@hanzo/rooms 0.1.0

package/dist/lib/invite.js

@@ -0,0 +1,245 @@
+import { me, scope } from './session.js';
+import { api, CLIENT, iam } from './api.js';
+export class InviteRefusal extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+    }
+}
+async function call(path, init) {
+    const res = await fetch(`${api()}${path}`, {
+        ...init,
+        headers: {
+            'Content-Type': 'application/json',
+            ...scope(),
+            ...init?.headers,
+        },
+    });
+    if (res.status === 401)
+        throw new InviteRefusal(401, 'Your session expired — sign in again');
+    if (res.status === 403)
+        throw new InviteRefusal(403, 'Your role in this organization does not allow this');
+    if (!res.ok) {
+        let detail = '';
+        try {
+            const body = (await res.json());
+            detail = body.msg || body.error || body.message || '';
+        }
+        catch {
+            // an HTML error page proves nothing worth toasting
+        }
+        throw new InviteRefusal(res.status, detail || `Invitation service answered ${res.status}`);
+    }
+    const body = (await res.json());
+    // IAM's raw handlers refuse with HTTP 200 and `{status: "error", msg}` — the
+    // memberships writes do — so the envelope is read as well as the status.
+    if (body?.status === 'error')
+        throw new InviteRefusal(400, body.msg || 'IAM refused the change');
+    return body;
+}
+/** The invitation's row name within its org: random, and never the code. */
+function mintName() {
+    const alphabet = 'abcdefghjkmnpqrstuvwxyz23456789';
+    const bytes = new Uint8Array(10);
+    crypto.getRandomValues(bytes);
+    return `inv-${Array.from(bytes, (b) => alphabet[b % alphabet.length]).join('')}`;
+}
+/** The link a member joins by, on the same IAM the account panel signs into.
+ *  Those two were separately configurable and neither name was set anywhere, so
+ *  pointing the app at another IAM would have moved one and left the other. It is
+ *  the link IAM emails, parameter for parameter, so a copied link and an emailed
+ *  one are the same link: the application the member joins through, the code, and
+ *  the org IAM looks the code up in. */
+export function inviteLink(org, code) {
+    const q = new URLSearchParams({ client_id: CLIENT, invite: code, org });
+    return `${iam()}/join?${q}`;
+}
+/** How many people one shared invite link admits. */
+export const LINK_SEATS = 25;
+/**
+ * Issues one invitation and returns it: pinned to an email and redeemable once,
+ * or open to anyone with the link for `quota` joins. The caller owns telling the
+ * person — `sendInvitation` emails a pinned one, and the link is
+ * `inviteLink(invitation.owner, invitation.code)`.
+ */
+export async function createInvitation(org, email, quota = 1) {
+    // No code is sent: IAM mints it, and only a code IAM minted is exempt from the
+    // limit on guesses at an org's invitations. The row it answers carries it.
+    const created = (await call('/v1/iam/invitations', {
+        method: 'POST',
+        body: JSON.stringify({
+            owner: org,
+            name: mintName(),
+            displayName: email ? `Invitation for ${email}` : 'Invite link',
+            quota,
+            usedCount: 0,
+            email: email || '',
+            state: 'Active',
+        }),
+    }));
+    if (!created?.code)
+        throw new InviteRefusal(502, 'IAM made the invitation without a code');
+    return created;
+}
+/**
+ * One organization's invitations, newest first, redeemed ones included.
+ *
+ * The organization is named as `?owner=`, the one input IAM's list reads. A
+ * read that names none is authorized against no organization and refused.
+ */
+export async function listInvitations(org) {
+    const body = (await call(`/v1/iam/invitations?owner=${encodeURIComponent(org)}`));
+    return (body.invitations ?? []).filter((r) => r && r.code);
+}
+/**
+ * Emails the join link to the address an invitation is pinned to, and returns
+ * the address IAM sent it to. A refusal carries IAM's own reason.
+ */
+export async function sendInvitation(inv) {
+    try {
+        const body = (await call(`/v1/iam/invitations/${encodeURIComponent(inv.owner)}/${encodeURIComponent(inv.name)}/send`, { method: 'POST', body: '{}' }));
+        if (!body.sent)
+            throw new InviteRefusal(502, 'IAM did not send the email');
+        return body.to ?? '';
+    }
+    catch (e) {
+        if (!(e instanceof InviteRefusal))
+            throw e;
+        // IAM paces sends per invitation, per org and per mailbox, and names which.
+        if (e.status === 429)
+            throw new InviteRefusal(429, e.message || 'Wait before sending it again');
+        // An IAM that predates the send route answers a bare 404.
+        if (e.status === 404 && e.message.startsWith('Invitation service answered')) {
+            throw new InviteRefusal(404, 'Invitation emails are not switched on yet');
+        }
+        throw e;
+    }
+}
+/**
+ * The organization's shared invite link: an active invitation pinned to nobody
+ * with a seat left. Pinned invitations are one person's and are not it.
+ */
+export function shareable(rows) {
+    return rows.find((r) => r.state === 'Active' && !r.email && r.quota > 1 && r.usedCount < r.quota);
+}
+/** Withdraws an invitation so its code stops redeeming. */
+export async function withdrawInvitation(inv) {
+    await call(`/v1/iam/invitations/${encodeURIComponent(inv.owner)}/${encodeURIComponent(inv.name)}`, {
+        method: 'DELETE',
+    });
+}
+/**
+ * Sets how the organization APPEARS: an image, or one emoji, or neither.
+ *
+ * `POST /v1/iam/organizations/avatar` writes those two fields onto the stored
+ * row and touches nothing else — which the general update cannot do, because it
+ * replaces the whole record and a record read back arrives MASKED, so a
+ * read-modify-write through it would persist the mask over the organization's
+ * own credential settings. That is IAM's own reason for publishing this route,
+ * and it is why the logo does not go through `updateOrganization`.
+ *
+ * An image is an https link or the bytes inline as a data URL, up to 96 KiB —
+ * the same bound and the same shape `lib/mark.ts` already produces for a
+ * person's photograph, so a logo is not a second kind of picture.
+ */
+export async function setOrganizationMark(owner, name, mark) {
+    await call('/v1/iam/organizations/avatar', {
+        method: 'POST',
+        body: JSON.stringify({ owner, name, ...mark }),
+    });
+}
+/**
+ * Changes how an organization READS: its display name and its website.
+ *
+ * `POST /v1/iam/organizations/profile`, the sibling of the avatar route, and it
+ * exists for the same reason. Update REPLACES the record, so sending just a new
+ * name blanks the website and the sign-in rules — and a record read back arrives
+ * MASKED, so the obvious read-modify-write stores "***" as the master password.
+ * One costs the organization its settings, the other its credentials. This
+ * writes the fields it names and touches nothing else.
+ *
+ * A field left `undefined` is not sent and not changed; `''` is sent and clears.
+ */
+export async function setOrganizationProfile(owner, name, profile) {
+    await call('/v1/iam/organizations/profile', {
+        method: 'POST',
+        body: JSON.stringify({ owner, name, ...profile }),
+    });
+}
+/**
+ * The organization's people: everyone who may act in it, with their role.
+ *
+ * Two reads, because IAM grants access two ways: a MEMBERSHIP row (someone who
+ * lives in another org and was let into this one) and an account that LIVES in
+ * this org, whose access is the account itself and has no row. A person usually
+ * lives in their own personal organization and acts in a team one, so a team
+ * org's people are mostly rows; an older org's people mostly live in it.
+ *
+ * A membership row carries the account and the role and no name, and IAM lets a
+ * reader open accounts in the org's own directory and no other org's. So each
+ * member is named from what the reader may read: the reader from their own
+ * account (`self`, where the caller holds it), a member who lives in the org
+ * from its directory, and anyone else by the username the row carries. The
+ * directory also marks the org's service accounts, which are left out: the
+ * roster beside the agents is where somebody looks for those. A reader who may
+ * not read the directory sees the rows alone, by username.
+ */
+export async function members(org, self) {
+    const q = encodeURIComponent(org);
+    const [roster, directory] = await Promise.all([
+        call(`/v1/iam/memberships?org=${q}`),
+        call(`/v1/iam/users?owner=${q}`).catch(() => ({ users: [] })),
+    ]);
+    const accounts = directory?.users ?? [];
+    const key = (u) => `${u.owner}/${u.name}`;
+    const machines = new Set(accounts.filter((u) => u?.type === 'service-account').map(key));
+    const people = accounts.filter((u) => u?.type !== 'service-account');
+    const known = new Map(people.map((u) => [key(u), u]));
+    const mine = me();
+    const rows = (Array.isArray(roster?.data) ? roster.data : []).filter((r) => typeof r?.user === 'string' && r.user.includes('/'));
+    const named = (id, role, home) => {
+        const username = id.slice(id.indexOf('/') + 1);
+        if (self && id === mine)
+            return { id, name: self.name || username, email: self.email, role, home };
+        const account = known.get(id);
+        return { id, name: account?.displayName || username, email: account?.email ?? '', role, home };
+    };
+    const listed = new Set();
+    const out = [];
+    for (const r of rows) {
+        if (machines.has(r.user))
+            continue;
+        listed.add(r.user);
+        out.push(named(r.user, r.role, r.user.slice(0, r.user.indexOf('/')) === org));
+    }
+    // Everyone whose account lives here acts here, row or no row: IAM puts the home
+    // org first in every token it mints (store.MemberOrgRefs) with the role the
+    // account's own flag gives it (store.HomeRole).
+    for (const u of people) {
+        const id = key(u);
+        if (listed.has(id))
+            continue;
+        out.push(named(id, u.isAdmin ? 'admin' : 'member', true));
+    }
+    return out;
+}
+/**
+ * Changes an existing member's role: `POST /v1/iam/memberships {user, org, role}`,
+ * the one role write HIP-0527 names, by an owner or admin of the org. Resolves to
+ * the role IAM holds for them afterwards, read back from the roster, so a caller
+ * reports what IAM stored rather than what it asked for.
+ */
+export async function setRole(org, user, next) {
+    await call('/v1/iam/memberships', { method: 'POST', body: JSON.stringify({ user, org, role: next }) });
+    const roster = (await call(`/v1/iam/memberships?org=${encodeURIComponent(org)}`));
+    return (Array.isArray(roster?.data) ? roster.data : []).find((r) => r?.user === user)?.role ?? null;
+}
+/**
+ * Ends someone's access to the org: `POST /v1/iam/delete-membership {user, org}`.
+ * Their account survives. IAM refuses it for a person whose account lives in the
+ * org, and says so in its own words.
+ */
+export async function removeMember(org, user) {
+    await call('/v1/iam/delete-membership', { method: 'POST', body: JSON.stringify({ user, org }) });
+}

package/dist/lib/limits.d.ts

@@ -0,0 +1,55 @@
+/** One window: the percent of it used, and when it starts over. */
+export interface Span {
+    /** Used, 0–100. */
+    percent: number;
+    /** RFC 3339, or null when no window is running — a session starts at the next request. */
+    resets_at: string | null;
+}
+export interface Limits {
+    /** The plan slug ("max-20x"), or "" for a caller with no plan. */
+    plan: string;
+    period_start?: string;
+    period_end?: string;
+    session?: Span;
+    day?: Span;
+    month?: Span;
+    /** The next plan's slug, "" at the top of the ladder. */
+    upgrade?: string;
+}
+/**
+ * The answer, checked field by field: it is a network response. A body without
+ * a string `plan` is not an answer at all; a window without a numeric percent
+ * is left out rather than drawn as full or empty.
+ */
+export declare function limitsOf(body: unknown): Limits | null;
+/** Reads the limits as whoever holds the bearer, in this browser's organization. */
+export declare function readLimits(signal?: AbortSignal): Promise<Limits>;
+/**
+ * The limits, held, and the way to read them again. `limits` is `null` until
+ * answered, and after a refusal: a reader whose limits are unknown is drawn no
+ * bars. `answered` says the first read has come back either way, so a surface
+ * that shows something only to a reader with no plan waits for it.
+ */
+export declare function useLimits(enabled?: boolean, org?: string | null): {
+    limits: Limits | null;
+    answered: boolean;
+    reload: () => void;
+};
+/**
+ * Whether a reader's dollar spend may be shown: their limits came back and name no
+ * plan, or could not be read. A plan holder sees usage as shares, never money.
+ */
+export declare const spendShown: ({ limits, answered }: {
+    limits: Limits | null;
+    answered: boolean;
+}) => boolean;
+/** What is left of a window, 0–100: the bar goes down as it is used. */
+export declare const left: (s: Span) => number;
+/** Whether a model is a Hanzo SKU — an Enso or Zen id — the only models a consumer surface offers. */
+export declare const sku: (id: string) => boolean;
+/** A reset as a clock reads it in this browser — "17:00" — or '' for none. */
+export declare function clock(iso: string | null | undefined): string;
+/** A period's end as a sentence states it — "Oct 30, 2026" — or '' for none. Periods end on UTC days. */
+export declare function date(iso: string | null | undefined): string;
+/** A period's end without its year — "Oct 30" — for the month bar. */
+export declare function day(iso: string | null | undefined): string;

package/dist/lib/limits.js

@@ -0,0 +1,119 @@
+'use client';
+/**
+ * WHAT A PLAN HOLDER HAS LEFT, AS A SHARE.
+ *
+ * A paid plan is a subscription with usage limits, never a debit from a
+ * balance. `GET /v1/ai/limits` answers the acting org's plan and three
+ * windows — the five-hour session, the day, and the billing month — each as
+ * the percent USED with the moment it resets, and the next plan up. Shares
+ * only: nothing here is a count of requests or an amount of money.
+ *
+ * The month is the plan's included usage for the period. Spending it refuses
+ * nothing — Enso and Zen keep answering from free models — so it is a line
+ * under the bars, never a refusal. The session and the day refuse when spent.
+ *
+ * `plan` "" is a caller with no plan (Free), and then nothing else is sent:
+ * that reader keeps the Free display. A read that fails is `null`, which is not
+ * knowing, and nothing is drawn from it.
+ *
+ * Same base URL and headers as every billing read (lib/hanzo/tier.ts): the
+ * bearer is the subject and `X-Org-Id` the organization this browser works in.
+ */
+import { useCallback, useEffect, useState } from 'react';
+import { api } from './api.js';
+import { scope } from './session.js';
+const text = (v) => (typeof v === 'string' ? v : null);
+function span(v) {
+    const o = v;
+    const p = o?.percent;
+    if (typeof p !== 'number' || !Number.isFinite(p))
+        return undefined;
+    return { percent: Math.min(100, Math.max(0, Math.round(p))), resets_at: text(o?.resets_at) };
+}
+/**
+ * The answer, checked field by field: it is a network response. A body without
+ * a string `plan` is not an answer at all; a window without a numeric percent
+ * is left out rather than drawn as full or empty.
+ */
+export function limitsOf(body) {
+    const o = body;
+    const plan = text(o?.plan);
+    if (plan === null)
+        return null;
+    if (plan === '')
+        return { plan };
+    return {
+        plan,
+        period_start: text(o?.period_start) ?? undefined,
+        period_end: text(o?.period_end) ?? undefined,
+        session: span(o?.session),
+        day: span(o?.day),
+        month: span(o?.month),
+        upgrade: text(o?.upgrade) ?? '',
+    };
+}
+/** Reads the limits as whoever holds the bearer, in this browser's organization. */
+export async function readLimits(signal) {
+    const res = await fetch(`${api()}/v1/ai/limits`, { headers: scope(), signal });
+    if (!res.ok)
+        throw Object.assign(new Error(`Limits answered ${res.status}`), { status: res.status });
+    const got = limitsOf(await res.json());
+    if (!got)
+        throw Object.assign(new Error('Limits answered without a plan'), { status: 502 });
+    return got;
+}
+/**
+ * The limits, held, and the way to read them again. `limits` is `null` until
+ * answered, and after a refusal: a reader whose limits are unknown is drawn no
+ * bars. `answered` says the first read has come back either way, so a surface
+ * that shows something only to a reader with no plan waits for it.
+ */
+export function useLimits(enabled = true, org = null) {
+    const [limits, setLimits] = useState(null);
+    const [answered, setAnswered] = useState(false);
+    const [nonce, setNonce] = useState(0);
+    useEffect(() => {
+        if (!enabled)
+            return;
+        const stop = new AbortController();
+        readLimits(stop.signal)
+            .then((got) => {
+            if (!stop.signal.aborted)
+                setLimits(got);
+        })
+            .catch(() => {
+            if (!stop.signal.aborted)
+                setLimits(null);
+        })
+            .finally(() => {
+            if (!stop.signal.aborted)
+                setAnswered(true);
+        });
+        return () => stop.abort();
+    }, [enabled, nonce, org]);
+    return { limits, answered, reload: useCallback(() => setNonce((n) => n + 1), []) };
+}
+/**
+ * Whether a reader's dollar spend may be shown: their limits came back and name no
+ * plan, or could not be read. A plan holder sees usage as shares, never money.
+ */
+export const spendShown = ({ limits, answered }) => answered && !limits?.plan;
+/** What is left of a window, 0–100: the bar goes down as it is used. */
+export const left = (s) => 100 - s.percent;
+/** Whether a model is a Hanzo SKU — an Enso or Zen id — the only models a consumer surface offers. */
+export const sku = (id) => /^(hanzo\/)?(enso|zen)/i.test(id);
+/** A reset as a clock reads it in this browser — "17:00" — or '' for none. */
+export function clock(iso) {
+    const t = iso ? Date.parse(iso) : NaN;
+    return Number.isNaN(t) ? '' : new Date(t).toLocaleTimeString('en-US', { hour: '2-digit', minute: '2-digit', hourCycle: 'h23' });
+}
+/** A period's end as a sentence states it — "Oct 30, 2026" — or '' for none. Periods end on UTC days. */
+export function date(iso) {
+    const t = iso ? Date.parse(iso) : NaN;
+    return Number.isNaN(t) ? '' : new Date(t).toLocaleDateString('en-US', { timeZone: 'UTC', year: 'numeric', month: 'short', day: 'numeric' });
+}
+/** A period's end without its year — "Oct 30" — for the month bar. */
+export function day(iso) {
+    const t = iso ? Date.parse(iso) : NaN;
+    return Number.isNaN(t) ? '' : new Date(t).toLocaleDateString('en-US', { timeZone: 'UTC', month: 'short', day: 'numeric' });
+}

package/dist/lib/list.d.ts

@@ -0,0 +1,9 @@
+/**
+ * A fetched list, as an array or nothing.
+ *
+ * `x ?? []` covers null and undefined and nothing else: a body that answers
+ * `{rooms: {}}`, or an error object where a page was expected, passes through
+ * it and the first `.filter` on it throws in render. A read from the network
+ * is a boundary, and this is the one check at it.
+ */
+export declare function list<T>(x: unknown): T[];

package/dist/lib/list.js

@@ -0,0 +1,11 @@
+/**
+ * A fetched list, as an array or nothing.
+ *
+ * `x ?? []` covers null and undefined and nothing else: a body that answers
+ * `{rooms: {}}`, or an error object where a page was expected, passes through
+ * it and the first `.filter` on it throws in render. A read from the network
+ * is a boundary, and this is the one check at it.
+ */
+export function list(x) {
+    return Array.isArray(x) ? x : [];
+}

package/dist/lib/mark.d.ts

@@ -0,0 +1,13 @@
+/** Longest reference IAM stores — `schema.AvatarLimit`, restated because it is
+ *  the far side of a wire. A write over it is refused there, so it is checked
+ *  here where a smaller encode is still possible. */
+export declare const LIMIT: number;
+/**
+ * A file the reader picked, as a data URL ready to store.
+ *
+ * Throws where the file is not an image the browser can decode, or where even
+ * the lowest quality is over the limit — both are things the caller must say
+ * out loud rather than swallow, because the alternative is a picture that
+ * silently did not change.
+ */
+export declare function mark(file: File): Promise<string>;

package/dist/lib/mark.js

@@ -0,0 +1,85 @@
+// A picked image, turned into the thing IAM stores.
+//
+// The server states the contract and states that this side exists:
+// `pkg/schema/avatar.go` accepts an `https` link or an inline `data:` URL of a
+// raster format, bounded at 96 KiB — "which is what a crop performed in a
+// browser produces". Nothing performed it. The profile page drew an upload
+// button with no handler, so the sentence described a step no code took.
+//
+// SQUARE, BECAUSE EVERY READER DRAWS IT ROUND. A portrait handed over whole is
+// cropped by whichever avatar happens to render it, and the person who chose
+// the picture is not the one choosing what survives. Cropping here means the
+// centre they framed is the centre stored.
+//
+// The bound is met by LOWERING QUALITY, not by refusing. A 4 MB photograph is
+// the normal thing to pick, and answering it with "too large" hands somebody an
+// image editor as homework; 256px at falling quality reaches the limit in two
+// or three steps and looks like what they chose.
+/** Longest reference IAM stores — `schema.AvatarLimit`, restated because it is
+ *  the far side of a wire. A write over it is refused there, so it is checked
+ *  here where a smaller encode is still possible. */
+export const LIMIT = 96 << 10;
+/** Side of the stored square. The limit was sized for this. */
+const SIDE = 256;
+/** Tried in order until one fits. Below the last, the picture is not worth keeping. */
+const QUALITY = [0.9, 0.75, 0.6, 0.45, 0.3];
+/** JPEG: every browser encodes it, and a photograph is what this holds. PNG at
+ *  256² is routinely over the limit for the same picture. */
+const KIND = 'image/jpeg';
+/**
+ * A file the reader picked, as a data URL ready to store.
+ *
+ * Throws where the file is not an image the browser can decode, or where even
+ * the lowest quality is over the limit — both are things the caller must say
+ * out loud rather than swallow, because the alternative is a picture that
+ * silently did not change.
+ */
+export async function mark(file) {
+    if (!file.type.startsWith('image/')) {
+        throw new Error('Pick an image file.');
+    }
+    const source = await decode(file);
+    const canvas = document.createElement('canvas');
+    canvas.width = SIDE;
+    canvas.height = SIDE;
+    const ink = canvas.getContext('2d');
+    if (!ink)
+        throw new Error('This browser cannot crop images.');
+    // The centre square of whatever was handed over, scaled to fill.
+    const edge = Math.min(source.width, source.height);
+    ink.drawImage(source, (source.width - edge) / 2, (source.height - edge) / 2, edge, edge, 0, 0, SIDE, SIDE);
+    if ('close' in source)
+        source.close();
+    for (const quality of QUALITY) {
+        const url = canvas.toDataURL(KIND, quality);
+        if (url.length <= LIMIT)
+            return url;
+    }
+    throw new Error('That image will not fit. Try a simpler one.');
+}
+/** `createImageBitmap` where it exists — it decodes off the main thread and
+ *  honours EXIF orientation, so a photo taken sideways is stored upright. The
+ *  `<img>` path is the fallback, and Safari below 17 is why there is one. */
+async function decode(file) {
+    if (typeof createImageBitmap === 'function') {
+        try {
+            return await createImageBitmap(file, { imageOrientation: 'from-image' });
+        }
+        catch {
+            // Fall through: a decoder that refuses the bytes may still be an image
+            // the element can read.
+        }
+    }
+    const url = URL.createObjectURL(file);
+    try {
+        return await new Promise((ok, no) => {
+            const img = new Image();
+            img.onload = () => ok(img);
+            img.onerror = () => no(new Error('That file is not an image this browser reads.'));
+            img.src = url;
+        });
+    }
+    finally {
+        URL.revokeObjectURL(url);
+    }
+}

package/dist/lib/mix.d.ts

@@ -0,0 +1,22 @@
+/**
+ * A colour mixed down to a share of itself, for a gui colour prop.
+ *
+ * gui hands a `color-mix()` to the page unchanged; its types only name custom
+ * properties, so the value is typed as one.
+ */
+export declare const mix: (ink: string, share: number, space?: 'oklab' | 'srgb') => `var(--${string})`;
+/**
+ * A state hue set as text: the hue mixed toward the theme's own ink.
+ *
+ * design's state colours are one value in both themes: `--state-success` is
+ * 2.1:1 on the light paper, and `--destructive` is a FILL (red-600, cut for the
+ * white label on it) that reads 4.1:1 as text on the dark ground. Mixed toward
+ * `--foreground` they darken on light and lighten on dark, and hold 4.5:1 on
+ * either theme's panes (measured on /meet and /drive) while still reading as
+ * the hue.
+ */
+export declare const hue: (ink: string, share: number) => `var(--${string})`;
+/** Success, said in text. */
+export declare const GOOD: `var(--${string})`;
+/** A destructive action's word. */
+export declare const BAD: `var(--${string})`;

package/dist/lib/mix.js

@@ -0,0 +1,22 @@
+/**
+ * A colour mixed down to a share of itself, for a gui colour prop.
+ *
+ * gui hands a `color-mix()` to the page unchanged; its types only name custom
+ * properties, so the value is typed as one.
+ */
+export const mix = (ink, share, space = 'oklab') => `color-mix(in ${space}, ${ink} ${share}%, transparent)`;
+/**
+ * A state hue set as text: the hue mixed toward the theme's own ink.
+ *
+ * design's state colours are one value in both themes: `--state-success` is
+ * 2.1:1 on the light paper, and `--destructive` is a FILL (red-600, cut for the
+ * white label on it) that reads 4.1:1 as text on the dark ground. Mixed toward
+ * `--foreground` they darken on light and lighten on dark, and hold 4.5:1 on
+ * either theme's panes (measured on /meet and /drive) while still reading as
+ * the hue.
+ */
+export const hue = (ink, share) => `color-mix(in srgb, ${ink} ${share}%, var(--foreground))`;
+/** Success, said in text. */
+export const GOOD = hue('var(--state-success)', 55);
+/** A destructive action's word. */
+export const BAD = hue('var(--destructive)', 70);

package/dist/lib/models.d.ts

@@ -0,0 +1,27 @@
+export { canonicalOrg, getOrgAndSlug, modelPagePath } from './path.js';
+/** The two fields naming needs. */
+export interface ModelData {
+    id: string;
+    name?: string;
+}
+export declare const ORG_DISPLAY_NAMES: Record<string, string>;
+export declare function orgDisplayName(org?: string): string;
+/**
+ * What a model is CALLED, as against the id it answers to.
+ *
+ * Two things the catalog does that a reader should not have to:
+ *
+ *   it names the house families by their slug — `name` is `"enso"`, the same
+ *   string as `id` — so the card would read "enso" twice, once in prose type
+ *   and once in mono. Title-case the slug and the card reads "Enso Flash" over
+ *   `enso-flash`, which is a name over an address.
+ *
+ *   it prefixes third-party names with the lab — `"DeepSeek: DeepSeek V4 Pro"`,
+ *   `"SpaceXAI: Grok 4.5"`. The lab is already the group the row sits in and
+ *   the namespace on the id beside it, so the prefix is the third telling.
+ *
+ * It lived on /models as a private helper while the table, the tile and the lab
+ * index all needed it, which is how the same model could read three ways on one
+ * page.
+ */
+export declare function modelName(model: Pick<ModelData, 'id' | 'name'>): string;