@tangle-network/agent-app 0.27.2 → 0.29.0

package/dist/roles-CLtYKHHl.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Pure role algebra for the teams capability — the tenancy/membership model
+ * shared across the fleet. Zero dependencies: no drizzle, no env, no react, no
+ * I/O. The DB layer (`./teams/drizzle`), the members API (`./teams/members-api`)
+ * and the React surface (`./teams-react`) all build on these functions; this
+ * leaf imports nothing back, so a consumer can pull just the role math.
+ *
+ * Two role ladders, deliberately distinct:
+ *   - Organization roles rank the tenant (who owns/administers the org and its
+ *     billing). An org owner/admin is an owner of every workspace under it.
+ *   - Workspace roles rank a single workspace. They are the access primitive
+ *     every route checks via `hasWorkspaceRole(actual, minimum)`.
+ *
+ * `resolveWorkspaceRole` is the bridge: it folds the org role and the
+ * per-workspace role into the one effective workspace role a request runs at.
+ */
+declare const WORKSPACE_ROLES: readonly ["viewer", "editor", "admin", "owner"];
+type WorkspaceRole = typeof WORKSPACE_ROLES[number];
+declare const ASSIGNABLE_WORKSPACE_ROLES: readonly ["viewer", "editor", "admin"];
+type AssignableWorkspaceRole = typeof ASSIGNABLE_WORKSPACE_ROLES[number];
+declare const ORGANIZATION_ROLES: readonly ["owner", "admin", "member", "billing"];
+type OrganizationRole = typeof ORGANIZATION_ROLES[number];
+type WorkspaceCollaborationAccess = 'read' | 'write';
+type SandboxWorkspaceRole = 'owner' | 'admin' | 'developer' | 'viewer';
+declare const WORKSPACE_ROLE_RANK: Record<WorkspaceRole, number>;
+declare const ORGANIZATION_ROLE_RANK: Record<OrganizationRole, number>;
+/** True when `actual` is at least `minimum` on the workspace ladder. */
+declare function hasWorkspaceRole(actual: WorkspaceRole, minimum: WorkspaceRole): boolean;
+/** True when `actual` is at least `minimum` on the organization ladder. */
+declare function hasOrganizationRole(actual: OrganizationRole, minimum: OrganizationRole): boolean;
+declare function isAssignableWorkspaceRole(value: unknown): value is AssignableWorkspaceRole;
+/** Org owners and admins are workspace owners across the whole org. */
+declare function organizationRoleGrantsWorkspaceOwner(role: OrganizationRole | string | null | undefined): boolean;
+/**
+ * The effective workspace role a request runs at: org owner/admin → owner of
+ * every workspace; otherwise the explicit per-workspace role (or null = no
+ * access). This is the single fold every access check goes through.
+ */
+declare function resolveWorkspaceRole(organizationRole: OrganizationRole | string | null | undefined, workspaceRole: WorkspaceRole | null | undefined): WorkspaceRole | null;
+/**
+ * Whether `actorRole` may set/clear a member currently at `targetRole`. Owners
+ * can manage anyone; everyone else can only manage members strictly below
+ * their own rank (an admin cannot demote another admin or an owner).
+ */
+declare function canManageWorkspaceMemberRole(actorRole: WorkspaceRole, targetRole: WorkspaceRole): boolean;
+declare function workspaceRoleToCollaborationAccess(role: WorkspaceRole): WorkspaceCollaborationAccess;
+declare function workspaceRoleToSandboxRole(role: WorkspaceRole): SandboxWorkspaceRole;
+
+export { ASSIGNABLE_WORKSPACE_ROLES as A, type OrganizationRole as O, type SandboxWorkspaceRole as S, WORKSPACE_ROLES as W, type AssignableWorkspaceRole as a, ORGANIZATION_ROLES as b, ORGANIZATION_ROLE_RANK as c, WORKSPACE_ROLE_RANK as d, type WorkspaceCollaborationAccess as e, type WorkspaceRole as f, canManageWorkspaceMemberRole as g, hasOrganizationRole as h, hasWorkspaceRole as i, isAssignableWorkspaceRole as j, workspaceRoleToSandboxRole as k, organizationRoleGrantsWorkspaceOwner as o, resolveWorkspaceRole as r, workspaceRoleToCollaborationAccess as w };

package/dist/runtime/index.d.ts

@@ -1,13 +1,44 @@
+export { C as CatalogModel, M as ModelCatalog, R as RouterModel, _ as __resetCatalogCache, b as buildCatalog, f as fetchModelCatalog, n as normalizeModelId } from '../model-catalog-BEAEVDaa.js';
+export { C as CreateTangleRouterModelConfigOptions, D as DEFAULT_TANGLE_BILLING_ENFORCEMENT_ENV_VAR, a as DEFAULT_TANGLE_ROUTER_BASE_URL, R as ResolveModelOptions, b as ResolveUserTangleExecutionKeyForUserOptions, c as ResolveUserTangleExecutionKeyOptions, d as ResolvedTangleExecutionKey, T as TangleBillingEnforcementOptions, e as TangleExecutionEnvironment, f as TangleExecutionKeyError, g as TangleExecutionKeyErrorCode, h as TangleExecutionKeyHttpError, i as TangleExecutionKeySource, j as TangleModelConfig, k as createTangleRouterModelConfig, l as isTangleBillingEnforcementDisabled, m as isTangleExecutionKeyError, r as resolveTangleExecutionEnvironment, n as resolveTangleModelConfig, o as resolveUserTangleExecutionKey, p as resolveUserTangleExecutionKeyForUser, t as tangleExecutionKeyHttpError } from '../model-CKzniMMr.js';
 import * as _tangle_network_agent_runtime from '@tangle-network/agent-runtime';
 import { ToolLoopMessage, ToolLoopResult, StreamToolLoopYield, ToolLoopCall } from '@tangle-network/agent-runtime';
 export { RunToolLoopOptions as AppToolLoopOptions, ToolLoopAssistantToolCall as LoopAssistantToolCall, ToolLoopMessage as LoopMessage, ToolLoopCall as LoopToolCall, StreamToolLoopOptions as StreamAppToolLoopOptions, StreamToolLoopYield as StreamLoopYield, ToolLoopEvent, ToolLoopResult, ToolLoopStopReason, runToolLoop as runAppToolLoop, streamToolLoop as streamAppToolLoop } from '@tangle-network/agent-runtime';
-export { C as CatalogModel, M as ModelCatalog, R as RouterModel, _ as __resetCatalogCache, b as buildCatalog, f as fetchModelCatalog, n as normalizeModelId } from '../model-catalog-BEAEVDaa.js';
-export { C as CreateTangleRouterModelConfigOptions, D as DEFAULT_TANGLE_BILLING_ENFORCEMENT_ENV_VAR, a as DEFAULT_TANGLE_ROUTER_BASE_URL, R as ResolveModelOptions, b as ResolveUserTangleExecutionKeyForUserOptions, c as ResolveUserTangleExecutionKeyOptions, d as ResolvedTangleExecutionKey, T as TangleBillingEnforcementOptions, e as TangleExecutionEnvironment, f as TangleExecutionKeyError, g as TangleExecutionKeyErrorCode, h as TangleExecutionKeyHttpError, i as TangleExecutionKeySource, j as TangleModelConfig, k as createTangleRouterModelConfig, l as isTangleBillingEnforcementDisabled, m as isTangleExecutionKeyError, r as resolveTangleExecutionEnvironment, n as resolveTangleModelConfig, o as resolveUserTangleExecutionKey, p as resolveUserTangleExecutionKeyForUser, t as tangleExecutionKeyHttpError } from '../model-CKzniMMr.js';
 import { b as AppToolContext, e as AppToolProducedEvent, f as AppToolTaxonomy, c as AppToolHandlers, d as AppToolOutcome } from '../types-2rOJo8Hc.js';
 import { CertifiedProfile } from '@tangle-network/agent-runtime/intelligence';
 import { A as AppToolMcpServer } from '../mcp-BShTlESm.js';
 import '../auth-BlS9GWfL.js';
 
+/**
+ * Events the app's OpenAI-compat stream adapter ({@link toLoopEvents}) yields.
+ *
+ * This is the app's own `Raw` event type for the streaming loop — the canonical
+ * `streamToolLoop<Raw>` is generic over it. It widens the substrate's
+ * tool-loop event with `reasoning` (DeepSeek/router `reasoning_content` /
+ * `thinking` deltas, rendered as thinking sections) and `usage` (per-message
+ * token accounting) — neither belongs in the substrate's loop contract, so they
+ * stay here. The adapter maps each into the `streamTurn` seam; `text` and
+ * `tool_call` drive the loop, `reasoning` / `usage` pass through to the UI.
+ */
+type LoopEvent = {
+    type: 'text';
+    text: string;
+} | {
+    type: 'reasoning';
+    text: string;
+} | {
+    type: 'tool_call';
+    call: _tangle_network_agent_runtime.ToolLoopCall;
+} | {
+    type: 'usage';
+    usage: {
+        promptTokens: number;
+        completionTokens: number;
+    };
+} | {
+    type: 'other';
+    event: unknown;
+};
+
 /**
  * OpenAI-compatible stream → `LoopEvent` adapter, for NON-sandbox copilots.
  *
@@ -356,35 +387,4 @@ interface SurfaceMergeBase {
  */
 declare function mergeSurfaceOverlay<TBase extends SurfaceMergeBase>(base: TBase, overlay: SurfaceOverlay): TBase & SurfaceMergeBase;
 
-/**
- * Events the app's OpenAI-compat stream adapter ({@link toLoopEvents}) yields.
- *
- * This is the app's own `Raw` event type for the streaming loop — the canonical
- * `streamToolLoop<Raw>` is generic over it. It widens the substrate's
- * tool-loop event with `reasoning` (DeepSeek/router `reasoning_content` /
- * `thinking` deltas, rendered as thinking sections) and `usage` (per-message
- * token accounting) — neither belongs in the substrate's loop contract, so they
- * stay here. The adapter maps each into the `streamTurn` seam; `text` and
- * `tool_call` drive the loop, `reasoning` / `usage` pass through to the UI.
- */
-type LoopEvent = {
-    type: 'text';
-    text: string;
-} | {
-    type: 'reasoning';
-    text: string;
-} | {
-    type: 'tool_call';
-    call: _tangle_network_agent_runtime.ToolLoopCall;
-} | {
-    type: 'usage';
-    usage: {
-        promptTokens: number;
-        completionTokens: number;
-    };
-} | {
-    type: 'other';
-    event: unknown;
-};
-
 export { type AgentRuntime, type AgentRuntimeModelConfig, type AgentTurnOptions, type AnySurfaceKind, type CertifiedDelivery, type CertifiedDeliveryConfig, type CreateAgentRuntimeOptions, type LoopEvent, type OpenAICompatStreamTurnOptions, type OpenAIStreamChunk, type ResolvedAgentProfile, type SurfaceKindDefinition, type SurfaceMcpServer, type SurfaceMergeBase, type SurfaceOverlay, type SurfacePermissionValue, type SurfaceRegistry, createAgentRuntime, createCertifiedDelivery, createOpenAICompatStreamTurn, createSurfaceRegistry, defineSurfaceKind, mergeSurfaceOverlay, toLoopEvents };

package/dist/runtime/index.js

@@ -12,7 +12,7 @@ import {
   runToolLoop,
   streamToolLoop,
   toLoopEvents
-} from "../chunk-LUE4HO5C.js";
+} from "../chunk-4IQMTTNE.js";
 import {
   DEFAULT_TANGLE_BILLING_ENFORCEMENT_ENV_VAR,
   DEFAULT_TANGLE_ROUTER_BASE_URL,

package/dist/sequences/index.d.ts

@@ -1,6 +1,6 @@
 import { j as SequenceMediaKind, o as SequenceTimeline, r as TimelineInterval, m as SequenceStore } from '../store-gckrNq-g.js';
 export { M as MIN_SEQUENCE_CLIP_FRAMES, N as NewSequenceClip, a as NewSequenceDecision, b as NewSequenceTrack, S as SequenceClip, c as SequenceClipMedia, d as SequenceClipPatch, e as SequenceDecision, f as SequenceExportFormat, g as SequenceExportRecord, h as SequenceExportStatus, i as SequenceFrameSnapshot, k as SequenceMeta, l as SequenceStatus, n as SequenceStoreScope, p as SequenceTrack, q as SequenceTrackKind, T as TimelineClipBounds, s as assertClipFitsSequence, t as chooseCaptionPlacement, u as clampClipDuration, v as clampClipStart, w as formatSeconds, x as formatTimecode, y as framesToSeconds, z as secondsToFrames, A as snapshotFrame, B as trackIntervals } from '../store-gckrNq-g.js';
-export { A as AddCaptionOperation, C as CaptionTargetResolution, a as CreateTrackOperation, D as DeleteClipOperation, E as ExtendSequenceOperation, M as MoveClipOperation, P as PlaceClipOperation, Q as QueueExportOperation, S as SEQUENCE_OPERATION_TYPES, b as SequenceApplyResult, c as SequenceOperation, d as SequenceOperationContext, e as SequenceOperationType, f as SequencePlan, g as SetClipDisabledOperation, h as SetClipTextOperation, i as SplitClipOperation, T as TrimClipOperation, j as applySequenceOperation, k as applySequenceOperations, l as assertSequenceMediaUrl, m as captionTrackNameForLanguage, n as lastClipEndFrame, p as parseSequenceOperations, r as resolveCaptionPlacement, o as resolveCaptionTarget, q as resolvePlaceClipTrack, v as validateAddCaption, s as validateCreateTrack, t as validateDeleteClip, u as validateExtendSequence, w as validateMoveClip, x as validatePlaceClip, y as validateQueueExport, z as validateSequenceOperation, B as validateSequenceOperations, F as validateSetClipDisabled, G as validateSetClipText, H as validateSplitClip, I as validateTrimClip } from '../apply-Cp8c3K9D.js';
+export { A as AddCaptionOperation, C as CaptionTargetResolution, a as CreateTrackOperation, D as DeleteClipOperation, E as ExtendSequenceOperation, M as MoveClipOperation, P as PlaceClipOperation, Q as QueueExportOperation, S as SEQUENCE_OPERATION_TYPES, b as SequenceApplyResult, c as SequenceOperation, d as SequenceOperationContext, e as SequenceOperationType, f as SequencePlan, g as SetClipDisabledOperation, h as SetClipTextOperation, i as SplitClipOperation, T as TrimClipOperation, j as applySequenceOperation, k as applySequenceOperations, l as assertSequenceMediaUrl, m as captionTrackNameForLanguage, n as lastClipEndFrame, p as parseSequenceOperations, r as resolveCaptionPlacement, o as resolveCaptionTarget, q as resolvePlaceClipTrack, v as validateAddCaption, s as validateCreateTrack, t as validateDeleteClip, u as validateExtendSequence, w as validateMoveClip, x as validatePlaceClip, y as validateQueueExport, z as validateSequenceOperation, B as validateSequenceOperations, F as validateSetClipDisabled, G as validateSetClipText, H as validateSplitClip, I as validateTrimClip } from '../apply-Gk4raT2j.js';
 import { c as ToolHeaderNames } from '../auth-BlS9GWfL.js';
 import { A as AppToolMcpServer } from '../mcp-BShTlESm.js';
 import { b as AppToolContext } from '../types-2rOJo8Hc.js';

package/dist/sequences/index.js

@@ -41,7 +41,7 @@ import {
   validateSetClipText,
   validateSplitClip,
   validateTrimClip
-} from "../chunk-6UOE5CTA.js";
+} from "../chunk-JT6HHO5P.js";
 import {
   MIN_SEQUENCE_CLIP_FRAMES,
   assertClipFitsSequence,
@@ -55,6 +55,7 @@ import {
   snapshotFrame,
   trackIntervals
 } from "../chunk-ZYBWGSAZ.js";
+import "../chunk-HFC4BTWJ.js";
 import "../chunk-A76ZHWNF.js";
 export {
   DEFAULT_SEQUENCES_MCP_DESCRIPTION,

package/dist/sequences-react/index.d.ts

@@ -1,4 +1,4 @@
-import { c as SequenceOperation, b as SequenceApplyResult } from '../apply-Cp8c3K9D.js';
+import { c as SequenceOperation, b as SequenceApplyResult } from '../apply-Gk4raT2j.js';
 import { o as SequenceTimeline, S as SequenceClip, p as SequenceTrack } from '../store-gckrNq-g.js';
 import * as react from 'react';
 import react__default from 'react';
@@ -543,6 +543,9 @@ interface TimelineClipChipProps {
     sequenceDurationFrames: number;
     selected: boolean;
     canWrite: boolean;
+    /** Roving-tabindex: exactly one chip per editor carries tabIndex 0 so the
+     *  clip set is a single Tab stop; arrows move focus across the others. */
+    tabbable: boolean;
     frameProvider: VideoFrameProvider;
     /** Snap a candidate move (both clip edges considered); editor closes over
      *  the engine's snap points. */
@@ -564,6 +567,12 @@ interface TimelineClipChipProps {
     };
     onSnapPointChange(point: SnapPoint | null): void;
     onSelect(clipId: string, additive: boolean): void;
+    /** Keyboard delete of the focused clip (one command on the stack), routed
+     *  through the same locked-track guard as the transport Delete key. */
+    onRequestDelete(clipId: string): void;
+    /** Move keyboard focus to the previous/next clip in DOM order (roving
+     *  tabindex); the editor owns the ordered chip set. */
+    onFocusStep(clipId: string, direction: -1 | 1): void;
     onCommitMove(input: ClipMoveCommit): void;
     onCommitTrim(input: ClipTrimCommit): void;
     onCommitText(input: {
@@ -580,6 +589,9 @@ interface TimelineTrackRowProps {
     zoom: number;
     sequenceDurationFrames: number;
     selectedClipIds: ReadonlySet<string>;
+    /** The single clip that carries tabIndex 0 (roving tabindex); null seeds the
+     *  first chip in the editor as the lone Tab stop. */
+    tabbableClipId: string | null;
     canWrite: boolean;
     frameProvider: VideoFrameProvider;
     snapMove(candidate: {
@@ -599,6 +611,8 @@ interface TimelineTrackRowProps {
     };
     onSnapPointChange(point: SnapPoint | null): void;
     onSelectClip(clipId: string, additive: boolean): void;
+    onRequestDeleteClip(clipId: string): void;
+    onFocusStepClip(clipId: string, direction: -1 | 1): void;
     onCommitMove(input: ClipMoveCommit): void;
     onCommitTrim(input: ClipTrimCommit): void;
     onCommitText(input: {

package/dist/sequences-react/index.js

@@ -47,7 +47,7 @@ import {
   trimClipCommand,
   trimEndDrag,
   trimStartDrag
-} from "../chunk-RJ2ZHK5D.js";
+} from "../chunk-S6WS2B32.js";
 import "../chunk-ZYBWGSAZ.js";
 
 // src/sequences-react/media/transcription.ts
@@ -182,7 +182,7 @@ function createWhisperTranscriptionProvider(opts) {
 
 // src/sequences-react/lazy.tsx
 import React from "react";
-var SequenceTimelineEditorLazy = React.lazy(() => import("../TimelineEditor-JDG54OBP.js"));
+var SequenceTimelineEditorLazy = React.lazy(() => import("../TimelineEditor-Z7C6BFP5.js"));
 export {
   COMMAND_HISTORY_LIMIT,
   DEFAULT_MAX_MEDIA_ELEMENTS,

package/dist/{store-CUStmtdH.d.ts → store-CFyxgTlD.d.ts}

@@ -1,4 +1,4 @@
-import { c as SceneDocument } from './model-BHLN208Z.js';
+import { c as SceneDocument } from './model-BBwyOuWG.js';
 
 /**
  * Storage contract for design-canvas documents. Unlike sequences (row per

package/dist/teams/drizzle.d.ts

@@ -0,0 +1,42 @@
+import { T as TeamDatabase, a as TeamTables, O as OrganizationRow, b as OrganizationMemberRow } from '../access-ChAHG4Tp.js';
+export { C as CreateAccessOptions, c as CreateOrganizationAccessOptions, d as CreateTeamTablesOptions, e as OrganizationAccess, f as OrganizationAccessApi, g as TeamParentTable, U as UserWorkspaceSummary, W as WorkspaceAccess, h as WorkspaceAccessApi, i as WorkspaceAccessTable, j as WorkspaceMemberRow, k as createOrganizationAccess, l as createTeamTables, m as createWorkspaceAccess } from '../access-ChAHG4Tp.js';
+import { O as OrganizationRole } from '../roles-CLtYKHHl.js';
+import 'drizzle-orm/sqlite-core';
+
+/**
+ * `ensurePersonalOrganization` — the substrate that makes solo-user adoption
+ * work. Every user gets exactly one auto-created `kind: 'personal'` org with
+ * the user as `owner` member. That org is the tenant that owns their
+ * workspaces, so role resolution (`getWorkspaceAccess`) has an org row to read
+ * even before any team/invite exists.
+ *
+ * Idempotent by construction: the org `slug` is derived from the user id
+ * (`personal-<id>`) and upserted; the membership upserts on the
+ * (organizationId, userId) unique index. Concurrent calls converge — no
+ * duplicate personal orgs, no duplicate owner rows.
+ *
+ * ADOPTION CONTRACT: call this once per user at first authenticated entry
+ * (e.g. right after sign-in / session bootstrap) BEFORE the first
+ * `getWorkspaceAccess`. Role resolution requires the org membership to exist;
+ * an adopter that skips this will see `null` access for a brand-new user with
+ * no org row. There is no implicit creation inside the access builders — that
+ * keeps reads side-effect-free; provisioning is this explicit call.
+ */
+
+interface EnsurePersonalOrganizationUser {
+    id: string;
+    name?: string | null;
+    email?: string | null;
+}
+interface PersonalOrganizationResult {
+    organization: OrganizationRow;
+    member: OrganizationMemberRow;
+    role: OrganizationRole;
+}
+interface CreatePersonalOrganizationOptions {
+    db: TeamDatabase;
+    tables: TeamTables;
+}
+declare function createEnsurePersonalOrganization(opts: CreatePersonalOrganizationOptions): (user: EnsurePersonalOrganizationUser) => Promise<PersonalOrganizationResult>;
+
+export { type CreatePersonalOrganizationOptions, type EnsurePersonalOrganizationUser, OrganizationMemberRow, OrganizationRow, type PersonalOrganizationResult, TeamDatabase, TeamTables, createEnsurePersonalOrganization };

package/dist/teams/drizzle.js

@@ -0,0 +1,194 @@
+import {
+  hasOrganizationRole,
+  hasWorkspaceRole,
+  resolveWorkspaceRole
+} from "../chunk-63CE7FEZ.js";
+
+// src/teams/drizzle/schema.ts
+import { sql } from "drizzle-orm";
+import { index, integer, sqliteTable, text, uniqueIndex } from "drizzle-orm/sqlite-core";
+var hexId = () => text("id").primaryKey().default(sql`(lower(hex(randomblob(16))))`);
+var createdAt = () => integer("created_at", { mode: "timestamp" }).notNull().default(sql`(unixepoch())`);
+var updatedAt = () => integer("updated_at", { mode: "timestamp" }).notNull().default(sql`(unixepoch())`);
+function createTeamTables(opts) {
+  const { userTable, workspaceTable } = opts;
+  const organizations = sqliteTable("organization", {
+    id: hexId(),
+    name: text("name").notNull(),
+    slug: text("slug").notNull().unique(),
+    kind: text("kind", { enum: ["personal", "team"] }).notNull().default("personal"),
+    createdBy: text("created_by").notNull().references(() => userTable.id, { onDelete: "cascade" }),
+    createdAt: createdAt(),
+    updatedAt: updatedAt()
+  }, (table) => [
+    index("idx_organization_created_by").on(table.createdBy)
+  ]);
+  const organizationMembers = sqliteTable("organization_member", {
+    id: hexId(),
+    organizationId: text("organization_id").notNull().references(() => organizations.id, { onDelete: "cascade" }),
+    userId: text("user_id").notNull().references(() => userTable.id, { onDelete: "cascade" }),
+    role: text("role", { enum: ["owner", "admin", "member", "billing"] }).notNull().default("member"),
+    createdAt: createdAt(),
+    updatedAt: updatedAt()
+  }, (table) => [
+    uniqueIndex("uniq_org_member_user").on(table.organizationId, table.userId),
+    index("idx_org_member_user").on(table.userId)
+  ]);
+  const workspaceMembers = sqliteTable("workspace_member", {
+    id: hexId(),
+    workspaceId: text("workspace_id").notNull().references(() => workspaceTable.id, { onDelete: "cascade" }),
+    organizationMemberId: text("organization_member_id").references(() => organizationMembers.id, { onDelete: "cascade" }),
+    userId: text("user_id").references(() => userTable.id, { onDelete: "cascade" }),
+    role: text("role", { enum: ["owner", "admin", "editor", "viewer"] }).notNull().default("editor"),
+    invitedBy: text("invited_by"),
+    inviteEmail: text("invite_email"),
+    inviteToken: text("invite_token"),
+    invitedAt: integer("invited_at", { mode: "timestamp" }).notNull().default(sql`(unixepoch())`),
+    acceptedAt: integer("accepted_at", { mode: "timestamp" })
+  }, (table) => [
+    uniqueIndex("uniq_workspace_member_org_member").on(table.workspaceId, table.organizationMemberId),
+    index("idx_workspace_member_user").on(table.workspaceId, table.userId),
+    index("idx_member_user").on(table.userId),
+    uniqueIndex("idx_member_invite_token").on(table.inviteToken)
+  ]);
+  return { organizations, organizationMembers, workspaceMembers };
+}
+
+// src/teams/drizzle/access.ts
+import { and, desc, eq, isNotNull } from "drizzle-orm";
+function createWorkspaceAccess(opts) {
+  const { db, tables, workspaceTable } = opts;
+  const { organizations, organizationMembers, workspaceMembers } = tables;
+  const workspaces = workspaceTable;
+  async function getWorkspaceAccess(workspaceId, userId, minRole = "viewer") {
+    const [row] = await db.select({
+      workspace: workspaces,
+      organization: organizations,
+      organizationMember: organizationMembers,
+      projectRole: workspaceMembers.role,
+      acceptedAt: workspaceMembers.acceptedAt
+    }).from(workspaces).innerJoin(organizations, eq(organizations.id, workspaces.organizationId)).innerJoin(organizationMembers, and(
+      eq(organizationMembers.organizationId, workspaces.organizationId),
+      eq(organizationMembers.userId, userId)
+    )).leftJoin(workspaceMembers, and(
+      eq(workspaceMembers.workspaceId, workspaces.id),
+      eq(workspaceMembers.organizationMemberId, organizationMembers.id),
+      isNotNull(workspaceMembers.acceptedAt)
+    )).where(eq(workspaces.id, workspaceId)).limit(1);
+    if (!row) return null;
+    const role = resolveWorkspaceRole(row.organizationMember.role, row.projectRole);
+    if (!role) return null;
+    if (!hasWorkspaceRole(role, minRole)) return null;
+    return {
+      workspace: row.workspace,
+      organization: row.organization,
+      organizationMember: row.organizationMember,
+      role
+    };
+  }
+  async function requireWorkspaceAccess(workspaceId, userId, minRole = "viewer") {
+    const access = await getWorkspaceAccess(workspaceId, userId, minRole);
+    if (!access) throw new Response("Workspace not found", { status: 404 });
+    return access;
+  }
+  async function listUserWorkspaces(userId) {
+    const rows = await db.select({
+      workspace: workspaces,
+      organization: organizations,
+      organizationMember: organizationMembers,
+      projectRole: workspaceMembers.role
+    }).from(workspaces).innerJoin(organizations, eq(organizations.id, workspaces.organizationId)).innerJoin(organizationMembers, and(
+      eq(organizationMembers.organizationId, workspaces.organizationId),
+      eq(organizationMembers.userId, userId)
+    )).leftJoin(workspaceMembers, and(
+      eq(workspaceMembers.workspaceId, workspaces.id),
+      eq(workspaceMembers.organizationMemberId, organizationMembers.id),
+      isNotNull(workspaceMembers.acceptedAt)
+    )).orderBy(desc(workspaces.updatedAt));
+    return rows.flatMap((row) => {
+      const role = resolveWorkspaceRole(row.organizationMember.role, row.projectRole);
+      if (!role) return [];
+      return [{
+        ...row.workspace,
+        organizationId: row.organization.id,
+        organizationName: row.organization.name,
+        role
+      }];
+    });
+  }
+  return { getWorkspaceAccess, requireWorkspaceAccess, listUserWorkspaces };
+}
+function createOrganizationAccess(opts) {
+  const { db, tables } = opts;
+  const { organizations, organizationMembers } = tables;
+  async function getOrganizationAccess(organizationId, userId, minRole = "member") {
+    const [row] = await db.select({
+      organization: organizations,
+      member: organizationMembers
+    }).from(organizationMembers).innerJoin(organizations, eq(organizations.id, organizationMembers.organizationId)).where(and(
+      eq(organizationMembers.organizationId, organizationId),
+      eq(organizationMembers.userId, userId)
+    )).limit(1);
+    if (!row) return null;
+    const role = row.member.role;
+    if (!hasOrganizationRole(role, minRole)) return null;
+    return { organization: row.organization, member: row.member, role };
+  }
+  async function requireOrganizationAccess(organizationId, userId, minRole = "member") {
+    const access = await getOrganizationAccess(organizationId, userId, minRole);
+    if (!access) throw new Response("Organization not found", { status: 404 });
+    return access;
+  }
+  return { getOrganizationAccess, requireOrganizationAccess };
+}
+
+// src/teams/drizzle/personal-organization.ts
+import { and as and2, eq as eq2 } from "drizzle-orm";
+function createEnsurePersonalOrganization(opts) {
+  const { db, tables } = opts;
+  const { organizations, organizationMembers } = tables;
+  return async function ensurePersonalOrganization(user) {
+    const [existing] = await db.select({
+      organization: organizations,
+      member: organizationMembers
+    }).from(organizationMembers).innerJoin(organizations, eq2(organizations.id, organizationMembers.organizationId)).where(and2(
+      eq2(organizationMembers.userId, user.id),
+      eq2(organizations.kind, "personal")
+    )).limit(1);
+    if (existing) {
+      return {
+        organization: existing.organization,
+        member: existing.member,
+        role: existing.member.role
+      };
+    }
+    const orgName = user.name?.trim() || user.email?.split("@")[0] || "Personal";
+    const slug = `personal-${user.id}`;
+    const [organization] = await db.insert(organizations).values({
+      name: `${orgName}'s Organization`,
+      slug,
+      kind: "personal",
+      createdBy: user.id
+    }).onConflictDoUpdate({
+      target: organizations.slug,
+      set: { updatedAt: /* @__PURE__ */ new Date() }
+    }).returning();
+    const org = organization;
+    const [member] = await db.insert(organizationMembers).values({
+      organizationId: org.id,
+      userId: user.id,
+      role: "owner"
+    }).onConflictDoUpdate({
+      target: [organizationMembers.organizationId, organizationMembers.userId],
+      set: { role: "owner", updatedAt: /* @__PURE__ */ new Date() }
+    }).returning();
+    return { organization: org, member, role: "owner" };
+  };
+}
+export {
+  createEnsurePersonalOrganization,
+  createOrganizationAccess,
+  createTeamTables,
+  createWorkspaceAccess
+};
+//# sourceMappingURL=drizzle.js.map

package/dist/teams/drizzle.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/teams/drizzle/schema.ts","../../src/teams/drizzle/access.ts","../../src/teams/drizzle/personal-organization.ts"],"sourcesContent":["/**\n * Drizzle schema factory for the teams tables. The product owns the user and\n * workspace tables; this factory creates the tenancy/membership tables and\n * wires their foreign keys into the passed-in tables so the whole graph lives\n * in one drizzle schema with real cascade semantics. Column names, types,\n * defaults, enums, and indexes mirror gtm's hand-rolled tables so a product\n * with those tables can adopt the factory without rewriting rows.\n *\n * The three tables and their roles:\n *   - `organization` — the TENANT/ownership primitive. `kind` is 'personal'\n *     (one auto-created per user; see ensurePersonalOrganization) or 'team'.\n *     This is what owns workspaces and what billing/seats attach to.\n *   - `organizationMember` — who belongs to an org and at what org role.\n *   - `workspaceMember` — the additive invite/member surface: per-workspace\n *     access grants, including pending email-only invites carrying a token.\n *\n * Imports `drizzle-orm` at module top — that is WHY this lives behind the\n * `/teams/drizzle` sub-subpath. The pure `./teams` leaf imports none of this,\n * so a consumer that never touches the DB never pulls the optional peer.\n */\n\nimport { sql } from 'drizzle-orm'\nimport { index, integer, sqliteTable, text, uniqueIndex } from 'drizzle-orm/sqlite-core'\nimport type { AnySQLiteColumn, AnySQLiteTable } from 'drizzle-orm/sqlite-core'\n\n/** A product table referenced by FK — only the `id` column is touched. */\nexport type TeamParentTable = AnySQLiteTable & { id: AnySQLiteColumn }\n\nexport interface CreateTeamTablesOptions {\n  /** The product's user table — org/member rows reference `userTable.id`. */\n  userTable: TeamParentTable\n  /** The product's workspace table — workspace members reference `workspaceTable.id`. */\n  workspaceTable: TeamParentTable\n}\n\nconst hexId = () => text('id').primaryKey().default(sql`(lower(hex(randomblob(16))))`)\n\nconst createdAt = () => integer('created_at', { mode: 'timestamp' }).notNull().default(sql`(unixepoch())`)\n\nconst updatedAt = () => integer('updated_at', { mode: 'timestamp' }).notNull().default(sql`(unixepoch())`)\n\nexport function createTeamTables(opts: CreateTeamTablesOptions) {\n  const { userTable, workspaceTable } = opts\n\n  const organizations = sqliteTable('organization', {\n    id: hexId(),\n    name: text('name').notNull(),\n    slug: text('slug').notNull().unique(),\n    kind: text('kind', { enum: ['personal', 'team'] }).notNull().default('personal'),\n    createdBy: text('created_by').notNull().references(() => userTable.id, { onDelete: 'cascade' }),\n    createdAt: createdAt(),\n    updatedAt: updatedAt(),\n  }, (table) => [\n    index('idx_organization_created_by').on(table.createdBy),\n  ])\n\n  const organizationMembers = sqliteTable('organization_member', {\n    id: hexId(),\n    organizationId: text('organization_id').notNull().references(() => organizations.id, { onDelete: 'cascade' }),\n    userId: text('user_id').notNull().references(() => userTable.id, { onDelete: 'cascade' }),\n    role: text('role', { enum: ['owner', 'admin', 'member', 'billing'] }).notNull().default('member'),\n    createdAt: createdAt(),\n    updatedAt: updatedAt(),\n  }, (table) => [\n    uniqueIndex('uniq_org_member_user').on(table.organizationId, table.userId),\n    index('idx_org_member_user').on(table.userId),\n  ])\n\n  const workspaceMembers = sqliteTable('workspace_member', {\n    id: hexId(),\n    workspaceId: text('workspace_id').notNull().references(() => workspaceTable.id, { onDelete: 'cascade' }),\n    organizationMemberId: text('organization_member_id').references(() => organizationMembers.id, { onDelete: 'cascade' }),\n    userId: text('user_id').references(() => userTable.id, { onDelete: 'cascade' }),\n    role: text('role', { enum: ['owner', 'admin', 'editor', 'viewer'] }).notNull().default('editor'),\n    invitedBy: text('invited_by'),\n    inviteEmail: text('invite_email'),\n    inviteToken: text('invite_token'),\n    invitedAt: integer('invited_at', { mode: 'timestamp' }).notNull().default(sql`(unixepoch())`),\n    acceptedAt: integer('accepted_at', { mode: 'timestamp' }),\n  }, (table) => [\n    uniqueIndex('uniq_workspace_member_org_member').on(table.workspaceId, table.organizationMemberId),\n    index('idx_workspace_member_user').on(table.workspaceId, table.userId),\n    index('idx_member_user').on(table.userId),\n    uniqueIndex('idx_member_invite_token').on(table.inviteToken),\n  ])\n\n  return { organizations, organizationMembers, workspaceMembers }\n}\n\nexport type TeamTables = ReturnType<typeof createTeamTables>\n\nexport type OrganizationRow = TeamTables['organizations']['$inferSelect']\nexport type OrganizationMemberRow = TeamTables['organizationMembers']['$inferSelect']\nexport type WorkspaceMemberRow = TeamTables['workspaceMembers']['$inferSelect']\n","/**\n * RBAC access builders over the teams tables. `createWorkspaceAccess` and\n * `createOrganizationAccess` close over the product's `db`, the tables from\n * `createTeamTables`, and the product's `workspace` table, returning the exact\n * `getWorkspaceAccess` / `requireWorkspaceAccess` / `listUserWorkspaces` /\n * `getOrganizationAccess` / `requireOrganizationAccess` functions a consumer\n * already calls — so adoption is a one-line import swap, every call site stays\n * identical.\n *\n * Defense in depth: org owners/admins are workspace owners across the org;\n * everyone else gets their explicit per-workspace role. Effective role is the\n * fold in `resolveWorkspaceRole` (pure, from `../roles`). Every query pins\n * `userId`, so a leaked id can never read across the tenancy boundary — it\n * surfaces as \"not found\".\n *\n * Driver-agnostic: builders are awaited, never `.run()`/`.all()`, so\n * better-sqlite3, D1, and libsql handles all behave identically.\n */\n\nimport { and, desc, eq, isNotNull } from 'drizzle-orm'\nimport type { BaseSQLiteDatabase } from 'drizzle-orm/sqlite-core'\nimport {\n  type OrganizationRole,\n  type WorkspaceRole,\n  hasOrganizationRole,\n  hasWorkspaceRole,\n  resolveWorkspaceRole,\n} from '../roles'\nimport type { TeamParentTable } from './schema'\nimport type { OrganizationMemberRow, OrganizationRow, TeamTables } from './schema'\n\n/** Any SQLite drizzle database — `any` erases driver-specific generics so\n *  better-sqlite3, D1, and libsql handles all fit. */\nexport type TeamDatabase = BaseSQLiteDatabase<'sync' | 'async', any, any>\n\n/**\n * The product's workspace table, narrowed to the columns the access joins read.\n * Adopters pass their real drizzle workspace table — it carries these columns\n * (gtm's does); the type only asserts the minimum the joins touch.\n */\nexport interface WorkspaceAccessTable {\n  id: any\n  organizationId: any\n  name: any\n  updatedAt: any\n}\n\nexport interface CreateAccessOptions {\n  db: TeamDatabase\n  tables: TeamTables\n  /** The product's workspace table (the FK target passed to createTeamTables). */\n  workspaceTable: TeamParentTable & WorkspaceAccessTable\n}\n\nexport interface WorkspaceAccess {\n  workspace: Record<string, unknown>\n  organization: OrganizationRow\n  organizationMember: OrganizationMemberRow\n  role: WorkspaceRole\n}\n\nexport interface UserWorkspaceSummary extends Record<string, unknown> {\n  organizationId: string\n  organizationName: string\n  role: WorkspaceRole\n}\n\nexport interface WorkspaceAccessApi {\n  getWorkspaceAccess(workspaceId: string, userId: string, minRole?: WorkspaceRole): Promise<WorkspaceAccess | null>\n  requireWorkspaceAccess(workspaceId: string, userId: string, minRole?: WorkspaceRole): Promise<WorkspaceAccess>\n  listUserWorkspaces(userId: string): Promise<UserWorkspaceSummary[]>\n}\n\nexport function createWorkspaceAccess(opts: CreateAccessOptions): WorkspaceAccessApi {\n  const { db, tables, workspaceTable } = opts\n  const { organizations, organizationMembers, workspaceMembers } = tables\n  const workspaces = workspaceTable\n\n  async function getWorkspaceAccess(\n    workspaceId: string,\n    userId: string,\n    minRole: WorkspaceRole = 'viewer',\n  ): Promise<WorkspaceAccess | null> {\n    const [row] = await db\n      .select({\n        workspace: workspaces,\n        organization: organizations,\n        organizationMember: organizationMembers,\n        projectRole: workspaceMembers.role,\n        acceptedAt: workspaceMembers.acceptedAt,\n      })\n      .from(workspaces)\n      .innerJoin(organizations, eq(organizations.id, workspaces.organizationId))\n      .innerJoin(organizationMembers, and(\n        eq(organizationMembers.organizationId, workspaces.organizationId),\n        eq(organizationMembers.userId, userId),\n      ))\n      .leftJoin(workspaceMembers, and(\n        eq(workspaceMembers.workspaceId, workspaces.id),\n        eq(workspaceMembers.organizationMemberId, organizationMembers.id),\n        isNotNull(workspaceMembers.acceptedAt),\n      ))\n      .where(eq(workspaces.id, workspaceId))\n      .limit(1)\n\n    if (!row) return null\n\n    const role = resolveWorkspaceRole(row.organizationMember.role, row.projectRole as WorkspaceRole | null)\n    if (!role) return null\n    if (!hasWorkspaceRole(role, minRole)) return null\n\n    return {\n      workspace: row.workspace as Record<string, unknown>,\n      organization: row.organization,\n      organizationMember: row.organizationMember,\n      role,\n    }\n  }\n\n  async function requireWorkspaceAccess(\n    workspaceId: string,\n    userId: string,\n    minRole: WorkspaceRole = 'viewer',\n  ): Promise<WorkspaceAccess> {\n    const access = await getWorkspaceAccess(workspaceId, userId, minRole)\n    if (!access) throw new Response('Workspace not found', { status: 404 })\n    return access\n  }\n\n  async function listUserWorkspaces(userId: string): Promise<UserWorkspaceSummary[]> {\n    const rows = await db\n      .select({\n        workspace: workspaces,\n        organization: organizations,\n        organizationMember: organizationMembers,\n        projectRole: workspaceMembers.role,\n      })\n      .from(workspaces)\n      .innerJoin(organizations, eq(organizations.id, workspaces.organizationId))\n      .innerJoin(organizationMembers, and(\n        eq(organizationMembers.organizationId, workspaces.organizationId),\n        eq(organizationMembers.userId, userId),\n      ))\n      .leftJoin(workspaceMembers, and(\n        eq(workspaceMembers.workspaceId, workspaces.id),\n        eq(workspaceMembers.organizationMemberId, organizationMembers.id),\n        isNotNull(workspaceMembers.acceptedAt),\n      ))\n      // Most recently active workspace first, so callers taking rows[0] as the\n      // default pick the freshest one.\n      .orderBy(desc(workspaces.updatedAt))\n\n    return rows.flatMap((row: any) => {\n      const role = resolveWorkspaceRole(row.organizationMember.role, row.projectRole as WorkspaceRole | null)\n      if (!role) return []\n      return [{\n        ...(row.workspace as Record<string, unknown>),\n        organizationId: row.organization.id,\n        organizationName: row.organization.name,\n        role,\n      } as UserWorkspaceSummary]\n    })\n  }\n\n  return { getWorkspaceAccess, requireWorkspaceAccess, listUserWorkspaces }\n}\n\nexport interface OrganizationAccess {\n  organization: OrganizationRow\n  member: OrganizationMemberRow\n  role: OrganizationRole\n}\n\nexport interface OrganizationAccessApi {\n  getOrganizationAccess(organizationId: string, userId: string, minRole?: OrganizationRole): Promise<OrganizationAccess | null>\n  requireOrganizationAccess(organizationId: string, userId: string, minRole?: OrganizationRole): Promise<OrganizationAccess>\n}\n\nexport interface CreateOrganizationAccessOptions {\n  db: TeamDatabase\n  tables: TeamTables\n}\n\nexport function createOrganizationAccess(opts: CreateOrganizationAccessOptions): OrganizationAccessApi {\n  const { db, tables } = opts\n  const { organizations, organizationMembers } = tables\n\n  async function getOrganizationAccess(\n    organizationId: string,\n    userId: string,\n    minRole: OrganizationRole = 'member',\n  ): Promise<OrganizationAccess | null> {\n    const [row] = await db\n      .select({\n        organization: organizations,\n        member: organizationMembers,\n      })\n      .from(organizationMembers)\n      .innerJoin(organizations, eq(organizations.id, organizationMembers.organizationId))\n      .where(and(\n        eq(organizationMembers.organizationId, organizationId),\n        eq(organizationMembers.userId, userId),\n      ))\n      .limit(1)\n\n    if (!row) return null\n    const role = row.member.role as OrganizationRole\n    if (!hasOrganizationRole(role, minRole)) return null\n    return { organization: row.organization, member: row.member, role }\n  }\n\n  async function requireOrganizationAccess(\n    organizationId: string,\n    userId: string,\n    minRole: OrganizationRole = 'member',\n  ): Promise<OrganizationAccess> {\n    const access = await getOrganizationAccess(organizationId, userId, minRole)\n    if (!access) throw new Response('Organization not found', { status: 404 })\n    return access\n  }\n\n  return { getOrganizationAccess, requireOrganizationAccess }\n}\n","/**\n * `ensurePersonalOrganization` — the substrate that makes solo-user adoption\n * work. Every user gets exactly one auto-created `kind: 'personal'` org with\n * the user as `owner` member. That org is the tenant that owns their\n * workspaces, so role resolution (`getWorkspaceAccess`) has an org row to read\n * even before any team/invite exists.\n *\n * Idempotent by construction: the org `slug` is derived from the user id\n * (`personal-<id>`) and upserted; the membership upserts on the\n * (organizationId, userId) unique index. Concurrent calls converge — no\n * duplicate personal orgs, no duplicate owner rows.\n *\n * ADOPTION CONTRACT: call this once per user at first authenticated entry\n * (e.g. right after sign-in / session bootstrap) BEFORE the first\n * `getWorkspaceAccess`. Role resolution requires the org membership to exist;\n * an adopter that skips this will see `null` access for a brand-new user with\n * no org row. There is no implicit creation inside the access builders — that\n * keeps reads side-effect-free; provisioning is this explicit call.\n */\n\nimport { and, eq } from 'drizzle-orm'\nimport type { OrganizationRole } from '../roles'\nimport type { TeamDatabase } from './access'\nimport type { OrganizationMemberRow, OrganizationRow, TeamTables } from './schema'\n\nexport interface EnsurePersonalOrganizationUser {\n  id: string\n  name?: string | null\n  email?: string | null\n}\n\nexport interface PersonalOrganizationResult {\n  organization: OrganizationRow\n  member: OrganizationMemberRow\n  role: OrganizationRole\n}\n\nexport interface CreatePersonalOrganizationOptions {\n  db: TeamDatabase\n  tables: TeamTables\n}\n\nexport function createEnsurePersonalOrganization(opts: CreatePersonalOrganizationOptions) {\n  const { db, tables } = opts\n  const { organizations, organizationMembers } = tables\n\n  return async function ensurePersonalOrganization(\n    user: EnsurePersonalOrganizationUser,\n  ): Promise<PersonalOrganizationResult> {\n    const [existing] = await db\n      .select({\n        organization: organizations,\n        member: organizationMembers,\n      })\n      .from(organizationMembers)\n      .innerJoin(organizations, eq(organizations.id, organizationMembers.organizationId))\n      .where(and(\n        eq(organizationMembers.userId, user.id),\n        eq(organizations.kind, 'personal'),\n      ))\n      .limit(1)\n\n    if (existing) {\n      return {\n        organization: existing.organization,\n        member: existing.member,\n        role: existing.member.role as OrganizationRole,\n      }\n    }\n\n    const orgName = user.name?.trim() || user.email?.split('@')[0] || 'Personal'\n    const slug = `personal-${user.id}`\n    const [organization] = await db\n      .insert(organizations)\n      .values({\n        name: `${orgName}'s Organization`,\n        slug,\n        kind: 'personal',\n        createdBy: user.id,\n      })\n      .onConflictDoUpdate({\n        target: organizations.slug,\n        set: { updatedAt: new Date() },\n      })\n      .returning()\n\n    // A single-row upsert with .returning() always yields exactly one row.\n    const org = organization as OrganizationRow\n\n    const [member] = await db\n      .insert(organizationMembers)\n      .values({\n        organizationId: org.id,\n        userId: user.id,\n        role: 'owner',\n      })\n      .onConflictDoUpdate({\n        target: [organizationMembers.organizationId, organizationMembers.userId],\n        set: { role: 'owner', updatedAt: new Date() },\n      })\n      .returning()\n\n    return { organization: org, member: member as OrganizationMemberRow, role: 'owner' }\n  }\n}\n"],"mappings":";;;;;;;AAqBA,SAAS,WAAW;AACpB,SAAS,OAAO,SAAS,aAAa,MAAM,mBAAmB;AAa/D,IAAM,QAAQ,MAAM,KAAK,IAAI,EAAE,WAAW,EAAE,QAAQ,iCAAiC;AAErF,IAAM,YAAY,MAAM,QAAQ,cAAc,EAAE,MAAM,YAAY,CAAC,EAAE,QAAQ,EAAE,QAAQ,kBAAkB;AAEzG,IAAM,YAAY,MAAM,QAAQ,cAAc,EAAE,MAAM,YAAY,CAAC,EAAE,QAAQ,EAAE,QAAQ,kBAAkB;AAElG,SAAS,iBAAiB,MAA+B;AAC9D,QAAM,EAAE,WAAW,eAAe,IAAI;AAEtC,QAAM,gBAAgB,YAAY,gBAAgB;AAAA,IAChD,IAAI,MAAM;AAAA,IACV,MAAM,KAAK,MAAM,EAAE,QAAQ;AAAA,IAC3B,MAAM,KAAK,MAAM,EAAE,QAAQ,EAAE,OAAO;AAAA,IACpC,MAAM,KAAK,QAAQ,EAAE,MAAM,CAAC,YAAY,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,QAAQ,UAAU;AAAA,IAC/E,WAAW,KAAK,YAAY,EAAE,QAAQ,EAAE,WAAW,MAAM,UAAU,IAAI,EAAE,UAAU,UAAU,CAAC;AAAA,IAC9F,WAAW,UAAU;AAAA,IACrB,WAAW,UAAU;AAAA,EACvB,GAAG,CAAC,UAAU;AAAA,IACZ,MAAM,6BAA6B,EAAE,GAAG,MAAM,SAAS;AAAA,EACzD,CAAC;AAED,QAAM,sBAAsB,YAAY,uBAAuB;AAAA,IAC7D,IAAI,MAAM;AAAA,IACV,gBAAgB,KAAK,iBAAiB,EAAE,QAAQ,EAAE,WAAW,MAAM,cAAc,IAAI,EAAE,UAAU,UAAU,CAAC;AAAA,IAC5G,QAAQ,KAAK,SAAS,EAAE,QAAQ,EAAE,WAAW,MAAM,UAAU,IAAI,EAAE,UAAU,UAAU,CAAC;AAAA,IACxF,MAAM,KAAK,QAAQ,EAAE,MAAM,CAAC,SAAS,SAAS,UAAU,SAAS,EAAE,CAAC,EAAE,QAAQ,EAAE,QAAQ,QAAQ;AAAA,IAChG,WAAW,UAAU;AAAA,IACrB,WAAW,UAAU;AAAA,EACvB,GAAG,CAAC,UAAU;AAAA,IACZ,YAAY,sBAAsB,EAAE,GAAG,MAAM,gBAAgB,MAAM,MAAM;AAAA,IACzE,MAAM,qBAAqB,EAAE,GAAG,MAAM,MAAM;AAAA,EAC9C,CAAC;AAED,QAAM,mBAAmB,YAAY,oBAAoB;AAAA,IACvD,IAAI,MAAM;AAAA,IACV,aAAa,KAAK,cAAc,EAAE,QAAQ,EAAE,WAAW,MAAM,eAAe,IAAI,EAAE,UAAU,UAAU,CAAC;AAAA,IACvG,sBAAsB,KAAK,wBAAwB,EAAE,WAAW,MAAM,oBAAoB,IAAI,EAAE,UAAU,UAAU,CAAC;AAAA,IACrH,QAAQ,KAAK,SAAS,EAAE,WAAW,MAAM,UAAU,IAAI,EAAE,UAAU,UAAU,CAAC;AAAA,IAC9E,MAAM,KAAK,QAAQ,EAAE,MAAM,CAAC,SAAS,SAAS,UAAU,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,QAAQ,QAAQ;AAAA,IAC/F,WAAW,KAAK,YAAY;AAAA,IAC5B,aAAa,KAAK,cAAc;AAAA,IAChC,aAAa,KAAK,cAAc;AAAA,IAChC,WAAW,QAAQ,cAAc,EAAE,MAAM,YAAY,CAAC,EAAE,QAAQ,EAAE,QAAQ,kBAAkB;AAAA,IAC5F,YAAY,QAAQ,eAAe,EAAE,MAAM,YAAY,CAAC;AAAA,EAC1D,GAAG,CAAC,UAAU;AAAA,IACZ,YAAY,kCAAkC,EAAE,GAAG,MAAM,aAAa,MAAM,oBAAoB;AAAA,IAChG,MAAM,2BAA2B,EAAE,GAAG,MAAM,aAAa,MAAM,MAAM;AAAA,IACrE,MAAM,iBAAiB,EAAE,GAAG,MAAM,MAAM;AAAA,IACxC,YAAY,yBAAyB,EAAE,GAAG,MAAM,WAAW;AAAA,EAC7D,CAAC;AAED,SAAO,EAAE,eAAe,qBAAqB,iBAAiB;AAChE;;;ACpEA,SAAS,KAAK,MAAM,IAAI,iBAAiB;AAsDlC,SAAS,sBAAsB,MAA+C;AACnF,QAAM,EAAE,IAAI,QAAQ,eAAe,IAAI;AACvC,QAAM,EAAE,eAAe,qBAAqB,iBAAiB,IAAI;AACjE,QAAM,aAAa;AAEnB,iBAAe,mBACb,aACA,QACA,UAAyB,UACQ;AACjC,UAAM,CAAC,GAAG,IAAI,MAAM,GACjB,OAAO;AAAA,MACN,WAAW;AAAA,MACX,cAAc;AAAA,MACd,oBAAoB;AAAA,MACpB,aAAa,iBAAiB;AAAA,MAC9B,YAAY,iBAAiB;AAAA,IAC/B,CAAC,EACA,KAAK,UAAU,EACf,UAAU,eAAe,GAAG,cAAc,IAAI,WAAW,cAAc,CAAC,EACxE,UAAU,qBAAqB;AAAA,MAC9B,GAAG,oBAAoB,gBAAgB,WAAW,cAAc;AAAA,MAChE,GAAG,oBAAoB,QAAQ,MAAM;AAAA,IACvC,CAAC,EACA,SAAS,kBAAkB;AAAA,MAC1B,GAAG,iBAAiB,aAAa,WAAW,EAAE;AAAA,MAC9C,GAAG,iBAAiB,sBAAsB,oBAAoB,EAAE;AAAA,MAChE,UAAU,iBAAiB,UAAU;AAAA,IACvC,CAAC,EACA,MAAM,GAAG,WAAW,IAAI,WAAW,CAAC,EACpC,MAAM,CAAC;AAEV,QAAI,CAAC,IAAK,QAAO;AAEjB,UAAM,OAAO,qBAAqB,IAAI,mBAAmB,MAAM,IAAI,WAAmC;AACtG,QAAI,CAAC,KAAM,QAAO;AAClB,QAAI,CAAC,iBAAiB,MAAM,OAAO,EAAG,QAAO;AAE7C,WAAO;AAAA,MACL,WAAW,IAAI;AAAA,MACf,cAAc,IAAI;AAAA,MAClB,oBAAoB,IAAI;AAAA,MACxB;AAAA,IACF;AAAA,EACF;AAEA,iBAAe,uBACb,aACA,QACA,UAAyB,UACC;AAC1B,UAAM,SAAS,MAAM,mBAAmB,aAAa,QAAQ,OAAO;AACpE,QAAI,CAAC,OAAQ,OAAM,IAAI,SAAS,uBAAuB,EAAE,QAAQ,IAAI,CAAC;AACtE,WAAO;AAAA,EACT;AAEA,iBAAe,mBAAmB,QAAiD;AACjF,UAAM,OAAO,MAAM,GAChB,OAAO;AAAA,MACN,WAAW;AAAA,MACX,cAAc;AAAA,MACd,oBAAoB;AAAA,MACpB,aAAa,iBAAiB;AAAA,IAChC,CAAC,EACA,KAAK,UAAU,EACf,UAAU,eAAe,GAAG,cAAc,IAAI,WAAW,cAAc,CAAC,EACxE,UAAU,qBAAqB;AAAA,MAC9B,GAAG,oBAAoB,gBAAgB,WAAW,cAAc;AAAA,MAChE,GAAG,oBAAoB,QAAQ,MAAM;AAAA,IACvC,CAAC,EACA,SAAS,kBAAkB;AAAA,MAC1B,GAAG,iBAAiB,aAAa,WAAW,EAAE;AAAA,MAC9C,GAAG,iBAAiB,sBAAsB,oBAAoB,EAAE;AAAA,MAChE,UAAU,iBAAiB,UAAU;AAAA,IACvC,CAAC,EAGA,QAAQ,KAAK,WAAW,SAAS,CAAC;AAErC,WAAO,KAAK,QAAQ,CAAC,QAAa;AAChC,YAAM,OAAO,qBAAqB,IAAI,mBAAmB,MAAM,IAAI,WAAmC;AACtG,UAAI,CAAC,KAAM,QAAO,CAAC;AACnB,aAAO,CAAC;AAAA,QACN,GAAI,IAAI;AAAA,QACR,gBAAgB,IAAI,aAAa;AAAA,QACjC,kBAAkB,IAAI,aAAa;AAAA,QACnC;AAAA,MACF,CAAyB;AAAA,IAC3B,CAAC;AAAA,EACH;AAEA,SAAO,EAAE,oBAAoB,wBAAwB,mBAAmB;AAC1E;AAkBO,SAAS,yBAAyB,MAA8D;AACrG,QAAM,EAAE,IAAI,OAAO,IAAI;AACvB,QAAM,EAAE,eAAe,oBAAoB,IAAI;AAE/C,iBAAe,sBACb,gBACA,QACA,UAA4B,UACQ;AACpC,UAAM,CAAC,GAAG,IAAI,MAAM,GACjB,OAAO;AAAA,MACN,cAAc;AAAA,MACd,QAAQ;AAAA,IACV,CAAC,EACA,KAAK,mBAAmB,EACxB,UAAU,eAAe,GAAG,cAAc,IAAI,oBAAoB,cAAc,CAAC,EACjF,MAAM;AAAA,MACL,GAAG,oBAAoB,gBAAgB,cAAc;AAAA,MACrD,GAAG,oBAAoB,QAAQ,MAAM;AAAA,IACvC,CAAC,EACA,MAAM,CAAC;AAEV,QAAI,CAAC,IAAK,QAAO;AACjB,UAAM,OAAO,IAAI,OAAO;AACxB,QAAI,CAAC,oBAAoB,MAAM,OAAO,EAAG,QAAO;AAChD,WAAO,EAAE,cAAc,IAAI,cAAc,QAAQ,IAAI,QAAQ,KAAK;AAAA,EACpE;AAEA,iBAAe,0BACb,gBACA,QACA,UAA4B,UACC;AAC7B,UAAM,SAAS,MAAM,sBAAsB,gBAAgB,QAAQ,OAAO;AAC1E,QAAI,CAAC,OAAQ,OAAM,IAAI,SAAS,0BAA0B,EAAE,QAAQ,IAAI,CAAC;AACzE,WAAO;AAAA,EACT;AAEA,SAAO,EAAE,uBAAuB,0BAA0B;AAC5D;;;AC1MA,SAAS,OAAAA,MAAK,MAAAC,WAAU;AAsBjB,SAAS,iCAAiC,MAAyC;AACxF,QAAM,EAAE,IAAI,OAAO,IAAI;AACvB,QAAM,EAAE,eAAe,oBAAoB,IAAI;AAE/C,SAAO,eAAe,2BACpB,MACqC;AACrC,UAAM,CAAC,QAAQ,IAAI,MAAM,GACtB,OAAO;AAAA,MACN,cAAc;AAAA,MACd,QAAQ;AAAA,IACV,CAAC,EACA,KAAK,mBAAmB,EACxB,UAAU,eAAeA,IAAG,cAAc,IAAI,oBAAoB,cAAc,CAAC,EACjF,MAAMD;AAAA,MACLC,IAAG,oBAAoB,QAAQ,KAAK,EAAE;AAAA,MACtCA,IAAG,cAAc,MAAM,UAAU;AAAA,IACnC,CAAC,EACA,MAAM,CAAC;AAEV,QAAI,UAAU;AACZ,aAAO;AAAA,QACL,cAAc,SAAS;AAAA,QACvB,QAAQ,SAAS;AAAA,QACjB,MAAM,SAAS,OAAO;AAAA,MACxB;AAAA,IACF;AAEA,UAAM,UAAU,KAAK,MAAM,KAAK,KAAK,KAAK,OAAO,MAAM,GAAG,EAAE,CAAC,KAAK;AAClE,UAAM,OAAO,YAAY,KAAK,EAAE;AAChC,UAAM,CAAC,YAAY,IAAI,MAAM,GAC1B,OAAO,aAAa,EACpB,OAAO;AAAA,MACN,MAAM,GAAG,OAAO;AAAA,MAChB;AAAA,MACA,MAAM;AAAA,MACN,WAAW,KAAK;AAAA,IAClB,CAAC,EACA,mBAAmB;AAAA,MAClB,QAAQ,cAAc;AAAA,MACtB,KAAK,EAAE,WAAW,oBAAI,KAAK,EAAE;AAAA,IAC/B,CAAC,EACA,UAAU;AAGb,UAAM,MAAM;AAEZ,UAAM,CAAC,MAAM,IAAI,MAAM,GACpB,OAAO,mBAAmB,EAC1B,OAAO;AAAA,MACN,gBAAgB,IAAI;AAAA,MACpB,QAAQ,KAAK;AAAA,MACb,MAAM;AAAA,IACR,CAAC,EACA,mBAAmB;AAAA,MAClB,QAAQ,CAAC,oBAAoB,gBAAgB,oBAAoB,MAAM;AAAA,MACvE,KAAK,EAAE,MAAM,SAAS,WAAW,oBAAI,KAAK,EAAE;AAAA,IAC9C,CAAC,EACA,UAAU;AAEb,WAAO,EAAE,cAAc,KAAK,QAAyC,MAAM,QAAQ;AAAA,EACrF;AACF;","names":["and","eq"]}

package/dist/teams/index.d.ts

@@ -0,0 +1,44 @@
+export { A as ASSIGNABLE_WORKSPACE_ROLES, a as AssignableWorkspaceRole, b as ORGANIZATION_ROLES, c as ORGANIZATION_ROLE_RANK, O as OrganizationRole, S as SandboxWorkspaceRole, W as WORKSPACE_ROLES, d as WORKSPACE_ROLE_RANK, e as WorkspaceCollaborationAccess, f as WorkspaceRole, g as canManageWorkspaceMemberRole, h as hasOrganizationRole, i as hasWorkspaceRole, j as isAssignableWorkspaceRole, o as organizationRoleGrantsWorkspaceOwner, r as resolveWorkspaceRole, w as workspaceRoleToCollaborationAccess, k as workspaceRoleToSandboxRole } from '../roles-CLtYKHHl.js';
+
+/**
+ * Pure invite-token helpers — generation, shape validation, and expiry math.
+ * No I/O: the members API persists/looks up tokens; these functions only
+ * produce well-formed tokens and decide, given values the caller already
+ * loaded, whether an invite is usable.
+ *
+ * A token is an opaque high-entropy URL-safe string. It is the bearer secret
+ * in `/invite/:token`, so it must be unguessable and never derived from the
+ * email or workspace. `generateInviteToken` uses Web Crypto (`crypto`), which
+ * is present in Workers, Node 18+, Deno, and browsers — no Node-only import,
+ * so this stays a pure leaf.
+ */
+/** Cryptographically-random, URL-safe (base64url) invite token. */
+declare function generateInviteToken(): string;
+/** True when `value` has the shape of an invite token (not whether it exists). */
+declare function isInviteTokenShape(value: unknown): value is string;
+/** A pending invite row, narrowed to the fields invite acceptance reasons over. */
+interface InviteTokenState {
+    /** null until accepted — a non-null value means the invite was already used. */
+    acceptedAt: Date | number | null | undefined;
+    /** Email the invite was addressed to, if any. */
+    inviteEmail?: string | null;
+    /** Optional hard expiry; omit/undefined for invites that never expire. */
+    expiresAt?: Date | number | null;
+}
+type InviteRejectionReason = 'already-accepted' | 'expired' | 'email-mismatch';
+interface InviteValidationResult {
+    ok: boolean;
+    reason?: InviteRejectionReason;
+}
+/**
+ * Decide whether a loaded invite can be accepted by `acceptingEmail` at `now`.
+ * Pure: the caller has already fetched the row by token; this only judges it.
+ * Email match is case-insensitive and only enforced when the invite was
+ * addressed to a specific email (an open invite has no `inviteEmail`).
+ */
+declare function validateInviteToken(invite: InviteTokenState, opts?: {
+    acceptingEmail?: string | null;
+    now?: Date;
+}): InviteValidationResult;
+
+export { type InviteRejectionReason, type InviteTokenState, type InviteValidationResult, generateInviteToken, isInviteTokenShape, validateInviteToken };

package/dist/teams/index.js

@@ -0,0 +1,39 @@
+import {
+  generateInviteToken,
+  isInviteTokenShape,
+  validateInviteToken
+} from "../chunk-3SVAA3MA.js";
+import {
+  ASSIGNABLE_WORKSPACE_ROLES,
+  ORGANIZATION_ROLES,
+  ORGANIZATION_ROLE_RANK,
+  WORKSPACE_ROLES,
+  WORKSPACE_ROLE_RANK,
+  canManageWorkspaceMemberRole,
+  hasOrganizationRole,
+  hasWorkspaceRole,
+  isAssignableWorkspaceRole,
+  organizationRoleGrantsWorkspaceOwner,
+  resolveWorkspaceRole,
+  workspaceRoleToCollaborationAccess,
+  workspaceRoleToSandboxRole
+} from "../chunk-63CE7FEZ.js";
+export {
+  ASSIGNABLE_WORKSPACE_ROLES,
+  ORGANIZATION_ROLES,
+  ORGANIZATION_ROLE_RANK,
+  WORKSPACE_ROLES,
+  WORKSPACE_ROLE_RANK,
+  canManageWorkspaceMemberRole,
+  generateInviteToken,
+  hasOrganizationRole,
+  hasWorkspaceRole,
+  isAssignableWorkspaceRole,
+  isInviteTokenShape,
+  organizationRoleGrantsWorkspaceOwner,
+  resolveWorkspaceRole,
+  validateInviteToken,
+  workspaceRoleToCollaborationAccess,
+  workspaceRoleToSandboxRole
+};
+//# sourceMappingURL=index.js.map

package/dist/teams/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}