@growth-labs/cms 0.1.0

package/dist/engine/invites.js

@@ -0,0 +1,158 @@
+// invites.ts — workspace_invites engine (P7 Task 5).
+//
+// Copies inbox-platform src/lib/invites/service.ts, re-keyed onto:
+//   workspace_invites / workspace_memberships / masthead_users
+// Differences from inbox:
+//   - Uses Web Crypto (crypto.subtle.digest) NOT node:crypto — workerd-pure.
+//   - Timestamps are INTEGER unixepoch() (CMS convention, not inbox's TEXT datetime('now')).
+//   - acceptInvite takes the full user object; the identity call (mintOrAttachAccount)
+//     is the route layer's responsibility (routes/rbac-invites.ts), NOT the engine.
+//
+// SCOPE GUARDS (from spec §12):
+//   - Email must match the invite on accept (else invite_email_mismatch).
+//   - Membership is keyed on the REAL OpenAuth subject ('user:<uuid>') — NEVER a placeholder.
+//   - Email send is a Fronts-cutover concern; the engine only writes the row + returns the token.
+import { upsertMastheadUser } from './members.js';
+// ---------------------------------------------------------------------------
+// hashInviteToken — Web Crypto SHA-256 hex (workerd-pure, no node:crypto)
+// ---------------------------------------------------------------------------
+export async function hashInviteToken(token) {
+    const enc = new TextEncoder();
+    const buf = await crypto.subtle.digest('SHA-256', enc.encode(token));
+    return Array.from(new Uint8Array(buf))
+        .map((b) => b.toString(16).padStart(2, '0'))
+        .join('');
+}
+// ---------------------------------------------------------------------------
+// createInvite — write the invite row, return the raw token (not stored)
+// ---------------------------------------------------------------------------
+/**
+ * Create a workspace invite. Generates a random token, stores only its
+ * SHA-256 hash in the DB (never the raw value), and returns the token + id.
+ *
+ * The invite-email send is a Fronts-cutover concern (injected hook in the route
+ * layer) — the engine only persists the row. Mirror inbox "failure-as-value".
+ */
+export async function createInvite(db, input) {
+    const id = crypto.randomUUID();
+    // Generate a raw token: 32 random bytes as hex
+    const raw = new Uint8Array(32);
+    crypto.getRandomValues(raw);
+    const token = Array.from(raw)
+        .map((b) => b.toString(16).padStart(2, '0'))
+        .join('');
+    const tokenHash = await hashInviteToken(token);
+    const expiresIn = input.expiresInSeconds ?? 7 * 24 * 60 * 60; // 7 days
+    const now = Math.floor(Date.now() / 1000);
+    const expiresAt = now + expiresIn;
+    await db
+        .prepare(`INSERT INTO workspace_invites (id, workspace_id, email, role, invited_by, token_hash, expires_at, accepted_at, created_at)
+			 VALUES (?, ?, ?, ?, ?, ?, ?, NULL, ?)`)
+        .bind(id, input.workspaceId, input.email, input.role, input.invitedBy, tokenHash, expiresAt, now)
+        .run();
+    return { inviteId: id, token };
+}
+// ---------------------------------------------------------------------------
+// loadInviteByToken — hash the token, look up, reject expired/accepted
+// ---------------------------------------------------------------------------
+/**
+ * Load a pending invite by its raw token. Returns null if:
+ *   - token hash does not match any row
+ *   - the invite is expired (expires_at <= now)
+ *   - the invite is already accepted (accepted_at IS NOT NULL)
+ *
+ * Mirrors inbox `loadTenantInviteByToken`.
+ */
+export async function loadInviteByToken(db, token) {
+    const tokenHash = await hashInviteToken(token);
+    const now = Math.floor(Date.now() / 1000);
+    const row = await db
+        .prepare(`SELECT id, workspace_id, email, role, invited_by, token_hash, expires_at, accepted_at, created_at
+			 FROM workspace_invites
+			 WHERE token_hash = ? AND expires_at > ? AND accepted_at IS NULL`)
+        .bind(tokenHash, now)
+        .first();
+    if (!row)
+        return null;
+    return {
+        id: row.id,
+        workspaceId: row.workspace_id,
+        email: row.email,
+        role: row.role,
+        invitedBy: row.invited_by,
+        tokenHash: row.token_hash,
+        expiresAt: row.expires_at,
+        acceptedAt: row.accepted_at,
+        createdAt: row.created_at,
+    };
+}
+// ---------------------------------------------------------------------------
+// upsertMembership — insert or update a workspace_memberships row
+// ---------------------------------------------------------------------------
+async function upsertMembership(db, { workspaceId, userId, role, invitedBy, acceptedAt, }) {
+    const now = Math.floor(Date.now() / 1000);
+    await db
+        .prepare(`INSERT INTO workspace_memberships (workspace_id, user_id, role, invited_by, accepted_at, created_at, updated_at)
+			 VALUES (?, ?, ?, ?, ?, ?, ?)
+			 ON CONFLICT(workspace_id, user_id) DO UPDATE SET
+			   role = excluded.role,
+			   accepted_at = excluded.accepted_at,
+			   updated_at = excluded.updated_at`)
+        .bind(workspaceId, userId, role, invitedBy ?? null, acceptedAt, now, now)
+        .run();
+}
+// ---------------------------------------------------------------------------
+// acceptInvite — validate email match, upsert user + membership, mark accepted
+// ---------------------------------------------------------------------------
+/**
+ * Accept a workspace invite.
+ *
+ * Validates:
+ *   1. The token resolves to a pending, non-expired invite.
+ *   2. The user's email matches the invite email (prevents invite-link hijacking).
+ *
+ * On success:
+ *   - Upserts masthead_users (with the REAL OpenAuth subject as id).
+ *   - Upserts workspace_memberships keyed on the real subject.
+ *   - Marks the invite accepted.
+ *
+ * Throws:
+ *   - 'invite_not_found' if the token is unknown/expired/accepted.
+ *   - 'invite_email_mismatch' if the user email does not match.
+ *
+ * NOTE: The IdentityProvider.mintOrAttachAccount call is the ROUTE layer's
+ * responsibility — the engine only persists the data.
+ */
+export async function acceptInvite(db, input) {
+    const invite = await loadInviteByToken(db, input.token);
+    if (!invite) {
+        throw new Error('invite_not_found');
+    }
+    // Email must match (case-insensitive)
+    if (invite.email.toLowerCase() !== input.user.email.toLowerCase()) {
+        throw new Error('invite_email_mismatch');
+    }
+    const now = Math.floor(Date.now() / 1000);
+    // Upsert the user profile
+    await upsertMastheadUser(db, {
+        id: input.user.id,
+        email: input.user.email,
+        name: input.user.name,
+        image: input.user.image,
+    });
+    // Upsert the membership (accepted)
+    await upsertMembership(db, {
+        workspaceId: invite.workspaceId,
+        userId: input.user.id,
+        role: invite.role,
+        invitedBy: invite.invitedBy,
+        acceptedAt: now,
+    });
+    // Mark invite accepted
+    await db
+        .prepare(`UPDATE workspace_invites SET accepted_at = ? WHERE id = ?`)
+        .bind(now, invite.id)
+        .run();
+    return { workspaceId: invite.workspaceId, role: invite.role };
+}
+//# sourceMappingURL=invites.js.map

package/dist/engine/invites.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invites.js","sourceRoot":"","sources":["../../src/engine/invites.ts"],"names":[],"mappings":"AAAA,qDAAqD;AACrD,EAAE;AACF,mEAAmE;AACnE,+DAA+D;AAC/D,0BAA0B;AAC1B,6EAA6E;AAC7E,6FAA6F;AAC7F,uFAAuF;AACvF,oFAAoF;AACpF,EAAE;AACF,gCAAgC;AAChC,0EAA0E;AAC1E,8FAA8F;AAC9F,kGAAkG;AAIlG,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AAEjD,8EAA8E;AAC9E,0EAA0E;AAC1E,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAa;IAClD,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAA;IAC7B,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;IACpE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;SACpC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC,CAAA;AACX,CAAC;AA4CD,8EAA8E;AAC9E,yEAAyE;AACzE,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CACjC,EAAc,EACd,KAAwB;IAExB,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;IAC9B,+CAA+C;IAC/C,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAA;IAC9B,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;IAC3B,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;SAC3B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC,CAAA;IAEV,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAA;IAC9C,MAAM,SAAS,GAAG,KAAK,CAAC,gBAAgB,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAA,CAAC,SAAS;IACtE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IACzC,MAAM,SAAS,GAAG,GAAG,GAAG,SAAS,CAAA;IAEjC,MAAM,EAAE;SACN,OAAO,CACP;0CACuC,CACvC;SACA,IAAI,CACJ,EAAE,EACF,KAAK,CAAC,WAAW,EACjB,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,SAAS,EACf,SAAS,EACT,SAAS,EACT,GAAG,CACH;SACA,GAAG,EAAE,CAAA;IAEP,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,CAAA;AAC/B,CAAC;AAED,8EAA8E;AAC9E,uEAAuE;AACvE,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACtC,EAAc,EACd,KAAa;IAEb,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAA;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IAEzC,MAAM,GAAG,GAAG,MAAM,EAAE;SAClB,OAAO,CACP;;oEAEiE,CACjE;SACA,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC;SACpB,KAAK,EAUF,CAAA;IAEL,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAA;IACrB,OAAO;QACN,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,SAAS,EAAE,GAAG,CAAC,UAAU;KACzB,CAAA;AACF,CAAC;AAED,8EAA8E;AAC9E,kEAAkE;AAClE,8EAA8E;AAE9E,KAAK,UAAU,gBAAgB,CAC9B,EAAc,EACd,EACC,WAAW,EACX,MAAM,EACN,IAAI,EACJ,SAAS,EACT,UAAU,GAOV;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IACzC,MAAM,EAAE;SACN,OAAO,CACP;;;;;uCAKoC,CACpC;SACA,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,IAAI,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,CAAC;SACxE,GAAG,EAAE,CAAA;AACR,CAAC;AAED,8EAA8E;AAC9E,+EAA+E;AAC/E,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CACjC,EAAc,EACd,KAAwB;IAExB,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAAA;IACvD,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;IACpC,CAAC;IAED,sCAAsC;IACtC,IAAI,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAA;IACzC,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IAEzC,0BAA0B;IAC1B,MAAM,kBAAkB,CAAC,EAAE,EAAE;QAC5B,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE;QACjB,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK;QACvB,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI;QACrB,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK;KACvB,CAAC,CAAA;IAEF,mCAAmC;IACnC,MAAM,gBAAgB,CAAC,EAAE,EAAE;QAC1B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE;QACrB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,UAAU,EAAE,GAAG;KACf,CAAC,CAAA;IAEF,uBAAuB;IACvB,MAAM,EAAE;SACN,OAAO,CAAC,2DAA2D,CAAC;SACpE,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC;SACpB,GAAG,EAAE,CAAA;IAEP,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAA;AAC9D,CAAC"}

package/dist/engine/members.d.ts

@@ -0,0 +1,59 @@
+import type { CmsRole } from '../schema/types.js';
+import type { D1Database } from './d1.js';
+/** A resolved membership record (workspace_memberships row, flat). */
+export interface MembershipRecord {
+    workspaceId: string;
+    userId: string;
+    role: CmsRole;
+    invitedBy: string | null;
+    invitedAt: number | null;
+    acceptedAt: number | null;
+    createdAt: number;
+    updatedAt: number;
+}
+/** A membership record joined to masthead_users for the member-list view. */
+export interface MemberListEntry extends MembershipRecord {
+    email: string;
+    name: string | null;
+    image: string | null;
+}
+export interface UpsertMastheadUserInput {
+    /** Real OpenAuth subject — MUST start with 'user:'. */
+    id: string;
+    email: string;
+    name: string | null;
+    image: string | null;
+}
+/**
+ * Upsert a masthead_users row. On conflict(id), updates email/name/image and
+ * bumps last_login_at + updated_at. Uses INTEGER unixepoch() timestamps
+ * (diverges from inbox's TEXT datetime('now') — match CMS convention).
+ *
+ * NEVER call with a locally-minted or placeholder id — id must be the real
+ * OpenAuth subject ('user:<uuid>'). A placeholder email on the UNIQUE column
+ * causes a 500 on the real person's first login (inbox-platform §16 risk 10).
+ */
+export declare function upsertMastheadUser(db: D1Database, input: UpsertMastheadUserInput): Promise<void>;
+/**
+ * Load a single workspace membership keyed on (workspaceId, userId).
+ * Returns null when absent — a caller receiving null must 403/401.
+ * The userId MUST be the real OpenAuth subject; a placeholder returns null.
+ */
+export declare function loadMembership(db: D1Database, workspaceId: string, userId: string): Promise<MembershipRecord | null>;
+/**
+ * List all accepted members for a workspace, joined to masthead_users for
+ * profile data. Ordered by membership created_at ASC (deterministic).
+ */
+export declare function listMembers(db: D1Database, workspaceId: string): Promise<MemberListEntry[]>;
+/**
+ * Update the role of an existing workspace member. Does not enforce the
+ * owner-invariant here — callers (route layer) must apply canChangeMemberRole
+ * from membership-rules.ts before calling this.
+ */
+export declare function setRole(db: D1Database, workspaceId: string, userId: string, role: CmsRole): Promise<void>;
+/**
+ * Remove a member from a workspace. Does not enforce the owner-invariant
+ * here — callers must apply canRemoveMember from membership-rules.ts first.
+ */
+export declare function removeMember(db: D1Database, workspaceId: string, userId: string): Promise<void>;
+//# sourceMappingURL=members.d.ts.map

package/dist/engine/members.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"members.d.ts","sourceRoot":"","sources":["../../src/engine/members.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAMzC,sEAAsE;AACtE,MAAM,WAAW,gBAAgB;IAChC,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,OAAO,CAAA;IACb,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CACjB;AAED,6EAA6E;AAC7E,MAAM,WAAW,eAAgB,SAAQ,gBAAgB;IACxD,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACpB;AAMD,MAAM,WAAW,uBAAuB;IACvC,uDAAuD;IACvD,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACpB;AAED;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CACvC,EAAE,EAAE,UAAU,EACd,KAAK,EAAE,uBAAuB,GAC5B,OAAO,CAAC,IAAI,CAAC,CAef;AAMD;;;;GAIG;AACH,wBAAsB,cAAc,CACnC,EAAE,EAAE,UAAU,EACd,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,GACZ,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CA8BlC;AAMD;;;GAGG;AACH,wBAAsB,WAAW,CAAC,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAyCjG;AAMD;;;;GAIG;AACH,wBAAsB,OAAO,CAC5B,EAAE,EAAE,UAAU,EACd,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO,GACX,OAAO,CAAC,IAAI,CAAC,CAUf;AAMD;;;GAGG;AACH,wBAAsB,YAAY,CACjC,EAAE,EAAE,UAAU,EACd,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CAKf"}

package/dist/engine/members.js

@@ -0,0 +1,124 @@
+// members.ts — Membership engine over workspace_memberships + masthead_users (P7 Task 1).
+//
+// Mirrors inbox-platform src/lib/data/members.ts (loadMembershipForUser /
+// upsertInboxUser) re-keyed onto workspace_memberships / masthead_users.
+// Differences from inbox:
+//   - Timestamps are INTEGER unixepoch() per CMS convention (inbox uses TEXT datetime('now')).
+//   - Subject format is the real OpenAuth subject 'user:<uuid>' (NEVER a locally-minted id).
+//   - listMembers does a LEFT JOIN to masthead_users for the profile view.
+/**
+ * Upsert a masthead_users row. On conflict(id), updates email/name/image and
+ * bumps last_login_at + updated_at. Uses INTEGER unixepoch() timestamps
+ * (diverges from inbox's TEXT datetime('now') — match CMS convention).
+ *
+ * NEVER call with a locally-minted or placeholder id — id must be the real
+ * OpenAuth subject ('user:<uuid>'). A placeholder email on the UNIQUE column
+ * causes a 500 on the real person's first login (inbox-platform §16 risk 10).
+ */
+export async function upsertMastheadUser(db, input) {
+    const now = Math.floor(Date.now() / 1000);
+    await db
+        .prepare(`INSERT INTO masthead_users (id, email, name, image, last_login_at, created_at, updated_at)
+			 VALUES (?, ?, ?, ?, ?, ?, ?)
+			 ON CONFLICT(id) DO UPDATE SET
+			   email = excluded.email,
+			   name = excluded.name,
+			   image = excluded.image,
+			   last_login_at = excluded.last_login_at,
+			   updated_at = excluded.updated_at`)
+        .bind(input.id, input.email, input.name ?? null, input.image ?? null, now, now, now)
+        .run();
+}
+// ---------------------------------------------------------------------------
+// loadMembership (mirror loadMembershipForUser)
+// ---------------------------------------------------------------------------
+/**
+ * Load a single workspace membership keyed on (workspaceId, userId).
+ * Returns null when absent — a caller receiving null must 403/401.
+ * The userId MUST be the real OpenAuth subject; a placeholder returns null.
+ */
+export async function loadMembership(db, workspaceId, userId) {
+    const row = await db
+        .prepare(`SELECT workspace_id, user_id, role, invited_by, invited_at, accepted_at, created_at, updated_at
+			 FROM workspace_memberships
+			 WHERE workspace_id = ? AND user_id = ?`)
+        .bind(workspaceId, userId)
+        .first();
+    if (!row)
+        return null;
+    return {
+        workspaceId: row.workspace_id,
+        userId: row.user_id,
+        role: row.role,
+        invitedBy: row.invited_by,
+        invitedAt: row.invited_at,
+        acceptedAt: row.accepted_at,
+        createdAt: row.created_at,
+        updatedAt: row.updated_at,
+    };
+}
+// ---------------------------------------------------------------------------
+// listMembers — LEFT JOIN masthead_users for the member list view
+// ---------------------------------------------------------------------------
+/**
+ * List all accepted members for a workspace, joined to masthead_users for
+ * profile data. Ordered by membership created_at ASC (deterministic).
+ */
+export async function listMembers(db, workspaceId) {
+    const result = await db
+        .prepare(`SELECT
+			   wm.workspace_id, wm.user_id, wm.role,
+			   wm.invited_by, wm.invited_at, wm.accepted_at,
+			   wm.created_at, wm.updated_at,
+			   mu.email, mu.name, mu.image
+			 FROM workspace_memberships wm
+			 LEFT JOIN masthead_users mu ON mu.id = wm.user_id
+			 WHERE wm.workspace_id = ?
+			 ORDER BY wm.created_at ASC`)
+        .bind(workspaceId)
+        .all();
+    return (result.results ?? []).map((row) => ({
+        workspaceId: row.workspace_id,
+        userId: row.user_id,
+        role: row.role,
+        invitedBy: row.invited_by,
+        invitedAt: row.invited_at,
+        acceptedAt: row.accepted_at,
+        createdAt: row.created_at,
+        updatedAt: row.updated_at,
+        email: row.email,
+        name: row.name,
+        image: row.image,
+    }));
+}
+// ---------------------------------------------------------------------------
+// setRole — update a member's role
+// ---------------------------------------------------------------------------
+/**
+ * Update the role of an existing workspace member. Does not enforce the
+ * owner-invariant here — callers (route layer) must apply canChangeMemberRole
+ * from membership-rules.ts before calling this.
+ */
+export async function setRole(db, workspaceId, userId, role) {
+    const now = Math.floor(Date.now() / 1000);
+    await db
+        .prepare(`UPDATE workspace_memberships
+			 SET role = ?, updated_at = ?
+			 WHERE workspace_id = ? AND user_id = ?`)
+        .bind(role, now, workspaceId, userId)
+        .run();
+}
+// ---------------------------------------------------------------------------
+// removeMember — delete a membership row
+// ---------------------------------------------------------------------------
+/**
+ * Remove a member from a workspace. Does not enforce the owner-invariant
+ * here — callers must apply canRemoveMember from membership-rules.ts first.
+ */
+export async function removeMember(db, workspaceId, userId) {
+    await db
+        .prepare(`DELETE FROM workspace_memberships WHERE workspace_id = ? AND user_id = ?`)
+        .bind(workspaceId, userId)
+        .run();
+}
+//# sourceMappingURL=members.js.map

package/dist/engine/members.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"members.js","sourceRoot":"","sources":["../../src/engine/members.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,EAAE;AACF,0EAA0E;AAC1E,yEAAyE;AACzE,0BAA0B;AAC1B,+FAA+F;AAC/F,6FAA6F;AAC7F,2EAA2E;AAwC3E;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACvC,EAAc,EACd,KAA8B;IAE9B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IACzC,MAAM,EAAE;SACN,OAAO,CACP;;;;;;;uCAOoC,CACpC;SACA,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,IAAI,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;SACnF,GAAG,EAAE,CAAA;AACR,CAAC;AAED,8EAA8E;AAC9E,gDAAgD;AAChD,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CACnC,EAAc,EACd,WAAmB,EACnB,MAAc;IAEd,MAAM,GAAG,GAAG,MAAM,EAAE;SAClB,OAAO,CACP;;2CAEwC,CACxC;SACA,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC;SACzB,KAAK,EASF,CAAA;IAEL,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAA;IACrB,OAAO;QACN,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,MAAM,EAAE,GAAG,CAAC,OAAO;QACnB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,SAAS,EAAE,GAAG,CAAC,UAAU;KACzB,CAAA;AACF,CAAC;AAED,8EAA8E;AAC9E,kEAAkE;AAClE,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,EAAc,EAAE,WAAmB;IACpE,MAAM,MAAM,GAAG,MAAM,EAAE;SACrB,OAAO,CACP;;;;;;;;+BAQ4B,CAC5B;SACA,IAAI,CAAC,WAAW,CAAC;SACjB,GAAG,EAYA,CAAA;IAEL,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC3C,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,MAAM,EAAE,GAAG,CAAC,OAAO;QACnB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,KAAK,EAAE,GAAG,CAAC,KAAK;KAChB,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,8EAA8E;AAC9E,mCAAmC;AACnC,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC5B,EAAc,EACd,WAAmB,EACnB,MAAc,EACd,IAAa;IAEb,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IACzC,MAAM,EAAE;SACN,OAAO,CACP;;2CAEwC,CACxC;SACA,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,CAAC;SACpC,GAAG,EAAE,CAAA;AACR,CAAC;AAED,8EAA8E;AAC9E,yCAAyC;AACzC,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CACjC,EAAc,EACd,WAAmB,EACnB,MAAc;IAEd,MAAM,EAAE;SACN,OAAO,CAAC,0EAA0E,CAAC;SACnF,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC;SACzB,GAAG,EAAE,CAAA;AACR,CAAC"}

package/dist/engine/membership-rules.d.ts

@@ -0,0 +1,25 @@
+export type MembershipSummary = {
+    userId: string;
+    role: string;
+};
+export type MemberActionDecision = {
+    allowed: true;
+} | {
+    allowed: false;
+    reason: 'cannot-remove-self' | 'last-owner';
+};
+/**
+ * Count the number of members with the 'owner' role.
+ */
+export declare function ownerCount(members: MembershipSummary[]): number;
+/**
+ * A member cannot remove themselves (avoids accidental lockout) and the sole
+ * owner cannot be removed (the workspace must always keep at least one owner).
+ */
+export declare function canRemoveMember(members: MembershipSummary[], actorUserId: string, targetUserId: string): MemberActionDecision;
+/**
+ * The sole owner cannot be demoted to a non-owner role — that would leave the
+ * workspace with no owner. Any other role change is allowed.
+ */
+export declare function canChangeMemberRole(members: MembershipSummary[], targetUserId: string, newRole: string): MemberActionDecision;
+//# sourceMappingURL=membership-rules.d.ts.map

package/dist/engine/membership-rules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"membership-rules.d.ts","sourceRoot":"","sources":["../../src/engine/membership-rules.ts"],"names":[],"mappings":"AAaA,MAAM,MAAM,iBAAiB,GAAG;IAC/B,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;CACZ,CAAA;AAED,MAAM,MAAM,oBAAoB,GAC7B;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GACjB;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,oBAAoB,GAAG,YAAY,CAAA;CAAE,CAAA;AAElE;;GAEG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAE/D;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC9B,OAAO,EAAE,iBAAiB,EAAE,EAC5B,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GAClB,oBAAoB,CAStB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAClC,OAAO,EAAE,iBAAiB,EAAE,EAC5B,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM,GACb,oBAAoB,CAMtB"}

package/dist/engine/membership-rules.js

@@ -0,0 +1,44 @@
+// membership-rules.ts — Pure membership invariant guards (P7 Task 3).
+//
+// Copied from inbox-platform src/lib/permissions.ts — re-keyed onto the
+// workspace_memberships model. The mailboxScope helpers are stripped; the
+// owner-invariant logic (ownerCount / canRemoveMember / canChangeMemberRole)
+// is preserved verbatim.
+//
+// These are PURE functions — no D1, no crypto, no async.
+//
+// The "always keep ≥1 owner" invariant is non-negotiable:
+//   - canRemoveMember: cannot remove self; cannot remove the sole owner.
+//   - canChangeMemberRole: cannot demote the sole owner to a non-owner role.
+/**
+ * Count the number of members with the 'owner' role.
+ */
+export function ownerCount(members) {
+    return members.filter((member) => member.role === 'owner').length;
+}
+/**
+ * A member cannot remove themselves (avoids accidental lockout) and the sole
+ * owner cannot be removed (the workspace must always keep at least one owner).
+ */
+export function canRemoveMember(members, actorUserId, targetUserId) {
+    if (actorUserId === targetUserId) {
+        return { allowed: false, reason: 'cannot-remove-self' };
+    }
+    const target = members.find((member) => member.userId === targetUserId);
+    if (target?.role === 'owner' && ownerCount(members) <= 1) {
+        return { allowed: false, reason: 'last-owner' };
+    }
+    return { allowed: true };
+}
+/**
+ * The sole owner cannot be demoted to a non-owner role — that would leave the
+ * workspace with no owner. Any other role change is allowed.
+ */
+export function canChangeMemberRole(members, targetUserId, newRole) {
+    const target = members.find((member) => member.userId === targetUserId);
+    if (target?.role === 'owner' && newRole !== 'owner' && ownerCount(members) <= 1) {
+        return { allowed: false, reason: 'last-owner' };
+    }
+    return { allowed: true };
+}
+//# sourceMappingURL=membership-rules.js.map

package/dist/engine/membership-rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"membership-rules.js","sourceRoot":"","sources":["../../src/engine/membership-rules.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,EAAE;AACF,wEAAwE;AACxE,0EAA0E;AAC1E,6EAA6E;AAC7E,yBAAyB;AACzB,EAAE;AACF,yDAAyD;AACzD,EAAE;AACF,0DAA0D;AAC1D,yEAAyE;AACzE,6EAA6E;AAW7E;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,OAA4B;IACtD,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,MAAM,CAAA;AAClE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC9B,OAA4B,EAC5B,WAAmB,EACnB,YAAoB;IAEpB,IAAI,WAAW,KAAK,YAAY,EAAE,CAAC;QAClC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAA;IACxD,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,YAAY,CAAC,CAAA;IACvE,IAAI,MAAM,EAAE,IAAI,KAAK,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAA;IAChD,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;AACzB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAClC,OAA4B,EAC5B,YAAoB,EACpB,OAAe;IAEf,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,YAAY,CAAC,CAAA;IACvE,IAAI,MAAM,EAAE,IAAI,KAAK,OAAO,IAAI,OAAO,KAAK,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACjF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAA;IAChD,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;AACzB,CAAC"}

package/dist/engine/og-render.d.ts

@@ -0,0 +1,40 @@
+/** The deterministic spec the generateOgImage route hands to the renderer. */
+export interface OgCardSpec {
+    /** The article headline / title. */
+    title: string;
+    /** Subtitle copy — typically the excerpt/dek. Empty string when absent. */
+    subtitle: string;
+    /** Publication brand label (displayed on the card). */
+    brand: string;
+    /** Optional hero-image URL to composite into the card background. */
+    heroUrl?: string;
+}
+/**
+ * The renderer interface. The package defines the contract; the site (cutover
+ * P8) supplies a real implementation backed by a Browser Rendering binding or
+ * a Resvg/satori WASM path. Tests inject a stub that returns fixed bytes.
+ */
+export interface OgImageRenderer {
+    /** Render the card spec to PNG bytes. */
+    render(spec: OgCardSpec): Promise<Uint8Array>;
+}
+/** Options for buildOgCardSpec. */
+export interface OgCardSpecOpts {
+    /** Override the publication brand label. Defaults to 'The Publication'. */
+    brand?: string;
+    /** Pre-resolved hero image URL. If absent, heroUrl is omitted from the spec. */
+    heroUrl?: string;
+}
+/**
+ * Build a deterministic OgCardSpec from a content row + options.
+ *
+ * - title: from the content item.
+ * - subtitle: from the item's excerpt; empty string when absent/null.
+ * - brand: from opts.brand or a sensible default label.
+ * - heroUrl: from opts.heroUrl when present; omitted otherwise.
+ */
+export declare function buildOgCardSpec(item: {
+    title: string;
+    excerpt?: string | null;
+}, opts: OgCardSpecOpts): OgCardSpec;
+//# sourceMappingURL=og-render.d.ts.map

package/dist/engine/og-render.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"og-render.d.ts","sourceRoot":"","sources":["../../src/engine/og-render.ts"],"names":[],"mappings":"AAOA,8EAA8E;AAC9E,MAAM,WAAW,UAAU;IAC1B,oCAAoC;IACpC,KAAK,EAAE,MAAM,CAAA;IACb,2EAA2E;IAC3E,QAAQ,EAAE,MAAM,CAAA;IAChB,uDAAuD;IACvD,KAAK,EAAE,MAAM,CAAA;IACb,qEAAqE;IACrE,OAAO,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC/B,yCAAyC;IACzC,MAAM,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;CAC7C;AAED,mCAAmC;AACnC,MAAM,WAAW,cAAc;IAC9B,2EAA2E;IAC3E,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,gFAAgF;IAChF,OAAO,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAC9B,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EAChD,IAAI,EAAE,cAAc,GAClB,UAAU,CAUZ"}

package/dist/engine/og-render.js

@@ -0,0 +1,26 @@
+// OG-image renderer interface + pure card-spec builder (P4 Task 5).
+//
+// The package owns the OgImageRenderer *interface* and the OgCardSpec type.
+// The mechanism that produces the PNG (Cloudflare Browser Rendering binding vs.
+// Resvg/satori WASM) is INJECTED by the site and is NOT imported here — it is
+// cutover glue (P8). Tests inject a stub renderer that returns fixed bytes.
+/**
+ * Build a deterministic OgCardSpec from a content row + options.
+ *
+ * - title: from the content item.
+ * - subtitle: from the item's excerpt; empty string when absent/null.
+ * - brand: from opts.brand or a sensible default label.
+ * - heroUrl: from opts.heroUrl when present; omitted otherwise.
+ */
+export function buildOgCardSpec(item, opts) {
+    const spec = {
+        title: item.title,
+        subtitle: item.excerpt ?? '',
+        brand: opts.brand ?? 'The Publication',
+    };
+    if (opts.heroUrl !== undefined) {
+        spec.heroUrl = opts.heroUrl;
+    }
+    return spec;
+}
+//# sourceMappingURL=og-render.js.map

package/dist/engine/og-render.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"og-render.js","sourceRoot":"","sources":["../../src/engine/og-render.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,EAAE;AACF,4EAA4E;AAC5E,gFAAgF;AAChF,8EAA8E;AAC9E,4EAA4E;AAgC5E;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAC9B,IAAgD,EAChD,IAAoB;IAEpB,MAAM,IAAI,GAAe;QACxB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,QAAQ,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE;QAC5B,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,iBAAiB;KACtC,CAAA;IACD,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAChC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAA;IAC5B,CAAC;IACD,OAAO,IAAI,CAAA;AACZ,CAAC"}

package/dist/engine/publish-guard.d.ts

@@ -0,0 +1,58 @@
+/**
+ * publish-guard.ts
+ *
+ * Wraps `validateArticleBody` for call sites that need a single
+ * pass/fail decision plus a response-shaped payload. The CMS PATCH
+ * route and Foundry callbacks each invoke this before writing the new
+ * body so broken content is rejected before it lands in
+ * `article_content`.
+ *
+ * Ported verbatim from fulcrum-labs/fronts
+ * src/lib/article-publish-guard.ts (inventory §1: extract). Only
+ * block-severity codes cause `ok = false`; warn-severity codes populate
+ * `warnings` so the CMS / Foundry callback can surface them to the
+ * editor but does NOT reject the write.
+ *
+ * Keep this layer thin — the heavy lifting lives in `./validator/`.
+ */
+import { type ArticleBodyInput, type RunOptions, type ValidationError } from './validator/index.js';
+export interface PublishGuardOptions extends Partial<RunOptions> {
+    /**
+     * A short label included in the log line / response so logs can be
+     * traced back to the call site (e.g. "cms.patch", "foundry.faq").
+     */
+    source: string;
+    /**
+     * Optional content_id for log correlation.
+     */
+    contentId?: string;
+}
+export interface PublishGuardOutcome {
+    /** `true` iff there are no block-severity violations. */
+    ok: boolean;
+    /** All violations (block + warn) in detection order. */
+    errors: ValidationError[];
+    /** Block-severity subset of {@link errors} — the rejection reason. */
+    blockErrors: ValidationError[];
+    /** Warn-severity subset of {@link errors} — for editor surfacing. */
+    warnings: ValidationError[];
+    /** Pre-formatted error string, ready for log lines / response body. */
+    summary: string;
+}
+/**
+ * Validate the body and produce a structured outcome. Callers decide
+ * whether to return a 422, log a warning, or proceed. `ok` is true
+ * iff there are no block-severity codes — warn-only violations still
+ * populate `warnings` for editor surfacing.
+ */
+export declare function evaluateArticleBody(input: ArticleBodyInput, options: PublishGuardOptions): PublishGuardOutcome;
+/**
+ * Convenience helper for HTTP handlers: returns a 422 Response when
+ * the body has block-severity violations, or null when validation
+ * passes (so the handler can proceed). Warn-severity violations log
+ * but do NOT block the response — callers that want to surface them
+ * in their 200 payload should call {@link evaluateArticleBody}
+ * directly and read `outcome.warnings`.
+ */
+export declare function publishGuardResponseOrNull(input: ArticleBodyInput, options: PublishGuardOptions): Response | null;
+//# sourceMappingURL=publish-guard.d.ts.map

package/dist/engine/publish-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish-guard.d.ts","sourceRoot":"","sources":["../../src/engine/publish-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EACN,KAAK,gBAAgB,EAErB,KAAK,UAAU,EACf,KAAK,eAAe,EAIpB,MAAM,sBAAsB,CAAA;AAE7B,MAAM,WAAW,mBAAoB,SAAQ,OAAO,CAAC,UAAU,CAAC;IAC/D;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAA;IACd;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,mBAAmB;IACnC,yDAAyD;IACzD,EAAE,EAAE,OAAO,CAAA;IACX,wDAAwD;IACxD,MAAM,EAAE,eAAe,EAAE,CAAA;IACzB,sEAAsE;IACtE,WAAW,EAAE,eAAe,EAAE,CAAA;IAC9B,qEAAqE;IACrE,QAAQ,EAAE,eAAe,EAAE,CAAA;IAC3B,uEAAuE;IACvE,OAAO,EAAE,MAAM,CAAA;CACf;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAClC,KAAK,EAAE,gBAAgB,EACvB,OAAO,EAAE,mBAAmB,GAC1B,mBAAmB,CAqBrB;AAUD;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CACzC,KAAK,EAAE,gBAAgB,EACvB,OAAO,EAAE,mBAAmB,GAC1B,QAAQ,GAAG,IAAI,CAmBjB"}