}

package/dist/modules/observability/PlatformObservabilityController.js

@@ -0,0 +1,41 @@
+import { getPlatformObservabilityContract } from '@cat-factory/contracts';
+import { buildHonoRoute } from '@toad-contracts/hono';
+import { Hono } from 'hono';
+/** The signed-in user, or null. Generic over the (contract-typed) env, like AccountController. */
+function accountUser(c) {
+    const user = c.get('user');
+    return user ? { id: user.id, login: user.login, name: user.name } : null;
+}
+const signInRequired = (c) => c.json({ error: { code: 'unauthorized', message: 'Sign in to view platform observability' } }, 401);
+/**
+ * Platform-operator observability: `GET /accounts/:accountId/observability/platform` — the
+ * deployment-level aggregate health of an account's runs (outcomes, failure taxonomy,
+ * live/parked depth, duration + trend) over a time window. Admin-gated (cross-workspace
+ * operational data), and 503 when the platform-metrics rollup isn't wired (tests / no store).
+ *
+ * The dual of the per-run observability endpoints in ExecutionController: those answer
+ * "what did THIS run do"; this answers "how is the deployment doing".
+ */
+export function platformObservabilityController() {
+    const app = new Hono();
+    buildHonoRoute(app, getPlatformObservabilityContract, async (c) => {
+        const user = accountUser(c);
+        if (!user)
+            return signInRequired(c);
+        const container = c.get('container');
+        if (!container.platformObservability) {
+            return c.json({
+                error: {
+                    code: 'unavailable',
+                    message: 'Platform observability is not available on this deployment',
+                },
+            }, 503);
+        }
+        const { accountId } = c.req.valid('param');
+        await container.accountService.requireAdmin(accountId, user.id);
+        const window = c.req.valid('query').window ?? '24h';
+        return c.json(await container.platformObservability.summarize(accountId, window), 200);
+    });
+    return app;
+}
+//# sourceMappingURL=PlatformObservabilityController.js.map

package/dist/modules/observability/PlatformObservabilityController.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PlatformObservabilityController.js","sourceRoot":"","sources":["../../../src/modules/observability/PlatformObservabilityController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,wBAAwB,CAAA;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAI3B,kGAAkG;AAClG,SAAS,WAAW,CAAmB,CAAa;IAClD,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IAC1B,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;AAC1E,CAAC;AAED,MAAM,cAAc,GAAG,CAAmB,CAAa,EAAE,EAAE,CACzD,CAAC,CAAC,IAAI,CACJ,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,wCAAwC,EAAE,EAAE,EACtF,GAAG,CACJ,CAAA;AAEH;;;;;;;;GAQG;AACH,MAAM,UAAU,+BAA+B;IAC7C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAE9B,cAAc,CAAC,GAAG,EAAE,gCAAgC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAChE,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;QAC3B,IAAI,CAAC,IAAI;YAAE,OAAO,cAAc,CAAC,CAAC,CAAC,CAAA;QACnC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QACpC,IAAI,CAAC,SAAS,CAAC,qBAAqB,EAAE,CAAC;YACrC,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE;oBACL,IAAI,EAAE,aAAa;oBACnB,OAAO,EAAE,4DAA4D;iBACtE;aACF,EACD,GAAG,CACJ,CAAA;QACH,CAAC;QACD,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC1C,MAAM,SAAS,CAAC,cAAc,CAAC,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;QAC/D,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,IAAI,KAAK,CAAA;QACnD,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,SAAS,CAAC,qBAAqB,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAA;IACxF,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/modules/workspaces/WorkspaceController.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"WorkspaceController.d.ts","sourceRoot":"","sources":["../../../src/modules/workspaces/WorkspaceController.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAG3B,OAAO,KAAK,EAIV,UAAU,EAIX,MAAM,wBAAwB,CAAA;AA8G/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,wGAAwG;AACxG,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACvD;AAKD,wBAAsB,UAAU,CAC9B,KAAK,EAAE,OAAO,EACd,IAAI,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,EAC5B,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GAC1E,OAAO,CAAC,gBAAgB,GAAG,aAAa,GAAG,YAAY,CAAC,CAwB1D;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB;IAChC,YAAY,CAAC,EAAE;QAAE,iBAAiB,EAAE;YAAE,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;SAAE,CAAA;KAAE,CAAA;IACrF,OAAO,CAAC,EAAE;QAAE,iBAAiB,EAAE;YAAE,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;SAAE,CAAA;KAAE,CAAA;IAChF;;;;;;;;OAQG;IACH,+BAA+B,CAAC,EAAE,OAAO,CAAA;IACzC;;;;;;;;OAQG;IACH,oCAAoC,CAAC,EAAE,OAAO,CAAA;IAC9C,0BAA0B,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CAC9D;AAED,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,iBAAiB,EAC5B,WAAW,EAAE,MAAM,EACnB,MAAM,GAAE,gBAA+B,GACtC,OAAO,CAAC,UAAU,CAAC,CAmBrB;AAcD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAU/C,+DAA+D;AAC/D,wBAAgB,mBAAmB,IAAI,IAAI,CAAC,MAAM,CAAC,CAmOlD"}
+{"version":3,"file":"WorkspaceController.d.ts","sourceRoot":"","sources":["../../../src/modules/workspaces/WorkspaceController.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAG3B,OAAO,KAAK,EAIV,UAAU,EAIX,MAAM,wBAAwB,CAAA;AAgH/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,wGAAwG;AACxG,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACvD;AAKD,wBAAsB,UAAU,CAC9B,KAAK,EAAE,OAAO,EACd,IAAI,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,EAC5B,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GAC1E,OAAO,CAAC,gBAAgB,GAAG,aAAa,GAAG,YAAY,CAAC,CAwB1D;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB;IAChC,YAAY,CAAC,EAAE;QAAE,iBAAiB,EAAE;YAAE,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;SAAE,CAAA;KAAE,CAAA;IACrF,OAAO,CAAC,EAAE;QAAE,iBAAiB,EAAE;YAAE,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;SAAE,CAAA;KAAE,CAAA;IAChF;;;;;;;;OAQG;IACH,+BAA+B,CAAC,EAAE,OAAO,CAAA;IACzC;;;;;;;;OAQG;IACH,oCAAoC,CAAC,EAAE,OAAO,CAAA;IAC9C,0BAA0B,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CAC9D;AAED,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,iBAAiB,EAC5B,WAAW,EAAE,MAAM,EACnB,MAAM,GAAE,gBAA+B,GACtC,OAAO,CAAC,UAAU,CAAC,CAmBrB;AAcD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AA8C/C,+DAA+D;AAC/D,wBAAgB,mBAAmB,IAAI,IAAI,CAAC,MAAM,CAAC,CA+QlD"}

package/dist/modules/workspaces/WorkspaceController.js

@@ -3,6 +3,7 @@ import { configContributionCatalog } from '@cat-factory/agents';
 import { buildHonoRoute } from '@toad-contracts/hono';
 import { Hono } from 'hono';
 import { logger as sharedLogger } from '../../observability/logger.js';
+import { resolveWorkspaceAccess } from '@cat-factory/kernel';
 /**
  * Assemble the account- and user-tier spend widgets for a snapshot: the account-tier
  * status (across the owning account's workspaces), the signed-in caller's user-tier
@@ -131,26 +132,78 @@ function deploymentModelDefaults(routing) {
     };
 }
 import { param } from '../../http/params.js';
+import { loadWorkspaceAccess } from '../../http/workspaceAccess.js';
 import { redactBoard, resolveDeniedFrameIds } from './redactFrames.js';
 /** The signed-in user, narrowed to what the tenancy layer needs. */
 function accountUser(c) {
     const user = c.get('user');
     return user ? { id: user.id, login: user.login, name: user.name } : null;
 }
+/**
+ * The caller's EFFECTIVE workspace role for a board in `GET /workspaces`, computed in-memory
+ * from the visibility scopes + one batched member-row read (no per-board round-trip). Reuses
+ * the SAME `resolveWorkspaceAccess` decision the gate runs, so the badge can't drift from
+ * enforcement. Only `admin`-ness and membership of an account matter to resolution, so the
+ * synthetic account-role stand-in (`['admin']` / `['developer']` / `[]`) is faithful. A legacy
+ * board only appears in the list when the caller owns it, so it resolves to `admin` directly.
+ * `undefined` ⇒ no role to badge (a board reachable purely via account membership in account
+ * mode still resolves to `member`, so `undefined` is effectively unreachable for a listed board
+ * — kept for a denied edge that never surfaces).
+ */
+function effectiveWorkspaceRole(userId, workspace, ctx) {
+    if (workspace.accountId === null)
+        return 'admin';
+    const accountRoles = ctx.adminSet.has(workspace.accountId)
+        ? ['admin']
+        : ctx.accountSet.has(workspace.accountId)
+            ? ['developer']
+            : [];
+    const access = resolveWorkspaceAccess({
+        userId,
+        workspace: {
+            accountId: workspace.accountId,
+            ownerUserId: null,
+            accessMode: workspace.accessMode ?? 'account',
+        },
+        accountRoles,
+        memberRole: ctx.memberRole,
+    });
+    return access.allowed ? access.role : undefined;
+}
 /** Board (workspace) lifecycle and full-snapshot retrieval. */
 export function workspaceController() {
     const app = new Hono();
-    // Boards visible to the signed-in user: those in any account they belong to,
-    // plus any legacy board they personally own. When auth is disabled (`user`
-    // unset) the scope is null → no scoping (every board, dev behaviour).
+    // Boards visible to the signed-in user (see WorkspaceVisibility): unrestricted boards in
+    // accounts they belong to, ANY board in accounts they admin (escape hatch), boards they
+    // hold an explicit member row on, and legacy boards they personally own. When auth is
+    // disabled (`user` unset) the scope is null → no scoping (every board, dev behaviour). Each
+    // returned board is annotated with the caller's EFFECTIVE workspace role (`viewerRole`) via
+    // one batched member-row read combined with the in-memory account-scope map.
     buildHonoRoute(app, listWorkspacesContract, async (c) => {
         const container = c.get('container');
         const user = accountUser(c);
         if (!user)
             return c.json(await container.workspaceService.list(null), 200);
         await container.accountService.ensurePersonalAccount(user);
-        const accountIds = await container.accountService.accessibleAccountIds(user.id);
-        return c.json(await container.workspaceService.list({ accountIds, ownerUserId: user.id }), 200);
+        const { accountIds, adminAccountIds } = await container.accountService.accessibleAccountScopes(user.id);
+        const boards = await container.workspaceService.list({
+            accountIds,
+            adminAccountIds,
+            ownerUserId: user.id,
+            userId: user.id,
+        });
+        const memberRoles = await container.workspaceService.rolesForUserInWorkspaces(user.id, boards.map((w) => w.id));
+        const accountSet = new Set(accountIds);
+        const adminSet = new Set(adminAccountIds);
+        const annotated = boards.map((w) => {
+            const role = effectiveWorkspaceRole(user.id, w, {
+                accountSet,
+                adminSet,
+                memberRole: memberRoles.get(w.id) ?? null,
+            });
+            return role ? { ...w, viewerRole: role } : w;
+        });
+        return c.json(annotated, 200);
     });
     buildHonoRoute(app, createWorkspaceContract, async (c) => {
         const container = c.get('container');
@@ -187,10 +240,19 @@ export function workspaceController() {
         // app-owned registry the container carries — identical for every workspace and both facades —
         // attached here in the shared controller (like `customAgentKinds`) rather than per-facade.
         const initiativePresets = container.initiativePresetRegistry.descriptors();
+        // The creator's resolved access. The gate doesn't run for the id-less create route, so resolve
+        // it here (the creator is auto-enrolled admin, so this is always an admin grant when signed in).
+        const resolved = user
+            ? await loadWorkspaceAccess(container, snapshot.workspace.id, user.id)
+            : null;
+        const access = resolved && resolved.allowed
+            ? { role: resolved.role, permissions: [...resolved.permissions] }
+            : undefined;
         return c.json({
             ...snapshot,
             spend,
             ...budgetTiers,
+            ...(access ? { access } : {}),
             agentConfigCatalog: snapshotAgentConfigCatalog(snapshot, container.agentKindRegistry),
             deploymentModelDefaults: deploymentModelDefaults(container.config.agents.routing),
             ...(customAgentKinds ? { customAgentKinds } : {}),
@@ -300,11 +362,18 @@ export function workspaceController() {
             accountId: budgetAccountId,
             viewerUserId: c.get('user')?.id,
         });
+        // The caller's resolved workspace-RBAC access, published by the gate — zero extra reads.
+        // Absent under dev-open (no signed-in user) ⇒ omitted ⇒ the SPA allows all (backend-parity).
+        const resolvedAccess = c.get('workspaceAccess');
+        const access = resolvedAccess && resolvedAccess.workspaceId === workspaceId
+            ? { role: resolvedAccess.role, permissions: [...resolvedAccess.permissions] }
+            : undefined;
         return c.json({
             ...snapshot,
             blocks: redacted.blocks,
             executions: redacted.executions,
             spend,
+            ...(access ? { access } : {}),
             ...budgetTiers,
             ...(redacted.bootstrapJobs ? { bootstrapJobs: redacted.bootstrapJobs } : {}),
             ...(envConfigRepairJobs ? { envConfigRepairJobs } : {}),

package/dist/modules/workspaces/WorkspaceController.js.map

@@ -1 +1 @@
-{"version":3,"file":"WorkspaceController.js","sourceRoot":"","sources":["../../../src/modules/workspaces/WorkspaceController.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,EAAE,MAAM,IAAI,YAAY,EAAE,MAAM,+BAA+B,CAAA;AAetE;;;;;;;;;;GAUG;AACH,KAAK,UAAU,mBAAmB,CAChC,SAA0B,EAC1B,IAAgF;IAOhF,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,IAAI,CAAA;IACxC,MAAM,kBAAkB,GACtB,YAAY,IAAI,SAAS,CAAC,YAAY;QACpC,CAAC,CAAC,MAAM,SAAS,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;QAC/E,CAAC,CAAC,SAAS,CAAA;IACf,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAClD,SAAS;YACP,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;YACnE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;QACzB,YAAY;YACV,CAAC,CAAC,SAAS,CAAC,YAAY;iBACnB,UAAU,CACT,YAAY,EACZ,kBAAkB;gBAChB,CAAC,CAAC,EAAE,eAAe,EAAE,kBAAkB,CAAC,iBAAiB,EAAE;gBAC3D,CAAC,CAAC,SAAS,CACd;iBACA,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;YACtB,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;KAC1B,CAAC,CAAA;IACF,OAAO;QACL,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,UAAU,EAAE,SAAS,CAAC,YAAY,CAAC,UAAU,EAAE;KAChD,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,0BAA0B,CAAC,QAA2B,EAAE,QAA2B;IAC1F,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAA;IAC/B,KAAK,MAAM,QAAQ,IAAI,QAAQ,CAAC,SAAS;QAAE,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,UAAU;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAClG,OAAO,yBAAyB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;AACnD,CAAC;AAED;;;;GAIG;AACH;;;;;;GAMG;AACH,SAAS,wBAAwB,CAAC,QAA2B;IAC3D,MAAM,KAAK,GAAG,QAAQ;SACnB,GAAG,EAAE;SACL,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC;SACjC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACb,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,YAAY,EAAE,GAAG,CAAC,YAAa;QAC/B,SAAS,EAAE,QAAQ,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC;KAChD,CAAC,CAAC,CAAA;IACL,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;AAC7C,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAAC,UAG7B;IAIC,OAAO;QACL,uBAAuB,EAAE,UAAU,CAAC,0BAA0B,CAAC,QAAQ,EAAE;QACzE,kBAAkB,EAAE,UAAU,CAAC,qBAAqB,CAAC,QAAQ,EAAE;KAChE,CAAA;AACH,CAAC;AAuCD,oGAAoG;AACpG,MAAM,qBAAqB,GAAG,IAAI,CAAA;AAElC,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,KAAc,EACd,IAA4B,EAC5B,IAAI,GAAqE,EAAE;IAE3E,IAAI,CAAC,KAAK;QAAE,OAAO,gBAAgB,CAAA;IACnC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,qBAAqB,CAAA;IACzD,IAAI,KAAgD,CAAA;IACpD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YAChC,IAAI,EAAE;YACN,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;gBAC/B,KAAK,GAAG,UAAU,CAChB,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,qCAAqC,SAAS,IAAI,CAAC,CAAC,EAC3E,SAAS,CACV,CAAA;YACH,CAAC,CAAC;SACH,CAAC,CAAA;QACF,OAAO,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,aAAa,CAAA;IAC9C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,MAAM,EAAE,IAAI,CACf,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAC1E,4DAA4D,CAC7D,CAAA;QACD,OAAO,gBAAgB,CAAA;IACzB,CAAC;YAAS,CAAC;QACT,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAA;IAChC,CAAC;AACH,CAAC;AAsCD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,SAA4B,EAC5B,WAAmB,EACnB,MAAM,GAAqB,YAAY;IAEvC,MAAM,CAAC,qBAAqB,EAAE,aAAa,EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC9E,UAAU,CACR,CAAC,CAAC,SAAS,CAAC,YAAY,IAAI,CAAC,SAAS,CAAC,oCAAoC,IAAI,IAAI,CAAC,EACpF,GAAG,EAAE,CAAC,SAAS,CAAC,YAAa,CAAC,iBAAiB,CAAC,aAAa,CAAC,WAAW,CAAC,EAC1E,EAAE,IAAI,EAAE,uBAAuB,EAAE,MAAM,EAAE,CAC1C;QACD,UAAU,CACR,CAAC,CAAC,SAAS,CAAC,OAAO,IAAI,CAAC,CAAC,SAAS,CAAC,+BAA+B,EAClE,GAAG,EAAE,CAAC,SAAS,CAAC,OAAQ,CAAC,iBAAiB,CAAC,aAAa,CAAC,WAAW,CAAC,EACrE,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,CAClC;QACD,UAAU,CACR,CAAC,CAAC,SAAS,CAAC,0BAA0B,EACtC,GAAG,EAAE,CAAC,SAAS,CAAC,0BAA2B,CAAC,WAAW,CAAC,EACxD,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,CAClC;KACF,CAAC,CAAA;IACF,OAAO,EAAE,qBAAqB,EAAE,aAAa,EAAE,aAAa,EAAE,CAAA;AAChE,CAAC;AAED,SAAS,uBAAuB,CAAC,OAAqB;IACpD,MAAM,GAAG,GAAG,CAAC,CAAW,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,EAAE,CAAA;IACvD,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC;QACjC,MAAM,EAAE,MAAM,CAAC,WAAW,CACxB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;aAC3B,MAAM,CAAC,CAAC,KAAK,EAAqD,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;aACtF,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAC9C;KACF,CAAA;AACH,CAAC;AAGD,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAC5C,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAA;AAEtE,oEAAoE;AACpE,SAAS,WAAW,CAAmB,CAAa;IAClD,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IAC1B,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;AAC1E,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,mBAAmB;IACjC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAE9B,6EAA6E;IAC7E,2EAA2E;IAC3E,sEAAsE;IACtE,cAAc,CAAC,GAAG,EAAE,sBAAsB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QACpC,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;QAC3B,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,SAAS,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAA;QAC1E,MAAM,SAAS,CAAC,cAAc,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAA;QAC1D,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,cAAc,CAAC,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC/E,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,SAAS,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,CAAA;IACjG,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QACpC,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;QAC3B,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAEhC,8EAA8E;QAC9E,4EAA4E;QAC5E,IAAI,SAAS,GAAkB,IAAI,CAAA;QACnC,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBACnB,2EAA2E;gBAC3E,MAAM,SAAS,CAAC,cAAc,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;gBACrE,SAAS,GAAG,IAAI,CAAC,SAAS,CAAA;YAC5B,CAAC;iBAAM,CAAC;gBACN,SAAS,GAAG,CAAC,MAAM,SAAS,CAAC,cAAc,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;YAC7E,CAAC;QACH,CAAC;aAAM,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YAC1B,SAAS,GAAG,IAAI,CAAC,SAAS,CAAA;QAC5B,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,IAAI,EAAE,SAAS,CAAC,CAAA;QAC3F,kFAAkF;QAClF,qFAAqF;QACrF,mFAAmF;QACnF,mFAAmF;QACnF,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACzD,SAAS,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACpD,kBAAkB,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACpD,mBAAmB,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;SACtE,CAAC,CAAA;QACF,MAAM,gBAAgB,GAAG,wBAAwB,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAA;QAC9E,iGAAiG;QACjG,8FAA8F;QAC9F,2FAA2F;QAC3F,MAAM,iBAAiB,GAAG,SAAS,CAAC,wBAAwB,CAAC,WAAW,EAAE,CAAA;QAC1E,OAAO,CAAC,CAAC,IAAI,CACX;YACE,GAAG,QAAQ;YACX,KAAK;YACL,GAAG,WAAW;YACd,kBAAkB,EAAE,0BAA0B,CAAC,QAAQ,EAAE,SAAS,CAAC,iBAAiB,CAAC;YACrF,uBAAuB,EAAE,uBAAuB,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;YACjF,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,oBAAoB,CAAC,SAAS,CAAC;YAClC,UAAU;SACX,EACD,GAAG,CACJ,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACpD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QACpC,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAA;QAC3C,uFAAuF;QACvF,iFAAiF;QACjF,MAAM,eAAe,GAAG,MAAM,SAAS,CAAC,gBAAgB,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;QAC/E,oFAAoF;QACpF,+EAA+E;QAC/E,qFAAqF;QACrF,MAAM,CACJ,QAAQ,EACR,KAAK;QACL,+EAA+E;QAC/E,kFAAkF;QAClF,8CAA8C;QAC9C,aAAa;QACb,kFAAkF;QAClF,sFAAsF;QACtF,mBAAmB;QACnB,uFAAuF;QACvF,kFAAkF;QAClF,mBAAmB;QACnB,6EAA6E;QAC7E,uDAAuD;QACvD,aAAa,EACb,YAAY;QACZ,iFAAiF;QACjF,gFAAgF;QAChF,uBAAuB;QACvB,YAAY;QACZ,8EAA8E;QAC9E,8EAA8E;QAC9E,gFAAgF;QAChF,0BAA0B;QAC1B,YAAY;QACZ,iFAAiF;QACjF,uBAAuB;QACvB,8EAA8E;QAC9E,gFAAgF;QAChF,+BAA+B;QAC/B,kBAAkB,EAClB,eAAe;QACf,gFAAgF;QAChF,qDAAqD;QACrD,WAAW;QACX,kFAAkF;QAClF,gEAAgE;QAChE,QAAQ;QACR,gFAAgF;QAChF,qFAAqF;QACrF,MAAM,EACN,cAAc,EACd,UAAU;QACV,oFAAoF;QACpF,yFAAyF;QACzF,2DAA2D;QAC3D,eAAe,EAChB,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACpB,SAAS,CAAC,gBAAgB,CAAC,QAAQ,CAAC,WAAW,CAAC;YAChD,SAAS,CAAC,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC;YAC1C,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;YAClD,SAAS,CAAC,eAAe,EAAE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;YACxD,SAAS,CAAC,YAAY,EAAE,eAAe,EAAE,WAAW,CAAC,WAAW,CAAC;YACjE,SAAS,CAAC,aAAa,EAAE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;YACtD,SAAS,CAAC,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;YACjD,SAAS,CAAC,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;YACjD,SAAS,CAAC,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;YACjD,SAAS,CAAC,uBAAuB,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;YAC3D,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;YAC9C,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;YAC3C,SAAS,CAAC,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;YAChD,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;YAC5C,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC;YACnD,SAAS,CAAC,QAAQ,IAAI,eAAe,KAAK,SAAS;gBACjD,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,eAAe,CAAC;gBAC5D,CAAC,CAAC,SAAS;YACb,kBAAkB,CAAC,SAAS,EAAE,WAAW,CAAC;YAC1C,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS;SAC/E,CAAC,CAAA;QACF,MAAM,gBAAgB,GAAG,wBAAwB,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAA;QAC9E,iGAAiG;QACjG,8FAA8F;QAC9F,2FAA2F;QAC3F,MAAM,iBAAiB,GAAG,SAAS,CAAC,wBAAwB,CAAC,WAAW,EAAE,CAAA;QAE1E,4FAA4F;QAC5F,4FAA4F;QAC5F,4FAA4F;QAC5F,qCAAqC;QACrC,MAAM,cAAc,GAAG,MAAM,qBAAqB,CAAC;YACjD,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE;YAC/B,QAAQ,EAAE,cAAc,IAAI,EAAE;YAC9B,KAAK,EAAE,eAAe,IAAI,EAAE;YAC5B,cAAc,EAAE,SAAS,CAAC,cAAc;SACzC,CAAC,CAAA;QACF,MAAM,QAAQ,GAAG,WAAW,CAC1B;YACE,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,QAAQ,EAAE,cAAc;YACxB,aAAa;YACb,aAAa;SACd,EACD,cAAc,CACf,CAAA;QAED,oFAAoF;QACpF,wFAAwF;QACxF,0FAA0F;QAC1F,MAAM,WAAW,GAAG,MAAM,mBAAmB,CAAC,SAAS,EAAE;YACvD,SAAS,EAAE,eAAe;YAC1B,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE;SAChC,CAAC,CAAA;QAEF,OAAO,CAAC,CAAC,IAAI,CACX;YACE,GAAG,QAAQ;YACX,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,KAAK;YACL,GAAG,WAAW;YACd,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC,EAAE,uBAAuB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7B,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,kBAAkB,EAAE,0BAA0B,CAAC,QAAQ,EAAE,SAAS,CAAC,iBAAiB,CAAC;YACrF,uBAAuB,EAAE,uBAAuB,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;YACjF,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,oBAAoB,CAAC,SAAS,CAAC;YAClC,UAAU;SACX,EACD,GAAG,CACJ,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvD,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAChC,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE;YAC1F,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,GAAG,CAAC,aAAa,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpE,CAAC,CAAA;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;IAC/B,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvD,MAAM,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,CAAA;QACzE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC"}
+{"version":3,"file":"WorkspaceController.js","sourceRoot":"","sources":["../../../src/modules/workspaces/WorkspaceController.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,EAAE,MAAM,IAAI,YAAY,EAAE,MAAM,+BAA+B,CAAA;AAYtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAA;AAK5D;;;;;;;;;;GAUG;AACH,KAAK,UAAU,mBAAmB,CAChC,SAA0B,EAC1B,IAAgF;IAOhF,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,IAAI,CAAA;IACxC,MAAM,kBAAkB,GACtB,YAAY,IAAI,SAAS,CAAC,YAAY;QACpC,CAAC,CAAC,MAAM,SAAS,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;QAC/E,CAAC,CAAC,SAAS,CAAA;IACf,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAClD,SAAS;YACP,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;YACnE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;QACzB,YAAY;YACV,CAAC,CAAC,SAAS,CAAC,YAAY;iBACnB,UAAU,CACT,YAAY,EACZ,kBAAkB;gBAChB,CAAC,CAAC,EAAE,eAAe,EAAE,kBAAkB,CAAC,iBAAiB,EAAE;gBAC3D,CAAC,CAAC,SAAS,CACd;iBACA,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;YACtB,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;KAC1B,CAAC,CAAA;IACF,OAAO;QACL,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,UAAU,EAAE,SAAS,CAAC,YAAY,CAAC,UAAU,EAAE;KAChD,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,0BAA0B,CAAC,QAA2B,EAAE,QAA2B;IAC1F,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAA;IAC/B,KAAK,MAAM,QAAQ,IAAI,QAAQ,CAAC,SAAS;QAAE,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,UAAU;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAClG,OAAO,yBAAyB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;AACnD,CAAC;AAED;;;;GAIG;AACH;;;;;;GAMG;AACH,SAAS,wBAAwB,CAAC,QAA2B;IAC3D,MAAM,KAAK,GAAG,QAAQ;SACnB,GAAG,EAAE;SACL,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC;SACjC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACb,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,YAAY,EAAE,GAAG,CAAC,YAAa;QAC/B,SAAS,EAAE,QAAQ,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC;KAChD,CAAC,CAAC,CAAA;IACL,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;AAC7C,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAAC,UAG7B;IAIC,OAAO;QACL,uBAAuB,EAAE,UAAU,CAAC,0BAA0B,CAAC,QAAQ,EAAE;QACzE,kBAAkB,EAAE,UAAU,CAAC,qBAAqB,CAAC,QAAQ,EAAE;KAChE,CAAA;AACH,CAAC;AAuCD,oGAAoG;AACpG,MAAM,qBAAqB,GAAG,IAAI,CAAA;AAElC,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,KAAc,EACd,IAA4B,EAC5B,IAAI,GAAqE,EAAE;IAE3E,IAAI,CAAC,KAAK;QAAE,OAAO,gBAAgB,CAAA;IACnC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,qBAAqB,CAAA;IACzD,IAAI,KAAgD,CAAA;IACpD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YAChC,IAAI,EAAE;YACN,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;gBAC/B,KAAK,GAAG,UAAU,CAChB,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,qCAAqC,SAAS,IAAI,CAAC,CAAC,EAC3E,SAAS,CACV,CAAA;YACH,CAAC,CAAC;SACH,CAAC,CAAA;QACF,OAAO,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,aAAa,CAAA;IAC9C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,MAAM,EAAE,IAAI,CACf,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAC1E,4DAA4D,CAC7D,CAAA;QACD,OAAO,gBAAgB,CAAA;IACzB,CAAC;YAAS,CAAC;QACT,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAA;IAChC,CAAC;AACH,CAAC;AAsCD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,SAA4B,EAC5B,WAAmB,EACnB,MAAM,GAAqB,YAAY;IAEvC,MAAM,CAAC,qBAAqB,EAAE,aAAa,EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC9E,UAAU,CACR,CAAC,CAAC,SAAS,CAAC,YAAY,IAAI,CAAC,SAAS,CAAC,oCAAoC,IAAI,IAAI,CAAC,EACpF,GAAG,EAAE,CAAC,SAAS,CAAC,YAAa,CAAC,iBAAiB,CAAC,aAAa,CAAC,WAAW,CAAC,EAC1E,EAAE,IAAI,EAAE,uBAAuB,EAAE,MAAM,EAAE,CAC1C;QACD,UAAU,CACR,CAAC,CAAC,SAAS,CAAC,OAAO,IAAI,CAAC,CAAC,SAAS,CAAC,+BAA+B,EAClE,GAAG,EAAE,CAAC,SAAS,CAAC,OAAQ,CAAC,iBAAiB,CAAC,aAAa,CAAC,WAAW,CAAC,EACrE,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,CAClC;QACD,UAAU,CACR,CAAC,CAAC,SAAS,CAAC,0BAA0B,EACtC,GAAG,EAAE,CAAC,SAAS,CAAC,0BAA2B,CAAC,WAAW,CAAC,EACxD,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,CAClC;KACF,CAAC,CAAA;IACF,OAAO,EAAE,qBAAqB,EAAE,aAAa,EAAE,aAAa,EAAE,CAAA;AAChE,CAAC;AAED,SAAS,uBAAuB,CAAC,OAAqB;IACpD,MAAM,GAAG,GAAG,CAAC,CAAW,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,EAAE,CAAA;IACvD,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC;QACjC,MAAM,EAAE,MAAM,CAAC,WAAW,CACxB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;aAC3B,MAAM,CAAC,CAAC,KAAK,EAAqD,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;aACtF,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAC9C;KACF,CAAA;AACH,CAAC;AAGD,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAC5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAA;AACnE,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAA;AAEtE,oEAAoE;AACpE,SAAS,WAAW,CAAmB,CAAa;IAClD,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IAC1B,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;AAC1E,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,sBAAsB,CAC7B,MAAc,EACd,SAAoB,EACpB,GAAyF;IAEzF,IAAI,SAAS,CAAC,SAAS,KAAK,IAAI;QAAE,OAAO,OAAO,CAAA;IAChD,MAAM,YAAY,GAAkB,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC;QACvE,CAAC,CAAC,CAAC,OAAO,CAAC;QACX,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC;YACvC,CAAC,CAAC,CAAC,WAAW,CAAC;YACf,CAAC,CAAC,EAAE,CAAA;IACR,MAAM,MAAM,GAAG,sBAAsB,CAAC;QACpC,MAAM;QACN,SAAS,EAAE;YACT,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,WAAW,EAAE,IAAI;YACjB,UAAU,EAAE,SAAS,CAAC,UAAU,IAAI,SAAS;SAC9C;QACD,YAAY;QACZ,UAAU,EAAE,GAAG,CAAC,UAAU;KAC3B,CAAC,CAAA;IACF,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;AACjD,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,mBAAmB;IACjC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAE9B,yFAAyF;IACzF,wFAAwF;IACxF,sFAAsF;IACtF,4FAA4F;IAC5F,4FAA4F;IAC5F,6EAA6E;IAC7E,cAAc,CAAC,GAAG,EAAE,sBAAsB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QACpC,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;QAC3B,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,SAAS,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAA;QAC1E,MAAM,SAAS,CAAC,cAAc,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAA;QAC1D,MAAM,EAAE,UAAU,EAAE,eAAe,EAAE,GAAG,MAAM,SAAS,CAAC,cAAc,CAAC,uBAAuB,CAC5F,IAAI,CAAC,EAAE,CACR,CAAA;QACD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,gBAAgB,CAAC,IAAI,CAAC;YACnD,UAAU;YACV,eAAe;YACf,WAAW,EAAE,IAAI,CAAC,EAAE;YACpB,MAAM,EAAE,IAAI,CAAC,EAAE;SAChB,CAAC,CAAA;QACF,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,gBAAgB,CAAC,wBAAwB,CAC3E,IAAI,CAAC,EAAE,EACP,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACxB,CAAA;QACD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAA;QACtC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAA;QACzC,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACjC,MAAM,IAAI,GAAG,sBAAsB,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,EAAE;gBAC9C,UAAU;gBACV,QAAQ;gBACR,UAAU,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,IAAI;aAC1C,CAAC,CAAA;YACF,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;QAC9C,CAAC,CAAC,CAAA;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;IAC/B,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QACpC,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;QAC3B,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAEhC,8EAA8E;QAC9E,4EAA4E;QAC5E,IAAI,SAAS,GAAkB,IAAI,CAAA;QACnC,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBACnB,2EAA2E;gBAC3E,MAAM,SAAS,CAAC,cAAc,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;gBACrE,SAAS,GAAG,IAAI,CAAC,SAAS,CAAA;YAC5B,CAAC;iBAAM,CAAC;gBACN,SAAS,GAAG,CAAC,MAAM,SAAS,CAAC,cAAc,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;YAC7E,CAAC;QACH,CAAC;aAAM,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YAC1B,SAAS,GAAG,IAAI,CAAC,SAAS,CAAA;QAC5B,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,IAAI,EAAE,SAAS,CAAC,CAAA;QAC3F,kFAAkF;QAClF,qFAAqF;QACrF,mFAAmF;QACnF,mFAAmF;QACnF,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACzD,SAAS,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACpD,kBAAkB,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACpD,mBAAmB,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;SACtE,CAAC,CAAA;QACF,MAAM,gBAAgB,GAAG,wBAAwB,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAA;QAC9E,iGAAiG;QACjG,8FAA8F;QAC9F,2FAA2F;QAC3F,MAAM,iBAAiB,GAAG,SAAS,CAAC,wBAAwB,CAAC,WAAW,EAAE,CAAA;QAC1E,+FAA+F;QAC/F,iGAAiG;QACjG,MAAM,QAAQ,GAAG,IAAI;YACnB,CAAC,CAAC,MAAM,mBAAmB,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC;YACtE,CAAC,CAAC,IAAI,CAAA;QACR,MAAM,MAAM,GACV,QAAQ,IAAI,QAAQ,CAAC,OAAO;YAC1B,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,GAAG,QAAQ,CAAC,WAAW,CAAC,EAAE;YACjE,CAAC,CAAC,SAAS,CAAA;QACf,OAAO,CAAC,CAAC,IAAI,CACX;YACE,GAAG,QAAQ;YACX,KAAK;YACL,GAAG,WAAW;YACd,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7B,kBAAkB,EAAE,0BAA0B,CAAC,QAAQ,EAAE,SAAS,CAAC,iBAAiB,CAAC;YACrF,uBAAuB,EAAE,uBAAuB,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;YACjF,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,oBAAoB,CAAC,SAAS,CAAC;YAClC,UAAU;SACX,EACD,GAAG,CACJ,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACpD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QACpC,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAA;QAC3C,uFAAuF;QACvF,iFAAiF;QACjF,MAAM,eAAe,GAAG,MAAM,SAAS,CAAC,gBAAgB,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;QAC/E,oFAAoF;QACpF,+EAA+E;QAC/E,qFAAqF;QACrF,MAAM,CACJ,QAAQ,EACR,KAAK;QACL,+EAA+E;QAC/E,kFAAkF;QAClF,8CAA8C;QAC9C,aAAa;QACb,kFAAkF;QAClF,sFAAsF;QACtF,mBAAmB;QACnB,uFAAuF;QACvF,kFAAkF;QAClF,mBAAmB;QACnB,6EAA6E;QAC7E,uDAAuD;QACvD,aAAa,EACb,YAAY;QACZ,iFAAiF;QACjF,gFAAgF;QAChF,uBAAuB;QACvB,YAAY;QACZ,8EAA8E;QAC9E,8EAA8E;QAC9E,gFAAgF;QAChF,0BAA0B;QAC1B,YAAY;QACZ,iFAAiF;QACjF,uBAAuB;QACvB,8EAA8E;QAC9E,gFAAgF;QAChF,+BAA+B;QAC/B,kBAAkB,EAClB,eAAe;QACf,gFAAgF;QAChF,qDAAqD;QACrD,WAAW;QACX,kFAAkF;QAClF,gEAAgE;QAChE,QAAQ;QACR,gFAAgF;QAChF,qFAAqF;QACrF,MAAM,EACN,cAAc,EACd,UAAU;QACV,oFAAoF;QACpF,yFAAyF;QACzF,2DAA2D;QAC3D,eAAe,EAChB,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACpB,SAAS,CAAC,gBAAgB,CAAC,QAAQ,CAAC,WAAW,CAAC;YAChD,SAAS,CAAC,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC;YAC1C,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;YAClD,SAAS,CAAC,eAAe,EAAE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;YACxD,SAAS,CAAC,YAAY,EAAE,eAAe,EAAE,WAAW,CAAC,WAAW,CAAC;YACjE,SAAS,CAAC,aAAa,EAAE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;YACtD,SAAS,CAAC,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;YACjD,SAAS,CAAC,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;YACjD,SAAS,CAAC,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;YACjD,SAAS,CAAC,uBAAuB,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;YAC3D,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;YAC9C,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;YAC3C,SAAS,CAAC,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;YAChD,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;YAC5C,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC;YACnD,SAAS,CAAC,QAAQ,IAAI,eAAe,KAAK,SAAS;gBACjD,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,eAAe,CAAC;gBAC5D,CAAC,CAAC,SAAS;YACb,kBAAkB,CAAC,SAAS,EAAE,WAAW,CAAC;YAC1C,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS;SAC/E,CAAC,CAAA;QACF,MAAM,gBAAgB,GAAG,wBAAwB,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAA;QAC9E,iGAAiG;QACjG,8FAA8F;QAC9F,2FAA2F;QAC3F,MAAM,iBAAiB,GAAG,SAAS,CAAC,wBAAwB,CAAC,WAAW,EAAE,CAAA;QAE1E,4FAA4F;QAC5F,4FAA4F;QAC5F,4FAA4F;QAC5F,qCAAqC;QACrC,MAAM,cAAc,GAAG,MAAM,qBAAqB,CAAC;YACjD,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE;YAC/B,QAAQ,EAAE,cAAc,IAAI,EAAE;YAC9B,KAAK,EAAE,eAAe,IAAI,EAAE;YAC5B,cAAc,EAAE,SAAS,CAAC,cAAc;SACzC,CAAC,CAAA;QACF,MAAM,QAAQ,GAAG,WAAW,CAC1B;YACE,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,QAAQ,EAAE,cAAc;YACxB,aAAa;YACb,aAAa;SACd,EACD,cAAc,CACf,CAAA;QAED,oFAAoF;QACpF,wFAAwF;QACxF,0FAA0F;QAC1F,MAAM,WAAW,GAAG,MAAM,mBAAmB,CAAC,SAAS,EAAE;YACvD,SAAS,EAAE,eAAe;YAC1B,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE;SAChC,CAAC,CAAA;QAEF,yFAAyF;QACzF,6FAA6F;QAC7F,MAAM,cAAc,GAAG,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAA;QAC/C,MAAM,MAAM,GACV,cAAc,IAAI,cAAc,CAAC,WAAW,KAAK,WAAW;YAC1D,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,GAAG,cAAc,CAAC,WAAW,CAAC,EAAE;YAC7E,CAAC,CAAC,SAAS,CAAA;QAEf,OAAO,CAAC,CAAC,IAAI,CACX;YACE,GAAG,QAAQ;YACX,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,KAAK;YACL,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7B,GAAG,WAAW;YACd,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC,EAAE,uBAAuB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7B,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,kBAAkB,EAAE,0BAA0B,CAAC,QAAQ,EAAE,SAAS,CAAC,iBAAiB,CAAC;YACrF,uBAAuB,EAAE,uBAAuB,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;YACjF,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,oBAAoB,CAAC,SAAS,CAAC;YAClC,UAAU;SACX,EACD,GAAG,CACJ,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvD,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAChC,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE;YAC1F,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,GAAG,CAAC,aAAa,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpE,CAAC,CAAA;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;IAC/B,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvD,MAAM,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,CAAA;QACzE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/persistence/rpc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rpc.d.ts","sourceRoot":"","sources":["../../src/persistence/rpc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,KAAK,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAyBvE,4CAA4C;AAC5C,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,OAAO,EAAE,CAAA;CAChB;AAED,oGAAoG;AACpG,UAAU,UAAU;IAClB,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;CACZ;AAED,MAAM,MAAM,sBAAsB,GAC9B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,UAAU,CAAA;CAAE,GACnE;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,mBAAmB,CAAA;CAAE,CAAA;AAE7C,wFAAwF;AACxF,MAAM,MAAM,oBAAoB,GAAG,eAAe,GAAG,WAAW,GAAG,gBAAgB,GAAG,UAAU,CAAA;AAEhG,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,oBAAoB,CAAA;IAC1B,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAClC;AAcD,0FAA0F;AAC1F,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,oBAAoB,GAAG,MAAM,CAE5E;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsEG;AACH,MAAM,MAAM,SAAS,GACjB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACvC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAChC;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC7B;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAChC;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACjD;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAA;AAEvC,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,SAAS,CAAA;IAChB,qFAAqF;IACrF,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,2FAA2F;AAC3F,MAAM,MAAM,sBAAsB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAA;AAE/E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,0BAA0B,EAAE,sBAgwBxC,CAAA;AAMD,qFAAqF;AACrF,MAAM,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,CAAC,CAAA;AAEjG,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,gEAAgE;IAChE,KAAK,EAAE;QAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;IAC/C,kGAAkG;IAClG,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAA;IACzE;;;OAGG;IACH,qBAAqB,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAA;IAC3E;;;;OAIG;IACH,sBAAsB,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC,CAAA;IAC5F;;;;OAIG;IACH,wBAAwB,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC,CAAA;IAChG;;;;;OAKG;IACH,uBAAuB,CAAC,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;IAC9D,4EAA4E;IAC5E,KAAK,CAAC,EAAE,sBAAsB,CAAA;CAC/B;AAED,wFAAwF;AACxF,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,sBAAsB,CAAA;CAC7B;AAgBD;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,qBAAqB,EAC9B,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,cAAc,CAAC,CAsRzB;AAED,yEAAyE;AACzE,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,mBAAmB,GAAG,KAAK,CAW7E"}
+{"version":3,"file":"rpc.d.ts","sourceRoot":"","sources":["../../src/persistence/rpc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,KAAK,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAyBvE,4CAA4C;AAC5C,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,OAAO,EAAE,CAAA;CAChB;AAED,oGAAoG;AACpG,UAAU,UAAU;IAClB,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;CACZ;AAED,MAAM,MAAM,sBAAsB,GAC9B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,UAAU,CAAA;CAAE,GACnE;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,mBAAmB,CAAA;CAAE,CAAA;AAE7C,wFAAwF;AACxF,MAAM,MAAM,oBAAoB,GAAG,eAAe,GAAG,WAAW,GAAG,gBAAgB,GAAG,UAAU,CAAA;AAEhG,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,oBAAoB,CAAA;IAC1B,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAClC;AAcD,0FAA0F;AAC1F,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,oBAAoB,GAAG,MAAM,CAE5E;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsEG;AACH,MAAM,MAAM,SAAS,GACjB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACvC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAChC;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC7B;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAChC;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACjD;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAA;AAEvC,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,SAAS,CAAA;IAChB,qFAAqF;IACrF,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,2FAA2F;AAC3F,MAAM,MAAM,sBAAsB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAA;AAE/E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,0BAA0B,EAAE,sBA8wBxC,CAAA;AAMD,qFAAqF;AACrF,MAAM,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,CAAC,CAAA;AAEjG,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,gEAAgE;IAChE,KAAK,EAAE;QAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;IAC/C,kGAAkG;IAClG,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAA;IACzE;;;OAGG;IACH,qBAAqB,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAA;IAC3E;;;;OAIG;IACH,sBAAsB,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC,CAAA;IAC5F;;;;OAIG;IACH,wBAAwB,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC,CAAA;IAChG;;;;;OAKG;IACH,uBAAuB,CAAC,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;IAC9D,4EAA4E;IAC5E,KAAK,CAAC,EAAE,sBAAsB,CAAA;CAC/B;AAED,wFAAwF;AACxF,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,sBAAsB,CAAA;CAC7B;AAkBD;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,qBAAqB,EAC9B,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,cAAc,CAAC,CA4RzB;AAED,yEAAyE;AACzE,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,mBAAmB,GAAG,KAAK,CAW7E"}

package/dist/persistence/rpc.js

@@ -109,6 +109,20 @@ export const REMOTE_PERSISTENCE_METHODS = {
         listByAccount: { scope: { kind: 'account', arg: 0 } },
         get: { scope: { kind: 'account', arg: 0 } },
     },
+    // The workspace-RBAC member-tier READS the gate + list path run on every signed request
+    // (workspace-rbac slice 3). `get` is the gate's per-request effective-role read — workspace-
+    // scoped and secret-free, exactly like `workspaceRepository.accessRowOf`.
+    // `getRolesForUserInWorkspaces` is the `GET /workspaces` list-annotation batch read; it is
+    // pinned to the CALLER's own id (`selfUser`), so it can only ever return the caller's own
+    // membership roles (a board they hold no row in is simply absent — no existence leak), and it
+    // returns a serializable `Record` so it round-trips over this RPC. The roster read
+    // (`listByWorkspace`/`listWorkspaceIdsForUser`) + the writes (`upsert`/`remove`/
+    // `removeByAccountMembership`) stay mothership-internal — the member-management API is a later
+    // slice, and the writes are admin-gated (the machine token is role-blind).
+    workspaceMemberRepository: {
+        get: { scope: { kind: 'workspace', arg: 0 } },
+        getRolesForUserInWorkspaces: { scope: { kind: 'selfUser', arg: 0 } },
+    },
     // --- Member-display read surface ------------------------------------------------
     // The user DISPLAY records the account members panel enriches its roster with
     // (`AccountService.members` → `userRepository.listByIds(memberIds)`) and the single-user display
@@ -1105,7 +1119,13 @@ export async function dispatchPersistenceCall(request, opts) {
             if (!requested || typeof requested !== 'object')
                 return denied;
             const accountIds = (requested.accountIds ?? []).filter((id) => inScope(id));
-            args[rule.arg] = { accountIds, ownerUserId: opts.scope.userId };
+            const adminAccountIds = (requested.adminAccountIds ?? []).filter((id) => inScope(id));
+            args[rule.arg] = {
+                accountIds,
+                adminAccountIds,
+                ownerUserId: opts.scope.userId,
+                userId: opts.scope.userId,
+            };
             break;
         }
         default: {