@stapel/workspaces-react 0.5.0 → 0.7.0

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,gFAAgF;AAChF,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAI7D,gFAAgF;AAChF,4EAA4E;AAC5E,4EAA4E;AAC5E,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAOvE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAOtE,gFAAgF;AAChF,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAK7D,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAE3D,gFAAgF;AAChF,OAAO,EACL,aAAa,EACb,YAAY,EACZ,UAAU,GACX,MAAM,oBAAoB,CAAC;AAE5B,gFAAgF;AAChF,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,EACf,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAqB9B,gFAAgF;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAE5D,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAEhD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAGlE,gFAAgF;AAChF,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AAGxB,gFAAgF;AAChF,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,gFAAgF;AAChF,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAI7D,gFAAgF;AAChF,4EAA4E;AAC5E,4EAA4E;AAC5E,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAOvE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAMrE,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAOtE,gFAAgF;AAChF,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAK7D,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAE3D,gFAAgF;AAChF,OAAO,EACL,aAAa,EACb,YAAY,EACZ,UAAU,EACV,QAAQ,EACR,oBAAoB,EACpB,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAG5B,gFAAgF;AAChF,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC3E,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAEnE,gFAAgF;AAChF,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,EACf,mBAAmB,EACnB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAyB9B,gFAAgF;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAE5D,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAEhD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAElE,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAC;AAExC,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAEtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAGlE,gFAAgF;AAChF,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AAGxB,gFAAgF;AAChF,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC"}

package/dist/model/capabilities.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Client-side capability matcher (org-program §A1/§A2) — a PORT of
+ * stapel-workspaces' `capabilities.capability_matches` (which is itself
+ * mirrored by the consumer helper in `stapel_core.django.workspaces`).
+ * KEEP SEMANTICS IN SYNC with the backend: capability strings are namespaced
+ * `"<domain>.<action>"`, free-form for the client (`meetings.spotlight`,
+ * `records.view`, …); a granted string may be the exact capability, the
+ * global wildcard `"*"`, or a prefix wildcard like `"members.*"` (which
+ * matches `members.remove` AND deeper `members.role.change`).
+ *
+ * The client-side check is a UI convenience (hide/disable affordances) —
+ * NEVER an access decision: the backend re-checks every capability on every
+ * operation (`has_capability` in-service, `workspaces.check_capability`
+ * cross-service).
+ */
+/** Match one granted capability string against the requested one. */
+export declare function capabilityMatches(capability: string, granted: string): boolean;
+/** True if any of `granted` (verbatim registry strings, wildcards included)
+ * matches `capability`. Empty/absent grants deny — deny-by-default. */
+export declare function hasCapability(granted: readonly string[] | null | undefined, capability: string): boolean;
+//# sourceMappingURL=capabilities.d.ts.map

package/dist/model/capabilities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilities.d.ts","sourceRoot":"","sources":["../../src/model/capabilities.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,qEAAqE;AACrE,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,GACd,OAAO,CAMT;AAED;uEACuE;AACvE,wBAAgB,aAAa,CAC3B,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,GAAG,SAAS,EAC7C,UAAU,EAAE,MAAM,GACjB,OAAO,CAGT"}

package/dist/model/capabilities.js

@@ -0,0 +1,32 @@
+/**
+ * Client-side capability matcher (org-program §A1/§A2) — a PORT of
+ * stapel-workspaces' `capabilities.capability_matches` (which is itself
+ * mirrored by the consumer helper in `stapel_core.django.workspaces`).
+ * KEEP SEMANTICS IN SYNC with the backend: capability strings are namespaced
+ * `"<domain>.<action>"`, free-form for the client (`meetings.spotlight`,
+ * `records.view`, …); a granted string may be the exact capability, the
+ * global wildcard `"*"`, or a prefix wildcard like `"members.*"` (which
+ * matches `members.remove` AND deeper `members.role.change`).
+ *
+ * The client-side check is a UI convenience (hide/disable affordances) —
+ * NEVER an access decision: the backend re-checks every capability on every
+ * operation (`has_capability` in-service, `workspaces.check_capability`
+ * cross-service).
+ */
+/** Match one granted capability string against the requested one. */
+export function capabilityMatches(capability, granted) {
+    if (granted === "*" || granted === capability)
+        return true;
+    if (granted.endsWith(".*")) {
+        return capability.startsWith(granted.slice(0, -1));
+    }
+    return false;
+}
+/** True if any of `granted` (verbatim registry strings, wildcards included)
+ * matches `capability`. Empty/absent grants deny — deny-by-default. */
+export function hasCapability(granted, capability) {
+    if (!granted)
+        return false;
+    return granted.some((g) => capabilityMatches(capability, g));
+}
+//# sourceMappingURL=capabilities.js.map

package/dist/model/capabilities.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilities.js","sourceRoot":"","sources":["../../src/model/capabilities.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,qEAAqE;AACrE,MAAM,UAAU,iBAAiB,CAC/B,UAAkB,EAClB,OAAe;IAEf,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IAC3D,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,OAAO,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;uEACuE;AACvE,MAAM,UAAU,aAAa,CAC3B,OAA6C,EAC7C,UAAkB;IAElB,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC;AAC/D,CAAC"}

package/dist/model/emailMask.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Email masking — a PORT of stapel-workspaces' `views._mask_email` (the
+ * function that produces `InvitationPreviewResponse.email_masked`). KEEP IN
+ * SYNC with the backend: first character of the local part and of the domain
+ * name survive, the TLD stays readable — `m***@e***.com`.
+ *
+ * Why the client re-implements it: the public invitation preview deliberately
+ * carries only the MASKED email (harvest-proof, org-program §B2), yet the
+ * §B4 flow must route "session & email match" vs "wrong account" BEFORE
+ * attempting the accept. Masking the signed-in account's own (fully known)
+ * email with the same algorithm and comparing the two masks is the exact
+ * decision the backend would make — without ever exposing the invitee's
+ * address. A mask collision (two addresses masking identically) merely shows
+ * the accept prompt; the backend's real email-match on accept remains the
+ * enforcement point.
+ */
+/** Mask an email exactly like the backend's invitation preview does. */
+export declare function maskEmail(email: string): string;
+/** Whether `email`, masked by the backend's algorithm, equals `emailMasked`
+ * (case-insensitive on the email, as the backend matches `iexact`). */
+export declare function emailMatchesMask(email: string, emailMasked: string): boolean;
+//# sourceMappingURL=emailMask.d.ts.map

package/dist/model/emailMask.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"emailMask.d.ts","sourceRoot":"","sources":["../../src/model/emailMask.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,wEAAwE;AACxE,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAY/C;AAED;uEACuE;AACvE,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAE5E"}

package/dist/model/emailMask.js

@@ -0,0 +1,36 @@
+/**
+ * Email masking — a PORT of stapel-workspaces' `views._mask_email` (the
+ * function that produces `InvitationPreviewResponse.email_masked`). KEEP IN
+ * SYNC with the backend: first character of the local part and of the domain
+ * name survive, the TLD stays readable — `m***@e***.com`.
+ *
+ * Why the client re-implements it: the public invitation preview deliberately
+ * carries only the MASKED email (harvest-proof, org-program §B2), yet the
+ * §B4 flow must route "session & email match" vs "wrong account" BEFORE
+ * attempting the accept. Masking the signed-in account's own (fully known)
+ * email with the same algorithm and comparing the two masks is the exact
+ * decision the backend would make — without ever exposing the invitee's
+ * address. A mask collision (two addresses masking identically) merely shows
+ * the accept prompt; the backend's real email-match on accept remains the
+ * enforcement point.
+ */
+/** Mask an email exactly like the backend's invitation preview does. */
+export function maskEmail(email) {
+    const at = email.indexOf("@");
+    const local = at === -1 ? email : email.slice(0, at);
+    const domain = at === -1 ? "" : email.slice(at + 1);
+    const dot = domain.lastIndexOf(".");
+    const maskedLocal = `${local.slice(0, 1) || "*"}***`;
+    if (dot !== -1) {
+        const domainName = domain.slice(0, dot);
+        const tld = domain.slice(dot + 1);
+        return `${maskedLocal}@${domainName.slice(0, 1) || "*"}***.${tld}`;
+    }
+    return `${maskedLocal}@${domain.slice(0, 1) || "*"}***`;
+}
+/** Whether `email`, masked by the backend's algorithm, equals `emailMasked`
+ * (case-insensitive on the email, as the backend matches `iexact`). */
+export function emailMatchesMask(email, emailMasked) {
+    return maskEmail(email.trim().toLowerCase()) === emailMasked.toLowerCase();
+}
+//# sourceMappingURL=emailMask.js.map

package/dist/model/emailMask.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"emailMask.js","sourceRoot":"","sources":["../../src/model/emailMask.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,wEAAwE;AACxE,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACpD,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,WAAW,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC;IACrD,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;QACf,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QAClC,OAAO,GAAG,WAAW,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,OAAO,GAAG,EAAE,CAAC;IACrE,CAAC;IACD,OAAO,GAAG,WAAW,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC;AAC1D,CAAC;AAED;uEACuE;AACvE,MAAM,UAAU,gBAAgB,CAAC,KAAa,EAAE,WAAmB;IACjE,OAAO,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,WAAW,CAAC,WAAW,EAAE,CAAC;AAC7E,CAAC"}

package/dist/model/mutations.d.ts

@@ -1,6 +1,6 @@
 import type { UseMutationResult } from "@tanstack/react-query";
 import type { StapelApiError } from "@stapel/core";
-import type { Member, MemberInvite, MemberInviteResult, InvitationAccept, Workspace, WorkspaceCreate, WorkspaceRole, WorkspaceUpdate } from "../api/types.js";
+import type { Member, MemberInvite, MemberInviteResult, InvitationAccept, InvitationClaim, Workspace, WorkspaceCreate, WorkspaceUpdate } from "../api/types.js";
 /**
  * Write hooks (frontend-standard §2 — "мутации с инвалидацией"). Each mutation
  * invalidates exactly the server state it can move. Membership and ownership are
@@ -29,10 +29,14 @@ export declare function useDeleteWorkspace(): UseMutationResult<void, StapelApiE
  * there).
  */
 export declare function useInviteMembers(workspaceId: string): UseMutationResult<MemberInviteResult, StapelApiError, MemberInvite>;
-/** The variable for {@link useUpdateMemberRole}: which member, which new role. */
+/** The variable for {@link useUpdateMemberRole}: which member, which new role.
+ * `role` is an open string since stapel-workspaces 0.6.0 (org-program §A1):
+ * the effective registry is settings-extensible, so any key of GET /roles is
+ * valid — the backend validates against the registry. {@link WorkspaceRole}
+ * still names the builtin four for literals. */
 export interface MemberRoleChange {
     readonly userId: string;
-    readonly role: WorkspaceRole;
+    readonly role: string;
 }
 /**
  * Change a member's role (admin+; the backend guards owner grants and the
@@ -52,4 +56,20 @@ export declare function useRemoveMember(workspaceId: string): UseMutationResult<
  * Refreshes the workspace list (the new membership appears there).
  */
 export declare function useAcceptInvitation(): UseMutationResult<Member, StapelApiError, InvitationAccept>;
+/**
+ * Mint a login grant for a NOT-yet-registered invitee (POST
+ * /invitations/{token}/claim, AllowAny — org-program §B2/§B3). The variable
+ * is the invite token; the result carries the single-use `grant_token` to
+ * exchange at AUTH's `POST /grant/exchange/` (the auth-react api — this pair
+ * deliberately does not call it; see `InviteAcceptFlow`'s `onLoginGrant`
+ * seam). 409 `email_already_registered` → switch to login. The invitation is
+ * NOT consumed here. The grant token is a credential: never log it.
+ */
+export declare function useClaimInvitation(): UseMutationResult<InvitationClaim, StapelApiError, string>;
+/**
+ * Decline an invitation (POST /invitations/{token}/decline, authenticated +
+ * email-match — org-program §B2). The variable is the invite token. Decline ≠
+ * revoke — the preview's `status` becomes `declined`.
+ */
+export declare function useDeclineInvitation(): UseMutationResult<void, StapelApiError, string>;
 //# sourceMappingURL=mutations.d.ts.map

package/dist/model/mutations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mutations.d.ts","sourceRoot":"","sources":["../../src/model/mutations.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAEV,iBAAiB,EAClB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EACV,MAAM,EACN,YAAY,EACZ,kBAAkB,EAClB,gBAAgB,EAChB,SAAS,EACT,eAAe,EACf,aAAa,EACb,eAAe,EAChB,MAAM,iBAAiB,CAAC;AAIzB;;;;;;;;;;;GAWG;AAEH,wEAAwE;AACxE,wBAAgB,kBAAkB,IAAI,iBAAiB,CACrD,SAAS,EACT,cAAc,EACd,eAAe,CAChB,CAaA;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,MAAM,GAClB,iBAAiB,CAAC,SAAS,EAAE,cAAc,EAAE,eAAe,CAAC,CAiB/D;AAED,0FAA0F;AAC1F,wBAAgB,kBAAkB,IAAI,iBAAiB,CACrD,IAAI,EACJ,cAAc,EACd,MAAM,CACP,CAeA;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,MAAM,GAClB,iBAAiB,CAAC,kBAAkB,EAAE,cAAc,EAAE,YAAY,CAAC,CAgBrE;AAED,kFAAkF;AAClF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;CAC9B;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,MAAM,GAClB,iBAAiB,CAAC,MAAM,EAAE,cAAc,EAAE,gBAAgB,CAAC,CAa7D;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,WAAW,EAAE,MAAM,GAClB,iBAAiB,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,CAAC,CAYjD;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,IAAI,iBAAiB,CACtD,MAAM,EACN,cAAc,EACd,gBAAgB,CACjB,CAYA"}
+{"version":3,"file":"mutations.d.ts","sourceRoot":"","sources":["../../src/model/mutations.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAEV,iBAAiB,EAClB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EACV,MAAM,EACN,YAAY,EACZ,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,SAAS,EACT,eAAe,EACf,eAAe,EAChB,MAAM,iBAAiB,CAAC;AAIzB;;;;;;;;;;;GAWG;AAEH,wEAAwE;AACxE,wBAAgB,kBAAkB,IAAI,iBAAiB,CACrD,SAAS,EACT,cAAc,EACd,eAAe,CAChB,CAaA;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,MAAM,GAClB,iBAAiB,CAAC,SAAS,EAAE,cAAc,EAAE,eAAe,CAAC,CAiB/D;AAED,0FAA0F;AAC1F,wBAAgB,kBAAkB,IAAI,iBAAiB,CACrD,IAAI,EACJ,cAAc,EACd,MAAM,CACP,CAeA;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,MAAM,GAClB,iBAAiB,CAAC,kBAAkB,EAAE,cAAc,EAAE,YAAY,CAAC,CAgBrE;AAED;;;;gDAIgD;AAChD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,MAAM,GAClB,iBAAiB,CAAC,MAAM,EAAE,cAAc,EAAE,gBAAgB,CAAC,CAa7D;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,WAAW,EAAE,MAAM,GAClB,iBAAiB,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,CAAC,CAYjD;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,IAAI,iBAAiB,CACtD,MAAM,EACN,cAAc,EACd,gBAAgB,CACjB,CAgBA;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,IAAI,iBAAiB,CACrD,eAAe,EACf,cAAc,EACd,MAAM,CACP,CAMA;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,IAAI,iBAAiB,CACvD,IAAI,EACJ,cAAc,EACd,MAAM,CACP,CAYA"}

package/dist/model/mutations.js

@@ -127,10 +127,48 @@ export function useAcceptInvitation() {
     const queryClient = useQueryClient();
     const options = {
         mutationFn: (body) => api.acceptInvitation(body),
-        onSuccess: () => {
+        onSuccess: (_member, body) => {
             void queryClient.invalidateQueries({
                 queryKey: workspacesQueryKeys.list(),
             });
+            // The preview's `status` moved pending → accepted.
+            void queryClient.invalidateQueries({
+                queryKey: workspacesQueryKeys.invitationPreview(body.token),
+            });
+        },
+    };
+    return useMutation(options);
+}
+/**
+ * Mint a login grant for a NOT-yet-registered invitee (POST
+ * /invitations/{token}/claim, AllowAny — org-program §B2/§B3). The variable
+ * is the invite token; the result carries the single-use `grant_token` to
+ * exchange at AUTH's `POST /grant/exchange/` (the auth-react api — this pair
+ * deliberately does not call it; see `InviteAcceptFlow`'s `onLoginGrant`
+ * seam). 409 `email_already_registered` → switch to login. The invitation is
+ * NOT consumed here. The grant token is a credential: never log it.
+ */
+export function useClaimInvitation() {
+    const api = useWorkspacesApi();
+    const options = {
+        mutationFn: (token) => api.claimInvitation(token),
+    };
+    return useMutation(options);
+}
+/**
+ * Decline an invitation (POST /invitations/{token}/decline, authenticated +
+ * email-match — org-program §B2). The variable is the invite token. Decline ≠
+ * revoke — the preview's `status` becomes `declined`.
+ */
+export function useDeclineInvitation() {
+    const api = useWorkspacesApi();
+    const queryClient = useQueryClient();
+    const options = {
+        mutationFn: (token) => api.declineInvitation(token),
+        onSuccess: (_result, token) => {
+            void queryClient.invalidateQueries({
+                queryKey: workspacesQueryKeys.invitationPreview(token),
+            });
         },
     };
     return useMutation(options);

package/dist/model/mutations.js.map

@@ -1 +1 @@
-{"version":3,"file":"mutations.js","sourceRoot":"","sources":["../../src/model/mutations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAgBpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAErD;;;;;;;;;;;GAWG;AAEH,wEAAwE;AACxE,MAAM,UAAU,kBAAkB;IAKhC,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC/B,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,MAAM,OAAO,GACX;QACE,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC;QAC/C,SAAS,EAAE,GAAG,EAAE;YACd,KAAK,WAAW,CAAC,iBAAiB,CAAC;gBACjC,QAAQ,EAAE,mBAAmB,CAAC,IAAI,EAAE;aACrC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;IACJ,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,WAAmB;IAEnB,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC/B,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,MAAM,OAAO,GACX;QACE,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,WAAW,EAAE,KAAK,CAAC;QAC9D,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE;YACrB,WAAW,CAAC,YAAY,CACtB,mBAAmB,CAAC,MAAM,CAAC,WAAW,CAAC,EACvC,OAAO,CACR,CAAC;YACF,KAAK,WAAW,CAAC,iBAAiB,CAAC;gBACjC,QAAQ,EAAE,mBAAmB,CAAC,IAAI,EAAE;aACrC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;IACJ,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,kBAAkB;IAKhC,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC/B,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,MAAM,OAAO,GAAqD;QAChE,UAAU,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,WAAW,CAAC;QAC7D,SAAS,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE;YAClC,WAAW,CAAC,aAAa,CAAC;gBACxB,QAAQ,EAAE,mBAAmB,CAAC,MAAM,CAAC,WAAW,CAAC;aAClD,CAAC,CAAC;YACH,KAAK,WAAW,CAAC,iBAAiB,CAAC;gBACjC,QAAQ,EAAE,mBAAmB,CAAC,IAAI,EAAE;aACrC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;IACF,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,WAAmB;IAEnB,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC/B,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,MAAM,OAAO,GAIT;QACF,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC;QAC1D,SAAS,EAAE,GAAG,EAAE;YACd,KAAK,WAAW,CAAC,iBAAiB,CAAC;gBACjC,QAAQ,EAAE,mBAAmB,CAAC,OAAO,CAAC,WAAW,CAAC;aACnD,CAAC,CAAC;QACL,CAAC;KACF,CAAC;IACF,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC;AAQD;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,WAAmB;IAEnB,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC/B,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,MAAM,OAAO,GAAiE;QAC5E,UAAU,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAC/B,GAAG,CAAC,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC;QACrD,SAAS,EAAE,GAAG,EAAE;YACd,KAAK,WAAW,CAAC,iBAAiB,CAAC;gBACjC,QAAQ,EAAE,mBAAmB,CAAC,OAAO,CAAC,WAAW,CAAC;aACnD,CAAC,CAAC;QACL,CAAC;KACF,CAAC;IACF,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,WAAmB;IAEnB,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC/B,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,MAAM,OAAO,GAAqD;QAChE,UAAU,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7D,SAAS,EAAE,GAAG,EAAE;YACd,KAAK,WAAW,CAAC,iBAAiB,CAAC;gBACjC,QAAQ,EAAE,mBAAmB,CAAC,OAAO,CAAC,WAAW,CAAC;aACnD,CAAC,CAAC;QACL,CAAC;KACF,CAAC;IACF,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB;IAKjC,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC/B,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,MAAM,OAAO,GAAiE;QAC5E,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC;QAChD,SAAS,EAAE,GAAG,EAAE;YACd,KAAK,WAAW,CAAC,iBAAiB,CAAC;gBACjC,QAAQ,EAAE,mBAAmB,CAAC,IAAI,EAAE;aACrC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;IACF,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC"}
+{"version":3,"file":"mutations.js","sourceRoot":"","sources":["../../src/model/mutations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAgBpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAErD;;;;;;;;;;;GAWG;AAEH,wEAAwE;AACxE,MAAM,UAAU,kBAAkB;IAKhC,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC/B,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,MAAM,OAAO,GACX;QACE,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC;QAC/C,SAAS,EAAE,GAAG,EAAE;YACd,KAAK,WAAW,CAAC,iBAAiB,CAAC;gBACjC,QAAQ,EAAE,mBAAmB,CAAC,IAAI,EAAE;aACrC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;IACJ,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,WAAmB;IAEnB,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC/B,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,MAAM,OAAO,GACX;QACE,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,WAAW,EAAE,KAAK,CAAC;QAC9D,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE;YACrB,WAAW,CAAC,YAAY,CACtB,mBAAmB,CAAC,MAAM,CAAC,WAAW,CAAC,EACvC,OAAO,CACR,CAAC;YACF,KAAK,WAAW,CAAC,iBAAiB,CAAC;gBACjC,QAAQ,EAAE,mBAAmB,CAAC,IAAI,EAAE;aACrC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;IACJ,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,kBAAkB;IAKhC,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC/B,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,MAAM,OAAO,GAAqD;QAChE,UAAU,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,WAAW,CAAC;QAC7D,SAAS,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE;YAClC,WAAW,CAAC,aAAa,CAAC;gBACxB,QAAQ,EAAE,mBAAmB,CAAC,MAAM,CAAC,WAAW,CAAC;aAClD,CAAC,CAAC;YACH,KAAK,WAAW,CAAC,iBAAiB,CAAC;gBACjC,QAAQ,EAAE,mBAAmB,CAAC,IAAI,EAAE;aACrC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;IACF,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,WAAmB;IAEnB,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC/B,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,MAAM,OAAO,GAIT;QACF,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC;QAC1D,SAAS,EAAE,GAAG,EAAE;YACd,KAAK,WAAW,CAAC,iBAAiB,CAAC;gBACjC,QAAQ,EAAE,mBAAmB,CAAC,OAAO,CAAC,WAAW,CAAC;aACnD,CAAC,CAAC;QACL,CAAC;KACF,CAAC;IACF,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC;AAYD;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,WAAmB;IAEnB,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC/B,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,MAAM,OAAO,GAAiE;QAC5E,UAAU,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAC/B,GAAG,CAAC,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC;QACrD,SAAS,EAAE,GAAG,EAAE;YACd,KAAK,WAAW,CAAC,iBAAiB,CAAC;gBACjC,QAAQ,EAAE,mBAAmB,CAAC,OAAO,CAAC,WAAW,CAAC;aACnD,CAAC,CAAC;QACL,CAAC;KACF,CAAC;IACF,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,WAAmB;IAEnB,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC/B,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,MAAM,OAAO,GAAqD;QAChE,UAAU,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7D,SAAS,EAAE,GAAG,EAAE;YACd,KAAK,WAAW,CAAC,iBAAiB,CAAC;gBACjC,QAAQ,EAAE,mBAAmB,CAAC,OAAO,CAAC,WAAW,CAAC;aACnD,CAAC,CAAC;QACL,CAAC;KACF,CAAC;IACF,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB;IAKjC,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC/B,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,MAAM,OAAO,GAAiE;QAC5E,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC;QAChD,SAAS,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE;YAC3B,KAAK,WAAW,CAAC,iBAAiB,CAAC;gBACjC,QAAQ,EAAE,mBAAmB,CAAC,IAAI,EAAE;aACrC,CAAC,CAAC;YACH,mDAAmD;YACnD,KAAK,WAAW,CAAC,iBAAiB,CAAC;gBACjC,QAAQ,EAAE,mBAAmB,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC;aAC5D,CAAC,CAAC;QACL,CAAC;KACF,CAAC;IACF,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB;IAKhC,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC/B,MAAM,OAAO,GAAgE;QAC3E,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC;KAClD,CAAC;IACF,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB;IAKlC,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC/B,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,MAAM,OAAO,GAAqD;QAChE,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,KAAK,CAAC;QACnD,SAAS,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE;YAC5B,KAAK,WAAW,CAAC,iBAAiB,CAAC;gBACjC,QAAQ,EAAE,mBAAmB,CAAC,iBAAiB,CAAC,KAAK,CAAC;aACvD,CAAC,CAAC;QACL,CAAC;KACF,CAAC;IACF,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC"}

package/dist/model/queries.d.ts

@@ -1,23 +1,73 @@
 import type { UseQueryResult } from "@tanstack/react-query";
 import type { StapelApiError } from "@stapel/core";
-import type { MemberPage, MembersParams, Workspace, WorkspaceList } from "../api/types.js";
+import type { InvitationPreview, MemberPage, MembersParams, RoleInfo, Workspace, WorkspaceList } from "../api/types.js";
 /**
  * Read hooks over the workspaces API. Staleness follows core's query defaults;
  * override per call site via a page that needs fresher data. Keys are
  * namespaced (see `workspacesQueryKeys`).
  */
-/** The caller's workspaces — their accepted memberships (GET /). */
+/**
+ * The caller's workspaces — their accepted memberships (GET /).
+ *
+ * Gated on {@link useActiveSessionReady} (owner-diagnosed live incident,
+ * 2026-07-17): unlike {@link useWorkspace}/{@link useMembers} below (both
+ * naturally disabled until a `workspaceId` is picked), this is the top-level
+ * list hook with nothing else to gate it — it fires the instant a component
+ * mounts. Without the session ready-gate this is exactly the shape of hook
+ * that raced a session still bootstrapping (e.g. right after a QR
+ * `session_share` scan set fresh cookies this JS runtime hadn't caught up
+ * to yet) and read a live session as "expired" before it had a chance to
+ * resolve — zero manual `enabled` wiring needed at each call site by design.
+ */
 export declare function useWorkspaces(): UseQueryResult<WorkspaceList, StapelApiError>;
 /**
  * A single workspace by id (GET /{id}). Disabled until a `workspaceId` is
- * given, so a detail hook can mount before a selection exists.
+ * given, so a detail hook can mount before a selection exists — AND until
+ * the session is ready (a `workspaceId` can be known synchronously, e.g.
+ * from a URL param, before the session has finished bootstrapping).
  */
 export declare function useWorkspace(workspaceId: string | null): UseQueryResult<Workspace, StapelApiError>;
 /**
  * A page of a workspace's members (GET /{id}/members, anchor-paginated).
- * Disabled until a `workspaceId` is given. Pass `{ anchor, direction, limit,
- * search }` to jump to a specific page or filter; omit for the newest page
- * (default limit 100).
+ * Disabled until a `workspaceId` is given (and the session is ready — see
+ * {@link useWorkspace}). Pass `{ anchor, direction, limit, search }` to jump
+ * to a specific page or filter; omit for the newest page (default limit 100).
  */
 export declare function useMembers(workspaceId: string | null, params?: MembersParams): UseQueryResult<MemberPage, StapelApiError>;
+/**
+ * The effective role registry (GET /roles, org-program §A2): builtin four +
+ * the deployment's `STAPEL_WORKSPACES["ROLES"]` overlay, capability strings
+ * verbatim, rank-descending. Deployment-static data — role UI (RoleSelect)
+ * reads this instead of hardcoding the builtin four. Session-ready-gated like
+ * {@link useWorkspaces} (IsAuthenticated endpoint, mounts at screen top).
+ */
+export declare function useRoles(): UseQueryResult<readonly RoleInfo[], StapelApiError>;
+/**
+ * Public invitation preview (GET /invitations/{token}, AllowAny — org-program
+ * §B2): what the `/invite/{token}` page renders BEFORE any auth decision.
+ * Deliberately NOT session-gated — the whole point is that the invitee may
+ * have no session at all; the token in the URL is the bearer secret.
+ */
+export declare function useInvitationPreview(token: string | null): UseQueryResult<InvitationPreview, StapelApiError>;
+/** What {@link useCapabilities} returns: the caller's granted capability
+ * strings in one workspace plus the wildcard-aware `can()` check. */
+export interface CapabilitiesResult {
+    /** Verbatim registry strings of the caller's role (wildcards included);
+     * empty while loading or when the caller is not a member. */
+    readonly capabilities: readonly string[];
+    /** Wildcard-aware check (`*` / `prefix.*` — the backend matcher, ported).
+     * UI convenience only: the backend re-checks on every operation. */
+    can(capability: string): boolean;
+    readonly isLoading: boolean;
+    readonly isError: boolean;
+    readonly error: StapelApiError | null;
+}
+/**
+ * The caller's capabilities in one workspace (org-program §A2): reads
+ * `my_capabilities` off the workspace detail (`WorkspaceResponse`, additive
+ * field since stapel-workspaces 0.6.0) and exposes the ported wildcard
+ * matcher. Deny-by-default: `can()` is false while loading, on error, or when
+ * the backend predates the field.
+ */
+export declare function useCapabilities(workspaceId: string | null): CapabilitiesResult;
 //# sourceMappingURL=queries.d.ts.map

package/dist/model/queries.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"queries.d.ts","sourceRoot":"","sources":["../../src/model/queries.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EACV,UAAU,EACV,aAAa,EACb,SAAS,EACT,aAAa,EACd,MAAM,iBAAiB,CAAC;AAIzB;;;;GAIG;AAEH,oEAAoE;AACpE,wBAAgB,aAAa,IAAI,cAAc,CAAC,aAAa,EAAE,cAAc,CAAC,CAM7E;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAC1B,WAAW,EAAE,MAAM,GAAG,IAAI,GACzB,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,CAO3C;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CACxB,WAAW,EAAE,MAAM,GAAG,IAAI,EAC1B,MAAM,CAAC,EAAE,aAAa,GACrB,cAAc,CAAC,UAAU,EAAE,cAAc,CAAC,CAQ5C"}
+{"version":3,"file":"queries.d.ts","sourceRoot":"","sources":["../../src/model/queries.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAE5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EACV,iBAAiB,EACjB,UAAU,EACV,aAAa,EACb,QAAQ,EACR,SAAS,EACT,aAAa,EACd,MAAM,iBAAiB,CAAC;AAKzB;;;;GAIG;AAEH;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,IAAI,cAAc,CAAC,aAAa,EAAE,cAAc,CAAC,CAQ7E;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAC1B,WAAW,EAAE,MAAM,GAAG,IAAI,GACzB,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,CAQ3C;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CACxB,WAAW,EAAE,MAAM,GAAG,IAAI,EAC1B,MAAM,CAAC,EAAE,aAAa,GACrB,cAAc,CAAC,UAAU,EAAE,cAAc,CAAC,CAS5C;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,IAAI,cAAc,CACxC,SAAS,QAAQ,EAAE,EACnB,cAAc,CACf,CAQA;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,MAAM,GAAG,IAAI,GACnB,cAAc,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAOnD;AAED;qEACqE;AACrE,MAAM,WAAW,kBAAkB;IACjC;iEAC6D;IAC7D,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC;wEACoE;IACpE,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI,CAAC;CACvC;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,kBAAkB,CAU9E"}

package/dist/model/queries.js

@@ -1,44 +1,112 @@
 import { useQuery } from "@tanstack/react-query";
+import { useActiveSessionReady } from "@stapel/core";
 import { useWorkspacesApi } from "./context.js";
 import { workspacesQueryKeys } from "./queryKeys.js";
+import { hasCapability } from "./capabilities.js";
 /**
  * Read hooks over the workspaces API. Staleness follows core's query defaults;
  * override per call site via a page that needs fresher data. Keys are
  * namespaced (see `workspacesQueryKeys`).
  */
-/** The caller's workspaces — their accepted memberships (GET /). */
+/**
+ * The caller's workspaces — their accepted memberships (GET /).
+ *
+ * Gated on {@link useActiveSessionReady} (owner-diagnosed live incident,
+ * 2026-07-17): unlike {@link useWorkspace}/{@link useMembers} below (both
+ * naturally disabled until a `workspaceId` is picked), this is the top-level
+ * list hook with nothing else to gate it — it fires the instant a component
+ * mounts. Without the session ready-gate this is exactly the shape of hook
+ * that raced a session still bootstrapping (e.g. right after a QR
+ * `session_share` scan set fresh cookies this JS runtime hadn't caught up
+ * to yet) and read a live session as "expired" before it had a chance to
+ * resolve — zero manual `enabled` wiring needed at each call site by design.
+ */
 export function useWorkspaces() {
     const api = useWorkspacesApi();
+    const sessionReady = useActiveSessionReady();
     return useQuery({
         queryKey: workspacesQueryKeys.list(),
         queryFn: () => api.listWorkspaces(),
+        enabled: sessionReady,
     });
 }
 /**
  * A single workspace by id (GET /{id}). Disabled until a `workspaceId` is
- * given, so a detail hook can mount before a selection exists.
+ * given, so a detail hook can mount before a selection exists — AND until
+ * the session is ready (a `workspaceId` can be known synchronously, e.g.
+ * from a URL param, before the session has finished bootstrapping).
  */
 export function useWorkspace(workspaceId) {
     const api = useWorkspacesApi();
+    const sessionReady = useActiveSessionReady();
     return useQuery({
         queryKey: workspacesQueryKeys.detail(workspaceId ?? ""),
         queryFn: () => api.getWorkspace(workspaceId),
-        enabled: workspaceId !== null && workspaceId !== "",
+        enabled: sessionReady && workspaceId !== null && workspaceId !== "",
     });
 }
 /**
  * A page of a workspace's members (GET /{id}/members, anchor-paginated).
- * Disabled until a `workspaceId` is given. Pass `{ anchor, direction, limit,
- * search }` to jump to a specific page or filter; omit for the newest page
- * (default limit 100).
+ * Disabled until a `workspaceId` is given (and the session is ready — see
+ * {@link useWorkspace}). Pass `{ anchor, direction, limit, search }` to jump
+ * to a specific page or filter; omit for the newest page (default limit 100).
  */
 export function useMembers(workspaceId, params) {
     const api = useWorkspacesApi();
+    const sessionReady = useActiveSessionReady();
     const p = params ?? {};
     return useQuery({
         queryKey: workspacesQueryKeys.membersPage(workspaceId ?? "", p),
         queryFn: () => api.listMembers(workspaceId, p),
-        enabled: workspaceId !== null && workspaceId !== "",
+        enabled: sessionReady && workspaceId !== null && workspaceId !== "",
     });
 }
+/**
+ * The effective role registry (GET /roles, org-program §A2): builtin four +
+ * the deployment's `STAPEL_WORKSPACES["ROLES"]` overlay, capability strings
+ * verbatim, rank-descending. Deployment-static data — role UI (RoleSelect)
+ * reads this instead of hardcoding the builtin four. Session-ready-gated like
+ * {@link useWorkspaces} (IsAuthenticated endpoint, mounts at screen top).
+ */
+export function useRoles() {
+    const api = useWorkspacesApi();
+    const sessionReady = useActiveSessionReady();
+    return useQuery({
+        queryKey: workspacesQueryKeys.roles(),
+        queryFn: async () => (await api.listRoles()).roles ?? [],
+        enabled: sessionReady,
+    });
+}
+/**
+ * Public invitation preview (GET /invitations/{token}, AllowAny — org-program
+ * §B2): what the `/invite/{token}` page renders BEFORE any auth decision.
+ * Deliberately NOT session-gated — the whole point is that the invitee may
+ * have no session at all; the token in the URL is the bearer secret.
+ */
+export function useInvitationPreview(token) {
+    const api = useWorkspacesApi();
+    return useQuery({
+        queryKey: workspacesQueryKeys.invitationPreview(token ?? ""),
+        queryFn: () => api.getInvitationPreview(token),
+        enabled: token !== null && token !== "",
+    });
+}
+/**
+ * The caller's capabilities in one workspace (org-program §A2): reads
+ * `my_capabilities` off the workspace detail (`WorkspaceResponse`, additive
+ * field since stapel-workspaces 0.6.0) and exposes the ported wildcard
+ * matcher. Deny-by-default: `can()` is false while loading, on error, or when
+ * the backend predates the field.
+ */
+export function useCapabilities(workspaceId) {
+    const query = useWorkspace(workspaceId);
+    const capabilities = query.data?.my_capabilities ?? [];
+    return {
+        capabilities,
+        can: (capability) => hasCapability(capabilities, capability),
+        isLoading: query.isLoading,
+        isError: query.isError,
+        error: query.error ?? null,
+    };
+}
 //# sourceMappingURL=queries.js.map

package/dist/model/queries.js.map

@@ -1 +1 @@
-{"version":3,"file":"queries.js","sourceRoot":"","sources":["../../src/model/queries.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AASjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAErD;;;;GAIG;AAEH,oEAAoE;AACpE,MAAM,UAAU,aAAa;IAC3B,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC/B,OAAO,QAAQ,CAAC;QACd,QAAQ,EAAE,mBAAmB,CAAC,IAAI,EAAE;QACpC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,cAAc,EAAE;KACpC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAC1B,WAA0B;IAE1B,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC/B,OAAO,QAAQ,CAAC;QACd,QAAQ,EAAE,mBAAmB,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;QACvD,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,WAAqB,CAAC;QACtD,OAAO,EAAE,WAAW,KAAK,IAAI,IAAI,WAAW,KAAK,EAAE;KACpD,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CACxB,WAA0B,EAC1B,MAAsB;IAEtB,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC/B,MAAM,CAAC,GAAG,MAAM,IAAI,EAAE,CAAC;IACvB,OAAO,QAAQ,CAAC;QACd,QAAQ,EAAE,mBAAmB,CAAC,WAAW,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC,CAAC;QAC/D,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,WAAqB,EAAE,CAAC,CAAC;QACxD,OAAO,EAAE,WAAW,KAAK,IAAI,IAAI,WAAW,KAAK,EAAE;KACpD,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"queries.js","sourceRoot":"","sources":["../../src/model/queries.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAEjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAUrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAElD;;;;GAIG;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,aAAa;IAC3B,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC/B,MAAM,YAAY,GAAG,qBAAqB,EAAE,CAAC;IAC7C,OAAO,QAAQ,CAAC;QACd,QAAQ,EAAE,mBAAmB,CAAC,IAAI,EAAE;QACpC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,cAAc,EAAE;QACnC,OAAO,EAAE,YAAY;KACtB,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAC1B,WAA0B;IAE1B,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC/B,MAAM,YAAY,GAAG,qBAAqB,EAAE,CAAC;IAC7C,OAAO,QAAQ,CAAC;QACd,QAAQ,EAAE,mBAAmB,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;QACvD,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,WAAqB,CAAC;QACtD,OAAO,EAAE,YAAY,IAAI,WAAW,KAAK,IAAI,IAAI,WAAW,KAAK,EAAE;KACpE,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CACxB,WAA0B,EAC1B,MAAsB;IAEtB,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC/B,MAAM,YAAY,GAAG,qBAAqB,EAAE,CAAC;IAC7C,MAAM,CAAC,GAAG,MAAM,IAAI,EAAE,CAAC;IACvB,OAAO,QAAQ,CAAC;QACd,QAAQ,EAAE,mBAAmB,CAAC,WAAW,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC,CAAC;QAC/D,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,WAAqB,EAAE,CAAC,CAAC;QACxD,OAAO,EAAE,YAAY,IAAI,WAAW,KAAK,IAAI,IAAI,WAAW,KAAK,EAAE;KACpE,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ;IAItB,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC/B,MAAM,YAAY,GAAG,qBAAqB,EAAE,CAAC;IAC7C,OAAO,QAAQ,CAAC;QACd,QAAQ,EAAE,mBAAmB,CAAC,KAAK,EAAE;QACrC,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE;QACxD,OAAO,EAAE,YAAY;KACtB,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAoB;IAEpB,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC/B,OAAO,QAAQ,CAAC;QACd,QAAQ,EAAE,mBAAmB,CAAC,iBAAiB,CAAC,KAAK,IAAI,EAAE,CAAC;QAC5D,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC,KAAe,CAAC;QACxD,OAAO,EAAE,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE;KACxC,CAAC,CAAC;AACL,CAAC;AAgBD;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,WAA0B;IACxD,MAAM,KAAK,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;IACxC,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,EAAE,eAAe,IAAI,EAAE,CAAC;IACvD,OAAO;QACL,YAAY;QACZ,GAAG,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,aAAa,CAAC,YAAY,EAAE,UAAU,CAAC;QAC5D,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI;KAC3B,CAAC;AACJ,CAAC"}

package/dist/model/queryKeys.d.ts

@@ -5,5 +5,7 @@ export declare const workspacesQueryKeys: {
     detail(workspaceId: string): readonly ["workspaces", "detail", string];
     members(workspaceId: string): readonly ["workspaces", "members", string];
     membersPage(workspaceId: string, params: MembersParams): readonly ["workspaces", "members", string, MembersParams];
+    roles(): readonly ["workspaces", "roles"];
+    invitationPreview(token: string): readonly ["workspaces", "invitation-preview", string];
 };
 //# sourceMappingURL=queryKeys.d.ts.map

package/dist/model/queryKeys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"queryKeys.d.ts","sourceRoot":"","sources":["../../src/model/queryKeys.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAWrD,eAAO,MAAM,mBAAmB,EAAE;IAChC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC;IACtC,IAAI,IAAI,SAAS,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACxC,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACvE,OAAO,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC,YAAY,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IACzE,WAAW,CACT,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,aAAa,GACpB,SAAS,CAAC,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;CAS9D,CAAC"}
+{"version":3,"file":"queryKeys.d.ts","sourceRoot":"","sources":["../../src/model/queryKeys.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAWrD,eAAO,MAAM,mBAAmB,EAAE;IAChC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC;IACtC,IAAI,IAAI,SAAS,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACxC,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACvE,OAAO,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC,YAAY,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IACzE,WAAW,CACT,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,aAAa,GACpB,SAAS,CAAC,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;IAC7D,KAAK,IAAI,SAAS,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAC1C,iBAAiB,CACf,KAAK,EAAE,MAAM,GACZ,SAAS,CAAC,YAAY,EAAE,oBAAoB,EAAE,MAAM,CAAC,CAAC;CAe1D,CAAC"}

package/dist/model/queryKeys.js

@@ -14,5 +14,11 @@ export const workspacesQueryKeys = {
     // invalidating `members(workspaceId)` (mutations.ts) drops every page.
     members: (workspaceId) => [ROOT, "members", workspaceId],
     membersPage: (workspaceId, params) => [ROOT, "members", workspaceId, params],
+    roles: () => [ROOT, "roles"],
+    // NOTE: the key carries the invite TOKEN (a secret). Core's query persist
+    // scope is per-user and the preview response is already public-by-design
+    // (masked email only) — but hosts logging query keys should treat this one
+    // as sensitive.
+    invitationPreview: (token) => [ROOT, "invitation-preview", token],
 };
 //# sourceMappingURL=queryKeys.js.map

package/dist/model/queryKeys.js.map

@@ -1 +1 @@
-{"version":3,"file":"queryKeys.js","sourceRoot":"","sources":["../../src/model/queryKeys.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,MAAM,IAAI,GAAG,YAAqB,CAAC;AAEnC,MAAM,CAAC,MAAM,mBAAmB,GAS5B;IACF,GAAG,EAAE,CAAC,IAAI,CAAC;IACX,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC;IAC1B,MAAM,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,WAAW,CAAC;IACtD,kEAAkE;IAClE,uEAAuE;IACvE,OAAO,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,CAAC;IACxD,WAAW,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,CAAC;CAC7E,CAAC"}
+{"version":3,"file":"queryKeys.js","sourceRoot":"","sources":["../../src/model/queryKeys.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,MAAM,IAAI,GAAG,YAAqB,CAAC;AAEnC,MAAM,CAAC,MAAM,mBAAmB,GAa5B;IACF,GAAG,EAAE,CAAC,IAAI,CAAC;IACX,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC;IAC1B,MAAM,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,WAAW,CAAC;IACtD,kEAAkE;IAClE,uEAAuE;IACvE,OAAO,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,CAAC;IACxD,WAAW,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,CAAC;IAC5E,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC;IAC5B,0EAA0E;IAC1E,yEAAyE;IACzE,2EAA2E;IAC3E,gBAAgB;IAChB,iBAAiB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,oBAAoB,EAAE,KAAK,CAAC;CAClE,CAAC"}