@intelligo-dev/auth 1.0.0-beta.1

package/dist/team/service.js

@@ -0,0 +1,438 @@
+/**
+ * Team management service — the durable business rules behind
+ * workspace membership and invitations, extracted from
+ * the product application’s team actions (first slice of the page/registry
+ * migration, section C1).
+ *
+ * Mirrors `createExecutions(ports)` (packages/executions/src/lifecycle.ts):
+ * a factory over optional ports, so this package's allowlisted
+ * dependency (`@intelligo-dev/core` only — see
+ * tests/architecture/dependency-direction.test.ts) never grows to
+ * include billing, email, or notifications. A consumer binds those in
+ * at its composition root:
+ *
+ *   const teamService = createTeamService({
+ *     checkMemberLimit: checkTeamMemberLimit,       // @intelligo-dev/billing
+ *     sendInvitationEmail: ...,                     // see note below
+ *     notifyMemberJoined: triggerTeamMemberJoinedNotification, // @intelligo-dev/core/notifications
+ *   });
+ *
+ * Authorization (`requireAuth`/`requireWorkspace`/`requireRole`) lives
+ * INSIDE each method, not at the transport. Every recognized failure
+ * throws `TeamServiceError` with a stable `code` — no
+ * revalidatePath/Sentry/next-intl/toast here; that shaping is the
+ * transport's job (a Server Action, a route handler).
+ *
+ * ---------------------------------------------------------------------
+ * Invitation-email duplication (investigated for this extraction)
+ * ---------------------------------------------------------------------
+ * `packages/auth/src/server.ts` configures the Better-Auth organization
+ * plugin's own `sendInvitationEmail` hook (EMAIL-06). Reading the
+ * installed org plugin (`better-auth@1.6.30`,
+ * `plugins/organization/routes/crud-invites.mjs`): every successful
+ * `/organization/invite-member` call — both the "new invitation" path
+ * and the "resend" path — unconditionally does
+ * `if (ctx.context.orgOptions.sendInvitationEmail) await
+ * runInBackgroundOrAwait(orgOptions.sendInvitationEmail(...))` once the
+ * invitation row is created. Because `server.ts` always sets that
+ * option, the hook fires on every `inviteMember()` call this service
+ * makes — there is no code path where it does not.
+ *
+ * ignite's current `actions/team.ts` ALSO calls
+ * `@intelligo-dev/core/email`'s `sendInvitationEmail` directly after the
+ * same `/organization/invite-member` call. That means **two** emails
+ * go out per invitation today. This is a live duplication bug, not a
+ * hypothetical.
+ *
+ * Decision: `inviteMember` below does NOT call `ports.sendInvitationEmail`
+ * by default — the org-plugin hook already covers it, so exactly one
+ * email fires per invitation as long as `server.ts`'s hook stays wired.
+ * The port is kept (and tested) for a consumer that disables or
+ * replaces that hook (e.g. a fork of `server.ts`, or a future
+ * environment where the org plugin's hook is intentionally left unset)
+ * — pass `sendInvitationEmail` and this service will use it. Bumping
+ * both at once will resume the duplication; do not turn the port back
+ * on without also removing the hook in `server.ts`.
+ *
+ * ---------------------------------------------------------------------
+ * Active-organization resolution (found the same way, via the
+ * integration test's real DB)
+ * ---------------------------------------------------------------------
+ * Better-Auth's organization plugin resolves "the caller's active
+ * workspace" from `session.activeOrganizationId` when a call omits an
+ * explicit `organizationId`. That column does not exist on this repo's
+ * Drizzle `sessions` schema (`packages/core/src/db/schema/auth.ts`), so
+ * every bare `auth.api.getFullOrganization({ headers })` call —
+ * ignite's original pattern in `listMembers`, `listInvitations`, and
+ * the sole-owner check in `leaveWorkspace` — resolves to *no*
+ * organization, regardless of what the caller most recently activated.
+ * `requireWorkspace()` (packages/auth/src/helpers.ts) never hits this:
+ * it has its own fallback that lists the caller's organizations and
+ * fetches the first one by explicit id. This service does the same —
+ * every `getFullOrganization` call below passes an explicit
+ * `organizationId` sourced from `requireWorkspace`/`requireRole`'s
+ * resolved `workspace.id` (or, in `acceptInvitation`, the invitation's
+ * own `organizationId`) rather than relying on session state. This is
+ * a behavior fix, not a stylistic change: without it, a fresh
+ * single-workspace user's own membership list comes back empty.
+ */
+import { headers } from "next/headers";
+import { createLogger } from "@intelligo-dev/core/logger";
+import { auth } from "../server";
+import { requireAuth, requireRole, requireWorkspace } from "../helpers";
+import { orgApi } from "../org-api";
+import { inviteMemberSchema, updateRoleSchema } from "./schemas";
+import { TeamServiceError, isTeamServiceError } from "./errors";
+const log = createLogger("TeamService");
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+/** Maps requireAuth/requireWorkspace/requireRole failures to `forbidden`. */
+function toForbidden(error) {
+    if (isTeamServiceError(error))
+        return error;
+    return new TeamServiceError("forbidden", errorMessage(error), {
+        cause: error,
+    });
+}
+function parseInput(schema, input) {
+    const result = schema.safeParse(input);
+    if (!result.success) {
+        throw new TeamServiceError("invalid_input", result.error.issues.map((issue) => issue.message).join("; ") ||
+            "Invalid input", { cause: result.error });
+    }
+    return result.data;
+}
+export function createTeamService(ports = {}) {
+    async function callRequireAuth() {
+        try {
+            return await requireAuth();
+        }
+        catch (error) {
+            throw toForbidden(error);
+        }
+    }
+    async function callRequireWorkspace() {
+        try {
+            return await requireWorkspace();
+        }
+        catch (error) {
+            throw toForbidden(error);
+        }
+    }
+    async function callRequireRole(allowedRoles) {
+        try {
+            return await requireRole(allowedRoles);
+        }
+        catch (error) {
+            throw toForbidden(error);
+        }
+    }
+    /** Wraps a Better-Auth org-plugin call; unrecognized failures become `provider_error`. */
+    async function callOrgApi(context, fn) {
+        try {
+            return await fn();
+        }
+        catch (error) {
+            if (isTeamServiceError(error))
+                throw error;
+            log.error("Org API call failed", { context, error: errorMessage(error) });
+            throw new TeamServiceError("provider_error", `Better-Auth organization API call failed (${context})`, { cause: error });
+        }
+    }
+    /**
+     * List members of the caller's active workspace.
+     */
+    async function listMembers() {
+        const { workspace } = await callRequireWorkspace();
+        const hdrs = await headers();
+        const org = await callOrgApi("getFullOrganization", () => auth.api.getFullOrganization({
+            headers: hdrs,
+            query: { organizationId: workspace.id },
+        }));
+        return (org?.members ?? []);
+    }
+    /**
+     * List pending invitations for the caller's active workspace.
+     */
+    async function listInvitations() {
+        const { workspace } = await callRequireWorkspace();
+        const hdrs = await headers();
+        const org = await callOrgApi("getFullOrganization", () => auth.api.getFullOrganization({
+            headers: hdrs,
+            query: { organizationId: workspace.id },
+        }));
+        return (org?.invitations ?? []);
+    }
+    /**
+     * Invite a member by email. Owner/admin only (TEAM-01).
+     *
+     * The member-limit port, when bound, gates the invite before it is
+     * created. Exactly one invitation email is sent — see the module doc
+     * comment on the email-duplication finding.
+     */
+    async function inviteMember(input) {
+        const { workspace, user } = await callRequireRole(["owner", "admin"]);
+        const validated = parseInput(inviteMemberSchema, input);
+        const hdrs = await headers();
+        // Check team member limit (FLAG-05), via port only.
+        if (ports.checkMemberLimit) {
+            const org = await callOrgApi("getFullOrganization", () => auth.api.getFullOrganization({
+                headers: hdrs,
+                query: { organizationId: workspace.id },
+            }));
+            const currentMemberCount = org?.members?.length ?? 0;
+            const limitCheck = await ports.checkMemberLimit(workspace.id, currentMemberCount);
+            if (!limitCheck.allowed) {
+                throw new TeamServiceError("member_limit_reached", `Your plan allows up to ${limitCheck.limit} team member${limitCheck.limit === 1 ? "" : "s"}. Upgrade to add more members.`, { meta: { limit: limitCheck.limit } });
+            }
+        }
+        // Better-Auth's own duplicate-pending-invite guard
+        // (USER_IS_ALREADY_INVITED_TO_THIS_ORGANIZATION) runs inside this
+        // call and surfaces as a provider_error if tripped — ignite's
+        // action never added a second check on top of it, so neither does
+        // this service.
+        const result = await callOrgApi("invite-member", () => orgApi["/organization/invite-member"]({
+            headers: hdrs,
+            body: {
+                email: validated.email,
+                role: validated.role,
+                organizationId: workspace.id,
+            },
+        }));
+        if (ports.sendInvitationEmail) {
+            const invitationId = result?.id ?? "";
+            ports
+                .sendInvitationEmail({
+                to: validated.email,
+                inviterName: user.name || "A team member",
+                workspaceName: workspace.name,
+                invitationId,
+                role: validated.role,
+            })
+                .catch((err) => log.error("Failed to send invitation email", {
+                error: errorMessage(err),
+            }));
+        }
+        return result;
+    }
+    /**
+     * Accept invitation (TEAM-03).
+     *
+     * Defence-in-depth against stolen-invitationId attacks: we (a)
+     * require the caller to be authenticated, (b) verify the
+     * invitationId is in the caller's pending list before forwarding it
+     * to Better-Auth, and (c) confirm the user is actually a member of
+     * the resulting org after the call. Better-Auth's accept-invitation
+     * endpoint already checks the email match, but layering these guards
+     * means a future upstream regression can't silently grant
+     * cross-tenant access.
+     */
+    async function acceptInvitation(invitationId) {
+        const { user } = await callRequireAuth();
+        const hdrs = await headers();
+        if (typeof invitationId !== "string" || invitationId.length === 0) {
+            throw new TeamServiceError("invalid_input", "Invalid invitation id");
+        }
+        // Pre-check: invitationId must be in the caller's pending list.
+        const pending = await callOrgApi("list-user-invitations", () => orgApi["/organization/list-user-invitations"]({ headers: hdrs }));
+        const matched = pending?.find((inv) => inv.id === invitationId);
+        if (!matched) {
+            log.warn("acceptInvitation rejected — invitation not in caller's pending list", { userId: user.id, invitationId });
+            throw new TeamServiceError("invitation_not_found", "Invitation not found");
+        }
+        await callOrgApi("accept-invitation", () => orgApi["/organization/accept-invitation"]({
+            headers: hdrs,
+            body: { invitationId },
+        }));
+        // Post-check: caller must now be a member of the target org.
+        const targetOrg = await callOrgApi("getFullOrganization", () => auth.api.getFullOrganization({
+            headers: hdrs,
+            query: { organizationId: matched.organizationId },
+        }));
+        const isMember = targetOrg?.members?.some((m) => m.userId === user.id);
+        if (!isMember) {
+            log.error("acceptInvitation post-check failed — not a member after accept", {
+                userId: user.id,
+                invitationId,
+                organizationId: matched.organizationId,
+            });
+            throw new TeamServiceError("accept_verification_failed", "Failed to accept invitation");
+        }
+        // Notify the workspace owner (fire-and-forget, non-blocking —
+        // invitation acceptance has already succeeded above).
+        //
+        // Reuses `targetOrg` from the post-check above (scoped to
+        // `matched.organizationId`, the org the caller just joined) rather
+        // than re-fetching "the active org" the way ignite's original
+        // action did: Better-Auth's org plugin needs a
+        // `sessions.activeOrganizationId` column to resolve an org from
+        // headers alone, and this repo's Drizzle schema for `sessions`
+        // does not define one, so a bare `getFullOrganization({ headers })`
+        // call resolves to no organization at all — this notify lookup
+        // would silently no-op every time. `targetOrg` sidesteps that by
+        // asking for the org we already know the answer for.
+        if (ports.notifyMemberJoined) {
+            try {
+                const session = await auth.api.getSession({ headers: hdrs });
+                if (session?.session && targetOrg) {
+                    const owner = targetOrg.members?.find((m) => m.role === "owner");
+                    if (owner) {
+                        const memberName = session.user?.name || "A new member";
+                        const memberEmail = session.user?.email || "";
+                        ports
+                            .notifyMemberJoined({
+                            workspaceId: targetOrg.id,
+                            workspaceName: targetOrg.name,
+                            memberName,
+                            memberEmail,
+                            ownerId: owner.userId,
+                        })
+                            .catch((err) => log.error("Failed to send join notification", {
+                            error: errorMessage(err),
+                        }));
+                    }
+                }
+            }
+            catch (notifError) {
+                log.error("Notification lookup failed", {
+                    error: errorMessage(notifError),
+                });
+                // Non-blocking — invitation acceptance still succeeds.
+            }
+        }
+    }
+    /**
+     * Reject/decline invitation (TEAM-04).
+     *
+     * Same caller-side guard as acceptInvitation: require auth and
+     * verify the invitationId is in the caller's pending list before
+     * forwarding.
+     */
+    async function rejectInvitation(invitationId) {
+        await callRequireAuth();
+        const hdrs = await headers();
+        if (typeof invitationId !== "string" || invitationId.length === 0) {
+            throw new TeamServiceError("invalid_input", "Invalid invitation id");
+        }
+        const pending = await callOrgApi("list-user-invitations", () => orgApi["/organization/list-user-invitations"]({ headers: hdrs }));
+        if (!pending?.some((inv) => inv.id === invitationId)) {
+            throw new TeamServiceError("invitation_not_found", "Invitation not found");
+        }
+        await callOrgApi("reject-invitation", () => orgApi["/organization/reject-invitation"]({
+            headers: hdrs,
+            body: { invitationId },
+        }));
+    }
+    /**
+     * Cancel a pending invitation. Owner/admin only.
+     */
+    async function cancelInvitation(invitationId) {
+        await callRequireRole(["owner", "admin"]);
+        const hdrs = await headers();
+        await callOrgApi("cancel-invitation", () => orgApi["/organization/cancel-invitation"]({
+            headers: hdrs,
+            body: { invitationId },
+        }));
+    }
+    /**
+     * Remove a member from workspace. Owner/admin only (TEAM-06).
+     */
+    async function removeMember(memberId) {
+        const { workspace } = await callRequireRole(["owner", "admin"]);
+        const hdrs = await headers();
+        await callOrgApi("remove-member", () => orgApi["/organization/remove-member"]({
+            headers: hdrs,
+            body: { memberIdOrEmail: memberId, organizationId: workspace.id },
+        }));
+    }
+    /**
+     * Update member role. Owner/admin only (TEAM-05, TEAM-08).
+     */
+    async function updateMemberRole(input) {
+        const { workspace } = await callRequireRole(["owner", "admin"]);
+        const validated = parseInput(updateRoleSchema, input);
+        const hdrs = await headers();
+        await callOrgApi("update-member-role", () => orgApi["/organization/update-member-role"]({
+            headers: hdrs,
+            body: {
+                memberId: validated.memberId,
+                role: validated.role,
+                organizationId: workspace.id,
+            },
+        }));
+    }
+    /**
+     * Leave workspace (TEAM-09). Sole owner cannot leave — must transfer
+     * ownership first.
+     */
+    async function leaveWorkspace() {
+        const { workspace, membership } = await callRequireWorkspace();
+        const hdrs = await headers();
+        if (membership.role === "owner") {
+            const org = await callOrgApi("getFullOrganization", () => auth.api.getFullOrganization({
+                headers: hdrs,
+                query: { organizationId: workspace.id },
+            }));
+            const owners = org?.members.filter((m) => m.role === "owner") ?? [];
+            if (owners.length <= 1) {
+                throw new TeamServiceError("sole_owner", "Cannot leave workspace as the sole owner. Transfer ownership first.");
+            }
+        }
+        await callOrgApi("leave", () => orgApi["/organization/leave"]({
+            headers: hdrs,
+            body: { organizationId: workspace.id },
+        }));
+        // Switch to another workspace, if one exists.
+        const orgs = await callOrgApi("list", () => orgApi["/organization/list"]({ headers: hdrs }));
+        if (orgs && orgs.length > 0) {
+            await callOrgApi("set-active", () => orgApi["/organization/set-active"]({
+                headers: hdrs,
+                body: { organizationId: orgs[0].id },
+            }));
+        }
+    }
+    /**
+     * Transfer workspace ownership to another member. Owner only (TEAM-07).
+     */
+    async function transferOwnership(targetMemberId) {
+        const { workspace } = await callRequireRole(["owner"]);
+        const hdrs = await headers();
+        // Promote target to owner. Note: Better-Auth may handle demotion of
+        // the previous owner automatically. If not, the old owner remains
+        // as co-owner, which is acceptable (ported behavior).
+        await callOrgApi("update-member-role", () => orgApi["/organization/update-member-role"]({
+            headers: hdrs,
+            body: {
+                memberId: targetMemberId,
+                role: "owner",
+                organizationId: workspace.id,
+            },
+        }));
+    }
+    /**
+     * Get the caller's own pending invitations (for the invitation
+     * accept page). No explicit requireAuth here — Better-Auth's
+     * list-user-invitations endpoint reads the session off `headers`
+     * itself; ported as-is from ignite's action.
+     */
+    async function getUserInvitations() {
+        const hdrs = await headers();
+        const invitations = await callOrgApi("list-user-invitations", () => orgApi["/organization/list-user-invitations"]({ headers: hdrs }));
+        return invitations ?? [];
+    }
+    return {
+        listMembers,
+        listInvitations,
+        inviteMember,
+        cancelInvitation,
+        removeMember,
+        updateMemberRole,
+        leaveWorkspace,
+        transferOwnership,
+        acceptInvitation,
+        rejectInvitation,
+        getUserInvitations,
+    };
+}
+//# sourceMappingURL=service.js.map

package/dist/team/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/team/service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6EG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAE1D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACxE,OAAO,EAAE,MAAM,EAAsC,MAAM,YAAY,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAEhE,MAAM,GAAG,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;AAyCxC,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,6EAA6E;AAC7E,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,kBAAkB,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,IAAI,gBAAgB,CAAC,WAAW,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE;QAC5D,KAAK,EAAE,KAAK;KACb,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAI,MAAkB,EAAE,KAAc;IACvD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,gBAAgB,CACxB,eAAe,EACf,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAC1D,eAAe,EACjB,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CACxB,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAA0B,EAAE;IAC5D,KAAK,UAAU,eAAe;QAC5B,IAAI,CAAC;YACH,OAAO,MAAM,WAAW,EAAE,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,KAAK,UAAU,oBAAoB;QACjC,IAAI,CAAC;YACH,OAAO,MAAM,gBAAgB,EAAE,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,KAAK,UAAU,eAAe,CAC5B,YAAiD;QAEjD,IAAI,CAAC;YACH,OAAO,MAAM,WAAW,CAAC,YAAY,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,0FAA0F;IAC1F,KAAK,UAAU,UAAU,CACvB,OAAe,EACf,EAAoB;QAEpB,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,EAAE,CAAC;QACpB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,kBAAkB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC3C,GAAG,CAAC,KAAK,CAAC,qBAAqB,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC1E,MAAM,IAAI,gBAAgB,CACxB,gBAAgB,EAChB,6CAA6C,OAAO,GAAG,EACvD,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,UAAU,WAAW;QACxB,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,oBAAoB,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,MAAM,OAAO,EAAE,CAAC;QAE7B,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,qBAAqB,EAAE,GAAG,EAAE,CACvD,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC;YAC3B,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,EAAE,cAAc,EAAE,SAAS,CAAC,EAAE,EAAE;SACxC,CAAC,CACH,CAAC;QAEF,OAAO,CAAC,GAAG,EAAE,OAAO,IAAI,EAAE,CAAgB,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,KAAK,UAAU,eAAe;QAC5B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,oBAAoB,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,MAAM,OAAO,EAAE,CAAC;QAE7B,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,qBAAqB,EAAE,GAAG,EAAE,CACvD,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC;YAC3B,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,EAAE,cAAc,EAAE,SAAS,CAAC,EAAE,EAAE;SACxC,CAAC,CACH,CAAC;QAEF,OAAO,CAAC,GAAG,EAAE,WAAW,IAAI,EAAE,CAAoB,CAAC;IACrD,CAAC;IAED;;;;;;OAMG;IACH,KAAK,UAAU,YAAY,CAAC,KAG3B;QACC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,MAAM,eAAe,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QACtE,MAAM,SAAS,GAAG,UAAU,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC;QACxD,MAAM,IAAI,GAAG,MAAM,OAAO,EAAE,CAAC;QAE7B,oDAAoD;QACpD,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,qBAAqB,EAAE,GAAG,EAAE,CACvD,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC;gBAC3B,OAAO,EAAE,IAAI;gBACb,KAAK,EAAE,EAAE,cAAc,EAAE,SAAS,CAAC,EAAE,EAAE;aACxC,CAAC,CACH,CAAC;YACF,MAAM,kBAAkB,GAAG,GAAG,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC;YAErD,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAC7C,SAAS,CAAC,EAAE,EACZ,kBAAkB,CACnB,CAAC;YACF,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;gBACxB,MAAM,IAAI,gBAAgB,CACxB,sBAAsB,EACtB,0BAA0B,UAAU,CAAC,KAAK,eACxC,UAAU,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAChC,gCAAgC,EAChC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,EAAE,CACtC,CAAC;YACJ,CAAC;QACH,CAAC;QAED,mDAAmD;QACnD,kEAAkE;QAClE,8DAA8D;QAC9D,kEAAkE;QAClE,gBAAgB;QAChB,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,eAAe,EAAE,GAAG,EAAE,CACpD,MAAM,CAAC,6BAA6B,CAAC,CAAC;YACpC,OAAO,EAAE,IAAI;YACb,IAAI,EAAE;gBACJ,KAAK,EAAE,SAAS,CAAC,KAAK;gBACtB,IAAI,EAAE,SAAS,CAAC,IAAI;gBACpB,cAAc,EAAE,SAAS,CAAC,EAAE;aAC7B;SACF,CAAC,CACH,CAAC;QAEF,IAAI,KAAK,CAAC,mBAAmB,EAAE,CAAC;YAC9B,MAAM,YAAY,GAAG,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC;YACtC,KAAK;iBACF,mBAAmB,CAAC;gBACnB,EAAE,EAAE,SAAS,CAAC,KAAK;gBACnB,WAAW,EAAE,IAAI,CAAC,IAAI,IAAI,eAAe;gBACzC,aAAa,EAAE,SAAS,CAAC,IAAI;gBAC7B,YAAY;gBACZ,IAAI,EAAE,SAAS,CAAC,IAAI;aACrB,CAAC;iBACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CACb,GAAG,CAAC,KAAK,CAAC,iCAAiC,EAAE;gBAC3C,KAAK,EAAE,YAAY,CAAC,GAAG,CAAC;aACzB,CAAC,CACH,CAAC;QACN,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,UAAU,gBAAgB,CAAC,YAAoB;QAClD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,MAAM,OAAO,EAAE,CAAC;QAE7B,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,uBAAuB,CAAC,CAAC;QACvE,CAAC;QAED,gEAAgE;QAChE,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAC7D,MAAM,CAAC,qCAAqC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CACjE,CAAC;QACF,MAAM,OAAO,GAAG,OAAO,EAAE,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,YAAY,CAAC,CAAC;QAChE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CACN,qEAAqE,EACrE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,YAAY,EAAE,CAClC,CAAC;YACF,MAAM,IAAI,gBAAgB,CACxB,sBAAsB,EACtB,sBAAsB,CACvB,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,CAAC,mBAAmB,EAAE,GAAG,EAAE,CACzC,MAAM,CAAC,iCAAiC,CAAC,CAAC;YACxC,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,EAAE,YAAY,EAAE;SACvB,CAAC,CACH,CAAC;QAEF,6DAA6D;QAC7D,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,qBAAqB,EAAE,GAAG,EAAE,CAC7D,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC;YAC3B,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE;SAClD,CAAC,CACH,CAAC;QACF,MAAM,QAAQ,GAAG,SAAS,EAAE,OAAO,EAAE,IAAI,CACvC,CAAC,CAAY,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,CACvC,CAAC;QACF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,GAAG,CAAC,KAAK,CACP,gEAAgE,EAChE;gBACE,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,YAAY;gBACZ,cAAc,EAAE,OAAO,CAAC,cAAc;aACvC,CACF,CAAC;YACF,MAAM,IAAI,gBAAgB,CACxB,4BAA4B,EAC5B,6BAA6B,CAC9B,CAAC;QACJ,CAAC;QAED,8DAA8D;QAC9D,sDAAsD;QACtD,EAAE;QACF,0DAA0D;QAC1D,mEAAmE;QACnE,8DAA8D;QAC9D,+CAA+C;QAC/C,gEAAgE;QAChE,+DAA+D;QAC/D,oEAAoE;QACpE,+DAA+D;QAC/D,iEAAiE;QACjE,qDAAqD;QACrD,IAAI,KAAK,CAAC,kBAAkB,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC7D,IAAI,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,CAAC;oBAClC,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,CACnC,CAAC,CAAY,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CACrC,CAAC;oBACF,IAAI,KAAK,EAAE,CAAC;wBACV,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,IAAI,cAAc,CAAC;wBACxD,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;wBAC9C,KAAK;6BACF,kBAAkB,CAAC;4BAClB,WAAW,EAAE,SAAS,CAAC,EAAE;4BACzB,aAAa,EAAE,SAAS,CAAC,IAAI;4BAC7B,UAAU;4BACV,WAAW;4BACX,OAAO,EAAE,KAAK,CAAC,MAAM;yBACtB,CAAC;6BACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CACb,GAAG,CAAC,KAAK,CAAC,kCAAkC,EAAE;4BAC5C,KAAK,EAAE,YAAY,CAAC,GAAG,CAAC;yBACzB,CAAC,CACH,CAAC;oBACN,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,OAAO,UAAU,EAAE,CAAC;gBACpB,GAAG,CAAC,KAAK,CAAC,4BAA4B,EAAE;oBACtC,KAAK,EAAE,YAAY,CAAC,UAAU,CAAC;iBAChC,CAAC,CAAC;gBACH,uDAAuD;YACzD,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,UAAU,gBAAgB,CAAC,YAAoB;QAClD,MAAM,eAAe,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,MAAM,OAAO,EAAE,CAAC;QAE7B,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,uBAAuB,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAC7D,MAAM,CAAC,qCAAqC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CACjE,CAAC;QACF,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,YAAY,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,gBAAgB,CACxB,sBAAsB,EACtB,sBAAsB,CACvB,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,CAAC,mBAAmB,EAAE,GAAG,EAAE,CACzC,MAAM,CAAC,iCAAiC,CAAC,CAAC;YACxC,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,EAAE,YAAY,EAAE;SACvB,CAAC,CACH,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,UAAU,gBAAgB,CAAC,YAAoB;QAClD,MAAM,eAAe,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,MAAM,OAAO,EAAE,CAAC;QAE7B,MAAM,UAAU,CAAC,mBAAmB,EAAE,GAAG,EAAE,CACzC,MAAM,CAAC,iCAAiC,CAAC,CAAC;YACxC,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,EAAE,YAAY,EAAE;SACvB,CAAC,CACH,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,UAAU,YAAY,CAAC,QAAgB;QAC1C,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,eAAe,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QAChE,MAAM,IAAI,GAAG,MAAM,OAAO,EAAE,CAAC;QAE7B,MAAM,UAAU,CAAC,eAAe,EAAE,GAAG,EAAE,CACrC,MAAM,CAAC,6BAA6B,CAAC,CAAC;YACpC,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,EAAE,eAAe,EAAE,QAAQ,EAAE,cAAc,EAAE,SAAS,CAAC,EAAE,EAAE;SAClE,CAAC,CACH,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,UAAU,gBAAgB,CAAC,KAG/B;QACC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,eAAe,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QAChE,MAAM,SAAS,GAAG,UAAU,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,MAAM,OAAO,EAAE,CAAC;QAE7B,MAAM,UAAU,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAC1C,MAAM,CAAC,kCAAkC,CAAC,CAAC;YACzC,OAAO,EAAE,IAAI;YACb,IAAI,EAAE;gBACJ,QAAQ,EAAE,SAAS,CAAC,QAAQ;gBAC5B,IAAI,EAAE,SAAS,CAAC,IAAI;gBACpB,cAAc,EAAE,SAAS,CAAC,EAAE;aAC7B;SACF,CAAC,CACH,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,UAAU,cAAc;QAC3B,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,oBAAoB,EAAE,CAAC;QAC/D,MAAM,IAAI,GAAG,MAAM,OAAO,EAAE,CAAC;QAE7B,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,qBAAqB,EAAE,GAAG,EAAE,CACvD,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC;gBAC3B,OAAO,EAAE,IAAI;gBACb,KAAK,EAAE,EAAE,cAAc,EAAE,SAAS,CAAC,EAAE,EAAE;aACxC,CAAC,CACH,CAAC;YACF,MAAM,MAAM,GACV,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAY,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,EAAE,CAAC;YAClE,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAI,gBAAgB,CACxB,YAAY,EACZ,qEAAqE,CACtE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,CAC7B,MAAM,CAAC,qBAAqB,CAAC,CAAC;YAC5B,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,EAAE,cAAc,EAAE,SAAS,CAAC,EAAE,EAAE;SACvC,CAAC,CACH,CAAC;QAEF,8CAA8C;QAC9C,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,CACzC,MAAM,CAAC,oBAAoB,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAChD,CAAC;QACF,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,UAAU,CAAC,YAAY,EAAE,GAAG,EAAE,CAClC,MAAM,CAAC,0BAA0B,CAAC,CAAC;gBACjC,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC,CAAE,CAAC,EAAE,EAAE;aACtC,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,UAAU,iBAAiB,CAAC,cAAsB;QACrD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,MAAM,OAAO,EAAE,CAAC;QAE7B,oEAAoE;QACpE,kEAAkE;QAClE,sDAAsD;QACtD,MAAM,UAAU,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAC1C,MAAM,CAAC,kCAAkC,CAAC,CAAC;YACzC,OAAO,EAAE,IAAI;YACb,IAAI,EAAE;gBACJ,QAAQ,EAAE,cAAc;gBACxB,IAAI,EAAE,OAAO;gBACb,cAAc,EAAE,SAAS,CAAC,EAAE;aAC7B;SACF,CAAC,CACH,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,UAAU,kBAAkB;QAC/B,MAAM,IAAI,GAAG,MAAM,OAAO,EAAE,CAAC;QAE7B,MAAM,WAAW,GAAG,MAAM,UAAU,CAAC,uBAAuB,EAAE,GAAG,EAAE,CACjE,MAAM,CAAC,qCAAqC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CACjE,CAAC;QAEF,OAAO,WAAW,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,OAAO;QACL,WAAW;QACX,eAAe;QACf,YAAY;QACZ,gBAAgB;QAChB,YAAY;QACZ,gBAAgB;QAChB,cAAc;QACd,iBAAiB;QACjB,gBAAgB;QAChB,gBAAgB;QAChB,kBAAkB;KACnB,CAAC;AACJ,CAAC"}

package/dist/workspace/errors.js

@@ -0,0 +1,32 @@
+/**
+ * Workspace service error type.
+ *
+ * Mirrors `../team/errors.ts` exactly, one directory over: the
+ * workspace service (./service.ts) throws this for every failure it
+ * recognizes rather than returning an ad-hoc `{ success, error }`
+ * envelope — that shaping is a transport concern (a Server Action, a
+ * route handler) and belongs one layer up, alongside
+ * revalidatePath/Sentry/toast/i18n, none of which this package may
+ * depend on.
+ */
+export class WorkspaceServiceError extends Error {
+    constructor(code, message, options) {
+        super(message);
+        this.name = "WorkspaceServiceError";
+        this.code = code;
+        this.meta = options?.meta;
+        if (options?.cause !== undefined) {
+            // ES2020 target predates the standard `cause` constructor option;
+            // assign it directly so `instanceof Error` consumers (and Node's
+            // own error inspection) still see it.
+            this.cause = options.cause;
+        }
+        // Restore prototype chain (extending built-ins across some
+        // transpilation targets loses `instanceof`).
+        Object.setPrototypeOf(this, WorkspaceServiceError.prototype);
+    }
+}
+export function isWorkspaceServiceError(error) {
+    return error instanceof WorkspaceServiceError;
+}
+//# sourceMappingURL=errors.js.map

package/dist/workspace/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/workspace/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AA4BH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAI9C,YACE,IAA+B,EAC/B,OAAe,EACf,OAA+D;QAE/D,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,OAAO,EAAE,IAAI,CAAC;QAC1B,IAAI,OAAO,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;YACjC,kEAAkE;YAClE,iEAAiE;YACjE,sCAAsC;YACrC,IAA4B,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QACtD,CAAC;QAED,2DAA2D;QAC3D,6CAA6C;QAC7C,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAC/D,CAAC;CACF;AAED,MAAM,UAAU,uBAAuB,CACrC,KAAc;IAEd,OAAO,KAAK,YAAY,qBAAqB,CAAC;AAChD,CAAC"}

package/dist/workspace/schemas.js

@@ -0,0 +1,45 @@
+/**
+ * Workspace Validation Schemas
+ *
+ * Zod schemas for workspace create/update inputs, shared by the
+ * workspace service and its transports.
+ *
+ * (Ported from the product application's workspace validation module —
+ * same semantics. Ignite's copy is retired at cutover.)
+ */
+import { z } from "zod";
+/**
+ * Create Workspace Schema
+ * Name + optional slug for new workspaces
+ */
+export const createWorkspaceSchema = z.object({
+    name: z
+        .string()
+        .min(2, "Workspace name must be at least 2 characters")
+        .max(50, "Workspace name must be at most 50 characters"),
+    slug: z
+        .string()
+        .min(2, "Slug must be at least 2 characters")
+        .max(50, "Slug must be at most 50 characters")
+        .regex(/^[a-z0-9-]+$/, "Slug can only contain lowercase letters, numbers, and hyphens")
+        .optional(), // Auto-generated from name if not provided
+});
+/**
+ * Update Workspace Schema
+ * Optional name, slug, and logo for workspace settings
+ */
+export const updateWorkspaceSchema = z.object({
+    name: z
+        .string()
+        .min(2, "Workspace name must be at least 2 characters")
+        .max(50, "Workspace name must be at most 50 characters")
+        .optional(),
+    slug: z
+        .string()
+        .min(2, "Slug must be at least 2 characters")
+        .max(50, "Slug must be at most 50 characters")
+        .regex(/^[a-z0-9-]+$/, "Slug can only contain lowercase letters, numbers, and hyphens")
+        .optional(),
+    logo: z.string().url("Logo must be a valid URL").optional().nullable(),
+});
+//# sourceMappingURL=schemas.js.map

package/dist/workspace/schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../src/workspace/schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,EAAE,8CAA8C,CAAC;SACtD,GAAG,CAAC,EAAE,EAAE,8CAA8C,CAAC;IAC1D,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,EAAE,oCAAoC,CAAC;SAC5C,GAAG,CAAC,EAAE,EAAE,oCAAoC,CAAC;SAC7C,KAAK,CACJ,cAAc,EACd,+DAA+D,CAChE;SACA,QAAQ,EAAE,EAAE,2CAA2C;CAC3D,CAAC,CAAC;AAIH;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,EAAE,8CAA8C,CAAC;SACtD,GAAG,CAAC,EAAE,EAAE,8CAA8C,CAAC;SACvD,QAAQ,EAAE;IACb,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,EAAE,oCAAoC,CAAC;SAC5C,GAAG,CAAC,EAAE,EAAE,oCAAoC,CAAC;SAC7C,KAAK,CACJ,cAAc,EACd,+DAA+D,CAChE;SACA,QAAQ,EAAE;IACb,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACvE,CAAC,CAAC"}